From 441c441eca2be76bcdef0529e16f37bcc52eb67a Mon Sep 17 00:00:00 2001 From: clawbot Date: Sun, 8 Feb 2026 12:03:36 -0800 Subject: [PATCH] fix: prevent double-close of blobgen.Writer in CompressStream CompressStream had both a defer w.Close() and an explicit w.Close() call, causing the compressor and encryptor to be closed twice. The second close on the zstd encoder returns an error, and the age encryptor may write duplicate finalization bytes, potentially corrupting the output stream. Use a closed flag to prevent the deferred close from running after the explicit close succeeds. --- internal/blobgen/compress.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/internal/blobgen/compress.go b/internal/blobgen/compress.go index 1292fae..e8a8799 100644 --- a/internal/blobgen/compress.go +++ b/internal/blobgen/compress.go @@ -51,7 +51,13 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien if err != nil { return 0, "", fmt.Errorf("creating writer: %w", err) } - defer func() { _ = w.Close() }() + + closed := false + defer func() { + if !closed { + _ = w.Close() + } + }() // Copy data if _, err := io.Copy(w, src); err != nil { @@ -62,6 +68,7 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien if err := w.Close(); err != nil { return 0, "", fmt.Errorf("closing writer: %w", err) } + closed = true return w.BytesWritten(), hex.EncodeToString(w.Sum256()), nil } -- 2.45.2