nx_packmirror.nx source
↩ module page · 324 lines · 17179 B
1// nx_packmirror.nx -- THE PACK ARCHIVE ORGAN (debt 1787064637). Walks a pCloud-publink manifest and
2// mirrors EVERY file entry into <destdir> over the sovereign TLS stack, verifying each written file
3// against the manifest's declared byte size. COMPOSES the proven lanes: nx_packmirror_lib (parse +
4// verify core, gate-proven), nx_https_fetch_follow (the research_fetch TLS lane), the Mozilla trust
5// store. RESUMABLE: a dest already at its declared size is SKIPPED, so a re-run drains stragglers --
6// that is the retry story (one attempt per file per run, no in-run backoff duplication).
7// FAIL-CLOSED: a size mismatch keeps the evidence as <name>.partial and counts REFUSED; a body that
8// fills the reserve to the brim is REFUSED-TRUNCATED unread (the RF_BODY_CAP witness, same law).
9// THE RECEIPTS PARTITION MUST SUM: seen = fetched + skipped + refused (+ unparsed alongside), printed
10// with the reconciliation -- a partition that does not sum exits RED on itself.
11// usage: nx_packmirror <manifest.json> <publink-code> <destdir> (mirror, pCloud dialect)
12// nx_packmirror verify <pcloud|thread|bepis> <manifest.json> <destdir> (population byte-verify, no fetch)
13// exit: 0 all clean | 1 refused/unparsed/partition-leak | 2 usage | 3 manifest unreadable | 4 trust store
14// license_tier: ORIGINAL No hw writes (Rule 26).
15import "nx_syscalls.nx"
16import "nx_packmirror_lib.nx"
17import "nx_tool_run.nx" // tr_run_capture + tr_contains: fork the PROMOTED hash ruler, never a second sha256
18import "nx_base64.nx" // b64_decode: the canonical decoder (the BepisDB pin is base64 of the raw digest)
19import "nx_x509_trust_store.nx"
20import "nx_trust_store_load_from_certdata.nx"
21import "nx_https_fetch_follow.nx"
22
23const PMC_MANIFEST_CAP: i64 = 1048576 // a publink manifest measures ~50KB; filling this REFUSES loudly below
24const PMC_CERTDATA_CAP: i64 = 4194304 // Mozilla certdata.txt reserve (its own, never shared)
25// the network-body reserve: the one legitimate bound (a body's size is unknowable in advance), NAMED
26// for this purpose alone and sized for the pack lane (clips to ~92MB observed); brim-full REFUSES.
27// mmap commits lazily -- headroom costs address space, never resident memory.
28const PMC_BODY_CAP: i64 = 134217728
29const PMC_LINK_CAP: i64 = 65536 // getpublinkdownload JSON (~400B observed)
30const PMC_URL_CAP: i64 = 2048
31const PMC_PATH_CAP: i64 = 1024
32const PMC_MODE_FILE: i64 = 420 // 0644
33const PMC_MODE_DIR: i64 = 493 // 0755
34const PMC_REDIRECTS: i64 = 6 // the research_fetch lane's proven follow depth
35
36func pc_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
37func pc_n(v: i64) -> i64 {
38 let b: *u8 = sys_mmap(32)
39 var x: i64 = v
40 var ng: i64 = 0
41 if x < 0 { ng = 1; x = 0 - x }
42 var i: i64 = 31
43 if x == 0 { b[i] = 48 as u8; i = i - 1 }
44 while x > 0 { b[i] = (48 + x % 10) as u8; x = x / 10; i = i - 1 }
45 if ng == 1 { b[i] = 45 as u8; i = i - 1 }
46 sys_write(1, ((b as i64) + i + 1) as *u8, 31 - i)
47 return 0
48}
49func pc_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o+i] = s[i]; i = i + 1 } d[o+i] = 0 as u8; return o + i }
50func pc_catn(d: *u8, o: i64, v: i64) -> i64 {
51 var x: i64 = v
52 let t: *u8 = sys_mmap(32)
53 var k: i64 = 0
54 if x == 0 { t[0] = 48 as u8; k = 1 }
55 while x > 0 { t[k] = (48 + x % 10) as u8; x = x / 10; k = k + 1 }
56 var oo: i64 = o
57 var i: i64 = 0
58 while i < k { d[oo] = t[k-1-i]; oo = oo + 1; i = i + 1 }
59 d[oo] = 0 as u8
60 return oo
61}
62// copy a JSON string value found after <key> in buf[at..end) into dst, unescaping the one escape the
63// pCloud dialect uses in paths (backslash-slash to slash). returns length, -1 = not found.
64func pc_jstr(buf: *u8, at: i64, end: i64, key: *u8, dst: *u8, dcap: i64) -> i64 {
65 let kat: i64 = pm_findn(buf, at, end, key)
66 if kat < 0 { return 0 - 1 }
67 var m: i64 = 0
68 while key[m] != (0 as u8) { m = m + 1 }
69 var p: i64 = kat + m
70 // hosts is an array: skip spaces and one open bracket before the first string
71 var scan: i64 = 1
72 while scan == 1 {
73 if p >= end { return 0 - 1 }
74 let c0: i64 = pm_b(buf, p)
75 if c0 == 32 { p = p + 1 } else { if c0 == 91 { p = p + 1 } else { if c0 == 10 { p = p + 1 } else { if c0 == 9 { p = p + 1 } else { scan = 0 } } } }
76 }
77 if pm_b(buf,p) != 34 { return 0 - 1 }
78 p = p + 1
79 var o: i64 = 0
80 while p < end {
81 let c: i64 = pm_b(buf, p)
82 if c == 34 { dst[o] = 0 as u8; return o }
83 if o >= dcap - 1 { return 0 - 1 }
84 if c == 92 { if p + 1 < end { if pm_b(buf,p+1) == 47 { dst[o] = 47 as u8; o = o + 1; p = p + 2 } else { dst[o] = c as u8; o = o + 1; p = p + 1 } } else { return 0 - 1 } }
85 else { dst[o] = c as u8; o = o + 1; p = p + 1 }
86 }
87 return 0 - 1
88}
89func pc_read_file(path: *u8, buf: *u8, cap: i64) -> i64 {
90 let fd: i64 = sys_openat_rd(path)
91 if fd < 0 { return 0 - 1 }
92 var tot: i64 = 0
93 while tot < cap {
94 let r: i64 = sys_read(fd, ((buf as i64) + tot) as *u8, cap - tot)
95 if r <= 0 { break }
96 tot = tot + r
97 }
98 sys_close(fd)
99 return tot
100}
101func pc_write_file(path: *u8, buf: *u8, n: i64) -> i64 {
102 let fd: i64 = sys_openat_wr(path, PMC_MODE_FILE)
103 if fd < 0 { return 0 - 1 }
104 var off: i64 = 0
105 while off < n {
106 let r: i64 = sys_write(fd, ((buf as i64) + off) as *u8, n - off)
107 if r <= 0 { sys_close(fd); return 0 - 2 }
108 off = off + r
109 }
110 sys_close(fd)
111 return 0
112}
113
114func pc_eq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
115
116const PMC_HEX_0: i64 = 48 // '0' -- lowercase-hex emission base for digits
117const PMC_HEX_A: i64 = 87 // 'a' - 10 -- lowercase-hex emission base for a..f
118const PMC_RAW32: i64 = 32 // a sha256 digest is exactly 32 raw bytes; any other decode length is a bad pin
119const PMC_HEXCAP: i64 = 80 // 64 hex chars + NUL, with margin
120const PMC_HASHOUT: i64 = 4096 // nx_filehash JSON output reserve (observed ~120 B)
121func pc_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
122// raw bytes -> lowercase hex (the spelling nx_filehash prints; comparing hex-vs-hex keeps the
123// promoted ruler the ONLY sha256 in this organ)
124func pc_hex(raw: *u8, n: i64, out: *u8) -> i64 {
125 var i: i64 = 0
126 while i < n {
127 let v: i64 = raw[i] as i64 & 0xff
128 let hi: i64 = v / 16
129 let lo: i64 = v % 16
130 if hi < 10 { out[i*2] = (PMC_HEX_0 + hi) as u8 } else { out[i*2] = (PMC_HEX_A + hi) as u8 }
131 if lo < 10 { out[i*2+1] = (PMC_HEX_0 + lo) as u8 } else { out[i*2+1] = (PMC_HEX_A + lo) as u8 }
132 i = i + 1
133 }
134 out[n*2] = 0 as u8
135 return n * 2
136}
137// content pin check for one dest file: decode the served base64 pin -> hex, fork ./nx_filehash.elf
138// (the estate's ONE hash ruler, the refs-gate pattern) and ask whether its JSON carries that hex.
139// 1 = pin matches - 0 = mismatch or ruler unreadable - -1 = bad pin (decode is not 32 bytes)
140func pc_pin_ok(path: *u8, hb64: *u8) -> i64 {
141 let raw: *u8 = sys_mmap(64)
142 let dn: i64 = b64_decode(hb64, pc_len(hb64), raw)
143 if dn != PMC_RAW32 { return 0 - 1 }
144 let hex: *u8 = sys_mmap(PMC_HEXCAP)
145 pc_hex(raw, PMC_RAW32, hex)
146 let out: *u8 = sys_mmap(PMC_HASHOUT)
147 let olen: *i64 = sys_mmap(16) as *i64
148 let av: *i64 = sys_mmap(32) as *i64
149 av[0] = "./nx_filehash.elf" as *u8 as i64
150 av[1] = path as i64
151 av[2] = 0
152 olen[0] = 0
153 tr_run_capture("./nx_filehash.elf" as *u8, av, out, PMC_HASHOUT - 1, olen)
154 if olen[0] <= 0 { return 0 }
155 return tr_contains(out, olen[0], hex)
156}
157
158// VERIFY VERB: every entry the manifest declares must exist in destdir at its declared size. Reads only.
159// The receipts partition is the same shape as the mirror's: seen = ok + missing + wrongsize, and it
160// exits RED on its own leak. Dialect is an EXPLICIT argument -- never sniffed from content.
161func pc_verify(dialect: *u8, mpath: *u8, dest: *u8) -> i64 {
162 let mbuf: *u8 = sys_mmap(PMC_MANIFEST_CAP)
163 let mn: i64 = pc_read_file(mpath, mbuf, PMC_MANIFEST_CAP)
164 if mn <= 0 { pc_w("PM: manifest unreadable\n" as *u8); return 3 }
165 if mn >= PMC_MANIFEST_CAP { pc_w("PM: manifest fills its reserve -- REFUSING a possibly-partial parse\n" as *u8); return 3 }
166 let ids: *i64 = sys_mmap(PM_MAX_FILES * 8) as *i64
167 let sizes: *i64 = sys_mmap(PM_MAX_FILES * 8) as *i64
168 let names: *u8 = sys_mmap(PM_MAX_FILES * PM_NAME_CAP)
169 let counts: *i64 = sys_mmap(16) as *i64
170 let hashes: *u8 = sys_mmap(PM_MAX_FILES * PM_HASH_CAP)
171 var isbepis: i64 = 0
172 var seen: i64 = 0
173 if pc_eq(dialect, "thread" as *u8) == 1 { seen = pm_parse_thread(mbuf, mn, ids, sizes, names, PM_MAX_FILES, counts) }
174 else { if pc_eq(dialect, "pcloud" as *u8) == 1 { seen = pm_parse_manifest(mbuf, mn, ids, sizes, names, PM_MAX_FILES, counts) }
175 else { if pc_eq(dialect, "bepis" as *u8) == 1 { isbepis = 1; seen = pm_parse_bepis(mbuf, mn, ids, sizes, names, PM_MAX_FILES, counts, hashes) }
176 else { pc_w("PM: unknown dialect (pcloud|thread|bepis)\n" as *u8); return 2 } } }
177 let unparsed: i64 = counts[PM_UNPARSED_SLOT]
178 pc_w("PM VERIFY dialect=" as *u8); pc_w(dialect); pc_w(" entries=" as *u8); pc_n(seen); pc_w(" unparsed=" as *u8); pc_n(unparsed); pc_w("\n" as *u8)
179 let dpath: *u8 = sys_mmap(PMC_PATH_CAP)
180 var ok: i64 = 0
181 var missing: i64 = 0
182 var wrongsize: i64 = 0
183 var wronghash: i64 = 0
184 var i: i64 = 0
185 while i < seen {
186 let nm: *u8 = ((names as i64) + i * PM_NAME_CAP) as *u8
187 var dp: i64 = pc_cat(dpath, 0, dest)
188 dp = pc_cat(dpath, dp, "/" as *u8)
189 dp = pc_cat(dpath, dp, nm)
190 let fd: i64 = sys_openat_rd(dpath)
191 if fd < 0 { missing = missing + 1; pc_w(" MISSING " as *u8); pc_w(nm); pc_w("\n" as *u8) }
192 else {
193 let sz: i64 = sys_lseek(fd, 0, 2)
194 sys_close(fd)
195 if sz == sizes[i] {
196 // bepis rows carry the server-declared content pin: size alone cannot see a
197 // corrupted or swapped body, so the pin is checked through the ONE promoted ruler.
198 var pinok: i64 = 1
199 if isbepis == 1 {
200 let hb64: *u8 = ((hashes as i64) + i * PM_HASH_CAP) as *u8
201 let prr: i64 = pc_pin_ok(dpath, hb64)
202 if prr != 1 {
203 pinok = 0
204 wronghash = wronghash + 1
205 pc_w(" WRONG-HASH " as *u8); pc_w(nm)
206 if prr < 0 { pc_w(" (declared pin does not decode to 32 bytes)" as *u8) }
207 pc_w("\n" as *u8)
208 }
209 }
210 if pinok == 1 { ok = ok + 1 }
211 } else { wrongsize = wrongsize + 1; pc_w(" WRONG-SIZE " as *u8); pc_w(nm); pc_w(" on-disk=" as *u8); pc_n(sz); pc_w(" declared=" as *u8); pc_n(sizes[i]); pc_w("\n" as *u8) }
212 }
213 i = i + 1
214 }
215 pc_w("PM VERIFY RECEIPTS ok=" as *u8); pc_n(ok)
216 pc_w(" missing=" as *u8); pc_n(missing)
217 pc_w(" wrongsize=" as *u8); pc_n(wrongsize)
218 pc_w(" wronghash=" as *u8); pc_n(wronghash)
219 pc_w(" unparsed=" as *u8); pc_n(unparsed)
220 pc_w(" of entries=" as *u8); pc_n(seen)
221 if ok + missing + wrongsize + wronghash == seen { pc_w(" partition=SUMS\n" as *u8) } else { pc_w(" partition=LEAK -- this organ is wrong about itself, exit RED\n" as *u8); return 1 }
222 if missing > 0 { return 1 }
223 if wrongsize > 0 { return 1 }
224 if wronghash > 0 { return 1 }
225 if unparsed > 0 { return 1 }
226 if seen >= PM_MAX_FILES { pc_w("PARTIAL-MANIFEST: hit PM_MAX_FILES\n" as *u8); return 1 }
227 return 0
228}
229
230func main(argc: i64, argv: *i64) -> i64 {
231 if argc >= 5 { if pc_eq(argv[1] as *u8, "verify" as *u8) == 1 {
232 let vrc: i64 = pc_verify(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8)
233 sys_exit(vrc); return vrc
234 } }
235 if argc < 4 { pc_w("usage: nx_packmirror <manifest.json> <publink-code> <destdir> | verify <pcloud|thread|bepis> <manifest.json> <destdir>\n" as *u8); sys_exit(2); return 2 }
236 let mpath: *u8 = argv[1] as *u8
237 let code: *u8 = argv[2] as *u8
238 let dest: *u8 = argv[3] as *u8
239 let mbuf: *u8 = sys_mmap(PMC_MANIFEST_CAP)
240 let mn: i64 = pc_read_file(mpath, mbuf, PMC_MANIFEST_CAP)
241 if mn <= 0 { pc_w("PM: manifest unreadable\n" as *u8); sys_exit(3); return 3 }
242 if mn >= PMC_MANIFEST_CAP { pc_w("PM: manifest fills its reserve -- REFUSING a possibly-partial parse\n" as *u8); sys_exit(3); return 3 }
243 let tr: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, PMC_CERTDATA_CAP)
244 if tr <= 0 { pc_w("PM: trust store load failed\n" as *u8); sys_exit(4); return 4 }
245 let store: *TrustStore = tr as *TrustStore
246 sys_mkdir(dest, PMC_MODE_DIR)
247 let ids: *i64 = sys_mmap(PM_MAX_FILES * 8) as *i64
248 let sizes: *i64 = sys_mmap(PM_MAX_FILES * 8) as *i64
249 let names: *u8 = sys_mmap(PM_MAX_FILES * PM_NAME_CAP)
250 let counts: *i64 = sys_mmap(16) as *i64
251 let seen: i64 = pm_parse_manifest(mbuf, mn, ids, sizes, names, PM_MAX_FILES, counts)
252 let unparsed: i64 = counts[PM_UNPARSED_SLOT]
253 pc_w("PM manifest files=" as *u8); pc_n(seen)
254 pc_w(" unparsed=" as *u8); pc_n(unparsed)
255 if seen >= PM_MAX_FILES { pc_w(" PARTIAL-MANIFEST: hit PM_MAX_FILES, REFUSING to publish this as a full mirror" as *u8) }
256 pc_w("\n" as *u8)
257 let lbuf: *u8 = sys_mmap(PMC_LINK_CAP)
258 let body: *u8 = sys_mmap(PMC_BODY_CAP)
259 let url: *u8 = sys_mmap(PMC_URL_CAP)
260 let host: *u8 = sys_mmap(PMC_PATH_CAP)
261 let path: *u8 = sys_mmap(PMC_PATH_CAP)
262 let dpath: *u8 = sys_mmap(PMC_PATH_CAP)
263 let tpath: *u8 = sys_mmap(PMC_PATH_CAP)
264 let status: *i64 = sys_mmap(8) as *i64
265 var fetched: i64 = 0
266 var skipped: i64 = 0
267 var refused: i64 = 0
268 var i: i64 = 0
269 while i < seen {
270 let nm: *u8 = ((names as i64) + i * PM_NAME_CAP) as *u8
271 var dp: i64 = pc_cat(dpath, 0, dest)
272 dp = pc_cat(dpath, dp, "/" as *u8)
273 dp = pc_cat(dpath, dp, nm)
274 if pm_dest_ok(dpath, sizes[i]) == 1 {
275 skipped = skipped + 1
276 } else {
277 var ok: i64 = 0
278 var uo: i64 = pc_cat(url, 0, "https://eapi.pcloud.com/getpublinkdownload?code=" as *u8)
279 uo = pc_cat(url, uo, code)
280 uo = pc_cat(url, uo, "&fileid=" as *u8)
281 uo = pc_catn(url, uo, ids[i])
282 let ln: i64 = nx_https_fetch_follow_best(url, store, lbuf, PMC_LINK_CAP, PMC_REDIRECTS, status)
283 if ln > 0 { if status[0] < 400 {
284 let hl: i64 = pc_jstr(lbuf, 0, ln, "\"hosts\":" as *u8, host, PMC_PATH_CAP)
285 let pl: i64 = pc_jstr(lbuf, 0, ln, "\"path\":" as *u8, path, PMC_PATH_CAP)
286 if hl > 0 { if pl > 0 {
287 var du: i64 = pc_cat(url, 0, "https://" as *u8)
288 du = pc_cat(url, du, host)
289 du = pc_cat(url, du, path)
290 let bn: i64 = nx_https_fetch_follow_best(url, store, body, PMC_BODY_CAP, PMC_REDIRECTS, status)
291 if bn > 0 { if status[0] < 400 { if bn < PMC_BODY_CAP {
292 if bn == sizes[i] {
293 var tp: i64 = pc_cat(tpath, 0, dpath)
294 tp = pc_cat(tpath, tp, ".tmp" as *u8)
295 if pc_write_file(tpath, body, bn) == 0 { if sys_renameat(tpath, dpath) == 0 { ok = 1 } }
296 } else {
297 var pp: i64 = pc_cat(tpath, 0, dpath)
298 pp = pc_cat(tpath, pp, ".partial" as *u8)
299 pc_write_file(tpath, body, bn)
300 pc_w(" REFUSED-SIZE " as *u8); pc_w(nm)
301 pc_w(" got=" as *u8); pc_n(bn)
302 pc_w(" declared=" as *u8); pc_n(sizes[i])
303 pc_w(" (evidence kept as .partial)\n" as *u8)
304 }
305 } else { pc_w(" REFUSED-TRUNCATED " as *u8); pc_w(nm); pc_w(" filled the body reserve -- raise PMC_BODY_CAP deliberately\n" as *u8) } } }
306 } }
307 } }
308 if ok == 1 { fetched = fetched + 1 } else { if pm_dest_ok(dpath, sizes[i]) == 0 { refused = refused + 1
309 pc_w(" REFUSED " as *u8); pc_w(nm); pc_w(" fileid=" as *u8); pc_n(ids[i]); pc_w("\n" as *u8) } }
310 }
311 i = i + 1
312 }
313 pc_w("PM RECEIPTS fetched=" as *u8); pc_n(fetched)
314 pc_w(" skipped=" as *u8); pc_n(skipped)
315 pc_w(" refused=" as *u8); pc_n(refused)
316 pc_w(" unparsed=" as *u8); pc_n(unparsed)
317 pc_w(" of files=" as *u8); pc_n(seen)
318 if fetched + skipped + refused == seen { pc_w(" partition=SUMS\n" as *u8) } else { pc_w(" partition=LEAK -- this organ is wrong about itself, exit RED\n" as *u8); sys_exit(1); return 1 }
319 if refused > 0 { sys_exit(1); return 1 }
320 if unparsed > 0 { sys_exit(1); return 1 }
321 if seen >= PM_MAX_FILES { sys_exit(1); return 1 }
322 sys_exit(0)
323 return 0
324}