http: hand back response body without copying it

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code

[HarryR]

From the stage0 boot-path security review (buffer-duplication pass).

http::request extracted the response body with raw[sep + 4..].to_vec(), copying the whole tail into a fresh Vec and then dropping raw. On the payload download that is a full-length memcpy and roughly 2x peak memory for the transfer. This switches to raw.split_off(sep + 4), which reuses the existing allocation and hands back the tail directly.

No behavior change: the returned bytes are identical, so admission (sha256 / ed25519) and PCR 14 measurement are unaffected.

Verified: make boot-x86_64 boots the full chain (payload downloaded, admitted, measured, chain-loaded) and fails closed as expected.

🤖 Generated with Claude Code