TLS13-C8: FETCHS.BIN — the first guest HTTPS consumer - #1286
Merged
Merged
Conversation
The consumer the criterion actually asked for. `user/src/fetchs.zig` connects to
the host gateway on 443 over the kernel's TCP seam, completes a 1-RTT TLS 1.3
handshake against a vendored root set, sends one HTTP/1.0 GET, and streams the
response body to the console.
Three seams that had to meet, each now in its own file:
* lib/tls/stream.zig the one-slot 192-byte no-reassembly TCP buffer
bridged to the client's byte-stream transport (C7);
* lib/tls/vendored_roots.zig the root set as a static blob (ADR 0029 D5),
generated by vectors/emit_vendored_roots.py from
the fixture set, so the guest holds roots in the
image rather than fetching them per connection;
* rng (slot 64) for entropy and ui.sys_time() (slot 66) for the validity
clock — a certificate check without a clock cannot
tell "not yet valid" from "valid", and the guest
does have one.
DSK3 segmented, because the trust store and the adapter accumulator are static
.bss that the flat ESP layout cannot express. Built with the repo's real
convention: `pub export fn _start() callconv(.c) noreturn` (the first attempt
used `pub fn main`, which the `ENTRY(_start)` linker script silently turned
into an empty 472-byte stub).
Evidence:
zig build -> FETCHS.BIN, entry_offset=0x484, image 239176 B,
text 81920, data 157208, 3 PT_LOAD segments
zig build image -> artifacts/disk.img, contents verified
zig build test -> 196/196 steps, 3572/3572 tests
HONEST LIMIT: this is compile- and image-verified. Its runtime behaviour
against a live responder needs a VZ boot, which this session cannot perform;
the class-B gate that would prove it is specified in INTEGRATION.md and cannot
be committed until the runner has a TLS responder (every vgate spec needs a
guest boot, and a spec that cannot run fails the fleet).
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the consumer gap tracked under #1268.
What this is
user/src/fetchs.zig: a guest program that connects to the host gateway on 443 over the kernel TCP seam, completes a 1-RTT TLS 1.3 handshake against a vendored root set, sends one HTTP/1.0 GET, and streams the response body to the console.Three seams had to meet, each now in its own file:
lib/tls/stream.zig(C7, #1280)lib/tls/vendored_roots.zig+vectors/emit_vendored_roots.pyrng, slot 64) and the validity clock (ui.sys_time, slot 66)The clock matters: a certificate check with no clock cannot tell "not yet valid" from "valid", and the guest does expose one.
Evidence
One real trap on the way: the guest entry convention is
pub export fn _start() callconv(.c) noreturn, and the linker script'sENTRY(_start)silently turned mypub fn maininto an empty 472-byte stub rather than erroring. Worth knowing for the next app.Honest limit
Compile- and image-verified, not runtime-verified. Its behaviour against a live responder needs a VZ boot this session cannot perform. The class-B gate that would prove it (
live-tls13-handshake: guestTLS.BIN/FETCHS.BINagainst the runner's TLS responder) is specified inuser/src/lib/tls/INTEGRATION.md, and cannot be committed before the runner has that responder — everyvgatespec needs a guest boot, and a spec that cannot run fails the fleet.