@sproutboat/runtime 0.37.1 → 0.39.0

package/src/subtle/vendor/monocypher.h

@@ -0,0 +1,321 @@
+// Monocypher version 4.0.2
+//
+// This file is dual-licensed.  Choose whichever licence you want from
+// the two licences listed below.
+//
+// The first licence is a regular 2-clause BSD licence.  The second licence
+// is the CC-0 from Creative Commons. It is intended to release Monocypher
+// to the public domain.  The BSD licence serves as a fallback option.
+//
+// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0
+//
+// ------------------------------------------------------------------------
+//
+// Copyright (c) 2017-2019, Loup Vaillant
+// All rights reserved.
+//
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the
+//    distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// ------------------------------------------------------------------------
+//
+// Written in 2017-2019 by Loup Vaillant
+//
+// To the extent possible under law, the author(s) have dedicated all copyright
+// and related neighboring rights to this software to the public domain
+// worldwide.  This software is distributed without any warranty.
+//
+// You should have received a copy of the CC0 Public Domain Dedication along
+// with this software.  If not, see
+// <https://creativecommons.org/publicdomain/zero/1.0/>
+
+#ifndef MONOCYPHER_H
+#define MONOCYPHER_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef MONOCYPHER_CPP_NAMESPACE
+namespace MONOCYPHER_CPP_NAMESPACE {
+#elif defined(__cplusplus)
+extern "C" {
+#endif
+
+// Constant time comparisons
+// -------------------------
+
+// Return 0 if a and b are equal, -1 otherwise
+int crypto_verify16(const uint8_t a[16], const uint8_t b[16]);
+int crypto_verify32(const uint8_t a[32], const uint8_t b[32]);
+int crypto_verify64(const uint8_t a[64], const uint8_t b[64]);
+
+
+// Erase sensitive data
+// --------------------
+void crypto_wipe(void *secret, size_t size);
+
+
+// Authenticated encryption
+// ------------------------
+void crypto_aead_lock(uint8_t       *cipher_text,
+                      uint8_t        mac  [16],
+                      const uint8_t  key  [32],
+                      const uint8_t  nonce[24],
+                      const uint8_t *ad,         size_t ad_size,
+                      const uint8_t *plain_text, size_t text_size);
+int crypto_aead_unlock(uint8_t       *plain_text,
+                       const uint8_t  mac  [16],
+                       const uint8_t  key  [32],
+                       const uint8_t  nonce[24],
+                       const uint8_t *ad,          size_t ad_size,
+                       const uint8_t *cipher_text, size_t text_size);
+
+// Authenticated stream
+// --------------------
+typedef struct {
+	uint64_t counter;
+	uint8_t  key[32];
+	uint8_t  nonce[8];
+} crypto_aead_ctx;
+
+void crypto_aead_init_x(crypto_aead_ctx *ctx,
+                        const uint8_t key[32], const uint8_t nonce[24]);
+void crypto_aead_init_djb(crypto_aead_ctx *ctx,
+                          const uint8_t key[32], const uint8_t nonce[8]);
+void crypto_aead_init_ietf(crypto_aead_ctx *ctx,
+                           const uint8_t key[32], const uint8_t nonce[12]);
+
+void crypto_aead_write(crypto_aead_ctx *ctx,
+                       uint8_t         *cipher_text,
+                       uint8_t          mac[16],
+                       const uint8_t   *ad        , size_t ad_size,
+                       const uint8_t   *plain_text, size_t text_size);
+int crypto_aead_read(crypto_aead_ctx *ctx,
+                     uint8_t         *plain_text,
+                     const uint8_t    mac[16],
+                     const uint8_t   *ad        , size_t ad_size,
+                     const uint8_t   *cipher_text, size_t text_size);
+
+
+// General purpose hash (BLAKE2b)
+// ------------------------------
+
+// Direct interface
+void crypto_blake2b(uint8_t *hash,          size_t hash_size,
+                    const uint8_t *message, size_t message_size);
+
+void crypto_blake2b_keyed(uint8_t *hash,          size_t hash_size,
+                          const uint8_t *key,     size_t key_size,
+                          const uint8_t *message, size_t message_size);
+
+// Incremental interface
+typedef struct {
+	// Do not rely on the size or contents of this type,
+	// for they may change without notice.
+	uint64_t hash[8];
+	uint64_t input_offset[2];
+	uint64_t input[16];
+	size_t   input_idx;
+	size_t   hash_size;
+} crypto_blake2b_ctx;
+
+void crypto_blake2b_init(crypto_blake2b_ctx *ctx, size_t hash_size);
+void crypto_blake2b_keyed_init(crypto_blake2b_ctx *ctx, size_t hash_size,
+                               const uint8_t *key, size_t key_size);
+void crypto_blake2b_update(crypto_blake2b_ctx *ctx,
+                           const uint8_t *message, size_t message_size);
+void crypto_blake2b_final(crypto_blake2b_ctx *ctx, uint8_t *hash);
+
+
+// Password key derivation (Argon2)
+// --------------------------------
+#define CRYPTO_ARGON2_D  0
+#define CRYPTO_ARGON2_I  1
+#define CRYPTO_ARGON2_ID 2
+
+typedef struct {
+	uint32_t algorithm;  // Argon2d, Argon2i, Argon2id
+	uint32_t nb_blocks;  // memory hardness, >= 8 * nb_lanes
+	uint32_t nb_passes;  // CPU hardness, >= 1 (>= 3 recommended for Argon2i)
+	uint32_t nb_lanes;   // parallelism level (single threaded anyway)
+} crypto_argon2_config;
+
+typedef struct {
+	const uint8_t *pass;
+	const uint8_t *salt;
+	uint32_t pass_size;
+	uint32_t salt_size;  // 16 bytes recommended
+} crypto_argon2_inputs;
+
+typedef struct {
+	const uint8_t *key; // may be NULL if no key
+	const uint8_t *ad;  // may be NULL if no additional data
+	uint32_t key_size;  // 0 if no key (32 bytes recommended otherwise)
+	uint32_t ad_size;   // 0 if no additional data
+} crypto_argon2_extras;
+
+extern const crypto_argon2_extras crypto_argon2_no_extras;
+
+void crypto_argon2(uint8_t *hash, uint32_t hash_size, void *work_area,
+                   crypto_argon2_config config,
+                   crypto_argon2_inputs inputs,
+                   crypto_argon2_extras extras);
+
+
+// Key exchange (X-25519)
+// ----------------------
+
+// Shared secrets are not quite random.
+// Hash them to derive an actual shared key.
+void crypto_x25519_public_key(uint8_t       public_key[32],
+                              const uint8_t secret_key[32]);
+void crypto_x25519(uint8_t       raw_shared_secret[32],
+                   const uint8_t your_secret_key  [32],
+                   const uint8_t their_public_key [32]);
+
+// Conversion to EdDSA
+void crypto_x25519_to_eddsa(uint8_t eddsa[32], const uint8_t x25519[32]);
+
+// scalar "division"
+// Used for OPRF.  Be aware that exponential blinding is less secure
+// than Diffie-Hellman key exchange.
+void crypto_x25519_inverse(uint8_t       blind_salt [32],
+                           const uint8_t private_key[32],
+                           const uint8_t curve_point[32]);
+
+// "Dirty" versions of x25519_public_key().
+// Use with crypto_elligator_rev().
+// Leaks 3 bits of the private key.
+void crypto_x25519_dirty_small(uint8_t pk[32], const uint8_t sk[32]);
+void crypto_x25519_dirty_fast (uint8_t pk[32], const uint8_t sk[32]);
+
+
+// Signatures
+// ----------
+
+// EdDSA with curve25519 + BLAKE2b
+void crypto_eddsa_key_pair(uint8_t secret_key[64],
+                           uint8_t public_key[32],
+                           uint8_t seed[32]);
+void crypto_eddsa_sign(uint8_t        signature [64],
+                       const uint8_t  secret_key[64],
+                       const uint8_t *message, size_t message_size);
+int crypto_eddsa_check(const uint8_t  signature [64],
+                       const uint8_t  public_key[32],
+                       const uint8_t *message, size_t message_size);
+
+// Conversion to X25519
+void crypto_eddsa_to_x25519(uint8_t x25519[32], const uint8_t eddsa[32]);
+
+// EdDSA building blocks
+void crypto_eddsa_trim_scalar(uint8_t out[32], const uint8_t in[32]);
+void crypto_eddsa_reduce(uint8_t reduced[32], const uint8_t expanded[64]);
+void crypto_eddsa_mul_add(uint8_t r[32],
+                          const uint8_t a[32],
+                          const uint8_t b[32],
+                          const uint8_t c[32]);
+void crypto_eddsa_scalarbase(uint8_t point[32], const uint8_t scalar[32]);
+int crypto_eddsa_check_equation(const uint8_t signature[64],
+                                const uint8_t public_key[32],
+                                const uint8_t h_ram[32]);
+
+
+// Chacha20
+// --------
+
+// Specialised hash.
+// Used to hash X25519 shared secrets.
+void crypto_chacha20_h(uint8_t       out[32],
+                       const uint8_t key[32],
+                       const uint8_t in [16]);
+
+// Unauthenticated stream cipher.
+// Don't forget to add authentication.
+uint64_t crypto_chacha20_djb(uint8_t       *cipher_text,
+                             const uint8_t *plain_text,
+                             size_t         text_size,
+                             const uint8_t  key[32],
+                             const uint8_t  nonce[8],
+                             uint64_t       ctr);
+uint32_t crypto_chacha20_ietf(uint8_t       *cipher_text,
+                              const uint8_t *plain_text,
+                              size_t         text_size,
+                              const uint8_t  key[32],
+                              const uint8_t  nonce[12],
+                              uint32_t       ctr);
+uint64_t crypto_chacha20_x(uint8_t       *cipher_text,
+                           const uint8_t *plain_text,
+                           size_t         text_size,
+                           const uint8_t  key[32],
+                           const uint8_t  nonce[24],
+                           uint64_t       ctr);
+
+
+// Poly 1305
+// ---------
+
+// This is a *one time* authenticator.
+// Disclosing the mac reveals the key.
+// See crypto_lock() on how to use it properly.
+
+// Direct interface
+void crypto_poly1305(uint8_t        mac[16],
+                     const uint8_t *message, size_t message_size,
+                     const uint8_t  key[32]);
+
+// Incremental interface
+typedef struct {
+	// Do not rely on the size or contents of this type,
+	// for they may change without notice.
+	uint8_t  c[16];  // chunk of the message
+	size_t   c_idx;  // How many bytes are there in the chunk.
+	uint32_t r  [4]; // constant multiplier (from the secret key)
+	uint32_t pad[4]; // random number added at the end (from the secret key)
+	uint32_t h  [5]; // accumulated hash
+} crypto_poly1305_ctx;
+
+void crypto_poly1305_init  (crypto_poly1305_ctx *ctx, const uint8_t key[32]);
+void crypto_poly1305_update(crypto_poly1305_ctx *ctx,
+                            const uint8_t *message, size_t message_size);
+void crypto_poly1305_final (crypto_poly1305_ctx *ctx, uint8_t mac[16]);
+
+
+// Elligator 2
+// -----------
+
+// Elligator mappings proper
+void crypto_elligator_map(uint8_t curve [32], const uint8_t hidden[32]);
+int  crypto_elligator_rev(uint8_t hidden[32], const uint8_t curve [32],
+                          uint8_t tweak);
+
+// Easy to use key pair generation
+void crypto_elligator_key_pair(uint8_t hidden[32], uint8_t secret_key[32],
+                               uint8_t seed[32]);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // MONOCYPHER_H

package/src/subtle-date.ts

@@ -0,0 +1,6 @@
+/**
+ * The compatibility date from which `crypto.subtle` follows workerd's surface (RSA, ECDSA, Ed25519,
+ * AES, key import and export, DOMException errors). A placeholder: the maintainers choose the
+ * date. Keep it equal to `__SB_SUBTLE_DATE` in `native-fetch-prelude.js`; a test checks that.
+ */
+export const SUBTLE_DATE = "2026-11-06";

package/src/wrap.ts

@@ -205,6 +205,36 @@ export function neutraliseExports(source: string): string | null {
  * leaks that change to later requests. Freeze upstream once Porffor supports
  * Object.freeze in native mode.
  */
+/**
+ * What a handler needs of crypto.subtle: `"always"` (the default for the embedded transport) leaves the prelude as it is, which
+ * is what a shared template needs (sproutd compiles apps against one prelude). `"auto"` drops the
+ * workerd-style crypto.subtle (its JavaScript, and the BearSSL and Monocypher C behind it) from a
+ * handler whose source never mentions `subtle`, `DigestStream` or `CryptoKey`: such a handler cannot
+ * reach it, and the code is about 330 KB of a 5.3 MB standalone binary and about 2 s of its build.
+ * A handler that reaches crypto.subtle without naming it (a computed property name) gets the
+ * digest/HMAC/PBKDF2 subset that earlier dates have.
+ */
+export type SubtleMode = "always" | "auto";
+
+const SUBTLE_BLOCKS: Array<[string, string]> = [
+  ["// SUBTLE-JS:BEGIN", "// SUBTLE-JS:END"],
+  ["// SUBTLE:BEGIN", "// SUBTLE:END"],
+];
+/** The prelude without workerd-style crypto.subtle. Throws if a marker is missing: a silent no-op would ship the code. */
+export function pruneSubtle(prelude: string): string {
+  let out = prelude;
+  for (const [begin, end] of SUBTLE_BLOCKS) {
+    const start = out.indexOf(begin);
+    const stop = out.indexOf(end, start);
+    if (start < 0 || stop < 0) {
+      throw new Error(`the prelude has no ${begin} ... ${end} block to prune`);
+    }
+    out = out.slice(0, start) + out.slice(out.indexOf("\n", stop) + 1);
+  }
+  return out;
+}
+export const reachesSubtle = (source: string) => /\b(?:subtle|DigestStream|CryptoKey)\b/.test(source);
+
 export function wrapNativeFetchHandler(
   source: string,
   prelude: string,
@@ -224,7 +254,17 @@ export function wrapNativeFetchHandler(
    * own self-describing identity rather than a broker round trip.
    */
   versionMetadata?: { binding: string; id: string; tag: string; timestamp: string },
+  subtle?: SubtleMode,
 ): string {
+  // The shared template (sproutd) is the embedded transport and needs it all; a broker build links BearSSL only for
+  // a handler that uses crypto.subtle (the CLI does that), so it defaults to pruning.
+  // A prelude without the block (a test stub) is left alone; prune.test.ts holds the real one to it.
+  if (
+    (subtle ?? (transport === "embedded" ? "always" : "auto")) === "auto" &&
+    !reachesSubtle(source) &&
+    prelude.includes("// SUBTLE-JS:BEGIN")
+  )
+    prelude = pruneSubtle(prelude);
   const neutralised = neutraliseExports(inlineWorkersImports(source));
   // A WorkerEntrypoint may serve only RPC, and a Worker only scheduled() or queue(), with
   // no fetch() at all, as in workerd.

package/test/bearssl.ts

@@ -0,0 +1,70 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+// The prelude carries crypto.subtle's native half on every transport, so a test that compiles a
+// handler using crypto.subtle needs BearSSL on the include path and link line, as the CLI arranges
+// for a build. Same pinned source as the CLI's src/bearssl.ts; built once into the toolchain cache.
+const VERSION = "0.6";
+const URL_ = `https://bearssl.org/bearssl-${VERSION}.tar.gz`;
+const SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14";
+
+const walk = async (dir: string): Promise<string[]> =>
+  (
+    await Promise.all(
+      (await readdir(dir, { withFileTypes: true })).map((entry) =>
+        entry.isDirectory()
+          ? walk(join(dir, entry.name))
+          : Promise.resolve(entry.name.endsWith(".c") ? [join(dir, entry.name)] : []),
+      ),
+    )
+  ).flat();
+
+/** `SB_EXTRA_CFLAGS` and `SB_EXTRA_LINK` for a host Porffor compile that uses crypto.subtle. */
+export async function bearsslEnv(): Promise<{ SB_EXTRA_CFLAGS: string; SB_EXTRA_LINK: string }> {
+  const root = resolve(
+    process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? join(homedir(), ".cache/sproutboat"),
+    `bearssl-${VERSION}-test`,
+  );
+  const tree = join(root, `bearssl-${VERSION}`);
+  const objects = join(root, "obj");
+  const marker = join(objects, ".complete");
+  if (!existsSync(marker)) {
+    await mkdir(root, { recursive: true });
+    const response = await fetch(URL_);
+    if (!response.ok) throw new Error(`could not download ${URL_}: HTTP ${response.status}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (createHash("sha256").update(bytes).digest("hex") !== SHA256) throw new Error("BearSSL checksum mismatch");
+    await writeFile(join(root, "bearssl.tar.gz"), bytes);
+    await rm(tree, { recursive: true, force: true });
+    const untar = Bun.spawnSync(["tar", "xzf", join(root, "bearssl.tar.gz"), "-C", root]);
+    if (untar.exitCode !== 0) throw new Error(`could not unpack BearSSL: ${untar.stderr}`);
+    const stage = `${objects}.${process.pid}`;
+    await rm(stage, { recursive: true, force: true });
+    await mkdir(stage, { recursive: true });
+    const cc = process.env.CC ?? "cc";
+    const sources = await walk(join(tree, "src"));
+    const queue = [...sources];
+    const worker = async () => {
+      for (let file = queue.pop(); file !== undefined; file = queue.pop()) {
+        const out = join(stage, `${file.split("/").pop()!.replace(/\.c$/, "")}.o`);
+        const run = Bun.spawn([cc, "-Os", "-I", join(tree, "inc"), "-I", join(tree, "src"), "-c", file, "-o", out], {
+          stderr: "pipe",
+        });
+        if ((await run.exited) !== 0)
+          throw new Error(`could not compile ${file}: ${await new Response(run.stderr).text()}`);
+      }
+    };
+    await Promise.all(Array.from({ length: 8 }, worker));
+    await writeFile(join(stage, ".complete"), "");
+    await rm(objects, { recursive: true, force: true });
+    await rename(stage, objects);
+  }
+  const names = (await readdir(objects)).filter((name) => name.endsWith(".o")).sort();
+  return {
+    SB_EXTRA_CFLAGS: `-I ${join(tree, "inc")}`,
+    SB_EXTRA_LINK: names.map((name) => join(objects, name)).join(" "),
+  };
+}

package/test/native-crypto.ts

@@ -3,6 +3,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { ensurePorffor } from "../../toolchain/src/acquire";
+import { bearsslEnv } from "./bearssl";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // These values come from Bun WebCrypto and node:crypto, not from the runtime
@@ -71,26 +72,28 @@ try {
   const node = Bun.which("node");
   if (!node) throw new Error("native crypto test needs node on PATH");
 
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "crypto.generated.js");
   const binary = join(workdir, "crypto-native");
   // This is a direct ESM import into Porffor, with no bundler in front of it.
-  await writeFile(join(workdir, "crypto-helper.js"),
-    "export const keyBytes = () => Uint8Array.from({ length: 16 }, (_, index) => index + 1);\n");
+  await writeFile(
+    join(workdir, "crypto-helper.js"),
+    "export const keyBytes = () => Uint8Array.from({ length: 16 }, (_, index) => index + 1);\n",
+  );
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: { ...process.env, ...(await bearsslEnv()) },
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
   const [exitCode, stdout, stderr] = await Promise.all([
     compile.exited,
     new Response(compile.stdout).text(),

package/test/native-jwt.ts

@@ -4,6 +4,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { ensurePorffor } from "../../toolchain/src/acquire";
+import { bearsslEnv } from "./bearssl";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // The pieces of a JWT check (base64url decode, TextEncoder, HMAC verify) against values that do
@@ -290,7 +291,7 @@ try {
     [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
     {
       cwd: workdir,
-      env: process.env,
+      env: { ...process.env, ...(await bearsslEnv()) },
       stdout: "pipe",
       stderr: "pipe",
     },