Reads already wait for END_STREAM when inflation applies, so keep the receive window open while the encoded body is buffered. This lets a gzip response larger than 65,535 bytes inflate instead of failing, and the split test now reads before the content length so it exercises the read path.
With GCC whose exceptions are SEH, as MSYS2 UCRT64 ships it, link_libraries
adds windows_seh_personalities to every later target, nghttp2_static
included. nghttp2's install(EXPORT) then fails at generation because the
object library is in no export set, so the Windows MSYS2 workflow stops at
configure. nghttp2 is C and needs no personality routine; the libraries
that link it still get it from link_libraries.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHttp2SetMinSslVersion returns 0 for versions 2 (SSL 3.0) to 5 (TLS 1.2)
on a template or an unsent request: the range libSceSsl's
sceSslSetMinSslVersion takes on a 13.40 console (docs/dev/debt/libSceSsl.md).
The floor is not kept, as libSceSsl negotiates TLS 1.2 only, which meets
every accepted floor. Versions 0, 1 and above 5 still throw, as do context
and cookie-box ids and sent requests; unknown and deleted ids still return
0x817B1100.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHttp2SendRequest threw when sceSslConnect failed. A PS5 payload measured the result against loopback TLS servers: the console returns the handshake failure unchanged for an untrusted or mismatched certificate, an expired one once 0x8 is enabled, a fatal alert, a peer that closes or resets during the handshake and a reply that is not TLS. After a failed send the status call returns 0, the content length and read calls 0x817B1065, and another send the same error.
Each test serves its own CA_LIST.cer through the working-directory
override of the sandbox path. guest_ssl_system_roots checks that a
handshake to the fixture server fails without the helper and passes
with it, that a context authority still works alongside the list, and
that an empty or certificate-free list throws with its path.
guest_http2_system_roots sends a request from a context with no loaded
certificate, which passes only through the transport's helper call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every libSceSsl context started without trust anchors, so a libSceHttp2
request without a verify callback failed the known-CA check. RetroArch's
updater, PS5LM and Porpoise all use version-3 templates over https://
without one. libSceSsl now parses /<sandbox word>/common/cert/CA_LIST.cer,
served by libkernel from the host trust store, once per process into its
own pool, and SslTrustSystemRoots_nid_no_patch links those roots after
the context's own authorities for one connection. The HTTP/2 transport
calls it after creating each connection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Keep the auth and auto-redirect flags, headers and the auth-info and
pre-send callbacks in Http2::Settings, so requests copy them from their
template and they freeze once transport exists. Accepted kinds, error
codes and their order follow the firmware 13.42 module as reported in
the review: option, header and callback calls reject contexts and
cookie boxes, sceHttp2AuthCacheFlush validates the context,
sceHttp2RedirectCacheFlush ignores its argument and the auto-redirect
flag keeps the stored int.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01QdXm6rjuENJGYLZh5hc8cQ
Dean Galvin