GeezerVison

Summary

Both crypto.randomUUID() and crypto.subtle (SubtleCrypto) are restricted by browsers to secure contexts (HTTPS, or localhost). A ZIM served over plain HTTP on a non-localhost host (LAN server, offline hotspot, a VPN/Tailscale hostname, ...) — an extremely common Kiwix deployment — is not a secure context, so the browser omits both entirely, and any page depending on them fails (randomUUID throws; code awaiting crypto.subtle.digest() tends to fail silently instead).

• crypto.randomUUID(): crypto.getRandomValues() has no such restriction, so it's polyfilled on top of it (standard RFC 4122 v4 construction, via a separately-tested randomUUIDFromBytes helper).
• crypto.subtle.digest(): no lower-level primitive to build it from, so this adds a small, dependency-free pure-JS digest(algorithm, data) supporting SHA-1 and SHA-256 — the two algorithms actually observed in use (our own vendored wombat.js optionally uses SHA-1 for response ETags; archived pages have been seen using SHA-256 to derive a content id) — matching the native SubtleCrypto.digest() → Promise<ArrayBuffer> contract.

Both are installed as a side effect of loading wombatSetup.js, which already runs before any page script (warc2zim's head_insert.html loads it first in <head>).

sha1Bytes/sha256Bytes are cross-validated against Node's own crypto module across many input lengths, including the Merkle-Damgard padding's block-boundary edge cases, rather than relying solely on hand-transcribed test vectors — one of which did turn out to have a dropped character during review; sha1Bytes itself was correct throughout, confirmed via Python's hashlib.

Fixes #391 and #393, found via openzim/warc2zim#327: after fixing #387/#389, a user testing over a Tailscale hostname (plain HTTP, non-localhost) hit Uncaught TypeError: crypto.randomUUID is not a function, aborting the page's JS entirely. After the randomUUID fix, MDN's live-sample iframes were still stuck at src="about:blank" with no visible error — traced to crypto.subtle being undefined, silently breaking the await crypto.subtle.digest("SHA-256", ...) call used to build their content id.

Both reproduced directly (not just inferred): confirmed window.isSecureContext === false and typeof crypto.randomUUID !== "function" / typeof crypto.subtle === "undefined" against a real non-localhost URL, then confirmed both resolved after this patch, with the live-sample demos rendering again end to end.