|
| 1 | +//! The host's font declarations: `--font FAMILY=PATH@sha256:HEX`. |
| 2 | +//! |
| 3 | +//! A family name is not a font identity — the same name resolves to |
| 4 | +//! different bytes on different machines — so a declaration carries the |
| 5 | +//! digest of the bytes it means, and the host **verifies before rendering**. |
| 6 | +//! A mismatch refuses; it never becomes a silently different pixel. |
| 7 | +//! |
| 8 | +//! This is the host side of the hermetic environment the ratified |
| 9 | +//! [text-oracle method](../../../docs/wg/consolidation/text-oracle.md) |
| 10 | +//! requires. The engine never reads a font file and never consults an |
| 11 | +//! ambient font database: the environment it resolves against is exactly |
| 12 | +//! what was declared here, and an undeclared family refuses by name. |
| 13 | +
|
| 14 | +use std::path::Path; |
| 15 | +use std::sync::Arc; |
| 16 | + |
| 17 | +use sha2::{Digest, Sha256}; |
| 18 | + |
| 19 | +/// One parsed `--font` declaration, before its bytes are read. |
| 20 | +#[derive(Clone, Debug, PartialEq, Eq)] |
| 21 | +pub(crate) struct FontDeclaration { |
| 22 | + pub(crate) family: String, |
| 23 | + pub(crate) path: String, |
| 24 | + /// Lowercase hex SHA-256 of the bytes this declaration means. |
| 25 | + pub(crate) digest: String, |
| 26 | +} |
| 27 | + |
| 28 | +/// Parse one `FAMILY=PATH@sha256:HEX`. |
| 29 | +/// |
| 30 | +/// The family is everything before the first `=`, the digest everything |
| 31 | +/// after the last `@sha256:` — so a path may contain `=` and `@`, and only |
| 32 | +/// the exact digest marker terminates it. |
| 33 | +pub(crate) fn parse_declaration(spec: &str) -> Result<FontDeclaration, String> { |
| 34 | + const MARKER: &str = "@sha256:"; |
| 35 | + let Some((family, rest)) = spec.split_once('=') else { |
| 36 | + return Err(format!( |
| 37 | + "font declaration {spec:?} must look like FAMILY=PATH@sha256:HEX" |
| 38 | + )); |
| 39 | + }; |
| 40 | + if family.is_empty() { |
| 41 | + return Err(format!("font declaration {spec:?} names no family")); |
| 42 | + } |
| 43 | + let Some(marker_at) = rest.rfind(MARKER) else { |
| 44 | + return Err(format!( |
| 45 | + "font declaration {spec:?} carries no @sha256: digest — a family name is not a font \ |
| 46 | + identity, so the bytes it means are declared and verified" |
| 47 | + )); |
| 48 | + }; |
| 49 | + let path = &rest[..marker_at]; |
| 50 | + let digest = &rest[marker_at + MARKER.len()..]; |
| 51 | + if path.is_empty() { |
| 52 | + return Err(format!("font declaration {spec:?} names no path")); |
| 53 | + } |
| 54 | + if digest.len() != 64 || !digest.bytes().all(|b| b.is_ascii_hexdigit()) { |
| 55 | + return Err(format!( |
| 56 | + "font declaration {spec:?} carries {digest:?}, which is not a 64-character hex SHA-256" |
| 57 | + )); |
| 58 | + } |
| 59 | + Ok(FontDeclaration { |
| 60 | + family: family.to_string(), |
| 61 | + path: path.to_string(), |
| 62 | + digest: digest.to_ascii_lowercase(), |
| 63 | + }) |
| 64 | +} |
| 65 | + |
| 66 | +/// Read and verify every declaration into the engine's font environment. |
| 67 | +/// |
| 68 | +/// Verification is not advisory: bytes whose digest differs from the |
| 69 | +/// declaration are refused here, before a frame exists, so no render can |
| 70 | +/// proceed against a font the host did not mean. |
| 71 | +pub(crate) fn load_environment( |
| 72 | + declarations: &[FontDeclaration], |
| 73 | +) -> Result<textlayout::Environment, String> { |
| 74 | + let mut resources = Vec::with_capacity(declarations.len()); |
| 75 | + for declaration in declarations { |
| 76 | + let bytes = std::fs::read(Path::new(&declaration.path)) |
| 77 | + .map_err(|error| format!("cannot read font {}: {error}", declaration.path))?; |
| 78 | + let actual = format!("{:x}", Sha256::digest(&bytes)); |
| 79 | + if actual != declaration.digest { |
| 80 | + return Err(format!( |
| 81 | + "font {} is not the declared identity: expected sha256 {}, read {actual}", |
| 82 | + declaration.path, declaration.digest |
| 83 | + )); |
| 84 | + } |
| 85 | + let mut digest = [0u8; 32]; |
| 86 | + for (index, slot) in digest.iter_mut().enumerate() { |
| 87 | + *slot = u8::from_str_radix(&actual[index * 2..index * 2 + 2], 16) |
| 88 | + .expect("hex from a hex formatter"); |
| 89 | + } |
| 90 | + resources.push(textlayout::FontResource { |
| 91 | + key: textlayout::FontKey::new(digest), |
| 92 | + family: declaration.family.clone(), |
| 93 | + face_index: 0, |
| 94 | + bytes: Arc::from(bytes), |
| 95 | + }); |
| 96 | + } |
| 97 | + Ok(textlayout::Environment::new(resources)) |
| 98 | +} |
| 99 | + |
| 100 | +#[cfg(test)] |
| 101 | +mod tests { |
| 102 | + use super::*; |
| 103 | + |
| 104 | + const HEX: &str = "b719ecb31c5b21fc573c03f6421c74ac63c271a5a3ff841e34f9705fb94b8448"; |
| 105 | + |
| 106 | + #[test] |
| 107 | + fn a_well_formed_declaration_parses() { |
| 108 | + let parsed = parse_declaration(&format!("Ahem=fixtures/ahem.ttf@sha256:{HEX}")).unwrap(); |
| 109 | + assert_eq!( |
| 110 | + parsed, |
| 111 | + FontDeclaration { |
| 112 | + family: "Ahem".to_string(), |
| 113 | + path: "fixtures/ahem.ttf".to_string(), |
| 114 | + digest: HEX.to_string(), |
| 115 | + } |
| 116 | + ); |
| 117 | + } |
| 118 | + |
| 119 | + #[test] |
| 120 | + fn a_path_may_carry_the_delimiters() { |
| 121 | + // Only the *last* `@sha256:` terminates the path, and only the first |
| 122 | + // `=` ends the family — so awkward real paths still parse. |
| 123 | + let parsed = |
| 124 | + parse_declaration(&format!("My Font=/tmp/a=b@1/font.ttf@sha256:{HEX}")).unwrap(); |
| 125 | + assert_eq!(parsed.family, "My Font"); |
| 126 | + assert_eq!(parsed.path, "/tmp/a=b@1/font.ttf"); |
| 127 | + } |
| 128 | + |
| 129 | + #[test] |
| 130 | + fn an_undeclared_digest_refuses() { |
| 131 | + let error = parse_declaration("Ahem=fixtures/ahem.ttf").unwrap_err(); |
| 132 | + assert!(error.contains("a family name is not a font identity")); |
| 133 | + } |
| 134 | + |
| 135 | + #[test] |
| 136 | + fn a_malformed_digest_refuses() { |
| 137 | + for spec in [ |
| 138 | + format!("Ahem=f.ttf@sha256:{}", &HEX[..63]), |
| 139 | + format!("Ahem=f.ttf@sha256:{}z", &HEX[..63]), |
| 140 | + "Ahem=f.ttf@sha256:".to_string(), |
| 141 | + ] { |
| 142 | + let error = parse_declaration(&spec).unwrap_err(); |
| 143 | + assert!(error.contains("hex SHA-256"), "{spec}: {error}"); |
| 144 | + } |
| 145 | + } |
| 146 | + |
| 147 | + #[test] |
| 148 | + fn an_empty_family_or_path_refuses() { |
| 149 | + assert!(parse_declaration(&format!("=f.ttf@sha256:{HEX}")).is_err()); |
| 150 | + assert!(parse_declaration(&format!("Ahem=@sha256:{HEX}")).is_err()); |
| 151 | + } |
| 152 | + |
| 153 | + #[test] |
| 154 | + fn the_pinned_gate_font_verifies_and_a_wrong_digest_does_not() { |
| 155 | + let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../.."); |
| 156 | + let path = root |
| 157 | + .join("fixtures/web-first/fonts/ahem.ttf") |
| 158 | + .display() |
| 159 | + .to_string(); |
| 160 | + |
| 161 | + let environment = load_environment(&[FontDeclaration { |
| 162 | + family: "Ahem".to_string(), |
| 163 | + path: path.clone(), |
| 164 | + digest: HEX.to_string(), |
| 165 | + }]) |
| 166 | + .expect("the pinned bytes match their recorded digest"); |
| 167 | + assert_eq!(environment.fonts().len(), 1); |
| 168 | + assert_eq!(environment.fonts()[0].family, "Ahem"); |
| 169 | + |
| 170 | + let wrong = "0".repeat(64); |
| 171 | + let error = load_environment(&[FontDeclaration { |
| 172 | + family: "Ahem".to_string(), |
| 173 | + path, |
| 174 | + digest: wrong, |
| 175 | + }]) |
| 176 | + .expect_err("a font that is not the declared identity must refuse before rendering"); |
| 177 | + assert!(error.contains("is not the declared identity")); |
| 178 | + } |
| 179 | +} |
0 commit comments