@ai-ecoverse/slicc-kernel 1.133.2 → 1.133.3

package/dist/kernel-worker.js

@@ -7034,7 +7034,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.133.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.133.3" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -19490,10 +19490,32 @@ var KEY_ERRORS = [
   [-15232, "ERR_OSSL_BAD_DECRYPT"],
   [-15360, "ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED"]
 ];
-function keyRefused(err) {
-  const code = err instanceof TlsError ? err.code : 0;
+var PBE_OIDS = [
+  [42, 134, 72, 134, 247, 13, 1, 5],
+  [42, 134, 72, 134, 247, 13, 1, 12, 1]
+];
+function hasBytes(hay, needle) {
+  for (let i = 0; i + needle.length <= hay.length; i++) {
+    if (needle.every((b, j) => hay[i + j] === b)) return true;
+  }
+  return false;
+}
+function encryptedKey(key) {
+  if (key[0] === 48) return PBE_OIDS.some((oid2) => hasBytes(key, oid2));
+  return new TextDecoder().decode(key).includes("ENCRYPTED");
+}
+var KEY_PARSE_RANGES = [
+  [-16383, -14336],
+  [-5375, -4096],
+  [-28671, -24576],
+  [-127, -96]
+];
+var keyParse = (code) => code !== -15360 && KEY_PARSE_RANGES.some(([lo, hi]) => code >= lo && code <= hi);
+function keyRefused(err, locked) {
+  const raw2 = err instanceof TlsError ? err.code : 0;
+  const code = locked && keyParse(raw2) ? -15232 : raw2;
   const name2 = KEY_ERRORS.find(([n]) => n === code)?.[1] ?? "ERR_OSSL_UNSUPPORTED";
-  const text = code === -3 ? "the key does not match the certificate" : err.message;
+  const text = code === -3 ? "the key does not match the certificate" : code === raw2 ? err.message : "bad decrypt";
   return new KernelError("EPROTO", `${name2}: ${text}`);
 }
 function takeCert(req) {
@@ -19524,7 +19546,7 @@ function withCert(session, cert) {
   try {
     session.ownCert(cert.chain, cert.key, cert.pass);
   } catch (err) {
-    throw keyRefused(err);
+    throw keyRefused(err, cert.pass.length > 0 && encryptedKey(cert.key));
   }
 }
 function wipe(cert) {