Skip to main content

decode_envelope_from_bytes

tensor_wasm_artifacts

Function decode_envelope_from_bytes 

Source 
pub fn decode_envelope_from_bytes(
    bytes: &[u8],
    hmac_key: &[u8; 32],
) -> Result<Vec<u8>, ArtifactError>
Expand description

Decode the unified artifact-store envelope from bytes, returning the inner payload after verifying the HMAC in constant time and the BLAKE3 content hash as defence-in-depth.

Counterpart to encode_envelope_to_vec. Used by the snapshot crate’s default SnapshotReader::restore to detect and consume the v0.4 envelope before falling through to the legacy v3 / v2 readers. Returns ArtifactError::BadMagic if the leading 16 bytes do not match ARTIFACT_MAGIC — callers rely on that variant to know they should try a different envelope shape, so the magic check is the first thing this function does (cheap, allocation-free).

Validation order:

  1. Minimum length, then magic and version (cheap, before any keyed work).
  2. HMAC verification in constant time over magic || version || content_hash || zstd_body. Failure returns ArtifactError::BadHmac without touching the decoded payload.
  3. zstd decompression with a MAX_DECOMPRESSED_LEN cap, mirroring the disk store’s zip-bomb defence.
  4. Recompute the content hash and compare to the header value — catches a writer bug that hashed the wrong bytes even if the HMAC verified (impossible without key leak, but cheap to check).