code wiki / (root) / nx_https_get_live_github_test.nx

nx_https_get_live_github_test.nx

buildroot/runtime/nx_https_get_live_github_test.nx

5194 B101 linesdepth 21pulls 127 transitivereach 0 importersview sourcekind gate/prooftopic https
docsdependenciesstructsconstsfunctions

about

nx_https_get_live_github_test.nx -- LIVE external-CA regression gate for the GitHub certificate class. WHY THIS EXISTS (2026-07-15): the live MCP `nx_https_get` on the NAS could NOT fetch github.com/ api.github.com/raw.githubusercontent.com ("unknown certificate verification error"), while the current source verifies them fine. Root cause = a STALE NAS binary predating the 2026-06-25 ECDSA-P384 + chain-verify fixes; GitHub's chain (Sectigo/USERTrust ECC + Fastly) exercises exactly that path. This gate makes the capability SELF-VERIFYING: current source must verify GitHub's live chain, and a KNOWN-BAD cert must still be REJECTED (fail-closed) -- so the regression can never land silently again. Joins the live-CA family: nx_https_get_live_{real_ca,google,demo}_test.nx. Network-dependent (positive legs need github reachable); the fail-closed neg-control is safe under network loss (connect-fail also yields "did not fetch"). Deterministic cert-REJECTION is additionally covered offline by nx_tls13_client_validate_certificate_test + nx_x509_chain_verify_test. expect_exit: 0 license_tier: ORIGINAL

dependencies 4 imports · 0 importers

nx_syscalls.nx nx_x509_trust_store.nx nx_trust_store_load_from_certdata. nx_https_get.nx nx_https_get_live_github_test.

imports: nx_syscalls.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nxnx_https_get.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main ght_put sys_write nx_trust_store_load_from_c sys_mmap sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close nx_nss_certdata_parse sys_mmap ↻ _pat_class_cert _pat_value_octal _pat_end _find_newline _starts_with _parse_octal_line sys_mmap ↻ _is_space _decode_octal_escape _is_octal trust_store_alloc sys_mmap ↻ nx_x509_trust_store_load sys_mmap ↻ x509_parse sys_mmap ↻ asn1_cursor_init asn1_expect_tag sys_mmap ↻ asn1_read_tlv_header asn1_read_tag asn1_read_length asn1_read_length ↻ x509_read_tlv sys_mmap ↻ asn1_expect_tag ↻ x509_read_alg_id

structs

none

consts

22const GHT_CERTDATA: *u8 = "data/mozilla_certdata.txt" as *u8
23const GHT_CAP: i64 = 1048576

functions

25func ght_put(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: ght_positivemain calls 1: sys_write
26func ght_pn(v: i64) -> i64
called by 2: ght_positivemain calls 2: sys_mmapsys_write
40func ght_is200(out: *u8, n: i64) -> i64
called by 1: ght_positive
49func ght_positive(url: *u8, cr: *u8, priv: *u8, store: *TrustStore, now: i64, out: *u8) -> i64
called by 1: main calls 4: ght_putnx_https_getght_pnght_is200
58func main() -> i64
calls 9: ght_putnx_trust_store_load_from_certdatasys_exittrust_store_countght_pnsys_mmap+3