jedisct1

Fastly local development — all the links

From the talk Le développement pour Fastly, en local / Running Fastly on Your Laptop by Frank Denis (fdenis@fastly.com).

Compute

• fastly CLI — fastly compute serve: https://github.com/fastly/cli
• Viceroy — the standalone, open source Compute emulator: https://github.com/fastly/viceroy
• Fastlike — Compute emulator in Go, fully pluggable, with tracing and a real profiler: https://github.com/avidal/fastlike

jedisct1

const std = @import("std");
const mem = std.mem;
const math = std.math;
const Blake2b512 = std.crypto.hash.blake2.Blake2b512;

const block_length = 128;
const sync_points = 4;
const version = 0x13;

/// One Argon2 memory block: 1 KiB, 16-byte aligned.

jedisct1

1. Get the content of the QR for Okta Verify app setup. It looks like this: oktaverify://email@domain.com/?t=XXXXX&f=YYYYY&s=https://DOMAIN.okta.com&issuer=DOMAIN.okta.com&isIdxEnabled=true
2. Replace XXXXX, YYYYY and DOMAIN to your values in curl below:

curl --request POST \
  --url https://DOMAIN.okta.com/idp/authenticators \
  --header 'Accept: application/json; charset=UTF-8' \
  --header 'Accept-Encoding: gzip, deflate' \
  --header 'Authorization: OTDT XXXXX' \
  --header 'Content-Type: application/json; charset=UTF-8' \

jedisct1

/*
 * PoC: ASN1_UINTEGER length truncation via certificate parsing
 *
 * This creates a real X.509v3 self-signed certificate using the OpenSSL
 * API, serializes it to DER, then patches the serial number's length
 * field in the raw DER to exceed INT_MAX, and re-parses it with
 * d2i_X509(). Internally X509 parsing calls x_int64_ex_d2i which uses
 * the general ASN1 machinery, but the legacy d2i_ASN1_UINTEGER path
 * is only reached through direct calls.
 *

jedisct1

ASN1 UINTEGER decoder truncates oversized lengths

Classification

• Type: vulnerability
• Severity: high
• Confidence: certain

Affected Locations

• crypto/asn1/a_int.c:448
• crypto/asn1/a_int.c:457

jedisct1

Path-based package dependencies can escape the parent package root

Classification

• Type: unsafe trust-boundary violation
• Severity: high
• Confidence: certain

Affected Locations

• src/Package/Fetch.zig:526
• src/Package/Fetch.zig:963

jedisct1

Claude Code Environment Variables

Scope and methodology

This file documents environment variables visible in the checked-in source of this repository snapshot. It is not guaranteed to be exhaustive for the full product, because many imported files are not present here.

For each variable, this document gives:

• the visible purpose in code
• the rough subsystem it belongs to

jedisct1

{
  "version": 1,
  "timestamp": "2026-02-25T13:19:05.695339+00:00",
  "task": "Create xvcl code to compute the MD5 hash of the User-Agent header. Dont simulate, just lint",
  "model": "zai-org/GLM-5",
  "provider": "huggingface",
  "settings": {
    "temperature": 0.55,
    "top_p": 1.0,
    "seed": null,

jedisct1

{
  "version": 1,
  "timestamp": "2026-02-25T13:06:32.962539+00:00",
  "task": "Create xvcl code to compute the MD5 hash of the User-Agent header",
  "model": "zai-org/GLM-5",
  "provider": "huggingface",
  "settings": {
    "temperature": 0.55,
    "top_p": 1.0,
    "seed": null,

jedisct1

diff --git a/lib/std/base64.zig b/lib/std/base64.zig
index 8c08fd6786..5eb9a8d283 100644
--- a/lib/std/base64.zig
+++ b/lib/std/base64.zig
@@ -313,12 +313,22 @@ pub const Base64DecoderWithIgnore = struct {
         return result;
     }
 
-    /// Return the maximum possible decoded size for a given input length - The actual length may be less if the input includes padding.
-    /// `InvalidPadding` is returned if the input length is not valid.