[VFS] Verify lazy package downloads before trusting their final URLs#1072
Open
brandonpayton wants to merge 2 commits into
Open
[VFS] Verify lazy package downloads before trusting their final URLs#1072brandonpayton wants to merge 2 commits into
brandonpayton wants to merge 2 commits into
Conversation
brandonpayton
marked this pull request as ready for review
July 23, 2026 05:15
Phase B-1 matrix build status —
|
| Package | Arch | Status | Sha |
|---|---|---|---|
| shell | wasm32 | built | d761658f |
| lamp | wasm32 | built | e6fed502 |
| node-vfs | wasm32 | built | 7b7e43e9 |
| wordpress | wasm32 | built | 7dab6109 |
Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.
Pre-publication browser checks may read an artifact from a local or staging source while the VFS stores its final immutable HTTPS URL. Callers previously had to fetch and assemble that binding themselves, which made it too easy to associate incomplete or changed bytes with the trusted URL. Add a bounded loader that validates the complete source list before I/O, omits credentials, rejects redirects, streams exactly the declared length, verifies SHA-256, and only then returns canonical closed-asset bindings. Export the primitive and cover invalid identities, truncation, overflow, digest changes, aggregate limits, concurrency, and result ordering.
Abort peer fetches and wait for their response bodies to close when one verified source fails or the caller cancels. Validate and snapshot the full manifest before I/O, keep decoded bytes as the size authority, redact source queries from loader errors, and reject noncanonical URL fragments. Cover the contract with focused host tests and a real Chromium transport test for gzip decoding, omitted credentials, redirects, bounded streams, stream failure, and caller abort.
brandonpayton
force-pushed
the
vfs/verified-closed-package-sources-qk044
branch
from
July 23, 2026 06:07
f503fe0 to
fc556b2
Compare
brandonpayton
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A browser acceptance run may need to download a Homebrew package tree from a local or staging URL while the VFS image keeps its final immutable release URL. The temporary source is only a way to move bytes; it must never become trusted package identity.
The loader also needs one failure rule for the whole batch. If one download fails or the caller cancels, queued work must stop, active responses must close, and the original failure must remain visible.
What changes
This PR adds the verified transport primitive only. It does not change the kernel, ABI, package format, or current shell demo.
Evidence
Exact final head
fc556b20553dfc566cd3168d9d5a04154dfe2edc, based on main2b77bfd2107ebd8bce77eaed0cc8767246396830:import.metawarningsgit diff --check: passedThe normal pull-request CI run is now in progress.