nx_https_fetch_file.nx source
↩ module page · 97 lines · 4180 B
1// nx_https_fetch_file.nx -- SOVEREIGN LARGE-ARTIFACT FETCH: stream an https response BODY straight to a
2// file, in CONSTANT memory.
3//
4// Why this exists (2026-08-01). nx_https_get buffers the WHOLE response into one sys_mmap(HGC_OUTCAP) and
5// then CORRECTLY refuses anything past it with NX_HTTPS_GC_BUF_OVERFLOW (surfaced to the CLI as code=8).
6// That 4 MiB ceiling made every dataset, model weight, corpus and media artifact unreachable by sovereign
7// fetch -- it is what blocked an 11MB standard CIF test sequence from media.xiph.org, and through that the
8// whole ffmpeg-oracle BD-rate measurement (debt 1785634091).
9//
10// The fix is NOT to raise the constant. A per-fetch 256MB mmap is the memfloor incident waiting to happen
11// (nx_skullsdf took 27.7GB and froze every seat's builds); raising a cap only moves the landmine.
12// nx_https_get_stream ALREADY streams decrypted record plaintext to a dest_fd incrementally -- buffered
13// append via gs_bufapp, Content-Length body_target, redirect following, Range support -- and it is
14// gate-proven by nx_https_fetch_lib_gate and used in anger by the media vault. It was simply never exposed
15// as a general CLI. So this WIRES THE PRIMITIVE THAT ALREADY EXISTS rather than building a second one.
16//
17// Usage: nx_https_fetch_file <url> <outpath>
18// -> writes the response BODY (headers stripped, redirects followed by hf_fetch_to_file) to outpath.
19// Prints: NX-HTTPS-FETCH-FILE url= out= status= bytes= verdict=OK|FAIL
20// Exit: 0 ok / 2 usage-or-bad-url / 3 store-or-connect / 4 tls / 5 http / 6 cannot-open-outpath
21//
22// Deliberately NO connect-host:port override: that exists for our own domains and would mean copying
23// hgc_parse_ipport verbatim (rule 15). Add it by EXTRACTING the shared parser if a caller ever needs it.
24// license_tier: ORIGINAL
25import "nx_syscalls.nx"
26import "nx_csprng.nx"
27import "nx_x509_trust_store.nx"
28import "nx_trust_store_load_from_certdata.nx"
29import "nx_tls13_client_validate_certificate.nx"
30import "nx_tls13_client_session_run.nx"
31import "nx_tls13_chrome_session.nx"
32import "nx_https_url_for_fetch.nx"
33import "nx_https_url_connect.nx"
34import "nx_https_get_complete.nx"
35import "nx_https_get_stream.nx"
36import "nx_tls_cert_cache.nx"
37import "nx_https_fetch_lib.nx"
38
39const HFF_MODE_0644: i64 = 420
40
41func hff_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
42func hff_put(s: *u8) -> i64 { sys_write(1, s, hff_slen(s)); return 0 }
43func hff_putn(v: i64) -> i64 {
44 let b: *u8 = sys_mmap(24)
45 var m: i64 = v
46 if m == 0 { b[0] = 48 as u8; sys_write(1, b, 1); return 0 }
47 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
48 var nd: i64 = 0
49 var t: i64 = m
50 while t > 0 { nd = nd + 1; t = t / 10 }
51 var i: i64 = nd - 1
52 while i >= 0 { b[i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
53 sys_write(1, b, nd)
54 return 0
55}
56
57func main(argc: i64, argv: *i64) -> i64 {
58 if argc < 3 {
59 hff_put("ERROR: usage: nx_https_fetch_file <url> <outpath>\n" as *u8)
60 return 2
61 }
62 let url: *u8 = argv[1] as *u8
63 let outpath: *u8 = argv[2] as *u8
64
65 let store_i: i64 = hf_store_load()
66 if store_i <= 0 {
67 hff_put("ERROR: trust-store load failed (data/mozilla_certdata.txt on daemon CWD?)\n" as *u8)
68 return 3
69 }
70
71 // Open the destination BEFORE the fetch: a fetch that cannot land is not worth running.
72 let dest_fd: i64 = sys_openat_wr(outpath, HFF_MODE_0644)
73 if dest_fd < 0 {
74 hff_put("ERROR: cannot open outpath for write\n" as *u8)
75 return 6
76 }
77
78 let stbox: *i64 = sys_mmap(16) as *i64
79 stbox[0] = 0
80 let n: i64 = hf_fetch_to_file(store_i, url, 0, 0, dest_fd, 0, stbox)
81 sys_close(dest_fd)
82
83 hff_put("NX-HTTPS-FETCH-FILE url=" as *u8); hff_put(url)
84 hff_put(" out=" as *u8); hff_put(outpath)
85 hff_put(" status=" as *u8); hff_putn(stbox[0])
86 hff_put(" bytes=" as *u8); hff_putn(n)
87
88 if n < 0 {
89 hff_put(" verdict=FAIL\n" as *u8)
90 if n == HF_ERR_URL { return 2 }
91 if n == HF_ERR_CONNECT { return 3 }
92 if n == HF_ERR_TLS { return 4 }
93 return 5
94 }
95 hff_put(" verdict=OK\n" as *u8)
96 return 0
97}