From 8019260926dcebe4f4be99cb5f92f84fbc9cd6d3 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 19:03:34 +0100 Subject: Map OpenSSL only in a server that uses it Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66 MiB of it the process's own (relocated data), though most servers never reach an https receiver or seal a send. The code that uses OpenSSL (TLS to https receivers, sealing) is now built as pure-crypto.so beside pure-serve and exports one table; pure-serve maps it the first time a wire to an https URL opens or a key is read or a seal wired (serve/crypto.c), and a missing library is reported at startup. What needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in pure-serve. An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse (RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The checks, https webhooks and sealed sends included, pass unchanged. --- serve/serve.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'serve/serve.c') diff --git a/serve/serve.c b/serve/serve.c index 4f633ed..5088d8a 100644 --- a/serve/serve.c +++ b/serve/serve.c @@ -1754,6 +1754,11 @@ static bool open_wires(Executor *ex, const PureModule *m, const char *const *sen /* --seal OUTPUT=KEY: that output's sends sealed to the receiver's public key (hex). */ static bool wire_seals(Executor *ex, const PureModule *m, const char *const *seals, unsigned count) { + char error[512]; + if (count && !pure_seal_ready(error, sizeof(error))) { + fprintf(stderr, "--seal: %s\n", error); + return false; + } for (unsigned i = 0; i < count; ++i) { const char *equals = strchr(seals[i], '='); unsigned char peer[PURE_SEAL_KEY]; -- cgit v1.2.3