sproutboat 0.51.0 → 0.51.1

package/CHANGELOG.md

@@ -10,6 +10,25 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.51.1] - 2026-11-05
+
+Built on `@sproutboat/runtime` 0.42.2, `@sproutboat/toolchain` 0.23.1 and `@sproutboat/wire` 0.22.2. Nothing an app can observe changes except latency, the refused address ranges below and the `startTls()` write order, so there is no new compatibility date.
+
+### Fixed
+
+- **Bytes written right after `socket.startTls()` no longer go out unencrypted.** On a `connect()` socket, the I/O thread took the start-TLS request and the app's queued writes in the same pass, and flushed all of them in plaintext before switching to TLS. Any write queued before the thread picked up the upgrade could leave in the clear. Only the bytes written before `startTls()` now go out in plaintext. Everything after waits until the TLS engine owns the socket, and new writes on the old plaintext socket reject, as in workerd. A failed plaintext flush is now a connection error. The egress tunnel also no longer stays paused on the discarded plain socket after an upgrade under backpressure.
+
+- The BearSSL source ships in the package (`vendor/bearssl`, 867 KB) and is read first, hash-verified, so builds no longer depend on bearssl.org being up. bearssl.org stays as the fallback, with bounded retry on 5xx. Every source, vendored or downloaded, is checked against the pinned sha256, so a bad file cannot change what gets built.
+- **A malformed `connect()` tunnel opening frame no longer ends the egress process.** A `tcp.open` head whose JSON did not parse used to throw out of the egress service's socket handler before the token was checked, which took egress down for every app. It now gets an `expected tcp.open` error frame and only that connection closes; the broker answers it as a bad request, and a refused head stops buffering whatever the client keeps sending.
+
+### Changed
+
+- **`fetch()` and `connect()` refuse more reserved address space** that carries no public service: AS112 and the old IPv4 anycast blocks (`192.31.196.0/24`, `192.52.193.0/24`, `192.88.99.0/24`, `192.175.48.0/24`), SIIT (`::ffff:0:0:0/96`), IETF protocol assignments including Teredo (`2001::/23`), `3fff::/20` and SRv6 (`5f00::/16`). This applies to the broker, the egress service and a standalone binary alike, and `SB_EGRESS_ALLOW` still overrides it.
+
+### Performance
+
+- **Outbound TCP sockets set `TCP_NODELAY`.** Nagle's algorithm and the peer's delayed ACK stalled every fresh HTTPS `fetch()` by about 44 ms on Linux, because each small TLS handshake flight waited for an ACK; a fresh fetch now takes about 1.4 ms. This covers `fetch()`, outbound WebSockets and `connect()` on a standalone binary, including sockets handed over by `SB_EGRESS_FD`, and the egress tunnel's connections to origins.
+
 ## [0.51.0] - 2026-11-03
 
 Built on `@sproutboat/runtime` 0.42.0, `@sproutboat/toolchain` 0.23.0 and `@sproutboat/wire` 0.22.0. The change below starts at a new compatibility date; earlier dates answer as before.

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.51.0
+**Package:** `sproutboat` 0.51.1
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.51.0",
+  "version": "0.51.1",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.42.0",
-    "@sproutboat/toolchain": "^0.23.0",
-    "@sproutboat/wire": "^0.22.0"
+    "@sproutboat/runtime": "^0.42.2",
+    "@sproutboat/toolchain": "^0.23.1",
+    "@sproutboat/wire": "^0.22.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.51.0",
-    "@sproutboat/cli-darwin-x64": "0.51.0",
-    "@sproutboat/cli-linux-arm64": "0.51.0",
-    "@sproutboat/cli-linux-x64": "0.51.0"
+    "@sproutboat/cli-darwin-arm64": "0.51.1",
+    "@sproutboat/cli-darwin-x64": "0.51.1",
+    "@sproutboat/cli-linux-arm64": "0.51.1",
+    "@sproutboat/cli-linux-x64": "0.51.1"
   },
   "engines": {
     "node": ">=18"

package/src/bearssl.ts

@@ -19,6 +19,9 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+// @ts-expect-error Bun's file loader returns the embedded asset path in a compiled executable.
+import embeddedBearsslArchive from "../vendor/bearssl/bearssl-7bea48e.tar.gz" with { type: "file" };
+import { fetchPinned, type FetchPinnedOptions } from "./fetch-pinned";
 import { LINUX_TARGETS, type BuildTarget } from "./targets";
 import { resolveHostCompiler } from "./toolchain";
 
@@ -112,12 +115,22 @@ const run = (
     child.on("close", (code) => done({ code: code ?? 1, stderr }));
   });
 
+/**
+ * The pinned BearSSL source: the vendored copy (ships in the npm package, embedded in standalone
+ * binaries) first, bearssl.org only as a fallback. bearssl.org returned 502 for hours on 2026-11-04.
+ */
+export const bearsslVendorArchive = (): string => embeddedBearsslArchive;
+
+export const fetchBearsslTarball = (overrides: Partial<FetchPinnedOptions> = {}): Promise<Buffer> =>
+  fetchPinned({
+    localPath: bearsslVendorArchive(),
+    urls: [BEARSSL_URL],
+    sha256: BEARSSL_SHA256,
+    ...overrides,
+  });
+
 async function download(url: string, expected: string, to: string): Promise<Buffer> {
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`could not download ${url}: HTTP ${response.status}`);
-  const bytes = Buffer.from(await response.arrayBuffer());
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== expected) throw new Error(`checksum mismatch for ${url}: expected ${expected}, got ${digest}`);
+  const bytes = await fetchPinned({ urls: [url], sha256: expected });
   await writeFile(to, bytes);
   return bytes;
 }
@@ -143,7 +156,7 @@ async function sourceTree(): Promise<string> {
     await rm(tree, { recursive: true, force: true });
     if (!existsSync(tarball) || (await digest(tarball)) !== BEARSSL_SHA256) {
       await rm(tarball, { force: true });
-      await download(BEARSSL_URL, BEARSSL_SHA256, tarball);
+      await writeFile(tarball, await fetchBearsslTarball());
     }
     const stage = resolve(dir, `.bearssl-stage-${process.pid}-${crypto.randomUUID()}`);
     await mkdir(stage, { recursive: true });

package/src/fetch-pinned.ts

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+type Fetcher = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+export type FetchPinnedOptions = {
+  /** A vendored copy read from disk before any network source. Used only if its hash matches. */
+  localPath?: string;
+  /** Ordered download sources, tried after the vendored copy. Every one must serve the same bytes. */
+  urls: readonly string[];
+  /** Lowercase hex sha256 of the exact bytes. A source that serves anything else is rejected. */
+  sha256: string;
+  /** A verified copy is kept here (written atomically) and reused while its hash matches. */
+  cachePath?: string;
+  fetcher?: Fetcher;
+  /** Attempts per source for a 5xx or a network error. 4xx and a hash mismatch are never retried. */
+  attempts?: number;
+  /** First backoff; doubles each retry. */
+  backoffMs?: number;
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+};
+
+const sha256Hex = (bytes: Uint8Array): string => createHash("sha256").update(bytes).digest("hex");
+
+/** A failure that will not change on retry: a 4xx, or bytes that fail the pin. */
+class Permanent extends Error {}
+
+/**
+ * Return a build-time dependency's bytes, only if they hash to the pinned sha256: first the vendored
+ * file (`localPath`), then the ordered download list. The pin is what makes every source safe: one
+ * that has different bytes (a tampered vendored file included) is skipped, so the list can only
+ * improve availability, never change what gets built. A 5xx or a network error is retried with exponential backoff (bounded); a 4xx or a
+ * hash mismatch moves straight on to the next source.
+ */
+export async function fetchPinned(options: FetchPinnedOptions): Promise<Buffer> {
+  const sha256 = options.sha256.toLowerCase();
+  const fetcher: Fetcher = options.fetcher ?? fetch;
+  const attempts = Math.max(1, options.attempts ?? 3);
+  const sleep = options.sleep ?? ((ms: number) => Bun.sleep(ms));
+  if (options.localPath && existsSync(options.localPath)) {
+    const vendored = await readFile(options.localPath);
+    if (sha256Hex(vendored) === sha256) return vendored;
+    console.warn(
+      `fetchPinned: vendored ${options.localPath} does not match the pinned sha256, falling back to download`,
+    );
+  }
+  if (options.cachePath && existsSync(options.cachePath)) {
+    const cached = await readFile(options.cachePath);
+    if (sha256Hex(cached) === sha256) return cached;
+    await rm(options.cachePath, { force: true });
+  }
+  const failures: string[] = [];
+  for (const url of options.urls) {
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      if (attempt > 0) await sleep((options.backoffMs ?? 500) * 2 ** (attempt - 1));
+      try {
+        const response = await fetcher(url, { signal: AbortSignal.timeout(options.timeoutMs ?? 60_000) });
+        if (response.status >= 500) throw new Error(`HTTP ${response.status}`);
+        if (!response.ok) throw new Permanent(`HTTP ${response.status}`);
+        const bytes = Buffer.from(await response.arrayBuffer());
+        const got = sha256Hex(bytes);
+        if (got !== sha256) throw new Permanent(`sha256 mismatch (expected ${sha256}, got ${got})`);
+        if (options.cachePath) {
+          await mkdir(dirname(options.cachePath), { recursive: true });
+          const stage = `${options.cachePath}.${process.pid}.tmp`;
+          await writeFile(stage, bytes);
+          await rename(stage, options.cachePath);
+        }
+        return bytes;
+      } catch (error) {
+        failures.push(`${url}: ${error instanceof Error ? error.message : String(error)}`);
+        if (error instanceof Permanent) break;
+      }
+    }
+  }
+  throw new Error(`could not download a verified copy (sha256 ${sha256}) from any source:\n  ${failures.join("\n  ")}`);
+}

package/vendor/bearssl/LICENSE.txt

@@ -0,0 +1,21 @@
+Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+
+Permission is hereby granted, free of charge, to any person obtaining 
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be 
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/bearssl/README.md

@@ -0,0 +1,14 @@
+# Vendored BearSSL source
+
+`bearssl-7bea48e.tar.gz` is the BearSSL source snapshot the CLI builds embedded sprouts against. It ships in the
+npm package (and is embedded in standalone binaries), so a build needs no network access to bearssl.org, which
+returned HTTP 502 for hours on 2026-11-04.
+
+- Origin: https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=7bea48e5e850ab4cafbe68d3765cdaba13a86d6f;sf=tgz
+- Commit: `7bea48e5e850ab4cafbe68d3765cdaba13a86d6f` (`7bea48e5`; `git get-tar-commit-id` agrees)
+- sha256: `ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372`
+- License: MIT, see `LICENSE.txt` (copied from the tarball)
+
+`src/bearssl.ts` pins the sha256 and `fetchPinned` (`src/fetch-pinned.ts`) rejects this file if it does not match,
+then falls back to bearssl.org. To update: replace the tarball, then change `BEARSSL_COMMIT`, `BEARSSL_SHA256` and
+the import path in `src/bearssl.ts`.