crowdsecurity/crowdsec · critical

failed to create gzip reader for obfuscator wasm: %w

Error message

failed to create gzip reader for obfuscator wasm: %w

What it means

This error is returned by compileObfuscatorModule when gzip.NewReader fails on the embedded, gzip-compressed obfuscator WASM binary. Since obfuscatorWasmGz is a compile-time embedded byte slice, this almost certainly means the embedded asset is corrupt, truncated, or was produced by a bad build step. The error is wrapped with %w so the underlying gzip error (e.g. gzip: invalid header) is preserved.

Source

Thrown at pkg/appsec/challenge/challenge.go:317

	return nil
}

// NewChallengeRuntime builds and starts a ChallengeRuntime: it initializes the
// wazero runtime, decompresses the baked-in library bundle, derives the master
// secret + keyring, pre-warms the dynamic-module cache, and (if configured)
// spawns the background obfuscation refresher. Safe for concurrent use across
// all appsec runners. Pass WithXxx options to override defaults.
// compileObfuscatorModule decompresses the baked-in obfuscator WASM (once,
// process-wide) and compiles it for the given runtime. Pre-compiling lets each
// ObfuscateJS call merely instantiate the module instead of re-parsing the WASM
// bytes, which would otherwise cost ~4-5s per call.
func compileObfuscatorModule(ctx context.Context, r wazero.Runtime) (wazero.CompiledModule, error) {
	var obfuscatorWasmErr error

	obfuscatorWasmOnce.Do(func() {
		zr, err := gzip.NewReader(bytes.NewReader(obfuscatorWasmGz))
		if err != nil {
			obfuscatorWasmErr = fmt.Errorf("failed to create gzip reader for obfuscator wasm: %w", err)
			return
		}
		defer zr.Close()

		obfuscatorWasm, err = io.ReadAll(zr)
		if err != nil {
			obfuscatorWasmErr = fmt.Errorf("failed to decompress obfuscator wasm: %w", err)
			return
		}
	})

	if obfuscatorWasmErr != nil {
		return nil, obfuscatorWasmErr
	}

	compiledMod, err := r.CompileModule(ctx, obfuscatorWasm)
	if err != nil {
		return nil, fmt.Errorf("failed to compile obfuscator wasm module: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Rebuild the binary from a clean checkout: git status / git checkout -- pkg/appsec/challenge and run make build again.
2. Verify the embedded asset is valid gzip (check the go:embed directive and any generation script that produces obfuscatorWasmGz).
3. Regenerate obfuscatorWasmGz with the project's own embed/generation tooling instead of hand-crafting the bytes.
4. If using a fork or patch, re-apply upstream changes to challenge.go and its embedded assets.

Example fix

// before (hand-replaced asset)
obfuscatorWasmGz = somePlainWasmBytes
// after (regenerate properly and rebuild)
// go:embed obfuscator.wasm.gz
var obfuscatorWasmGz []byte // produced by gzip of obfuscator.wasm via the build script

// Go: verify the embedded asset is valid gzip before initializing
if _, err := gzip.NewReader(bytes.NewReader(obfuscatorWasmGz)); err != nil {
    return fmt.Errorf("embedded obfuscator wasm is not valid gzip: %w", err)
}

if err != nil { return nil, fmt.Errorf("failed to create gzip reader for obfuscator wasm: %w", err) } // check wrapped cause with errors.Unwrap

When it happens

Trigger: Calling NewChallengeRuntime (directly or via Configure) when the embedded obfuscatorWasmGz byte slice cannot be opened as a valid gzip stream — corrupt or truncated embedded asset, or a build/replace directive that swapped the binary for non-gzip bytes.

Common situations: Custom builds where the go:embed asset was overwritten or partially copied; a modified/stubbed challenge.go from a fork or a bad patch; binary corruption after a failed build or aggressive link stripping.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• failed to decompress obfuscator wasm: %w
• failed to read gz %s: %w
• failed to compile obfuscator wasm module: %w
• GOARCH %s has no wasm compiler backend
• wasm compiler mode unavailable: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/787fdc5fb2bd92b1. Report an issue: GitHub.