Publish curated VacatureRadar source snapshot

apps/sources/services/tls.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+import ssl
+from functools import lru_cache
+from pathlib import Path
+
+import certifi
+
+
+@lru_cache(maxsize=1)
+def trusted_tls_context() -> ssl.SSLContext:
+    """Build a strict TLS context from the pinned application CA bundle."""
+    bundle = Path(certifi.where()).resolve(strict=True)
+    if not bundle.is_file():
+        raise RuntimeError("De vertrouwde CA-bundel ontbreekt.")
+    return ssl.create_default_context(cafile=str(bundle))