imprimatur 0.4.0 → 0.6.0

data/ext/imprimatur_native/core/src/read/pdf/isolation.rs

@@ -0,0 +1,166 @@
+//! Render in a separate, resource-limited process. No untrusted PDF parsing
+//! occurs in the supervisor.
+
+mod protocol;
+mod system;
+#[cfg(test)]
+mod tests;
+mod worker;
+
+use std::fs::{self, File};
+use std::io::{Read, Write};
+use std::os::unix::process::CommandExt;
+use std::path::Path;
+use std::process::{Child, Command, ExitStatus, Stdio};
+use std::time::{Duration, Instant};
+
+use super::RenderOptions;
+use crate::read::{Budget, Image, Limits};
+use crate::{Error, Result};
+pub use worker::worker_main;
+
+/// Mandatory process limits, in addition to the reader/render limits.
+#[derive(Debug, Clone)]
+pub struct ProcessLimits {
+    /// Address-space cap on Linux/FreeBSD; RSS watchdog threshold on macOS.
+    pub memory_bytes: u64,
+    /// A finite upper bound even when the reader's timeout is disabled.
+    pub wall_time: Duration,
+}
+
+impl Default for ProcessLimits {
+    fn default() -> Self {
+        Self { memory_bytes: 1024 * 1024 * 1024, wall_time: Duration::from_mins(1) }
+    }
+}
+
+/// Renders through the explicitly selected, trusted worker executable.
+///
+/// The child is killed and reaped on timeout, cancellation, resource failure
+/// or supervisor errors. Missing workers never fall back to in-process work.
+/// macOS uses a sampled RSS watchdog and may briefly overshoot its threshold.
+///
+/// # Errors
+/// Invalid limits, failed worker startup/protocol, render errors, or exceeded
+/// input/output, process memory or wall-clock limits.
+pub fn render_page_isolated(
+    worker: &Path,
+    data: &[u8],
+    number: u32,
+    options: &RenderOptions,
+    limits: &Limits,
+    process: &ProcessLimits,
+) -> Result<Image> {
+    let budget = Budget::new(limits, data.len())?;
+    budget.check()?;
+    let deadline = Instant::now()
+        .checked_add(process.wall_time)
+        .ok_or(Error::InvalidPdfOption("worker wall time is too large"))?;
+    if !worker.is_absolute() || !worker.is_file() {
+        return Err(Error::InvalidPdfOption("an absolute path to the render worker is required"));
+    }
+    if process.memory_bytes == 0 || process.wall_time.is_zero() || number == 0 {
+        return Err(Error::InvalidPdfOption("process limits and page number must be positive"));
+    }
+    let request = protocol::Request::new(number, options, limits, process)?;
+    let directory = tempfile::tempdir()?;
+    let input_path = directory.path().join("input.pdf");
+    File::create(&input_path)?.write_all(data)?;
+    let output_path = directory.path().join("output");
+    let error_path = directory.path().join("stderr");
+    check(&budget, deadline)?;
+    let child = Command::new(worker)
+        .args(request.arguments())
+        .stdin(Stdio::from(File::open(&input_path)?))
+        .stdout(Stdio::from(File::create(&output_path)?))
+        .stderr(Stdio::from(File::create(&error_path)?))
+        .process_group(0)
+        .spawn()?;
+    let mut child = Running { child, finished: false };
+    let status = supervise(&mut child, &budget, deadline, process.memory_bytes)?;
+    if !status.success() {
+        return Err(Error::LimitExceeded("render worker resources"));
+    }
+    let maximum = options
+        .max_output_bytes
+        .max(protocol::MAX_ERROR_BYTES)
+        .checked_add(protocol::HEADER.len())
+        .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+    let maximum = u64::try_from(maximum).unwrap_or(u64::MAX);
+    if fs::metadata(&output_path)?.len() > maximum {
+        return Err(Error::LimitExceeded("render worker output"));
+    }
+    let mut output = Vec::new();
+    File::open(output_path)?.take(maximum).read_to_end(&mut output)?;
+    check_finished(&budget, deadline)?;
+    let data = protocol::decode(output, options.max_output_bytes)?;
+    // The trusted worker writes only PNG; also reject malformed/empty replies.
+    if !data.starts_with(b"\x89PNG\r\n\x1a\n") || data.len() < 26 {
+        return Err(Error::malformed("render worker", "invalid PNG response"));
+    }
+    let dimension = |at| u32::from_be_bytes(data[at..at + 4].try_into().unwrap_or([0; 4]));
+    let (width, height) = (dimension(16), dimension(20));
+    options.image(data, number, (width, height))
+}
+
+fn check(budget: &Budget<'_>, deadline: Instant) -> Result<()> {
+    budget.check()?;
+    check_finished(budget, deadline)
+}
+
+fn check_finished(budget: &Budget<'_>, deadline: Instant) -> Result<()> {
+    budget.check_time()?;
+    if Instant::now() >= deadline {
+        return Err(Error::LimitExceeded("render worker wall time"));
+    }
+    Ok(())
+}
+
+struct Running {
+    child: Child,
+    finished: bool,
+}
+
+impl Running {
+    fn poll(&mut self) -> Result<Option<ExitStatus>> {
+        let status = self.child.try_wait()?;
+        self.finished = status.is_some();
+        Ok(status)
+    }
+}
+
+impl Drop for Running {
+    fn drop(&mut self) {
+        if !self.finished {
+            system::terminate(&mut self.child);
+        }
+    }
+}
+
+fn supervise(
+    child: &mut Running,
+    budget: &Budget<'_>,
+    deadline: Instant,
+    memory: u64,
+) -> Result<ExitStatus> {
+    #[cfg(not(target_os = "macos"))]
+    let _ = memory;
+
+    loop {
+        // SIGCHLD can invoke Ruby's unblock callback. Prefer a completed
+        // worker; the binding checks pending Ruby exceptions before returning.
+        if let Some(status) = child.poll()? {
+            return Ok(status);
+        }
+        check(budget, deadline)?;
+        #[cfg(target_os = "macos")]
+        if let Err(error) = system::check_memory(child.child.id(), memory) {
+            // It may have exited between try_wait and the memory query.
+            if let Some(status) = child.poll()? {
+                return Ok(status);
+            }
+            return Err(error);
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}

data/ext/imprimatur_native/core/src/read/pdf/render.rs

@@ -0,0 +1,206 @@
+//! Full-page rasterization. Optional, pure Rust, and independent of text extraction.
+
+#[cfg(test)]
+mod tests;
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use hayro::hayro_interpret::InterpreterSettings;
+use hayro::hayro_syntax::{LoadPdfError, Pdf};
+use hayro::vello_cpu::color::palette::css::WHITE;
+use hayro::{PixmapSettings, RenderCache, RenderSettings};
+
+use super::bounded;
+use super::content::{Drawing, page_images};
+use crate::read::image::{Image, ImageFormat, ImageLocation, PngColor, png};
+use crate::read::{Budget, Limits};
+use crate::{Error, Result};
+
+#[derive(Debug, Clone)]
+pub struct RenderOptions {
+    /// Longest output side in pixels; 1568 by default.
+    pub max_side: u16,
+    /// Maximum output surface, before allocating it.
+    pub max_pixels: u64,
+    pub max_output_bytes: usize,
+    pub grayscale: bool,
+}
+
+impl Default for RenderOptions {
+    fn default() -> Self {
+        Self {
+            max_side: 1568,
+            max_pixels: 4_000_000,
+            max_output_bytes: 8 * 1024 * 1024,
+            grayscale: true,
+        }
+    }
+}
+
+impl RenderOptions {
+    pub(super) fn check_pixels(&self, width: u32, height: u32) -> Result<()> {
+        if width == 0 || height == 0 || u64::from(width) * u64::from(height) > self.max_pixels {
+            return Err(Error::LimitExceeded("rendered pixels"));
+        }
+        Ok(())
+    }
+
+    pub(super) fn image(&self, data: Vec<u8>, number: u32, size: (u32, u32)) -> Result<Image> {
+        self.check_pixels(size.0, size.1)?;
+        if data.len() > self.max_output_bytes {
+            return Err(Error::LimitExceeded("rendered bytes"));
+        }
+        Ok(Image {
+            data,
+            format: ImageFormat::Png,
+            width: Some(size.0),
+            height: Some(size.1),
+            location: ImageLocation::Page { number, bounds: None },
+        })
+    }
+}
+
+/// A one-based page, including native text and graphics, as an opaque PNG.
+///
+/// Output dimensions and encoded bytes are bounded. Hayro has no cancellation
+/// hook: time/cancellation are checked before and after rasterization, not
+/// during it. Use `isolation::render_page_isolated` for untrusted renders.
+/// `max_inflated` bounds our preflight, not Hayro's internal allocations.
+///
+/// # Errors
+/// As [`super::info`], invalid options/page number, an oversized surface or
+/// output, and renderer warnings (rather than silently missing content).
+pub fn render_page(
+    data: &[u8],
+    number: u32,
+    options: &RenderOptions,
+    limits: &Limits,
+) -> Result<Image> {
+    if number == 0
+        || options.max_side == 0
+        || options.max_pixels == 0
+        || options.max_output_bytes == 0
+    {
+        return Err(Error::InvalidPdfOption("page number and rendering limits must be positive"));
+    }
+    let budget = Budget::new(limits, data.len())?;
+    let inspected = bounded::info(data, limits)?;
+    if number > inspected.page_count {
+        return Err(Error::InvalidPdfOption("page number is past the end of the document"));
+    }
+    budget.check()?;
+    preflight(data, number, &budget)?;
+    catch_unwind(AssertUnwindSafe(|| render(data, number, options, &budget)))
+        .unwrap_or_else(|_| Err(Error::malformed("PDF", "the renderer failed on this page")))
+}
+
+fn preflight(data: &[u8], number: u32, budget: &Budget<'_>) -> Result<()> {
+    let document = bounded::open(data, budget)?;
+    let selected = document.select_pages(number, number, 1)?;
+    let (_, page) = selected
+        .pages
+        .into_iter()
+        .next()
+        .ok_or(Error::InvalidPdfOption("page number is past the end of the document"))?;
+    let mut drawn = Vec::new();
+    page_images(&document, &page?, &mut drawn)?;
+    let mut pixels = 0_u64;
+    for image in drawn {
+        budget.check()?;
+        let dict = match &image.image {
+            Drawing::Object { object, .. } => object.as_dict(),
+            Drawing::Inline { dict, .. } => Some(dict),
+        }
+        .ok_or_else(|| Error::malformed("PDF", "invalid image dictionary"))?;
+        let dimension = |full: &[u8], short: &[u8]| -> Result<u64> {
+            let value = document.entry(dict, full)?.or(document.entry(dict, short)?);
+            let value = value
+                .and_then(|value| value.as_integer())
+                .and_then(|value| u64::try_from(value).ok());
+            value
+                .filter(|&value| value != 0)
+                .ok_or_else(|| Error::malformed("PDF", "invalid image dimensions"))
+        };
+        let size = dimension(b"Width", b"W")?
+            .checked_mul(dimension(b"Height", b"H")?)
+            .ok_or(Error::LimitExceeded("source image pixels"))?;
+        pixels = pixels.saturating_add(size);
+        if pixels > 40_000_000 {
+            return Err(Error::LimitExceeded("source image pixels"));
+        }
+    }
+    Ok(())
+}
+
+fn render(data: &[u8], number: u32, options: &RenderOptions, budget: &Budget<'_>) -> Result<Image> {
+    let pdf = Pdf::new(data.to_vec()).map_err(|error| match error {
+        LoadPdfError::Decryption(_) => Error::PasswordRequired,
+        LoadPdfError::Invalid => Error::malformed("PDF", "the renderer cannot open this document"),
+    })?;
+    budget.check()?;
+    let page = pdf.pages().get(number as usize - 1).ok_or_else(|| {
+        Error::malformed("PDF", "the renderer's page tree differs from the reader's")
+    })?;
+    let (width, height) = page.render_dimensions();
+    if !width.is_finite() || !height.is_finite() || width <= 0.0 || height <= 0.0 {
+        return Err(Error::malformed("PDF", "invalid page dimensions"));
+    }
+    let scale = f32::from(options.max_side) / width.max(height);
+    let pixels = |side: f32| (side * scale).floor().max(1.0).min(f32::from(options.max_side));
+    let (target_width, target_height) = (pixels(width), pixels(height));
+    #[expect(
+        clippy::cast_possible_truncation,
+        clippy::cast_sign_loss,
+        reason = "bounded by max_side"
+    )]
+    let (w, h) = (target_width as u32, target_height as u32);
+    options.check_pixels(w, h)?;
+    let warned = Arc::new(AtomicBool::new(false));
+    let warning = Arc::clone(&warned);
+    let settings = InterpreterSettings {
+        warning_sink: Arc::new(move |_| {
+            warning.store(true, Ordering::Relaxed);
+        }),
+        ..InterpreterSettings::default()
+    };
+    let pixmap = hayro::render(
+        page,
+        &RenderCache::new(),
+        &settings,
+        &RenderSettings::default(),
+        &PixmapSettings {
+            x_scale: target_width / width,
+            y_scale: target_height / height,
+            bg_color: WHITE,
+        },
+    );
+    budget.check()?;
+    if warned.load(Ordering::Relaxed) {
+        return Err(Error::UnsupportedDocument(
+            "the renderer could not render all page content".into(),
+        ));
+    }
+    let (w, h) = (u32::from(pixmap.width()), u32::from(pixmap.height()));
+    options.check_pixels(w, h)?;
+    let rgba = pixmap.data_as_u8_slice();
+    let encoded = if options.grayscale {
+        let gray: Vec<u8> = rgba
+            .as_chunks::<4>()
+            .0
+            .iter()
+            .map(|pixel| {
+                let value = u32::from(pixel[0]) * 299
+                    + u32::from(pixel[1]) * 587
+                    + u32::from(pixel[2]) * 114;
+                u8::try_from(value / 1000).unwrap_or(255)
+            })
+            .collect();
+        png(w, h, PngColor::Gray, 8, None, &gray)
+    } else {
+        png(w, h, PngColor::Rgba, 8, None, rgba)
+    };
+    budget.check()?;
+    options.image(encoded, number, (w, h))
+}

data/ext/imprimatur_native/core/src/read/pdf.rs

@@ -1,8 +1,11 @@
-//! PDF: the text layer as Markdown. Every page's content runs through a
+//! PDF inspection, bounded text reads and optional full-page rendering.
+//!
+//! Every page's content runs through a
 //! small interpreter that places each glyph; layout turns the glyphs into
 //! lines, paragraphs and headings. Scanned pages have no text layer:
 //! they are images, and need OCR.
 
+mod bounded;
 mod cmap;
 mod content;
 mod crypt;
@@ -18,20 +21,28 @@ mod object;
 mod tests;
 mod xref;
 
+pub use bounded::{Info, PageResult, Pages, ReadOptions, Status, info, pages};
+#[cfg(feature = "render")]
+mod render;
+#[cfg(feature = "render")]
+pub use render::{RenderOptions, render_page};
+#[cfg(all(feature = "isolation", unix))]
+pub mod isolation;
+
 use super::Budget;
 use super::content::Page;
-use crate::{Error, Result};
+use crate::Result;
 use content::{Fonts, PageText};
 use document::Document;
-pub use images::images;
+pub(super) use images::images;
 use xref::is_limit;
 
 /// `%PDF-` within the first kilobyte, where readers look for it.
-pub fn is_pdf(document: &[u8]) -> bool {
+pub(super) fn is_pdf(document: &[u8]) -> bool {
     document[..document.len().min(1024)].windows(5).any(|window| window == b"%PDF-")
 }
 
-pub fn content(data: &[u8], budget: &Budget<'_>) -> Result<Vec<Page>> {
+pub(super) fn content(data: &[u8], budget: &Budget<'_>) -> Result<Vec<Page>> {
     let document = Document::open(data, budget)?;
     let pages = document.pages()?;
     let mut fonts = Fonts::new();
@@ -46,8 +57,5 @@ pub fn content(data: &[u8], budget: &Budget<'_>) -> Result<Vec<Page>> {
             Err(_) => lines.push(layout::PageLines::default()),
         }
     }
-    if lines.iter().all(|page| page.text.trim().is_empty()) {
-        return Err(Error::NoTextLayer);
-    }
     Ok(layout::pages(&lines))
 }

data/ext/imprimatur_native/core/src/read/xls/strings.rs

@@ -3,6 +3,7 @@
 //! across `CONTINUE` records.
 
 use crate::Result;
+use crate::bytes::u16_le;
 use crate::pdf::metrics::WIN_ANSI_HIGH;
 use crate::read::Budget;
 
@@ -19,7 +20,7 @@ pub enum Encoding {
 /// the end.
 pub fn string(bytes: &[u8], at: usize, wide_count: bool, encoding: Encoding) -> Option<String> {
     let (count, at) = if wide_count {
-        (usize::from(u16::from_le_bytes(bytes.get(at..at + 2)?.try_into().ok()?)), at + 2)
+        (usize::from(u16_le(bytes, at)?), at + 2)
     } else {
         (usize::from(*bytes.get(at)?), at + 1)
     };

data/ext/imprimatur_native/core/src/read/xls.rs

@@ -13,6 +13,7 @@ use super::Budget;
 use super::content::{Grid, Sheet, Value};
 use super::numbers::{Shown, built_in, classify, push_number};
 use super::ole::Ole;
+use crate::bytes::{u16_le as u16_at, u32_le as u32_at};
 use crate::{Error, Result};
 use strings::Encoding;
 
@@ -70,14 +71,6 @@ fn records(data: &[u8], mut at: usize) -> impl Iterator<Item = (u16, &[u8])> {
     })
 }
 
-fn u16_at(body: &[u8], at: usize) -> Option<u16> {
-    Some(u16::from_le_bytes(body.get(at..at + 2)?.try_into().ok()?))
-}
-
-fn u32_at(body: &[u8], at: usize) -> Option<u32> {
-    Some(u32::from_le_bytes(body.get(at..at + 4)?.try_into().ok()?))
-}
-
 /// A worksheet the workbook lists.
 struct Listed {
     name: String,

data/ext/imprimatur_native/core/src/read.rs

@@ -25,7 +25,7 @@ mod numbers;
 mod ods;
 mod ole;
 mod package;
-mod pdf;
+pub mod pdf;
 mod span;
 #[cfg(test)]
 mod tests;
@@ -82,8 +82,7 @@ impl Format {
 ///
 /// # Errors
 /// [`Error::UnsupportedDocument`] for other formats (legacy `.doc`, binary
-/// `.xlsb`, presentations, ODF text), [`Error::NoTextLayer`] for a
-/// PDF of scanned pages, [`Error::PasswordRequired`] for a document that
+/// `.xlsb`, presentations, ODF text), [`Error::PasswordRequired`] for a document that
 /// needs one, [`Error::LimitExceeded`] and [`Error::Cancelled`] when the
 /// [`Limits`] stop the read, and [`Error::Malformed`] for a corrupt document.
 pub fn content(document: &[u8], limits: &Limits) -> Result<Content> {
@@ -117,9 +116,11 @@ pub fn content(document: &[u8], limits: &Limits) -> Result<Content> {
 /// [`Content::to_markdown`].
 ///
 /// # Errors
-/// As [`content`].
+/// As [`content`], and [`Error::NoTextLayer`] for a PDF without text.
 pub fn markdown(document: &[u8], limits: &Limits) -> Result<String> {
-    content(document, limits).map(|content| content.to_markdown())
+    let content = content(document, limits)?;
+    content.ensure_text_layer()?;
+    Ok(content.to_markdown())
 }
 
 /// Calls `each` with every image in a document, as a file.

data/ext/imprimatur_native/core/src/test_support/font.rs

@@ -0,0 +1,37 @@
+//! Font fixture mutations.
+
+#![cfg(test)]
+
+use read_fonts::{FontRef, types::Tag};
+
+pub fn record(data: &[u8], tag: [u8; 4]) -> usize {
+    let font = FontRef::new(data).unwrap();
+    let index = font
+        .table_directory()
+        .table_records()
+        .iter()
+        .position(|record| record.tag() == Tag::new(&tag))
+        .unwrap();
+    12 + 16 * index
+}
+
+pub fn offset(data: &[u8], tag: [u8; 4]) -> usize {
+    let record = record(data, tag);
+    u32::from_be_bytes(data[record + 8..record + 12].try_into().unwrap()) as usize
+}
+
+pub fn set_u16(data: &mut [u8], tag: [u8; 4], at: usize, value: u16) {
+    let start = offset(data, tag) + at;
+    data[start..start + 2].copy_from_slice(&value.to_be_bytes());
+}
+
+/// Replaces a table, leaving checksums stale for malformed-input tests.
+pub fn replace(data: &mut Vec<u8>, tag: [u8; 4], table: &[u8]) {
+    let record = record(data, tag);
+    data.resize(data.len().next_multiple_of(4), 0);
+    let start = u32::try_from(data.len()).unwrap();
+    let length = u32::try_from(table.len()).unwrap();
+    data[record + 8..record + 12].copy_from_slice(&start.to_be_bytes());
+    data[record + 12..record + 16].copy_from_slice(&length.to_be_bytes());
+    data.extend_from_slice(table);
+}

data/ext/imprimatur_native/core/src/xlsx/validation.rs

@@ -57,24 +57,36 @@ pub struct Validation {
     allow_blank: bool,
     dropdown: bool,
     alert: Alert,
-    prompt_title: Option<String>,
-    prompt: Option<String>,
-    error_title: Option<String>,
-    error: Option<String>,
+    prompt: Message,
+    error: Message,
+}
+
+/// A prompt or alert.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
+struct Message {
+    title: Option<String>,
+    body: Option<String>,
+}
+
+impl Message {
+    fn new(kind: &str, title: String, body: String) -> Result<Self> {
+        Ok(Self {
+            title: text(&format!("{kind} title"), title, MAX_TITLE)?,
+            body: text(kind, body, MAX_MESSAGE)?,
+        })
+    }
 }
 
 impl Validation {
-    const fn new(kind: Kind, formula: String) -> Self {
+    fn new(kind: Kind, formula: String) -> Self {
         Self {
             kind,
             formula,
             allow_blank: true,
             dropdown: true,
             alert: Alert::Stop,
-            prompt_title: None,
-            prompt: None,
-            error_title: None,
-            error: None,
+            prompt: Message::default(),
+            error: Message::default(),
         }
     }
 
@@ -155,8 +167,7 @@ impl Validation {
     /// [`Error::InvalidValidation`] for a title over 32 characters or a
     /// message over 255.
     pub fn prompt(mut self, title: impl Into<String>, message: impl Into<String>) -> Result<Self> {
-        self.prompt_title = text("prompt title", title.into(), MAX_TITLE)?;
-        self.prompt = text("prompt", message.into(), MAX_MESSAGE)?;
+        self.prompt = Message::new("prompt", title.into(), message.into())?;
         Ok(self)
     }
 
@@ -166,8 +177,7 @@ impl Validation {
     /// # Errors
     /// As [`prompt`](Self::prompt).
     pub fn error(mut self, title: impl Into<String>, message: impl Into<String>) -> Result<Self> {
-        self.error_title = text("error title", title.into(), MAX_TITLE)?;
-        self.error = text("error", message.into(), MAX_MESSAGE)?;
+        self.error = Message::new("error", title.into(), message.into())?;
         Ok(self)
     }
 
@@ -193,17 +203,17 @@ impl Validation {
         if self.kind == Kind::List && !self.dropdown {
             attrs.push(("showDropDown", "1"));
         }
-        if self.prompt_title.is_some() || self.prompt.is_some() {
+        if self.prompt.title.is_some() || self.prompt.body.is_some() {
             attrs.push(("showInputMessage", "1"));
         }
         if self.alert != Alert::Off {
             attrs.push(("showErrorMessage", "1"));
         }
         let texts = [
-            ("errorTitle", &self.error_title),
-            ("error", &self.error),
-            ("promptTitle", &self.prompt_title),
-            ("prompt", &self.prompt),
+            ("errorTitle", &self.error.title),
+            ("error", &self.error.body),
+            ("promptTitle", &self.prompt.title),
+            ("prompt", &self.prompt.body),
         ]
         .map(|(name, value)| (name, value.as_deref().map(escape)));
         for (name, value) in &texts {

data/ext/imprimatur_native/core/src/zip/reader.rs

@@ -8,6 +8,7 @@ mod tests;
 use super::{
     CENTRAL_HEADER, END_OF_CENTRAL_DIRECTORY, LOCAL_HEADER, METHOD_DEFLATED, METHOD_STORED,
 };
+use crate::bytes::{u16_le as u16_at, u32_le as u32_at};
 use crate::read::Budget;
 use crate::{Error, Result};
 
@@ -131,14 +132,6 @@ impl<'a> ZipReader<'a> {
     }
 }
 
-fn u16_at(data: &[u8], at: usize) -> Option<u16> {
-    Some(u16::from_le_bytes(data.get(at..at + 2)?.try_into().ok()?))
-}
-
-fn u32_at(data: &[u8], at: usize) -> Option<u32> {
-    Some(u32::from_le_bytes(data.get(at..at + 4)?.try_into().ok()?))
-}
-
 fn malformed(reason: &str) -> Error {
     Error::malformed("zip", reason)
 }

data/ext/imprimatur_native/extconf.rb

@@ -23,6 +23,24 @@ create_rust_makefile('imprimatur/imprimatur_native') do |r|
   r.profile = ENV.fetch('RB_SYS_CARGO_PROFILE', :release).to_sym
 end
 
+# Build an ordinary executable, not a Ruby cdylib with Ruby's linker flags.
+File.open('Makefile', 'a') do |make|
+  make.write <<~MAKE
+
+    .PHONY: render-worker install-render-worker
+    RENDER_WORKER_MANIFEST = $(RB_SYS_CARGO_MANIFEST_DIR)/../core/Cargo.toml
+    all: render-worker
+    render-worker:
+    \t$(CARGO) build --manifest-path "$(RENDER_WORKER_MANIFEST)" \\
+    \t  --bin imprimatur-render-worker --features isolation $(RB_SYS_CARGO_PROFILE_FLAG) \\
+    \t  --target-dir "$(RB_SYS_CARGO_TARGET_DIR)" $(if $(CARGO_BUILD_TARGET),--target $(CARGO_BUILD_TARGET))
+    install: install-render-worker
+    install-render-worker: render-worker
+    \t$(MAKEDIRS) "$(RUBYARCHDIR)"
+    \t$(INSTALL_PROG) "$(RUSTLIBDIR)/imprimatur-render-worker" "$(RUBYARCHDIR)/imprimatur-render-worker"
+  MAKE
+end
+
 # BSD make reads BSDmakefile first (GNU make ignores it): delegate to gmake.
 if BSD
   File.write('BSDmakefile', <<~MAKE)