{"record":{"id":"5105c8ec3a5a8039","repo":"crowdsecurity/crowdsec","slug":"decompress-initial-bundle-w","errorCode":null,"errorMessage":"decompress initial bundle: %w","messagePattern":"decompress initial bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/static_bundle.go","lineNumber":65,"sourceCode":"func (c *ChallengeRuntime) seedCacheFromInitialBundle() error {\n\tinitialBundleOnce.Do(func() {\n\t\tdecompressStart := time.Now()\n\n\t\tif len(initialBundleGz) == 0 {\n\t\t\tinitialBundleErr = errors.New(\"baked-in initial_bundle.js.gz is empty (was `go generate` run?)\")\n\t\t\treturn\n\t\t}\n\n\t\tgz, err := gzip.NewReader(bytes.NewReader(initialBundleGz))\n\t\tif err != nil {\n\t\t\tinitialBundleErr = fmt.Errorf(\"gzip reader for initial bundle: %w\", err)\n\t\t\treturn\n\t\t}\n\t\tdefer gz.Close()\n\n\t\tdecoded, err := io.ReadAll(gz)\n\t\tif err != nil {\n\t\t\tinitialBundleErr = fmt.Errorf(\"decompress initial bundle: %w\", err)\n\t\t\treturn\n\t\t}\n\t\tinitialBundle = string(decoded)\n\n\t\tc.log().WithFields(log.Fields{\n\t\t\t\"compressed_bytes\":   len(initialBundleGz),\n\t\t\t\"decompressed_bytes\": len(initialBundle),\n\t\t\t\"duration_ms\":        time.Since(decompressStart).Milliseconds(),\n\t\t}).Debug(\"decompressed baked-in obfuscated challenge code\")\n\t})\n\n\tif initialBundleErr != nil {\n\t\treturn initialBundleErr\n\t}\n\tif initialBundle == \"\" {\n\t\treturn errors.New(\"initial bundle is empty after decompression\")\n\t}\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/static_bundle.go#L47-L83","documentation":"After opening the embedded initial_bundle.js.gz, the runtime reads the decompressed content with io.ReadAll; a failure here means the gzip stream is truncated or corrupted mid-decompression. The error is stored in initialBundleErr and returned for every request to the bundle endpoint. It signals a broken embedded asset in the binary.","triggerScenarios":"initialBundleGz passes gzip.NewReader's header check but its deflate stream is truncated or bit-flipped — e.g. a partial file was embedded because go:generate was interrupted or the asset was corrupted in the repo/build.","commonSituations":"Interrupted go:generate leaving a half-written .gz; LFS or git-smudge/clean filters corrupting binary assets; flaky CI artifact transfers; disk-full during the generate step.","solutions":["Regenerate the asset: delete initial_bundle.js.gz, re-run `go generate`, and rebuild","Validate the asset: `gzip -t initial_bundle.js.gz` must report OK","Compare the .gz checksum/size against a known-good build to spot truncation","Rebuild in a clean environment (fresh clone, adequate disk space) to rule out cache/transfer corruption"],"exampleFix":"# before: corrupted embedded asset\n$ curl localhost:8080/.well-known/appsec/initial_bundle.js\n# error: decompress initial bundle: unexpected EOF\n# after\ngo generate ./pkg/appsec/challenge/... && make build","handlingStrategy":"try-catch","validationCode":"if !bytes.HasPrefix(initialBundleGz, []byte{0x1f, 0x8b}) {\n    return errors.New(\"embedded bundle is not gzip\")\n}\nif zr, err := gzip.NewReader(bytes.NewReader(initialBundleGz)); err == nil {\n    if _, err := io.ReadAll(zr); err != nil { return fmt.Errorf(\"truncated bundle: %w\", err) }\n}","typeGuard":null,"tryCatchPattern":"bundle, err := challenge.InitialBundle()\nif err != nil {\n    log.Error().Err(err).Msg(\"embedded bundle decompression failed; rebuild required\")\n    http.Error(w, \"bundle unavailable\", http.StatusInternalServerError)\n    return\n}","preventionTips":["Run `gzip -t` on the generated asset in CI","Rebuild after any interrupted go:generate","Watch for LFS/git filters touching .gz files; verify checksums","Ensure adequate disk space during asset generation"],"tags":["gzip","embedded-assets","build"],"backgroundTag":"file-read-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}