#370 · home-lang/home

Tracks copied Bun corpus position 4152 (js/web/fetch/fetch.tls.wildcard.test.ts).

Scope:

run the complete unchanged upstream wildcard TLS matrix
implement RFC 6125 single-label wildcard matching and reject bare, multi-label, and deeply nested mismatches
preserve RFC 4343 case-insensitive DNS comparison
complete both success and error event paths for tls.connect() against TLS-enabled Bun.serve() listeners
expose Bun/Node-compatible ERR_TLS_CERT_ALTNAME_INVALID failures with structured operation, phase, endpoint, hostname, certificate pattern, cause, and composed stack context
add a permanent focused regression and keep the ordered corpus frontier at zero failures/unsupported cases

Parent tracker: #66 Predecessor: #369

Completed in dd9574d6350fcf26ee84258f99650b7c9197a9f9.

Implemented shared TLS hostname verification rather than a file-specific exception:

extracts DNS SAN identities from certificate DER
enforces RFC 6125 exact and single-label wildcard matching
rejects bare domains, multi-label/deep matches, malformed wildcard placement, and wildcard TLDs
compares DNS names case-insensitively per RFC 4343
preserves typed IP SAN verification for tls.checkServerIdentity
routes native and custom identity callbacks through the same handshake decision
returns ERR_TLS_CERT_ALTNAME_INVALID with operation tls.connect.verifyHostname, phase, hostname, certificate identities/pattern, cause, and composed stack

Verification:

upstream mirror is byte-identical to ~/Code/bun/test/js/web/fetch/fetch.tls.wildcard.test.ts
exact upstream wildcard file: 7 passed / 0 failed / 0 todo / 0 unsupported
original TLS + wildcard files together: 28 passed / 0 failed / 0 unsupported
surrounding Node TLS range: 22 files / 136 passed / 38 todo / 0 failed / 0 unsupported
50-file fetch tail: 1,406 passed / 20 todo / 0 failed / 0 unsupported
permanent focused wildcard regression: pass
zig build --cache-dir /private/tmp/home-zig-abi-cache: pass

Cumulative validated baseline segment through corpus position 4152: 493 files / 7,381 passed / 290 todo / 172 allowed-empty / 0 failed / 0 unsupported.

Parent tracker: #66 Predecessor: #369