cred: isolate scripts in WASI and move RSA signing to AWS-LC

2026-11-06 22:22:49 +00:00
parent 5b3e1393f5
commit 86c5d8a4e4
217 changed files with 155392 additions and 391 deletions
@@ -0,0 +1,46 @@
+# Credential script guest (D58)
+
+This host-internal WASI component runs credential validators and transforms in QuickJS.
+The host embeds `script.wasm`. It never exposes this component as a world program.
+
+`src/lib.rs` ports v2's bounded `jsrun` evaluator.
+`src/tests.rs` preserves its tests unchanged.
+The vendored compatibility patches and licenses remain in `vendor/`.
+`vendor/PATCHES.md` explains the compatibility fixes and memory-error classification.
+
+Rebuild the checked-in component from the repository root:
+
+```sh
+CARGO_TARGET_DIR="$PWD/target/cred-guest" nix develop -c nu host/cred-script/build.nu
+```
+
+The script sets `CARGO_BUILD_JOBS=2` and uses the locked, separate guest workspace.
+The development shell supplies the WASI C compiler and Rust target.
+
+Run the unchanged evaluator tests natively:
+
+```sh
+CARGO_BUILD_JOBS=2 CARGO_TARGET_DIR="$PWD/target/cred-guest" nix develop -c cargo test --manifest-path host/cred-script/Cargo.toml --release --all-targets --locked
+```
+
+These tests use optimized C and Rust code, like the shipped guest.
+Native debug builds exceed the 16 KiB interpreter stack.
+
+The JSON protocol accepts one source module, input, export name, and two limits.
+The reply contains a JSON result or a static error category.
+Script exception text never leaves the guest.
+The guest owns its input in zeroizing buffers before the QuickJS boundary.
+
+The host compiles the component once and caches its compiled code.
+Construct `cred::quickjs::QuickJs::default()` at startup and reuse it through `cred::script::Script`.
+The injection API does not change.
+Each call uses a fresh Store with linear memory limited to the clamped heap plus 8 MiB.
+The margin covers the Rust stack, WASI adapter, and protocol buffers.
+Only two evaluations run concurrently. Queue time counts against the deadline.
+Epoch callbacks check each call's deadline independently.
+
+The guest receives no directories, environment variables, or network access.
+Its wall clock returns zero. Its random sources use a fixed seed.
+Its monotonic clock serves the evaluator's internal budget only.
+JavaScript receives no clocks, random function, module loader, or host interfaces.
+`Error.prepareStackTrace` is disabled and immutable. Errors retain plain stack strings.