initialbundle

Overview ¶

initialbundle is a build-time tool that produces a pre-obfuscated initial challenge bundle, embedded into the Go binary. This eliminates the ~1 minute of synchronous obfuscation that NewChallengeRuntime would otherwise have to pay at startup before the service is ready to serve challenges.

Pipeline:

challenge_code.js  ──substitute placeholders──▶  source JS
obfuscate/index.wasm.gz ──decompress──▶ obfuscator WASM
wazero(obfuscator).Run(stdin=source) ──▶ obfuscated JS
gzip ──▶ ../initial_bundle.js.gz

The output `initial_bundle.js.gz` is committed and embedded via go:embed in pkg/appsec/challenge/challenge.go.