Merge branch 'master' into rc/flush

Fix rportfwd

.gitignore

@@ -5,6 +5,7 @@
 /artifacts
 /artifacts/**
 
+*.rc
 
 /Dockerfile.*
 /*.sdk.tar.xz

README.md

@@ -46,4 +46,3 @@ Please take a moment and fill out [our survey](https://forms.gle/SwVsHFNh24ChG58
 ### License - GPLv3
 
 Sliver is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective subdirectories in this project for details.
-

client/cli/cli.go

@@ -51,6 +51,7 @@ func init() {
 	defer logFile.Close()
 
 	rootCmd.TraverseChildren = true
+	rootCmd.Flags().String(RCFlagName, "", "path to rc script file")
 
 	// Create the console client, without any RPC or commands bound to it yet.
 	// This created before anything so that multiple commands can make use of

client/cli/console.go

@@ -40,6 +40,7 @@ func consoleCmd(con *console.SliverClient) *cobra.Command {
 		Short: "Start the sliver client console",
 	}
 
+	consoleCmd.Flags().String(RCFlagName, "", "path to rc script file")
 	consoleCmd.RunE, consoleCmd.PersistentPostRunE = consoleRunnerCmd(con, true)
 	return consoleCmd
 }
@@ -47,7 +48,7 @@ func consoleCmd(con *console.SliverClient) *cobra.Command {
 func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *cobra.Command, args []string) error) {
 	var ln *grpc.ClientConn
 
-	pre = func(_ *cobra.Command, _ []string) error {
+	pre = func(cmd *cobra.Command, _ []string) error {
 
 		configs := assets.GetConfigs()
 		if len(configs) == 0 {
@@ -59,13 +60,18 @@ func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *
 			return nil
 		}
 
+		rcScript, err := ReadRCScript(cmd)
+		if err != nil {
+			fmt.Printf("Failed to read rc script: %s\n", err)
+			return nil
+		}
+
 		// Don't clobber output when simply running an implant command from system shell.
 		if run {
 			fmt.Printf("Connecting to %s:%d ...\n", config.LHost, config.LPort)
 		}
 
 		var rpc rpcpb.SliverRPCClient
-		var err error
 
 		rpc, ln, err = transport.MTLSConnect(config)
 		if err != nil {
@@ -76,7 +82,7 @@ func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *
 		// Wait for any connection state changes and exit if the connection is lost.
 		go handleConnectionLost(ln)
 
-		return console.StartClient(con, rpc, command.ServerCommands(con, nil), command.SliverCommands(con), run)
+		return console.StartClient(con, rpc, command.ServerCommands(con, nil), command.SliverCommands(con), run, rcScript)
 	}
 
 	// Close the RPC connection once exiting

client/cli/rc.go

@@ -0,0 +1,31 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+const RCFlagName = "rc"
+
+func ReadRCScript(cmd *cobra.Command) (string, error) {
+	if cmd == nil {
+		return "", nil
+	}
+	if cmd.Flags().Lookup(RCFlagName) == nil {
+		return "", nil
+	}
+	rcPath, err := cmd.Flags().GetString(RCFlagName)
+	if err != nil {
+		return "", err
+	}
+	if rcPath == "" {
+		return "", nil
+	}
+	data, err := os.ReadFile(rcPath)
+	if err != nil {
+		return "", fmt.Errorf("read rc script %q: %w", rcPath, err)
+	}
+	return string(data), nil
+}

client/command/c2profiles/c2profiles.go

@@ -21,6 +21,7 @@ package c2profiles
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/url"
@@ -42,6 +43,10 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 )
 
+var (
+	ErrNoSelection = errors.New("no selection")
+)
+
 // C2ProfileCmd list available http profiles
 func C2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	profileName, _ := cmd.Flags().GetString("name")
@@ -53,7 +58,11 @@ func C2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 			return
 		}
 		if len(httpC2Profiles.Configs) != 1 {
-			profileName = selectC2Profile(httpC2Profiles.Configs)
+			profileName, err = selectC2Profile(httpC2Profiles.Configs)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
 		}
 	}
 
@@ -124,7 +133,11 @@ func ExportC2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []st
 			return
 		}
 		if len(httpC2Profiles.Configs) != 1 {
-			profileName = selectC2Profile(httpC2Profiles.Configs)
+			profileName, err = selectC2Profile(httpC2Profiles.Configs)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
 		}
 	}
 
@@ -540,7 +553,7 @@ func PrintC2Profiles(profile *clientpb.HTTPC2Config, con *console.SliverClient)
 	con.Println("\n")
 }
 
-func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) string {
+func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) (string, error) {
 	c2profile := ""
 	var choices []string
 	for _, c2profile := range c2profiles {
@@ -549,7 +562,11 @@ func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) string {
 
 	_ = forms.Select("Select a c2 profile", choices, &c2profile)
 
-	return c2profile
+	if c2profile == "" {
+		return "", ErrNoSelection
+	}
+
+	return c2profile, nil
 }
 
 func updateC2Profile(template *assets.HTTPC2Config, urls []string) (*assets.HTTPC2Config, error) {

client/command/exit/exit.go

@@ -20,7 +20,6 @@ package exit
 
 import (
 	"context"
-	"fmt"
 	"os"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -32,26 +31,25 @@ import (
 
 // ExitCmd - Exit the console.
 func ExitCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
-	fmt.Println("Exiting...")
 	if con.IsServer {
 		sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
 		if err != nil {
-			os.Exit(1)
+			flushAndExit(con, 1)
 		}
 		beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
 		if err != nil {
-			os.Exit(1)
+			flushAndExit(con, 1)
 		}
 		if 0 < len(sessions.Sessions) || 0 < len(beacons.Beacons) {
 			con.Printf("There are %d active sessions and %d active beacons.\n", len(sessions.Sessions), len(beacons.Beacons))
 			confirm := false
-			_ = forms.Confirm("Are you sure you want to exit?", &confirm)
+			forms.Confirm("Are you sure you want to exit?", &confirm)
 			if !confirm {
 				return
 			}
 		}
 	}
-	os.Exit(0)
+	flushAndExit(con, 0)
 }
 
 // Commands returns the `exit` command.
@@ -65,3 +63,12 @@ func Command(con *console.SliverClient) []*cobra.Command {
 		GroupID: constants.GenericHelpGroup,
 	}}
 }
+
+func flushAndExit(con *console.SliverClient, code int) {
+	if con != nil {
+		con.FlushOutput()
+	} else {
+		os.Stdout.Sync()
+	}
+	os.Exit(code)
+}

client/command/generate/generate.go

@@ -85,6 +85,7 @@ var (
 
 	ErrNoExternalBuilder = errors.New("no external builders are available")
 	ErrNoValidBuilders   = errors.New("no valid external builders for target")
+	ErrNoSelection       = errors.New("no selection")
 )
 
 // GenerateCmd - The main command used to generate implant binaries
@@ -1144,6 +1145,11 @@ func selectExternalBuilder(builders []*clientpb.Builder, _ *console.SliverClient
 	}
 	choice := ""
 	_ = forms.Select("Select an external builder:", choices, &choice)
+
+	if choice == "" {
+		return nil, ErrNoSelection
+	}
+
 	for _, builder := range builders {
 		if builder.Name == choice {
 			return builder, nil

client/command/generate/traffic-encoders.go

@@ -283,6 +283,10 @@ func SelectTrafficEncoder(con *console.SliverClient) string {
 	}
 	sort.Strings(encoderNames)
 	var selectedEncoder string
-	_ = forms.Select("Select a traffic encoder:", encoderNames, &selectedEncoder)
+	err = forms.Select("Select a traffic encoder:", encoderNames, &selectedEncoder)
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return ""
+	}
 	return selectedEncoder
 }

client/console/console.go

@@ -41,6 +41,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"github.com/bishopfox/sliver/util"
 	"github.com/gofrs/uuid"
+	"github.com/kballard/go-shellquote"
 	"github.com/reeflective/console"
 	"github.com/reeflective/readline"
 	"github.com/spf13/cobra"
@@ -98,8 +99,11 @@ type SliverClient struct {
 	IsServer                 bool
 	IsCLI                    bool
 
-	jsonHandler slog.Handler
-	printf      func(format string, args ...any) (int, error)
+	jsonHandler      slog.Handler
+	printf           func(format string, args ...any) (int, error)
+	stdoutPipeWriter *os.File
+	stdoutPipeDone   chan struct{}
+	stdoutPipeOnce   sync.Once
 }
 
 // NewConsole creates the sliver client (and console), creating menus and prompts.
@@ -159,7 +163,7 @@ func NewConsole(isServer bool) *SliverClient {
 // Init requires a working RPC connection to the sliver server, and 2 different sets of commands.
 // If run is true, the console application is started, making this call blocking. Otherwise, commands and
 // RPC connection are bound to the console (making the console ready to run), but the console does not start.
-func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, sliverCmds console.Commands, run bool) error {
+func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, sliverCmds console.Commands, run bool, rcScript string) error {
 	con.Rpc = rpc
 	con.IsCLI = !run
 
@@ -206,6 +210,13 @@ func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, slive
 		con.setupAsciicastRecord(asciicastLog, asciicastStream)
 	}
 
+	if rcScript != "" {
+		originalPrintf := con.printf
+		con.printf = fmt.Printf
+		con.runRCScript(serverCmds, sliverCmds, rcScript)
+		con.printf = originalPrintf
+	}
+
 	if !con.IsCLI {
 		return con.App.Start()
 	}
@@ -213,6 +224,71 @@ func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, slive
 	return nil
 }
 
+func (con *SliverClient) runRCScript(serverCmds, sliverCmds console.Commands, rcScript string) {
+	scanner := bufio.NewScanner(strings.NewReader(rcScript))
+	lineNumber := 0
+
+	for scanner.Scan() {
+		lineNumber++
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		if err := con.runRCLine(serverCmds, sliverCmds, line); err != nil {
+			con.PrintErrorf("rc line %d error: %s", lineNumber, err)
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		con.PrintErrorf("rc script error: %s", err)
+	}
+}
+
+func (con *SliverClient) runRCLine(serverCmds, sliverCmds console.Commands, line string) error {
+	args, err := shellquote.Split(line)
+	if err != nil {
+		return fmt.Errorf("parse error: %w", err)
+	}
+
+	for _, hook := range con.App.PreCmdRunLineHooks {
+		args, err = hook(args)
+		if err != nil {
+			return fmt.Errorf("pre-run line error: %w", err)
+		}
+	}
+
+	if len(args) == 0 {
+		return nil
+	}
+
+	menu := con.App.ActiveMenu()
+	if menu.Name() == consts.ImplantMenu {
+		menu.Command = sliverCmds()
+	} else {
+		menu.Command = serverCmds()
+	}
+
+	target, _, _ := menu.Command.Find(args)
+	if err := menu.CheckIsAvailable(target); err != nil {
+		return err
+	}
+
+	for _, hook := range con.App.PreCmdRunHooks {
+		if err := hook(); err != nil {
+			return fmt.Errorf("pre-run error: %w", err)
+		}
+	}
+
+	menu.SetArgs(args)
+	menu.SetContext(context.Background())
+
+	if err := menu.Execute(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (con *SliverClient) startEventLoop() {
 	eventStream, err := con.Rpc.Events(context.Background(), &commonpb.Empty{})
 	if err != nil {
@@ -341,11 +417,12 @@ func (con *SliverClient) triggerReactions(event *clientpb.Event) {
 		con.ActiveTarget.Set(currentActiveSession, currentActiveBeacon)
 	}()
 
-	if event.EventType == consts.SessionOpenedEvent {
+	switch event.EventType {
+	case consts.SessionOpenedEvent:
 		con.ActiveTarget.Set(nil, nil)
 
 		con.ActiveTarget.Set(event.Session, nil)
-	} else if event.EventType == consts.BeaconRegisteredEvent {
+	case consts.BeaconRegisteredEvent:
 		con.ActiveTarget.Set(nil, nil)
 
 		beacon := &clientpb.Beacon{}
@@ -609,6 +686,7 @@ func (c *SliverClient) exitConsole(_ *console.Console) {
 	answer := strings.TrimSpace(text)
 
 	if (answer == "Y") || (answer == "y") {
+		c.FlushOutput()
 		os.Exit(0)
 	}
 }

client/console/log.go

@@ -124,7 +124,14 @@ func (con *SliverClient) setupAsciicastRecord(logFile *os.File, server io.Writer
 	os.Stdout = w
 	os.Stderr = w
 
-	go io.Copy(mw, r)
+	done := make(chan struct{})
+	con.stdoutPipeWriter = w
+	con.stdoutPipeDone = done
+
+	go func() {
+		_, _ = io.Copy(mw, r)
+		close(done)
+	}()
 }
 
 func getConsoleLogFile() *os.File {
@@ -149,6 +156,25 @@ func getConsoleAsciicastFile() *os.File {
 	return logFile
 }
 
+// FlushOutput drains any piped stdout before exiting.
+func (con *SliverClient) FlushOutput() {
+	if con.stdoutPipeWriter == nil {
+		_ = os.Stdout.Sync()
+		return
+	}
+
+	con.stdoutPipeOnce.Do(func() {
+		_ = con.stdoutPipeWriter.Close()
+	})
+
+	if con.stdoutPipeDone != nil {
+		select {
+		case <-con.stdoutPipeDone:
+		case <-time.After(500 * time.Millisecond):
+		}
+	}
+}
+
 //
 // -------------------------- [ Logging ] -----------------------------
 //

client/forms/prompts.go

@@ -5,10 +5,20 @@ import (
 	"strings"
 
 	"github.com/charmbracelet/huh"
+	"golang.org/x/term"
 )
 
 const defaultSelectHeight = 10
 
+func getTerminalWidth() int {
+	// Try to get actual terminal width
+	if width, _, err := term.GetSize(1); err == nil && width > 0 {
+		return width
+	}
+	// Fall back to a reasonable default
+	return 200
+}
+
 // Confirm prompts for a yes/no answer.
 func Confirm(title string, value *bool) error {
 	if value == nil {
@@ -86,7 +96,7 @@ func MultiSelect(title string, options []string, value *[]string) error {
 		Height(listHeight(len(options))).
 		Value(value)
 
-	form := huh.NewForm(huh.NewGroup(field))
+	form := huh.NewForm(huh.NewGroup(field)).WithWidth(getTerminalWidth())
 	return form.Run()
 }
 
@@ -98,6 +108,8 @@ func selectPrompt(title string, options []string, value *string, required bool)
 		return errors.New("select options are required")
 	}
 
+	// Save the original value in case the form is cancelled
+	originalValue := *value
 	ensureSelectedValue(options, value)
 
 	field := huh.NewSelect[string]().
@@ -115,8 +127,16 @@ func selectPrompt(title string, options []string, value *string, required bool)
 		})
 	}
 
-	form := huh.NewForm(huh.NewGroup(field))
-	return form.Run()
+	form := huh.NewForm(huh.NewGroup(field)).WithWidth(getTerminalWidth())
+	err := form.Run()
+
+	// On error restore the originalValue and return err
+	if err != nil {
+		*value = originalValue
+		return err
+	}
+
+	return err
 }
 
 func ensureSelectedValue(options []string, value *string) {

go.mod

@@ -7,7 +7,7 @@ replace github.com/rsteube/carapace v0.36.3 => github.com/reeflective/carapace v
 replace github.com/reeflective/readline => github.com/moloch--/readline v0.0.0-20260104185423-d3ac1d6c561d
 
 require (
-	filippo.io/age v1.2.1
+	filippo.io/age v1.3.1
 	github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb
 	github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a
 	github.com/Binject/go-donut v0.0.0-20220908180326-fcdcc35d591c
@@ -33,26 +33,26 @@ require (
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
 	github.com/mattn/go-sqlite3 v1.14.32
-	github.com/miekg/dns v1.1.68
+	github.com/miekg/dns v1.1.69
 	github.com/moloch--/asciicast v0.1.1
 	github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e
 	github.com/moloch--/sgn v0.0.4
-	github.com/ncruces/go-sqlite3 v0.29.1
+	github.com/ncruces/go-sqlite3 v0.30.4
 	github.com/reeflective/console v0.1.25
 	github.com/reeflective/readline v1.1.3
 	github.com/rsteube/carapace v0.50.2
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.10.1
+	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/tetratelabs/wazero v1.9.0
+	github.com/tetratelabs/wazero v1.11.0
 	github.com/things-go/go-socks5 v0.1.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/xlab/treeprint v1.2.0
 	github.com/yiya1989/sshkrb5 v0.0.1
 	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9
-	golang.org/x/mod v0.30.0
+	golang.org/x/mod v0.31.0
 	golang.org/x/net v0.47.0
 	golang.org/x/sys v0.39.0
 	golang.org/x/term v0.38.0
@@ -71,6 +71,7 @@ require (
 )
 
 require (
+	filippo.io/hpke v0.4.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/invopop/jsonschema v0.13.0 // indirect
@@ -142,7 +143,7 @@ require (
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/mark3labs/mcp-go v0.43.2

go.sum

@@ -1,14 +1,16 @@
 9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f h1:1C7nZuxUMNz7eiQALRfiqNOm04+m3edWlRff/BYHf0Q=
 9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f/go.mod h1:hHyrZRryGqVdqrknjq5OWDLGCTJ2NeEvtrpR96mjraM=
-c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
-c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd h1:ZLsPO6WdZ5zatV4UfVpr7oAwLGRZ+sebTUruuM4Ra3M=
+c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
 cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
-filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
-filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
+filippo.io/age v1.3.1 h1:hbzdQOJkuaMEpRCLSN1/C5DX74RPcNCk6oqhKMXmZi0=
+filippo.io/age v1.3.1/go.mod h1:EZorDTYUxt836i3zdori5IJX/v2Lj6kWFU0cfh6C0D4=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
+filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
 filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
 filippo.io/mkcert v1.4.4/go.mod h1:VyvOchVuAye3BoUsPUOOofKygVwLV2KQMVFJNRq+1dA=
 github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb h1:c1Bb1n1wr2xgTHkNVxkUHBshff33m+IXgY6lE6oYttg=
@@ -338,8 +340,8 @@ github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ
 github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
-github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
-github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
+github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
@@ -362,8 +364,8 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncruces/go-sqlite3 v0.29.1 h1:NIi8AISWBToRHyoz01FXiTNvU147Tqdibgj2tFzJCqM=
-github.com/ncruces/go-sqlite3 v0.29.1/go.mod h1:PpccBNNhvjwUOwDQEn2gXQPFPTWdlromj0+fSkd5KSg=
+github.com/ncruces/go-sqlite3 v0.30.4 h1:j9hEoOL7f9ZoXl8uqXVniaq1VNwlWAXihZbTvhqPPjA=
+github.com/ncruces/go-sqlite3 v0.30.4/go.mod h1:7WR20VSC5IZusKhUdiR9y1NsUqnZgqIYCmKKoMEYg68=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=
@@ -414,8 +416,8 @@ github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -454,8 +456,8 @@ github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e h1:zOGKqN5D5hHhiYUp
 github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e/go.mod h1:orPd6JZXXRyuDusYilywte7k094d7dycXXU5YnWsrwg=
 github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
 github.com/tc-hib/winres v0.2.1/go.mod h1:C/JaNhH3KBvhNKVbvdlDWkbMDO9H4fKKDaN7/07SSuk=
-github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
-github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
+github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
+github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2 h1:CoMVaYyKFsVj6TjU6APqAhAvC07hTI6IQen8PHzHYY0=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2/go.mod h1:bv6Xa7kWy82uT0LnXPE2SzGqTj33TAEeR560MdJkiXs=
 github.com/things-go/go-socks5 v0.1.0 h1:4f5dz0iMQ6cA4wseFmyLmCHmg3SWJTW92ndrKS6oERg=
@@ -498,6 +500,7 @@ go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
@@ -521,8 +524,8 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

implant/sliver/transports/beacon.go

@@ -362,9 +362,6 @@ func dnsBeacon(uri *url.URL) *Beacon {
 			return client.WriteEnvelope(envelope)
 		},
 		Close: func() error {
-			if client != nil {
-				return client.CloseSession()
-			}
 			return nil
 		},
 		Cleanup: func() error {

server/cli/cli.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	clientcli "github.com/bishopfox/sliver/client/cli"
 	"github.com/bishopfox/sliver/server/assets"
 	"github.com/bishopfox/sliver/server/c2"
 	"github.com/bishopfox/sliver/server/certs"
@@ -72,6 +73,8 @@ func initConsoleLogging(appDir string) *os.File {
 }
 
 func init() {
+	rootCmd.Flags().String(clientcli.RCFlagName, "", "path to rc script file")
+
 	// Unpack
 	unpackCmd.Flags().BoolP(forceFlagStr, "f", false, "Force unpack and overwrite")
 	rootCmd.AddCommand(unpackCmd)
@@ -147,8 +150,14 @@ var rootCmd = &cobra.Command{
 		if serverConfig.DaemonMode {
 			daemon.Start(daemon.BlankHost, daemon.BlankPort, serverConfig.DaemonConfig.Tailscale)
 		} else {
+			rcScript, err := clientcli.ReadRCScript(cmd)
+			if err != nil {
+				fmt.Printf("Failed to read rc script: %s\n", err)
+				return
+			}
+
 			os.Args = os.Args[:1] // Hide cli from grumble console
-			console.Start()
+			console.Start(rcScript)
 		}
 	},
 }

server/console/console.go

@@ -38,7 +38,7 @@ import (
 )
 
 // Start - Starts the server console
-func Start() {
+func Start(rcScript string) {
 	_, ln, _ := transport.LocalListener()
 	ctxDialer := grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
 		return ln.Dial()
@@ -57,7 +57,7 @@ func Start() {
 	defer conn.Close()
 	localRPC := rpcpb.NewSliverRPCClient(conn)
 	con := console.NewConsole(false)
-	console.StartClient(con, localRPC, command.ServerCommands(con, serverOnlyCmds), command.SliverCommands(con), true)
+	console.StartClient(con, localRPC, command.ServerCommands(con, serverOnlyCmds), command.SliverCommands(con), true, rcScript)
 
 	con.App.Start()
 }

server/core/rtunnels/rtunnels.go

@@ -6,9 +6,11 @@ import (
 )
 
 var (
-	Rtunnels map[uint64]*RTunnel = make(map[uint64]*RTunnel)
-	mutex    sync.RWMutex
-	pending  sync.Map
+	Rtunnels  map[uint64]*RTunnel = make(map[uint64]*RTunnel)
+	mutex     sync.RWMutex
+	pending   map[string]map[string]int
+	listeners map[string]map[uint32]string
+	pendingMu sync.Mutex
 )
 
 // RTunnel - Duplex byte read/write
@@ -97,20 +99,107 @@ func RemoveRTunnel(ID uint64) {
 }
 
 func AddPending(sessionID string, connStr string) {
-	pending.Store(sessionID, connStr)
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		pending = make(map[string]map[string]int)
+	}
+	addrMap := pending[sessionID]
+	if addrMap == nil {
+		addrMap = make(map[string]int)
+		pending[sessionID] = addrMap
+	}
+	addrMap[connStr]++
 }
 
-func DeletePending(sessionID string) {
-	pending.Delete(sessionID)
+func DeletePending(sessionID string, connStr string) {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		return
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		if count, ok := addrMap[connStr]; ok {
+			if count <= 1 {
+				delete(addrMap, connStr)
+			} else {
+				addrMap[connStr] = count - 1
+			}
+		}
+		if len(addrMap) == 0 {
+			delete(pending, sessionID)
+		}
+	}
 }
 
 func Check(sessionID string, connStr string) bool {
-	if val, ok := pending.Load(sessionID); ok {
-		return val == connStr
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		return false
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		return addrMap[connStr] > 0
 	}
 	return false
 }
 
+func TrackListener(sessionID string, listenerID uint32, connStr string) {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if listeners == nil {
+		listeners = make(map[string]map[uint32]string)
+	}
+	if pending == nil {
+		pending = make(map[string]map[string]int)
+	}
+	lm := listeners[sessionID]
+	if lm == nil {
+		lm = make(map[uint32]string)
+		listeners[sessionID] = lm
+	}
+	lm[listenerID] = connStr
+	addrMap := pending[sessionID]
+	if addrMap == nil {
+		addrMap = make(map[string]int)
+		pending[sessionID] = addrMap
+	}
+	addrMap[connStr]++
+}
+
+func UntrackListener(sessionID string, listenerID uint32) bool {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if listeners == nil || pending == nil {
+		return false
+	}
+	lm, ok := listeners[sessionID]
+	if !ok {
+		return false
+	}
+	connStr, ok := lm[listenerID]
+	if !ok {
+		return false
+	}
+	delete(lm, listenerID)
+	if len(lm) == 0 {
+		delete(listeners, sessionID)
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		if count, ok := addrMap[connStr]; ok {
+			if count <= 1 {
+				delete(addrMap, connStr)
+			} else {
+				addrMap[connStr] = count - 1
+			}
+		}
+		if len(addrMap) == 0 {
+			delete(pending, sessionID)
+		}
+	}
+	return true
+}
+
 // func removeAndCloseAllRTunnels() {
 // 	mutex.Lock()
 // 	defer mutex.Unlock()

server/generate/binaries.go

@@ -533,12 +533,23 @@ func renderSliverGoCode(name string, build *clientpb.ImplantBuild, config *clien
 				goPackage = config.GoPackage
 			}
 		}
-		result, err := goname.RenameModule(sliverPkgDir, goPackage)
+		modResult, err := goname.RenameModule(sliverPkgDir, goPackage)
 		if err != nil {
 			buildLog.Errorf("Failed to rename module: %s", err)
 			return "", err
 		}
-		buildLog.Infof("Renamed module: %s -> %s (go.mod updated: %v)", result.OldModule, result.NewModule, result.GoModUpdated)
+		buildLog.Infof("Renamed module: %s -> %s (go.mod updated: %v)", modResult.OldModule, modResult.NewModule, modResult.GoModUpdated)
+
+		// Rename Import Paths
+		buildLog.Infof("Renaming import paths ...")
+		oldImportPrefix := path.Join(modResult.NewModule, "implant", "sliver")
+		newImportPrefix := path.Join(modResult.NewModule, "runc", "cgroup")
+		importResult, err := goname.RenameImport(sliverPkgDir, oldImportPrefix, newImportPrefix)
+		if err != nil {
+			buildLog.Errorf("Failed to rename imports: %s", err)
+			return "", err
+		}
+		buildLog.Infof("Renamed imports (%d files updated)", importResult.FilesUpdated)
 	}
 
 	return sliverPkgDir, nil

server/gogo/goname/rename_import.go

@@ -2,7 +2,10 @@ package goname
 
 import (
 	"errors"
+	"fmt"
 	"io/fs"
+	"os"
+	"path"
 	"path/filepath"
 	"strings"
 )
@@ -37,6 +40,9 @@ func RenameImport(dir, oldImportPrefix, newImportPrefix string) (*ImportResult,
 	if result.ImportsUpdated == 0 {
 		return result, errors.New("no imports updated (check old/new import prefixes)")
 	}
+	if err := renameImportDir(dir, oldImportPrefix, newImportPrefix); err != nil {
+		return result, err
+	}
 
 	return result, nil
 }
@@ -68,3 +74,61 @@ func rewriteImportPrefixes(dir, oldImportPrefix, newImportPrefix string, result
 		return nil
 	})
 }
+
+func renameImportDir(dir, oldImportPrefix, newImportPrefix string) error {
+	oldParts := splitImportPrefix(oldImportPrefix)
+	newParts := splitImportPrefix(newImportPrefix)
+	if len(oldParts) == 0 || len(newParts) == 0 {
+		return nil
+	}
+
+	for i := 0; i < len(oldParts); i++ {
+		suffixParts := oldParts[i:]
+		oldDir := filepath.Join(append([]string{dir}, suffixParts...)...)
+		info, err := os.Stat(oldDir)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return err
+		}
+		if !info.IsDir() {
+			continue
+		}
+
+		if len(newParts) < len(suffixParts) {
+			return fmt.Errorf("new import prefix has fewer path segments than old import prefix")
+		}
+		newSuffixParts := newParts[len(newParts)-len(suffixParts):]
+		newDir := filepath.Join(append([]string{dir}, newSuffixParts...)...)
+
+		if oldDir == newDir {
+			return nil
+		}
+
+		if _, err := os.Stat(newDir); err == nil {
+			return fmt.Errorf("rename import dir: target exists: %s", newDir)
+		} else if !os.IsNotExist(err) {
+			return err
+		}
+
+		if err := os.MkdirAll(filepath.Dir(newDir), 0700); err != nil {
+			return err
+		}
+		return os.Rename(oldDir, newDir)
+	}
+
+	return nil
+}
+
+func splitImportPrefix(prefix string) []string {
+	cleaned := path.Clean(strings.TrimSpace(prefix))
+	if cleaned == "." || cleaned == "/" {
+		return nil
+	}
+	cleaned = strings.TrimPrefix(cleaned, "/")
+	if cleaned == "" {
+		return nil
+	}
+	return strings.Split(cleaned, "/")
+}

server/gogo/goname/rename_import_test.go

@@ -42,11 +42,15 @@ func TestRenameImportBasic(t *testing.T) {
 		t.Fatalf("main.go still references old prefix")
 	}
 
-	barImports := importPaths(t, filepath.Join(tmp, "foo", "bar", "bar.go"))
+	barImports := importPaths(t, filepath.Join(tmp, "acme", "corp", "bar.go"))
 	if !barImports["acme/corp/baz"] {
 		t.Fatalf("bar.go import not updated")
 	}
 
+	if _, err := os.Stat(filepath.Join(tmp, "foo", "bar")); !os.IsNotExist(err) {
+		t.Fatalf("expected foo/bar to be renamed")
+	}
+
 	vendorImports := importPaths(t, filepath.Join(tmp, "vendor", "foo", "bar", "vendor.go"))
 	if !vendorImports["foo/bar/baz"] {
 		t.Fatalf("vendor import should remain unchanged")

server/handlers/sessions.go

@@ -231,7 +231,6 @@ func createReverseTunnelHandler(implantConn *core.ImplantConnection, data []byte
 		sessionHandlerLog.Errorf("Session %s attempted to create reverse tunnel to %s without being initiated by a client", session.ID, remoteAddress)
 		return nil
 	}
-	defer rtunnels.DeletePending(session.ID)
 
 	var defaultDialer = new(net.Dialer)
 

server/rpc/rpc-rportfwd.go

@@ -39,11 +39,17 @@ func (rpc *Server) GetRportFwdListeners(ctx context.Context, req *sliverpb.Rport
 // StartRportfwdListener - Instruct the implant to start a reverse port forward
 func (rpc *Server) StartRportFwdListener(ctx context.Context, req *sliverpb.RportFwdStartListenerReq) (*sliverpb.RportFwdListener, error) {
 	resp := &sliverpb.RportFwdListener{Response: &commonpb.Response{}}
-	rtunnels.AddPending(req.Request.SessionID, req.ForwardAddress)
 	err := rpc.GenericHandler(req, resp)
 	if err != nil {
 		return nil, err
 	}
+	if resp.Response.GetErr() == "" {
+		addr := req.ForwardAddress
+		if resp.ForwardAddress != "" {
+			addr = resp.ForwardAddress
+		}
+		rtunnels.TrackListener(req.Request.SessionID, resp.ID, addr)
+	}
 	return resp, nil
 }
 
@@ -54,5 +60,8 @@ func (rpc *Server) StopRportFwdListener(ctx context.Context, req *sliverpb.Rport
 	if err != nil {
 		return nil, err
 	}
+	if resp.Response.GetErr() == "" {
+		rtunnels.UntrackListener(req.Request.SessionID, req.ID)
+	}
 	return resp, nil
 }

vendor/filippo.io/age/AUTHORS

@@ -1,6 +0,0 @@
-# This is the official list of age authors for copyright purposes.
-# To be included, send a change adding the individual or company
-# who owns a contribution's copyright.
-
-Google LLC
-Filippo Valsorda

vendor/filippo.io/age/LICENSE

@@ -1,4 +1,6 @@
 Copyright 2019 The age Authors
+Copyright 2019 Google LLC
+Copyright 2022 Filippo Valsorda
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are

vendor/filippo.io/age/README.md

@@ -12,7 +12,7 @@
 
 age is a simple, modern and secure file encryption tool, format, and Go library.
 
-It features small explicit keys, no config options, and UNIX-style composability.
+It features small explicit keys, post-quantum support, no config options, and UNIX-style composability.
 
 ```
 $ age-keygen -o key.txt
@@ -21,17 +21,17 @@ $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9
 $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
 ```
 
-📜 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). age was designed by [@Benjojo12](https://twitter.com/Benjojo12) and [@FiloSottile](https://twitter.com/FiloSottile).
-
-📬 Follow the maintenance of this project by subscribing to [Maintainer Dispatches](https://filippo.io/newsletter)!
+📜 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). age was designed by [@benjojo](https://github.com/benjojo) and [@FiloSottile](https://github.com/FiloSottile).
 
 🦀 An alternative interoperable Rust implementation is available at [github.com/str4d/rage](https://github.com/str4d/rage).
 
+🌍 [Typage](https://github.com/FiloSottile/typage) is a TypeScript implementation. It works in the browser, Node.js, Deno, and Bun.
+
 🔑 Hardware PIV tokens such as YubiKeys are supported through the [age-plugin-yubikey](https://github.com/str4d/age-plugin-yubikey) plugin.
 
 ✨ For more plugins, implementations, tools, and integrations, check out the [awesome age](https://github.com/FiloSottile/awesome-age) list.
 
-💬 The author pronounces it `[aɡe̞]` [with a hard *g*](https://translate.google.com/?sl=it&text=aghe), like GIF, and is always spelled lowercase.
+💬 The author pronounces it `[aɡe̞]` [with a hard *g*](https://translate.google.com/?sl=it&text=aghe), like GIF, and it's always spelled lowercase.
 
 ## Installation
 
@@ -48,6 +48,12 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>port install age</code>
         </td>
     </tr>
+    <tr>
+        <td>Windows</td>
+        <td>
+            <code>winget install --id FiloSottile.age</code>
+        </td>
+    </tr>
     <tr>
         <td>Alpine Linux v3.15+</td>
         <td>
@@ -85,6 +91,12 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>emerge app-crypt/age</code>
         </td>
     </tr>
+    <tr>
+        <td>Guix System</td>
+        <td>
+            <code>guix package -i age</code>
+        </td>
+    </tr>
     <tr>
         <td>NixOS / Nix</td>
         <td>
@@ -133,22 +145,18 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>scoop bucket add extras && scoop install age</code>
         </td>
     </tr>
-    <tr>
-        <td>pkgx</td>
-        <td>
-            <code>pkgx install age</code>
-        </td>
-    </tr>
 </table>
 
 On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.
 
 ```
 https://dl.filippo.io/age/latest?for=linux/amd64
-https://dl.filippo.io/age/v1.1.1?for=darwin/arm64
+https://dl.filippo.io/age/v1.3.0?for=darwin/arm64
 ...
 ```
 
+If you download the pre-built binaries, you can check their [Sigsum proofs](./SIGSUM.md).
+
 If your system has [a supported version of Go](https://go.dev/dl/), you can build from source.
 
 ```
@@ -157,39 +165,6 @@ go install filippo.io/age/cmd/...@latest
 
 Help from new packagers is very welcome.
 
-### Verifying the release signatures
-
-If you download the pre-built binaries, you can check their
-[Sigsum](https://www.sigsum.org) proofs, which are like signatures with extra
-transparency: you can cryptographically verify that every proof is logged in a
-public append-only log, so you can hold the age project accountable for every
-binary release we ever produced. This is similar to what the [Go Checksum
-Database](https://go.dev/blog/module-mirror-launch) provides.
-
-```
-cat << EOF > age-sigsum-key.pub
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
-EOF
-cat << EOF > sigsum-trust-policy.txt
-log 154f49976b59ff09a123675f58cb3e346e0455753c3c3b15d465dcb4f6512b0b https://poc.sigsum.org/jellyfish
-witness poc.sigsum.org/nisse 1c25f8a44c635457e2e391d1efbca7d4c2951a0aef06225a881e46b98962ac6c
-witness rgdd.se/poc-witness  28c92a5a3a054d317c86fc2eeb6a7ab2054d6217100d0be67ded5b74323c5806
-group  demo-quorum-rule all poc.sigsum.org/nisse rgdd.se/poc-witness
-quorum demo-quorum-rule
-EOF
-
-curl -JLO "https://dl.filippo.io/age/v1.2.0?for=darwin/arm64"
-curl -JLO "https://dl.filippo.io/age/v1.2.0?for=darwin/arm64&proof"
-
-go install sigsum.org/sigsum-go/cmd/[email protected]
-sigsum-verify -k age-sigsum-key.pub -p sigsum-trust-policy.txt \
-    age-v1.2.0-darwin-arm64.tar.gz.proof < age-v1.2.0-darwin-arm64.tar.gz
-```
-
-You can learn more about what's happening above in the [Sigsum
-docs](https://www.sigsum.org/getting-started/).
-
 ## Usage
 
 For the full documentation, read [the age(1) man page](https://filippo.io/age/age.1).
@@ -254,6 +229,28 @@ $ age -R recipients.txt example.jpg > example.jpg.age
 
 If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
 
+### Post-quantum keys
+
+To generate hybrid post-quantum keys, which are secure against future quantum
+computer attacks, use the `-pq` flag with `age-keygen`. This may become the
+default in the future.
+
+Post-quantum identities start with `AGE-SECRET-KEY-PQ-1...` and recipients with
+`age1pq1...`. The recipients are unfortunately ~2000 characters long.
+
+```
+$ age-keygen -pq -o key.txt
+$ age-keygen -y key.txt > recipient.txt
+$ age -R recipient.txt example.jpg > example.jpg.age
+$ age -d -i key.txt example.jpg.age > example.jpg
+```
+
+Support for post-quantum keys is built into age v1.3.0 and later. Alternatively,
+the `age-plugin-pq` binary can be installed and placed in `$PATH` to add support
+to any version and implementation of age that supports plugins. Recipients will
+work out of the box, while identities will have to be converted to plugin
+identities with `age-plugin-pq -identity`.
+
 ### Passphrases
 
 Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
@@ -302,3 +299,28 @@ $ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
 ```
 
 Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can't be used to decrypt files.
+
+### Inspecting encrypted files
+
+The `age-inspect` command can display metadata about an encrypted file without decrypting it, including the recipient types, whether it uses post-quantum encryption, and the payload size.
+
+```
+$ age-inspect secrets.age
+secrets.age is an age file, version "age-encryption.org/v1".
+
+This file is encrypted to the following recipient types:
+  - "mlkem768x25519"
+
+This file uses post-quantum encryption.
+
+Size breakdown (assuming it decrypts successfully):
+
+    Header                      1627 bytes
+    Encryption overhead           32 bytes
+    Payload                       42 bytes
+                        -------------------
+    Total                       1701 bytes
+
+```
+
+For scripting, use `--json` to get machine-readable output.

vendor/filippo.io/age/SIGSUM.md

@@ -0,0 +1,23 @@
+If you download the pre-built binaries of version v1.2.0+, you can check their
+[Sigsum](https://www.sigsum.org) proofs, which are like signatures with extra
+transparency: you can cryptographically verify that every proof is logged in a
+public append-only log, so the age project can be held accountable for every
+binary release we ever produced. This is similar to what the [Go Checksum
+Database](https://go.dev/blog/module-mirror-launch) provides.
+
+```
+cat << EOF > age-sigsum-key.pub
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
+EOF
+
+curl -JLO "https://dl.filippo.io/age/v1.3.0?for=darwin/arm64"
+curl -JLO "https://dl.filippo.io/age/v1.3.0?for=darwin/arm64&proof"
+
+go install sigsum.org/sigsum-go/cmd/[email protected]
+sigsum-verify -k age-sigsum-key.pub -P sigsum-generic-2025-1 \
+    age-v1.3.0-darwin-arm64.tar.gz.proof < age-v1.3.0-darwin-arm64.tar.gz
+```
+
+You can learn more about what's happening above in the [Sigsum
+docs](https://www.sigsum.org/getting-started/).

vendor/filippo.io/age/age.go

@@ -5,10 +5,10 @@
 // Package age implements file encryption according to the age-encryption.org/v1
 // specification.
 //
-// For most use cases, use the Encrypt and Decrypt functions with
-// X25519Recipient and X25519Identity. If passphrase encryption is required, use
-// ScryptRecipient and ScryptIdentity. For compatibility with existing SSH keys
-// use the filippo.io/age/agessh package.
+// For most use cases, use the [Encrypt] and [Decrypt] functions with
+// [HybridRecipient] and [HybridIdentity]. If passphrase encryption is
+// required, use [ScryptRecipient] and [ScryptIdentity]. For compatibility with
+// existing SSH keys use the filippo.io/age/agessh package.
 //
 // age encrypted files are binary and not malleable. For encoding them as text,
 // use the filippo.io/age/armor package.
@@ -26,13 +26,13 @@
 // There is no default path for age keys. Instead, they should be stored at
 // application-specific paths. The CLI supports files where private keys are
 // listed one per line, ignoring empty lines and lines starting with "#". These
-// files can be parsed with ParseIdentities.
+// files can be parsed with [ParseIdentities].
 //
 // When integrating age into a new system, it's recommended that you only
-// support X25519 keys, and not SSH keys. The latter are supported for manual
-// encryption operations. If you need to tie into existing key management
-// infrastructure, you might want to consider implementing your own Recipient
-// and Identity.
+// support native (X25519 and hybrid) keys, and not SSH keys. The latter are
+// supported for manual encryption operations. If you need to tie into existing
+// key management infrastructure, you might want to consider implementing your
+// own [Recipient] and [Identity].
 //
 // # Backwards compatibility
 //
@@ -46,47 +46,47 @@
 package age
 
 import (
+	"bytes"
 	"crypto/hmac"
 	"crypto/rand"
 	"errors"
 	"fmt"
 	"io"
+	"slices"
 	"sort"
 
 	"filippo.io/age/internal/format"
 	"filippo.io/age/internal/stream"
 )
 
-// An Identity is passed to Decrypt to unwrap an opaque file key from a
-// recipient stanza. It can be for example a secret key like X25519Identity, a
+// An Identity is passed to [Decrypt] to unwrap an opaque file key from a
+// recipient stanza. It can be for example a secret key like [HybridIdentity], a
 // plugin, or a custom implementation.
-//
-// Unwrap must return an error wrapping ErrIncorrectIdentity if none of the
-// recipient stanzas match the identity, any other error will be considered
-// fatal.
-//
-// Most age API users won't need to interact with this directly, and should
-// instead pass Recipient implementations to Encrypt and Identity
-// implementations to Decrypt.
 type Identity interface {
+	// Unwrap must return an error wrapping [ErrIncorrectIdentity] if none of
+	// the recipient stanzas match the identity, any other error will be
+	// considered fatal.
+	//
+	// Most age API users won't need to interact with this method directly, and
+	// should instead pass [Identity] implementations to [Decrypt].
 	Unwrap(stanzas []*Stanza) (fileKey []byte, err error)
 }
 
+// ErrIncorrectIdentity is returned by [Identity.Unwrap] if none of the
+// recipient stanzas match the identity.
 var ErrIncorrectIdentity = errors.New("incorrect identity for recipient block")
 
-// A Recipient is passed to Encrypt to wrap an opaque file key to one or more
-// recipient stanza(s). It can be for example a public key like X25519Recipient,
+// A Recipient is passed to [Encrypt] to wrap an opaque file key to one or more
+// recipient stanza(s). It can be for example a public key like [HybridRecipient],
 // a plugin, or a custom implementation.
-//
-// Most age API users won't need to interact with this directly, and should
-// instead pass Recipient implementations to Encrypt and Identity
-// implementations to Decrypt.
 type Recipient interface {
+	// Most age API users won't need to interact with this method directly, and
+	// should instead pass [Recipient] implementations to [Encrypt].
 	Wrap(fileKey []byte) ([]*Stanza, error)
 }
 
-// RecipientWithLabels can be optionally implemented by a Recipient, in which
-// case Encrypt will use WrapWithLabels instead of Wrap.
+// RecipientWithLabels can be optionally implemented by a [Recipient], in which
+// case [Encrypt] will use WrapWithLabels instead of [Recipient.Wrap].
 //
 // Encrypt will succeed only if the labels returned by all the recipients
 // (assuming the empty set for those that don't implement RecipientWithLabels)
@@ -103,9 +103,9 @@ type RecipientWithLabels interface {
 // A Stanza is a section of the age header that encapsulates the file key as
 // encrypted to a specific recipient.
 //
-// Most age API users won't need to interact with this directly, and should
-// instead pass Recipient implementations to Encrypt and Identity
-// implementations to Decrypt.
+// Most age API users won't need to interact with this type directly, and should
+// instead pass [Recipient] implementations to [Encrypt] and [Identity]
+// implementations to [Decrypt].
 type Stanza struct {
 	Type string
 	Args []string
@@ -115,35 +115,23 @@ type Stanza struct {
 const fileKeySize = 16
 const streamNonceSize = 16
 
-// Encrypt encrypts a file to one or more recipients.
-//
-// Writes to the returned WriteCloser are encrypted and written to dst as an age
-// file. Every recipient will be able to decrypt the file.
-//
-// The caller must call Close on the WriteCloser when done for the last chunk to
-// be encrypted and flushed to dst.
-func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
+func encryptHdr(fileKey []byte, recipients ...Recipient) (*format.Header, error) {
 	if len(recipients) == 0 {
 		return nil, errors.New("no recipients specified")
 	}
 
-	fileKey := make([]byte, fileKeySize)
-	if _, err := rand.Read(fileKey); err != nil {
-		return nil, err
-	}
-
 	hdr := &format.Header{}
 	var labels []string
 	for i, r := range recipients {
 		stanzas, l, err := wrapWithLabels(r, fileKey)
 		if err != nil {
-			return nil, fmt.Errorf("failed to wrap key for recipient #%d: %v", i, err)
+			return nil, fmt.Errorf("failed to wrap key for recipient #%d: %w", i, err)
 		}
 		sort.Strings(l)
 		if i == 0 {
 			labels = l
 		} else if !slicesEqual(labels, l) {
-			return nil, fmt.Errorf("incompatible recipients")
+			return nil, incompatibleLabelsError(labels, l)
 		}
 		for _, s := range stanzas {
 			hdr.Recipients = append(hdr.Recipients, (*format.Stanza)(s))
@@ -154,19 +142,62 @@ func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
 	} else {
 		hdr.MAC = mac
 	}
+	return hdr, nil
+}
+
+// Encrypt encrypts a file to one or more recipients. Every recipient will be
+// able to decrypt the file.
+//
+// Writes to the returned WriteCloser are encrypted and written to dst as an age
+// file. The caller must call Close on the WriteCloser when done for the last
+// chunk to be encrypted and flushed to dst.
+func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
+	fileKey := make([]byte, fileKeySize)
+	rand.Read(fileKey)
+
+	hdr, err := encryptHdr(fileKey, recipients...)
+	if err != nil {
+		return nil, err
+	}
 	if err := hdr.Marshal(dst); err != nil {
-		return nil, fmt.Errorf("failed to write header: %v", err)
+		return nil, fmt.Errorf("failed to write header: %w", err)
 	}
 
 	nonce := make([]byte, streamNonceSize)
-	if _, err := rand.Read(nonce); err != nil {
-		return nil, err
-	}
+	rand.Read(nonce)
 	if _, err := dst.Write(nonce); err != nil {
-		return nil, fmt.Errorf("failed to write nonce: %v", err)
+		return nil, fmt.Errorf("failed to write nonce: %w", err)
 	}
 
-	return stream.NewWriter(streamKey(fileKey, nonce), dst)
+	return stream.NewEncryptWriter(streamKey(fileKey, nonce), dst)
+}
+
+// EncryptReader encrypts a file to one or more recipients. Every recipient will be
+// able to decrypt the file.
+//
+// Reads from the returned Reader produce the encrypted file, where the plaintext
+// is read from src.
+func EncryptReader(src io.Reader, recipients ...Recipient) (io.Reader, error) {
+	fileKey := make([]byte, fileKeySize)
+	rand.Read(fileKey)
+
+	hdr, err := encryptHdr(fileKey, recipients...)
+	if err != nil {
+		return nil, err
+	}
+	buf := &bytes.Buffer{}
+	if err := hdr.Marshal(buf); err != nil {
+		return nil, fmt.Errorf("failed to prepare header: %w", err)
+	}
+
+	nonce := make([]byte, streamNonceSize)
+	rand.Read(nonce)
+
+	r, err := stream.NewEncryptReader(streamKey(fileKey, nonce), src)
+	if err != nil {
+		return nil, err
+	}
+	return io.MultiReader(buf, bytes.NewReader(nonce), r), nil
 }
 
 func wrapWithLabels(r Recipient, fileKey []byte) (s []*Stanza, labels []string, err error) {
@@ -189,39 +220,147 @@ func slicesEqual(s1, s2 []string) bool {
 	return true
 }
 
-// NoIdentityMatchError is returned by Decrypt when none of the supplied
+func incompatibleLabelsError(l1, l2 []string) error {
+	hasPQ1 := slices.Contains(l1, "postquantum")
+	hasPQ2 := slices.Contains(l2, "postquantum")
+	if hasPQ1 != hasPQ2 {
+		return fmt.Errorf("incompatible recipients: can't mix post-quantum and classic recipients, or the file would be vulnerable to quantum computers")
+	}
+	return fmt.Errorf("incompatible recipients: %q and %q can't be mixed", l1, l2)
+}
+
+// NoIdentityMatchError is returned by [Decrypt] when none of the supplied
 // identities match the encrypted file.
 type NoIdentityMatchError struct {
 	// Errors is a slice of all the errors returned to Decrypt by the Unwrap
-	// calls it made. They all wrap ErrIncorrectIdentity.
+	// calls it made. They all wrap [ErrIncorrectIdentity].
 	Errors []error
+	// StanzaTypes are the first argument of each recipient stanza in the
+	// encrypted file's header.
+	StanzaTypes []string
 }
 
-func (*NoIdentityMatchError) Error() string {
+func (e *NoIdentityMatchError) Error() string {
+	if len(e.Errors) == 1 {
+		return "identity did not match any of the recipients: " + e.Errors[0].Error()
+	}
 	return "no identity matched any of the recipients"
 }
 
-// Decrypt decrypts a file encrypted to one or more identities.
-//
-// It returns a Reader reading the decrypted plaintext of the age file read
-// from src. All identities will be tried until one successfully decrypts the file.
-func Decrypt(src io.Reader, identities ...Identity) (io.Reader, error) {
-	if len(identities) == 0 {
-		return nil, errors.New("no identities specified")
-	}
+func (e *NoIdentityMatchError) Unwrap() []error {
+	return e.Errors
+}
 
+// Decrypt decrypts a file encrypted to one or more identities.
+// All identities will be tried until one successfully decrypts the file.
+// Native, non-interactive identities are tried before any other identities.
+//
+// Decrypt returns a Reader reading the decrypted plaintext of the age file read
+// from src. If no identity matches the encrypted file, the returned error will
+// be of type [NoIdentityMatchError].
+func Decrypt(src io.Reader, identities ...Identity) (io.Reader, error) {
 	hdr, payload, err := format.Parse(src)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read header: %w", err)
 	}
 
+	fileKey, err := decryptHdr(hdr, identities...)
+	if err != nil {
+		return nil, err
+	}
+
+	nonce := make([]byte, streamNonceSize)
+	if _, err := io.ReadFull(payload, nonce); err != nil {
+		return nil, fmt.Errorf("failed to read nonce: %w", err)
+	}
+
+	return stream.NewDecryptReader(streamKey(fileKey, nonce), payload)
+}
+
+// DecryptReaderAt decrypts a file encrypted to one or more identities.
+// All identities will be tried until one successfully decrypts the file.
+// Native, non-interactive identities are tried before any other identities.
+//
+// DecryptReaderAt takes an underlying [io.ReaderAt] and its total encrypted
+// size, and returns a ReaderAt of the decrypted plaintext and the plaintext
+// size. These can be used for example to instantiate an [io.SectionReader],
+// which implements [io.Reader] and [io.Seeker], or for [zip.NewReader].
+// Note that ReaderAt by definition disregards the seek position of src.
+//
+// The ReadAt method of the returned ReaderAt can be called concurrently.
+// The ReaderAt will internally cache the most recently decrypted chunk.
+// DecryptReaderAt reads and decrypts the final chunk before returning,
+// to authenticate the plaintext size.
+//
+// If no identity matches the encrypted file, the returned error will be of
+// type [NoIdentityMatchError].
+func DecryptReaderAt(src io.ReaderAt, encryptedSize int64, identities ...Identity) (io.ReaderAt, int64, error) {
+	srcReader := io.NewSectionReader(src, 0, encryptedSize)
+	hdr, payload, err := format.Parse(srcReader)
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to read header: %w", err)
+	}
+	buf := &bytes.Buffer{}
+	if err := hdr.Marshal(buf); err != nil {
+		return nil, 0, fmt.Errorf("failed to serialize header: %w", err)
+	}
+
+	fileKey, err := decryptHdr(hdr, identities...)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	nonce := make([]byte, streamNonceSize)
+	if _, err := io.ReadFull(payload, nonce); err != nil {
+		return nil, 0, fmt.Errorf("failed to read nonce: %w", err)
+	}
+
+	payloadOffset := int64(buf.Len()) + int64(len(nonce))
+	payloadSize := encryptedSize - payloadOffset
+	plaintextSize, err := stream.PlaintextSize(payloadSize)
+	if err != nil {
+		return nil, 0, err
+	}
+	payloadReaderAt := io.NewSectionReader(src, payloadOffset, payloadSize)
+	r, err := stream.NewDecryptReaderAt(streamKey(fileKey, nonce), payloadReaderAt, payloadSize)
+	if err != nil {
+		return nil, 0, err
+	}
+	return r, plaintextSize, nil
+}
+
+func decryptHdr(hdr *format.Header, identities ...Identity) ([]byte, error) {
+	if len(identities) == 0 {
+		return nil, errors.New("no identities specified")
+	}
+	slices.SortStableFunc(identities, func(a, b Identity) int {
+		var aIsNative, bIsNative bool
+		switch a.(type) {
+		case *X25519Identity, *HybridIdentity, *ScryptIdentity:
+			aIsNative = true
+		}
+		switch b.(type) {
+		case *X25519Identity, *HybridIdentity, *ScryptIdentity:
+			bIsNative = true
+		}
+		if aIsNative && !bIsNative {
+			return -1
+		}
+		if !aIsNative && bIsNative {
+			return 1
+		}
+		return 0
+	})
+
 	stanzas := make([]*Stanza, 0, len(hdr.Recipients))
+	errNoMatch := &NoIdentityMatchError{}
 	for _, s := range hdr.Recipients {
+		errNoMatch.StanzaTypes = append(errNoMatch.StanzaTypes, s.Type)
 		stanzas = append(stanzas, (*Stanza)(s))
 	}
-	errNoMatch := &NoIdentityMatchError{}
 	var fileKey []byte
 	for _, id := range identities {
+		var err error
 		fileKey, err = id.Unwrap(stanzas)
 		if errors.Is(err, ErrIncorrectIdentity) {
 			errNoMatch.Errors = append(errNoMatch.Errors, err)
@@ -243,12 +382,7 @@ func Decrypt(src io.Reader, identities ...Identity) (io.Reader, error) {
 		return nil, errors.New("bad header MAC")
 	}
 
-	nonce := make([]byte, streamNonceSize)
-	if _, err := io.ReadFull(payload, nonce); err != nil {
-		return nil, fmt.Errorf("failed to read nonce: %w", err)
-	}
-
-	return stream.NewReader(streamKey(fileKey, nonce), payload)
+	return fileKey, nil
 }
 
 // multiUnwrap is a helper that implements Identity.Unwrap in terms of a
@@ -269,3 +403,56 @@ func multiUnwrap(unwrap func(*Stanza) ([]byte, error), stanzas []*Stanza) ([]byt
 	}
 	return nil, ErrIncorrectIdentity
 }
+
+// ExtractHeader returns a detached header from the src file.
+//
+// The detached header can be decrypted with [DecryptHeader] (for example on a
+// different system, without sharing the ciphertext) and then the file key can
+// be used with [NewInjectedFileKeyIdentity].
+//
+// This is a low-level function that most users won't need.
+func ExtractHeader(src io.Reader) ([]byte, error) {
+	hdr, _, err := format.Parse(src)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read header: %w", err)
+	}
+	buf := &bytes.Buffer{}
+	if err := hdr.Marshal(buf); err != nil {
+		return nil, fmt.Errorf("failed to serialize header: %w", err)
+	}
+	return buf.Bytes(), nil
+}
+
+// DecryptHeader decrypts a detached header and returns a file key.
+//
+// The detached header can be produced by [ExtractHeader], and the
+// returned file key can be used with [NewInjectedFileKeyIdentity].
+//
+// This is a low-level function that most users won't need.
+// It is the caller's responsibility to keep track of what file the
+// returned file key decrypts, and to ensure the file key is not used
+// for any other purpose.
+func DecryptHeader(header []byte, identities ...Identity) ([]byte, error) {
+	hdr, _, err := format.Parse(bytes.NewReader(header))
+	if err != nil {
+		return nil, fmt.Errorf("failed to read header: %w", err)
+	}
+	return decryptHdr(hdr, identities...)
+}
+
+type injectedFileKeyIdentity struct {
+	fileKey []byte
+}
+
+// NewInjectedFileKeyIdentity returns an [Identity] that always produces
+// a fixed file key, allowing the use of a file key obtained out-of-band,
+// for example via [DecryptHeader].
+//
+// This is a low-level function that most users won't need.
+func NewInjectedFileKeyIdentity(fileKey []byte) Identity {
+	return injectedFileKeyIdentity{fileKey}
+}
+
+func (i injectedFileKeyIdentity) Unwrap(stanzas []*Stanza) (fileKey []byte, err error) {
+	return i.fileKey, nil
+}

vendor/filippo.io/age/internal/bech32/bech32.go

@@ -37,7 +37,7 @@ func polymod(values []byte) uint32 {
 		top := chk >> 25
 		chk = (chk & 0x1ffffff) << 5
 		chk = chk ^ uint32(v)
-		for i := 0; i < 5; i++ {
+		for i := range 5 {
 			bit := top >> i & 1
 			if bit == 1 {
 				chk ^= generator[i]

vendor/filippo.io/age/internal/format/format.go

@@ -77,10 +77,7 @@ func (w *WrappedBase64Encoder) writeWrapped(p []byte) (int, error) {
 		panic("age: internal error: non-empty WrappedBase64Encoder.buf")
 	}
 	for len(p) > 0 {
-		toWrite := ColumnsPerLine - (w.written % ColumnsPerLine)
-		if toWrite > len(p) {
-			toWrite = len(p)
-		}
+		toWrite := min(ColumnsPerLine-(w.written%ColumnsPerLine), len(p))
 		n, _ := w.buf.Write(p[:toWrite])
 		w.written += n
 		p = p[n:]
@@ -228,7 +225,7 @@ func (e *ParseError) Unwrap() error {
 	return e.err
 }
 
-func errorf(format string, a ...interface{}) error {
+func errorf(format string, a ...any) error {
 	return &ParseError{fmt.Errorf(format, a...)}
 }
 
@@ -239,7 +236,9 @@ func Parse(input io.Reader) (*Header, io.Reader, error) {
 	rr := bufio.NewReader(input)
 
 	line, err := rr.ReadString('\n')
-	if err != nil {
+	if err == io.EOF {
+		return nil, nil, errorf("file is empty")
+	} else if err != nil {
 		return nil, nil, errorf("failed to read intro: %w", err)
 	}
 	if line != intro {

vendor/filippo.io/age/internal/stream/stream.go

@@ -6,17 +6,45 @@
 package stream
 
 import (
+	"bytes"
 	"crypto/cipher"
+	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
+	"sync/atomic"
 
 	"golang.org/x/crypto/chacha20poly1305"
 )
 
 const ChunkSize = 64 * 1024
 
-type Reader struct {
+func EncryptedChunkCount(encryptedSize int64) (int64, error) {
+	chunks := (encryptedSize + encChunkSize - 1) / encChunkSize
+
+	plaintextSize := encryptedSize - chunks*chacha20poly1305.Overhead
+	expChunks := (plaintextSize + ChunkSize - 1) / ChunkSize
+	// Empty plaintext, the only case that allows (and requires) an empty chunk.
+	if plaintextSize == 0 {
+		expChunks = 1
+	}
+	if expChunks != chunks {
+		return 0, fmt.Errorf("invalid encrypted payload size: %d", encryptedSize)
+	}
+
+	return chunks, nil
+}
+
+func PlaintextSize(encryptedSize int64) (int64, error) {
+	chunks, err := EncryptedChunkCount(encryptedSize)
+	if err != nil {
+		return 0, err
+	}
+	plaintextSize := encryptedSize - chunks*chacha20poly1305.Overhead
+	return plaintextSize, nil
+}
+
+type DecryptReader struct {
 	a   cipher.AEAD
 	src io.Reader
 
@@ -32,18 +60,15 @@ const (
 	lastChunkFlag = 0x01
 )
 
-func NewReader(key []byte, src io.Reader) (*Reader, error) {
+func NewDecryptReader(key []byte, src io.Reader) (*DecryptReader, error) {
 	aead, err := chacha20poly1305.New(key)
 	if err != nil {
 		return nil, err
 	}
-	return &Reader{
-		a:   aead,
-		src: src,
-	}, nil
+	return &DecryptReader{a: aead, src: src}, nil
 }
 
-func (r *Reader) Read(p []byte) (int, error) {
+func (r *DecryptReader) Read(p []byte) (int, error) {
 	if len(r.unread) > 0 {
 		n := copy(p, r.unread)
 		r.unread = r.unread[n:]
@@ -85,7 +110,7 @@ func (r *Reader) Read(p []byte) (int, error) {
 // readChunk reads the next chunk of ciphertext from r.src and makes it available
 // in r.unread. last is true if the chunk was marked as the end of the message.
 // readChunk must not be called again after returning a last chunk or an error.
-func (r *Reader) readChunk() (last bool, err error) {
+func (r *DecryptReader) readChunk() (last bool, err error) {
 	if len(r.unread) != 0 {
 		panic("stream: internal error: readChunk called with dirty buffer")
 	}
@@ -118,7 +143,7 @@ func (r *Reader) readChunk() (last bool, err error) {
 		out, err = r.a.Open(outBuf, r.nonce[:], in, nil)
 	}
 	if err != nil {
-		return false, errors.New("failed to decrypt and authenticate payload chunk")
+		return false, errors.New("failed to decrypt and authenticate payload chunk, file may be corrupted or tampered with")
 	}
 
 	incNonce(&r.nonce)
@@ -130,12 +155,17 @@ func incNonce(nonce *[chacha20poly1305.NonceSize]byte) {
 	for i := len(nonce) - 2; i >= 0; i-- {
 		nonce[i]++
 		if nonce[i] != 0 {
-			break
-		} else if i == 0 {
-			// The counter is 88 bits, this is unreachable.
-			panic("stream: chunk counter wrapped around")
+			return
 		}
 	}
+	// The counter is 88 bits, this is unreachable.
+	panic("stream: chunk counter wrapped around")
+}
+
+func nonceForChunk(chunkIndex int64) *[chacha20poly1305.NonceSize]byte {
+	var nonce [chacha20poly1305.NonceSize]byte
+	binary.BigEndian.PutUint64(nonce[3:11], uint64(chunkIndex))
+	return &nonce
 }
 
 func setLastChunkFlag(nonce *[chacha20poly1305.NonceSize]byte) {
@@ -146,30 +176,23 @@ func nonceIsZero(nonce *[chacha20poly1305.NonceSize]byte) bool {
 	return *nonce == [chacha20poly1305.NonceSize]byte{}
 }
 
-type Writer struct {
-	a         cipher.AEAD
-	dst       io.Writer
-	unwritten []byte // backed by buf
-	buf       [encChunkSize]byte
-	nonce     [chacha20poly1305.NonceSize]byte
-	err       error
+type EncryptWriter struct {
+	a     cipher.AEAD
+	dst   io.Writer
+	buf   bytes.Buffer
+	nonce [chacha20poly1305.NonceSize]byte
+	err   error
 }
 
-func NewWriter(key []byte, dst io.Writer) (*Writer, error) {
+func NewEncryptWriter(key []byte, dst io.Writer) (*EncryptWriter, error) {
 	aead, err := chacha20poly1305.New(key)
 	if err != nil {
 		return nil, err
 	}
-	w := &Writer{
-		a:   aead,
-		dst: dst,
-	}
-	w.unwritten = w.buf[:0]
-	return w, nil
+	return &EncryptWriter{a: aead, dst: dst}, nil
 }
 
-func (w *Writer) Write(p []byte) (n int, err error) {
-	// TODO: consider refactoring with a bytes.Buffer.
+func (w *EncryptWriter) Write(p []byte) (n int, err error) {
 	if w.err != nil {
 		return 0, w.err
 	}
@@ -179,12 +202,13 @@ func (w *Writer) Write(p []byte) (n int, err error) {
 
 	total := len(p)
 	for len(p) > 0 {
-		freeBuf := w.buf[len(w.unwritten):ChunkSize]
-		n := copy(freeBuf, p)
+		n := min(len(p), ChunkSize-w.buf.Len())
+		w.buf.Write(p[:n])
 		p = p[n:]
-		w.unwritten = w.unwritten[:len(w.unwritten)+n]
 
-		if len(w.unwritten) == ChunkSize && len(p) > 0 {
+		// Only flush if there's a full chunk with bytes still to write, or we
+		// can't know if this is the last chunk yet.
+		if w.buf.Len() == ChunkSize && len(p) > 0 {
 			if err := w.flushChunk(notLastChunk); err != nil {
 				w.err = err
 				return 0, err
@@ -195,7 +219,7 @@ func (w *Writer) Write(p []byte) (n int, err error) {
 }
 
 // Close flushes the last chunk. It does not close the underlying Writer.
-func (w *Writer) Close() error {
+func (w *EncryptWriter) Close() error {
 	if w.err != nil {
 		return w.err
 	}
@@ -214,17 +238,214 @@ const (
 	notLastChunk = false
 )
 
-func (w *Writer) flushChunk(last bool) error {
-	if !last && len(w.unwritten) != ChunkSize {
+func (w *EncryptWriter) flushChunk(last bool) error {
+	if !last && w.buf.Len() != ChunkSize {
 		panic("stream: internal error: flush called with partial chunk")
 	}
 
 	if last {
 		setLastChunkFlag(&w.nonce)
 	}
-	buf := w.a.Seal(w.buf[:0], w.nonce[:], w.unwritten, nil)
-	_, err := w.dst.Write(buf)
-	w.unwritten = w.buf[:0]
+	w.buf.Grow(chacha20poly1305.Overhead)
+	ciphertext := w.a.Seal(w.buf.Bytes()[:0], w.nonce[:], w.buf.Bytes(), nil)
+	_, err := w.dst.Write(ciphertext)
 	incNonce(&w.nonce)
+	w.buf.Reset()
 	return err
 }
+
+type EncryptReader struct {
+	a   cipher.AEAD
+	src io.Reader
+
+	// The first ready bytes of buf are already encrypted. This may be less than
+	// buf.Len(), because we need to over-read to know if a chunk is the last.
+	ready int
+	buf   bytes.Buffer
+
+	nonce [chacha20poly1305.NonceSize]byte
+	err   error
+}
+
+func NewEncryptReader(key []byte, src io.Reader) (*EncryptReader, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+	return &EncryptReader{a: aead, src: src}, nil
+}
+
+func (r *EncryptReader) Read(p []byte) (int, error) {
+	if r.ready > 0 {
+		n, err := r.buf.Read(p[:min(len(p), r.ready)])
+		r.ready -= n
+		return n, err
+	}
+	if r.err != nil {
+		return 0, r.err
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	if err := r.feedBuffer(); err != nil {
+		r.err = err
+		return 0, err
+	}
+
+	n, err := r.buf.Read(p[:min(len(p), r.ready)])
+	r.ready -= n
+	return n, err
+}
+
+// feedBuffer reads and encrypts the next chunk from r.src and appends it to
+// r.buf. It sets r.ready to the number of newly available bytes in r.buf.
+func (r *EncryptReader) feedBuffer() error {
+	if r.ready > 0 {
+		panic("stream: internal error: feedBuffer called with dirty buffer")
+	}
+
+	// CopyN will use r.buf.ReadFrom/WriteTo to fill the buffer directly.
+	// We need ChunkSize + 1 bytes to determine if this is the last chunk.
+	_, err := io.CopyN(&r.buf, r.src, int64(ChunkSize-r.buf.Len()+1))
+	if err != nil && err != io.EOF {
+		return err
+	}
+
+	if last := r.buf.Len() <= ChunkSize; last {
+		setLastChunkFlag(&r.nonce)
+
+		// After Grow, we know r.buf.Bytes() has enough capacity for the
+		// overhead. We encrypt in place and then do a Write to include the
+		// overhead in the buffer.
+		r.buf.Grow(chacha20poly1305.Overhead)
+		plaintext := r.buf.Bytes()
+		r.a.Seal(plaintext[:0], r.nonce[:], plaintext, nil)
+		incNonce(&r.nonce)
+		r.buf.Write(plaintext[len(plaintext) : len(plaintext)+chacha20poly1305.Overhead])
+		r.ready = r.buf.Len()
+
+		r.err = io.EOF
+		return nil
+	}
+
+	// Same, but accounting for the tail byte which will remain unencrypted and
+	// needs to be shifted past the overhead.
+	if r.buf.Len() != ChunkSize+1 {
+		panic("stream: internal error: unexpected buffer length")
+	}
+	tailByte := r.buf.Bytes()[ChunkSize]
+	r.buf.Grow(chacha20poly1305.Overhead)
+	plaintext := r.buf.Bytes()[:ChunkSize]
+	r.a.Seal(plaintext[:0], r.nonce[:], plaintext, nil)
+	incNonce(&r.nonce)
+	r.buf.Write(plaintext[len(plaintext)+1 : len(plaintext)+chacha20poly1305.Overhead])
+	r.buf.WriteByte(tailByte)
+	r.ready = ChunkSize + chacha20poly1305.Overhead
+
+	return nil
+}
+
+type DecryptReaderAt struct {
+	a      cipher.AEAD
+	src    io.ReaderAt
+	size   int64
+	chunks int64
+	cache  atomic.Pointer[cachedChunk]
+}
+
+type cachedChunk struct {
+	off  int64
+	data []byte
+}
+
+func NewDecryptReaderAt(key []byte, src io.ReaderAt, size int64) (*DecryptReaderAt, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check that size is valid by decrypting the final chunk.
+	chunks, err := EncryptedChunkCount(size)
+	if err != nil {
+		return nil, err
+	}
+	finalChunkIndex := chunks - 1
+	finalChunkOff := finalChunkIndex * encChunkSize
+	finalChunkSize := size - finalChunkOff
+	finalChunk := make([]byte, finalChunkSize)
+	if _, err := src.ReadAt(finalChunk, finalChunkOff); err != nil {
+		return nil, fmt.Errorf("failed to read final chunk: %w", err)
+	}
+	nonce := nonceForChunk(finalChunkIndex)
+	setLastChunkFlag(nonce)
+	plaintext, err := aead.Open(finalChunk[:0], nonce[:], finalChunk, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt and authenticate final chunk: %w", err)
+	}
+	cache := &cachedChunk{off: finalChunkOff, data: plaintext}
+
+	plaintextSize := size - chunks*chacha20poly1305.Overhead
+	r := &DecryptReaderAt{a: aead, src: src, size: plaintextSize, chunks: chunks}
+	r.cache.Store(cache)
+	return r, nil
+}
+
+func (r *DecryptReaderAt) ReadAt(p []byte, off int64) (n int, err error) {
+	if off < 0 || off > r.size {
+		return 0, fmt.Errorf("offset out of range [0:%d]: %d", r.size, off)
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+	var cacheUpdate *cachedChunk
+	chunk := make([]byte, encChunkSize)
+	for len(p) > 0 && off < r.size {
+		chunkIndex := off / ChunkSize
+		chunkOff := chunkIndex * encChunkSize
+		encSize := r.size + r.chunks*chacha20poly1305.Overhead
+		chunkSize := min(encSize-chunkOff, encChunkSize)
+
+		cached := r.cache.Load()
+		var plaintext []byte
+		if cached != nil && cached.off == chunkOff {
+			plaintext = cached.data
+			cacheUpdate = nil
+		} else {
+			nn, err := r.src.ReadAt(chunk[:chunkSize], chunkOff)
+			if err == io.EOF {
+				if int64(nn) != chunkSize {
+					err = io.ErrUnexpectedEOF
+				} else {
+					err = nil
+				}
+			}
+			if err != nil {
+				return n, fmt.Errorf("failed to read chunk at offset %d: %w", chunkOff, err)
+			}
+			nonce := nonceForChunk(chunkIndex)
+			if chunkIndex == r.chunks-1 {
+				setLastChunkFlag(nonce)
+			}
+			plaintext, err = r.a.Open(chunk[:0], nonce[:], chunk[:chunkSize], nil)
+			if err != nil {
+				return n, fmt.Errorf("failed to decrypt and authenticate chunk at offset %d: %w", chunkOff, err)
+			}
+			cacheUpdate = &cachedChunk{off: chunkOff, data: plaintext}
+		}
+
+		plainChunkOff := int(off - chunkIndex*ChunkSize)
+		copySize := min(len(plaintext)-plainChunkOff, len(p))
+		copy(p, plaintext[plainChunkOff:plainChunkOff+copySize])
+		p = p[copySize:]
+		off += int64(copySize)
+		n += copySize
+	}
+	if cacheUpdate != nil {
+		r.cache.Store(cacheUpdate)
+	}
+	if off == r.size {
+		return n, io.EOF
+	}
+	return n, nil
+}

vendor/filippo.io/age/parse.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"unicode/utf8"
 )
 
 // ParseIdentities parses a file with one or more private key encodings, one per
@@ -16,10 +17,10 @@ import (
 //
 // This is the same syntax as the private key files accepted by the CLI, except
 // the CLI also accepts SSH private keys, which are not recommended for the
-// average application.
+// average application, and plugins, which involve invoking external programs.
 //
-// Currently, all returned values are of type *X25519Identity, but different
-// types might be returned in the future.
+// Currently, all returned values are of type *[X25519Identity] or
+// *[HybridIdentity], but different types might be returned in the future.
 func ParseIdentities(f io.Reader) ([]Identity, error) {
 	const privateKeySizeLimit = 1 << 24 // 16 MiB
 	var ids []Identity
@@ -31,30 +32,45 @@ func ParseIdentities(f io.Reader) ([]Identity, error) {
 		if strings.HasPrefix(line, "#") || line == "" {
 			continue
 		}
-		i, err := ParseX25519Identity(line)
+		if !utf8.ValidString(line) {
+			return nil, fmt.Errorf("identities file is not valid UTF-8")
+		}
+		i, err := parseIdentity(line)
 		if err != nil {
 			return nil, fmt.Errorf("error at line %d: %v", n, err)
 		}
 		ids = append(ids, i)
 	}
 	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("failed to read secret keys file: %v", err)
+		return nil, fmt.Errorf("failed to read identities file: %v", err)
 	}
 	if len(ids) == 0 {
-		return nil, fmt.Errorf("no secret keys found")
+		return nil, fmt.Errorf("no identities found")
 	}
 	return ids, nil
 }
 
+func parseIdentity(arg string) (Identity, error) {
+	switch {
+	case strings.HasPrefix(arg, "AGE-SECRET-KEY-1"):
+		return ParseX25519Identity(arg)
+	case strings.HasPrefix(arg, "AGE-SECRET-KEY-PQ-1"):
+		return ParseHybridIdentity(arg)
+	default:
+		return nil, fmt.Errorf("unknown identity type: %q", arg)
+	}
+}
+
 // ParseRecipients parses a file with one or more public key encodings, one per
 // line. Empty lines and lines starting with "#" are ignored.
 //
 // This is the same syntax as the recipients files accepted by the CLI, except
 // the CLI also accepts SSH recipients, which are not recommended for the
-// average application.
+// average application, tagged recipients, which have different privacy
+// properties, and plugins, which involve invoking external programs.
 //
-// Currently, all returned values are of type *X25519Recipient, but different
-// types might be returned in the future.
+// Currently, all returned values are of type *[X25519Recipient] or
+// *[HybridRecipient] but different types might be returned in the future.
 func ParseRecipients(f io.Reader) ([]Recipient, error) {
 	const recipientFileSizeLimit = 1 << 24 // 16 MiB
 	var recs []Recipient
@@ -66,11 +82,12 @@ func ParseRecipients(f io.Reader) ([]Recipient, error) {
 		if strings.HasPrefix(line, "#") || line == "" {
 			continue
 		}
-		r, err := ParseX25519Recipient(line)
+		if !utf8.ValidString(line) {
+			return nil, fmt.Errorf("recipients file is not valid UTF-8")
+		}
+		r, err := parseRecipient(line)
 		if err != nil {
-			// Hide the error since it might unintentionally leak the contents
-			// of confidential files.
-			return nil, fmt.Errorf("malformed recipient at line %d", n)
+			return nil, fmt.Errorf("error at line %d: %v", n, err)
 		}
 		recs = append(recs, r)
 	}
@@ -82,3 +99,14 @@ func ParseRecipients(f io.Reader) ([]Recipient, error) {
 	}
 	return recs, nil
 }
+
+func parseRecipient(arg string) (Recipient, error) {
+	switch {
+	case strings.HasPrefix(arg, "age1pq1"):
+		return ParseHybridRecipient(arg)
+	case strings.HasPrefix(arg, "age1"):
+		return ParseX25519Recipient(arg)
+	default:
+		return nil, fmt.Errorf("unknown recipient type: %q", arg)
+	}
+}

vendor/filippo.io/age/pq.go

@@ -0,0 +1,181 @@
+// Copyright 2025 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package age
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"filippo.io/age/internal/bech32"
+	"filippo.io/age/internal/format"
+	"filippo.io/hpke"
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+const pqLabel = "age-encryption.org/mlkem768x25519"
+
+// HybridRecipient is the standard age public key. Messages encrypted to
+// this recipient can be decrypted with the corresponding [HybridIdentity].
+//
+// This recipient is safe against future cryptographically-relevant quantum
+// computers, and can only be used along with other post-quantum recipients.
+//
+// This recipient is anonymous, in the sense that an attacker can't tell from
+// the message alone if it is encrypted to a certain recipient.
+type HybridRecipient struct {
+	pk hpke.PublicKey
+}
+
+var _ Recipient = &HybridRecipient{}
+
+// newHybridRecipient returns a new [HybridRecipient] from a raw HPKE public key.
+func newHybridRecipient(publicKey []byte) (*HybridRecipient, error) {
+	pk, err := hpke.MLKEM768X25519().NewPublicKey(publicKey)
+	if err != nil {
+		return nil, errors.New("invalid MLKEM768-X25519 public key")
+	}
+	return &HybridRecipient{pk: pk}, nil
+}
+
+// ParseHybridRecipient returns a new [HybridRecipient] from a Bech32 public key
+// encoding with the "age1pq1" prefix.
+func ParseHybridRecipient(s string) (*HybridRecipient, error) {
+	t, k, err := bech32.Decode(s)
+	if err != nil {
+		return nil, fmt.Errorf("malformed recipient %q: %v", s, err)
+	}
+	if t != "age1pq" {
+		return nil, fmt.Errorf("malformed recipient %q: invalid type %q", s, t)
+	}
+	r, err := newHybridRecipient(k)
+	if err != nil {
+		return nil, fmt.Errorf("malformed recipient %q: %v", s, err)
+	}
+	return r, nil
+}
+
+func (r *HybridRecipient) Wrap(fileKey []byte) ([]*Stanza, error) {
+	s, _, err := r.WrapWithLabels(fileKey)
+	return s, err
+}
+
+// WrapWithLabels implements [RecipientWithLabels], returning a single
+// "postquantum" label. This ensures a HybridRecipient can't be mixed with other
+// recipients that would defeat its post-quantum security.
+//
+// To unsafely bypass this restriction, wrap HybridRecipient in a [Recipient]
+// type that doesn't expose WrapWithLabels.
+func (r *HybridRecipient) WrapWithLabels(fileKey []byte) ([]*Stanza, []string, error) {
+	enc, s, err := hpke.NewSender(r.pk, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte(pqLabel))
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to set up HPKE sender: %v", err)
+	}
+	ct, err := s.Seal(nil, fileKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to encrypt file key: %v", err)
+	}
+
+	l := &Stanza{
+		Type: "mlkem768x25519",
+		Args: []string{format.EncodeToString(enc)},
+		Body: ct,
+	}
+
+	return []*Stanza{l}, []string{"postquantum"}, nil
+}
+
+// String returns the Bech32 public key encoding of r.
+func (r *HybridRecipient) String() string {
+	s, _ := bech32.Encode("age1pq", r.pk.Bytes())
+	return s
+}
+
+// HybridIdentity is the standard age private key, which can decrypt messages
+// encrypted to the corresponding [HybridRecipient].
+type HybridIdentity struct {
+	k hpke.PrivateKey
+}
+
+var _ Identity = &HybridIdentity{}
+
+// newHybridIdentity returns a new [HybridIdentity] from a raw HPKE private key.
+func newHybridIdentity(secretKey []byte) (*HybridIdentity, error) {
+	k, err := hpke.MLKEM768X25519().NewPrivateKey(secretKey)
+	if err != nil {
+		return nil, errors.New("invalid MLKEM768-X25519 secret key")
+	}
+	return &HybridIdentity{k: k}, nil
+}
+
+// GenerateHybridIdentity randomly generates a new [HybridIdentity].
+func GenerateHybridIdentity() (*HybridIdentity, error) {
+	k, err := hpke.MLKEM768X25519().GenerateKey()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate post-quantum identity: %v", err)
+	}
+	return &HybridIdentity{k: k}, nil
+}
+
+// ParseHybridIdentity returns a new [HybridIdentity] from a Bech32 private key
+// encoding with the "AGE-SECRET-KEY-PQ-1" prefix.
+func ParseHybridIdentity(s string) (*HybridIdentity, error) {
+	t, k, err := bech32.Decode(s)
+	if err != nil {
+		return nil, fmt.Errorf("malformed secret key: %v", err)
+	}
+	if t != "AGE-SECRET-KEY-PQ-" {
+		return nil, fmt.Errorf("malformed secret key: unknown type %q", t)
+	}
+	r, err := newHybridIdentity(k)
+	if err != nil {
+		return nil, fmt.Errorf("malformed secret key: %v", err)
+	}
+	return r, nil
+}
+
+func (i *HybridIdentity) Unwrap(stanzas []*Stanza) ([]byte, error) {
+	return multiUnwrap(i.unwrap, stanzas)
+}
+
+func (i *HybridIdentity) unwrap(block *Stanza) ([]byte, error) {
+	if block.Type != "mlkem768x25519" {
+		return nil, ErrIncorrectIdentity
+	}
+	if len(block.Args) != 1 {
+		return nil, errors.New("invalid mlkem768x25519 recipient block")
+	}
+	enc, err := format.DecodeString(block.Args[0])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse mlkem768x25519 recipient: %v", err)
+	}
+	if len(block.Body) != fileKeySize+chacha20poly1305.Overhead {
+		return nil, errIncorrectCiphertextSize
+	}
+
+	r, err := hpke.NewRecipient(enc, i.k, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte(pqLabel))
+	if err != nil {
+		// MLKEM768-X25519 does implicit rejection, so a mismatched key does not
+		// hit this error path, but is only detected later when trying to open.
+		return nil, fmt.Errorf("invalid mlkem768x25519 recipient: %v", err)
+	}
+	fileKey, err := r.Open(nil, block.Body)
+	if err != nil {
+		return nil, ErrIncorrectIdentity
+	}
+	return fileKey, nil
+}
+
+// Recipient returns the public [HybridRecipient] value corresponding to i.
+func (i *HybridIdentity) Recipient() *HybridRecipient {
+	return &HybridRecipient{pk: i.k.PublicKey()}
+}
+
+// String returns the Bech32 private key encoding of i.
+func (i *HybridIdentity) String() string {
+	b, _ := i.k.Bytes()
+	s, _ := bech32.Encode("AGE-SECRET-KEY-PQ-", b)
+	return strings.ToUpper(s)
+}

vendor/filippo.io/age/scrypt.go

@@ -27,7 +27,7 @@ const scryptLabel = "age-encryption.org/v1/scrypt"
 // for the same file.
 //
 // Its use is not recommended for automated systems, which should prefer
-// X25519Recipient.
+// [HybridRecipient] or [X25519Recipient].
 type ScryptRecipient struct {
 	password   []byte
 	workFactor int
@@ -150,14 +150,20 @@ func (i *ScryptIdentity) Unwrap(stanzas []*Stanza) ([]byte, error) {
 			return nil, errors.New("an scrypt recipient must be the only one")
 		}
 	}
-	return multiUnwrap(i.unwrap, stanzas)
+	for _, s := range stanzas {
+		if s.Type != "scrypt" {
+			continue
+		}
+		return i.unwrap(s)
+	}
+	return nil, fmt.Errorf("%w: file is not passphrase-encrypted", ErrIncorrectIdentity)
 }
 
 var digitsRe = regexp.MustCompile(`^[1-9][0-9]*$`)
 
 func (i *ScryptIdentity) unwrap(block *Stanza) ([]byte, error) {
 	if block.Type != "scrypt" {
-		return nil, ErrIncorrectIdentity
+		return nil, errors.New("internal error: unwrap called on non-scrypt stanza")
 	}
 	if len(block.Args) != 2 {
 		return nil, errors.New("invalid scrypt recipient block")
@@ -200,7 +206,9 @@ func (i *ScryptIdentity) unwrap(block *Stanza) ([]byte, error) {
 	if err == errIncorrectCiphertextSize {
 		return nil, errors.New("invalid scrypt recipient block: incorrect file key size")
 	} else if err != nil {
-		return nil, ErrIncorrectIdentity
+		// Wrap [ErrIncorrectIdentity] so that multiple passphrases can be tried
+		// in sequence by passing multiple [ScryptIdentity] values to [Decrypt].
+		return nil, fmt.Errorf("%w: incorrect passphrase", ErrIncorrectIdentity)
 	}
 	return fileKey, nil
 }

vendor/filippo.io/age/x25519.go

@@ -21,8 +21,9 @@ import (
 
 const x25519Label = "age-encryption.org/v1/X25519"
 
-// X25519Recipient is the standard age public key. Messages encrypted to this
-// recipient can be decrypted with the corresponding X25519Identity.
+// X25519Recipient is the standard age pre-quantum public key. Messages
+// encrypted to this recipient can be decrypted with the corresponding
+// [X25519Identity]. For post-quantum resistance, use [HybridRecipient].
 //
 // This recipient is anonymous, in the sense that an attacker can't tell from
 // the message alone if it is encrypted to a certain recipient.
@@ -105,8 +106,9 @@ func (r *X25519Recipient) String() string {
 	return s
 }
 
-// X25519Identity is the standard age private key, which can decrypt messages
-// encrypted to the corresponding X25519Recipient.
+// X25519Identity is the standard pre-quantum age private key, which can decrypt
+// messages encrypted to the corresponding [X25519Recipient]. For post-quantum
+// resistance, use [HybridIdentity].
 type X25519Identity struct {
 	secretKey, ourPublicKey []byte
 }

vendor/filippo.io/hpke/LICENSE

@@ -0,0 +1,27 @@
+Copyright 2009 The Go Authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/filippo.io/hpke/aead.go

@@ -0,0 +1,130 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package hpke
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"errors"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+// The AEAD is one of the three components of an HPKE ciphersuite, implementing
+// symmetric encryption.
+type AEAD interface {
+	ID() uint16
+	keySize() int
+	nonceSize() int
+	aead(key []byte) (cipher.AEAD, error)
+}
+
+// NewAEAD returns the AEAD implementation for the given AEAD ID.
+//
+// Applications are encouraged to use specific implementations like [AES128GCM]
+// or [ChaCha20Poly1305] instead, unless runtime agility is required.
+func NewAEAD(id uint16) (AEAD, error) {
+	switch id {
+	case 0x0001: // AES-128-GCM
+		return AES128GCM(), nil
+	case 0x0002: // AES-256-GCM
+		return AES256GCM(), nil
+	case 0x0003: // ChaCha20Poly1305
+		return ChaCha20Poly1305(), nil
+	case 0xFFFF: // Export-only
+		return ExportOnly(), nil
+	default:
+		return nil, fmt.Errorf("unsupported AEAD %04x", id)
+	}
+}
+
+// AES128GCM returns an AES-128-GCM AEAD implementation.
+func AES128GCM() AEAD { return aes128GCM }
+
+// AES256GCM returns an AES-256-GCM AEAD implementation.
+func AES256GCM() AEAD { return aes256GCM }
+
+// ChaCha20Poly1305 returns a ChaCha20Poly1305 AEAD implementation.
+func ChaCha20Poly1305() AEAD { return chacha20poly1305AEAD }
+
+// ExportOnly returns a placeholder AEAD implementation that cannot encrypt or
+// decrypt, but only export secrets with [Sender.Export] or [Recipient.Export].
+//
+// When this is used, [Sender.Seal] and [Recipient.Open] return errors.
+func ExportOnly() AEAD { return exportOnlyAEAD{} }
+
+type aead struct {
+	nK  int
+	nN  int
+	new func([]byte) (cipher.AEAD, error)
+	id  uint16
+}
+
+var aes128GCM = &aead{
+	nK:  128 / 8,
+	nN:  96 / 8,
+	new: newAESGCM,
+	id:  0x0001,
+}
+
+var aes256GCM = &aead{
+	nK:  256 / 8,
+	nN:  96 / 8,
+	new: newAESGCM,
+	id:  0x0002,
+}
+
+var chacha20poly1305AEAD = &aead{
+	nK:  chacha20poly1305.KeySize,
+	nN:  chacha20poly1305.NonceSize,
+	new: chacha20poly1305.New,
+	id:  0x0003,
+}
+
+func newAESGCM(key []byte) (cipher.AEAD, error) {
+	b, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	return cipher.NewGCM(b)
+}
+
+func (a *aead) ID() uint16 {
+	return a.id
+}
+
+func (a *aead) aead(key []byte) (cipher.AEAD, error) {
+	if len(key) != a.nK {
+		return nil, errors.New("invalid key size")
+	}
+	return a.new(key)
+}
+
+func (a *aead) keySize() int {
+	return a.nK
+}
+
+func (a *aead) nonceSize() int {
+	return a.nN
+}
+
+type exportOnlyAEAD struct{}
+
+func (exportOnlyAEAD) ID() uint16 {
+	return 0xFFFF
+}
+
+func (exportOnlyAEAD) aead(key []byte) (cipher.AEAD, error) {
+	return nil, nil
+}
+
+func (exportOnlyAEAD) keySize() int {
+	return 0
+}
+
+func (exportOnlyAEAD) nonceSize() int {
+	return 0
+}

vendor/filippo.io/hpke/crypto/ecdh/interfaces.go

@@ -0,0 +1,15 @@
+// Package ecdh defines an additional interface that will be added to the
+// crypto/ecdh package in Go 1.26+.
+package ecdh
+
+import "crypto/ecdh"
+
+// KeyExchanger is an interface for an opaque private key that can be used for
+// key exchange operations. For example, an ECDH key kept in a hardware module.
+//
+// It is implemented by [ecdh.PrivateKey].
+type KeyExchanger interface {
+	PublicKey() *ecdh.PublicKey
+	Curve() ecdh.Curve
+	ECDH(*ecdh.PublicKey) ([]byte, error)
+}

vendor/filippo.io/hpke/crypto/ecdh/stubs.go

@@ -0,0 +1,15 @@
+package ecdh
+
+import "crypto/ecdh"
+
+// This file contains stubs to allow importing only this package instead of
+// crypto/ecdh, to minimize the diff.
+
+type Curve = ecdh.Curve
+type PrivateKey = ecdh.PrivateKey
+type PublicKey = ecdh.PublicKey
+
+func X25519() Curve { return ecdh.X25519() }
+func P256() Curve   { return ecdh.P256() }
+func P384() Curve   { return ecdh.P384() }
+func P521() Curve   { return ecdh.P521() }

vendor/filippo.io/hpke/crypto/interfaces.go

@@ -0,0 +1,68 @@
+// Package crypto defines additional interfaces that will be added to the
+// crypto package in Go 1.26+.
+package crypto
+
+import (
+	"crypto/ecdh"
+	"crypto/mlkem"
+)
+
+// KeyExchanger is an interface for an opaque private key that can be used for
+// key exchange operations. For example, an ECDH key kept in a hardware module.
+//
+// It is implemented by [ecdh.PrivateKey].
+type KeyExchanger interface {
+	PublicKey() *ecdh.PublicKey
+	Curve() ecdh.Curve
+	ECDH(*ecdh.PublicKey) ([]byte, error)
+}
+
+// Encapsulator is an interface for a public KEM key that can be used for
+// encapsulation operations.
+//
+// It is implemented, for example, by [crypto/mlkem.EncapsulationKey768].
+type Encapsulator interface {
+	Bytes() []byte
+	Encapsulate() (sharedKey, ciphertext []byte)
+}
+
+// Decapsulator is an interface for an opaque private KEM key that can be used for
+// decapsulation operations. For example, an ML-KEM key kept in a hardware module.
+//
+// It will be implemented by [crypto/mlkem.DecapsulationKey768] in Go 1.26+.
+// In the meantime, use [DecapsulatorFromDecapsulationKey768] and
+// [DecapsulatorFromDecapsulationKey1024].
+type Decapsulator interface {
+	Encapsulator() Encapsulator
+	Decapsulate(ciphertext []byte) (sharedKey []byte, err error)
+}
+
+// DecapsulatorFromDecapsulationKey768 wraps an ML-KEM-768 decapsulation key
+// into a [Decapsulator], until Go 1.26+ where [crypto/mlkem.DecapsulationKey768]
+// implements it natively.
+func DecapsulatorFromDecapsulationKey768(dk *mlkem.DecapsulationKey768) Decapsulator {
+	return &mlkem768Decapsulator{dk}
+}
+
+type mlkem768Decapsulator struct {
+	*mlkem.DecapsulationKey768
+}
+
+func (d *mlkem768Decapsulator) Encapsulator() Encapsulator {
+	return d.EncapsulationKey()
+}
+
+// DecapsulatorFromDecapsulationKey1024 wraps an ML-KEM-1024 decapsulation key
+// into a [Decapsulator], until Go 1.26+ where [crypto/mlkem.DecapsulationKey1024]
+// implements it natively.
+func DecapsulatorFromDecapsulationKey1024(dk *mlkem.DecapsulationKey1024) Decapsulator {
+	return &mlkem1024Decapsulator{dk}
+}
+
+type mlkem1024Decapsulator struct {
+	*mlkem.DecapsulationKey1024
+}
+
+func (d *mlkem1024Decapsulator) Encapsulator() Encapsulator {
+	return d.EncapsulationKey()
+}

vendor/filippo.io/hpke/hpke-pq.md

@@ -0,0 +1,235 @@
+# HPKE Hybrid KEMs
+
+[filippo.io/hpke-pq](https://filippo.io/hpke-pq)
+
+This document is a simplified and self-contained implementation reference for
+the MLKEM768-X25519, MLKEM768-P256, and MLKEM1024-P384 hybrid HPKE KEMs,
+specified in [draft-ietf-hpke-pq-03][], [draft-irtf-cfrg-hybrid-kems-07][],
+[draft-irtf-cfrg-concrete-hybrid-kems-02][], and [draft-ietf-hpke-hpke-02].
+
+It compensates for the need to cross-reference four documents, with different
+nomenclature (including functions and components with the same name but
+different behavior), alternative irrelevant definitions (the UG, UK, and CK
+frameworks), and multiple KEM abstraction layers.
+
+## Conventions used in this document
+
+`||` denotes concatenation. `[N:M]` denotes the byte slice from index N (inclusive)
+to index M (exclusive). Strings quoted with `""` are encoded as ASCII. Values in
+code blocks are hex encoded byte strings. `random(N)` denotes N bytes of CSPRNG
+output. All lengths are in bytes.
+
+ML-KEM.KeyGen_internal, ML-KEM.Encaps, and ML-KEM.Decaps are defined in
+[FIPS 203][]. `SHAKE256(s, L)` is an invocation of `SHAKE256(s, 8*L)` defined in
+[FIPS 202][]. SHA3-256 is defined in [FIPS 202][].
+
+## KEM definitions
+
+| Parameter         | MLKEM768-X25519    | MLKEM768-P256      | MLKEM1024-P384     |
+| ----------------- | ------------------ | ------------------ | ------------------ |
+| ML-KEM parameters | ML-KEM-768         | ML-KEM-768         | ML-KEM-1024        |
+| Group             | Curve25519         | P-256              | P-384              |
+| KEM identifier    | 0x647a             | 0x0050             | 0x0051             |
+| Nsecret           | 32                 | 32                 | 32                 |
+| Nenc              | 1120               | 1153               | 1665               |
+| Npk               | 1216               | 1249               | 1665               |
+| Nsk               | 32                 | 32                 | 32                 |
+| Label             | `"\.//^\"`         | `"MLKEM768-P256"`  | `"MLKEM1024-P384"` |
+| KEM.Nct           | 1088               | 1088               | 1568               |
+| KEM.Nek           | 1184               | 1184               | 1568               |    
+| KEM.Nseed         | 64                 | 64                 | 64                 |
+| Group.Nelem       | 32                 | 65                 | 97                 |
+| Group.Nseed       | 32                 | 128                | 48                 |
+| Group.Nscalar     | N/A                | 32                 | 48                 |
+
+The MLKEM768-X25519 Label is alternatively encoded as
+
+    5c2e2f2f5e5c
+
+## KEM functions
+
+```
+def GenerateKeyPair():
+    seed = random(32)
+
+    ek_PQ, ek_T, _, _ = expandKey(seed)
+    ek = ek_PQ || ek_T
+
+    return (seed, ek)
+
+def DeriveKeyPair(ikm):
+    # SHAKE256.LabeledDerive is part of the single-stage KDF described in
+    # draft-ietf-hpke-hpke-02 and defined in draft-ietf-hpke-pq-03, but is
+    # reproduced below for convenience.
+    seed = SHAKE256.LabeledDerive(ikm, "DeriveKeyPair", "", 32)
+
+    ek_PQ, ek_T, _, _ = expandKey(seed)
+    ek = ek_PQ || ek_T
+
+    return (seed, ek)
+
+def Encaps(ek):
+    ek_PQ = ek[0 : KEM.Nek]
+    ek_T = ek[KEM.Nek : KEM.Nek + Group.Nelem]
+
+    ss_PQ, ct_PQ = ML-KEM.Encaps(ek_PQ)
+
+    sk_E = Group.RandomScalar(random(Group.Nseed))
+    ct_T = Group.Exp(Group.G, sk_E)
+    ss_T = Group.ElementToSharedSecret(Group.Exp(ek_T, sk_E))
+
+    ss = SHA3-256(ss_PQ || ss_T || ct_T || ek_T || Label)
+    ct = ct_PQ || ct_T
+
+    return (ss, ct)
+
+def Decaps(seed, ct):
+    ct_PQ = ct[0 : KEM.Nct]
+    ct_T = ct[KEM.Nct : KEM.Nct + Group.Nelem]
+
+    ek_PQ, ek_T, dk_PQ, dk_T = expandKey(seed)
+
+    ss_PQ = ML-KEM.Decaps(dk_PQ, ct_PQ)
+    ss_T = Group.ElementToSharedSecret(Group.Exp(ct_T, dk_T))
+
+    ss = SHA3-256(ss_PQ || ss_T || ct_T || ek_T || Label)
+
+    return ss
+
+def expandKey(seed):
+    seed_full = SHAKE256(seed, KEM.Nseed + Group.Nseed)
+    seed_PQ = seed_full[0 : KEM.Nseed]
+    seed_T = seed_full[KEM.Nseed : KEM.Nseed + Group.Nseed]
+
+    # Note that even if expandKey returns the semi-expanded ML-KEM decapsulation
+    # key dk_PQ to use FIPS 203 definitions, that format should be avoided and
+    # instead seed_PQ should be expanded directly into the implementation's
+    # internal ML-KEM private representation.
+    (ek_PQ, dk_PQ) = ML-KEM.KeyGen_internal(seed_PQ)
+    dk_T = Group.RandomScalar(seed_T)
+    ek_T = Group.Exp(Group.G, dk_T)
+
+    return (ek_PQ, ek_T, dk_PQ, dk_T)
+```
+
+There is no distinction between a private/public key and its serialization:
+there is no abstract key format, only byte strings. In practice, implementations
+will probably want to load keys into pairs of internal representations, and
+serialize them back to their byte string format when needed.
+
+The IETF/IRTF documents lack a specified way to turn a private key into public
+key, although it can be inferred from the key generation process. We define such
+a process here as `PrivateKeyToPublicKey`.
+
+```
+def PrivateKeyToPublicKey(seed):
+    ek_PQ, ek_T, _, _ = expandKey(seed)
+    ek = ek_PQ || ek_T
+
+    return ek
+```
+
+## Group definitions
+
+### Curve25519
+
+Group.Exp is the X25519 function defined in [RFC 7748][].
+
+Group.G is the canonical generator, which encodes to
+
+    0900000000000000000000000000000000000000000000000000000000000000
+
+consistently with [RFC 7748, Section 4.1][] and [RFC 7748, Section 6.1][].
+
+Group.RandomScalar and Group.ElementToSharedSecret are the identity.
+
+### P-256 and P-384
+
+The NIST P-256 and P-384 elliptic curves are defined in [SP800-186][].
+
+`Group.Exp(p, x)` computes scalar multiplication between the input element p and
+the scalar x. The input element p and the output element have length Group.Nelem
+and are encoded in uncompressed representation using the
+Elliptic-Curve-Point-to-Octet-String and Octet-String-to-Elliptic-Curve-Point
+functions defined in [SEC 1, Version 2.0][]. The input scalar x has length
+Group.Nscalar and is encoded in big-endian representation using the I2OSP and
+OS2IP functions defined in [RFC 8017][].
+
+Group.G is the canonical generator, which encodes to
+
+    046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29
+    64fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5
+
+for P-256, and to
+
+    04aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab
+    73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f
+
+for P-384, consistently with [SP800-186][], Section 3.2.1.
+
+```
+def RandomScalar(seed):
+    start = 0
+    end = Nscalar
+    sk = seed[start : end]
+    while OS2IP(sk) == 0 || OS2IP(sk) >= OS2IP(Group.N):
+        start = end
+        end = end + Nscalar
+        if end > len(seed):
+            # This happens with cryptographically negligible probability.
+            # The chance of a single rejection is < 2^-32 for P-256 and
+            # < 2^-192 for P-384. The chance of reaching this is thus
+            # < 2^-128 for P-256 and < 2^-192 for P-384.
+            raise Exception("Rejection sampling failed")
+        sk = seed[start : end]
+    return sk
+```
+
+Group.N is the order of the curve's group, which encodes to
+
+    ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
+
+for P-256, and to
+
+    ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973
+
+for P-384, consistently with [SP800-186][], Section 3.2.1.
+
+Group.ElementToSharedSecret encodes the input element as an X coordinate using
+the Field-Element-to-Octet-String function in [SEC 1, Version 2.0][].
+
+> Note that since the scalar x is always derived uniformly at random, the chance
+> of it being zero are cryptographically negligible. Moreover,
+> Octet-String-to-Elliptic-Curve-Point never decodes the point at infinity from
+> a string of Group.Nelem bytes. Since NIST P curves have prime order, this
+> means that the output of Group.Exp and input to Group.ElementToSharedSecret is
+> also never the point at infinity.
+
+## SHAKE256.LabeledDerive
+
+SHAKE256.LabeledDerive is used by DeriveKeyPair, and is part of the single-stage
+KDF specified across [draft-ietf-hpke-hpke-02][] and [draft-ietf-hpke-pq-03][],
+but is reproduced below for convenience.
+
+```
+def SHAKE256.LabeledDerive(ikm, label, context, L):
+    suite_id = concat("KEM", I2OSP(kem_id, 2))
+    prefixed_label = I2OSP(len(label), 2) || label
+    labeled_ikm = ikm || "HPKE-v1" || suite_id || prefixed_label || I2OSP(L, 2) || context
+    return SHAKE256(labeled_ikm, L)
+```
+
+I2OSP is defined in [RFC 8017][], and `kem_id` is the KEM identifier.
+
+[draft-ietf-hpke-hpke-02]: https://datatracker.ietf.org/doc/html/draft-ietf-hpke-hpke-02
+[draft-ietf-hpke-pq-03]: https://datatracker.ietf.org/doc/html/draft-ietf-hpke-pq-03
+[draft-irtf-cfrg-hybrid-kems-07]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hybrid-kems-07
+[draft-irtf-cfrg-concrete-hybrid-kems-02]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-concrete-hybrid-kems-02
+[RFC 7748]: https://rfc-editor.org/rfc/rfc7748.html
+[RFC 7748, Section 4.1]: https://rfc-editor.org/rfc/rfc7748.html#section-4.1
+[RFC 7748, Section 6.1]: https://rfc-editor.org/rfc/rfc7748.html#section-6.1
+[RFC 8017]: https://datatracker.ietf.org/doc/html/rfc8017
+[FIPS 202]: https://doi.org/10.6028/NIST.FIPS.202
+[FIPS 203]: https://doi.org/10.6028/NIST.FIPS.203
+[SP800-186]: https://doi.org/10.6028/NIST.SP.800-186
+[SEC 1, Version 2.0]: https://www.secg.org/sec1-v2.pdf

vendor/filippo.io/hpke/hpke.go

@@ -0,0 +1,263 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package hpke implements Hybrid Public Key Encryption (HPKE) as defined in
+// [RFC 9180].
+//
+// [RFC 9180]: https://www.rfc-editor.org/rfc/rfc9180.html
+package hpke
+
+import (
+	"crypto/cipher"
+	"errors"
+
+	"filippo.io/hpke/internal/byteorder"
+)
+
+type context struct {
+	suiteID []byte
+
+	export func(string, uint16) ([]byte, error)
+
+	aead      cipher.AEAD
+	baseNonce []byte
+	// seqNum starts at zero and is incremented for each Seal/Open call.
+	// 64 bits are enough not to overflow for 500 years at 1ns per operation.
+	seqNum uint64
+}
+
+// Sender is a sending HPKE context. It is instantiated with a specific KEM
+// encapsulation key (i.e. the public key), and it is stateful, incrementing the
+// nonce counter for each [Sender.Seal] call.
+type Sender struct {
+	*context
+}
+
+// Recipient is a receiving HPKE context. It is instantiated with a specific KEM
+// decapsulation key (i.e. the secret key), and it is stateful, incrementing the
+// nonce counter for each successful [Recipient.Open] call.
+type Recipient struct {
+	*context
+}
+
+func newContext(sharedSecret []byte, kemID uint16, kdf KDF, aead AEAD, info []byte) (*context, error) {
+	sid := suiteID(kemID, kdf.ID(), aead.ID())
+
+	if kdf.oneStage() {
+		secrets := make([]byte, 0, 2+2+len(sharedSecret))
+		secrets = byteorder.BEAppendUint16(secrets, 0) // empty psk
+		secrets = byteorder.BEAppendUint16(secrets, uint16(len(sharedSecret)))
+		secrets = append(secrets, sharedSecret...)
+
+		ksContext := make([]byte, 0, 1+2+2+len(info))
+		ksContext = append(ksContext, 0)                   // mode 0
+		ksContext = byteorder.BEAppendUint16(ksContext, 0) // empty psk_id
+		ksContext = byteorder.BEAppendUint16(ksContext, uint16(len(info)))
+		ksContext = append(ksContext, info...)
+
+		secret, err := kdf.labeledDerive(sid, secrets, "secret", ksContext,
+			uint16(aead.keySize()+aead.nonceSize()+kdf.size()))
+		if err != nil {
+			return nil, err
+		}
+		key := secret[:aead.keySize()]
+		baseNonce := secret[aead.keySize() : aead.keySize()+aead.nonceSize()]
+		expSecret := secret[aead.keySize()+aead.nonceSize():]
+
+		a, err := aead.aead(key)
+		if err != nil {
+			return nil, err
+		}
+		export := func(exporterContext string, length uint16) ([]byte, error) {
+			return kdf.labeledDerive(sid, expSecret, "sec", []byte(exporterContext), length)
+		}
+
+		return &context{
+			aead:      a,
+			suiteID:   sid,
+			export:    export,
+			baseNonce: baseNonce,
+		}, nil
+	}
+
+	pskIDHash, err := kdf.labeledExtract(sid, nil, "psk_id_hash", nil)
+	if err != nil {
+		return nil, err
+	}
+	infoHash, err := kdf.labeledExtract(sid, nil, "info_hash", info)
+	if err != nil {
+		return nil, err
+	}
+	ksContext := append([]byte{0}, pskIDHash...)
+	ksContext = append(ksContext, infoHash...)
+
+	secret, err := kdf.labeledExtract(sid, sharedSecret, "secret", nil)
+	if err != nil {
+		return nil, err
+	}
+	key, err := kdf.labeledExpand(sid, secret, "key", ksContext, uint16(aead.keySize()))
+	if err != nil {
+		return nil, err
+	}
+	a, err := aead.aead(key)
+	if err != nil {
+		return nil, err
+	}
+	baseNonce, err := kdf.labeledExpand(sid, secret, "base_nonce", ksContext, uint16(aead.nonceSize()))
+	if err != nil {
+		return nil, err
+	}
+	expSecret, err := kdf.labeledExpand(sid, secret, "exp", ksContext, uint16(kdf.size()))
+	if err != nil {
+		return nil, err
+	}
+	export := func(exporterContext string, length uint16) ([]byte, error) {
+		return kdf.labeledExpand(sid, expSecret, "sec", []byte(exporterContext), length)
+	}
+
+	return &context{
+		aead:      a,
+		suiteID:   sid,
+		export:    export,
+		baseNonce: baseNonce,
+	}, nil
+}
+
+// NewSender returns a sending HPKE context for the provided KEM encapsulation
+// key (i.e. the public key), and using the ciphersuite defined by the
+// combination of KEM, KDF, and AEAD.
+//
+// The info parameter is additional public information that must match between
+// sender and recipient.
+//
+// The returned enc ciphertext can be used to instantiate a matching receiving
+// HPKE context with the corresponding KEM decapsulation key.
+func NewSender(pk PublicKey, kdf KDF, aead AEAD, info []byte) (enc []byte, s *Sender, err error) {
+	sharedSecret, encapsulatedKey, err := pk.encap()
+	if err != nil {
+		return nil, nil, err
+	}
+	context, err := newContext(sharedSecret, pk.KEM().ID(), kdf, aead, info)
+	if err != nil {
+		return nil, nil, err
+	}
+	return encapsulatedKey, &Sender{context}, nil
+}
+
+// NewRecipient returns a receiving HPKE context for the provided KEM
+// decapsulation key (i.e. the secret key), and using the ciphersuite defined by
+// the combination of KEM, KDF, and AEAD.
+//
+// The enc parameter must have been produced by a matching sending HPKE context
+// with the corresponding KEM encapsulation key. The info parameter is
+// additional public information that must match between sender and recipient.
+func NewRecipient(enc []byte, k PrivateKey, kdf KDF, aead AEAD, info []byte) (*Recipient, error) {
+	sharedSecret, err := k.decap(enc)
+	if err != nil {
+		return nil, err
+	}
+	context, err := newContext(sharedSecret, k.KEM().ID(), kdf, aead, info)
+	if err != nil {
+		return nil, err
+	}
+	return &Recipient{context}, nil
+}
+
+// Seal encrypts the provided plaintext, optionally binding to the additional
+// public data aad.
+//
+// Seal uses incrementing counters for each call, and Open on the receiving side
+// must be called in the same order as Seal.
+func (s *Sender) Seal(aad, plaintext []byte) ([]byte, error) {
+	if s.aead == nil {
+		return nil, errors.New("export-only instantiation")
+	}
+	ciphertext := s.aead.Seal(nil, s.nextNonce(), plaintext, aad)
+	s.seqNum++
+	return ciphertext, nil
+}
+
+// Seal instantiates a single-use HPKE sending HPKE context like [NewSender],
+// and then encrypts the provided plaintext like [Sender.Seal] (with no aad).
+// Seal returns the concatenation of the encapsulated key and the ciphertext.
+func Seal(pk PublicKey, kdf KDF, aead AEAD, info, plaintext []byte) ([]byte, error) {
+	enc, s, err := NewSender(pk, kdf, aead, info)
+	if err != nil {
+		return nil, err
+	}
+	ct, err := s.Seal(nil, plaintext)
+	if err != nil {
+		return nil, err
+	}
+	return append(enc, ct...), nil
+}
+
+// Export produces a secret value derived from the shared key between sender and
+// recipient. length must be at most 65,535.
+func (s *Sender) Export(exporterContext string, length int) ([]byte, error) {
+	if length < 0 || length > 0xFFFF {
+		return nil, errors.New("invalid length")
+	}
+	return s.export(exporterContext, uint16(length))
+}
+
+// Open decrypts the provided ciphertext, optionally binding to the additional
+// public data aad, or returns an error if decryption fails.
+//
+// Open uses incrementing counters for each successful call, and must be called
+// in the same order as Seal on the sending side.
+func (r *Recipient) Open(aad, ciphertext []byte) ([]byte, error) {
+	if r.aead == nil {
+		return nil, errors.New("export-only instantiation")
+	}
+	plaintext, err := r.aead.Open(nil, r.nextNonce(), ciphertext, aad)
+	if err != nil {
+		return nil, err
+	}
+	r.seqNum++
+	return plaintext, nil
+}
+
+// Open instantiates a single-use HPKE receiving HPKE context like [NewRecipient],
+// and then decrypts the provided ciphertext like [Recipient.Open] (with no aad).
+// ciphertext must be the concatenation of the encapsulated key and the actual ciphertext.
+func Open(k PrivateKey, kdf KDF, aead AEAD, info, ciphertext []byte) ([]byte, error) {
+	encSize := k.KEM().encSize()
+	if len(ciphertext) < encSize {
+		return nil, errors.New("ciphertext too short")
+	}
+	enc, ciphertext := ciphertext[:encSize], ciphertext[encSize:]
+	r, err := NewRecipient(enc, k, kdf, aead, info)
+	if err != nil {
+		return nil, err
+	}
+	return r.Open(nil, ciphertext)
+}
+
+// Export produces a secret value derived from the shared key between sender and
+// recipient. length must be at most 65,535.
+func (r *Recipient) Export(exporterContext string, length int) ([]byte, error) {
+	if length < 0 || length > 0xFFFF {
+		return nil, errors.New("invalid length")
+	}
+	return r.export(exporterContext, uint16(length))
+}
+
+func (ctx *context) nextNonce() []byte {
+	nonce := make([]byte, ctx.aead.NonceSize())
+	byteorder.BEPutUint64(nonce[len(nonce)-8:], ctx.seqNum)
+	for i := range ctx.baseNonce {
+		nonce[i] ^= ctx.baseNonce[i]
+	}
+	return nonce
+}
+
+func suiteID(kemID, kdfID, aeadID uint16) []byte {
+	suiteID := make([]byte, 0, 4+2+2+2)
+	suiteID = append(suiteID, []byte("HPKE")...)
+	suiteID = byteorder.BEAppendUint16(suiteID, kemID)
+	suiteID = byteorder.BEAppendUint16(suiteID, kdfID)
+	suiteID = byteorder.BEAppendUint16(suiteID, aeadID)
+	return suiteID
+}

vendor/filippo.io/hpke/internal/byteorder/byteorder.go

@@ -0,0 +1,149 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package byteorder provides functions for decoding and encoding
+// little and big endian integer types from/to byte slices.
+package byteorder
+
+func LEUint16(b []byte) uint16 {
+	_ = b[1] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint16(b[0]) | uint16(b[1])<<8
+}
+
+func LEPutUint16(b []byte, v uint16) {
+	_ = b[1] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v)
+	b[1] = byte(v >> 8)
+}
+
+func LEAppendUint16(b []byte, v uint16) []byte {
+	return append(b,
+		byte(v),
+		byte(v>>8),
+	)
+}
+
+func LEUint32(b []byte) uint32 {
+	_ = b[3] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint32(b[0]) | uint32(b[1])<<8 | uint32(b[2])<<16 | uint32(b[3])<<24
+}
+
+func LEPutUint32(b []byte, v uint32) {
+	_ = b[3] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v)
+	b[1] = byte(v >> 8)
+	b[2] = byte(v >> 16)
+	b[3] = byte(v >> 24)
+}
+
+func LEAppendUint32(b []byte, v uint32) []byte {
+	return append(b,
+		byte(v),
+		byte(v>>8),
+		byte(v>>16),
+		byte(v>>24),
+	)
+}
+
+func LEUint64(b []byte) uint64 {
+	_ = b[7] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint64(b[0]) | uint64(b[1])<<8 | uint64(b[2])<<16 | uint64(b[3])<<24 |
+		uint64(b[4])<<32 | uint64(b[5])<<40 | uint64(b[6])<<48 | uint64(b[7])<<56
+}
+
+func LEPutUint64(b []byte, v uint64) {
+	_ = b[7] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v)
+	b[1] = byte(v >> 8)
+	b[2] = byte(v >> 16)
+	b[3] = byte(v >> 24)
+	b[4] = byte(v >> 32)
+	b[5] = byte(v >> 40)
+	b[6] = byte(v >> 48)
+	b[7] = byte(v >> 56)
+}
+
+func LEAppendUint64(b []byte, v uint64) []byte {
+	return append(b,
+		byte(v),
+		byte(v>>8),
+		byte(v>>16),
+		byte(v>>24),
+		byte(v>>32),
+		byte(v>>40),
+		byte(v>>48),
+		byte(v>>56),
+	)
+}
+
+func BEUint16(b []byte) uint16 {
+	_ = b[1] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint16(b[1]) | uint16(b[0])<<8
+}
+
+func BEPutUint16(b []byte, v uint16) {
+	_ = b[1] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v >> 8)
+	b[1] = byte(v)
+}
+
+func BEAppendUint16(b []byte, v uint16) []byte {
+	return append(b,
+		byte(v>>8),
+		byte(v),
+	)
+}
+
+func BEUint32(b []byte) uint32 {
+	_ = b[3] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint32(b[3]) | uint32(b[2])<<8 | uint32(b[1])<<16 | uint32(b[0])<<24
+}
+
+func BEPutUint32(b []byte, v uint32) {
+	_ = b[3] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v >> 24)
+	b[1] = byte(v >> 16)
+	b[2] = byte(v >> 8)
+	b[3] = byte(v)
+}
+
+func BEAppendUint32(b []byte, v uint32) []byte {
+	return append(b,
+		byte(v>>24),
+		byte(v>>16),
+		byte(v>>8),
+		byte(v),
+	)
+}
+
+func BEUint64(b []byte) uint64 {
+	_ = b[7] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint64(b[7]) | uint64(b[6])<<8 | uint64(b[5])<<16 | uint64(b[4])<<24 |
+		uint64(b[3])<<32 | uint64(b[2])<<40 | uint64(b[1])<<48 | uint64(b[0])<<56
+}
+
+func BEPutUint64(b []byte, v uint64) {
+	_ = b[7] // early bounds check to guarantee safety of writes below
+	b[0] = byte(v >> 56)
+	b[1] = byte(v >> 48)
+	b[2] = byte(v >> 40)
+	b[3] = byte(v >> 32)
+	b[4] = byte(v >> 24)
+	b[5] = byte(v >> 16)
+	b[6] = byte(v >> 8)
+	b[7] = byte(v)
+}
+
+func BEAppendUint64(b []byte, v uint64) []byte {
+	return append(b,
+		byte(v>>56),
+		byte(v>>48),
+		byte(v>>40),
+		byte(v>>32),
+		byte(v>>24),
+		byte(v>>16),
+		byte(v>>8),
+		byte(v),
+	)
+}

vendor/filippo.io/hpke/kdf.go

@@ -0,0 +1,156 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package hpke
+
+import (
+	"crypto/hkdf"
+	"crypto/sha256"
+	"crypto/sha3"
+	"crypto/sha512"
+	"errors"
+	"fmt"
+	"hash"
+
+	"filippo.io/hpke/internal/byteorder"
+)
+
+// The KDF is one of the three components of an HPKE ciphersuite, implementing
+// key derivation.
+type KDF interface {
+	ID() uint16
+	oneStage() bool
+	size() int // Nh
+	labeledDerive(suiteID, inputKey []byte, label string, context []byte, length uint16) ([]byte, error)
+	labeledExtract(suiteID, salt []byte, label string, inputKey []byte) ([]byte, error)
+	labeledExpand(suiteID, randomKey []byte, label string, info []byte, length uint16) ([]byte, error)
+}
+
+// NewKDF returns the KDF implementation for the given KDF ID.
+//
+// Applications are encouraged to use specific implementations like [HKDFSHA256]
+// instead, unless runtime agility is required.
+func NewKDF(id uint16) (KDF, error) {
+	switch id {
+	case 0x0001: // HKDF-SHA256
+		return HKDFSHA256(), nil
+	case 0x0002: // HKDF-SHA384
+		return HKDFSHA384(), nil
+	case 0x0003: // HKDF-SHA512
+		return HKDFSHA512(), nil
+	case 0x0010: // SHAKE128
+		return SHAKE128(), nil
+	case 0x0011: // SHAKE256
+		return SHAKE256(), nil
+	default:
+		return nil, fmt.Errorf("unsupported KDF %04x", id)
+	}
+}
+
+// HKDFSHA256 returns an HKDF-SHA256 KDF implementation.
+func HKDFSHA256() KDF { return hkdfSHA256 }
+
+// HKDFSHA384 returns an HKDF-SHA384 KDF implementation.
+func HKDFSHA384() KDF { return hkdfSHA384 }
+
+// HKDFSHA512 returns an HKDF-SHA512 KDF implementation.
+func HKDFSHA512() KDF { return hkdfSHA512 }
+
+type hkdfKDF struct {
+	hash func() hash.Hash
+	id   uint16
+	nH   int
+}
+
+var hkdfSHA256 = &hkdfKDF{hash: sha256.New, id: 0x0001, nH: sha256.Size}
+var hkdfSHA384 = &hkdfKDF{hash: sha512.New384, id: 0x0002, nH: sha512.Size384}
+var hkdfSHA512 = &hkdfKDF{hash: sha512.New, id: 0x0003, nH: sha512.Size}
+
+func (kdf *hkdfKDF) ID() uint16 {
+	return kdf.id
+}
+
+func (kdf *hkdfKDF) size() int {
+	return kdf.nH
+}
+
+func (kdf *hkdfKDF) oneStage() bool {
+	return false
+}
+
+func (kdf *hkdfKDF) labeledDerive(_, _ []byte, _ string, _ []byte, _ uint16) ([]byte, error) {
+	return nil, errors.New("hpke: internal error: labeledDerive called on two-stage KDF")
+}
+
+func (kdf *hkdfKDF) labeledExtract(suiteID []byte, salt []byte, label string, inputKey []byte) ([]byte, error) {
+	labeledIKM := make([]byte, 0, 7+len(suiteID)+len(label)+len(inputKey))
+	labeledIKM = append(labeledIKM, []byte("HPKE-v1")...)
+	labeledIKM = append(labeledIKM, suiteID...)
+	labeledIKM = append(labeledIKM, label...)
+	labeledIKM = append(labeledIKM, inputKey...)
+	return hkdf.Extract(kdf.hash, labeledIKM, salt)
+}
+
+func (kdf *hkdfKDF) labeledExpand(suiteID []byte, randomKey []byte, label string, info []byte, length uint16) ([]byte, error) {
+	labeledInfo := make([]byte, 0, 2+7+len(suiteID)+len(label)+len(info))
+	labeledInfo = byteorder.BEAppendUint16(labeledInfo, length)
+	labeledInfo = append(labeledInfo, []byte("HPKE-v1")...)
+	labeledInfo = append(labeledInfo, suiteID...)
+	labeledInfo = append(labeledInfo, label...)
+	labeledInfo = append(labeledInfo, info...)
+	return hkdf.Expand(kdf.hash, randomKey, string(labeledInfo), int(length))
+}
+
+// SHAKE128 returns a SHAKE128 KDF implementation.
+func SHAKE128() KDF {
+	return shake128KDF
+}
+
+// SHAKE256 returns a SHAKE256 KDF implementation.
+func SHAKE256() KDF {
+	return shake256KDF
+}
+
+type shakeKDF struct {
+	hash func() *sha3.SHAKE
+	id   uint16
+	nH   int
+}
+
+var shake128KDF = &shakeKDF{hash: sha3.NewSHAKE128, id: 0x0010, nH: 32}
+var shake256KDF = &shakeKDF{hash: sha3.NewSHAKE256, id: 0x0011, nH: 64}
+
+func (kdf *shakeKDF) ID() uint16 {
+	return kdf.id
+}
+
+func (kdf *shakeKDF) size() int {
+	return kdf.nH
+}
+
+func (kdf *shakeKDF) oneStage() bool {
+	return true
+}
+
+func (kdf *shakeKDF) labeledDerive(suiteID, inputKey []byte, label string, context []byte, length uint16) ([]byte, error) {
+	H := kdf.hash()
+	H.Write(inputKey)
+	H.Write([]byte("HPKE-v1"))
+	H.Write(suiteID)
+	H.Write([]byte{byte(len(label) >> 8), byte(len(label))})
+	H.Write([]byte(label))
+	H.Write([]byte{byte(length >> 8), byte(length)})
+	H.Write(context)
+	out := make([]byte, length)
+	H.Read(out)
+	return out, nil
+}
+
+func (kdf *shakeKDF) labeledExtract(_, _ []byte, _ string, _ []byte) ([]byte, error) {
+	return nil, errors.New("hpke: internal error: labeledExtract called on one-stage KDF")
+}
+
+func (kdf *shakeKDF) labeledExpand(_, _ []byte, _ string, _ []byte, _ uint16) ([]byte, error) {
+	return nil, errors.New("hpke: internal error: labeledExpand called on one-stage KDF")
+}

vendor/filippo.io/hpke/kem.go

@@ -0,0 +1,383 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package hpke
+
+import (
+	"crypto/rand"
+	"errors"
+
+	"filippo.io/hpke/crypto/ecdh"
+	"filippo.io/hpke/internal/byteorder"
+)
+
+// A KEM is a Key Encapsulation Mechanism, one of the three components of an
+// HPKE ciphersuite.
+type KEM interface {
+	// ID returns the HPKE KEM identifier.
+	ID() uint16
+
+	// GenerateKey generates a new key pair.
+	GenerateKey() (PrivateKey, error)
+
+	// NewPublicKey deserializes a public key from bytes.
+	//
+	// It implements DeserializePublicKey, as defined in RFC 9180.
+	NewPublicKey([]byte) (PublicKey, error)
+
+	// NewPrivateKey deserializes a private key from bytes.
+	//
+	// It implements DeserializePrivateKey, as defined in RFC 9180.
+	NewPrivateKey([]byte) (PrivateKey, error)
+
+	// DeriveKeyPair derives a key pair from the given input keying material.
+	//
+	// It implements DeriveKeyPair, as defined in RFC 9180.
+	DeriveKeyPair(ikm []byte) (PrivateKey, error)
+
+	encSize() int
+}
+
+// NewKEM returns the KEM implementation for the given KEM ID.
+//
+// Applications are encouraged to use specific implementations like [DHKEM] or
+// [MLKEM768X25519] instead, unless runtime agility is required.
+func NewKEM(id uint16) (KEM, error) {
+	switch id {
+	case 0x0010: // DHKEM(P-256, HKDF-SHA256)
+		return DHKEM(ecdh.P256()), nil
+	case 0x0011: // DHKEM(P-384, HKDF-SHA384)
+		return DHKEM(ecdh.P384()), nil
+	case 0x0012: // DHKEM(P-521, HKDF-SHA512)
+		return DHKEM(ecdh.P521()), nil
+	case 0x0020: // DHKEM(X25519, HKDF-SHA256)
+		return DHKEM(ecdh.X25519()), nil
+	case 0x0041: // ML-KEM-768
+		return MLKEM768(), nil
+	case 0x0042: // ML-KEM-1024
+		return MLKEM1024(), nil
+	case 0x647a: // MLKEM768-X25519
+		return MLKEM768X25519(), nil
+	case 0x0050: // MLKEM768-P256
+		return MLKEM768P256(), nil
+	case 0x0051: // MLKEM1024-P384
+		return MLKEM1024P384(), nil
+	default:
+		return nil, errors.New("unsupported KEM")
+	}
+}
+
+// A PublicKey is an instantiation of a KEM (one of the three components of an
+// HPKE ciphersuite) with an encapsulation key (i.e. the public key).
+//
+// A PublicKey is usually obtained from a method of the corresponding [KEM] or
+// [PrivateKey], such as [KEM.NewPublicKey] or [PrivateKey.PublicKey].
+type PublicKey interface {
+	// KEM returns the instantiated KEM.
+	KEM() KEM
+
+	// Bytes returns the public key as the output of SerializePublicKey.
+	Bytes() []byte
+
+	encap() (sharedSecret, enc []byte, err error)
+}
+
+// A PrivateKey is an instantiation of a KEM (one of the three components of
+// an HPKE ciphersuite) with a decapsulation key (i.e. the secret key).
+//
+// A PrivateKey is usually obtained from a method of the corresponding [KEM],
+// such as [KEM.GenerateKey] or [KEM.NewPrivateKey].
+type PrivateKey interface {
+	// KEM returns the instantiated KEM.
+	KEM() KEM
+
+	// Bytes returns the private key as the output of SerializePrivateKey, as
+	// defined in RFC 9180.
+	//
+	// Note that for X25519 this might not match the input to NewPrivateKey.
+	// This is a requirement of RFC 9180, Section 7.1.2.
+	Bytes() ([]byte, error)
+
+	// PublicKey returns the corresponding PublicKey.
+	PublicKey() PublicKey
+
+	decap(enc []byte) (sharedSecret []byte, err error)
+}
+
+type dhKEM struct {
+	kdf     KDF
+	id      uint16
+	curve   ecdh.Curve
+	Nsecret uint16
+	Nsk     uint16
+	Nenc    int
+}
+
+func (kem *dhKEM) extractAndExpand(dhKey, kemContext []byte) ([]byte, error) {
+	suiteID := byteorder.BEAppendUint16([]byte("KEM"), kem.id)
+	eaePRK, err := kem.kdf.labeledExtract(suiteID, nil, "eae_prk", dhKey)
+	if err != nil {
+		return nil, err
+	}
+	return kem.kdf.labeledExpand(suiteID, eaePRK, "shared_secret", kemContext, kem.Nsecret)
+}
+
+func (kem *dhKEM) ID() uint16 {
+	return kem.id
+}
+
+func (kem *dhKEM) encSize() int {
+	return kem.Nenc
+}
+
+var dhKEMP256 = &dhKEM{HKDFSHA256(), 0x0010, ecdh.P256(), 32, 32, 65}
+var dhKEMP384 = &dhKEM{HKDFSHA384(), 0x0011, ecdh.P384(), 48, 48, 97}
+var dhKEMP521 = &dhKEM{HKDFSHA512(), 0x0012, ecdh.P521(), 64, 66, 133}
+var dhKEMX25519 = &dhKEM{HKDFSHA256(), 0x0020, ecdh.X25519(), 32, 32, 32}
+
+// DHKEM returns a KEM implementing one of
+//
+//   - DHKEM(P-256, HKDF-SHA256)
+//   - DHKEM(P-384, HKDF-SHA384)
+//   - DHKEM(P-521, HKDF-SHA512)
+//   - DHKEM(X25519, HKDF-SHA256)
+//
+// depending on curve.
+func DHKEM(curve ecdh.Curve) KEM {
+	switch curve {
+	case ecdh.P256():
+		return dhKEMP256
+	case ecdh.P384():
+		return dhKEMP384
+	case ecdh.P521():
+		return dhKEMP521
+	case ecdh.X25519():
+		return dhKEMX25519
+	default:
+		// The set of ecdh.Curve implementations is closed, because the
+		// interface has unexported methods. Therefore, this default case is
+		// only hit if a new curve is added that DHKEM doesn't support.
+		return unsupportedCurveKEM{}
+	}
+}
+
+type unsupportedCurveKEM struct{}
+
+func (unsupportedCurveKEM) ID() uint16 {
+	return 0
+}
+func (unsupportedCurveKEM) GenerateKey() (PrivateKey, error) {
+	return nil, errors.New("unsupported curve")
+}
+func (unsupportedCurveKEM) NewPublicKey([]byte) (PublicKey, error) {
+	return nil, errors.New("unsupported curve")
+}
+func (unsupportedCurveKEM) NewPrivateKey([]byte) (PrivateKey, error) {
+	return nil, errors.New("unsupported curve")
+}
+func (unsupportedCurveKEM) DeriveKeyPair([]byte) (PrivateKey, error) {
+	return nil, errors.New("unsupported curve")
+}
+func (unsupportedCurveKEM) encSize() int {
+	return 0
+}
+
+type dhKEMPublicKey struct {
+	kem *dhKEM
+	pub *ecdh.PublicKey
+}
+
+// NewDHKEMPublicKey returns a PublicKey implementing
+//
+//   - DHKEM(P-256, HKDF-SHA256)
+//   - DHKEM(P-384, HKDF-SHA384)
+//   - DHKEM(P-521, HKDF-SHA512)
+//   - DHKEM(X25519, HKDF-SHA256)
+//
+// depending on the underlying curve of pub ([ecdh.X25519], [ecdh.P256],
+// [ecdh.P384], or [ecdh.P521]).
+//
+// This function is meant for applications that already have an instantiated
+// crypto/ecdh public key. Otherwise, applications should use the
+// [KEM.NewPublicKey] method of [DHKEM].
+func NewDHKEMPublicKey(pub *ecdh.PublicKey) (PublicKey, error) {
+	kem, ok := DHKEM(pub.Curve()).(*dhKEM)
+	if !ok {
+		return nil, errors.New("unsupported curve")
+	}
+	return &dhKEMPublicKey{
+		kem: kem,
+		pub: pub,
+	}, nil
+}
+
+func (kem *dhKEM) NewPublicKey(data []byte) (PublicKey, error) {
+	pub, err := kem.curve.NewPublicKey(data)
+	if err != nil {
+		return nil, err
+	}
+	return NewDHKEMPublicKey(pub)
+}
+
+func (pk *dhKEMPublicKey) KEM() KEM {
+	return pk.kem
+}
+
+func (pk *dhKEMPublicKey) Bytes() []byte {
+	return pk.pub.Bytes()
+}
+
+// testingOnlyGenerateKey is only used during testing, to provide
+// a fixed test key to use when checking the RFC 9180 vectors.
+var testingOnlyGenerateKey func() *ecdh.PrivateKey
+
+func (pk *dhKEMPublicKey) encap() (sharedSecret []byte, encapPub []byte, err error) {
+	privEph, err := pk.pub.Curve().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	if testingOnlyGenerateKey != nil {
+		privEph = testingOnlyGenerateKey()
+	}
+	dhVal, err := privEph.ECDH(pk.pub)
+	if err != nil {
+		return nil, nil, err
+	}
+	encPubEph := privEph.PublicKey().Bytes()
+
+	encPubRecip := pk.pub.Bytes()
+	kemContext := append(encPubEph, encPubRecip...)
+	sharedSecret, err = pk.kem.extractAndExpand(dhVal, kemContext)
+	if err != nil {
+		return nil, nil, err
+	}
+	return sharedSecret, encPubEph, nil
+}
+
+type dhKEMPrivateKey struct {
+	kem  *dhKEM
+	priv ecdh.KeyExchanger
+}
+
+// NewDHKEMPrivateKey returns a PrivateKey implementing
+//
+//   - DHKEM(P-256, HKDF-SHA256)
+//   - DHKEM(P-384, HKDF-SHA384)
+//   - DHKEM(P-521, HKDF-SHA512)
+//   - DHKEM(X25519, HKDF-SHA256)
+//
+// depending on the underlying curve of priv ([ecdh.X25519], [ecdh.P256],
+// [ecdh.P384], or [ecdh.P521]).
+//
+// This function is meant for applications that already have an instantiated
+// crypto/ecdh private key, or another implementation of a [ecdh.KeyExchanger]
+// (e.g. a hardware key). Otherwise, applications should use the
+// [KEM.NewPrivateKey] method of [DHKEM].
+func NewDHKEMPrivateKey(priv ecdh.KeyExchanger) (PrivateKey, error) {
+	kem, ok := DHKEM(priv.Curve()).(*dhKEM)
+	if !ok {
+		return nil, errors.New("unsupported curve")
+	}
+	return &dhKEMPrivateKey{
+		kem:  kem,
+		priv: priv,
+	}, nil
+}
+
+func (kem *dhKEM) GenerateKey() (PrivateKey, error) {
+	priv, err := kem.curve.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return NewDHKEMPrivateKey(priv)
+}
+
+func (kem *dhKEM) NewPrivateKey(ikm []byte) (PrivateKey, error) {
+	priv, err := kem.curve.NewPrivateKey(ikm)
+	if err != nil {
+		return nil, err
+	}
+	return NewDHKEMPrivateKey(priv)
+}
+
+func (kem *dhKEM) DeriveKeyPair(ikm []byte) (PrivateKey, error) {
+	// DeriveKeyPair from RFC 9180 Section 7.1.3.
+	suiteID := byteorder.BEAppendUint16([]byte("KEM"), kem.id)
+	prk, err := kem.kdf.labeledExtract(suiteID, nil, "dkp_prk", ikm)
+	if err != nil {
+		return nil, err
+	}
+	if kem == dhKEMX25519 {
+		s, err := kem.kdf.labeledExpand(suiteID, prk, "sk", nil, kem.Nsk)
+		if err != nil {
+			return nil, err
+		}
+		return kem.NewPrivateKey(s)
+	}
+	var counter uint8
+	for counter < 4 {
+		s, err := kem.kdf.labeledExpand(suiteID, prk, "candidate", []byte{counter}, kem.Nsk)
+		if err != nil {
+			return nil, err
+		}
+		if kem == dhKEMP521 {
+			s[0] &= 0x01
+		}
+		r, err := kem.NewPrivateKey(s)
+		if err != nil {
+			counter++
+			continue
+		}
+		return r, nil
+	}
+	panic("chance of four rejections is < 2^-128")
+}
+
+func (k *dhKEMPrivateKey) KEM() KEM {
+	return k.kem
+}
+
+func (k *dhKEMPrivateKey) Bytes() ([]byte, error) {
+	// Bizarrely, RFC 9180, Section 7.1.2 says SerializePrivateKey MUST clamp
+	// the output, which I thought we all agreed to instead do as part of the DH
+	// function, letting private keys be random bytes.
+	//
+	// At the same time, it says DeserializePrivateKey MUST also clamp, implying
+	// that the input doesn't have to be clamped, so Bytes by spec doesn't
+	// necessarily match the NewPrivateKey input.
+	//
+	// I'm sure this will not lead to any unexpected behavior or interop issue.
+	priv, ok := k.priv.(*ecdh.PrivateKey)
+	if !ok {
+		return nil, errors.New("ecdh: private key does not support Bytes")
+	}
+	if k.kem == dhKEMX25519 {
+		b := priv.Bytes()
+		b[0] &= 248
+		b[31] &= 127
+		b[31] |= 64
+		return b, nil
+	}
+	return priv.Bytes(), nil
+}
+
+func (k *dhKEMPrivateKey) PublicKey() PublicKey {
+	return &dhKEMPublicKey{
+		kem: k.kem,
+		pub: k.priv.PublicKey(),
+	}
+}
+
+func (k *dhKEMPrivateKey) decap(encPubEph []byte) ([]byte, error) {
+	pubEph, err := k.priv.Curve().NewPublicKey(encPubEph)
+	if err != nil {
+		return nil, err
+	}
+	dhVal, err := k.priv.ECDH(pubEph)
+	if err != nil {
+		return nil, err
+	}
+	kemContext := append(encPubEph, k.priv.PublicKey().Bytes()...)
+	return k.kem.extractAndExpand(dhVal, kemContext)
+}

vendor/filippo.io/hpke/pq.go

@@ -0,0 +1,535 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package hpke
+
+import (
+	"bytes"
+	"crypto/mlkem"
+	"crypto/rand"
+	"crypto/sha3"
+	"errors"
+
+	"filippo.io/hpke/crypto"
+	"filippo.io/hpke/crypto/ecdh"
+	"filippo.io/hpke/internal/byteorder"
+)
+
+var mlkem768X25519 = &hybridKEM{
+	id: 0x647a,
+	label: /**/ `\./` +
+		/*   */ `/^\`,
+	curve: ecdh.X25519(),
+
+	curveSeedSize:    32,
+	curvePointSize:   32,
+	pqEncapsKeySize:  mlkem.EncapsulationKeySize768,
+	pqCiphertextSize: mlkem.CiphertextSize768,
+
+	pqNewPublicKey: func(data []byte) (crypto.Encapsulator, error) {
+		return mlkem.NewEncapsulationKey768(data)
+	},
+	pqNewPrivateKey: func(data []byte) (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.NewDecapsulationKey768(data))
+	},
+}
+
+// MLKEM768X25519 returns a KEM implementing MLKEM768-X25519 (a.k.a. X-Wing)
+// from draft-ietf-hpke-pq.
+func MLKEM768X25519() KEM {
+	return mlkem768X25519
+}
+
+var mlkem768P256 = &hybridKEM{
+	id:    0x0050,
+	label: "MLKEM768-P256",
+	curve: ecdh.P256(),
+
+	curveSeedSize:    32,
+	curvePointSize:   65,
+	pqEncapsKeySize:  mlkem.EncapsulationKeySize768,
+	pqCiphertextSize: mlkem.CiphertextSize768,
+
+	pqNewPublicKey: func(data []byte) (crypto.Encapsulator, error) {
+		return mlkem.NewEncapsulationKey768(data)
+	},
+	pqNewPrivateKey: func(data []byte) (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.NewDecapsulationKey768(data))
+	},
+}
+
+// MLKEM768P256 returns a KEM implementing MLKEM768-P256 from draft-ietf-hpke-pq.
+func MLKEM768P256() KEM {
+	return mlkem768P256
+}
+
+var mlkem1024P384 = &hybridKEM{
+	id:    0x0051,
+	label: "MLKEM1024-P384",
+	curve: ecdh.P384(),
+
+	curveSeedSize:    48,
+	curvePointSize:   97,
+	pqEncapsKeySize:  mlkem.EncapsulationKeySize1024,
+	pqCiphertextSize: mlkem.CiphertextSize1024,
+
+	pqNewPublicKey: func(data []byte) (crypto.Encapsulator, error) {
+		return mlkem.NewEncapsulationKey1024(data)
+	},
+	pqNewPrivateKey: func(data []byte) (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.NewDecapsulationKey1024(data))
+	},
+}
+
+// MLKEM1024P384 returns a KEM implementing MLKEM1024-P384 from draft-ietf-hpke-pq.
+func MLKEM1024P384() KEM {
+	return mlkem1024P384
+}
+
+type hybridKEM struct {
+	id    uint16
+	label string
+	curve ecdh.Curve
+
+	curveSeedSize    int
+	curvePointSize   int
+	pqEncapsKeySize  int
+	pqCiphertextSize int
+
+	pqNewPublicKey  func(data []byte) (crypto.Encapsulator, error)
+	pqNewPrivateKey func(data []byte) (crypto.Decapsulator, error)
+}
+
+func (kem *hybridKEM) ID() uint16 {
+	return kem.id
+}
+
+func (kem *hybridKEM) encSize() int {
+	return kem.pqCiphertextSize + kem.curvePointSize
+}
+
+func (kem *hybridKEM) sharedSecret(ssPQ, ssT, ctT, ekT []byte) []byte {
+	h := sha3.New256()
+	h.Write(ssPQ)
+	h.Write(ssT)
+	h.Write(ctT)
+	h.Write(ekT)
+	h.Write([]byte(kem.label))
+	return h.Sum(nil)
+}
+
+type hybridPublicKey struct {
+	kem *hybridKEM
+	t   *ecdh.PublicKey
+	pq  crypto.Encapsulator
+}
+
+// NewHybridPublicKey returns a PublicKey implementing one of
+//
+//   - MLKEM768-X25519 (a.k.a. X-Wing)
+//   - MLKEM768-P256
+//   - MLKEM1024-P384
+//
+// from draft-ietf-hpke-pq, depending on the underlying curve of t
+// ([ecdh.X25519], [ecdh.P256], or [ecdh.P384]) and the type of pq (either
+// *[mlkem.EncapsulationKey768] or *[mlkem.EncapsulationKey1024]).
+//
+// This function is meant for applications that already have instantiated
+// crypto/ecdh and crypto/mlkem public keys. Otherwise, applications should use
+// the [KEM.NewPublicKey] method of e.g. [MLKEM768X25519].
+func NewHybridPublicKey(pq crypto.Encapsulator, t *ecdh.PublicKey) (PublicKey, error) {
+	switch t.Curve() {
+	case ecdh.X25519():
+		if _, ok := pq.(*mlkem.EncapsulationKey768); !ok {
+			return nil, errors.New("invalid PQ KEM for X25519 hybrid")
+		}
+		return &hybridPublicKey{mlkem768X25519, t, pq}, nil
+	case ecdh.P256():
+		if _, ok := pq.(*mlkem.EncapsulationKey768); !ok {
+			return nil, errors.New("invalid PQ KEM for P-256 hybrid")
+		}
+		return &hybridPublicKey{mlkem768P256, t, pq}, nil
+	case ecdh.P384():
+		if _, ok := pq.(*mlkem.EncapsulationKey1024); !ok {
+			return nil, errors.New("invalid PQ KEM for P-384 hybrid")
+		}
+		return &hybridPublicKey{mlkem1024P384, t, pq}, nil
+	default:
+		return nil, errors.New("unsupported curve")
+	}
+}
+
+func (kem *hybridKEM) NewPublicKey(data []byte) (PublicKey, error) {
+	if len(data) != kem.pqEncapsKeySize+kem.curvePointSize {
+		return nil, errors.New("invalid public key size")
+	}
+	pq, err := kem.pqNewPublicKey(data[:kem.pqEncapsKeySize])
+	if err != nil {
+		return nil, err
+	}
+	k, err := kem.curve.NewPublicKey(data[kem.pqEncapsKeySize:])
+	if err != nil {
+		return nil, err
+	}
+	return NewHybridPublicKey(pq, k)
+}
+
+func (pk *hybridPublicKey) KEM() KEM {
+	return pk.kem
+}
+
+func (pk *hybridPublicKey) Bytes() []byte {
+	return append(pk.pq.Bytes(), pk.t.Bytes()...)
+}
+
+var testingOnlyEncapsulate func() (ss, ct []byte)
+
+func (pk *hybridPublicKey) encap() (sharedSecret []byte, encapPub []byte, err error) {
+	skE, err := pk.t.Curve().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	if testingOnlyGenerateKey != nil {
+		skE = testingOnlyGenerateKey()
+	}
+	ssT, err := skE.ECDH(pk.t)
+	if err != nil {
+		return nil, nil, err
+	}
+	ctT := skE.PublicKey().Bytes()
+
+	ssPQ, ctPQ := pk.pq.Encapsulate()
+	if testingOnlyEncapsulate != nil {
+		ssPQ, ctPQ = testingOnlyEncapsulate()
+	}
+
+	ss := pk.kem.sharedSecret(ssPQ, ssT, ctT, pk.t.Bytes())
+	ct := append(ctPQ, ctT...)
+	return ss, ct, nil
+}
+
+type hybridPrivateKey struct {
+	kem  *hybridKEM
+	seed []byte // can be nil
+	t    ecdh.KeyExchanger
+	pq   crypto.Decapsulator
+}
+
+// NewHybridPrivateKey returns a PrivateKey implementing
+//
+//   - MLKEM768-X25519 (a.k.a. X-Wing)
+//   - MLKEM768-P256
+//   - MLKEM1024-P384
+//
+// from draft-ietf-hpke-pq, depending on the underlying curve of t
+// ([ecdh.X25519], [ecdh.P256], or [ecdh.P384]) and the type of pq.Encapsulator()
+// (either *[mlkem.EncapsulationKey768] or *[mlkem.EncapsulationKey1024]).
+//
+// This function is meant for applications that already have instantiated
+// crypto/ecdh and crypto/mlkem private keys, or another implementation of a
+// [ecdh.KeyExchanger] and [crypto.Decapsulator] (e.g. a hardware key).
+// Otherwise, applications should use the [KEM.NewPrivateKey] method of e.g.
+// [MLKEM768X25519].
+func NewHybridPrivateKey(pq crypto.Decapsulator, t ecdh.KeyExchanger) (PrivateKey, error) {
+	return newHybridPrivateKey(pq, t, nil)
+}
+
+func (kem *hybridKEM) GenerateKey() (PrivateKey, error) {
+	seed := make([]byte, 32)
+	rand.Read(seed)
+	return kem.NewPrivateKey(seed)
+}
+
+func (kem *hybridKEM) NewPrivateKey(priv []byte) (PrivateKey, error) {
+	if len(priv) != 32 {
+		return nil, errors.New("hpke: invalid hybrid KEM secret length")
+	}
+
+	s := sha3.NewSHAKE256()
+	s.Write(priv)
+
+	seedPQ := make([]byte, mlkem.SeedSize)
+	s.Read(seedPQ)
+	pq, err := kem.pqNewPrivateKey(seedPQ)
+	if err != nil {
+		return nil, err
+	}
+
+	seedT := make([]byte, kem.curveSeedSize)
+	for {
+		s.Read(seedT)
+		k, err := kem.curve.NewPrivateKey(seedT)
+		if err != nil {
+			continue
+		}
+		return newHybridPrivateKey(pq, k, priv)
+	}
+}
+
+func newHybridPrivateKey(pq crypto.Decapsulator, t ecdh.KeyExchanger, seed []byte) (PrivateKey, error) {
+	switch t.Curve() {
+	case ecdh.X25519():
+		if _, ok := pq.Encapsulator().(*mlkem.EncapsulationKey768); !ok {
+			return nil, errors.New("invalid PQ KEM for X25519 hybrid")
+		}
+		return &hybridPrivateKey{mlkem768X25519, bytes.Clone(seed), t, pq}, nil
+	case ecdh.P256():
+		if _, ok := pq.Encapsulator().(*mlkem.EncapsulationKey768); !ok {
+			return nil, errors.New("invalid PQ KEM for P-256 hybrid")
+		}
+		return &hybridPrivateKey{mlkem768P256, bytes.Clone(seed), t, pq}, nil
+	case ecdh.P384():
+		if _, ok := pq.Encapsulator().(*mlkem.EncapsulationKey1024); !ok {
+			return nil, errors.New("invalid PQ KEM for P-384 hybrid")
+		}
+		return &hybridPrivateKey{mlkem1024P384, bytes.Clone(seed), t, pq}, nil
+	default:
+		return nil, errors.New("unsupported curve")
+	}
+}
+
+func (kem *hybridKEM) DeriveKeyPair(ikm []byte) (PrivateKey, error) {
+	suiteID := byteorder.BEAppendUint16([]byte("KEM"), kem.id)
+	dk, err := SHAKE256().labeledDerive(suiteID, ikm, "DeriveKeyPair", nil, 32)
+	if err != nil {
+		return nil, err
+	}
+	return kem.NewPrivateKey(dk)
+}
+
+func (k *hybridPrivateKey) KEM() KEM {
+	return k.kem
+}
+
+func (k *hybridPrivateKey) Bytes() ([]byte, error) {
+	if k.seed == nil {
+		return nil, errors.New("private key seed not available")
+	}
+	return k.seed, nil
+}
+
+func (k *hybridPrivateKey) PublicKey() PublicKey {
+	return &hybridPublicKey{
+		kem: k.kem,
+		t:   k.t.PublicKey(),
+		pq:  k.pq.Encapsulator(),
+	}
+}
+
+func (k *hybridPrivateKey) decap(enc []byte) ([]byte, error) {
+	if len(enc) != k.kem.pqCiphertextSize+k.kem.curvePointSize {
+		return nil, errors.New("invalid encapsulated key size")
+	}
+	ctPQ, ctT := enc[:k.kem.pqCiphertextSize], enc[k.kem.pqCiphertextSize:]
+	ssPQ, err := k.pq.Decapsulate(ctPQ)
+	if err != nil {
+		return nil, err
+	}
+	pub, err := k.t.Curve().NewPublicKey(ctT)
+	if err != nil {
+		return nil, err
+	}
+	ssT, err := k.t.ECDH(pub)
+	if err != nil {
+		return nil, err
+	}
+	ss := k.kem.sharedSecret(ssPQ, ssT, ctT, k.t.PublicKey().Bytes())
+	return ss, nil
+}
+
+var mlkem768 = &mlkemKEM{
+	id:             0x0041,
+	ciphertextSize: mlkem.CiphertextSize768,
+	newPublicKey: func(data []byte) (crypto.Encapsulator, error) {
+		return mlkem.NewEncapsulationKey768(data)
+	},
+	newPrivateKey: func(data []byte) (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.NewDecapsulationKey768(data))
+	},
+	generateKey: func() (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.GenerateKey768())
+	},
+}
+
+// MLKEM768 returns a KEM implementing ML-KEM-768 from draft-ietf-hpke-pq.
+func MLKEM768() KEM {
+	return mlkem768
+}
+
+var mlkem1024 = &mlkemKEM{
+	id:             0x0042,
+	ciphertextSize: mlkem.CiphertextSize1024,
+	newPublicKey: func(data []byte) (crypto.Encapsulator, error) {
+		return mlkem.NewEncapsulationKey1024(data)
+	},
+	newPrivateKey: func(data []byte) (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.NewDecapsulationKey1024(data))
+	},
+	generateKey: func() (crypto.Decapsulator, error) {
+		return wrapDecapsulator(mlkem.GenerateKey1024())
+	},
+}
+
+// MLKEM1024 returns a KEM implementing ML-KEM-1024 from draft-ietf-hpke-pq.
+func MLKEM1024() KEM {
+	return mlkem1024
+}
+
+type mlkemKEM struct {
+	id             uint16
+	ciphertextSize int
+	newPublicKey   func(data []byte) (crypto.Encapsulator, error)
+	newPrivateKey  func(data []byte) (crypto.Decapsulator, error)
+	generateKey    func() (crypto.Decapsulator, error)
+}
+
+func (kem *mlkemKEM) ID() uint16 {
+	return kem.id
+}
+
+func (kem *mlkemKEM) encSize() int {
+	return kem.ciphertextSize
+}
+
+type mlkemPublicKey struct {
+	kem *mlkemKEM
+	pq  crypto.Encapsulator
+}
+
+// NewMLKEMPublicKey returns a KEMPublicKey implementing
+//
+//   - ML-KEM-768
+//   - ML-KEM-1024
+//
+// from draft-ietf-hpke-pq, depending on the type of pub
+// (*[mlkem.EncapsulationKey768] or *[mlkem.EncapsulationKey1024]).
+//
+// This function is meant for applications that already have an instantiated
+// crypto/mlkem public key. Otherwise, applications should use the
+// [KEM.NewPublicKey] method of e.g. [MLKEM768].
+func NewMLKEMPublicKey(pub crypto.Encapsulator) (PublicKey, error) {
+	switch pub.(type) {
+	case *mlkem.EncapsulationKey768:
+		return &mlkemPublicKey{mlkem768, pub}, nil
+	case *mlkem.EncapsulationKey1024:
+		return &mlkemPublicKey{mlkem1024, pub}, nil
+	default:
+		return nil, errors.New("unsupported public key type")
+	}
+}
+
+func (kem *mlkemKEM) NewPublicKey(data []byte) (PublicKey, error) {
+	pq, err := kem.newPublicKey(data)
+	if err != nil {
+		return nil, err
+	}
+	return NewMLKEMPublicKey(pq)
+}
+
+func (pk *mlkemPublicKey) KEM() KEM {
+	return pk.kem
+}
+
+func (pk *mlkemPublicKey) Bytes() []byte {
+	return pk.pq.Bytes()
+}
+
+func (pk *mlkemPublicKey) encap() (sharedSecret []byte, encapPub []byte, err error) {
+	ss, ct := pk.pq.Encapsulate()
+	if testingOnlyEncapsulate != nil {
+		ss, ct = testingOnlyEncapsulate()
+	}
+	return ss, ct, nil
+}
+
+type mlkemPrivateKey struct {
+	kem *mlkemKEM
+	pq  crypto.Decapsulator
+}
+
+// NewMLKEMPrivateKey returns a KEMPrivateKey implementing
+//
+//   - ML-KEM-768
+//   - ML-KEM-1024
+//
+// from draft-ietf-hpke-pq, depending on the type of priv.Encapsulator()
+// (either *[mlkem.EncapsulationKey768] or *[mlkem.EncapsulationKey1024]).
+//
+// This function is meant for applications that already have an instantiated
+// crypto/mlkem private key. Otherwise, applications should use the
+// [KEM.NewPrivateKey] method of e.g. [MLKEM768].
+func NewMLKEMPrivateKey(priv crypto.Decapsulator) (PrivateKey, error) {
+	switch priv.Encapsulator().(type) {
+	case *mlkem.EncapsulationKey768:
+		return &mlkemPrivateKey{mlkem768, priv}, nil
+	case *mlkem.EncapsulationKey1024:
+		return &mlkemPrivateKey{mlkem1024, priv}, nil
+	default:
+		return nil, errors.New("unsupported public key type")
+	}
+}
+
+func (kem *mlkemKEM) GenerateKey() (PrivateKey, error) {
+	pq, err := kem.generateKey()
+	if err != nil {
+		return nil, err
+	}
+	return NewMLKEMPrivateKey(pq)
+}
+
+func (kem *mlkemKEM) NewPrivateKey(priv []byte) (PrivateKey, error) {
+	pq, err := kem.newPrivateKey(priv)
+	if err != nil {
+		return nil, err
+	}
+	return NewMLKEMPrivateKey(pq)
+}
+
+func (kem *mlkemKEM) DeriveKeyPair(ikm []byte) (PrivateKey, error) {
+	suiteID := byteorder.BEAppendUint16([]byte("KEM"), kem.id)
+	dk, err := SHAKE256().labeledDerive(suiteID, ikm, "DeriveKeyPair", nil, 64)
+	if err != nil {
+		return nil, err
+	}
+	return kem.NewPrivateKey(dk)
+}
+
+func (k *mlkemPrivateKey) KEM() KEM {
+	return k.kem
+}
+
+func (k *mlkemPrivateKey) Bytes() ([]byte, error) {
+	pq, ok := k.pq.(interface {
+		Bytes() []byte
+	})
+	if !ok {
+		return nil, errors.New("private key seed not available")
+	}
+	return pq.Bytes(), nil
+}
+
+func (k *mlkemPrivateKey) PublicKey() PublicKey {
+	return &mlkemPublicKey{
+		kem: k.kem,
+		pq:  k.pq.Encapsulator(),
+	}
+}
+
+func (k *mlkemPrivateKey) decap(enc []byte) ([]byte, error) {
+	return k.pq.Decapsulate(enc)
+}
+
+func wrapDecapsulator(dk any, err error) (crypto.Decapsulator, error) {
+	if err != nil {
+		return nil, err
+	}
+	switch key := dk.(type) {
+	case *mlkem.DecapsulationKey768:
+		return crypto.DecapsulatorFromDecapsulationKey768(key), nil
+	case *mlkem.DecapsulationKey1024:
+		return crypto.DecapsulatorFromDecapsulationKey1024(key), nil
+	default:
+		return nil, errors.New("hpke: internal error: unknown decapsulation key type")
+	}
+}

vendor/github.com/miekg/dns/README.md

@@ -3,6 +3,11 @@
 [![Go Report Card](https://goreportcard.com/badge/github.com/miekg/dns)](https://goreportcard.com/report/miekg/dns)
 [![](https://godoc.org/github.com/miekg/dns?status.svg)](https://godoc.org/github.com/miekg/dns)
 
+DNS version 2 is now available at <https://codeberg.org/miekg/dns>, check it out if you want to
+help shape the next 15 years of the Go DNS package.
+
+The version here will see no new features and less and less development.
+
 # Alternative (more granular) approach to a DNS library
 
 > Less is more.
@@ -17,96 +22,97 @@ avoiding breaking changes wherever reasonable. We support the last two versions
 
 # Goals
 
-* KISS;
-* Fast;
-* Small API. If it's easy to code in Go, don't make a function for it.
+- KISS;
+- Fast;
+- Small API. If it's easy to code in Go, don't make a function for it.
 
 # Users
 
 A not-so-up-to-date-list-that-may-be-actually-current:
 
-* https://github.com/coredns/coredns
-* https://github.com/abh/geodns
-* https://github.com/baidu/bfe
-* http://www.statdns.com/
-* http://www.dnsinspect.com/
-* https://github.com/chuangbo/jianbing-dictionary-dns
-* http://www.dns-lg.com/
-* https://github.com/fcambus/rrda
-* https://github.com/kenshinx/godns
-* https://github.com/skynetservices/skydns
-* https://github.com/hashicorp/consul
-* https://github.com/DevelopersPL/godnsagent
-* https://github.com/duedil-ltd/discodns
-* https://github.com/StalkR/dns-reverse-proxy
-* https://github.com/tianon/rawdns
-* https://mesosphere.github.io/mesos-dns/
-* https://github.com/fcambus/statzone
-* https://github.com/benschw/dns-clb-go
-* https://github.com/corny/dnscheck for <http://public-dns.info/>
-* https://github.com/miekg/unbound
-* https://github.com/miekg/exdns
-* https://dnslookup.org
-* https://github.com/looterz/grimd
-* https://github.com/phamhongviet/serf-dns
-* https://github.com/mehrdadrad/mylg
-* https://github.com/bamarni/dockness
-* https://github.com/fffaraz/microdns
-* https://github.com/ipdcode/hades <https://jd.com>
-* https://github.com/StackExchange/dnscontrol/
-* https://www.dnsperf.com/
-* https://dnssectest.net/
-* https://github.com/oif/apex
-* https://github.com/jedisct1/dnscrypt-proxy
-* https://github.com/jedisct1/rpdns
-* https://github.com/xor-gate/sshfp
-* https://github.com/rs/dnstrace
-* https://blitiri.com.ar/p/dnss ([github mirror](https://github.com/albertito/dnss))
-* https://render.com
-* https://github.com/peterzen/goresolver
-* https://github.com/folbricht/routedns
-* https://domainr.com/
-* https://zonedb.org/
-* https://router7.org/
-* https://github.com/fortio/dnsping
-* https://github.com/Luzilla/dnsbl_exporter
-* https://github.com/bodgit/tsig
-* https://github.com/v2fly/v2ray-core (test only)
-* https://kuma.io/
-* https://www.misaka.io/services/dns
-* https://ping.sx/dig
-* https://fleetdeck.io/
-* https://github.com/markdingo/autoreverse
-* https://github.com/slackhq/nebula
-* https://addr.tools/
-* https://dnscheck.tools/
-* https://github.com/egbakou/domainverifier
-* https://github.com/semihalev/sdns
-* https://github.com/wintbiit/NineDNS
-* https://linuxcontainers.org/incus/
-* https://ifconfig.es
-* https://github.com/zmap/zdns
-* https://framagit.org/bortzmeyer/check-soa
+- https://github.com/coredns/coredns
+- https://github.com/abh/geodns
+- https://github.com/baidu/bfe
+- http://www.statdns.com/
+- http://www.dnsinspect.com/
+- https://github.com/chuangbo/jianbing-dictionary-dns
+- http://www.dns-lg.com/
+- https://github.com/fcambus/rrda
+- https://github.com/kenshinx/godns
+- https://github.com/skynetservices/skydns
+- https://github.com/hashicorp/consul
+- https://github.com/DevelopersPL/godnsagent
+- https://github.com/duedil-ltd/discodns
+- https://github.com/StalkR/dns-reverse-proxy
+- https://github.com/tianon/rawdns
+- https://mesosphere.github.io/mesos-dns/
+- https://github.com/fcambus/statzone
+- https://github.com/benschw/dns-clb-go
+- https://github.com/corny/dnscheck for <http://public-dns.info/>
+- https://github.com/miekg/unbound
+- https://github.com/miekg/exdns
+- https://dnslookup.org
+- https://github.com/looterz/grimd
+- https://github.com/phamhongviet/serf-dns
+- https://github.com/mehrdadrad/mylg
+- https://github.com/bamarni/dockness
+- https://github.com/fffaraz/microdns
+- https://github.com/ipdcode/hades <https://jd.com>
+- https://github.com/StackExchange/dnscontrol/
+- https://www.dnsperf.com/
+- https://dnssectest.net/
+- https://github.com/oif/apex
+- https://github.com/jedisct1/dnscrypt-proxy
+- https://github.com/jedisct1/rpdns
+- https://github.com/xor-gate/sshfp
+- https://github.com/rs/dnstrace
+- https://blitiri.com.ar/p/dnss ([github mirror](https://github.com/albertito/dnss))
+- https://render.com
+- https://github.com/peterzen/goresolver
+- https://github.com/folbricht/routedns
+- https://domainr.com/
+- https://zonedb.org/
+- https://router7.org/
+- https://github.com/fortio/dnsping
+- https://github.com/Luzilla/dnsbl_exporter
+- https://github.com/bodgit/tsig
+- https://github.com/v2fly/v2ray-core (test only)
+- https://kuma.io/
+- https://www.misaka.io/services/dns
+- https://ping.sx/dig
+- https://fleetdeck.io/
+- https://github.com/markdingo/autoreverse
+- https://github.com/slackhq/nebula
+- https://addr.tools/
+- https://dnscheck.tools/
+- https://github.com/egbakou/domainverifier
+- https://github.com/semihalev/sdns
+- https://github.com/wintbiit/NineDNS
+- https://linuxcontainers.org/incus/
+- https://ifconfig.es
+- https://github.com/zmap/zdns
+- https://framagit.org/bortzmeyer/check-soa
+- https://github.com/jkerdreux-imt/owns
 
 Send pull request if you want to be listed here.
 
 # Features
 
-* UDP/TCP queries, IPv4 and IPv6
-* RFC 1035 zone file parsing ($INCLUDE, $ORIGIN, $TTL and $GENERATE (for all record types) are supported
-* Fast
-* Server side programming (mimicking the net/http package)
-* Client side programming
-* DNSSEC: signing, validating and key generation for DSA, RSA, ECDSA and Ed25519
-* EDNS0, NSID, Cookies
-* AXFR/IXFR
-* TSIG, SIG(0)
-* DNS over TLS (DoT): encrypted connection between client and server over TCP
-* DNS name compression
+- UDP/TCP queries, IPv4 and IPv6
+- RFC 1035 zone file parsing ($INCLUDE, $ORIGIN, $TTL and $GENERATE (for all record types) are supported
+- Fast
+- Server side programming (mimicking the net/http package)
+- Client side programming
+- DNSSEC: signing, validating and key generation for DSA, RSA, ECDSA and Ed25519
+- EDNS0, NSID, Cookies
+- AXFR/IXFR
+- TSIG, SIG(0)
+- DNS over TLS (DoT): encrypted connection between client and server over TCP
+- DNS name compression
 
 Have fun!
 
-Miek Gieben  -  2010-2012  -  <miek@miek.nl>
+Miek Gieben - 2010-2012 - <miek@miek.nl>
 DNS Authors 2012-
 
 # Building
@@ -126,81 +132,83 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 
 ## Supported RFCs
 
-*all of them*
+_all of them_
 
-* 103{4,5} - DNS standard
-* 1183 - ISDN, X25 and other deprecated records
-* 1348 - NSAP record (removed the record)
-* 1982 - Serial Arithmetic
-* 1876 - LOC record
-* 1995 - IXFR
-* 1996 - DNS notify
-* 2136 - DNS Update (dynamic updates)
-* 2181 - RRset definition - there is no RRset type though, just []RR
-* 2537 - RSAMD5 DNS keys
-* 2065 - DNSSEC (updated in later RFCs)
-* 2671 - EDNS record
-* 2782 - SRV record
-* 2845 - TSIG record
-* 2915 - NAPTR record
-* 2929 - DNS IANA Considerations
-* 3110 - RSASHA1 DNS keys
-* 3123 - APL record
-* 3225 - DO bit (DNSSEC OK)
-* 340{1,2,3} - NAPTR record
-* 3445 - Limiting the scope of (DNS)KEY
-* 3596 - AAAA record
-* 3597 - Unknown RRs
-* 4025 - A Method for Storing IPsec Keying Material in DNS
-* 403{3,4,5} - DNSSEC + validation functions
-* 4255 - SSHFP record
-* 4343 - Case insensitivity
-* 4408 - SPF record
-* 4509 - SHA256 Hash in DS
-* 4592 - Wildcards in the DNS
-* 4635 - HMAC SHA TSIG
-* 4701 - DHCID
-* 4892 - id.server
-* 5001 - NSID
-* 5155 - NSEC3 record
-* 5205 - HIP record
-* 5702 - SHA2 in the DNS
-* 5936 - AXFR
-* 5966 - TCP implementation recommendations
-* 6605 - ECDSA
-* 6725 - IANA Registry Update
-* 6742 - ILNP DNS
-* 6840 - Clarifications and Implementation Notes for DNS Security
-* 6844 - CAA record
-* 6891 - EDNS0 update
-* 6895 - DNS IANA considerations
-* 6944 - DNSSEC DNSKEY Algorithm Status
-* 6975 - Algorithm Understanding in DNSSEC
-* 7043 - EUI48/EUI64 records
-* 7314 - DNS (EDNS) EXPIRE Option
-* 7477 - CSYNC RR
-* 7828 - edns-tcp-keepalive EDNS0 Option
-* 7553 - URI record
-* 7858 - DNS over TLS: Initiation and Performance Considerations
-* 7871 - EDNS0 Client Subnet
-* 7873 - Domain Name System (DNS) Cookies
-* 8080 - EdDSA for DNSSEC
-* 8490 - DNS Stateful Operations
-* 8499 - DNS Terminology
-* 8659 - DNS Certification Authority Authorization (CAA) Resource Record
-* 8777 - DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery
-* 8914 - Extended DNS Errors
-* 8976 - Message Digest for DNS Zones (ZONEMD RR)
-* 9460 - Service Binding and Parameter Specification via the DNS
-* 9461 - Service Binding Mapping for DNS Servers
-* 9462 - Discovery of Designated Resolvers
-* 9460 - SVCB and HTTPS Records
-* 9606 - DNS Resolver Information
-* Draft - Compact Denial of Existence in DNSSEC
+- 103{4,5} - DNS standard
+- 1183 - ISDN, X25 and other deprecated records
+- 1348 - NSAP record (removed the record)
+- 1982 - Serial Arithmetic
+- 1876 - LOC record
+- 1995 - IXFR
+- 1996 - DNS notify
+- 2136 - DNS Update (dynamic updates)
+- 2181 - RRset definition - there is no RRset type though, just []RR
+- 2537 - RSAMD5 DNS keys
+- 2065 - DNSSEC (updated in later RFCs)
+- 2671 - EDNS record
+- 2782 - SRV record
+- 2845 - TSIG record
+- 2915 - NAPTR record
+- 2929 - DNS IANA Considerations
+- 3110 - RSASHA1 DNS keys
+- 3123 - APL record
+- 3225 - DO bit (DNSSEC OK)
+- 340{1,2,3} - NAPTR record
+- 3445 - Limiting the scope of (DNS)KEY
+- 3596 - AAAA record
+- 3597 - Unknown RRs
+- 4025 - A Method for Storing IPsec Keying Material in DNS
+- 403{3,4,5} - DNSSEC + validation functions
+- 4255 - SSHFP record
+- 4343 - Case insensitivity
+- 4408 - SPF record
+- 4509 - SHA256 Hash in DS
+- 4592 - Wildcards in the DNS
+- 4635 - HMAC SHA TSIG
+- 4701 - DHCID
+- 4892 - id.server
+- 5001 - NSID
+- 5155 - NSEC3 record
+- 5205 - HIP record
+- 5702 - SHA2 in the DNS
+- 5936 - AXFR
+- 5966 - TCP implementation recommendations
+- 6605 - ECDSA
+- 6725 - IANA Registry Update
+- 6742 - ILNP DNS
+- 6840 - Clarifications and Implementation Notes for DNS Security
+- 6844 - CAA record
+- 6891 - EDNS0 update
+- 6895 - DNS IANA considerations
+- 6944 - DNSSEC DNSKEY Algorithm Status
+- 6975 - Algorithm Understanding in DNSSEC
+- 7043 - EUI48/EUI64 records
+- 7314 - DNS (EDNS) EXPIRE Option
+- 7477 - CSYNC RR
+- 7828 - edns-tcp-keepalive EDNS0 Option
+- 7553 - URI record
+- 7858 - DNS over TLS: Initiation and Performance Considerations
+- 7871 - EDNS0 Client Subnet
+- 7873 - Domain Name System (DNS) Cookies
+- 8080 - EdDSA for DNSSEC
+- 8490 - DNS Stateful Operations
+- 8499 - DNS Terminology
+- 8659 - DNS Certification Authority Authorization (CAA) Resource Record
+- 8777 - DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery
+- 8914 - Extended DNS Errors
+- 8976 - Message Digest for DNS Zones (ZONEMD RR)
+- 9460 - Service Binding and Parameter Specification via the DNS
+- 9461 - Service Binding Mapping for DNS Servers
+- 9462 - Discovery of Designated Resolvers
+- 9460 - SVCB and HTTPS Records
+- 9567 - DNS Error Reporting
+- 9606 - DNS Resolver Information
+- 9660 - DNS Zone Version (ZONEVERSION) Option
+- Draft - Compact Denial of Existence in DNSSEC
 
 ## Loosely Based Upon
 
-* ldns - <https://nlnetlabs.nl/projects/ldns/about/>
-* NSD - <https://nlnetlabs.nl/projects/nsd/about/>
-* Net::DNS - <http://www.net-dns.org/>
-* GRONG - <https://github.com/bortzmeyer/grong>
+- ldns - <https://nlnetlabs.nl/projects/ldns/about/>
+- NSD - <https://nlnetlabs.nl/projects/nsd/about/>
+- Net::DNS - <http://www.net-dns.org/>
+- GRONG - <https://github.com/bortzmeyer/grong>

vendor/github.com/miekg/dns/edns.go

@@ -24,6 +24,8 @@ const (
 	EDNS0TCPKEEPALIVE = 0xb     // EDNS0 tcp keep alive (See RFC 7828)
 	EDNS0PADDING      = 0xc     // EDNS0 padding (See RFC 7830)
 	EDNS0EDE          = 0xf     // EDNS0 extended DNS errors (See RFC 8914)
+	EDNS0REPORTING    = 0x12    // EDNS0 reporting (See RFC 9567)
+	EDNS0ZONEVERSION  = 0x13    // EDNS0 Zone Version (See RFC 9660)
 	EDNS0LOCALSTART   = 0xFDE9  // Beginning of range reserved for local/experimental use (See RFC 6891)
 	EDNS0LOCALEND     = 0xFFFE  // End of range reserved for local/experimental use (See RFC 6891)
 	_DO               = 1 << 15 // DNSSEC OK
@@ -60,6 +62,10 @@ func makeDataOpt(code uint16) EDNS0 {
 		return new(EDNS0_EDE)
 	case EDNS0ESU:
 		return new(EDNS0_ESU)
+	case EDNS0REPORTING:
+		return new(EDNS0_REPORTING)
+	case EDNS0ZONEVERSION:
+		return new(EDNS0_ZONEVERSION)
 	default:
 		e := new(EDNS0_LOCAL)
 		e.Code = code
@@ -75,17 +81,16 @@ type OPT struct {
 
 func (rr *OPT) String() string {
 	s := "\n;; OPT PSEUDOSECTION:\n; EDNS: version " + strconv.Itoa(int(rr.Version())) + "; "
+	s += "flags:"
 	if rr.Do() {
-		if rr.Co() {
-			s += "flags: do, co; "
-		} else {
-			s += "flags: do; "
-		}
-	} else {
-		s += "flags:; "
+		s += " do"
 	}
-	if rr.Hdr.Ttl&0x7FFF != 0 {
-		s += fmt.Sprintf("MBZ: 0x%04x, ", rr.Hdr.Ttl&0x7FFF)
+	if rr.Co() {
+		s += " co"
+	}
+	s += "; "
+	if z := rr.Z(); z != 0 {
+		s += fmt.Sprintf("MBZ: 0x%04x, ", z)
 	}
 	s += "udp: " + strconv.Itoa(int(rr.UDPSize()))
 
@@ -127,6 +132,10 @@ func (rr *OPT) String() string {
 			s += "\n; EDE: " + o.String()
 		case *EDNS0_ESU:
 			s += "\n; ESU: " + o.String()
+		case *EDNS0_REPORTING:
+			s += "\n; REPORT-CHANNEL: " + o.String()
+		case *EDNS0_ZONEVERSION:
+			s += "\n; ZONEVERSION: " + o.String()
 		}
 	}
 	return s
@@ -308,10 +317,6 @@ type EDNS0_SUBNET struct {
 func (e *EDNS0_SUBNET) Option() uint16 { return EDNS0SUBNET }
 
 func (e *EDNS0_SUBNET) pack() ([]byte, error) {
-	b := make([]byte, 4)
-	binary.BigEndian.PutUint16(b[0:], e.Family)
-	b[2] = e.SourceNetmask
-	b[3] = e.SourceScope
 	switch e.Family {
 	case 0:
 		// "dig" sets AddressFamily to 0 if SourceNetmask is also 0
@@ -319,16 +324,27 @@ func (e *EDNS0_SUBNET) pack() ([]byte, error) {
 		if e.SourceNetmask != 0 {
 			return nil, errors.New("bad address family")
 		}
+		b := make([]byte, 4)
+		b[3] = e.SourceScope
+		return b, nil
 	case 1:
 		if e.SourceNetmask > net.IPv4len*8 {
 			return nil, errors.New("bad netmask")
 		}
-		if len(e.Address.To4()) != net.IPv4len {
+		ip4 := e.Address.To4()
+		if len(ip4) != net.IPv4len {
 			return nil, errors.New("bad address")
 		}
-		ip := e.Address.To4().Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv4len*8))
 		needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
-		b = append(b, ip[:needLength]...)
+		b := make([]byte, 4+needLength)
+		binary.BigEndian.PutUint16(b[0:], e.Family)
+		b[2] = e.SourceNetmask
+		b[3] = e.SourceScope
+		if needLength > 0 {
+			ip := ip4.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv4len*8))
+			copy(b[4:], ip[:needLength])
+		}
+		return b, nil
 	case 2:
 		if e.SourceNetmask > net.IPv6len*8 {
 			return nil, errors.New("bad netmask")
@@ -336,13 +352,19 @@ func (e *EDNS0_SUBNET) pack() ([]byte, error) {
 		if len(e.Address) != net.IPv6len {
 			return nil, errors.New("bad address")
 		}
-		ip := e.Address.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv6len*8))
 		needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
-		b = append(b, ip[:needLength]...)
+		b := make([]byte, 4+needLength)
+		binary.BigEndian.PutUint16(b[0:], e.Family)
+		b[2] = e.SourceNetmask
+		b[3] = e.SourceScope
+		if needLength > 0 {
+			ip := e.Address.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv6len*8))
+			copy(b[4:], ip[:needLength])
+		}
+		return b, nil
 	default:
 		return nil, errors.New("bad address family")
 	}
-	return b, nil
 }
 
 func (e *EDNS0_SUBNET) unpack(b []byte) error {
@@ -875,3 +897,74 @@ func (e *EDNS0_ESU) unpack(b []byte) error {
 	e.Uri = string(b)
 	return nil
 }
+
+// EDNS0_REPORTING implements the EDNS0 Reporting Channel option (RFC 9567).
+type EDNS0_REPORTING struct {
+	Code        uint16 // always EDNS0REPORTING
+	AgentDomain string
+}
+
+func (e *EDNS0_REPORTING) Option() uint16 { return EDNS0REPORTING }
+func (e *EDNS0_REPORTING) String() string { return e.AgentDomain }
+func (e *EDNS0_REPORTING) copy() EDNS0    { return &EDNS0_REPORTING{e.Code, e.AgentDomain} }
+func (e *EDNS0_REPORTING) pack() ([]byte, error) {
+	b := make([]byte, 255)
+	off1, err := PackDomainName(Fqdn(e.AgentDomain), b, 0, nil, false)
+	if err != nil {
+		return nil, fmt.Errorf("bad agent domain: %w", err)
+	}
+	return b[:off1], nil
+}
+func (e *EDNS0_REPORTING) unpack(b []byte) error {
+	domain, _, err := UnpackDomainName(b, 0)
+	if err != nil {
+		return fmt.Errorf("bad agent domain: %w", err)
+	}
+	e.AgentDomain = domain
+	return nil
+}
+
+// EDNS0_ZONEVERSION implements the EDNS0 Zone Version option (RFC 9660).
+type EDNS0_ZONEVERSION struct {
+	// always EDNS0ZONEVERSION (19)
+	Code uint16
+	// An unsigned 1-octet Label Count indicating
+	// the number of labels for the name of the zone that VERSION value refers to.
+	LabelCount uint8
+	// An unsigned 1-octet type number distinguishing the format and meaning of version.
+	// 0 SOA-SERIAL, 1-245 Unassigned, 246-255 Reserved for private use, see RFC 9660.
+	Type uint8
+	// An opaque octet string conveying the zone version data (VERSION).
+	Version string
+}
+
+func (e *EDNS0_ZONEVERSION) Option() uint16 { return EDNS0ZONEVERSION }
+func (e *EDNS0_ZONEVERSION) String() string { return e.Version }
+func (e *EDNS0_ZONEVERSION) copy() EDNS0 {
+	return &EDNS0_ZONEVERSION{e.Code, e.LabelCount, e.Type, e.Version}
+}
+func (e *EDNS0_ZONEVERSION) pack() ([]byte, error) {
+	b := []byte{
+		// first octet label count
+		e.LabelCount,
+		// second octet is type
+		e.Type,
+	}
+	if len(e.Version) > 0 {
+		b = append(b, []byte(e.Version)...)
+	}
+	return b, nil
+}
+func (e *EDNS0_ZONEVERSION) unpack(b []byte) error {
+	if len(b) < 2 {
+		return ErrBuf
+	}
+	e.LabelCount = b[0]
+	e.Type = b[1]
+	if len(b) > 2 {
+		e.Version = string(b[2:])
+	} else {
+		e.Version = ""
+	}
+	return nil
+}

vendor/github.com/miekg/dns/server.go

@@ -194,7 +194,9 @@ type DecorateWriter func(Writer) Writer
 // rejected (or ignored) by the MsgAcceptFunc, or passed to this function.
 type MsgInvalidFunc func(m []byte, err error)
 
-func DefaultMsgInvalidFunc(m []byte, err error) {}
+var DefaultMsgInvalidFunc MsgInvalidFunc = defaultMsgInvalidFunc
+
+func defaultMsgInvalidFunc(m []byte, err error) {}
 
 // A Server defines parameters for running an DNS server.
 type Server struct {

vendor/github.com/miekg/dns/version.go

@@ -3,7 +3,7 @@ package dns
 import "fmt"
 
 // Version is current version of this library.
-var Version = v{1, 1, 68}
+var Version = v{1, 1, 69}
 
 // v holds the version of this library.
 type v struct {

vendor/github.com/ncruces/go-sqlite3/README.md

@@ -84,14 +84,14 @@ It also benefits greatly from [SQLite's](https://sqlite.org/testing.html) and
 thorough testing.
 
 Every commit is tested on:
-* Linux: amd64, arm64, 386, riscv64, ppc64le, s390x
+* Linux: amd64, arm64, 386, arm, riscv64, ppc64le, loong64, s390x
 * macOS: amd64, arm64
-* Windows: amd64
+* Windows: amd64, arm64
 * BSD:
   * FreeBSD: amd64, arm64
-  * OpenBSD: amd64
   * NetBSD: amd64, arm64
   * DragonFly BSD: amd64
+  * OpenBSD: amd64
 * illumos: amd64
 * Solaris: amd64
 

vendor/github.com/ncruces/go-sqlite3/config.go

@@ -265,7 +265,7 @@ func traceCallback(ctx context.Context, mod api.Module, evt TraceEvent, pDB, pAr
 			}
 		}
 		if arg1 != nil {
-			_, rc = errorCode(c.trace(evt, arg1, arg2), ERROR)
+			_ = c.trace(evt, arg1, arg2)
 		}
 	}
 	return rc

vendor/github.com/ncruces/go-sqlite3/conn.go

@@ -420,21 +420,21 @@ func busyCallback(ctx context.Context, mod api.Module, pDB ptr_t, count int32) (
 // Status retrieves runtime status information about a database connection.
 //
 // https://sqlite.org/c3ref/db_status.html
-func (c *Conn) Status(op DBStatus, reset bool) (current, highwater int, err error) {
+func (c *Conn) Status(op DBStatus, reset bool) (current, highwater int64, err error) {
 	defer c.arena.mark()()
-	hiPtr := c.arena.new(intlen)
-	curPtr := c.arena.new(intlen)
+	hiPtr := c.arena.new(8)
+	curPtr := c.arena.new(8)
 
 	var i int32
 	if reset {
 		i = 1
 	}
 
-	rc := res_t(c.call("sqlite3_db_status", stk_t(c.handle),
+	rc := res_t(c.call("sqlite3_db_status64", stk_t(c.handle),
 		stk_t(op), stk_t(curPtr), stk_t(hiPtr), stk_t(i)))
 	if err = c.error(rc); err == nil {
-		current = int(util.Read32[int32](c.mod, curPtr))
-		highwater = int(util.Read32[int32](c.mod, hiPtr))
+		current = util.Read64[int64](c.mod, curPtr)
+		highwater = util.Read64[int64](c.mod, hiPtr)
 	}
 	return
 }

vendor/github.com/ncruces/go-sqlite3/const.go

@@ -73,6 +73,9 @@ const (
 	ERROR_MISSING_COLLSEQ   ExtendedErrorCode = xErrorCode(ERROR) | (1 << 8)
 	ERROR_RETRY             ExtendedErrorCode = xErrorCode(ERROR) | (2 << 8)
 	ERROR_SNAPSHOT          ExtendedErrorCode = xErrorCode(ERROR) | (3 << 8)
+	ERROR_RESERVESIZE       ExtendedErrorCode = xErrorCode(ERROR) | (4 << 8)
+	ERROR_KEY               ExtendedErrorCode = xErrorCode(ERROR) | (5 << 8)
+	ERROR_UNABLE            ExtendedErrorCode = xErrorCode(ERROR) | (6 << 8)
 	IOERR_READ              ExtendedErrorCode = xErrorCode(IOERR) | (1 << 8)
 	IOERR_SHORT_READ        ExtendedErrorCode = xErrorCode(IOERR) | (2 << 8)
 	IOERR_WRITE             ExtendedErrorCode = xErrorCode(IOERR) | (3 << 8)
@@ -107,6 +110,8 @@ const (
 	IOERR_DATA              ExtendedErrorCode = xErrorCode(IOERR) | (32 << 8)
 	IOERR_CORRUPTFS         ExtendedErrorCode = xErrorCode(IOERR) | (33 << 8)
 	IOERR_IN_PAGE           ExtendedErrorCode = xErrorCode(IOERR) | (34 << 8)
+	IOERR_BADKEY            ExtendedErrorCode = xErrorCode(IOERR) | (35 << 8)
+	IOERR_CODEC             ExtendedErrorCode = xErrorCode(IOERR) | (36 << 8)
 	LOCKED_SHAREDCACHE      ExtendedErrorCode = xErrorCode(LOCKED) | (1 << 8)
 	LOCKED_VTAB             ExtendedErrorCode = xErrorCode(LOCKED) | (2 << 8)
 	BUSY_RECOVERY           ExtendedErrorCode = xErrorCode(BUSY) | (1 << 8)
@@ -229,7 +234,8 @@ const (
 	DBSTATUS_DEFERRED_FKS        DBStatus = 10
 	DBSTATUS_CACHE_USED_SHARED   DBStatus = 11
 	DBSTATUS_CACHE_SPILL         DBStatus = 12
-	// DBSTATUS_MAX              DBStatus = 12
+	DBSTATUS_TEMPBUF_SPILL       DBStatus = 13
+	// DBSTATUS_MAX              DBStatus = 13
 )
 
 // DBConfig are the available database connection configuration options.
@@ -362,13 +368,14 @@ const (
 // CheckpointMode are all the checkpoint mode values.
 //
 // https://sqlite.org/c3ref/c_checkpoint_full.html
-type CheckpointMode uint32
+type CheckpointMode int32
 
 const (
-	CHECKPOINT_PASSIVE  CheckpointMode = 0 /* Do as much as possible w/o blocking */
-	CHECKPOINT_FULL     CheckpointMode = 1 /* Wait for writers, then checkpoint */
-	CHECKPOINT_RESTART  CheckpointMode = 2 /* Like FULL but wait for readers */
-	CHECKPOINT_TRUNCATE CheckpointMode = 3 /* Like RESTART but also truncate WAL */
+	CHECKPOINT_NOOP     CheckpointMode = -1 /* Do no work at all */
+	CHECKPOINT_PASSIVE  CheckpointMode = 0  /* Do as much as possible w/o blocking */
+	CHECKPOINT_FULL     CheckpointMode = 1  /* Wait for writers, then checkpoint */
+	CHECKPOINT_RESTART  CheckpointMode = 2  /* Like FULL but wait for readers */
+	CHECKPOINT_TRUNCATE CheckpointMode = 3  /* Like RESTART but also truncate WAL */
 )
 
 // TxnState are the allowed return values from [Conn.TxnState].

vendor/github.com/ncruces/go-sqlite3/context.go

@@ -198,14 +198,14 @@ func (ctx Context) ResultError(err error) {
 		return
 	}
 
-	msg, code := errorCode(err, _OK)
+	msg, code := errorCode(err, ERROR)
 	if msg != "" {
 		defer ctx.c.arena.mark()()
 		ptr := ctx.c.arena.string(msg)
 		ctx.c.call("sqlite3_result_error",
 			stk_t(ctx.handle), stk_t(ptr), stk_t(len(msg)))
 	}
-	if code != _OK {
+	if code != res_t(ERROR) {
 		ctx.c.call("sqlite3_result_error_code",
 			stk_t(ctx.handle), stk_t(code))
 	}

vendor/github.com/ncruces/go-sqlite3/driver/driver.go

@@ -263,10 +263,8 @@ func (n *connector) Connect(ctx context.Context) (ret driver.Conn, err error) {
 			return nil, err
 		}
 		defer s.Close()
-		if s.Step() && s.ColumnBool(0) {
-			c.readOnly = '1'
-		} else {
-			c.readOnly = '0'
+		if s.Step() {
+			c.readOnly = s.ColumnBool(0)
 		}
 		err = s.Close()
 		if err != nil {
@@ -322,7 +320,7 @@ type conn struct {
 	txReset  string
 	tmRead   sqlite3.TimeFormat
 	tmWrite  sqlite3.TimeFormat
-	readOnly byte
+	readOnly bool
 }
 
 var (
@@ -358,9 +356,9 @@ func (c *conn) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, e
 
 	c.txReset = ``
 	txBegin := `BEGIN ` + txLock
-	if opts.ReadOnly {
+	if opts.ReadOnly && !c.readOnly {
 		txBegin += ` ; PRAGMA query_only=on`
-		c.txReset = `; PRAGMA query_only=` + string(c.readOnly)
+		c.txReset = `; PRAGMA query_only=off`
 	}
 
 	if old := c.Conn.SetInterrupt(ctx); old != ctx {
@@ -655,14 +653,12 @@ type rows struct {
 	names []string
 	types []string
 	scans []scantype
-	dest  []driver.Value
 }
 
 var (
 	// Ensure these interfaces are implemented:
 	_ driver.RowsColumnTypeDatabaseTypeName = &rows{}
 	_ driver.RowsColumnTypeNullable         = &rows{}
-	// _ driver.RowsColumnScanner           = &rows{}
 )
 
 func (r *rows) Close() error {
@@ -782,7 +778,6 @@ func (r *rows) ColumnTypeScanType(index int) (typ reflect.Type) {
 }
 
 func (r *rows) Next(dest []driver.Value) error {
-	r.dest = nil
 	c := r.Stmt.Conn()
 	if old := c.SetInterrupt(r.ctx); old != r.ctx {
 		defer c.SetInterrupt(old)
@@ -832,33 +827,5 @@ func (r *rows) Next(dest []driver.Value) error {
 			}
 		}
 	}
-	r.dest = dest
 	return nil
 }
-
-func (r *rows) ScanColumn(dest any, index int) (err error) {
-	// notest // Go 1.26
-	var tm *time.Time
-	var ok *bool
-	switch d := dest.(type) {
-	case *time.Time:
-		tm = d
-	case *sql.NullTime:
-		tm = &d.Time
-		ok = &d.Valid
-	case *sql.Null[time.Time]:
-		tm = &d.V
-		ok = &d.Valid
-	default:
-		return driver.ErrSkip
-	}
-	value := r.dest[index]
-	*tm, err = r.tmRead.Decode(value)
-	if ok != nil {
-		*ok = err == nil
-		if value == nil {
-			return nil
-		}
-	}
-	return err
-}

vendor/github.com/ncruces/go-sqlite3/embed/README.md

@@ -1,6 +1,6 @@
 # Embeddable Wasm build of SQLite
 
-This folder includes an embeddable Wasm build of SQLite 3.50.4 for use with
+This folder includes an embeddable Wasm build of SQLite 3.51.1 for use with
 [`github.com/ncruces/go-sqlite3`](https://pkg.go.dev/github.com/ncruces/go-sqlite3).
 
 The following optional features are compiled in:

vendor/github.com/ncruces/go-sqlite3/embed/build.sh

@@ -23,6 +23,7 @@ trap 'rm -f sqlite3.tmp' EXIT
 	-Wl,--import-undefined \
 	-Wl,--initial-memory=327680 \
 	-D_HAVE_SQLITE_CONFIG_H \
+	-DSQLITE_EXPERIMENTAL_PRAGMA_20251114 \
 	-DSQLITE_CUSTOM_INCLUDE=sqlite_opt.h \
 	$(awk '{print "-Wl,--export="$0}' exports.txt)
 

vendor/github.com/ncruces/go-sqlite3/embed/exports.txt

@@ -59,7 +59,7 @@ sqlite3_db_filename
 sqlite3_db_name
 sqlite3_db_readonly
 sqlite3_db_release_memory
-sqlite3_db_status
+sqlite3_db_status64
 sqlite3_declare_vtab
 sqlite3_errcode
 sqlite3_errmsg

vendor/github.com/ncruces/go-sqlite3/embed/init.go

@@ -17,5 +17,7 @@ import (
 var binary string
 
 func init() {
-	sqlite3.Binary = unsafe.Slice(unsafe.StringData(binary), len(binary))
+	if sqlite3.Binary == nil {
+		sqlite3.Binary = unsafe.Slice(unsafe.StringData(binary), len(binary))
+	}
 }

vendor/github.com/ncruces/go-sqlite3/error.go

@@ -11,6 +11,7 @@ import (
 //
 // https://sqlite.org/c3ref/errcode.html
 type Error struct {
+	sys  error
 	msg  string
 	sql  string
 	code res_t
@@ -33,16 +34,28 @@ func (e *Error) ExtendedCode() ExtendedErrorCode {
 // Error implements the error interface.
 func (e *Error) Error() string {
 	var b strings.Builder
-	b.WriteString(util.ErrorCodeString(uint32(e.code)))
+	b.WriteString(util.ErrorCodeString(e.code))
 
 	if e.msg != "" {
 		b.WriteString(": ")
 		b.WriteString(e.msg)
 	}
+	if e.sys != nil {
+		b.WriteString(": ")
+		b.WriteString(e.sys.Error())
+	}
 
 	return b.String()
 }
 
+// Unwrap returns the underlying operating system error
+// that caused the I/O error or failure to open a file.
+//
+// https://sqlite.org/c3ref/system_errno.html
+func (e *Error) Unwrap() error {
+	return e.sys
+}
+
 // Is tests whether this error matches a given [ErrorCode] or [ExtendedErrorCode].
 //
 // It makes it possible to do:
@@ -90,7 +103,16 @@ func (e *Error) SQL() string {
 
 // Error implements the error interface.
 func (e ErrorCode) Error() string {
-	return util.ErrorCodeString(uint32(e))
+	return util.ErrorCodeString(e)
+}
+
+// As converts this error to an [ExtendedErrorCode].
+func (e ErrorCode) As(err any) bool {
+	c, ok := err.(*xErrorCode)
+	if ok {
+		*c = xErrorCode(e)
+	}
+	return ok
 }
 
 // Temporary returns true for [BUSY] errors.
@@ -105,7 +127,7 @@ func (e ErrorCode) ExtendedCode() ExtendedErrorCode {
 
 // Error implements the error interface.
 func (e ExtendedErrorCode) Error() string {
-	return util.ErrorCodeString(uint32(e))
+	return util.ErrorCodeString(e)
 }
 
 // Is tests whether this error matches a given [ErrorCode].
@@ -150,14 +172,10 @@ func errorCode(err error, def ErrorCode) (msg string, code res_t) {
 		return code.msg, res_t(code.code)
 	}
 
-	var ecode ErrorCode
 	var xcode xErrorCode
-	switch {
-	case errors.As(err, &xcode):
+	if errors.As(err, &xcode) {
 		code = res_t(xcode)
-	case errors.As(err, &ecode):
-		code = res_t(ecode)
-	default:
+	} else {
 		code = res_t(def)
 	}
 	return err.Error(), code

vendor/github.com/ncruces/go-sqlite3/internal/alloc/alloc_unix.go

@@ -5,8 +5,9 @@ package alloc
 import (
 	"math"
 
-	"github.com/tetratelabs/wazero/experimental"
 	"golang.org/x/sys/unix"
+
+	"github.com/tetratelabs/wazero/experimental"
 )
 
 func NewMemory(cap, max uint64) experimental.LinearMemory {

vendor/github.com/ncruces/go-sqlite3/internal/alloc/alloc_windows.go

@@ -5,8 +5,9 @@ import (
 	"reflect"
 	"unsafe"
 
-	"github.com/tetratelabs/wazero/experimental"
 	"golang.org/x/sys/windows"
+
+	"github.com/tetratelabs/wazero/experimental"
 )
 
 func NewMemory(cap, max uint64) experimental.LinearMemory {

vendor/github.com/ncruces/go-sqlite3/internal/util/const.go

@@ -39,6 +39,9 @@ const (
 	ERROR_MISSING_COLLSEQ   = ERROR | (1 << 8)
 	ERROR_RETRY             = ERROR | (2 << 8)
 	ERROR_SNAPSHOT          = ERROR | (3 << 8)
+	ERROR_RESERVESIZE       = ERROR | (4 << 8)
+	ERROR_KEY               = ERROR | (5 << 8)
+	ERROR_UNABLE            = ERROR | (6 << 8)
 	IOERR_READ              = IOERR | (1 << 8)
 	IOERR_SHORT_READ        = IOERR | (2 << 8)
 	IOERR_WRITE             = IOERR | (3 << 8)
@@ -73,6 +76,8 @@ const (
 	IOERR_DATA              = IOERR | (32 << 8)
 	IOERR_CORRUPTFS         = IOERR | (33 << 8)
 	IOERR_IN_PAGE           = IOERR | (34 << 8)
+	IOERR_BADKEY            = IOERR | (35 << 8)
+	IOERR_CODEC             = IOERR | (36 << 8)
 	LOCKED_SHAREDCACHE      = LOCKED | (1 << 8)
 	LOCKED_VTAB             = LOCKED | (2 << 8)
 	BUSY_RECOVERY           = BUSY | (1 << 8)

vendor/github.com/ncruces/go-sqlite3/internal/util/error.go

@@ -33,8 +33,12 @@ func AssertErr() ErrorString {
 	return ErrorString(msg)
 }
 
-func ErrorCodeString(rc uint32) string {
-	switch rc {
+type errorCode interface {
+	~uint8 | ~uint16 | ~uint32 | ~int32
+}
+
+func ErrorCodeString[T errorCode](rc T) string {
+	switch uint32(rc) {
 	case ABORT_ROLLBACK:
 		return "sqlite3: abort due to ROLLBACK"
 	case ROW:
@@ -42,7 +46,7 @@ func ErrorCodeString(rc uint32) string {
 	case DONE:
 		return "sqlite3: no more rows available"
 	}
-	switch rc & 0xff {
+	switch uint8(rc) {
 	case OK:
 		return "sqlite3: not an error"
 	case ERROR:

vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_unix.go

@@ -7,8 +7,9 @@ import (
 	"os"
 	"unsafe"
 
-	"github.com/tetratelabs/wazero/api"
 	"golang.org/x/sys/unix"
+
+	"github.com/tetratelabs/wazero/api"
 )
 
 type mmapState struct {

vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_windows.go

@@ -1,12 +1,10 @@
 package util
 
 import (
-	"context"
 	"os"
 	"reflect"
 	"unsafe"
 
-	"github.com/tetratelabs/wazero/api"
 	"golang.org/x/sys/windows"
 )
 
@@ -16,14 +14,21 @@ type MappedRegion struct {
 	addr uintptr
 }
 
-func MapRegion(ctx context.Context, mod api.Module, f *os.File, offset int64, size int32) (*MappedRegion, error) {
-	h, err := windows.CreateFileMapping(windows.Handle(f.Fd()), nil, windows.PAGE_READWRITE, 0, 0, nil)
+func MapRegion(f *os.File, offset int64, size int32) (*MappedRegion, error) {
+	maxSize := offset + int64(size)
+	h, err := windows.CreateFileMapping(
+		windows.Handle(f.Fd()), nil, windows.PAGE_READWRITE,
+		uint32(maxSize>>32), uint32(maxSize), nil)
 	if h == 0 {
 		return nil, err
 	}
 
+	const allocationGranularity = 64 * 1024
+	align := offset % allocationGranularity
+	offset -= align
+
 	a, err := windows.MapViewOfFile(h, windows.FILE_MAP_WRITE,
-		uint32(offset>>32), uint32(offset), uintptr(size))
+		uint32(offset>>32), uint32(offset), uintptr(size)+uintptr(align))
 	if a == 0 {
 		windows.CloseHandle(h)
 		return nil, err
@@ -32,9 +37,9 @@ func MapRegion(ctx context.Context, mod api.Module, f *os.File, offset int64, si
 	ret := &MappedRegion{Handle: h, addr: a}
 	// SliceHeader, although deprecated, avoids a go vet warning.
 	sh := (*reflect.SliceHeader)(unsafe.Pointer(&ret.Data))
+	sh.Data = a + uintptr(align)
 	sh.Len = int(size)
 	sh.Cap = int(size)
-	sh.Data = a
 	return ret, nil
 }
 

vendor/github.com/ncruces/go-sqlite3/internal/util/module.go

@@ -12,6 +12,7 @@ type ConnKey struct{}
 
 type moduleKey struct{}
 type moduleState struct {
+	sysError error
 	mmapState
 	handleState
 }
@@ -23,3 +24,20 @@ func NewContext(ctx context.Context) context.Context {
 	ctx = context.WithValue(ctx, moduleKey{}, state)
 	return ctx
 }
+
+func GetSystemError(ctx context.Context) error {
+	// Test needed to simplify testing.
+	s, ok := ctx.Value(moduleKey{}).(*moduleState)
+	if ok {
+		return s.sysError
+	}
+	return nil
+}
+
+func SetSystemError(ctx context.Context, err error) {
+	// Test needed to simplify testing.
+	s, ok := ctx.Value(moduleKey{}).(*moduleState)
+	if ok {
+		s.sysError = err
+	}
+}

vendor/github.com/ncruces/go-sqlite3/sqlite.go

@@ -5,12 +5,14 @@ import (
 	"context"
 	"math/bits"
 	"os"
+	"runtime"
 	"strings"
 	"sync"
 	"unsafe"
 
 	"github.com/tetratelabs/wazero"
 	"github.com/tetratelabs/wazero/api"
+	"github.com/tetratelabs/wazero/experimental"
 
 	"github.com/ncruces/go-sqlite3/internal/util"
 	"github.com/ncruces/go-sqlite3/vfs"
@@ -79,7 +81,9 @@ func compileSQLite() {
 		return
 	}
 
-	instance.compiled, instance.err = instance.runtime.CompileModule(ctx, bin)
+	instance.compiled, instance.err = instance.runtime.CompileModule(
+		experimental.WithCompilationWorkers(ctx, runtime.GOMAXPROCS(0)/4),
+		bin)
 }
 
 type sqlite struct {
@@ -125,14 +129,15 @@ func (sqlt *sqlite) error(rc res_t, handle ptr_t, sql ...string) error {
 		panic(util.OOMErr)
 	}
 
+	var msg, query string
 	if handle != 0 {
-		var msg, query string
 		if ptr := ptr_t(sqlt.call("sqlite3_errmsg", stk_t(handle))); ptr != 0 {
 			msg = util.ReadString(sqlt.mod, ptr, _MAX_LENGTH)
-			if msg == "not an error" {
+			msg = strings.TrimPrefix(msg, "sqlite3: ")
+			msg = strings.TrimPrefix(msg, util.ErrorCodeString(rc)[len("sqlite3: "):])
+			msg = strings.TrimPrefix(msg, ": ")
+			if msg == "" || msg == "not an error" {
 				msg = ""
-			} else {
-				msg = strings.TrimPrefix(msg, util.ErrorCodeString(uint32(rc))[len("sqlite3: "):])
 			}
 		}
 
@@ -141,10 +146,16 @@ func (sqlt *sqlite) error(rc res_t, handle ptr_t, sql ...string) error {
 				query = sql[0][i:]
 			}
 		}
+	}
 
-		if msg != "" || query != "" {
-			return &Error{code: rc, msg: msg, sql: query}
-		}
+	var sys error
+	switch ErrorCode(rc) {
+	case CANTOPEN, IOERR:
+		sys = util.GetSystemError(sqlt.ctx)
+	}
+
+	if sys != nil || msg != "" || query != "" {
+		return &Error{code: rc, sys: sys, msg: msg, sql: query}
 	}
 	return xErrorCode(rc)
 }

vendor/github.com/ncruces/go-sqlite3/time.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/ncruces/go-sqlite3/internal/util"
+	"github.com/ncruces/go-sqlite3/util/sql3util"
 	"github.com/ncruces/julianday"
 )
 
@@ -157,11 +158,13 @@ func (f TimeFormat) Decode(v any) (time.Time, error) {
 
 	case TimeFormatUnix, TimeFormatUnixFrac:
 		if s, ok := v.(string); ok {
-			f, err := strconv.ParseFloat(s, 64)
-			if err != nil {
-				return time.Time{}, err
+			if i, err := strconv.ParseInt(s, 10, 64); err == nil {
+				v = i
+			} else if f, ok := sql3util.ParseFloat(s); ok {
+				v = f
+			} else {
+				return time.Time{}, util.TimeErr
 			}
-			v = f
 		}
 		switch v := v.(type) {
 		case float64:
@@ -234,8 +237,8 @@ func (f TimeFormat) Decode(v any) (time.Time, error) {
 				v = i
 				break
 			}
-			f, err := strconv.ParseFloat(s, 64)
-			if err == nil {
+			f, ok := sql3util.ParseFloat(s)
+			if ok {
 				v = f
 				break
 			}

vendor/github.com/ncruces/go-sqlite3/util/sql3util/arg.go

@@ -1,6 +1,10 @@
 package sql3util
 
-import "strings"
+import (
+	"strconv"
+	"strings"
+	"time"
+)
 
 // NamedArg splits an named arg into a key and value,
 // around an equals sign.
@@ -63,3 +67,124 @@ func ParseBool(s string) (b, ok bool) {
 	}
 	return false, false
 }
+
+// ParseFloat parses a decimal floating point number.
+func ParseFloat(s string) (f float64, ok bool) {
+	if strings.TrimLeft(s, "+-.0123456789Ee") != "" {
+		return
+	}
+	f, err := strconv.ParseFloat(s, 64)
+	return f, err == nil
+}
+
+// ParseTimeShift parses a time shift modifier,
+// also the output of timediff.
+//
+// https://sqlite.org/lang_datefunc.html
+func ParseTimeShift(s string) (years, months, days int, duration time.Duration, ok bool) {
+	// Sign part: ±
+	neg := strings.HasPrefix(s, "-")
+	sign := neg || strings.HasPrefix(s, "+")
+	if sign {
+		s = s[1:]
+	}
+
+	if ok = len(s) >= 5; !ok {
+		return // !ok
+	}
+
+	defer func() {
+		if neg {
+			years = -years
+			months = -months
+			days = -days
+			duration = -duration
+		}
+	}()
+
+	// Date part: YYYY-MM-DD
+	if s[4] == '-' {
+		if ok = sign && len(s) >= 10 && s[7] == '-'; !ok {
+			return // !ok
+		}
+		if years, ok = parseInt(s[0:4], 0); !ok {
+			return // !ok
+		}
+		if months, ok = parseInt(s[5:7], 12); !ok {
+			return // !ok
+		}
+		if days, ok = parseInt(s[8:10], 31); !ok {
+			return // !ok
+		}
+		if len(s) == 10 {
+			return
+		}
+		if ok = s[10] == ' '; !ok {
+			return // !ok
+		}
+		s = s[11:]
+	}
+
+	// Time part: HH:MM
+	if ok = len(s) >= 5 && s[2] == ':'; !ok {
+		return // !ok
+	}
+
+	var hours, minutes int
+	if hours, ok = parseInt(s[0:2], 24); !ok {
+		return
+	}
+	if minutes, ok = parseInt(s[3:5], 60); !ok {
+		return
+	}
+	duration = time.Duration(hours)*time.Hour + time.Duration(minutes)*time.Minute
+
+	if len(s) == 5 {
+		return
+	}
+	if ok = len(s) >= 8 && s[5] == ':'; !ok {
+		return // !ok
+	}
+
+	// Seconds part: HH:MM:SS
+	var seconds int
+	if seconds, ok = parseInt(s[6:8], 60); !ok {
+		return
+	}
+	duration += time.Duration(seconds) * time.Second
+
+	if len(s) == 8 {
+		return
+	}
+	if ok = len(s) >= 10 && s[8] == '.'; !ok {
+		return // !ok
+	}
+	s = s[9:]
+
+	// Nanosecond part: HH:MM:SS.SSS
+	var nanos int
+	if nanos, ok = parseInt(s[0:min(9, len(s))], 0); !ok {
+		return
+	}
+	for i := len(s); i < 9; i++ {
+		nanos *= 10
+	}
+	duration += time.Duration(nanos)
+
+	// Subnanosecond part.
+	if len(s) > 9 {
+		_, ok = parseInt(s[9:], 0)
+	}
+	return
+}
+
+func parseInt(s string, max int) (i int, _ bool) {
+	for _, r := range []byte(s) {
+		r -= '0'
+		if r > 9 {
+			return
+		}
+		i = i*10 + int(r)
+	}
+	return i, max == 0 || i < max
+}

vendor/github.com/ncruces/go-sqlite3/vfs/README.md

@@ -20,11 +20,12 @@ The main differences to be aware of are
 ### File Locking
 
 POSIX advisory locks,
-which SQLite uses on [Unix](https://github.com/sqlite/sqlite/blob/5d60f4/src/os_unix.c#L13-L14),
-are [broken by design](https://github.com/sqlite/sqlite/blob/5d60f4/src/os_unix.c#L1074-L1162).
+which SQLite uses on [Unix](https://github.com/sqlite/sqlite/blob/41fda52/src/os_unix.c#L13-L14),
+are [broken by design](https://github.com/sqlite/sqlite/blob/41fda52/src/os_unix.c#L1188-L1276).
 Instead, on Linux and macOS, this package uses
-[OFD locks](https://gnu.org/software/libc/manual/html_node/Open-File-Description-Locks.html)
+[OFD locks](https://sourceware.org/glibc/manual/2.25/html_node/Open-File-Description-Locks.html)
 to synchronize access to database files.
+OFD locks require [Linux 3.15](https://lwn.net/Articles/586904/).
 
 This package can also use
 [BSD locks](https://man.freebsd.org/cgi/man.cgi?query=flock&sektion=2),
@@ -73,7 +74,7 @@ to check if your build supports shared memory.
 
 ### Blocking Locks
 
-On Windows and macOS, this package implements
+On macOS, this package implements
 [Wal-mode blocking locks](https://sqlite.org/src/doc/tip/doc/wal-lock.md).
 
 ### Batch-Atomic Write
@@ -116,9 +117,13 @@ The VFS can be customized with a few build tags:
 
 - [`github.com/ncruces/go-sqlite3/vfs/memdb`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/memdb)
   implements an in-memory VFS.
+- [`github.com/ncruces/go-sqlite3/vfs/mvcc`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/mvcc)
+  implements an in-memory MVCC VFS.
 - [`github.com/ncruces/go-sqlite3/vfs/readervfs`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/readervfs)
   implements a VFS for immutable databases.
 - [`github.com/ncruces/go-sqlite3/vfs/adiantum`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/adiantum)
   wraps a VFS to offer encryption at rest.
 - [`github.com/ncruces/go-sqlite3/vfs/xts`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/xts)
   wraps a VFS to offer encryption at rest.
+- [`github.com/ncruces/go-sqlite3/litestream`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/litestream)
+  implements Litestream [lightweight read-replicas](https://fly.io/blog/litestream-revamped/#lightweight-read-replicas).

vendor/github.com/ncruces/go-sqlite3/vfs/api.go

@@ -10,7 +10,8 @@ import (
 
 // A VFS defines the interface between the SQLite core and the underlying operating system.
 //
-// Use sqlite3.ErrorCode or sqlite3.ExtendedErrorCode to return specific error codes to SQLite.
+// Use [SystemError], sqlite3.ErrorCode, or sqlite3.ExtendedErrorCode
+// to return specific error codes to SQLite.
 //
 // https://sqlite.org/c3ref/vfs.html
 type VFS interface {
@@ -31,8 +32,9 @@ type VFSFilename interface {
 
 // A File represents an open file in the OS interface layer.
 //
-// Use sqlite3.ErrorCode or sqlite3.ExtendedErrorCode to return specific error codes to SQLite.
-// In particular, sqlite3.BUSY is necessary to correctly implement lock methods.
+// Use [SystemError], sqlite3.ErrorCode, or sqlite3.ExtendedErrorCode
+// to return specific error codes to SQLite.
+// In particular, sqlite3.BUSY is needed to correctly implement lock methods.
 //
 // https://sqlite.org/c3ref/io_methods.html
 type File interface {
@@ -193,8 +195,8 @@ type FileSharedMemory interface {
 // SharedMemory is a shared-memory WAL-index implementation.
 // Use [NewSharedMemory] to create a shared-memory.
 type SharedMemory interface {
-	shmMap(context.Context, api.Module, int32, int32, bool) (ptr_t, _ErrorCode)
-	shmLock(int32, int32, _ShmFlag) _ErrorCode
+	shmMap(context.Context, api.Module, int32, int32, bool) (ptr_t, error)
+	shmLock(int32, int32, _ShmFlag) error
 	shmUnmap(bool)
 	shmBarrier()
 	io.Closer
@@ -205,6 +207,10 @@ type blockingSharedMemory interface {
 	shmEnableBlocking(block bool)
 }
 
+// FileControl makes it easy to forward all fileControl methods,
+// which we want to do for the checksum VFS.
+// However, this is not a safe default, and other VFSes
+// should explicitly wrap the methods they want to wrap.
 type fileControl interface {
 	File
 	fileControl(ctx context.Context, mod api.Module, op _FcntlOpcode, pArg ptr_t) _ErrorCode

vendor/github.com/ncruces/go-sqlite3/vfs/const.go

@@ -20,11 +20,11 @@ type (
 type _ErrorCode uint32
 
 func (e _ErrorCode) Error() string {
-	return util.ErrorCodeString(uint32(e))
+	return util.ErrorCodeString(e)
 }
 
 const (
-	_OK                      _ErrorCode = util.OK
+	_OK                                 = util.OK
 	_ERROR                   _ErrorCode = util.ERROR
 	_PERM                    _ErrorCode = util.PERM
 	_BUSY                    _ErrorCode = util.BUSY

vendor/github.com/ncruces/go-sqlite3/vfs/file.go

@@ -40,7 +40,7 @@ func evalSymlinks(path string) (string, error) {
 func (vfsOS) Delete(path string, syncDir bool) error {
 	err := os.Remove(path)
 	if errors.Is(err, fs.ErrNotExist) {
-		return _IOERR_DELETE_NOENT
+		return sysError{err, _IOERR_DELETE_NOENT}
 	}
 	if err != nil {
 		return err
@@ -48,12 +48,12 @@ func (vfsOS) Delete(path string, syncDir bool) error {
 	if isUnix && syncDir {
 		f, err := os.Open(filepath.Dir(path))
 		if err != nil {
-			return _OK
+			return nil
 		}
 		defer f.Close()
 		err = osSync(f, 0, SYNC_FULL)
 		if err != nil {
-			return _IOERR_DIR_FSYNC
+			return sysError{err, _IOERR_DIR_FSYNC}
 		}
 	}
 	return nil
@@ -108,14 +108,14 @@ func (vfsOS) OpenFilename(name *Filename, flags OpenFlag) (File, OpenFlag, error
 	}
 	if err != nil {
 		if name == nil {
-			return nil, flags, _IOERR_GETTEMPPATH
+			return nil, flags, sysError{err, _IOERR_GETTEMPPATH}
 		}
 		if errors.Is(err, syscall.EISDIR) {
-			return nil, flags, _CANTOPEN_ISDIR
+			return nil, flags, sysError{err, _CANTOPEN_ISDIR}
 		}
 		if isCreate && isJournl && errors.Is(err, fs.ErrPermission) &&
 			osAccess(name.String(), ACCESS_EXISTS) != nil {
-			return nil, flags, _READONLY_DIRECTORY
+			return nil, flags, sysError{err, _READONLY_DIRECTORY}
 		}
 		return nil, flags, err
 	}
@@ -123,7 +123,7 @@ func (vfsOS) OpenFilename(name *Filename, flags OpenFlag) (File, OpenFlag, error
 	if modeof := name.URIParameter("modeof"); modeof != "" {
 		if err = osSetMode(f, modeof); err != nil {
 			f.Close()
-			return nil, flags, _IOERR_FSTAT
+			return nil, flags, sysError{err, _IOERR_FSTAT}
 		}
 	}
 	if isUnix && flags&OPEN_DELETEONCLOSE != 0 {
@@ -193,7 +193,7 @@ func (f *vfsFile) Sync(flags SyncFlag) error {
 		defer d.Close()
 		err = osSync(f.File, f.flags, flags)
 		if err != nil {
-			return _IOERR_DIR_FSYNC
+			return sysError{err, _IOERR_DIR_FSYNC}
 		}
 	}
 	return nil

vendor/github.com/ncruces/go-sqlite3/vfs/filename.go

@@ -120,7 +120,7 @@ func (n *Filename) URIParameter(key string) string {
 	}
 
 	// Parse the format from:
-	// https://github.com/sqlite/sqlite/blob/b74eb0/src/pager.c#L4797-L4840
+	// https://github.com/sqlite/sqlite/blob/41fda52/src/pager.c#L4821-L4864
 	// This avoids having to alloc/free the key just to find a value.
 	for {
 		k := util.ReadString(n.mod, ptr, _MAX_NAME)
@@ -160,7 +160,7 @@ func (n *Filename) URIParameters() url.Values {
 	var params url.Values
 
 	// Parse the format from:
-	// https://github.com/sqlite/sqlite/blob/b74eb0/src/pager.c#L4797-L4840
+	// https://github.com/sqlite/sqlite/blob/41fda52/src/pager.c#L4821-L4864
 	// This is the only way to support multiple valued keys.
 	for {
 		k := util.ReadString(n.mod, ptr, _MAX_NAME)

vendor/github.com/ncruces/go-sqlite3/vfs/lock.go

@@ -51,8 +51,8 @@ func (f *vfsFile) Lock(lock LockLevel) error {
 		if f.lock != LOCK_NONE {
 			panic(util.AssertErr())
 		}
-		if rc := osGetSharedLock(f.File); rc != _OK {
-			return rc
+		if err := osGetSharedLock(f.File); err != nil {
+			return err
 		}
 		f.lock = LOCK_SHARED
 		return nil
@@ -62,8 +62,8 @@ func (f *vfsFile) Lock(lock LockLevel) error {
 		if f.lock != LOCK_SHARED {
 			panic(util.AssertErr())
 		}
-		if rc := osGetReservedLock(f.File); rc != _OK {
-			return rc
+		if err := osGetReservedLock(f.File); err != nil {
+			return err
 		}
 		f.lock = LOCK_RESERVED
 		return nil
@@ -73,8 +73,8 @@ func (f *vfsFile) Lock(lock LockLevel) error {
 		if f.lock <= LOCK_NONE || f.lock >= LOCK_EXCLUSIVE {
 			panic(util.AssertErr())
 		}
-		if rc := osGetExclusiveLock(f.File, &f.lock); rc != _OK {
-			return rc
+		if err := osGetExclusiveLock(f.File, &f.lock); err != nil {
+			return err
 		}
 		f.lock = LOCK_EXCLUSIVE
 		return nil
@@ -101,14 +101,14 @@ func (f *vfsFile) Unlock(lock LockLevel) error {
 
 	switch lock {
 	case LOCK_SHARED:
-		rc := osDowngradeLock(f.File, f.lock)
+		err := osDowngradeLock(f.File, f.lock)
 		f.lock = LOCK_SHARED
-		return rc
+		return err
 
 	case LOCK_NONE:
-		rc := osReleaseLock(f.File, f.lock)
+		err := osReleaseLock(f.File, f.lock)
 		f.lock = LOCK_NONE
-		return rc
+		return err
 
 	default:
 		panic(util.AssertErr())

vendor/github.com/ncruces/go-sqlite3/vfs/os_bsd.go

@@ -8,13 +8,13 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-func osGetSharedLock(file *os.File) _ErrorCode {
+func osGetSharedLock(file *os.File) error {
 	return osFlock(file, unix.LOCK_SH|unix.LOCK_NB, _IOERR_RDLOCK)
 }
 
-func osGetReservedLock(file *os.File) _ErrorCode {
-	rc := osFlock(file, unix.LOCK_EX|unix.LOCK_NB, _IOERR_LOCK)
-	if rc == _BUSY {
+func osGetReservedLock(file *os.File) error {
+	err := osFlock(file, unix.LOCK_EX|unix.LOCK_NB, _IOERR_LOCK)
+	if err == _BUSY {
 		// The documentation states that a lock is upgraded by
 		// releasing the previous lock, then acquiring the new lock.
 		// Going over the source code of various BSDs, though,
@@ -26,19 +26,19 @@ func osGetReservedLock(file *os.File) _ErrorCode {
 		// and invoke the busy handler if appropriate.
 		return _BUSY_SNAPSHOT
 	}
-	return rc
+	return err
 }
 
-func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
+func osGetExclusiveLock(file *os.File, state *LockLevel) error {
 	if *state >= LOCK_RESERVED {
-		return _OK
+		return nil
 	}
 	return osGetReservedLock(file)
 }
 
-func osDowngradeLock(file *os.File, _ LockLevel) _ErrorCode {
-	rc := osFlock(file, unix.LOCK_SH|unix.LOCK_NB, _IOERR_RDLOCK)
-	if rc == _BUSY {
+func osDowngradeLock(file *os.File, _ LockLevel) error {
+	err := osFlock(file, unix.LOCK_SH|unix.LOCK_NB, _IOERR_RDLOCK)
+	if err == _BUSY {
 		// The documentation states that a lock is downgraded by
 		// releasing the previous lock then acquiring the new lock.
 		// Going over the source code of various BSDs, though,
@@ -46,44 +46,44 @@ func osDowngradeLock(file *os.File, _ LockLevel) _ErrorCode {
 		// Return IOERR_RDLOCK, as BUSY would cause an assert to fail.
 		return _IOERR_RDLOCK
 	}
-	return _OK
+	return err
 }
 
-func osReleaseLock(file *os.File, _ LockLevel) _ErrorCode {
+func osReleaseLock(file *os.File, _ LockLevel) error {
 	for {
 		err := unix.Flock(int(file.Fd()), unix.LOCK_UN)
 		if err == nil {
-			return _OK
+			return nil
 		}
 		if err != unix.EINTR {
-			return _IOERR_UNLOCK
+			return sysError{err, _IOERR_UNLOCK}
 		}
 	}
 }
 
-func osCheckReservedLock(file *os.File) (bool, _ErrorCode) {
+func osCheckReservedLock(file *os.File) (bool, error) {
 	// Test the RESERVED lock with fcntl(F_GETLK).
 	// This only works on systems where fcntl and flock are compatible.
 	// However, SQLite only calls this while holding a shared lock,
 	// so the difference is immaterial.
-	lock, rc := osTestLock(file, _RESERVED_BYTE, 1)
-	return lock == unix.F_WRLCK, rc
+	lock, err := osTestLock(file, _RESERVED_BYTE, 1, _IOERR_CHECKRESERVEDLOCK)
+	return lock == unix.F_WRLCK, err
 }
 
-func osFlock(file *os.File, how int, def _ErrorCode) _ErrorCode {
+func osFlock(file *os.File, how int, def _ErrorCode) error {
 	err := unix.Flock(int(file.Fd()), how)
 	return osLockErrorCode(err, def)
 }
 
-func osReadLock(file *os.File, start, len int64) _ErrorCode {
+func osReadLock(file *os.File, start, len int64) error {
 	return osLock(file, unix.F_RDLCK, start, len, _IOERR_RDLOCK)
 }
 
-func osWriteLock(file *os.File, start, len int64) _ErrorCode {
+func osWriteLock(file *os.File, start, len int64) error {
 	return osLock(file, unix.F_WRLCK, start, len, _IOERR_LOCK)
 }
 
-func osLock(file *os.File, typ int16, start, len int64, def _ErrorCode) _ErrorCode {
+func osLock(file *os.File, typ int16, start, len int64, def _ErrorCode) error {
 	err := unix.FcntlFlock(file.Fd(), unix.F_SETLK, &unix.Flock_t{
 		Type:  typ,
 		Start: start,
@@ -92,7 +92,7 @@ func osLock(file *os.File, typ int16, start, len int64, def _ErrorCode) _ErrorCo
 	return osLockErrorCode(err, def)
 }
 
-func osUnlock(file *os.File, start, len int64) _ErrorCode {
+func osUnlock(file *os.File, start, len int64) error {
 	lock := unix.Flock_t{
 		Type:  unix.F_UNLCK,
 		Start: start,
@@ -101,10 +101,10 @@ func osUnlock(file *os.File, start, len int64) _ErrorCode {
 	for {
 		err := unix.FcntlFlock(file.Fd(), unix.F_SETLK, &lock)
 		if err == nil {
-			return _OK
+			return nil
 		}
 		if err != unix.EINTR {
-			return _IOERR_UNLOCK
+			return sysError{err, _IOERR_UNLOCK}
 		}
 	}
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_darwin.go

@@ -75,15 +75,15 @@ func osAllocate(file *os.File, size int64) error {
 	return file.Truncate(size)
 }
 
-func osReadLock(file *os.File, start, len int64, timeout time.Duration) _ErrorCode {
+func osReadLock(file *os.File, start, len int64, timeout time.Duration) error {
 	return osLock(file, unix.F_RDLCK, start, len, timeout, _IOERR_RDLOCK)
 }
 
-func osWriteLock(file *os.File, start, len int64, timeout time.Duration) _ErrorCode {
+func osWriteLock(file *os.File, start, len int64, timeout time.Duration) error {
 	return osLock(file, unix.F_WRLCK, start, len, timeout, _IOERR_LOCK)
 }
 
-func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, def _ErrorCode) _ErrorCode {
+func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, def _ErrorCode) error {
 	lock := &flocktimeout_t{fl: unix.Flock_t{
 		Type:  typ,
 		Start: start,
@@ -103,7 +103,7 @@ func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, d
 	return osLockErrorCode(err, def)
 }
 
-func osUnlock(file *os.File, start, len int64) _ErrorCode {
+func osUnlock(file *os.File, start, len int64) error {
 	lock := unix.Flock_t{
 		Type:  unix.F_UNLCK,
 		Start: start,
@@ -112,10 +112,10 @@ func osUnlock(file *os.File, start, len int64) _ErrorCode {
 	for {
 		err := unix.FcntlFlock(file.Fd(), _F_OFD_SETLK, &lock)
 		if err == nil {
-			return _OK
+			return nil
 		}
 		if err != unix.EINTR {
-			return _IOERR_UNLOCK
+			return sysError{err, _IOERR_UNLOCK}
 		}
 	}
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_dotlk.go

@@ -23,7 +23,7 @@ type vfsDotLocker struct {
 	reserved *os.File // +checklocks:vfsDotLocksMtx
 }
 
-func osGetSharedLock(file *os.File) _ErrorCode {
+func osGetSharedLock(file *os.File) error {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
@@ -34,7 +34,7 @@ func osGetSharedLock(file *os.File) _ErrorCode {
 			if errors.Is(err, fs.ErrExist) {
 				return _BUSY // Another process has the lock.
 			}
-			return _IOERR_LOCK
+			return sysError{err, _IOERR_LOCK}
 		}
 		locker = &vfsDotLocker{}
 		vfsDotLocks[name] = locker
@@ -44,10 +44,10 @@ func osGetSharedLock(file *os.File) _ErrorCode {
 		return _BUSY
 	}
 	locker.shared++
-	return _OK
+	return nil
 }
 
-func osGetReservedLock(file *os.File) _ErrorCode {
+func osGetReservedLock(file *os.File) error {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
@@ -61,10 +61,10 @@ func osGetReservedLock(file *os.File) _ErrorCode {
 		return _BUSY
 	}
 	locker.reserved = file
-	return _OK
+	return nil
 }
 
-func osGetExclusiveLock(file *os.File, _ *LockLevel) _ErrorCode {
+func osGetExclusiveLock(file *os.File, _ *LockLevel) error {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
@@ -81,10 +81,10 @@ func osGetExclusiveLock(file *os.File, _ *LockLevel) _ErrorCode {
 	if locker.shared > 1 {
 		return _BUSY
 	}
-	return _OK
+	return nil
 }
 
-func osDowngradeLock(file *os.File, _ LockLevel) _ErrorCode {
+func osDowngradeLock(file *os.File, _ LockLevel) error {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
@@ -100,10 +100,10 @@ func osDowngradeLock(file *os.File, _ LockLevel) _ErrorCode {
 	if locker.pending == file {
 		locker.pending = nil
 	}
-	return _OK
+	return nil
 }
 
-func osReleaseLock(file *os.File, state LockLevel) _ErrorCode {
+func osReleaseLock(file *os.File, state LockLevel) error {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
@@ -115,7 +115,7 @@ func osReleaseLock(file *os.File, state LockLevel) _ErrorCode {
 
 	if locker.shared == 1 {
 		if err := dotlk.Unlock(name + ".lock"); err != nil {
-			return _IOERR_UNLOCK
+			return sysError{err, _IOERR_UNLOCK}
 		}
 		delete(vfsDotLocks, name)
 	}
@@ -127,17 +127,14 @@ func osReleaseLock(file *os.File, state LockLevel) _ErrorCode {
 		locker.pending = nil
 	}
 	locker.shared--
-	return _OK
+	return nil
 }
 
-func osCheckReservedLock(file *os.File) (bool, _ErrorCode) {
+func osCheckReservedLock(file *os.File) (bool, error) {
 	vfsDotLocksMtx.Lock()
 	defer vfsDotLocksMtx.Unlock()
 
 	name := file.Name()
 	locker := vfsDotLocks[name]
-	if locker == nil {
-		return false, _OK
-	}
-	return locker.reserved != nil, _OK
+	return locker != nil && locker.reserved != nil, nil
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_linux.go

@@ -44,15 +44,15 @@ func osAllocate(file *os.File, size int64) error {
 
 }
 
-func osReadLock(file *os.File, start, len int64, timeout time.Duration) _ErrorCode {
+func osReadLock(file *os.File, start, len int64, timeout time.Duration) error {
 	return osLock(file, unix.F_RDLCK, start, len, timeout, _IOERR_RDLOCK)
 }
 
-func osWriteLock(file *os.File, start, len int64, timeout time.Duration) _ErrorCode {
+func osWriteLock(file *os.File, start, len int64, timeout time.Duration) error {
 	return osLock(file, unix.F_WRLCK, start, len, timeout, _IOERR_LOCK)
 }
 
-func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, def _ErrorCode) _ErrorCode {
+func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, def _ErrorCode) error {
 	lock := unix.Flock_t{
 		Type:  typ,
 		Start: start,
@@ -68,7 +68,7 @@ func osLock(file *os.File, typ int16, start, len int64, timeout time.Duration, d
 	return osLockErrorCode(err, def)
 }
 
-func osUnlock(file *os.File, start, len int64) _ErrorCode {
+func osUnlock(file *os.File, start, len int64) error {
 	lock := unix.Flock_t{
 		Type:  unix.F_UNLCK,
 		Start: start,
@@ -77,10 +77,10 @@ func osUnlock(file *os.File, start, len int64) _ErrorCode {
 	for {
 		err := unix.FcntlFlock(file.Fd(), unix.F_OFD_SETLK, &lock)
 		if err == nil {
-			return _OK
+			return nil
 		}
 		if err != unix.EINTR {
-			return _IOERR_UNLOCK
+			return sysError{err, _IOERR_UNLOCK}
 		}
 	}
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_ofd.go

@@ -9,25 +9,25 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-func osGetSharedLock(file *os.File) _ErrorCode {
+func osGetSharedLock(file *os.File) error {
 	// Test the PENDING lock before acquiring a new SHARED lock.
-	if lock, _ := osTestLock(file, _PENDING_BYTE, 1); lock == unix.F_WRLCK {
+	if lock, _ := osTestLock(file, _PENDING_BYTE, 1, _IOERR); lock == unix.F_WRLCK {
 		return _BUSY
 	}
 	// Acquire the SHARED lock.
 	return osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0)
 }
 
-func osGetReservedLock(file *os.File) _ErrorCode {
+func osGetReservedLock(file *os.File) error {
 	// Acquire the RESERVED lock.
 	return osWriteLock(file, _RESERVED_BYTE, 1, 0)
 }
 
-func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
+func osGetExclusiveLock(file *os.File, state *LockLevel) error {
 	if *state == LOCK_RESERVED {
 		// A PENDING lock is needed before acquiring an EXCLUSIVE lock.
-		if rc := osWriteLock(file, _PENDING_BYTE, 1, -1); rc != _OK {
-			return rc
+		if err := osWriteLock(file, _PENDING_BYTE, 1, -1); err != nil {
+			return err
 		}
 		*state = LOCK_PENDING
 	}
@@ -35,10 +35,10 @@ func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
 	return osWriteLock(file, _SHARED_FIRST, _SHARED_SIZE, time.Millisecond)
 }
 
-func osDowngradeLock(file *os.File, state LockLevel) _ErrorCode {
+func osDowngradeLock(file *os.File, state LockLevel) error {
 	if state >= LOCK_EXCLUSIVE {
 		// Downgrade to a SHARED lock.
-		if rc := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); rc != _OK {
+		if err := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); err != nil {
 			// notest // this should never happen
 			return _IOERR_RDLOCK
 		}
@@ -47,13 +47,13 @@ func osDowngradeLock(file *os.File, state LockLevel) _ErrorCode {
 	return osUnlock(file, _PENDING_BYTE, 2)
 }
 
-func osReleaseLock(file *os.File, _ LockLevel) _ErrorCode {
+func osReleaseLock(file *os.File, _ LockLevel) error {
 	// Release all locks.
 	return osUnlock(file, 0, 0)
 }
 
-func osCheckReservedLock(file *os.File) (bool, _ErrorCode) {
+func osCheckReservedLock(file *os.File) (bool, error) {
 	// Test the RESERVED lock.
-	lock, rc := osTestLock(file, _RESERVED_BYTE, 1)
-	return lock == unix.F_WRLCK, rc
+	lock, err := osTestLock(file, _RESERVED_BYTE, 1, _IOERR_CHECKRESERVEDLOCK)
+	return lock == unix.F_WRLCK, err
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_unix.go

@@ -33,7 +33,7 @@ func osReadAt(file *os.File, p []byte, off int64) (int, error) {
 			unix.ERANGE,
 			unix.EIO,
 			unix.ENXIO:
-			return n, _IOERR_CORRUPTFS
+			return n, sysError{err, _IOERR_CORRUPTFS}
 		}
 	}
 	return n, err
@@ -42,7 +42,7 @@ func osReadAt(file *os.File, p []byte, off int64) (int, error) {
 func osWriteAt(file *os.File, p []byte, off int64) (int, error) {
 	n, err := file.WriteAt(p, off)
 	if errno, ok := err.(unix.Errno); ok && errno == unix.ENOSPC {
-		return n, _FULL
+		return n, sysError{err, _FULL}
 	}
 	return n, err
 }
@@ -59,7 +59,7 @@ func osSetMode(file *os.File, modeof string) error {
 	return nil
 }
 
-func osTestLock(file *os.File, start, len int64) (int16, _ErrorCode) {
+func osTestLock(file *os.File, start, len int64, def _ErrorCode) (int16, error) {
 	lock := unix.Flock_t{
 		Type:  unix.F_WRLCK,
 		Start: start,
@@ -68,17 +68,17 @@ func osTestLock(file *os.File, start, len int64) (int16, _ErrorCode) {
 	for {
 		err := unix.FcntlFlock(file.Fd(), unix.F_GETLK, &lock)
 		if err == nil {
-			return lock.Type, _OK
+			return lock.Type, nil
 		}
 		if err != unix.EINTR {
-			return 0, _IOERR_CHECKRESERVEDLOCK
+			return 0, sysError{err, def}
 		}
 	}
 }
 
-func osLockErrorCode(err error, def _ErrorCode) _ErrorCode {
+func osLockErrorCode(err error, def _ErrorCode) error {
 	if err == nil {
-		return _OK
+		return nil
 	}
 	if errno, ok := err.(unix.Errno); ok {
 		switch errno {
@@ -92,12 +92,12 @@ func osLockErrorCode(err error, def _ErrorCode) _ErrorCode {
 			unix.ETIMEDOUT:
 			return _BUSY
 		case unix.EPERM:
-			return _PERM
+			return sysError{err, _PERM}
 		}
 		// notest // usually EWOULDBLOCK == EAGAIN
 		if errno == unix.EWOULDBLOCK && unix.EWOULDBLOCK != unix.EAGAIN {
 			return _BUSY
 		}
 	}
-	return def
+	return sysError{err, def}
 }

vendor/github.com/ncruces/go-sqlite3/vfs/os_windows.go

@@ -20,31 +20,31 @@ func osWriteAt(file *os.File, p []byte, off int64) (int, error) {
 		case
 			windows.ERROR_HANDLE_DISK_FULL,
 			windows.ERROR_DISK_FULL:
-			return n, _FULL
+			return n, sysError{err, _FULL}
 		}
 	}
 	return n, err
 }
 
-func osGetSharedLock(file *os.File) _ErrorCode {
+func osGetSharedLock(file *os.File) error {
 	// Acquire the PENDING lock temporarily before acquiring a new SHARED lock.
-	rc := osReadLock(file, _PENDING_BYTE, 1, 0)
-	if rc == _OK {
+	err := osReadLock(file, _PENDING_BYTE, 1, 0)
+	if err == nil {
 		// Acquire the SHARED lock.
-		rc = osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0)
+		err = osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0)
 
 		// Release the PENDING lock.
 		osUnlock(file, _PENDING_BYTE, 1)
 	}
-	return rc
+	return err
 }
 
-func osGetReservedLock(file *os.File) _ErrorCode {
+func osGetReservedLock(file *os.File) error {
 	// Acquire the RESERVED lock.
 	return osWriteLock(file, _RESERVED_BYTE, 1, 0)
 }
 
-func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
+func osGetExclusiveLock(file *os.File, state *LockLevel) error {
 	// A PENDING lock is needed before releasing the SHARED lock.
 	if *state < LOCK_PENDING {
 		// If we were RESERVED, we can block indefinitely.
@@ -52,8 +52,8 @@ func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
 		if *state == LOCK_RESERVED {
 			timeout = -1
 		}
-		if rc := osWriteLock(file, _PENDING_BYTE, 1, timeout); rc != _OK {
-			return rc
+		if err := osWriteLock(file, _PENDING_BYTE, 1, timeout); err != nil {
+			return err
 		}
 		*state = LOCK_PENDING
 	}
@@ -63,25 +63,25 @@ func osGetExclusiveLock(file *os.File, state *LockLevel) _ErrorCode {
 
 	// Acquire the EXCLUSIVE lock.
 	// Can't wait here, because the file is not OVERLAPPED.
-	rc := osWriteLock(file, _SHARED_FIRST, _SHARED_SIZE, 0)
+	err := osWriteLock(file, _SHARED_FIRST, _SHARED_SIZE, 0)
 
-	if rc != _OK {
+	if err != nil {
 		// Reacquire the SHARED lock.
-		if rc := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); rc != _OK {
+		if err := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); err != nil {
 			// notest // this should never happen
 			return _IOERR_RDLOCK
 		}
 	}
-	return rc
+	return err
 }
 
-func osDowngradeLock(file *os.File, state LockLevel) _ErrorCode {
+func osDowngradeLock(file *os.File, state LockLevel) error {
 	if state >= LOCK_EXCLUSIVE {
 		// Release the EXCLUSIVE lock while holding the PENDING lock.
 		osUnlock(file, _SHARED_FIRST, _SHARED_SIZE)
 
 		// Reacquire the SHARED lock.
-		if rc := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); rc != _OK {
+		if err := osReadLock(file, _SHARED_FIRST, _SHARED_SIZE, 0); err != nil {
 			// notest // this should never happen
 			return _IOERR_RDLOCK
 		}
@@ -94,10 +94,10 @@ func osDowngradeLock(file *os.File, state LockLevel) _ErrorCode {
 	if state >= LOCK_PENDING {
 		osUnlock(file, _PENDING_BYTE, 1)
 	}
-	return _OK
+	return nil
 }
 
-func osReleaseLock(file *os.File, state LockLevel) _ErrorCode {
+func osReleaseLock(file *os.File, state LockLevel) error {
 	// Release all locks, PENDING must be last.
 	if state >= LOCK_RESERVED {
 		osUnlock(file, _RESERVED_BYTE, 1)
@@ -108,31 +108,32 @@ func osReleaseLock(file *os.File, state LockLevel) _ErrorCode {
 	if state >= LOCK_PENDING {
 		osUnlock(file, _PENDING_BYTE, 1)
 	}
-	return _OK
+	return nil
 }
 
-func osCheckReservedLock(file *os.File) (bool, _ErrorCode) {
+func osCheckReservedLock(file *os.File) (bool, error) {
 	// Test the RESERVED lock.
-	rc := osLock(file, 0, _RESERVED_BYTE, 1, 0, _IOERR_CHECKRESERVEDLOCK)
-	if rc == _BUSY {
-		return true, _OK
+	err := osLock(file, 0, _RESERVED_BYTE, 1, 0, _IOERR_CHECKRESERVEDLOCK)
+	if err == _BUSY {
+		return true, nil
 	}
-	if rc == _OK {
+	if err == nil {
 		// Release the RESERVED lock.
 		osUnlock(file, _RESERVED_BYTE, 1)
+		return false, nil
 	}
-	return false, rc
+	return false, err
 }
 
-func osReadLock(file *os.File, start, len uint32, timeout time.Duration) _ErrorCode {
+func osReadLock(file *os.File, start, len uint32, timeout time.Duration) error {
 	return osLock(file, 0, start, len, timeout, _IOERR_RDLOCK)
 }
 
-func osWriteLock(file *os.File, start, len uint32, timeout time.Duration) _ErrorCode {
+func osWriteLock(file *os.File, start, len uint32, timeout time.Duration) error {
 	return osLock(file, windows.LOCKFILE_EXCLUSIVE_LOCK, start, len, timeout, _IOERR_LOCK)
 }
 
-func osLock(file *os.File, flags, start, len uint32, timeout time.Duration, def _ErrorCode) _ErrorCode {
+func osLock(file *os.File, flags, start, len uint32, timeout time.Duration, def _ErrorCode) error {
 	var err error
 	switch {
 	default:
@@ -143,16 +144,16 @@ func osLock(file *os.File, flags, start, len uint32, timeout time.Duration, def
 	return osLockErrorCode(err, def)
 }
 
-func osUnlock(file *os.File, start, len uint32) _ErrorCode {
+func osUnlock(file *os.File, start, len uint32) error {
 	err := windows.UnlockFileEx(windows.Handle(file.Fd()),
 		0, len, 0, &windows.Overlapped{Offset: start})
 	if err == windows.ERROR_NOT_LOCKED {
-		return _OK
+		return nil
 	}
 	if err != nil {
-		return _IOERR_UNLOCK
+		return sysError{err, _IOERR_UNLOCK}
 	}
-	return _OK
+	return nil
 }
 
 func osLockEx(file *os.File, flags, start, len uint32) error {
@@ -160,9 +161,9 @@ func osLockEx(file *os.File, flags, start, len uint32) error {
 		0, len, 0, &windows.Overlapped{Offset: start})
 }
 
-func osLockErrorCode(err error, def _ErrorCode) _ErrorCode {
+func osLockErrorCode(err error, def _ErrorCode) error {
 	if err == nil {
-		return _OK
+		return nil
 	}
 	if errno, ok := err.(windows.Errno); ok {
 		// https://devblogs.microsoft.com/oldnewthing/20140905-00/?p=63
@@ -175,5 +176,5 @@ func osLockErrorCode(err error, def _ErrorCode) _ErrorCode {
 			return _BUSY
 		}
 	}
-	return def
+	return sysError{err, def}
 }

vendor/github.com/ncruces/go-sqlite3/vfs/shm.go

@@ -1,4 +1,4 @@
-//go:build ((linux || darwin || windows || freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le)) || sqlite3_flock || sqlite3_dotlk
+//go:build ((linux || darwin || windows || freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64)) || sqlite3_flock || sqlite3_dotlk
 
 package vfs
 

vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go

@@ -1,8 +1,9 @@
-//go:build ((freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le) && !sqlite3_dotlk) || sqlite3_flock
+//go:build ((freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64) && !sqlite3_dotlk) || sqlite3_flock
 
 package vfs
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"io"
@@ -10,9 +11,10 @@ import (
 	"os"
 	"sync"
 
-	"github.com/tetratelabs/wazero/api"
 	"golang.org/x/sys/unix"
 
+	"github.com/tetratelabs/wazero/api"
+
 	"github.com/ncruces/go-sqlite3/internal/util"
 )
 
@@ -68,9 +70,9 @@ func (s *vfsShm) Close() error {
 	panic(util.AssertErr())
 }
 
-func (s *vfsShm) shmOpen() (rc _ErrorCode) {
+func (s *vfsShm) shmOpen() (err error) {
 	if s.vfsShmParent != nil {
-		return _OK
+		return nil
 	}
 
 	vfsShmListMtx.Lock()
@@ -80,7 +82,7 @@ func (s *vfsShm) shmOpen() (rc _ErrorCode) {
 	// Closing it would release all POSIX locks on it.
 	fi, err := os.Stat(s.path)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return _IOERR_FSTAT
+		return sysError{err, _IOERR_FSTAT}
 	}
 
 	// Find a shared file, increase the reference count.
@@ -88,7 +90,7 @@ func (s *vfsShm) shmOpen() (rc _ErrorCode) {
 		if g != nil && os.SameFile(fi, g.info) {
 			s.vfsShmParent = g
 			g.refs++
-			return _OK
+			return nil
 		}
 	}
 
@@ -96,34 +98,34 @@ func (s *vfsShm) shmOpen() (rc _ErrorCode) {
 	f, err := os.OpenFile(s.path,
 		os.O_RDWR|os.O_CREATE|_O_NOFOLLOW, 0666)
 	if err != nil {
-		return _CANTOPEN
+		return sysError{err, _CANTOPEN}
 	}
 	defer func() {
-		if rc != _OK {
+		if err != nil {
 			f.Close()
 		}
 	}()
 
 	// Dead man's switch.
-	if lock, rc := osTestLock(f, _SHM_DMS, 1); rc != _OK {
-		return _IOERR_LOCK
+	if lock, err := osTestLock(f, _SHM_DMS, 1, _IOERR_LOCK); err != nil {
+		return err
 	} else if lock == unix.F_WRLCK {
 		return _BUSY
 	} else if lock == unix.F_UNLCK {
-		if rc := osWriteLock(f, _SHM_DMS, 1); rc != _OK {
-			return rc
+		if err := osWriteLock(f, _SHM_DMS, 1); err != nil {
+			return err
 		}
 		if err := f.Truncate(0); err != nil {
-			return _IOERR_SHMOPEN
+			return sysError{err, _IOERR_SHMOPEN}
 		}
 	}
-	if rc := osReadLock(f, _SHM_DMS, 1); rc != _OK {
-		return rc
+	if err := osReadLock(f, _SHM_DMS, 1); err != nil {
+		return err
 	}
 
 	fi, err = f.Stat()
 	if err != nil {
-		return _IOERR_FSTAT
+		return sysError{err, _IOERR_FSTAT}
 	}
 
 	// Add the new shared file.
@@ -134,53 +136,57 @@ func (s *vfsShm) shmOpen() (rc _ErrorCode) {
 	for i, g := range vfsShmList {
 		if g == nil {
 			vfsShmList[i] = s.vfsShmParent
-			return _OK
+			return nil
 		}
 	}
 	vfsShmList = append(vfsShmList, s.vfsShmParent)
-	return _OK
+	return nil
 }
 
-func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, _ErrorCode) {
+func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, error) {
 	// Ensure size is a multiple of the OS page size.
 	if int(size)&(unix.Getpagesize()-1) != 0 {
 		return 0, _IOERR_SHMMAP
 	}
 
-	if rc := s.shmOpen(); rc != _OK {
-		return 0, rc
+	if err := s.shmOpen(); err != nil {
+		return 0, err
 	}
 
 	// Check if file is big enough.
 	o, err := s.Seek(0, io.SeekEnd)
 	if err != nil {
-		return 0, _IOERR_SHMSIZE
+		return 0, sysError{err, _IOERR_SHMSIZE}
 	}
 	if n := (int64(id) + 1) * int64(size); n > o {
 		if !extend {
-			return 0, _OK
+			return 0, nil
 		}
-		if osAllocate(s.File, n) != nil {
-			return 0, _IOERR_SHMSIZE
+		if err := osAllocate(s.File, n); err != nil {
+			return 0, sysError{err, _IOERR_SHMSIZE}
 		}
 	}
 
 	r, err := util.MapRegion(ctx, mod, s.File, int64(id)*int64(size), size, false)
 	if err != nil {
-		return 0, _IOERR_SHMMAP
+		return 0, err
 	}
 	s.regions = append(s.regions, r)
-	return r.Ptr, _OK
+	return r.Ptr, nil
 }
 
-func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
+func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) error {
+	if s.vfsShmParent == nil {
+		return _IOERR_SHMLOCK
+	}
+
 	s.Lock()
 	defer s.Unlock()
 
 	// Check if we can obtain/release locks locally.
-	rc := s.shmMemLock(offset, n, flags)
-	if rc != _OK {
-		return rc
+	err := s.shmMemLock(offset, n, flags)
+	if err != nil {
+		return err
 	}
 
 	// Obtain/release the appropriate file locks.
@@ -192,36 +198,38 @@ func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 		for i := begin; i < end; i++ {
 			if s.vfsShmParent.lock[i] != 0 {
 				if i > begin {
-					rc |= osUnlock(s.File, _SHM_BASE+int64(begin), int64(i-begin))
+					err = cmp.Or(err,
+						osUnlock(s.File, _SHM_BASE+int64(begin), int64(i-begin)))
 				}
 				begin = i + 1
 			}
 		}
 		if end > begin {
-			rc |= osUnlock(s.File, _SHM_BASE+int64(begin), int64(end-begin))
+			err = cmp.Or(err,
+				osUnlock(s.File, _SHM_BASE+int64(begin), int64(end-begin)))
 		}
-		return rc
+		return err
 	case flags&_SHM_SHARED != 0:
 		// Acquiring a new shared lock on the file is only necessary
 		// if there was a new shared lock in the range.
 		for i := offset; i < offset+n; i++ {
 			if s.vfsShmParent.lock[i] == 1 {
-				rc = osReadLock(s.File, _SHM_BASE+int64(offset), int64(n))
+				err = osReadLock(s.File, _SHM_BASE+int64(offset), int64(n))
 				break
 			}
 		}
 	case flags&_SHM_EXCLUSIVE != 0:
 		// Acquiring an exclusive lock on the file is always necessary.
-		rc = osWriteLock(s.File, _SHM_BASE+int64(offset), int64(n))
+		err = osWriteLock(s.File, _SHM_BASE+int64(offset), int64(n))
 	default:
 		panic(util.AssertErr())
 	}
 
-	// Release the local locks we had acquired.
-	if rc != _OK {
+	if err != nil {
+		// Release the local locks we had acquired.
 		s.shmMemLock(offset, n, flags^(_SHM_UNLOCK|_SHM_LOCK))
 	}
-	return rc
+	return err
 }
 
 func (s *vfsShm) shmUnmap(delete bool) {

vendor/github.com/ncruces/go-sqlite3/vfs/shm_copy.go

@@ -1,4 +1,4 @@
-//go:build (windows && (386 || arm || amd64 || arm64 || riscv64 || ppc64le)) || sqlite3_dotlk
+//go:build (windows && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64)) || sqlite3_dotlk
 
 package vfs
 
@@ -31,8 +31,8 @@ const (
 //
 // https://sqlite.org/walformat.html#the_wal_index_file_format
 
-func (s *vfsShm) shmAcquire(ptr *_ErrorCode) {
-	if ptr != nil && *ptr != _OK {
+func (s *vfsShm) shmAcquire(errp *error) {
+	if errp != nil && *errp != nil {
 		return
 	}
 	if len(s.ptrs) == 0 || shmEqual(s.shadow[0][:], s.shared[0][:]) {

vendor/github.com/ncruces/go-sqlite3/vfs/shm_dotlk.go

@@ -59,16 +59,16 @@ func (s *vfsShm) Close() error {
 	}
 
 	if err := dotlk.Unlock(s.path); err != nil {
-		return _IOERR_UNLOCK
+		return sysError{err, _IOERR_UNLOCK}
 	}
 	delete(vfsShmList, s.path)
 	s.vfsShmParent = nil
 	return nil
 }
 
-func (s *vfsShm) shmOpen() _ErrorCode {
+func (s *vfsShm) shmOpen() error {
 	if s.vfsShmParent != nil {
-		return _OK
+		return nil
 	}
 
 	vfsShmListMtx.Lock()
@@ -78,7 +78,7 @@ func (s *vfsShm) shmOpen() _ErrorCode {
 	if g, ok := vfsShmList[s.path]; ok {
 		s.vfsShmParent = g
 		g.refs++
-		return _OK
+		return nil
 	}
 
 	// Dead man's switch.
@@ -87,16 +87,16 @@ func (s *vfsShm) shmOpen() _ErrorCode {
 		return _BUSY
 	}
 	if err != nil {
-		return _IOERR_LOCK
+		return sysError{err, _IOERR_LOCK}
 	}
 
 	// Add the new shared buffer.
 	s.vfsShmParent = &vfsShmParent{}
 	vfsShmList[s.path] = s.vfsShmParent
-	return _OK
+	return nil
 }
 
-func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, _ErrorCode) {
+func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, error) {
 	if size != _WALINDEX_PGSZ {
 		return 0, _IOERR_SHMMAP
 	}
@@ -105,8 +105,8 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 		s.free = mod.ExportedFunction("sqlite3_free")
 		s.alloc = mod.ExportedFunction("sqlite3_malloc64")
 	}
-	if rc := s.shmOpen(); rc != _OK {
-		return 0, rc
+	if err := s.shmOpen(); err != nil {
+		return 0, err
 	}
 
 	s.Lock()
@@ -116,7 +116,7 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 	// Extend shared memory.
 	if int(id) >= len(s.shared) {
 		if !extend {
-			return 0, _OK
+			return 0, nil
 		}
 		s.shared = append(s.shared, make([][_WALINDEX_PGSZ]byte, int(id)-len(s.shared)+1)...)
 	}
@@ -140,16 +140,20 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 	}
 
 	s.shadow[0][4] = 1
-	return s.ptrs[id], _OK
+	return s.ptrs[id], nil
 }
 
-func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) (rc _ErrorCode) {
+func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) (err error) {
+	if s.vfsShmParent == nil {
+		return _IOERR_SHMLOCK
+	}
+
 	s.Lock()
 	defer s.Unlock()
 
 	switch {
 	case flags&_SHM_LOCK != 0:
-		defer s.shmAcquire(&rc)
+		defer s.shmAcquire(&err)
 	case flags&_SHM_EXCLUSIVE != 0:
 		s.shmRelease()
 	}

vendor/github.com/ncruces/go-sqlite3/vfs/shm_memlk.go

@@ -1,11 +1,11 @@
-//go:build ((freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le)) || sqlite3_flock || sqlite3_dotlk
+//go:build ((freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64)) || sqlite3_flock || sqlite3_dotlk
 
 package vfs
 
 import "github.com/ncruces/go-sqlite3/internal/util"
 
 // +checklocks:s.Mutex
-func (s *vfsShm) shmMemLock(offset, n int32, flags _ShmFlag) _ErrorCode {
+func (s *vfsShm) shmMemLock(offset, n int32, flags _ShmFlag) error {
 	switch {
 	case flags&_SHM_UNLOCK != 0:
 		for i := offset; i < offset+n; i++ {
@@ -48,6 +48,5 @@ func (s *vfsShm) shmMemLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 	default:
 		panic(util.AssertErr())
 	}
-
-	return _OK
+	return nil
 }

vendor/github.com/ncruces/go-sqlite3/vfs/shm_ofd.go

@@ -1,4 +1,4 @@
-//go:build (linux || darwin) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le) && !(sqlite3_flock || sqlite3_dotlk)
+//go:build (linux || darwin) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64) && !(sqlite3_flock || sqlite3_dotlk)
 
 package vfs
 
@@ -9,9 +9,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/tetratelabs/wazero/api"
 	"golang.org/x/sys/unix"
 
+	"github.com/tetratelabs/wazero/api"
+
 	"github.com/ncruces/go-sqlite3/internal/util"
 )
 
@@ -27,7 +28,10 @@ type vfsShm struct {
 
 var _ blockingSharedMemory = &vfsShm{}
 
-func (s *vfsShm) shmOpen() _ErrorCode {
+func (s *vfsShm) shmOpen() error {
+	if s.fileLock {
+		return nil
+	}
 	if s.File == nil {
 		f, err := os.OpenFile(s.path,
 			os.O_RDWR|os.O_CREATE|_O_NOFOLLOW, 0666)
@@ -37,17 +41,15 @@ func (s *vfsShm) shmOpen() _ErrorCode {
 			s.readOnly = true
 		}
 		if err != nil {
-			return _CANTOPEN
+			return sysError{err, _CANTOPEN}
 		}
+		s.fileLock = false
 		s.File = f
 	}
-	if s.fileLock {
-		return _OK
-	}
 
 	// Dead man's switch.
-	if lock, rc := osTestLock(s.File, _SHM_DMS, 1); rc != _OK {
-		return _IOERR_LOCK
+	if lock, err := osTestLock(s.File, _SHM_DMS, 1, _IOERR_LOCK); err != nil {
+		return err
 	} else if lock == unix.F_WRLCK {
 		return _BUSY
 	} else if lock == unix.F_UNLCK {
@@ -61,54 +63,57 @@ func (s *vfsShm) shmOpen() _ErrorCode {
 		// but only downgrade it to a shared lock.
 		// So no point in blocking here.
 		// The call below to obtain the shared DMS lock may use a blocking lock.
-		if rc := osWriteLock(s.File, _SHM_DMS, 1, 0); rc != _OK {
-			return rc
+		if err := osWriteLock(s.File, _SHM_DMS, 1, 0); err != nil {
+			return err
 		}
 		if err := s.Truncate(0); err != nil {
-			return _IOERR_SHMOPEN
+			return sysError{err, _IOERR_SHMOPEN}
 		}
 	}
-	rc := osReadLock(s.File, _SHM_DMS, 1, time.Millisecond)
-	s.fileLock = rc == _OK
-	return rc
+	err := osReadLock(s.File, _SHM_DMS, 1, time.Millisecond)
+	s.fileLock = err == nil
+	return err
 }
 
-func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, _ErrorCode) {
+func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (ptr_t, error) {
 	// Ensure size is a multiple of the OS page size.
 	if int(size)&(unix.Getpagesize()-1) != 0 {
 		return 0, _IOERR_SHMMAP
 	}
 
-	if rc := s.shmOpen(); rc != _OK {
-		return 0, rc
+	if err := s.shmOpen(); err != nil {
+		return 0, err
 	}
 
 	// Check if file is big enough.
 	o, err := s.Seek(0, io.SeekEnd)
 	if err != nil {
-		return 0, _IOERR_SHMSIZE
+		return 0, sysError{err, _IOERR_SHMSIZE}
 	}
 	if n := (int64(id) + 1) * int64(size); n > o {
 		if !extend {
-			return 0, _OK
+			return 0, nil
 		}
-		if s.readOnly || osAllocate(s.File, n) != nil {
+		if s.readOnly {
 			return 0, _IOERR_SHMSIZE
 		}
+		if err := osAllocate(s.File, n); err != nil {
+			return 0, sysError{err, _IOERR_SHMSIZE}
+		}
 	}
 
 	r, err := util.MapRegion(ctx, mod, s.File, int64(id)*int64(size), size, s.readOnly)
 	if err != nil {
-		return 0, _IOERR_SHMMAP
+		return 0, err
 	}
 	s.regions = append(s.regions, r)
 	if s.readOnly {
 		return r.Ptr, _READONLY
 	}
-	return r.Ptr, _OK
+	return r.Ptr, nil
 }
 
-func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
+func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) error {
 	// Argument check.
 	switch {
 	case n <= 0:
@@ -129,6 +134,10 @@ func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 		panic(util.AssertErr())
 	}
 
+	if s.File == nil {
+		return _IOERR_SHMLOCK
+	}
+
 	var timeout time.Duration
 	if s.blocking {
 		timeout = time.Millisecond
@@ -163,6 +172,7 @@ func (s *vfsShm) shmUnmap(delete bool) {
 	}
 	s.Close()
 	s.File = nil
+	s.fileLock = false
 }
 
 func (s *vfsShm) shmBarrier() {

vendor/github.com/ncruces/go-sqlite3/vfs/shm_other.go

@@ -1,4 +1,4 @@
-//go:build !(((linux || darwin || windows || freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le)) || sqlite3_flock || sqlite3_dotlk)
+//go:build !(((linux || darwin || windows || freebsd || openbsd || netbsd || dragonfly || illumos) && (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64)) || sqlite3_flock || sqlite3_dotlk)
 
 package vfs
 

vendor/github.com/ncruces/go-sqlite3/vfs/shm_windows.go

@@ -1,4 +1,4 @@
-//go:build (386 || arm || amd64 || arm64 || riscv64 || ppc64le) && !sqlite3_dotlk
+//go:build (386 || arm || amd64 || arm64 || riscv64 || ppc64le || loong64) && !sqlite3_dotlk
 
 package vfs
 
@@ -8,9 +8,10 @@ import (
 	"os"
 	"sync"
 
-	"github.com/tetratelabs/wazero/api"
 	"golang.org/x/sys/windows"
 
+	"github.com/tetratelabs/wazero/api"
+
 	"github.com/ncruces/go-sqlite3/internal/util"
 )
 
@@ -40,32 +41,33 @@ func (s *vfsShm) Close() error {
 	return s.File.Close()
 }
 
-func (s *vfsShm) shmOpen() _ErrorCode {
+func (s *vfsShm) shmOpen() error {
+	if s.fileLock {
+		return nil
+	}
 	if s.File == nil {
 		f, err := os.OpenFile(s.path, os.O_RDWR|os.O_CREATE, 0666)
 		if err != nil {
-			return _CANTOPEN
+			return sysError{err, _CANTOPEN}
 		}
+		s.fileLock = false
 		s.File = f
 	}
-	if s.fileLock {
-		return _OK
-	}
 
 	// Dead man's switch.
-	if rc := osWriteLock(s.File, _SHM_DMS, 1, 0); rc == _OK {
+	if osWriteLock(s.File, _SHM_DMS, 1, 0) == nil {
 		err := s.Truncate(0)
 		osUnlock(s.File, _SHM_DMS, 1)
 		if err != nil {
-			return _IOERR_SHMOPEN
+			return sysError{err, _IOERR_SHMOPEN}
 		}
 	}
-	rc := osReadLock(s.File, _SHM_DMS, 1, 0)
-	s.fileLock = rc == _OK
-	return rc
+	err := osReadLock(s.File, _SHM_DMS, 1, 0)
+	s.fileLock = err == nil
+	return err
 }
 
-func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (_ ptr_t, rc _ErrorCode) {
+func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, extend bool) (_ ptr_t, err error) {
 	// Ensure size is a multiple of the OS page size.
 	if size != _WALINDEX_PGSZ || (windows.Getpagesize()-1)&_WALINDEX_PGSZ != 0 {
 		return 0, _IOERR_SHMMAP
@@ -75,31 +77,31 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 		s.free = mod.ExportedFunction("sqlite3_free")
 		s.alloc = mod.ExportedFunction("sqlite3_malloc64")
 	}
-	if rc := s.shmOpen(); rc != _OK {
-		return 0, rc
+	if err := s.shmOpen(); err != nil {
+		return 0, err
 	}
 
-	defer s.shmAcquire(&rc)
+	defer s.shmAcquire(&err)
 
 	// Check if file is big enough.
 	o, err := s.Seek(0, io.SeekEnd)
 	if err != nil {
-		return 0, _IOERR_SHMSIZE
+		return 0, sysError{err, _IOERR_SHMSIZE}
 	}
 	if n := (int64(id) + 1) * int64(size); n > o {
 		if !extend {
-			return 0, _OK
+			return 0, nil
 		}
-		if osAllocate(s.File, n) != nil {
-			return 0, _IOERR_SHMSIZE
+		if err := osAllocate(s.File, n); err != nil {
+			return 0, sysError{err, _IOERR_SHMSIZE}
 		}
 	}
 
 	// Maps regions into memory.
 	for int(id) >= len(s.shared) {
-		r, err := util.MapRegion(ctx, mod, s.File, int64(id)*int64(size), size)
+		r, err := util.MapRegion(s.File, int64(id)*int64(size), size)
 		if err != nil {
-			return 0, _IOERR_SHMMAP
+			return 0, err
 		}
 		s.regions = append(s.regions, r)
 		s.shared = append(s.shared, r.Data)
@@ -124,13 +126,17 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 	}
 
 	s.shadow[0][4] = 1
-	return s.ptrs[id], _OK
+	return s.ptrs[id], nil
 }
 
-func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) (rc _ErrorCode) {
+func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) (err error) {
+	if s.File == nil {
+		return _IOERR_SHMLOCK
+	}
+
 	switch {
 	case flags&_SHM_LOCK != 0:
-		defer s.shmAcquire(&rc)
+		defer s.shmAcquire(&err)
 	case flags&_SHM_EXCLUSIVE != 0:
 		s.shmRelease()
 	}
@@ -168,6 +174,7 @@ func (s *vfsShm) shmUnmap(delete bool) {
 	// Close the file.
 	s.Close()
 	s.File = nil
+	s.fileLock = false
 	if delete {
 		os.Remove(s.path)
 	}

vendor/github.com/ncruces/go-sqlite3/vfs/vfs.go

@@ -102,7 +102,7 @@ func vfsFullPathname(ctx context.Context, mod api.Module, pVfs, zRelative ptr_t,
 	}
 	util.WriteString(mod, zFull, path)
 
-	return vfsErrorCode(err, _CANTOPEN_FULLPATH)
+	return vfsErrorCode(ctx, err, _CANTOPEN_FULLPATH)
 }
 
 func vfsDelete(ctx context.Context, mod api.Module, pVfs, zPath ptr_t, syncDir int32) _ErrorCode {
@@ -110,7 +110,7 @@ func vfsDelete(ctx context.Context, mod api.Module, pVfs, zPath ptr_t, syncDir i
 	path := util.ReadString(mod, zPath, _MAX_PATHNAME)
 
 	err := vfs.Delete(path, syncDir != 0)
-	return vfsErrorCode(err, _IOERR_DELETE)
+	return vfsErrorCode(ctx, err, _IOERR_DELETE)
 }
 
 func vfsAccess(ctx context.Context, mod api.Module, pVfs, zPath ptr_t, flags AccessFlag, pResOut ptr_t) _ErrorCode {
@@ -119,7 +119,7 @@ func vfsAccess(ctx context.Context, mod api.Module, pVfs, zPath ptr_t, flags Acc
 
 	ok, err := vfs.Access(path, flags)
 	util.WriteBool(mod, pResOut, ok)
-	return vfsErrorCode(err, _IOERR_ACCESS)
+	return vfsErrorCode(ctx, err, _IOERR_ACCESS)
 }
 
 func vfsOpen(ctx context.Context, mod api.Module, pVfs, zPath, pFile ptr_t, flags OpenFlag, pOutFlags, pOutVFS ptr_t) _ErrorCode {
@@ -134,7 +134,7 @@ func vfsOpen(ctx context.Context, mod api.Module, pVfs, zPath, pFile ptr_t, flag
 		file, flags, err = vfs.Open(name.String(), flags)
 	}
 	if err != nil {
-		return vfsErrorCode(err, _CANTOPEN)
+		return vfsErrorCode(ctx, err, _CANTOPEN)
 	}
 
 	if file, ok := file.(FilePowersafeOverwrite); ok {
@@ -155,7 +155,7 @@ func vfsOpen(ctx context.Context, mod api.Module, pVfs, zPath, pFile ptr_t, flag
 
 func vfsClose(ctx context.Context, mod api.Module, pFile ptr_t) _ErrorCode {
 	err := vfsFileClose(ctx, mod, pFile)
-	return vfsErrorCode(err, _IOERR_CLOSE)
+	return vfsErrorCode(ctx, err, _IOERR_CLOSE)
 }
 
 func vfsRead(ctx context.Context, mod api.Module, pFile, zBuf ptr_t, iAmt int32, iOfst int64) _ErrorCode {
@@ -167,7 +167,7 @@ func vfsRead(ctx context.Context, mod api.Module, pFile, zBuf ptr_t, iAmt int32,
 		return _OK
 	}
 	if err != io.EOF {
-		return vfsErrorCode(err, _IOERR_READ)
+		return vfsErrorCode(ctx, err, _IOERR_READ)
 	}
 	clear(buf[n:])
 	return _IOERR_SHORT_READ
@@ -178,45 +178,45 @@ func vfsWrite(ctx context.Context, mod api.Module, pFile, zBuf ptr_t, iAmt int32
 	buf := util.View(mod, zBuf, int64(iAmt))
 
 	_, err := file.WriteAt(buf, iOfst)
-	return vfsErrorCode(err, _IOERR_WRITE)
+	return vfsErrorCode(ctx, err, _IOERR_WRITE)
 }
 
 func vfsTruncate(ctx context.Context, mod api.Module, pFile ptr_t, nByte int64) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	err := file.Truncate(nByte)
-	return vfsErrorCode(err, _IOERR_TRUNCATE)
+	return vfsErrorCode(ctx, err, _IOERR_TRUNCATE)
 }
 
 func vfsSync(ctx context.Context, mod api.Module, pFile ptr_t, flags SyncFlag) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	err := file.Sync(flags)
-	return vfsErrorCode(err, _IOERR_FSYNC)
+	return vfsErrorCode(ctx, err, _IOERR_FSYNC)
 }
 
 func vfsFileSize(ctx context.Context, mod api.Module, pFile, pSize ptr_t) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	size, err := file.Size()
 	util.Write64(mod, pSize, size)
-	return vfsErrorCode(err, _IOERR_SEEK)
+	return vfsErrorCode(ctx, err, _IOERR_SEEK)
 }
 
 func vfsLock(ctx context.Context, mod api.Module, pFile ptr_t, eLock LockLevel) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	err := file.Lock(eLock)
-	return vfsErrorCode(err, _IOERR_LOCK)
+	return vfsErrorCode(ctx, err, _IOERR_LOCK)
 }
 
 func vfsUnlock(ctx context.Context, mod api.Module, pFile ptr_t, eLock LockLevel) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	err := file.Unlock(eLock)
-	return vfsErrorCode(err, _IOERR_UNLOCK)
+	return vfsErrorCode(ctx, err, _IOERR_UNLOCK)
 }
 
 func vfsCheckReservedLock(ctx context.Context, mod api.Module, pFile, pResOut ptr_t) _ErrorCode {
 	file := vfsFileGet(ctx, mod, pFile).(File)
 	locked, err := file.CheckReservedLock()
 	util.WriteBool(mod, pResOut, locked)
-	return vfsErrorCode(err, _IOERR_CHECKRESERVEDLOCK)
+	return vfsErrorCode(ctx, err, _IOERR_CHECKRESERVEDLOCK)
 }
 
 func vfsFileControl(ctx context.Context, mod api.Module, pFile ptr_t, op _FcntlOpcode, pArg ptr_t) _ErrorCode {
@@ -268,20 +268,20 @@ func vfsFileControlImpl(ctx context.Context, mod api.Module, file File, op _Fcnt
 		if file, ok := file.(FileSizeHint); ok {
 			size := util.Read64[int64](mod, pArg)
 			err := file.SizeHint(size)
-			return vfsErrorCode(err, _IOERR_TRUNCATE)
+			return vfsErrorCode(ctx, err, _IOERR_TRUNCATE)
 		}
 
 	case _FCNTL_HAS_MOVED:
 		if file, ok := file.(FileHasMoved); ok {
 			moved, err := file.HasMoved()
 			util.WriteBool(mod, pArg, moved)
-			return vfsErrorCode(err, _IOERR_FSTAT)
+			return vfsErrorCode(ctx, err, _IOERR_FSTAT)
 		}
 
 	case _FCNTL_OVERWRITE:
 		if file, ok := file.(FileOverwrite); ok {
 			err := file.Overwrite()
-			return vfsErrorCode(err, _IOERR)
+			return vfsErrorCode(ctx, err, _IOERR)
 		}
 
 	case _FCNTL_SYNC:
@@ -291,29 +291,29 @@ func vfsFileControlImpl(ctx context.Context, mod api.Module, file File, op _Fcnt
 				name = util.ReadString(mod, pArg, _MAX_PATHNAME)
 			}
 			err := file.SyncSuper(name)
-			return vfsErrorCode(err, _IOERR)
+			return vfsErrorCode(ctx, err, _IOERR)
 		}
 
 	case _FCNTL_COMMIT_PHASETWO:
 		if file, ok := file.(FileCommitPhaseTwo); ok {
 			err := file.CommitPhaseTwo()
-			return vfsErrorCode(err, _IOERR)
+			return vfsErrorCode(ctx, err, _IOERR)
 		}
 
 	case _FCNTL_BEGIN_ATOMIC_WRITE:
 		if file, ok := file.(FileBatchAtomicWrite); ok {
 			err := file.BeginAtomicWrite()
-			return vfsErrorCode(err, _IOERR_BEGIN_ATOMIC)
+			return vfsErrorCode(ctx, err, _IOERR_BEGIN_ATOMIC)
 		}
 	case _FCNTL_COMMIT_ATOMIC_WRITE:
 		if file, ok := file.(FileBatchAtomicWrite); ok {
 			err := file.CommitAtomicWrite()
-			return vfsErrorCode(err, _IOERR_COMMIT_ATOMIC)
+			return vfsErrorCode(ctx, err, _IOERR_COMMIT_ATOMIC)
 		}
 	case _FCNTL_ROLLBACK_ATOMIC_WRITE:
 		if file, ok := file.(FileBatchAtomicWrite); ok {
 			err := file.RollbackAtomicWrite()
-			return vfsErrorCode(err, _IOERR_ROLLBACK_ATOMIC)
+			return vfsErrorCode(ctx, err, _IOERR_ROLLBACK_ATOMIC)
 		}
 
 	case _FCNTL_CKPT_START:
@@ -329,16 +329,16 @@ func vfsFileControlImpl(ctx context.Context, mod api.Module, file File, op _Fcnt
 
 	case _FCNTL_PRAGMA:
 		if file, ok := file.(FilePragma); ok {
+			var value string
 			ptr := util.Read32[ptr_t](mod, pArg+1*ptrlen)
 			name := util.ReadString(mod, ptr, _MAX_SQL_LENGTH)
-			var value string
 			if ptr := util.Read32[ptr_t](mod, pArg+2*ptrlen); ptr != 0 {
 				value = util.ReadString(mod, ptr, _MAX_SQL_LENGTH)
 			}
 
 			out, err := file.Pragma(strings.ToLower(name), value)
 
-			ret := vfsErrorCode(err, _ERROR)
+			ret := vfsErrorCode(ctx, err, _ERROR)
 			if ret == _ERROR {
 				out = err.Error()
 			}
@@ -407,14 +407,15 @@ func vfsShmBarrier(ctx context.Context, mod api.Module, pFile ptr_t) {
 
 func vfsShmMap(ctx context.Context, mod api.Module, pFile ptr_t, iRegion, szRegion, bExtend int32, pp ptr_t) _ErrorCode {
 	shm := vfsFileGet(ctx, mod, pFile).(FileSharedMemory).SharedMemory()
-	p, rc := shm.shmMap(ctx, mod, iRegion, szRegion, bExtend != 0)
+	p, err := shm.shmMap(ctx, mod, iRegion, szRegion, bExtend != 0)
 	util.Write32(mod, pp, p)
-	return rc
+	return vfsErrorCode(ctx, err, _IOERR_SHMMAP)
 }
 
 func vfsShmLock(ctx context.Context, mod api.Module, pFile ptr_t, offset, n int32, flags _ShmFlag) _ErrorCode {
 	shm := vfsFileGet(ctx, mod, pFile).(FileSharedMemory).SharedMemory()
-	return shm.shmLock(offset, n, flags)
+	err := shm.shmLock(offset, n, flags)
+	return vfsErrorCode(ctx, err, _IOERR_SHMLOCK)
 }
 
 func vfsShmUnmap(ctx context.Context, mod api.Module, pFile ptr_t, bDelete int32) _ErrorCode {
@@ -454,13 +455,40 @@ func vfsFileClose(ctx context.Context, mod api.Module, pFile ptr_t) error {
 	return util.DelHandle(ctx, id)
 }
 
-func vfsErrorCode(err error, def _ErrorCode) _ErrorCode {
-	if err == nil {
-		return _OK
+func vfsErrorCode(ctx context.Context, err error, code _ErrorCode) _ErrorCode {
+	var sys error
+
+	switch err := err.(type) {
+	case nil:
+		code = _OK
+	case _ErrorCode:
+		code = err
+	case sysError:
+		code = err.code
+		sys = err.error
+	default:
+		switch v := reflect.ValueOf(err); v.Kind() {
+		case reflect.Uint8, reflect.Uint16:
+			code = _ErrorCode(v.Uint())
+		default:
+			sys = err
+		}
 	}
-	switch v := reflect.ValueOf(err); v.Kind() {
-	case reflect.Uint8, reflect.Uint16, reflect.Uint32:
-		return _ErrorCode(v.Uint())
+
+	util.SetSystemError(ctx, sys)
+	return code
+}
+
+// SystemError tags an error with a given
+// sqlite3.ErrorCode or sqlite3.ExtendedErrorCode.
+func SystemError[T interface{ ~uint8 | ~uint16 }](err error, code T) error {
+	if err == nil {
+		return nil
 	}
-	return def
+	return sysError{error: err, code: _ErrorCode(code)}
+}
+
+type sysError struct {
+	error
+	code _ErrorCode
 }

vendor/github.com/ncruces/go-sqlite3/vtab.go

@@ -445,7 +445,8 @@ const (
 type IndexScanFlag uint32
 
 const (
-	INDEX_SCAN_UNIQUE IndexScanFlag = 1
+	INDEX_SCAN_UNIQUE IndexScanFlag = 0x00000001
+	INDEX_SCAN_HEX    IndexScanFlag = 0x00000002
 )
 
 func vtabModuleCallback(i vtabConstructor) func(_ context.Context, _ api.Module, _ ptr_t, _ int32, _, _, _ ptr_t) res_t {
@@ -465,19 +466,19 @@ func vtabModuleCallback(i vtabConstructor) func(_ context.Context, _ api.Module,
 			vtabPutHandle(ctx, mod, ppVTab, val[0].Interface())
 		}
 
-		return vtabError(ctx, mod, pzErr, _PTR_ERROR, err)
+		return vtabError(ctx, mod, pzErr, _PTR_ERROR, err, ERROR)
 	}
 }
 
 func vtabDisconnectCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	err := vtabDelHandle(ctx, mod, pVTab)
-	return vtabError(ctx, mod, 0, _PTR_ERROR, err)
+	return vtabError(ctx, mod, 0, _PTR_ERROR, err, ERROR)
 }
 
 func vtabDestroyCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabDestroyer)
 	err := errors.Join(vtab.Destroy(), vtabDelHandle(ctx, mod, pVTab))
-	return vtabError(ctx, mod, 0, _PTR_ERROR, err)
+	return vtabError(ctx, mod, 0, _PTR_ERROR, err, ERROR)
 }
 
 func vtabBestIndexCallback(ctx context.Context, mod api.Module, pVTab, pIdxInfo ptr_t) res_t {
@@ -490,7 +491,7 @@ func vtabBestIndexCallback(ctx context.Context, mod api.Module, pVTab, pIdxInfo
 	err := vtab.BestIndex(&info)
 
 	info.save()
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabUpdateCallback(ctx context.Context, mod api.Module, pVTab ptr_t, nArg int32, pArg, pRowID ptr_t) res_t {
@@ -504,13 +505,13 @@ func vtabUpdateCallback(ctx context.Context, mod api.Module, pVTab ptr_t, nArg i
 		util.Write64(mod, pRowID, rowID)
 	}
 
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabRenameCallback(ctx context.Context, mod api.Module, pVTab, zNew ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabRenamer)
 	err := vtab.Rename(util.ReadString(mod, zNew, _MAX_NAME))
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabFindFuncCallback(ctx context.Context, mod api.Module, pVTab ptr_t, nArg int32, zName, pxFunc ptr_t) int32 {
@@ -534,51 +535,49 @@ func vtabIntegrityCallback(ctx context.Context, mod api.Module, pVTab, zSchema,
 	err := vtab.Integrity(schema, table, int(mFlags))
 	// xIntegrity should return OK - even if it finds problems in the content of the virtual table.
 	// https://sqlite.org/vtab.html#xintegrity
-	vtabError(ctx, mod, pzErr, _PTR_ERROR, err)
-	_, code := errorCode(err, _OK)
-	return code
+	return vtabError(ctx, mod, pzErr, _PTR_ERROR, err, _OK)
 }
 
 func vtabBeginCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabTxn)
 	err := vtab.Begin()
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabSyncCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabTxn)
 	err := vtab.Sync()
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabCommitCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabTxn)
 	err := vtab.Commit()
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabRollbackCallback(ctx context.Context, mod api.Module, pVTab ptr_t) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabTxn)
 	err := vtab.Rollback()
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabSavepointCallback(ctx context.Context, mod api.Module, pVTab ptr_t, id int32) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabSavepointer)
 	err := vtab.Savepoint(int(id))
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabReleaseCallback(ctx context.Context, mod api.Module, pVTab ptr_t, id int32) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabSavepointer)
 	err := vtab.Release(int(id))
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func vtabRollbackToCallback(ctx context.Context, mod api.Module, pVTab ptr_t, id int32) res_t {
 	vtab := vtabGetHandle(ctx, mod, pVTab).(VTabSavepointer)
 	err := vtab.RollbackTo(int(id))
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func cursorOpenCallback(ctx context.Context, mod api.Module, pVTab, ppCur ptr_t) res_t {
@@ -589,12 +588,12 @@ func cursorOpenCallback(ctx context.Context, mod api.Module, pVTab, ppCur ptr_t)
 		vtabPutHandle(ctx, mod, ppCur, cursor)
 	}
 
-	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, pVTab, _VTAB_ERROR, err, ERROR)
 }
 
 func cursorCloseCallback(ctx context.Context, mod api.Module, pCur ptr_t) res_t {
 	err := vtabDelHandle(ctx, mod, pCur)
-	return vtabError(ctx, mod, 0, _VTAB_ERROR, err)
+	return vtabError(ctx, mod, 0, _PTR_ERROR, err, ERROR)
 }
 
 func cursorFilterCallback(ctx context.Context, mod api.Module, pCur ptr_t, idxNum int32, idxStr ptr_t, nArg int32, pArg ptr_t) res_t {
@@ -609,7 +608,7 @@ func cursorFilterCallback(ctx context.Context, mod api.Module, pCur ptr_t, idxNu
 
 	cursor := vtabGetHandle(ctx, mod, pCur).(VTabCursor)
 	err := cursor.Filter(int(idxNum), idxName, *args...)
-	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err)
+	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err, ERROR)
 }
 
 func cursorEOFCallback(ctx context.Context, mod api.Module, pCur ptr_t) int32 {
@@ -623,14 +622,14 @@ func cursorEOFCallback(ctx context.Context, mod api.Module, pCur ptr_t) int32 {
 func cursorNextCallback(ctx context.Context, mod api.Module, pCur ptr_t) res_t {
 	cursor := vtabGetHandle(ctx, mod, pCur).(VTabCursor)
 	err := cursor.Next()
-	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err)
+	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err, ERROR)
 }
 
 func cursorColumnCallback(ctx context.Context, mod api.Module, pCur, pCtx ptr_t, n int32) res_t {
 	cursor := vtabGetHandle(ctx, mod, pCur).(VTabCursor)
 	db := ctx.Value(connKey{}).(*Conn)
 	err := cursor.Column(Context{db, pCtx}, int(n))
-	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err)
+	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err, ERROR)
 }
 
 func cursorRowIDCallback(ctx context.Context, mod api.Module, pCur, pRowID ptr_t) res_t {
@@ -641,7 +640,7 @@ func cursorRowIDCallback(ctx context.Context, mod api.Module, pCur, pRowID ptr_t
 		util.Write64(mod, pRowID, rowID)
 	}
 
-	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err)
+	return vtabError(ctx, mod, pCur, _CURSOR_ERROR, err, ERROR)
 }
 
 const (
@@ -650,10 +649,10 @@ const (
 	_CURSOR_ERROR
 )
 
-func vtabError(ctx context.Context, mod api.Module, ptr ptr_t, kind uint32, err error) res_t {
+func vtabError(ctx context.Context, mod api.Module, ptr ptr_t, kind uint32, err error, def ErrorCode) res_t {
 	const zErrMsgOffset = 8
-	msg, code := errorCode(err, ERROR)
-	if msg != "" && ptr != 0 {
+	msg, code := errorCode(err, def)
+	if ptr != 0 && msg != "" {
 		switch kind {
 		case _VTAB_ERROR:
 			ptr = ptr + zErrMsgOffset // zErrMsg

vendor/github.com/spf13/cobra/.golangci.yml

@@ -57,3 +57,10 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+  settings:
+    govet:
+      # Disable buildtag check to allow dual build tag syntax (both //go:build and // +build).
+      # This is necessary for Go 1.15 compatibility since //go:build was introduced in Go 1.17.
+      # This can be removed once Cobra requires Go 1.17 or higher.
+      disable:
+        - buildtag

vendor/github.com/spf13/cobra/command.go

@@ -557,7 +557,7 @@ func (c *Command) FlagErrorFunc() (f func(*Command, error) error) {
 	}
 }
 
-var minUsagePadding = 25
+const minUsagePadding = 25
 
 // UsagePadding return padding for the usage.
 func (c *Command) UsagePadding() int {
@@ -567,7 +567,7 @@ func (c *Command) UsagePadding() int {
 	return c.parent.commandsMaxUseLen
 }
 
-var minCommandPathPadding = 11
+const minCommandPathPadding = 11
 
 // CommandPathPadding return padding for the command path.
 func (c *Command) CommandPathPadding() int {
@@ -577,7 +577,7 @@ func (c *Command) CommandPathPadding() int {
 	return c.parent.commandsMaxCommandPathLen
 }
 
-var minNamePadding = 11
+const minNamePadding = 11
 
 // NamePadding returns padding for the name.
 func (c *Command) NamePadding() int {
@@ -1939,7 +1939,7 @@ type tmplFunc struct {
 	fn   func(io.Writer, interface{}) error
 }
 
-var defaultUsageTemplate = `Usage:{{if .Runnable}}
+const defaultUsageTemplate = `Usage:{{if .Runnable}}
   {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}
   {{.CommandPath}} [command]{{end}}{{if gt (len .Aliases) 0}}
 
@@ -2039,7 +2039,7 @@ func defaultUsageFunc(w io.Writer, in interface{}) error {
 	return nil
 }
 
-var defaultHelpTemplate = `{{with (or .Long .Short)}}{{. | trimTrailingWhitespaces}}
+const defaultHelpTemplate = `{{with (or .Long .Short)}}{{. | trimTrailingWhitespaces}}
 
 {{end}}{{if or .Runnable .HasSubCommands}}{{.UsageString}}{{end}}`
 
@@ -2061,7 +2061,7 @@ func defaultHelpFunc(w io.Writer, in interface{}) error {
 	return nil
 }
 
-var defaultVersionTemplate = `{{with .DisplayName}}{{printf "%s " .}}{{end}}{{printf "version %s" .Version}}
+const defaultVersionTemplate = `{{with .DisplayName}}{{printf "%s " .}}{{end}}{{printf "version %s" .Version}}
 `
 
 // defaultVersionFunc is equivalent to executing defaultVersionTemplate. The two should be changed in sync.

vendor/github.com/tetratelabs/wazero/Makefile

@@ -108,23 +108,29 @@ internal/testing/dwarftestdata/testdata/rust/main.wasm.xz:
 	@mv $(@D)/target/$(cargo_target)/release/$(@F) $(@D)
 
 spectest_base_dir := internal/integration_test/spectest
+
 spectest_v1_dir := $(spectest_base_dir)/v1
 spectest_v1_testdata_dir := $(spectest_v1_dir)/testdata
 spec_version_v1 := wg-1.0
+
 spectest_v2_dir := $(spectest_base_dir)/v2
 spectest_v2_testdata_dir := $(spectest_v2_dir)/testdata
-# Latest draft state as of March 12, 2024.
-spec_version_v2 := 1c5e5d178bd75c79b7a12881c529098beaee2a05
+spec_version_v2 := wg-2.0
+
 spectest_threads_dir := $(spectest_base_dir)/threads
 spectest_threads_testdata_dir := $(spectest_threads_dir)/testdata
-# From https://github.com/WebAssembly/threads/tree/upstream-rebuild which has not been merged to main yet.
-# It will likely be renamed to main in the future - https://github.com/WebAssembly/threads/issues/216.
-spec_version_threads := 3635ca51a17e57e106988846c5b0e0cc48ac04fc
+spec_version_threads := ff17701446d8e2086142423ef77ae947a025e26f
+
+spectest_tail_call_dir := $(spectest_base_dir)/tail-call
+spectest_tail_call_testdata_dir := $(spectest_tail_call_dir)/testdata
+spec_version_tail_call := 88e97b0f742f4c3ee01fea683da130f344dd7b02
 
 .PHONY: build.spectest
 build.spectest:
 	@$(MAKE) build.spectest.v1
 	@$(MAKE) build.spectest.v2
+	@$(MAKE) build.spectest.threads
+	@$(MAKE) build.spectest.tail_call
 
 .PHONY: build.spectest.v1
 build.spectest.v1: # Note: wabt by default uses >1.0 features, so wast2json flags might drift as they include more. See WebAssembly/wabt#1878
@@ -155,6 +161,7 @@ build.spectest.v1: # Note: wabt by default uses >1.0 features, so wast2json flag
 
 .PHONY: build.spectest.v2
 build.spectest.v2: # Note: SIMD cases are placed in the "simd" subdirectory.
+	@rm -rf $(spectest_v2_testdata_dir)
 	@mkdir -p $(spectest_v2_testdata_dir)
 	@cd $(spectest_v2_testdata_dir) \
 		&& curl -sSL 'https://api.github.com/repos/WebAssembly/spec/contents/test/core?ref=$(spec_version_v2)' | jq -r '.[]| .download_url' | grep -E ".wast" | xargs -Iurl curl -sJL url -O
@@ -168,13 +175,24 @@ build.spectest.v2: # Note: SIMD cases are placed in the "simd" subdirectory.
 # https://github.com/WebAssembly/wabt/issues/2348#issuecomment-1878003959
 .PHONY: build.spectest.threads
 build.spectest.threads:
+	@rm -rf $(spectest_threads_testdata_dir)
 	@mkdir -p $(spectest_threads_testdata_dir)
 	@cd $(spectest_threads_testdata_dir) \
-		&& curl -sSL 'https://api.github.com/repos/WebAssembly/threads/contents/test/core?ref=$(spec_version_threads)' | jq -r '.[]| .download_url' | grep -E "atomic.wast" | xargs -Iurl curl -sJL url -O
+		&& curl -sSL 'https://api.github.com/repos/WebAssembly/threads/contents/test/core/threads?ref=$(spec_version_threads)' | jq -r '.[]| .download_url' | grep -E "/atomic.wast" | xargs -Iurl curl -sJL url -O
 	@cd $(spectest_threads_testdata_dir) && for f in `find . -name '*.wast'`; do \
 		wast2json --enable-threads --debug-names $$f; \
 	done
 
+.PHONY: build.spectest.tail_call
+build.spectest.tail_call:
+	@rm -rf $(spectest_tail_call_testdata_dir)
+	@mkdir -p $(spectest_tail_call_testdata_dir)
+	@cd $(spectest_tail_call_testdata_dir) \
+		&& curl -sSL 'https://api.github.com/repos/WebAssembly/testsuite/contents/proposals/tail-call?ref=$(spec_version_tail_call)' | jq -r '.[]| .download_url' | grep -E ".wast" | xargs -Iurl curl -sJL url -O
+	@cd $(spectest_tail_call_testdata_dir) && for f in `find . -name '*.wast'`; do \
+		wast2json --enable-tail-call --debug-names $$f; \
+	done
+
 .PHONY: test
 test:
 	@go test $(go_test_options) ./...
@@ -220,13 +238,10 @@ check:
 	@GOARCH=wasm GOOS=wasip1 go build ./...
 # Ensure we build on aix. See #1723
 	@GOARCH=ppc64 GOOS=aix go build ./...
-# Ensure we build on windows:
-	@GOARCH=amd64 GOOS=windows go build ./...
-# Ensure we build on an arbitrary operating system:
-	@GOARCH=amd64 GOOS=dragonfly go build ./...
-# Ensure we build on solaris/illumos:
-	@GOARCH=amd64 GOOS=illumos go build ./...
-	@GOARCH=amd64 GOOS=solaris go build ./...
+# Ensure we build on linux s390x. See #2412
+	@GOARCH=s390x GOOS=linux go build ./...
+# Ensure we build on linux ppc64le. See #2412
+	@GOARCH=ppc64le GOOS=linux go build ./...
 # Ensure we build on linux arm for Dapr:
 #	gh release view -R dapr/dapr --json assets --jq 'first(.assets[] | select(.name = "daprd_linux_arm.tar.gz") | {url, downloadCount})'
 	@GOARCH=arm GOOS=linux go build ./...
@@ -274,22 +289,15 @@ libsodium:
 #### CLI release related ####
 
 VERSION ?= dev
-# Default to a dummy version 0.0.1.1, which is always lower than a real release.
-# Legal version values should look like 'x.x.x.x' where x is an integer from 0 to 65534.
-# https://learn.microsoft.com/en-us/windows/win32/msi/productversion?redirectedfrom=MSDN
-# https://stackoverflow.com/questions/9312221/msi-version-numbers
-MSI_VERSION ?= 0.0.1.1
 non_windows_platforms := darwin_amd64 darwin_arm64 linux_amd64 linux_arm64
 non_windows_archives  := $(non_windows_platforms:%=dist/wazero_$(VERSION)_%.tar.gz)
 windows_platforms     := windows_amd64 # TODO: add arm64 windows once we start testing on it.
-windows_archives      := $(windows_platforms:%=dist/wazero_$(VERSION)_%.zip) $(windows_platforms:%=dist/wazero_$(VERSION)_%.msi)
+windows_archives      := $(windows_platforms:%=dist/wazero_$(VERSION)_%.zip)
 checksum_txt          := dist/wazero_$(VERSION)_checksums.txt
 
 # define macros for multi-platform builds. these parse the filename being built
 go-arch = $(if $(findstring amd64,$1),amd64,arm64)
 go-os   = $(if $(findstring .exe,$1),windows,$(if $(findstring linux,$1),linux,darwin))
-# msi-arch is a macro so we can detect it based on the file naming convention
-msi-arch     = $(if $(findstring amd64,$1),x64,arm64)
 
 build/wazero_%/wazero:
 	$(call go-build,$@,$<)
@@ -314,51 +322,15 @@ define go-build
 	@echo build "ok"
 endef
 
-# this makes a marker file ending in .signed to avoid repeatedly calling codesign
-%.signed: %
-	$(call codesign,$<)
-	@touch $@
-
-# This requires osslsigncode package (apt or brew) or latest windows release from mtrojnar/osslsigncode
-#
-# Default is self-signed while production should be a Digicert signing key
-#
-# Ex.
-# ```bash
-# keytool -genkey -alias wazero -storetype PKCS12 -keyalg RSA -keysize 2048 -storepass wazero-bunch \
-# -keystore wazero.p12 -dname "O=wazero,CN=wazero.io" -validity 3650
-# ```
-WINDOWS_CODESIGN_P12      ?= packaging/msi/wazero.p12
-WINDOWS_CODESIGN_PASSWORD ?= wazero-bunch
-define codesign
-	@printf "$(ansi_format_dark)" codesign "signing $1"
-	@osslsigncode sign -h sha256 -pkcs12 ${WINDOWS_CODESIGN_P12} -pass "${WINDOWS_CODESIGN_PASSWORD}" \
-	-n "wazero is the zero dependency WebAssembly runtime for Go developers" -i https://wazero.io -t http://timestamp.digicert.com \
-	$(if $(findstring msi,$(1)),-add-msi-dse) -in $1 -out $1-signed
-	@mv $1-signed $1
-	@printf "$(ansi_format_bright)" codesign "ok"
-endef
-
-# This task is only supported on Windows, where we use candle.exe (compile wxs to wixobj) and light.exe (link to msi)
-dist/wazero_$(VERSION)_%.msi: build/wazero_%/wazero.exe.signed
-ifeq ($(OS),Windows_NT)
-	@echo msi "building $@"
-	@mkdir -p $(@D)
-	@candle -nologo -arch $(call msi-arch,$@) -dVersion=$(MSI_VERSION) -dBin=$(<:.signed=) -o build/wazero.wixobj packaging/msi/wazero.wxs
-	@light -nologo -o $@ build/wazero.wixobj -spdb
-	$(call codesign,$@)
-	@echo msi "ok"
-endif
-
-dist/wazero_$(VERSION)_%.zip: build/wazero_%/wazero.exe.signed
+dist/wazero_$(VERSION)_%.zip: build/wazero_%/wazero.exe
 	@echo zip "zipping $@"
 	@mkdir -p $(@D)
-	@zip -qj $@ $(<:.signed=)
+	@zip -qj $@ $<
 	@echo zip "ok"
 
 # Darwin doesn't have sha256sum. See https://github.com/actions/virtual-environments/issues/90
 sha256sum := $(if $(findstring darwin,$(shell go env GOOS)),shasum -a 256,sha256sum)
-$(checksum_txt):
-	@cd $(@D); touch $(@F); $(sha256sum) * >> $(@F)
+$(checksum_txt): $(non_windows_archives) $(windows_archives)
+	@cd $(@D); touch $(@F); $(sha256sum) * > $(@F)
 
-dist: $(non_windows_archives) $(if $(findstring Windows_NT,$(OS)),$(windows_archives),) $(checksum_txt)
+dist: $(non_windows_archives) $(windows_archives) $(checksum_txt)

vendor/github.com/tetratelabs/wazero/RATIONALE.md

@@ -7,24 +7,19 @@ have heavy impact usually due to CGO. By avoiding CGO, wazero avoids
 prerequisites such as shared libraries or libc, and lets users keep features
 like cross compilation.
 
-Avoiding go.mod dependencies reduces interference on Go version support, and
-size of a statically compiled binary. However, doing so brings some
+Avoiding most `go.mod` dependencies reduces interference on Go version support,
+and size of a statically compiled binary. However, doing so brings some
 responsibility into the project.
 
-Go's native platform support is good: We don't need platform-specific code to
+Go's native platform support is good: we don't need platform-specific code to
 get monotonic time, nor do we need much work to implement certain features
 needed by our compiler such as `mmap`. That said, Go does not support all
-common operating systems to the same degree. For example, Go 1.18 includes
-`Mprotect` on Linux and Darwin, but not FreeBSD.
+common operating systems to the same degree.
 
-The general tradeoff the project takes from a zero dependency policy is more
+The general tradeoff the project takes from a strict dependency policy is more
 explicit support of platforms (in the compiler runtime), as well a larger and
 more technically difficult codebase.
 
-At some point, we may allow extensions to supply their own platform-specific
-hooks. Until then, one end user impact/tradeoff is some glitches trying
-untested platforms (with the Compiler runtime).
-
 ### Why do we use CGO to implement system calls on darwin?
 
 wazero is dependency and CGO free by design. In some cases, we have code that
@@ -45,25 +40,20 @@ This plays to our advantage for system calls that aren't yet exposed in the Go
 standard library, notably `futimens` for nanosecond-precision timestamp
 manipulation.
 
-### Why not x/sys
+### Why x/sys
 
-Going beyond Go's SDK limitations can be accomplished with their [x/sys library](https://pkg.go.dev/golang.org/x/sys/unix).
-For example, this includes `zsyscall_freebsd_amd64.go` missing from the Go SDK.
+The [x/sys library](https://pkg.go.dev/golang.org/x/sys/unix) is currently
+our only `go.mod` dependency.
 
-However, like all dependencies, x/sys is a source of conflict. For example,
-x/sys had to be in order to upgrade to Go 1.18.
+That module is maintained by the Go authors, and covers OSes that the syscall
+package neglects.
 
-If we depended on x/sys, we could get more precise functionality needed for
-features such as clocks or more platform support for the compiler runtime.
+After [heavy consideration](https://github.com/wazero/wazero/issues/2434) we
+decided to it as a dependency.
 
-That said, formally supporting an operating system may still require testing as
-even use of x/sys can require platform-specifics. For example, [mmap-go](https://github.com/edsrzf/mmap-go)
-uses x/sys, but also mentions limitations, some not surmountable with x/sys
-alone.
-
-Regardless, we may at some point introduce a separate go.mod for users to use
-x/sys as a platform plugin without forcing all users to maintain that
-dependency.
+Using was shown to improve the experience of using wazero on older,
+or less common, OSes without increasing the maintenance work, or creating
+deployment issues for users of wazero.
 
 ## Project structure
 
@@ -507,7 +497,7 @@ inserted after exit: https://github.com/emscripten-core/emscripten/issues/12322
 
 ## WASI
 
-Unfortunately, (WASI Snapshot Preview 1)[https://github.com/WebAssembly/WASI/blob/snapshot-01/phases/snapshot/docs.md] is not formally defined enough, and has APIs with ambiguous semantics.
+Unfortunately, [WASI Snapshot Preview 1](https://github.com/WebAssembly/WASI/blob/snapshot-01/phases/snapshot/docs.md) is not formally defined enough, and has APIs with ambiguous semantics.
 This section describes how Wazero interprets and implements the semantics of several WASI APIs that may be interpreted differently by different wasm runtimes.
 Those APIs may affect the portability of a WASI application.
 
@@ -756,7 +746,7 @@ value (possibly `PWD`). Those unable to control the compiled code should only
 use absolute paths in configuration.
 
 See
-* https://github.com/golang/go/blob/go1.20/src/syscall/fs_js.go#L324
+* https://github.com/golang/go/blob/go1.24.0/src/syscall/fs_js.go#L341
 * https://github.com/WebAssembly/wasi-libc/pull/214#issue-673090117
 * https://github.com/ziglang/zig/blob/53a9ee699a35a3d245ab6d1dac1f0687a4dcb42c/src/main.zig#L32
 
@@ -1064,7 +1054,7 @@ reason, wazero adds overhead to synthesize dot entries despite it being
 unnecessary for most users.
 
 See https://pubs.opengroup.org/onlinepubs/9699919799/functions/readdir.html
-See https://github.com/golang/go/blob/go1.20/src/os/dir_unix.go#L108-L110
+See https://github.com/golang/go/blob/go1.24.0/src/os/dir_unix.go#L122-L124
 See https://github.com/bytecodealliance/preview2-prototyping/blob/e4c04bcfbd11c42c27c28984948d501a3e168121/crates/wasi-preview1-component-adapter/src/lib.rs#L1026-L1041
 
 ### Why don't we pre-populate an inode for the dot-dot ("..") entry?
@@ -1150,7 +1140,7 @@ See
  * https://linux.die.net/man/3/getdents
  * https://www.unix.com/man-page/osx/2/getdirentries/
  * https://man.openbsd.org/OpenBSD-5.4/getdirentries.2
- * https://github.com/golang/go/blob/go1.20/src/syscall/dirent.go#L60-L102
+ * https://github.com/golang/go/blob/go1.24.0/src/syscall/dirent.go#L57-L101
  * https://go-review.googlesource.com/c/go/+/507915
 
 ## sys.Walltime and Nanotime
@@ -1201,7 +1191,7 @@ See https://go.googlesource.com/proposal/+/master/design/12914-monotonic.md
 WebAssembly time imports do not have the same concern. In fact even Go's
 imports for clocks split walltime from nanotime readings.
 
-See https://github.com/golang/go/blob/go1.20/misc/wasm/wasm_exec.js#L243-L255
+See https://github.com/golang/go/blob/go1.24.0/lib/wasm/wasm_exec.js#L258-L268
 
 Finally, Go's clock is not an interface. WebAssembly users who want determinism
 or security need to be able to substitute an alternative clock implementation
@@ -1215,13 +1205,13 @@ value. For now, we return fixed values of 1us for realtime and 1ns for monotonic
 often lower precision than monotonic clocks. In the future, this could be improved by having OS+arch specific assembly
 to make syscalls.
 
-For example, Go implements time.Now for linux-amd64 with this [assembly](https://github.com/golang/go/blob/go1.20/src/runtime/time_linux_amd64.s).
+For example, Go implements time.Now for linux-amd64 with this [assembly](https://github.com/golang/go/blob/go1.24.0/src/runtime/time_linux_amd64.s).
 Because retrieving resolution is not generally called often, unlike getting time, it could be appropriate to only
 implement the fallback logic that does not use VDSO (executing syscalls in user mode). The syscall for clock_getres
 is 229 and should be usable. https://pkg.go.dev/syscall#pkg-constants.
 
-If implementing similar for Windows, [mingw](https://github.com/mirror/mingw-w64/blob/6a0e9165008f731bccadfc41a59719cf7c8efc02/mingw-w64-libraries/winpthreads/src/clock.c#L77
-) is often a good source to find the Windows API calls that correspond
+If implementing similar for Windows, [mingw](https://github.com/mirror/mingw-w64/blob/v12.0.0/mingw-w64-libraries/winpthreads/src/clock.c#L54)
+is often a good source to find the Windows API calls that correspond
 to a POSIX method.
 
 Writing assembly would allow making syscalls without CGO, but comes with the cost that it will require implementations
@@ -1490,7 +1480,7 @@ This is due to the same reason for the limitation on the number of functions abo
 
 While the the spec does not clarify a limitation of function stack values, wazero limits this to 2^27 = 134,217,728.
 The reason is that we internally represent all the values as 64-bit integers regardless of its types (including f32, f64), and 2^27 values means
-1 GiB = (2^30). 1 GiB is the reasonable for most applications [as we see a Goroutine has 250 MB as a limit on the stack for 32-bit arch](https://github.com/golang/go/blob/go1.20/src/runtime/proc.go#L152-L159), considering that WebAssembly is (currently) 32-bit environment.
+1 GiB = (2^30). 1 GiB is the reasonable for most applications [as we see a Goroutine has 250 MB as a limit on the stack for 32-bit arch](https://github.com/golang/go/blob/go1.24.0/src/runtime/proc.go#L154-L161), considering that WebAssembly is (currently) 32-bit environment.
 
 All the functions are statically analyzed at module instantiation phase, and if a function can potentially reach this limit, an error is returned.
 
@@ -1523,8 +1513,8 @@ since it tries to interrupt the execution of Goroutine at any point of function,
 Fortunately, our runtime-generated machine codes do not need to take the async preemption into account.
 All the assembly codes are entered via the trampoline implemented as Go Assembler Function (e.g. [arch_amd64.s](./arch_amd64.s)),
 and as of Go 1.20, these assembler functions are considered as _unsafe_ for async preemption:
-- https://github.com/golang/go/blob/go1.20rc1/src/runtime/preempt.go#L406-L407
-- https://github.com/golang/go/blob/9f0234214473dfb785a5ad84a8fc62a6a395cbc3/src/runtime/traceback.go#L227
+- https://github.com/golang/go/blob/go1.24.0/src/runtime/preempt.go#L407-L408
+- https://github.com/golang/go/blob/go1.24.0/src/runtime/traceback.go#L350
 
 From the Go runtime point of view, the execution of runtime-generated machine codes is considered as a part of
 that trampoline function. Therefore, runtime-generated machine code is also correctly considered unsafe for async preemption.
@@ -1582,6 +1572,6 @@ In lieu of formal documentation, we infer this pattern works from other sources
  * `sync.WaitGroup` by definition must support calling `Add` from other goroutines. Internally, it uses atomics.
  * rsc in golang/go#5045 writes "atomics guarantee sequential consistency among the atomic variables".
 
-See https://github.com/golang/go/blob/go1.20/src/sync/waitgroup.go#L64
+See https://github.com/golang/go/blob/go1.24.0/src/sync/waitgroup.go#L76
 See https://github.com/golang/go/issues/5045#issuecomment-252730563
 See https://www.youtube.com/watch?v=VmrEG-3bWyM