@ai-ecoverse/slicc-kernel 1.125.8 → 1.125.10

package/README.md

@@ -426,7 +426,7 @@ The module's default export (or its `main` export) is called with a context and
       - With `rejectUnauthorized: false`, `chainError` says what is wrong with the chain apart from the name, with Node's names, and is absent when the chain is fine:
         - a self-signed leaf alone is `DEPTH_ZERO_SELF_SIGNED_CERT`;
         - an untrusted chain ending in a self-signed root is `SELF_SIGNED_CERT_IN_CHAIN`;
-        - self-signed means the certificate's own key verifies its signature (RSA PKCS#1 v1.5, ECDSA P-256/384/521 or Ed25519), not just that its issuer and subject names match, so a self-issued certificate signed by another key, such as a CA rollover certificate, is not self-signed, as in Node ([#1059](https://github.com/ai-ecoverse/slicc-kernel/issues/1059));
+        - self-signed means the certificate's own key verifies its signature (RSA PKCS#1 v1.5, RSA-PSS, ECDSA P-256/384/521 or Ed25519; a signature the kernel can't verify is not self-signed), not just that its issuer and subject names match, so a self-issued certificate signed by another key, such as a CA rollover certificate, is not self-signed, as in Node ([#1059](https://github.com/ai-ecoverse/slicc-kernel/issues/1059));
         - a lone leaf whose issuer is unknown is `UNABLE_TO_VERIFY_LEAF_SIGNATURE`;
         - an untrusted longer chain is `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`;
         - otherwise it's the reason's code, such as `CERT_HAS_EXPIRED`.
@@ -635,7 +635,7 @@ The proxy answers `200` with `Content-Type: application/vnd.slicc.raw-fetch`: a
 
 ## Filesystem
 
-`/` is the OPFS root. Each process mounts the top-level directories that exist when it starts (plus `/usr` and `/bin`), so files in them are shared by all processes and visible through the OPFS API as soon as the process that wrote them has closed them; `run` resolves only after that. `createKernel` creates `/tmp` and `/home` in OPFS, so they are shared too. Files directly in `/`, and directories created there after a process started, are OPFS as well, the same for Emscripten and WASI programs; only `/dev` and `/proc` live in each process's memory. A program's `mkdir` (WASI `path_create_directory`, Emscripten's `mkdir`) is exclusive, as on Linux: it fails with `EEXIST` when the name exists, and of several processes or threads making one name at once exactly one succeeds, so a directory works as a lock. Under a missing directory it fails with `ENOENT`, as on Linux (`mkdir -p` and `os.makedirs` make the parents in the program); a JS program's `ctx.fs.mkdir` makes parents itself. The kernel makes the system `PNPM_HOME` (`/usr/local/share/pnpm`, or the embedder's) when it starts, since pnpm makes only its `bin` directory there. A full origin storage (`QuotaExceededError`, which also comes early in a browser's private or off-the-record contexts, whatever `navigator.storage.estimate()` says) is `ENOSPC`, never retried. An OPFS or IndexedDB failure that has no POSIX counterpart is `EIO`; its message names the DOM error and the operation (`lookup`, `read`, `write`, `commit` or `sidecar`), and the kernel worker logs the first of each kind to its console. File contents are buffered per open file and written back on close, `fsync` and exit, so a refused write (`ENOSPC`, `EIO`) surfaces at that close or `fsync`, and a program that ignores close errors doesn't see it (`echo x > f` can exit 0 with `f` empty, as with any buffered write-back). A write-back error a close has already reported to a WASI program isn't raised again when it exits, so the program keeps its own exit status. Metadata operations (`mkdir`, `rename`, `rm`, …) go straight to OPFS. The kernel worker is the only writer.
+`/` is the OPFS root. Each process mounts the top-level directories that exist when it starts (plus `/usr` and `/bin`), so files in them are shared by all processes and visible through the OPFS API as soon as the process that wrote them has closed them; `run` resolves only after that. `createKernel` creates `/tmp` and `/home` in OPFS, so they are shared too. Files directly in `/`, and directories created there after a process started, are OPFS as well, the same for Emscripten and WASI programs; only `/dev` and `/proc` live in each process's memory. A program's `mkdir` (WASI `path_create_directory`, Emscripten's `mkdir`) is exclusive, as on Linux: it fails with `EEXIST` when the name exists, and of several processes or threads making one name at once exactly one succeeds, so a directory works as a lock. Under a missing directory it fails with `ENOENT`, as on Linux (`mkdir -p` and `os.makedirs` make the parents in the program); a JS program's `ctx.fs.mkdir` makes parents itself. The kernel makes the system `PNPM_HOME` (`/usr/local/share/pnpm`, or the embedder's) when it starts, since pnpm makes only its `bin` directory there. A full origin storage (`QuotaExceededError`, which also comes early in a browser's private or off-the-record contexts, whatever `navigator.storage.estimate()` says) is `ENOSPC`, never retried. A read that meets `NotFoundError` while a writer outside the kernel swaps the file in with `createWritable` (and a `stat`, `lstat` or `utimes` that meets it) looks the name up again, up to three times, before it fails ([#1075](https://github.com/ai-ecoverse/slicc-kernel/issues/1075)), so a program whose package is overwritten in place keeps starting. An OPFS or IndexedDB failure that has no POSIX counterpart is `EIO`; its message names the DOM error and the operation (`lookup`, `read`, `write`, `commit` or `sidecar`), and the kernel worker logs the first of each kind to its console. File contents are buffered per open file and written back on close, `fsync` and exit, so a refused write (`ENOSPC`, `EIO`) surfaces at that close or `fsync`, and a program that ignores close errors doesn't see it (`echo x > f` can exit 0 with `f` empty, as with any buffered write-back). A write-back error a close has already reported to a WASI program isn't raised again when it exits, so the program keeps its own exit status. Metadata operations (`mkdir`, `rename`, `rm`, …) go straight to OPFS. The kernel worker is the only writer.
 
 A lookup follows at most 40 symlinks, as Linux does: the 41st is `ELOOP`, for WASI programs, JS programs and the kernel API alike, with or without `..` in a link's target. Emscripten programs resolve paths in their glue, which stops one link earlier, at 40.
 

package/dist/kernel-worker.js

@@ -1077,6 +1077,17 @@ var S_IFIFO = 4096;
 var PERM_MASK = 4095;
 var S_ISGID2 = 1024;
 var READ_ATTEMPTS = 3;
+async function swapped(op) {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await op();
+    } catch (err) {
+      if (err?.name !== "NotFoundError" || attempt >= READ_ATTEMPTS) {
+        throw err;
+      }
+    }
+  }
+}
 var MAX_LINKS2 = 40;
 var CHECK_MS = 1e3;
 var ABSENT_MS = 2;
@@ -1862,10 +1873,14 @@ var OpfsFs = class {
     return { ...stat, ...ownOf(meta) ?? inherit(entries) };
   }
   stat(path) {
-    return this.unreplaced(async () => this.describe(await this.located(path, true)));
+    return this.unreplaced(
+      () => swapped(async () => this.describe(await this.located(path, true)))
+    );
   }
   lstat(path) {
-    return this.unreplaced(async () => this.describe(await this.located(path, false)));
+    return this.unreplaced(
+      () => swapped(async () => this.describe(await this.located(path, false)))
+    );
   }
   async exists(path) {
     return this.locate(path, true).then(
@@ -1891,8 +1906,17 @@ var OpfsFs = class {
   }
   reading(path, op) {
     return this.unreplaced(async () => {
-      const handle = await this.existing(path);
-      return this.retrying(path, () => op(handle), false);
+      for (let attempt = 1; ; attempt++) {
+        const found = await this.locate(path, true);
+        const handle = found.handle;
+        if (handle.kind === "directory") throw fsError("EISDIR", path);
+        try {
+          return await this.retrying(path, () => op(handle), false);
+        } catch (err) {
+          if (err.code !== "ENOENT" || attempt >= READ_ATTEMPTS) throw err;
+          this.files.delete(found.path);
+        }
+      }
     });
   }
   async existing(path, writing = false) {
@@ -2396,10 +2420,10 @@ var OpfsFs = class {
     }));
   }
   async utimes(path, atime, mtime) {
-    await this.setTimes(await this.locate(path, true), atime, mtime);
+    await swapped(async () => this.setTimes(await this.locate(path, true), atime, mtime));
   }
   async lutimes(path, atime, mtime) {
-    await this.setTimes(await this.locate(path, false), atime, mtime);
+    await swapped(async () => this.setTimes(await this.locate(path, false), atime, mtime));
   }
   async setTimes(found, atime, mtime) {
     this.refuse(found.path);
@@ -6632,7 +6656,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.125.8" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.125.10" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17313,8 +17337,32 @@ var HASHES = {
   "2a8648ce3d040302": ["ECDSA", "SHA-256"],
   "2a8648ce3d040303": ["ECDSA", "SHA-384"],
   "2a8648ce3d040304": ["ECDSA", "SHA-512"],
-  "2b6570": ["Ed25519", ""]
+  "2b6570": ["Ed25519", ""],
+  "2a864886f70d01010a": ["RSA-PSS", "SHA-1"]
 };
+var PSS_HASHES = {
+  "2b0e03021a": "SHA-1",
+  "608648016503040201": "SHA-256",
+  "608648016503040202": "SHA-384",
+  "608648016503040203": "SHA-512"
+};
+function pssOf(der, algorithm) {
+  const params = children2(der, algorithm, 2)?.[1];
+  let hash = "SHA-1";
+  let salt = 20;
+  for (const field4 of params && der[params.start] === 48 ? children2(der, params, 3) ?? [] : []) {
+    const inner = tlv2(der, field4.body);
+    if (!inner) return void 0;
+    if (der[field4.start] === 160) {
+      const known = PSS_HASHES[oidOf(der, inner) ?? ""];
+      if (!known) return void 0;
+      hash = known;
+    } else if (der[field4.start] === 162) {
+      salt = der.subarray(inner.body, inner.end).reduce((n, b) => n * 256 + b, 0);
+    }
+  }
+  return { hash, salt };
+}
 var CURVES = {
   "2a8648ce3d030107": ["P-256", 32],
   "2b81040022": ["P-384", 48],
@@ -17349,10 +17397,13 @@ function signedOf(der) {
   const spki = parts2?.tbs[5];
   if (!tbs || !algorithm || !value2 || !spki || der[value2.start] !== 3) return void 0;
   const known = HASHES[oidOf(der, algorithm) ?? ""];
-  if (!known) return "unknown";
-  const [scheme, hash] = known;
+  if (!known) return void 0;
+  const [scheme] = known;
+  const pss = scheme === "RSA-PSS" ? pssOf(der, algorithm) : void 0;
+  if (scheme === "RSA-PSS" && !pss) return void 0;
+  const hash = pss?.hash ?? known[1];
   const curve = scheme === "ECDSA" ? curveOf(der, spki) : void 0;
-  if (scheme === "ECDSA" && !curve) return "unknown";
+  if (scheme === "ECDSA" && !curve) return void 0;
   const signature = der.subarray(value2.body + 1, value2.end);
   return {
     tbs: raw(der, tbs),
@@ -17360,7 +17411,8 @@ function signedOf(der) {
     signature,
     scheme,
     hash,
-    ...curve ? { curve } : {}
+    ...curve ? { curve } : {},
+    ...pss ? { salt: pss.salt } : {}
   };
 }
 async function verifiesItself(s) {
@@ -17371,13 +17423,12 @@ async function verifiesItself(s) {
   ]);
   const signature = s.curve ? fixedEcdsa(s.signature, s.curve[1]) : s.signature;
   if (!signature) return false;
-  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : { name: s.scheme };
+  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : s.salt === void 0 ? { name: s.scheme } : { name: s.scheme, saltLength: s.salt };
   return crypto.subtle.verify(params, key, new Uint8Array(signature), new Uint8Array(s.tbs));
 }
 async function selfSigned(der) {
   if (!selfIssued(der)) return false;
   const signed = signedOf(der);
-  if (signed === "unknown") return true;
   if (!signed) return false;
   return verifiesItself(signed).catch(() => false);
 }