Native TLS: complete SecureContext ownership, CA verification and version options

Published native TLS context checkpoint

fbdfbf890 is pushed on codex/runtime-port as Chris Breuer without coauthors; not merged to main. Private context ownership, CA isolation, binary PKCS#12 parsing, detailed certificate chains, native hostname verification and TLS version options are implemented and verified on Darwin. This issue remains open for platform verification and integration; further socket callback/event gaps are split into #542 and #543.

The no-cipher-match file also passes (1 test / 3 assertions). User-created contexts bypass both caches while internal contexts keep sharing; their live CA mutations cannot authorize another context. Detailed certificates retain native reference ownership and the JS chain across allocations, include trust-store issuers and self-issued roots, and cap issuer traversal. Version limits survive parsing, cloning, equality/hash and native cache identity. Actual TLS 1.2/1.3 negotiations and disjoint-version rejection pass; this is not merely property acceptance.

The final role check excludes both ordinary and Duplex-server modes from client hostname verification. A mutual-TLS generic-Duplex regression checks native authorization and the exact client certificate with a deliberately different context hostname; the earlier candidate fails, while pinned Bun and the corrected Home artifact pass. Initial probe/control lifecycle mistakes are retained separately from the final explicit-cleanup regression.

Native positive/negative verification includes hostname checks, client certificates, PKCS#12 Buffer/offset-view and malformed inputs, exact certificate representations, repeated conversion and GC. Normal and VM-destruction/exception-check runs pass, the published parent fails at the missing native handle, and pinned Bun passes the adapted identity/path control. The unchanged peer-certificate leak test retains its original workload and memory threshold. Root initialization/immutability, context churn, upgrade and half-open cases pass. Eleven Node parallel programs pass their BoringSSL branches; legacy PFX skips its OpenSSL-only body, and two destructor-UAF cases retain sanitizer guards. Skips/TODOs and controls unavailable in release are not passes.

The full server/connect files are still not green: server 31 pass / 7 fail (Bun 38/0) leaves SNI/ALPN callback behavior in #542. Connect 26 pass / 4 fail / 1 skip (Bun 28/2/1 skip) leaves two local session/keylog cases in #543 plus two live bun.sh OCSP-field expectations that fail in pinned Bun too. Those external assertions are preserved as failures.

Native build 17/17; runtime units 1,828 pass / 19 skip / 0 fail, 19/19 steps; sequential regressions 61/61, including 30 native files. Complete compression 32/32, HTTP/2 client 60/60, HTTP/3 client 52/52, both proxy files, full body-stream 9,086/9,086 / 135,984 assertions, five EOF/fetch files and both abort files pass. The initial HTTP/3 adversarial run failed 24 pass / 3 fail / 160 assertions, followed by three 27/27 / 163 serial replays. #539 remains unresolved; passing retries do not erase the final artifact’s initial failure or prior Home/Bun failures.

All 249 measured TLS test/harness/fixture sources, 48 HTTP/regression sources and 13 consulted TLS implementations match pin 4982b91e3702094330f3be3883354c52b8c01323. Evidence: docs/docs/NATIVE_RUNTIME_BINDINGS.md, zig-out/tls532-publication.json, tls532-candidate5.json, tls532-expanded5.json, tls532-expanded-release1.json, tls532-broader-parent2.json, tls532-unit2.json, tls532-regression5s.json, tls532-final5-results.json, and integrity manifests. Final executable SHA-256: d9649de0fa31c3b0fa935b909cf09e028a088be76bc407e29d66a8927b889e9e.

Failed builds and the incomplete disk-exhausted parent1 attempt remain recorded; parent2 is the complete replay. An initial missing-client-certificate control wrongly required a client error; pinned Bun established that TLS 1.3 can close without one, so the regression checks no server secureConnection and no application bytes instead. No original upstream assertions/workloads/deadlines changed. Shared Darwin checkout; unrelated compiler changes are excluded. Pinned C/C++/JSC dependencies remain, with no Rust archive. Platform/integration, full source ownership and 100% logical parity under #66 remain incomplete.

Historical missing-implementation evidence

Published transport checkpoint

29c196835 is pushed on codex/runtime-port (not merged to main). This issue remains open: its specific missing behavior is not repaired by the TLS ABI/duplex checkpoint. Final native/control results are recorded in #530 and #66; 72 measured test/harness sources match the pin.

Parent: #66. Discovered while repairing the TLS options ABI in #530.

The ABI repair restores HTTP/3 dispatch and advances complete unchanged bun-serve-ssl.test.ts from 12 pass / 4 fail / 20 assertions to 16/16 / 32, matching pinned Bun. It does not establish complete TLS parity.

Remaining complete unchanged files:

• node-tls-context.test.ts: published parent 3 pass / 4 fail / 15 assertions; ABI candidate 3 pass / 4 fail / 25 assertions; pinned Bun 7/7 / 28. Failures include client-certificate authorization, most-recent SNI context selection, and CA/peer-certificate handling.
• ssl-ctx-cache.test.ts: both native runs 4 pass / 5 fail / 9 assertions. tls.createSecureContext().context is undefined, exclusive user context ownership/addCACert isolation cannot be exercised, and default CA override checks fail. The release control cannot import its debug-only internal binding; it is not a passing control.
• node-tls-create-secure-context-args.test.ts: all three runs 5/5 / 13 assertions.

Separately, source inspection shows Home SSLConfig and generated option plumbing omit the pin's ssl_min_version/ssl_max_version propagation. Restoring the C struct fields defaults them to zero and fixes layout; it does not implement user-selected TLS version limits. Add actual version-negotiation controls before claiming this path fixed. Preserve config cloning, equality, hashing, native cache identity, and ownership when porting it.

Acceptance: pass the complete original context/cache suites with real native handles and verification, implement and test TLS min/max options, retain positive and negative client/server certificate checks, and verify across platforms. Do not fake certificate objects or make CA verification permissive.

Evidence: zig-out/h3-tls-{parent1,abi1,release1}.json, full logs, and h3-source-integrity1.json. Pin 4982b91e3702094330f3be3883354c52b8c01323; original assertions and deadlines intact. #66 remains incomplete.

Published fbdfbf890 on codex/runtime-port as Chris Breuer without coauthors; not merged to main.

All six core TLS files pass; the native positive/negative fixture passes normally and under VM destruction, including the mutual-TLS generic-Duplex server-role check that fails the earlier candidate. The original peer-certificate leak workload and expanded context/version/PFX programs pass. Full verification is in the updated issue and runtime documentation. This issue remains open for platform/integration; #542/#543 retain separate socket callback/event gaps and #66 remains incomplete.

The native HTTP/TLS module ownership batch includes 893 unchanged original entries. Initial and targeted repair runs retain real TLS failures: test-tls-error-servername.js times out, test-tls-exportkeyingmaterial.js reports ECONNRESET before handshake, test-tls-psk-alpn-callback-exception-handling.js misses required failure callbacks, test-tls-set-default-ca-certificates-extra-override.js differs in CA override results, and node-tls-connect.test.ts misses a peer-certificate field. These are not passing parity and remain part of #532/#66. Native TLS context/SNI/session controls are green, but narrower controls do not close these original failures. No expired-certificate acceptance bypass or fixture rewrite is part of this batch. A final full-scope report and retained evidence will follow publication.

The paired live-certificate controls narrow one earlier failure: the current bun.sh certificate is issued by Google Trust Services WE1, valid August 24–November 22, 2026. Both the selected pinned Bun binary and Node return infoAccess with only CA Issuers - URI (http://i.pki.goog/we1.crt) and no OCSP URI. The unchanged node-tls-connect.test.ts assertion near line 313 requires OCSP - URI. This is a live external-certificate expectation mismatch; it does not prove Home dropped a present field, and no OCSP value will be fabricated. The original failure still receives no passing parity credit. Other original TLS failures (servername error delivery, keying material, PSK/ALPN callbacks, and CA overrides) remain separate incomplete verification under #532/#66. Raw paired controls are retained for the pending HTTP/TLS checkpoint.

Source b2ad7e9cb and verified evidence are on main. Home owns 112 explicit registry modules plus the internal test adapter, adding the complete 22-module HTTP/HTTPS/HTTP2/TLS graph from the pin. Native NodeHTTP and NodeTLS ownership is wired into the selected translation unit with exact header comparisons. Generation supports verified named-export namespaces and scoped Zig factories.

The original 10 MiB subprocess/HTTP/stdout pipeline exposed premature exit before queued nextTick stream work ran. The post-poll drain fixes it without a listener/timer workaround; the unchanged fixture validates the full payload. Real expose_gc aliasing, per-stream async context, stream byte accounting and write-completion ordering clear original parser-GC, async-local-storage, buffer-size and writable/drain failures.

Publication-source checks pass: 18 native groups; 81 ABI tests / 1,332 assertions; Debug 34/34 (5,660 MB peak under 8,192 MB); complete Bun HTTP2 file 287 pass / zero fail / six original skips. Pickier, scoped formatting/whitespace and documentation portability checks pass.

Full-scope verification remains incomplete: the latest combined audit of 893 unchanged original entries reports 709 registered passes + 752 process checks, two registered failures and 69 failing files. 13 skips, 20 TODOs and 22 skipped files receive no passing credit. Remaining internal HTTP2/core/util/Undici modules, binding controls and wire/state behavior are tracked in #867; TLS delivery/CA failures remain open in #532. #868 records mutually exclusive original range-error assertions for the same invalid close operation; Bun's existing message is preserved without filename-sensitive behavior or test edits. Paired pinned Bun and Node return the current bun.sh certificate without an OCSP URI, so that original live-certificate expectation is not credited or fabricated.

The unchanged single-buffer fixture allocates 4 GiB and documents substantial cloning. Its direct pinned Bun control passes at 12,288 MB, and the separate Home corpus coordinator passes at 12,303 MB under an isolated 12,800 MB ceiling with host-pressure protection retained. Ordinary files remain under 3,840 MB. Allocation, assertions and original case deadlines are unchanged. Lower-bound guard stops, disk refusals, incomplete journals, cache-rebuild failures and seven pre-existing fixture differences are retained.

All 11,376 committed archives verify; all 893 authoritative reports restore with their recorded validator outcomes, including failures. Source bytes remain unchanged across main integration. Full-suite and remaining ownership/pending/Release/ASAN/platform parity stay open under #66/#532/#533/#867/#868.