Vendor Data — packaging-mode-invariant + signed + canary-guarded

Loader for vendored data files that ship inside the framework tarball (lib/vendor/*). Inline-as-JS means the data survives any packaging mode — SEA, esbuild bundle, pkg, nexe, Bun compile, AWS Lambda — without __dirname-relative fs.readFileSync paths collapsing under the bundler. Every load runs four orthogonal integrity checks before returning a byte to the caller:

1. SHA-256 of the embedded payload matches the expected constant 2. SHA3-512 of the embedded payload matches the expected constant 3. SLH-DSA-SHAKE-256f signature over the payload verifies against the maintainer's pinned public key (lib/vendor/.vendor-data-pubkey) 4. The known canary entry (where applicable per data file) is present in the parsed payload — defends against content swap even when an attacker forges hashes + signatures

Refusal at any step throws VendorDataError. verifyAll() runs at framework boot so a tampered vendor file is a fail-fast — not a first-request-touches-PSL surprise.

Each vendored data file ships as a .data.js module that exports { payload, metadata, canary }. The .data.js is regenerated by scripts/vendor-update.sh --refresh-data whenever the upstream source is refreshed; it is never hand-edited.

b.vendorData.get(name) #

Return the verified payload Buffer for the named vendored data file. First call per name runs all integrity layers (dual-hash + SLH-DSA signature); subsequent calls return from cache. The canary-in-payload check is run by verifyAll() at framework boot; get() skips it on the hot path because the canary's parse-side semantics are caller- specific (PSL parser vs password-set lookup vs PEM chain).

var pslBytes = b.vendorData.get("public-suffix-list");
var psl = pslBytes.toString("utf8");

b.vendorData.getAsString(name) #

Convenience wrapper around get(name) that returns the payload decoded as UTF-8. Use when the caller wants a string directly; the underlying Buffer caches once so repeated calls don't re-decode.

var passwordList = b.vendorData.getAsString("common-passwords-top-10000");
var lines = passwordList.split(/\r?\n/);

b.vendorData.verifyAll() #

Run all four integrity layers across every registered vendored data file — including the in-payload canary check via the caller-supplied canaryCheck closure each .data.js exports. Returns the inventory of names verified. Throws on any failure. Operators wire this into framework boot so a tampered install fails fast.

b.vendorData.verifyAll();   // throws VendorDataError on any tamper

b.vendorData.inventory() #

Return per-vendor-data metadata for compliance reporting. Each entry: { name, source, fetchedAt, sha256, sha3_512, signedBy, canary, byteLength }. Pipes directly into SBOM emission + b.compliance posture rendering.

var inv = b.vendorData.inventory();
inv.forEach(function (entry) {
  console.log(entry.name + " (" + entry.byteLength + " bytes) " +
              "fetched " + entry.fetchedAt + " from " + entry.source +
              " — signed by " + entry.signedBy);
});

Last updated 2026-08-08T16:39:49.652Z by seeder.