@sproutboat/runtime 0.40.0 → 0.41.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sproutboat/runtime
 
+## 0.41.0
+
+### Minor Changes
+
+- 1eacf43: Secrets read from the environment (a standalone binary, a sproutd worker) are decoded as UTF-8 from the proposed compatibility date 2026-11-07. Before, the handler got the environment's bytes one char per byte, so `é` arrived as `é`. The broker transport is unchanged: its secrets already arrive as real strings. Bytes that are not valid UTF-8 pass through as before.
+
+### Patch Changes
+
+- f74835a: `crypto.subtle` signs and verifies P-256 (ES256 and ECDH) with BearSSL's 64-bit `ec_p256_m64` where the target has a 128-bit multiply, and keeps the portable code everywhere else (and for P-384 and P-521). BearSSL never picks m64 by itself, so the C asks for it with `br_ec_p256_m64_get()`, which returns null on a target without one. Through the runtime on macOS arm64, ES256 signs 2.2x faster (2,563 to 5,621 per second) and verifies 3.1x faster (1,318 to 4,050 per second). Results are unchanged, so there is no new compatibility date.
+  
+  This needs the BearSSL that the CLI pins from the release that ships with it: m64 is not in BearSSL 0.6, so a CLI that still links 0.6 cannot link this runtime.
+
 ## 0.40.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/native-fetch-prelude.js

@@ -9397,6 +9397,14 @@ static const sbc_u8 sbc_oid_x25519[] = { 0x2b, 0x65, 0x6e };
 static int sbc_oid_eq(const sbc_u8* a, size_t al, const sbc_u8* b, size_t bl) { return al == bl && memcmp(a, b, al) == 0; }
 
 static int sbc_curve_br(int c) { return c == 1 ? BR_EC_secp256r1 : c == 2 ? BR_EC_secp384r1 : c == 3 ? BR_EC_secp521r1 : 0; }
+
+static const br_ec_impl* sbc_ec(int br_curve) {
+  if (br_curve == BR_EC_secp256r1) {
+    const br_ec_impl* fast = br_ec_p256_m64_get();
+    if (fast) return fast;
+  }
+  return br_ec_get_default();
+}
 static int sbc_curve_from_br(int c) { return c == BR_EC_secp256r1 ? 1 : c == BR_EC_secp384r1 ? 2 : c == BR_EC_secp521r1 ? 3 : 0; }
 static size_t sbc_curve_size(int c) { return c == 1 ? 32 : c == 2 ? 48 : c == 3 ? 66 : 0; }
 static void sbc_curve_oid(int c, const sbc_u8** o, size_t* n) {
@@ -9579,7 +9587,7 @@ static int sbc_decode(int pkcs8, const sbc_u8* der, size_t len, sbc_buf* out) {
       if (cv) {
         sbc_u8 pub[133];
         br_ec_public_key pk;
-        if (br_ec_compute_pub(br_ec_get_default(), &pk, pub, sk) != 0) {
+        if (br_ec_compute_pub(sbc_ec(sk->curve), &pk, pub, sk) != 0) {
           sbc_put1(out, SBC_K_EC); sbc_put1(out, (sbc_u8)cv); sbc_put1(out, 1);
           sbc_field(out, pk.q, pk.qlen);
 
@@ -9862,7 +9870,7 @@ static int sbc_ecdsa_sign(int bits, const sbc_u8* key, size_t kl, const sbc_u8*
   sbc_u8 h[64], sig[132];
   rc = SBC_OPERATION;
   if (sbc_digest(bits, m, ml, h)) {
-    size_t n = br_ecdsa_sign_raw_get_default()(br_ec_get_default(), sbc_hash(bits), h, sk, sig);
+    size_t n = br_ecdsa_sign_raw_get_default()(sbc_ec(sk->curve), sbc_hash(bits), h, sk, sig);
     if (n) { sbc_put(out, sig, n); rc = SBC_OK; }
   }
   free(dc);
@@ -9877,7 +9885,7 @@ static int sbc_ecdsa_verify(int bits, int curve, const sbc_u8* point, size_t pl,
   if (sl != 2 * fs) return SBC_OK;
   br_ec_public_key pk;
   pk.curve = sbc_curve_br(curve); pk.q = (sbc_u8*)point; pk.qlen = pl;
-  if (br_ecdsa_vrfy_raw_get_default()(br_ec_get_default(), h, sbc_hlen(bits), &pk, sig, sl)) *ok = 1;
+  if (br_ecdsa_vrfy_raw_get_default()(sbc_ec(pk.curve), h, sbc_hlen(bits), &pk, sig, sl)) *ok = 1;
   return SBC_OK;
 }
 
@@ -9887,12 +9895,12 @@ static int sbc_ec_point_ok(int curve, const sbc_u8* point, size_t pl) {
   sbc_u8 q[133];
   memcpy(q, point, pl);
   sbc_u8 one[1] = { 1 };
-  return br_ec_get_default()->mul(q, pl, one, 1, sbc_curve_br(curve)) != 0;
+  return sbc_ec(sbc_curve_br(curve))->mul(q, pl, one, 1, sbc_curve_br(curve)) != 0;
 }
 static int sbc_ec_keygen(int curve, sbc_buf* out) {
   br_ec_private_key sk; br_ec_public_key pk;
   sbc_u8 kb[BR_EC_KBUF_PRIV_MAX_SIZE], pb[BR_EC_KBUF_PUB_MAX_SIZE];
-  const br_ec_impl* impl = br_ec_get_default();
+  const br_ec_impl* impl = sbc_ec(sbc_curve_br(curve));
   if (!br_ec_keygen(&sbc_prng, impl, &sk, kb, sbc_curve_br(curve))) return SBC_OPERATION;
   if (!br_ec_compute_pub(impl, &pk, pb, &sk)) return SBC_OPERATION;
   size_t need = br_encode_ec_pkcs8_der(0, &sk, &pk);
@@ -10059,8 +10067,9 @@ static int sbc_ecdh(int curve, const sbc_u8* pkcs8, size_t kl, const sbc_u8* pee
   if (sk->curve == sbc_curve_br(curve) && fs && pl == 1 + 2 * fs && peer[0] == 4) {
     sbc_u8 pt[133];
     memcpy(pt, peer, pl);
-    if (br_ec_get_default()->mul(pt, pl, sk->x, sk->xlen, sk->curve)) {
-      size_t xl; size_t xo = br_ec_get_default()->xoff(sk->curve, &xl);
+    const br_ec_impl* impl = sbc_ec(sk->curve);
+    if (impl->mul(pt, pl, sk->x, sk->xlen, sk->curve)) {
+      size_t xl; size_t xo = impl->xoff(sk->curve, &xl);
       sbc_put(out, pt + xo, xl); rc = SBC_OK;
     }
   }

package/src/subtle/README.md

@@ -12,10 +12,10 @@ uses it.
 
 | Need | Source | Licence |
 | --- | --- | --- |
-| SHA-1/256/384/512, HMAC, HKDF | BearSSL 0.6 | MIT |
-| RSA (private and public operations, key generation, PKCS#1 v1.5 padding), RSA-OAEP | BearSSL 0.6 | MIT |
-| ECDSA and ECDH on P-256, P-384, P-521, EC key generation | BearSSL 0.6 | MIT |
-| AES (constant-time), CBC, CTR, GCM | BearSSL 0.6 | MIT |
+| SHA-1/256/384/512, HMAC, HKDF | BearSSL (master 7bea48e) | MIT |
+| RSA (private and public operations, key generation, PKCS#1 v1.5 padding), RSA-OAEP | BearSSL (master 7bea48e) | MIT |
+| ECDSA and ECDH on P-256, P-384, P-521, EC key generation | BearSSL (master 7bea48e) | MIT |
+| AES (constant-time), CBC, CTR, GCM | BearSSL (master 7bea48e) | MIT |
 | Ed25519, X25519 | Monocypher 4.0.2, vendored in `vendor/` | BSD-2-Clause or CC0-1.0 |
 
 BearSSL is already linked into every embedded sprout (standalone binaries and sproutd) for

package/src/subtle/subtle.c

@@ -183,6 +183,17 @@ static int sbc_oid_eq(const sbc_u8* a, size_t al, const sbc_u8* b, size_t bl) {
 
 /* Curve codes used on the wire to JS: 1 = P-256, 2 = P-384, 3 = P-521. */
 static int sbc_curve_br(int c) { return c == 1 ? BR_EC_secp256r1 : c == 2 ? BR_EC_secp384r1 : c == 3 ? BR_EC_secp521r1 : 0; }
+/* BearSSL's default EC implementation is the portable m31 (m15 where there is no 64-bit multiply
+   result). P-256 has a 64-bit specialisation, m64, that is roughly 3x faster to sign and 5x to verify,
+   but BearSSL never selects it by itself. br_ec_p256_m64_get() returns null on a target without a
+   128-bit multiply, and m64 only knows P-256, so every other curve keeps the default. */
+static const br_ec_impl* sbc_ec(int br_curve) {
+  if (br_curve == BR_EC_secp256r1) {
+    const br_ec_impl* fast = br_ec_p256_m64_get();
+    if (fast) return fast;
+  }
+  return br_ec_get_default();
+}
 static int sbc_curve_from_br(int c) { return c == BR_EC_secp256r1 ? 1 : c == BR_EC_secp384r1 ? 2 : c == BR_EC_secp521r1 ? 3 : 0; }
 static size_t sbc_curve_size(int c) { return c == 1 ? 32 : c == 2 ? 48 : c == 3 ? 66 : 0; }
 static void sbc_curve_oid(int c, const sbc_u8** o, size_t* n) {
@@ -380,7 +391,7 @@ static int sbc_decode(int pkcs8, const sbc_u8* der, size_t len, sbc_buf* out) {
       if (cv) {
         sbc_u8 pub[133];
         br_ec_public_key pk;
-        if (br_ec_compute_pub(br_ec_get_default(), &pk, pub, sk) != 0) {
+        if (br_ec_compute_pub(sbc_ec(sk->curve), &pk, pub, sk) != 0) {
           sbc_put1(out, SBC_K_EC); sbc_put1(out, (sbc_u8)cv); sbc_put1(out, 1);
           sbc_field(out, pk.q, pk.qlen);
           /* The scalar, left padded to the field size as JWK d wants it. */
@@ -677,7 +688,7 @@ static int sbc_ecdsa_sign(int bits, const sbc_u8* key, size_t kl, const sbc_u8*
   sbc_u8 h[64], sig[132];
   rc = SBC_OPERATION;
   if (sbc_digest(bits, m, ml, h)) {
-    size_t n = br_ecdsa_sign_raw_get_default()(br_ec_get_default(), sbc_hash(bits), h, sk, sig);
+    size_t n = br_ecdsa_sign_raw_get_default()(sbc_ec(sk->curve), sbc_hash(bits), h, sk, sig);
     if (n) { sbc_put(out, sig, n); rc = SBC_OK; }
   }
   free(dc);
@@ -692,7 +703,7 @@ static int sbc_ecdsa_verify(int bits, int curve, const sbc_u8* point, size_t pl,
   if (sl != 2 * fs) return SBC_OK;
   br_ec_public_key pk;
   pk.curve = sbc_curve_br(curve); pk.q = (sbc_u8*)point; pk.qlen = pl;
-  if (br_ecdsa_vrfy_raw_get_default()(br_ec_get_default(), h, sbc_hlen(bits), &pk, sig, sl)) *ok = 1;
+  if (br_ecdsa_vrfy_raw_get_default()(sbc_ec(pk.curve), h, sbc_hlen(bits), &pk, sig, sl)) *ok = 1;
   return SBC_OK;
 }
 /* A public point is valid when it is on the curve (the group is prime order, cofactor 1). */
@@ -702,12 +713,12 @@ static int sbc_ec_point_ok(int curve, const sbc_u8* point, size_t pl) {
   sbc_u8 q[133];
   memcpy(q, point, pl);
   sbc_u8 one[1] = { 1 };
-  return br_ec_get_default()->mul(q, pl, one, 1, sbc_curve_br(curve)) != 0;
+  return sbc_ec(sbc_curve_br(curve))->mul(q, pl, one, 1, sbc_curve_br(curve)) != 0;
 }
 static int sbc_ec_keygen(int curve, sbc_buf* out) {
   br_ec_private_key sk; br_ec_public_key pk;
   sbc_u8 kb[BR_EC_KBUF_PRIV_MAX_SIZE], pb[BR_EC_KBUF_PUB_MAX_SIZE];
-  const br_ec_impl* impl = br_ec_get_default();
+  const br_ec_impl* impl = sbc_ec(sbc_curve_br(curve));
   if (!br_ec_keygen(&sbc_prng, impl, &sk, kb, sbc_curve_br(curve))) return SBC_OPERATION;
   if (!br_ec_compute_pub(impl, &pk, pb, &sk)) return SBC_OPERATION;
   size_t need = br_encode_ec_pkcs8_der(0, &sk, &pk);
@@ -885,8 +896,9 @@ static int sbc_ecdh(int curve, const sbc_u8* pkcs8, size_t kl, const sbc_u8* pee
   if (sk->curve == sbc_curve_br(curve) && fs && pl == 1 + 2 * fs && peer[0] == 4) {
     sbc_u8 pt[133];
     memcpy(pt, peer, pl);
-    if (br_ec_get_default()->mul(pt, pl, sk->x, sk->xlen, sk->curve)) {
-      size_t xl; size_t xo = br_ec_get_default()->xoff(sk->curve, &xl);
+    const br_ec_impl* impl = sbc_ec(sk->curve);
+    if (impl->mul(pt, pl, sk->x, sk->xlen, sk->curve)) {
+      size_t xl; size_t xo = impl->xoff(sk->curve, &xl);
       sbc_put(out, pt + xo, xl); rc = SBC_OK;
     }
   }

package/src/subtle/subtle.test.ts

@@ -9,7 +9,7 @@ import { assembleSubtleC } from "./assemble";
 
 const bear = join(
   process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? join(homedir(), ".cache/sproutboat"),
-  "bearssl-0.6/bearssl-0.6",
+  "bearssl-7bea48e/BearSSL-7bea48e",
 );
 const lib = join(bear, "build/libbearssl.a");
 // SUBTLE_DRIVER: a prebuilt driver binary (a machine with no C compiler, or a cross-built one).

package/src/transport-embedded.js

@@ -4962,8 +4962,13 @@ function __sbEmbeddedDispatch(msg) {
   if (op === "secret.get") {
     // Secrets reach a standalone binary through the environment, the same
     // channel the launcher and the supervisor use; there is nothing to decrypt.
-    const value = __sbEnv(String(msg.name));
-    if (!value) throw new Error("secret not set: " + msg.name);
+    const raw = __sbEnv(String(msg.name));
+    if (!raw) throw new Error("secret not set: " + msg.name);
+    // __sbEnv hands back the environment's bytes as a bytestring, one char per byte, so a UTF-8 secret ("é" is
+    // C3 A9) reached the app as "é". From compatibility date 2026-11-07 it is decoded as UTF-8, as workerd's
+    // secrets are text. Bytes that are not valid UTF-8 pass through unchanged (__sbFromUtf8's rule). The broker
+    // transport is not touched: its secrets arrive as JSON, already real strings.
+    const value = __sbCompatDate() >= "2026-11-07" ? __sbFromUtf8(raw) : raw;
     return { ok: true, value };
   }
 

package/test/bearssl.ts

@@ -7,9 +7,10 @@ import { join, resolve } from "node:path";
 // The prelude carries crypto.subtle's native half on every transport, so a test that compiles a
 // handler using crypto.subtle needs BearSSL on the include path and link line, as the CLI arranges
 // for a build. Same pinned source as the CLI's src/bearssl.ts; built once into the toolchain cache.
-const VERSION = "0.6";
-const URL_ = `https://bearssl.org/bearssl-${VERSION}.tar.gz`;
-const SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14";
+const COMMIT = "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f";
+const VERSION = COMMIT.slice(0, 7);
+const URL_ = `https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=${COMMIT};sf=tgz`;
+const SHA256 = "ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372";
 
 const walk = async (dir: string): Promise<string[]> =>
   (
@@ -28,7 +29,7 @@ export async function bearsslEnv(): Promise<{ SB_EXTRA_CFLAGS: string; SB_EXTRA_
     process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? join(homedir(), ".cache/sproutboat"),
     `bearssl-${VERSION}-test`,
   );
-  const tree = join(root, `bearssl-${VERSION}`);
+  const tree = join(root, `BearSSL-${VERSION}`);
   const objects = join(root, "obj");
   const marker = join(objects, ".complete");
   if (!existsSync(marker)) {