nx_hf_probe.nx source
↩ module page · 104 lines · 4817 B
1// nx_hf_probe.nx -- D1 of the sovereign model-download arc: prove our TLS1.3 client reaches HuggingFace
2// and CAPTURE the LFS redirect (302 -> CDN Location), the prerequisite for a sovereign GGUF download.
3//
4// Reuses the PROVEN sovereign HTTPS stack verbatim (nx_tls13_client_session_run + nx_https_get_complete;
5// no curl/wget/python), validated vs the real Mozilla CA store -- the identical path that fetched live
6// Wikipedia pages in nx_library_fetch. HF LFS files 302-redirect to a CDN; our fetcher does ONE GET (no
7// auto-redirect), so this saves the raw 302 response -> we read the Location header to get the CDN URL.
8// license_tier: ORIGINAL (clone of nx_library_fetch fetch_page; only the URL differs)
9import "nx_syscalls.nx"
10import "nx_csprng.nx"
11import "nx_x509_trust_store.nx"
12import "nx_trust_store_load_from_certdata.nx"
13import "nx_tls13_client_validate_certificate.nx"
14import "nx_tls13_client_session_run.nx"
15import "nx_https_url_for_fetch.nx"
16import "nx_https_url_connect.nx"
17import "nx_https_get.nx"
18import "nx_https_get_complete.nx"
19import "nx_http_response_parse.nx"
20const K_MAGIC_4194304: i64 = 4194304
21
22func hp_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
23func hp_putn(v: i64) -> i64 {
24 let bb: *u8 = sys_mmap(28); var m: i64 = v
25 if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) }
26 let t: *u8 = sys_mmap(28); var k: i64 = 0
27 if m == 0 { t[0] = 48 as u8; k = 1 }
28 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
29 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0
30}
31func hp_strlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
32
33func fetch_raw(store: *TrustStore, full_url: *u8, path: *u8, path_len: i64, out_path: *u8) -> i64 {
34 hp_puts("--- fetch "); hp_puts(full_url); hp_puts("\n")
35 let cr: *u8 = sys_mmap(32)
36 var i: i64 = 0
37 nx_csprng_fill(cr, 32) // CWE-330 (debt 1785970852): was the constant 0xC0..0xDF
38 let priv: *u8 = sys_mmap(32)
39 i = 0
40 nx_csprng_fill(priv, 32) // CWE-330: the X25519 scalar was the constant 0xA0..0xBF on EVERY session
41
42 let url_p: *NxUrl = nx_url_new()
43 let target_raw: *u8 = sys_mmap(32)
44 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
45 target.url = url_p
46 target.port = 0
47 if nx_https_url_for_fetch(full_url, target) != NX_HTTPS_URL_OK { return 0 - 41 }
48
49 let fd_p: *i64 = sys_mmap(16) as *i64
50 if nx_https_url_connect(target, full_url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0 - 42 }
51 let fd: i64 = *fd_p
52
53 let val_ctx_raw: *u8 = sys_mmap(64)
54 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
55 val_ctx.store = store
56 val_ctx.sni_host = full_url + target.url.host_off
57 val_ctx.sni_host_len = target.url.host_len
58 val_ctx.now_epoch = sys_now_realtime_sec()
59
60 let sr: i64 = nx_tls13_client_session_run(
61 fd, full_url + target.url.host_off, target.url.host_len,
62 cr, priv, val_ctx
63 )
64 if sr <= 0 { sys_close(fd); return 0 - (200 + (0 - sr)) }
65
66 let session: *Tls13ClientSession = sr as *Tls13ClientSession
67 let buf: *u8 = sys_mmap(K_MAGIC_4194304)
68 let gc: i64 = nx_https_get_complete(
69 session, fd, path, path_len,
70 full_url + target.url.host_off, target.url.host_len,
71 buf, K_MAGIC_4194304
72 )
73 sys_close(fd)
74 if gc < 0 { return 0 - (100 + (0 - gc)) }
75
76 let rs: *i64 = sys_mmap(128) as *i64
77 nx_http_response_parse(buf, gc, rs)
78 let status: i64 = rs[1]
79
80 let ofd: i64 = sys_openat_wr(out_path, 0x1A4)
81 if ofd <= 0 { return 0 - 70 }
82 sys_write(ofd, buf, gc)
83 sys_close(ofd)
84
85 hp_puts(" ST="); hp_putn(status); hp_puts(" bytes="); hp_putn(gc); hp_puts(" -> "); hp_puts(out_path); hp_puts("\n")
86 return status
87}
88
89func main() -> i64 {
90 let cpath: *u8 = "/tmp/mozilla_certdata.txt\x00"
91 let r: i64 = nx_trust_store_load_from_certdata(cpath, 512, K_MAGIC_4194304)
92 if r <= 0 { hp_puts("HF-PROBE: certdata load failed (need /tmp/mozilla_certdata.txt)\n"); return 1 }
93 let store: *TrustStore = r as *TrustStore
94 let nca: i64 = trust_store_count(store)
95 hp_puts("CA="); hp_putn(nca); hp_puts("\n")
96 if nca < 50 { hp_puts("HF-PROBE: too few CAs\n"); return 3 }
97
98 let u: *u8 = "https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF/resolve/main/qwen2.5-0.5b-instruct-q4_k_m.gguf\x00"
99 let p: *u8 = "/Qwen/Qwen2.5-0.5B-Instruct-GGUF/resolve/main/qwen2.5-0.5b-instruct-q4_k_m.gguf\x00"
100 let st: i64 = fetch_raw(store, u, p, hp_strlen(p), "/tmp/hf_probe.raw\x00" as *u8)
101 hp_puts("HF-PROBE status="); hp_putn(st); hp_puts(" (302/307=redirect captured; read /tmp/hf_probe.raw for Location)\n")
102 if st < 0 { return 5 }
103 return 0
104}