@amritk/nish-x86_64-linux 0.24.0 → 0.25.0

package/std/compress/gzip.ts

@@ -67,7 +67,7 @@ export const GZIP_END: i32 = -100
 const GZIP_HEADER_SIZE: i32 = 10
 const GZIP_TRAILER_SIZE: i32 = 8
 
-/** The bytes a `GzipWriter` holds before it compresses them: one window of history and two of input. */
+/** The bytes a `GzipWriter` holds: 32 KB of history, and up to 64 KB of input before it compresses them. */
 const GZIP_WRITER_HISTORY: i32 = 32768
 const GZIP_WRITER_INPUT: i32 = 65536
 
@@ -337,9 +337,16 @@ export class GzipWriter {
     this.finished = false
   }
 
-  /** The most bytes a `write` of `len` bytes, or a `flush` or `finish` after it, can produce. */
+  /**
+   * The most bytes a `write` of `len` bytes, or a `flush` or `finish` after
+   * it, can produce. Less than 64 KB is pending before the call, and the
+   * call compresses once per 64 KB pending: `deflateBound` of all of it,
+   * with the constant part of `deflateBound` again for each compression
+   * after the first.
+   */
   bound(len: i32): i32 {
-    return deflateBound(GZIP_WRITER_INPUT + len) + GZIP_HEADER_SIZE + GZIP_TRAILER_SIZE + 10
+    const drains: i32 = (len >> 16) + 1
+    return deflateBound(GZIP_WRITER_INPUT + len) + drains * 18 + GZIP_HEADER_SIZE + GZIP_TRAILER_SIZE + 10
   }
 
   /** Writes the header into `out` at `at` if it has not been; answers the new position. */
@@ -404,16 +411,17 @@ export class GzipWriter {
     this.size = this.size + toU32(len)
     let p: i32 = off
     const end: i32 = off + len
-    const cap: i32 = toI32(this.window.length)
+    // Compressed once 64 KB is pending, the first window too: `pending` is
+    // at most `GZIP_WRITER_HISTORY` here, so the window always has the room.
     while (p < end) {
-      let take: i32 = cap - this.fill
+      let take: i32 = GZIP_WRITER_INPUT - (this.fill - this.pending)
       if (take > end - p) {
         take = end - p
       }
       copyBytes(this.window, this.fill, src, p, take)
       this.fill += take
       p += take
-      if (this.fill === cap) {
+      if (this.fill - this.pending === GZIP_WRITER_INPUT) {
         o = this.drain(out, o, false)
         if (o < 0) {
           panic("GzipWriter.write: a block larger than its bound")
@@ -439,6 +447,9 @@ export class GzipWriter {
     let o: i32 = this.header(out, at)
     if (this.fill > this.pending) {
       o = this.drain(out, o, false)
+      if (o < 0) {
+        panic("GzipWriter.flush: a block larger than its bound")
+      }
     }
     o = this.deflater.writeStored(this.window, toI32(0), toI32(0), false, out, o, toI32(out.length))
     return o
@@ -459,6 +470,9 @@ export class GzipWriter {
     }
     let o: i32 = this.header(out, at)
     o = this.drain(out, o, true)
+    if (o < 0) {
+      panic("GzipWriter.finish: a block larger than its bound")
+    }
     o = this.deflater.flushBits(out, o, toI32(out.length))
     if (o < 0 || toI32(out.length) - o < GZIP_TRAILER_SIZE) {
       panic("GzipWriter.finish: a block larger than its bound")

package/std/crypto/LICENSE-fiat-crypto-p384

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2020 the fiat-crypto authors (see the AUTHORS file).
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/std/crypto/p256.ts

@@ -112,7 +112,7 @@
  * functions share the importing program's flat symbol namespace
  * (`docs/wp26-stdlib.md` §3e).
  */
-import { Secret, expose, exposeWith, wipe } from "nish:secret"
+import { Secret, expose, exposeWith, secret, wipe } from "nish:secret"
 import { SHA256_BLOCK, SHA256_SIZE, Sha256, sha256 } from "nish/crypto/sha256"
 import { timingSafeEqual } from "nish/crypto/ct"
 
@@ -5268,6 +5268,68 @@ const p256PublicKeyExposed = (priv: u8[]): u8[] | null => {
   return encoded
 }
 
+/**
+ * The ECDH shared secret of `priv` and the peer's public key `peerPoint`
+ * (SEC 1 §3.3.1): the 32-byte big-endian x coordinate of `priv * peerPoint`,
+ * as TLS 1.3 uses it (RFC 8446 §7.4.2). Answers `null` unless `priv` is a
+ * private key `p256PublicKey` would take and `peerPoint` is a 65-byte
+ * uncompressed point on the curve, and for a product at infinity, which a
+ * valid key and point cannot give. An x of zero is a point like any other
+ * and is answered.
+ */
+export const p256Ecdh = (priv: Secret<u8[]>, peerPoint: u8[]): Secret<u8[]> | null => {
+  const shared: u8[] | null = exposeWith(priv, peerPoint, p256EcdhExposed)
+  if (shared === null) {
+    return null
+  }
+  return secret(shared)
+}
+
+/**
+ * `p256Ecdh` on the plain key, for `exposeWith` to run. The scratch, the
+ * product and every limb of `X / Z` follow the key, so all are wiped; the
+ * inversion is written out here, rather than through `p256AffineX`, so that its
+ * accumulator and Z's inverse are this function's to wipe.
+ */
+const p256EcdhExposed = (priv: u8[], peerPoint: u8[]): u8[] | null => {
+  if (!p256ScalarInRange(priv)) {
+    return null
+  }
+  const peer: P256ProjectivePoint | null = p256DecodePoint(peerPoint)
+  if (peer === null) {
+    return null
+  }
+  const point = new P256ProjectivePoint()
+  const scratch = new P256PointScratch()
+  p256ScalarMult(point, priv, peer, scratch)
+  p256WipeScratch(scratch)
+  const infinity: boolean = p256FiatNonzero(point.z) === 0
+  // 1 / Z as Z^(p - 2), as p256FieldInvert computes it, over limbs wiped below.
+  const e: u32[] = p256Prime()
+  e[0] = 0xfffffffd
+  const acc: u32[] = p256Limbs()
+  p256FiatSetOne(acc)
+  for (let i: i32 = 255; i >= 0; i--) {
+    p256FiatSquare(acc, acc)
+    if (p256Bit(e, i)) {
+      p256FiatMul(acc, acc, point.z)
+    }
+  }
+  const x: u32[] = p256Limbs()
+  p256FiatMul(x, point.x, acc)
+  p256FiatMul(x, x, p256PlainOne())
+  const out: u8[] = new Array<u8>(P256_SCALAR_SIZE)
+  p256LimbsToBytes(out, 0, x)
+  wipe(x)
+  wipe(acc)
+  p256WipePoint(point)
+  if (infinity) {
+    wipe(out)
+    return null
+  }
+  return out
+}
+
 /**
  * The ECDSA signature (FIPS 186-4 §6.4) of `digest` under `priv`, as `r || s`,
  * 64 bytes, with the deterministic nonce of RFC 6979 §3.2 over HMAC-SHA-256.