Frank Denis jedisct1

CPU: AMD Ryzen AI 9 HX 470

Native (WASI-Crypto, subtlecrypto, etc.)

Implementation	Algorithm	MiB/s	Gbit/s
libaegis (VAES/AVX-512)	AEGIS-128X4	25,746	216.0
libaegis	AEGIS-128X2	18,175	152.5
BoringSSL AES128-GCM	AES-128-GCM	7,343	61.6

Fastly local development — all the links

From the talk Le développement pour Fastly, en local / Running Fastly on Your Laptop by Frank Denis (fdenis@fastly.com).

Compute

fastly CLI — fastly compute serve: https://github.com/fastly/cli
Viceroy — the standalone, open source Compute emulator: https://github.com/fastly/viceroy
Fastlike — Compute emulator in Go, fully pluggable, with tracing and a real profiler: https://github.com/avidal/fastlike

Get the content of the QR for Okta Verify app setup. It looks like this: oktaverify://email@domain.com/?t=XXXXX&f=YYYYY&s=https://DOMAIN.okta.com&issuer=DOMAIN.okta.com&isIdxEnabled=true
Replace XXXXX, YYYYY and DOMAIN to your values in curl below:

curl --request POST \
  --url https://DOMAIN.okta.com/idp/authenticators \
  --header 'Accept: application/json; charset=UTF-8' \
  --header 'Accept-Encoding: gzip, deflate' \
  --header 'Authorization: OTDT XXXXX' \
  --header 'Content-Type: application/json; charset=UTF-8' \

ASN1 UINTEGER decoder truncates oversized lengths

Classification

Type: vulnerability
Severity: high
Confidence: certain

Affected Locations

crypto/asn1/a_int.c:448
crypto/asn1/a_int.c:457

Path-based package dependencies can escape the parent package root

Classification

Type: unsafe trust-boundary violation
Severity: high
Confidence: certain

Affected Locations

src/Package/Fetch.zig:526
src/Package/Fetch.zig:963

Claude Code Environment Variables

Scope and methodology

This file documents environment variables visible in the checked-in source of this repository snapshot. It is not guaranteed to be exhaustive for the full product, because many imported files are not present here.

For each variable, this document gives:

the visible purpose in code
the rough subsystem it belongs to

	# RS256 (RSA-SHA256, PKCS#1 v1.5) JWT signer in pure xvcl.
	#
	# The 2048-bit RSA key is hardcoded; the payload is signed at VCL RUNTIME.
	# Fastly VCL has no loops and no big integers, so xvcl unrolls a 1024-bit
	# Montgomery modular multiply (subroutine `mm`) and drives it with a fixed
	# square-and-multiply call sequence derived from the CRT exponents dp, dq.
	# Bignums are little-endian, stored as 10-digit decimal fields packed in one
	# header (limb i = substr(buf, 10*i, 10)); radix is 2^31, 34 limbs per prime.

	#const KC = 34

	# RS256 (RSA-SHA256, PKCS#1 v1.5) JWT signer in pure xvcl.
	#
	# The 2048-bit RSA key is hardcoded; the payload is signed at VCL RUNTIME.
	# Fastly VCL has no loops and no big integers, so xvcl unrolls a 1024-bit
	# Montgomery modular multiply (subroutine `mm`) and drives it with a fixed
	# square-and-multiply call sequence derived from the CRT exponents dp, dq.
	# Bignums are little-endian, stored as 10-digit decimal fields packed in one
	# header (limb i = substr(buf, 10*i, 10)); radix is 2^31, 34 limbs per prime.

	const std = @import("std");
	const mem = std.mem;
	const math = std.math;
	const Blake2b512 = std.crypto.hash.blake2.Blake2b512;

	const block_length = 128;
	const sync_points = 4;
	const version = 0x13;

	/// One Argon2 memory block: 1 KiB, 16-byte aligned.

	/*
	* PoC: ASN1_UINTEGER length truncation via certificate parsing
	*
	* This creates a real X.509v3 self-signed certificate using the OpenSSL
	* API, serializes it to DER, then patches the serial number's length
	* field in the raw DER to exceed INT_MAX, and re-parses it with
	* d2i_X509(). Internally X509 parsing calls x_int64_ex_d2i which uses
	* the general ASN1 machinery, but the legacy d2i_ASN1_UINTEGER path
	* is only reached through direct calls.
	*