From 221a6f00965e42c79fd9cd53034db4e9dab531f0 Mon Sep 17 00:00:00 2001 From: Jan-Ivar Bruaroey Date: Tue, 25 Nov 2025 16:18:52 -0500 Subject: [PATCH 1/6] Add an associated webtransport-hashes to request --- fetch.bs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fetch.bs b/fetch.bs index a46852e0a..034caa190 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2248,6 +2248,20 @@ Unless stated otherwise, it is false.

This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]] +

A request has an associated webtransport-hashes (a +list of [=webtransport-hash=] items). Unless stated otherwise it is « ». + +

An webtransport-hash is a +tuple that consists of +algorithm +(a string) and +value (a byte sequence). + +

This list is for exclusive use by +{{WebTransport/WebTransport(url, options)}} when options contains +{{WebTransportOptions/serverCertificateHashes}}. +

A request has an associated From 3c7c2a079061a4de8a450584c3b7d697c52ebca1 Mon Sep 17 00:00:00 2001 From: Jan-Ivar Bruaroey Date: Tue, 2 Dec 2025 17:29:48 -0500 Subject: [PATCH 2/6] Wire webtransport-hashes concept down to obtain a connection --- fetch.bs | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/fetch.bs b/fetch.bs index 034caa190..1469fa143 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2249,8 +2249,11 @@ Unless stated otherwise, it is false.

This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]]

A request has an associated webtransport-hashes (a -list of [=webtransport-hash=] items). Unless stated otherwise it is « ». +id=concept-request-webtransport-hash-list>webtransport-hash list (a +webtransport-hash list). Unless stated otherwise it is « ». + +

A webtransport-hash list is a list of zero or more +webtransport-hashes. It is initially « ».

An webtransport-hash is a tuple that consists of @@ -3017,16 +3020,18 @@ steps:

To obtain a connection, given a network partition key key, URL url, boolean credentials, an optional new connection setting new (default -"no"), and an optional boolean -requireUnreliable (default false), run these +"no"), an optional boolean +requireUnreliable (default false), +and an optional webtransport-hash list webTransportHashes (default []), run these steps: - +

  1. If new is "no", then:

      +

    1. Assert: webTransportHashes is empty.

    2. Let connections be a set of connections in the user agent's connection pool whose key is key, origin is url's origin, and @@ -3074,7 +3079,8 @@ steps:

      Let connection be the result of running this step: run create a connection given key, url's origin, credentials, proxy, an implementation-defined host from hosts, - timingInfo, and requireUnreliable an implementation-defined number + timingInfo, requireUnreliable and webTransportHashes + an implementation-defined number of times, in parallel from each other, and wait for at least 1 to return a value. In an implementation-defined manner, select a value to return from the returned values and return it. Any other returned values that are connections may be closed. @@ -3108,8 +3114,9 @@ reused across connections whose credentials are fal

      To create a connection, given a network partition key key, origin origin, boolean credentials, string proxy, -host host, connection timing info timingInfo, and -boolean requireUnreliable, run these steps: +host host, connection timing info timingInfo, +boolean requireUnreliable and a webtransport-hash list +webTransportHashes, run these steps:

      1. Set timingInfo's connection start time to the @@ -3136,6 +3143,12 @@ boolean requireUnreliable, run these steps:

      2. If credentials is false, then do not send a TLS client certificate. +

      3. If webTransportHashes [=set/is empty|is not empty=], instead of using the + default certificate verification algorithm, consider the server certificate valid if it + meets the [=custom certificate requirements=] and if + [=verify a certificate hash|verifying the certificate hash=] against |webTransportHashes| + returns true. If either condition is not met, then return failure. +

      4. If establishing a connection does not succeed (e.g., a UDP, TCP, or TLS error), then return failure. From 6614713e9816e9fd40f98808edacd9295bd392f6 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 18 Dec 2025 09:09:20 +0100 Subject: [PATCH 3/6] nits --- fetch.bs | 53 +++++++++++++++++++++++++---------------------------- 1 file changed, 25 insertions(+), 28 deletions(-) diff --git a/fetch.bs b/fetch.bs index 1469fa143..c81070d5c 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2248,22 +2248,18 @@ Unless stated otherwise, it is false.

        This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]] -

        A request has an associated webtransport-hash list (a +

        A request has an associated webtransport-hash list (a webtransport-hash list). Unless stated otherwise it is « ». -

        A webtransport-hash list is a list of zero or more +

        A webtransport-hash list is a list of zero or more webtransport-hashes. It is initially « ». -

        An webtransport-hash is a -tuple that consists of -algorithm -(a string) and -value (a byte sequence). +

        An webtransport-hash is a tuple +consisting of an algorithm (a string) and a +value (a byte sequence). -

        This list is for exclusive use by -{{WebTransport/WebTransport(url, options)}} when options contains -{{WebTransportOptions/serverCertificateHashes}}. +

        This list is for exclusive use by {{WebTransport/WebTransport(url, options)}} when +options contains {{WebTransportOptions/serverCertificateHashes}}.

        @@ -3021,17 +3017,18 @@ steps: network partition key key, URL url, boolean credentials, an optional new connection setting new (default "no"), an optional boolean -requireUnreliable (default false), -and an optional webtransport-hash list webTransportHashes (default []), run these -steps: +requireUnreliable (default false), and an +optional webtransport-hash list +webTransportHashes (default « »):
        1. -

          If new is "no", then: +

          If new is "no":

            -

          1. Assert: webTransportHashes is empty. +

          2. Assert: webTransportHashes is empty. +

          3. Let connections be a set of connections in the user agent's connection pool whose key is key, origin is url's origin, and @@ -3079,11 +3076,11 @@ steps:

            Let connection be the result of running this step: run create a connection given key, url's origin, credentials, proxy, an implementation-defined host from hosts, - timingInfo, requireUnreliable and webTransportHashes - an implementation-defined number - of times, in parallel from each other, and wait for at least 1 to return a value. In an - implementation-defined manner, select a value to return from the returned values and - return it. Any other returned values that are connections may be closed. + timingInfo, requireUnreliable, and webTransportHashes an + implementation-defined number of times, in parallel from each other, and wait for + at least 1 to return a value. In an implementation-defined manner, select a value to + return from the returned values and return it. Any other returned values that are + connections may be closed.

            Essentially this allows an implementation to pick one or more IP addresses from the return value of resolve an origin (assuming @@ -3115,8 +3112,8 @@ reused across connections whose credentials are fal

            To create a connection, given a network partition key key, origin origin, boolean credentials, string proxy, host host, connection timing info timingInfo, -boolean requireUnreliable and a webtransport-hash list -webTransportHashes, run these steps: +boolean requireUnreliable, and a webtransport-hash list +webTransportHashes:

            1. Set timingInfo's connection start time to the @@ -3143,11 +3140,11 @@ boolean requireUnreliable and a webtransport-hash list

            2. If credentials is false, then do not send a TLS client certificate. -

            3. If webTransportHashes [=set/is empty|is not empty=], instead of using the - default certificate verification algorithm, consider the server certificate valid if it - meets the [=custom certificate requirements=] and if - [=verify a certificate hash|verifying the certificate hash=] against |webTransportHashes| - returns true. If either condition is not met, then return failure. +

            4. If webTransportHashes [=set/is not empty=], instead of using the default + certificate verification algorithm, consider the server certificate valid if it meets the + [=custom certificate requirements=] and if + [=verify a certificate hash|verifying the certificate hash=] against |webTransportHashes| returns + true. If either condition is not met, then return failure.

            5. If establishing a connection does not succeed (e.g., a UDP, TCP, or TLS error), then return failure. From 6f4756bce718d680f17ad1d47a33c75e3e40be8a Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 18 Dec 2025 09:13:45 +0100 Subject: [PATCH 4/6] Update fetch.bs --- fetch.bs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fetch.bs b/fetch.bs index c81070d5c..f8e116f81 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2254,7 +2254,7 @@ Unless stated otherwise, it is false.

              A webtransport-hash list is a list of zero or more webtransport-hashes. It is initially « ». -

              An webtransport-hash is a tuple +

              A webtransport-hash is a tuple consisting of an algorithm (a string) and a value (a byte sequence). From b868e229875c95258a550e2b1279299cda8046b6 Mon Sep 17 00:00:00 2001 From: Jan-Ivar Bruaroey Date: Mon, 12 Jan 2026 20:43:19 -0500 Subject: [PATCH 5/6] s/webtransport-hash/WebTransport-hash/ and use [=list/is not empty=] --- fetch.bs | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/fetch.bs b/fetch.bs index f8e116f81..60c501d10 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2248,15 +2248,15 @@ Unless stated otherwise, it is false.

              This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]] -

              A request has an associated webtransport-hash list (a -webtransport-hash list). Unless stated otherwise it is « ». +

              A request has an associated WebTransport-hash list (a +WebTransport-hash list). Unless stated otherwise it is « ». -

              A webtransport-hash list is a list of zero or more -webtransport-hashes. It is initially « ». +

              A WebTransport-hash list is a list of zero or more +WebTransport-hashes. It is initially « ». -

              A webtransport-hash is a tuple -consisting of an algorithm (a string) and a -value (a byte sequence). +

              A WebTransport-hash is a tuple +consisting of an algorithm (a string) and a +value (a byte sequence).

              This list is for exclusive use by {{WebTransport/WebTransport(url, options)}} when options contains {{WebTransportOptions/serverCertificateHashes}}. @@ -3018,7 +3018,7 @@ steps: credentials, an optional new connection setting new (default "no"), an optional boolean requireUnreliable (default false), and an -optional webtransport-hash list +optional WebTransport-hash list webTransportHashes (default « »): @@ -3112,7 +3112,7 @@ reused across connections whose credentials are fal

              To create a connection, given a network partition key key, origin origin, boolean credentials, string proxy, host host, connection timing info timingInfo, -boolean requireUnreliable, and a webtransport-hash list +boolean requireUnreliable, and a WebTransport-hash list webTransportHashes:

                @@ -3140,7 +3140,7 @@ boolean requireUnreliable, and a webtransport-hash list

              1. If credentials is false, then do not send a TLS client certificate. -

              2. If webTransportHashes [=set/is not empty=], instead of using the default +

              3. If webTransportHashes [=list/is not empty=], instead of using the default certificate verification algorithm, consider the server certificate valid if it meets the [=custom certificate requirements=] and if [=verify a certificate hash|verifying the certificate hash=] against |webTransportHashes| returns From 1a73ec311a2d850f15da5e183a51812d2c50aceb Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 28 Jan 2026 14:10:52 +0100 Subject: [PATCH 6/6] nits --- fetch.bs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fetch.bs b/fetch.bs index 60c501d10..800a7ceb7 100755 --- a/fetch.bs +++ b/fetch.bs @@ -2252,7 +2252,7 @@ Unless stated otherwise, it is false. WebTransport-hash list). Unless stated otherwise it is « ».

                A WebTransport-hash list is a list of zero or more -WebTransport-hashes. It is initially « ». +WebTransport-hashes.

                A WebTransport-hash is a tuple consisting of an algorithm (a string) and a @@ -3020,7 +3020,7 @@ steps: requireUnreliable (default false), and an optional WebTransport-hash list webTransportHashes (default « »): - +