code wiki / _hdl_build / nx_pub_tls_gate.nx
`nx_pub_tls_gate.nx` source

1// nx_pub_tls_gate.nx -- pub_tls proof: the publisher produces the served HTTPS response for a liveroot file via the
2// PROVEN sovereign TLS-1.3 serving substrate (nx_edge_serve_static -> nx_tls13_server_session_app_send; full handshake
3// proven by nx_tls13_server_full_handshake_test). This gate proves the publisher-owned bridge (file -> 200 response
4// with exact bytes); a missing file yields NO fabricated response. File-based. license_tier: ORIGINAL  expect_exit: 0
5import "nx_syscalls.nx"
6import "nx_pub_tls_serve.nx"
7import "nx_runpath.nx"
8
9func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
10func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
11func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w("  " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 }
12func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 }
13
14func main() -> i64 {
15    let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0
16    g_w("=== NX-PUB-TLS GATE (publisher serves over the proven sovereign TLS-1.3 server) ===\n" as *u8)
17    let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid)
18    let D: *u8 = sys_mmap(512); rp_path(wsid, "ptls" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0)
19    let page: *u8 = sys_mmap(700); pub_join(D, "page.html" as *u8, page); sv_write(page, "TLS-BODY-XYZ\n" as *u8)
20
21    let out: *u8 = sys_mmap(65536)
22    let n: i64 = pub_tls_http_for_file(D, "page.html" as *u8, out, 65536)
23    let ok200: i64 = ((n > 0) as i64) & (pub_substr(out, n, "200 OK" as *u8))
24    let has_body: i64 = pub_substr(out, n, "TLS-BODY-XYZ" as *u8)
25    let has_clen: i64 = pub_substr(out, n, "Content-Length" as *u8)
26    let miss: i64 = pub_tls_http_for_file(D, "nope.html" as *u8, out, 65536)
27
28    g_w("  response_bytes=" as *u8); g_n(n); g_w("  200=" as *u8); g_n(ok200); g_w(" body=" as *u8); g_n(has_body); g_w(" clen=" as *u8); g_n(has_clen); g_w(" missing=" as *u8); g_n(miss); g_w("\n" as *u8)
29    g_row("pub_tls builds the served HTTPS response (200 OK + Content-Length) for a liveroot file" as *u8, ok200 & has_clen, pass)
30    g_row("the served response carries the EXACT file bytes (TLS layer AEAD-encrypts this)" as *u8, has_body, pass)
31    g_row("LIAR-KILL: a missing file yields NO fabricated response (<0)" as *u8, (miss < 0) as i64, pass)
32    g_w("  NOTE: TLS encryption + handshake = ecosystem's proven sovereign stack (nx_tls13_server_full_handshake_test GREEN)\n" as *u8)
33
34    g_w("NX-PUB-TLS rows=3 pass=" as *u8); g_n(pass[0])
35    if pass[0]==3 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
36    g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1
37}
nx_pub_tls_gate.nx source

`nx_pub_tls_gate.nx` source
