nx_https_fetch_file.nx source
↩ module page · 96 lines · 4145 B
1// nx_https_fetch_file.nx -- SOVEREIGN LARGE-ARTIFACT FETCH: stream an https response BODY straight to a
2// file, in CONSTANT memory.
3//
4// Why this exists (2026-08-01). nx_https_get buffers the WHOLE response into one sys_mmap(HGC_OUTCAP) and
5// then CORRECTLY refuses anything past it with NX_HTTPS_GC_BUF_OVERFLOW (surfaced to the CLI as code=8).
6// That 4 MiB ceiling made every dataset, model weight, corpus and media artifact unreachable by sovereign
7// fetch -- it is what blocked an 11MB standard CIF test sequence from media.xiph.org, and through that the
8// whole ffmpeg-oracle BD-rate measurement (debt 1785634091).
9//
10// The fix is NOT to raise the constant. A per-fetch 256MB mmap is the memfloor incident waiting to happen
11// (nx_skullsdf took 27.7GB and froze every seat's builds); raising a cap only moves the landmine.
12// nx_https_get_stream ALREADY streams decrypted record plaintext to a dest_fd incrementally -- buffered
13// append via gs_bufapp, Content-Length body_target, redirect following, Range support -- and it is
14// gate-proven by nx_https_fetch_lib_gate and used in anger by the media vault. It was simply never exposed
15// as a general CLI. So this WIRES THE PRIMITIVE THAT ALREADY EXISTS rather than building a second one.
16//
17// Usage: nx_https_fetch_file <url> <outpath>
18// -> writes the response BODY (headers stripped, redirects followed by hf_fetch_to_file) to outpath.
19// Prints: NX-HTTPS-FETCH-FILE url= out= status= bytes= verdict=OK|FAIL
20// Exit: 0 ok / 2 usage-or-bad-url / 3 store-or-connect / 4 tls / 5 http / 6 cannot-open-outpath
21//
22// Deliberately NO connect-host:port override: that exists for our own domains and would mean copying
23// hgc_parse_ipport verbatim (rule 15). Add it by EXTRACTING the shared parser if a caller ever needs it.
24// license_tier: ORIGINAL
25import "nx_syscalls.nx"
26import "nx_csprng.nx"
27import "nx_x509_trust_store.nx"
28import "nx_trust_store_load_from_certdata.nx"
29import "nx_tls13_client_validate_certificate.nx"
30import "nx_tls13_client_session_run.nx"
31import "nx_tls13_chrome_session.nx"
32import "nx_https_url_for_fetch.nx"
33import "nx_https_url_connect.nx"
34import "nx_https_get_complete.nx"
35import "nx_https_get_stream.nx"
36import "nx_tls_cert_cache.nx"
37import "nx_https_fetch_lib.nx"
38
39
40func hff_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
41func hff_put(s: *u8) -> i64 { sys_write(1, s, hff_slen(s)); return 0 }
42func hff_putn(v: i64) -> i64 {
43 let b: *u8 = sys_mmap(24)
44 var m: i64 = v
45 if m == 0 { b[0] = 48 as u8; sys_write(1, b, 1); return 0 }
46 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
47 var nd: i64 = 0
48 var t: i64 = m
49 while t > 0 { nd = nd + 1; t = t / 10 }
50 var i: i64 = nd - 1
51 while i >= 0 { b[i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
52 sys_write(1, b, nd)
53 return 0
54}
55
56func main(argc: i64, argv: *i64) -> i64 {
57 if argc < 3 {
58 hff_put("ERROR: usage: nx_https_fetch_file <url> <outpath>\n" as *u8)
59 return 2
60 }
61 let url: *u8 = argv[1] as *u8
62 let outpath: *u8 = argv[2] as *u8
63
64 let store_i: i64 = hf_store_load()
65 if store_i <= 0 {
66 hff_put("ERROR: trust-store load failed (data/mozilla_certdata.txt on daemon CWD?)\n" as *u8)
67 return 3
68 }
69
70 // Open the destination BEFORE the fetch: a fetch that cannot land is not worth running.
71 let dest_fd: i64 = sys_openat_wr(outpath, MODE_0644)
72 if dest_fd < 0 {
73 hff_put("ERROR: cannot open outpath for write\n" as *u8)
74 return 6
75 }
76
77 let stbox: *i64 = sys_mmap(16) as *i64
78 stbox[0] = 0
79 let n: i64 = hf_fetch_to_file(store_i, url, 0, 0, dest_fd, 0, stbox)
80 sys_close(dest_fd)
81
82 hff_put("NX-HTTPS-FETCH-FILE url=" as *u8); hff_put(url)
83 hff_put(" out=" as *u8); hff_put(outpath)
84 hff_put(" status=" as *u8); hff_putn(stbox[0])
85 hff_put(" bytes=" as *u8); hff_putn(n)
86
87 if n < 0 {
88 hff_put(" verdict=FAIL\n" as *u8)
89 if n == HF_ERR_URL { return 2 }
90 if n == HF_ERR_CONNECT { return 3 }
91 if n == HF_ERR_TLS { return 4 }
92 return 5
93 }
94 hff_put(" verdict=OK\n" as *u8)
95 return 0
96}