@threadedstack/wmd-web 0.1.17 → 0.1.19

package/src/registry/load-tar.js

@@ -0,0 +1,473 @@
+// An image tar -> packs, in the page: the other half of pull.js. It reads what `buildctl build --output
+// type=oci` or `type=docker` writes (an OCI image layout: oci-layout, index.json, blobs/sha256/..., and for
+// type=docker also manifest.json) or a `docker save` tar (manifest.json, <hex>.json, layer tars), and returns
+// what pullImage returns: { index, packs } with an IMAGE_SCHEMA index (layers top first) and the packs in that
+// order, converted with wmdpack.wasm exactly as pull.js converts a downloaded layer. Also `name`: the
+// io.containerd.image.name annotation of the index, or null.
+//
+//   const { index, packs, name } = await loadImageTar(bytes, { converter: wmdpackWasmUrl, platform: 'linux/arm64' })
+//
+// The tar is read in place: a Uint8Array is indexed (entry offsets) and each blob is a view of it (the one
+// copy is the layer handed to the converter Worker); a Blob is read one entry at a time, so the whole tar is
+// never in memory at once.
+
+import { createConverter } from './converter.js'
+import { RegistryError, sha256 } from './hub.js'
+import { CONVERTER } from './pull.js'
+import { isAttestation, isIndexType, isLayerType, isManifestType, isZstdLayer, MAX_LAYERS, pickPlatform } from './oci.js'
+import { IMAGE_SCHEMA, isDigest, parsePlatform, platformMatches, platformString } from './ref.js'
+
+const MAX_JSON = 4 << 20
+const NAME_ANNOTATION = 'io.containerd.image.name'
+const dec = new TextDecoder()
+const unshared = b => (typeof SharedArrayBuffer !== 'undefined' && b.buffer instanceof SharedArrayBuffer ? b.slice() : b)
+const fail = msg => {
+  throw new RegistryError(`image tar: ${msg}`, 400)
+}
+
+
+const K256 = Uint32Array.from(
+  '428a2f98 71374491 b5c0fbcf e9b5dba5 3956c25b 59f111f1 923f82a4 ab1c5ed5 d807aa98 12835b01 243185be 550c7dc3 72be5d74 80deb1fe 9bdc06a7 c19bf174 e49b69c1 efbe4786 0fc19dc6 240ca1cc 2de92c6f 4a7484aa 5cb0a9dc 76f988da 983e5152 a831c66d b00327c8 bf597fc7 c6e00bf3 d5a79147 06ca6351 14292967 27b70a85 2e1b2138 4d2c6dfc 53380d13 650a7354 766a0abb 81c2c92e 92722c85 a2bfe8a1 a81a664b c24b8b70 c76c51a3 d192e819 d6990624 f40e3585 106aa070 19a4c116 1e376c08 2748774c 34b0bcb5 391c0cb3 4ed8aa4a 5b9cca4f 682e6ff3 748f82ee 78a5636f 84c87814 8cc70208 90befffa a4506ceb bef9a3f7 c67178f2'
+    .split(' ')
+    .map(x => parseInt(x, 16)),
+)
+
+/** An incremental SHA-256 (WebCrypto has none): update(chunk) as the bytes arrive, digest() -> 'sha256:<hex>'. */
+class Sha256 {
+  constructor() {
+    this.h = Uint32Array.of(0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19)
+    this.buf = new Uint8Array(64)
+    this.n = 0 // bytes in buf
+    this.len = 0
+    this.w = new Uint32Array(64)
+  }
+
+  block(b, o) {
+    const { h, w } = this
+    const rotr = (x, n) => (x >>> n) | (x << (32 - n))
+    for (let i = 0; i < 16; i++) w[i] = ((b[o + i * 4] << 24) | (b[o + i * 4 + 1] << 16) | (b[o + i * 4 + 2] << 8) | b[o + i * 4 + 3]) | 0
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3)
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10)
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0
+    }
+    let [a, b2, c, d, e, f, g, hh] = h
+    for (let i = 0; i < 64; i++) {
+      const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K256[i] + w[i]) | 0
+      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b2) ^ (a & c) ^ (b2 & c))) | 0
+      hh = g
+      g = f
+      f = e
+      e = (d + t1) | 0
+      d = c
+      c = b2
+      b2 = a
+      a = (t1 + t2) | 0
+    }
+    h[0] += a
+    h[1] += b2
+    h[2] += c
+    h[3] += d
+    h[4] += e
+    h[5] += f
+    h[6] += g
+    h[7] += hh
+  }
+
+  update(u8) {
+    this.len += u8.length
+    let i = 0
+    if (this.n) {
+      const take = Math.min(64 - this.n, u8.length)
+      this.buf.set(u8.subarray(0, take), this.n)
+      this.n += take
+      i = take
+      if (this.n < 64) return
+      this.block(this.buf, 0)
+      this.n = 0
+    }
+    for (; i + 64 <= u8.length; i += 64) this.block(u8, i)
+    this.buf.set(u8.subarray(i), 0)
+    this.n = u8.length - i
+  }
+
+  digest() {
+    const bits = this.len * 8
+    const pad = new Uint8Array((this.n < 56 ? 64 : 128) - this.n)
+    pad[0] = 0x80
+    const dv = new DataView(pad.buffer)
+    dv.setUint32(pad.length - 8, Math.floor(bits / 2 ** 32))
+    dv.setUint32(pad.length - 4, bits >>> 0)
+    const keep = this.len
+    this.update(pad)
+    this.len = keep
+    return `sha256:${[...this.h].map(x => (x >>> 0).toString(16).padStart(8, '0')).join('')}`
+  }
+}
+
+/** sha256 of the gunzipped bytes, streamed (the decompressed layer is never held whole). */
+async function gunzipDigest(bytes, what) {
+  const sha = new Sha256()
+  try {
+    const rd = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('gzip')).getReader()
+    for (;;) {
+      const { done, value } = await rd.read()
+      if (done) break
+      sha.update(value)
+    }
+  } catch (e) {
+    fail(`${what} is not valid gzip (${e.message})`)
+  }
+  return sha.digest()
+}
+
+/** A reader over the tar's bytes: read(off, len) -> Uint8Array (a view for bytes, a fresh copy for a Blob). */
+function source(input) {
+  if (input instanceof Uint8Array) return { size: input.length, read: async (off, len) => input.subarray(off, off + len) }
+  if (input instanceof ArrayBuffer) return source(new Uint8Array(input))
+  if (typeof Blob !== 'undefined' && input instanceof Blob) {
+    return { size: input.size, read: async (off, len) => new Uint8Array(await input.slice(off, off + len).arrayBuffer()) }
+  }
+  throw new TypeError('loadImageTar: the tar as a Uint8Array, ArrayBuffer or Blob')
+}
+
+const field = (h, a, l) => dec.decode(h.subarray(a, a + l)).replace(/\0[\s\S]*$/, '')
+function tarSize(h) {
+  if (h[124] & 0x80) {
+    // base-256 (GNU)
+    let n = 0
+    for (let i = 125; i < 136; i++) n = n * 256 + h[i]
+    return n
+  }
+  return parseInt(field(h, 124, 12).trim() || '0', 8)
+}
+const paxFields = text => {
+  const o = {}
+  for (const line of text.split('\n')) {
+    const sp = line.indexOf(' ')
+    const eq = line.indexOf('=', sp)
+    if (sp > 0 && eq > 0) o[line.slice(sp + 1, eq)] = line.slice(eq + 1)
+  }
+  return o
+}
+
+const isUstar = h => field(h, 257, 6) === 'ustar' && h[263] === 0x30 && h[264] === 0x30
+function checksumOk(h) {
+  const want = parseInt(field(h, 148, 8).trim() || 'x', 8)
+  if (!Number.isInteger(want)) return false
+  let u = 0
+  let sg = 0
+  for (let i = 0; i < 512; i++) {
+    const c = i >= 148 && i < 156 ? 0x20 : h[i]
+    u += c
+    sg += c > 127 ? c - 256 : c
+  }
+  return want === u || want === sg
+}
+
+/**
+ * The files of the tar: Map name -> {off, size, type, link}. type '0' is a regular file, '1' a hard link and
+ * '2' a symlink (link is its target). Reads the 512-byte headers only (and the metadata records).
+ */
+async function indexTar(src) {
+  const files = new Map()
+  let off = 0
+  let longName = null
+  let longLink = null
+  let pax = null
+  while (off + 512 <= src.size) {
+    const h = await src.read(off, 512)
+    if (h.length < 512 || h.every(x => x === 0)) break
+    if (!checksumOk(h)) fail(`bad tar header checksum at offset ${off}`)
+    let name = field(h, 0, 100)
+    const prefix = field(h, 345, 155)
+    if (prefix && isUstar(h)) name = `${prefix}/${name}`
+    let size = tarSize(h)
+    const type = String.fromCharCode(h[156] || 48)
+    const meta = 'LKxgDV'.includes(type)
+    if (type === 'x' || type === 'L' || type === 'K') {
+      // a record's own size is the header's
+    } else if (pax?.size !== undefined && !meta) {
+      size = Number(pax.size)
+    }
+    if (!Number.isSafeInteger(size) || size < 0) fail(`bad entry size for ${name}`)
+    const body = off + 512
+    if (body + size > src.size) fail(`the tar is cut short inside ${name}`)
+    off = body + Math.ceil(size / 512) * 512
+    if (meta) {
+      if (type === 'g' || type === 'D' || type === 'V') continue
+      if (size > 1 << 20) fail('an oversized name record')
+      const text = dec.decode(await src.read(body, size))
+      if (type === 'L') longName = text.replace(/\0[\s\S]*$/, '')
+      else if (type === 'K') longLink = text.replace(/\0[\s\S]*$/, '')
+      else pax = paxFields(text)
+      continue
+    }
+    let link = field(h, 157, 100)
+    if (pax?.path) name = pax.path
+    if (longName) name = longName
+    if (pax?.linkpath) link = pax.linkpath
+    if (longLink) link = longLink
+    longName = null
+    longLink = null
+    pax = null
+    name = name.replace(/^(\.\/)+/, '')
+    if (type === '0') files.set(name, { off: body, size, type })
+    else if (type === '1' || type === '2') files.set(name, { off: body, size: 0, type, link })
+  }
+  return files
+}
+
+const normPath = p => {
+  const out = []
+  for (const seg of p.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg === '..') out.pop()
+    else out.push(seg)
+  }
+  return out.join('/')
+}
+/** The regular file a name leads to, through symlinks and hard links (at most 16 hops), or undefined. */
+function resolveEntry(files, name) {
+  let path = normPath(name)
+  for (let hops = 0; hops <= 16; hops++) {
+    const e = files.get(path)
+    if (!e) return undefined
+    if (e.type === '0') return e
+    // a symlink is relative to its folder (or absolute from the tar's root); a hard link names a path from the root
+    path = e.type === '2' && !e.link.startsWith('/') ? normPath(`${path.split('/').slice(0, -1).join('/')}/${e.link}`) : normPath(e.link)
+  }
+  return fail(`${name}: too many links`)
+}
+
+const isGzip = b => b.length > 2 && b[0] === 0x1f && b[1] === 0x8b
+const isZstd = b => b.length >= 4 && b[0] === 0x28 && b[1] === 0xb5 && b[2] === 0x2f && b[3] === 0xfd
+
+/**
+ * @param {Uint8Array|ArrayBuffer|Blob} input the image tar
+ * @param {object} o
+ * @param {string|URL|Uint8Array|WebAssembly.Module|{convert: Function, add: Function}} o.converter wmdpack.wasm, or a converter from createConverter
+ * @param {string|string[]} [o.platform] default linux/arm64
+ * @returns {Promise<{index: object, packs: Uint8Array[], name: string|null}>} packs top first, as index.layers
+ */
+export async function loadImageTar(input, o = {}) {
+  const t0 = performance.now()
+  if (!o.converter) throw new TypeError('loadImageTar: pass converter: wmdpack.wasm (a URL, its bytes or a WebAssembly.Module)')
+  const wants = (Array.isArray(o.platform) ? o.platform : [o.platform || 'linux/arm64']).map(p => parsePlatform(p))
+  const wantsText = wants.map(platformString).join(' or ')
+  const src = source(input)
+  const magic = await src.read(0, 4)
+  if (isGzip(magic) || isZstd(magic)) fail(`the image tar is compressed (${isGzip(magic) ? 'gzip' : 'zstd'}); give the plain tar`)
+  const files = await indexTar(src)
+  const entry = path => {
+    const e = resolveEntry(files, path)
+    if (!e) fail(`it has no ${path}`)
+    return e
+  }
+  const readFile = async path => {
+    const e = entry(path)
+    return src.read(e.off, e.size)
+  }
+  const readJson = async (path, what) => {
+    const e = entry(path)
+    if (e.size > MAX_JSON) fail(`${what} is ${e.size} bytes (at most ${MAX_JSON})`)
+    try {
+      return JSON.parse(dec.decode(await src.read(e.off, e.size)))
+    } catch {
+      return fail(`${what} is not JSON`)
+    }
+  }
+  /** A blob by descriptor: size and sha256 checked. */
+  const blob = async (d, what) => {
+    if (!isDigest(d?.digest)) fail(`bad ${what} descriptor ${JSON.stringify(d).slice(0, 200)}`)
+    const path = `blobs/sha256/${d.digest.slice(7)}`
+    const e = resolveEntry(files, path)
+    if (!e) fail(`it has no blob ${d.digest} (${what})`)
+    if (Number.isSafeInteger(d.size) && d.size !== e.size) fail(`${what} ${d.digest.slice(0, 19)}: ${e.size} bytes, the descriptor says ${d.size}`)
+    const b = await src.read(e.off, e.size)
+    const got = await sha256(unshared(b))
+    if (got !== d.digest) fail(`${what} ${d.digest.slice(0, 19)} hashes to ${got.slice(0, 19)}`)
+    return b
+  }
+  const blobJson = async (d, what) => {
+    if (d.size > MAX_JSON) fail(`${what} is ${d.size} bytes (at most ${MAX_JSON})`)
+    const b = await blob(d, what)
+    try {
+      return JSON.parse(dec.decode(b))
+    } catch {
+      return fail(`${what} is not JSON`)
+    }
+  }
+
+  let name = null
+  let indexDigest = null
+  let manifestDigest = null
+  let cfg
+  let layers // [{digest, mediaType, size, get: () => Promise<Uint8Array>}] bottom first
+  let have = []
+
+  if (resolveEntry(files, 'index.json')) {
+    // an OCI layout (also what type=docker writes, beside manifest.json)
+    if (resolveEntry(files, 'oci-layout')) {
+      const l = await readJson('oci-layout', 'oci-layout')
+      if (l.imageLayoutVersion && !/^1\./.test(l.imageLayoutVersion)) fail(`unsupported image layout ${l.imageLayoutVersion}`)
+    }
+    const top = await readJson('index.json', 'index.json')
+    if (!Array.isArray(top.manifests) || top.manifests.length === 0) fail('index.json lists no manifests')
+    for (const m of top.manifests) name ??= m?.annotations?.[NAME_ANNOTATION] || null
+    let doc = top
+    let want = null
+    let man = null
+    for (let depth = 0; ; depth++) {
+      if (depth > 3) fail('indexes nested too deep')
+      const pick = pickPlatform(doc, want ? [want] : wants)
+      have = [...new Set([...have, ...pick.have || []])]
+      let desc = pick.desc
+      if (!desc) {
+        // BuildKit's index.json names its image manifest without a platform: take it, the config is checked below
+        desc = doc.manifests.find(m => m && isDigest(m.digest) && !m.platform && !isAttestation(m) && !isIndexType(m.mediaType || ''))
+        if (!desc) break
+      } else if (pick.platform) want = pick.platform
+      const d = desc
+      const sub = await blobJson(d, 'manifest')
+      if (isIndexType(d.mediaType || '') || (Array.isArray(sub.manifests) && !sub.layers)) {
+        indexDigest ??= d.digest
+        doc = sub
+        continue
+      }
+      man = { doc: sub, digest: d.digest, mediaType: d.mediaType || sub.mediaType || '' }
+      break
+    }
+    if (!man) fail(`no ${wantsText} image in it (it has: ${have.length ? have.join(', ') : 'no platforms'})`)
+    if (man.doc.schemaVersion === 1 || !(isManifestType(man.mediaType) || Array.isArray(man.doc.layers))) fail(`unsupported manifest type ${JSON.stringify(man.mediaType)}`)
+    manifestDigest = man.digest
+    if (!man.doc.config || !isDigest(man.doc.config.digest)) fail('the manifest has no config')
+    cfg = await blobJson(man.doc.config, 'config')
+    const ls = man.doc.layers
+    if (!Array.isArray(ls) || ls.length === 0) fail('the manifest has no layers')
+    if (ls.length > MAX_LAYERS) fail(`${ls.length} layers (at most ${MAX_LAYERS})`)
+    for (const l of ls) {
+      if (!isDigest(l?.digest) || !Number.isSafeInteger(l.size) || l.size < 0) fail(`bad layer descriptor ${JSON.stringify(l).slice(0, 200)}`)
+      if (isZstdLayer(l.mediaType)) fail(`layer ${l.digest.slice(0, 19)} is zstd; the page's converter takes tar and gzip layers only`)
+      if (!isLayerType(l.mediaType || '', { zstd: false })) fail(`layer ${l.digest.slice(0, 19)} has media type ${l.mediaType} (foreign or not a filesystem tar)`)
+    }
+    layers = ls.map(l => ({ digest: l.digest, size: l.size, get: () => blob(l, 'layer') }))
+  } else if (resolveEntry(files, 'manifest.json')) {
+    // docker save
+    const list = await readJson('manifest.json', 'manifest.json')
+    if (!Array.isArray(list) || list.length === 0) fail('manifest.json lists no images')
+    const picks = []
+    for (const m of list) {
+      const cb = await readFile(String(m?.Config ?? ''))
+      let c
+      try {
+        c = JSON.parse(dec.decode(cb))
+      } catch {
+        fail(`${m.Config} is not JSON`)
+      }
+      const p = c.os && c.architecture ? { os: c.os, architecture: c.architecture, variant: c.variant || '' } : null
+      picks.push({ m, c, cb, p })
+      if (p) have.push(platformString(p))
+    }
+    const hit = picks.find(x => x.p && wants.some(w => platformMatches(w, x.p)))
+    if (!hit) fail(`no ${wantsText} image in it (it has: ${have.length ? [...new Set(have)].join(', ') : 'no platforms'})`)
+    const { m, c, cb } = hit
+    const cm = /^(?:blobs\/sha256\/)?([0-9a-f]{64})(?:\.json)?$/.exec(m.Config)
+    if (cm && (await sha256(unshared(cb))) !== `sha256:${cm[1]}`) fail(`${m.Config} does not hash to its name`)
+    cfg = c
+    name = Array.isArray(m.RepoTags) && m.RepoTags.length ? m.RepoTags[0] : null
+    const paths = m.Layers
+    if (!Array.isArray(paths) || paths.length === 0) fail('the image has no layers')
+    if (paths.length > MAX_LAYERS) fail(`${paths.length} layers (at most ${MAX_LAYERS})`)
+    const diffIds = Array.isArray(c.rootfs?.diff_ids) ? c.rootfs.diff_ids : []
+    layers = paths.map((p, i) => ({
+      digest: null,
+      size: resolveEntry(files, p)?.size ?? fail(`it has no layer ${p}`),
+      get: async () => {
+        const b = await readFile(p)
+        if (isZstd(b)) fail(`layer ${p} is zstd; the page's converter takes tar and gzip layers only`)
+        const got = await sha256(unshared(b))
+        // the config's diff_id is the digest of the uncompressed tar (a gzip layer is gunzipped, streamed, to check it)
+        const diff = isGzip(b) ? await gunzipDigest(b, `layer ${p}`) : got
+        if (diffIds[i] && diffIds[i] !== diff) fail(`layer ${p} hashes to ${diff.slice(0, 19)}, the config says ${diffIds[i].slice(0, 19)}`)
+        return { b, digest: diffIds[i] || diff }
+      },
+    }))
+  } else {
+    fail('it is neither an OCI image layout (index.json) nor a docker save tar (manifest.json)')
+  }
+
+  // the platform is checked against the config too: an index entry can lie
+  const cfgPlat = cfg.os && cfg.architecture ? { os: cfg.os, architecture: cfg.architecture, variant: cfg.variant || '' } : null
+  const want = cfgPlat ? wants.find(w => platformMatches(w, cfgPlat)) : wants[0]
+  if (!want || (cfgPlat && !platformMatches(want, cfgPlat))) {
+    const had = [...new Set([...have, ...(cfgPlat ? [platformString(cfgPlat)] : [])])]
+    fail(`no ${wantsText} image in it (it has: ${had.length ? had.join(', ') : 'no platforms'})`)
+  }
+
+  // layers, bottom first, each converted over the packs below it
+  const ownConverter = !(typeof o.converter?.convert === 'function')
+  const conv = ownConverter ? await createConverter(o.converter) : o.converter
+  const out = []
+  let convertMs = 0
+  let fileBytes = 0
+  let wasmBytes = 0
+  let layerBytes = 0
+  try {
+    for (let i = 0; i < layers.length; i++) {
+      const l = layers[i]
+      const got = await l.get()
+      const b = got.b || got
+      if (isZstd(b)) fail(`layer ${l.digest ? l.digest.slice(0, 19) : i} is zstd; the page's converter takes tar and gzip layers only`)
+      layerBytes += b.length
+      const below = out.map(x => x.pack).reverse()
+      const r = await conv.convert(b, below)
+      convertMs += r.ms
+      fileBytes += r.fileBytes
+      wasmBytes = Math.max(wasmBytes, r.wasmBytes || 0)
+      out.push({ pack: r.sha, size: r.size, layer: l.digest || got.digest, bytes: r.bytes })
+    }
+  } finally {
+    if (ownConverter) conv.close()
+  }
+
+  const c = cfg.config || {}
+  const top = out.slice().reverse()
+  const index = {
+    schema: IMAGE_SCHEMA,
+    ref: name || '',
+    platform: platformString(want),
+    index: indexDigest,
+    manifest: manifestDigest,
+    os: cfg.os || null,
+    architecture: cfg.architecture || null,
+    config: {
+      Env: c.Env || null,
+      Cmd: c.Cmd || null,
+      Entrypoint: c.Entrypoint || null,
+      WorkingDir: c.WorkingDir || '',
+      User: c.User || '',
+      ExposedPorts: c.ExposedPorts || null,
+      Labels: c.Labels || null,
+      Volumes: c.Volumes || null,
+      StopSignal: c.StopSignal || '',
+      Healthcheck: c.Healthcheck || null,
+    },
+    layers: top.map(x => ({ pack: x.pack, size: x.size, layer: x.layer })),
+    converter: CONVERTER,
+    pulled: new Date().toISOString(),
+    stats: {
+      totalMs: Math.round(performance.now() - t0),
+      layerBytes,
+      downloadBytes: 0,
+      downloadMs: 0,
+      convertMs,
+      fileBytes,
+      wasmBytes,
+      packBytes: out.reduce((a, x) => a + x.size, 0),
+      cachedLayers: 0,
+      tarFiles: files.size,
+    },
+  }
+  return { index, packs: top.map(x => x.bytes), name, rawConfig: cfg }
+}

package/src/registry/pull.js

@@ -66,7 +66,8 @@ async function fromStore(store, key) {
  * @param {{get: (key: string) => any, put: (key: string, bytes: Uint8Array) => any}} [o.store]
  * @param {number} [o.concurrency] downloads at once (default 3)
  * @param {string[]} [o.local] test registry host:port names allowed besides Docker Hub
- * @returns {Promise<{index: object, packs: Uint8Array[]}>} packs top first, as index.layers
+ * @param {string} [o.mirror] 'http(s)://host[:port]': a Docker Hub mirror tried first for docker.io references (its host is allowed because it is named here)
+ * @returns {Promise<{index: object, packs: Uint8Array[], rawConfig: object}>} packs top first, as index.layers
  */
 export async function pullImage(refStr, o = {}) {
   const t0 = performance.now()
@@ -74,7 +75,7 @@ export async function pullImage(refStr, o = {}) {
   const wants = (Array.isArray(o.platform) ? o.platform : o.platform ? [o.platform] : DEFAULT_PLATFORMS).map(p => parsePlatform(p))
   const ev = o.onProgress || (() => {})
   const sig = o.signal
-  const hub = new HubRepo(ref, { fetch: o.fetch, local: o.local })
+  const hub = new HubRepo(ref, { fetch: o.fetch, local: o.local, mirror: o.mirror })
   if (!o.converter) throw new TypeError('pullImage: pass converter: wmdpack.wasm (a URL, its bytes or a WebAssembly.Module)')
 
   // 1. resolve
@@ -254,5 +255,6 @@ export async function pullImage(refStr, o = {}) {
       cachedLayers: out.filter(x => x.cached).length,
     },
   }
-  return { index, packs: top.map(x => x.bytes) }
+  // rawConfig: the image config blob as parsed JSON (rootfs.diff_ids, history, config.OnBuild, config.Shell...): the build fast path reads it
+  return { index, packs: top.map(x => x.bytes), rawConfig: cfg }
 }

package/src/worker.js

@@ -35,6 +35,7 @@ import { WasiExit, createWasi } from './host/wasi.js'
 import { createJitDoor, poolProbe, TABLE_MIN } from './host/jit.js'
 import { stdioWriter } from './host/stdio.js'
 import { createWmdImports } from './host/wmd-imports.js'
+import { createDiskImports } from './host/disk.js'
 import { createRamImports } from './host/ram-mem.js'
 import { createChanImports } from './host/chan.js'
 import { createCkptImports } from './host/ckpt-point.js'
@@ -176,6 +177,7 @@ async function run(m) {
     chan,
     ckpt,
     ram: ramImports,
+    blk: m.blk ? createDiskImports({ memory, mailbox: m.blk }) : null, // a disk (host/disk.js)
     counters: ctl, // stub calls (chan_open, snapshot, jit_* without a door) are counted in ctl, read by the page
   })