the one PR

.clang-format

@@ -0,0 +1,34 @@
+# nginx coding style for C modules
+# Based on nginx source conventions: 4-space indent, 80-col limit,
+# aligned struct members and macros (nginx hallmark style).
+BasedOnStyle: LLVM
+IndentWidth: 4
+TabWidth: 4
+UseTab: Never
+ColumnLimit: 80
+BreakBeforeBraces: Linux
+AllowShortFunctionsOnASingleLine: None
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLoopsOnASingleLine: false
+IndentCaseLabels: false
+SpaceBeforeParens: ControlStatements
+PointerAlignment: Right
+AlignConsecutiveDeclarations:
+  Enabled: true
+  AcrossEmptyLines: false
+  AcrossComments: false
+AlignConsecutiveMacros:
+  Enabled: true
+  AcrossEmptyLines: false
+  AcrossComments: false
+AlignConsecutiveAssignments: false
+AlignTrailingComments:
+  Kind: Always
+  OverEmptyLines: 0
+SortIncludes: false
+ReflowComments: false
+BreakBeforeTernaryOperators: true
+AlwaysBreakAfterReturnType: None
+SpacesInParentheses: false
+SpacesInSquareBrackets: false
+SpaceInEmptyParentheses: false

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+charset = utf-8
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{sh,bash}]
+indent_style = space
+indent_size = 4
+switch_case_indent = true
+binary_next_line = true

.gitattributes

@@ -1 +1,46 @@
 *.t linguist-language=Text
+
+# Files that are executed or sourced by POSIX sh/perl on Linux (including
+# WSL builds from a Windows checkout) must stay LF: nginx's ./configure
+# sources `config`/`auto/zstd` with sh, which treats a CR as part of the
+# line and fails with "$'\r': command not found" when core.autocrlf=true
+# has smudged the checkout to CRLF.
+config text eol=lf
+auto/* text eol=lf
+*/config text eol=lf
+*.sh text eol=lf
+*.t text eol=lf
+
+# Byte-exact fixtures: fuzz corpus entries are raw Accept-Encoding header
+# bytes and .zst files are compressed frames — any EOL conversion corrupts
+# them.
+ci/fuzz/corpus/* -text
+ci/fuzz/fuzz.dict -text
+*.dict -text
+*.zst binary
+
+# t/suite/test's byte length is asserted verbatim by the static suite
+# (Content-Length and the size half of the ETag) — CRLF smudging changes
+# the on-disk size and fails every identity-response assertion.
+ci/t/suite/* -text
+
+# More byte-exact fuzz fixtures: corpus_dcz/* are raw dcz-dict header
+# bytes, and regressions{,_dcz}/* are saved crash-reproducer inputs —
+# core.autocrlf=true would smudge either and corrupt the fuzzer's inputs
+# or make a saved crash stop reproducing. Each regressions dir also has a
+# real README.md, which must stay text; order it after the wildcard so
+# the more specific rule wins.
+ci/fuzz/corpus_dcz/* -text
+ci/fuzz/regressions/* -text
+ci/fuzz/regressions/README.md text
+ci/fuzz/regressions_dcz/* -text
+ci/fuzz/regressions_dcz/README.md text
+
+# CI-only stub module (linkage-isolation job); keep it out of release
+# tarballs (git archive). Its former sibling, the vary-suppression
+# stub, no longer exists in the tree.
+/ci/tools/ci-linkcheck-module export-ignore
+
+# Patches are applied with git apply against LF checkouts; CRLF
+# smudging would make every context line mismatch.
+ci/tools/patches/** text eol=lf

.githooks/pre-commit

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# .githooks/pre-commit -- tracked, reviewable commit gate.
+#
+# Lives in the repo (unlike .git/hooks/, which is per-clone and invisible to
+# review), so a change to what the gate checks arrives as a diff.
+#
+# Enable once per clone:
+#     git config core.hooksPath .githooks
+# Emergency bypass:
+#     git commit --no-verify
+#
+# It lints only the STAGED files, so a commit is never blocked by a finding in
+# a file it does not touch. Run the whole tree yourself with:
+#     ci/linter/run-all.sh
+#     pre-commit run --all-files
+#
+# TWO GATES, ONE ENTRY POINT, AND THE REASON THIS FILE CALLS BOTH.
+#
+# `core.hooksPath` REPLACES .git/hooks/ -- git does not consult both. So the
+# hook that `pre-commit install` writes into .git/hooks/pre-commit becomes
+# unreachable the moment core.hooksPath is set, and .pre-commit-config.yaml
+# stops running on commit while still looking installed from every angle a
+# human checks: the config is present, `pre-commit install` reported success,
+# and the file is right there in .git/hooks/. Measured 2026-08-02 in this repo:
+# a file with trailing whitespace and no closing newline committed clean, past
+# hooks whose entire job is those two things -- and past detect-private-key,
+# flawfinder and semgrep with it.
+#
+# Neither list is a superset of the other (ci/linter/ owns the workflow-policy
+# and docs-drift checks; .pre-commit-config.yaml owns secret detection and the
+# C SAST gates), so this hook runs BOTH and fails on either.
+#
+# Exit 2 (a tool is not installed) blocks the commit on purpose: a gate that
+# skips itself when its tool is missing reports green while checking nothing.
+# That applies to pre-commit itself, which is why its absence is fatal here
+# rather than a warning.
+#
+# VERIFY BEFORE TRUSTING (this gate was green and inert for days):
+#     printf 'probe   \n\nno newline at eof' > _p.txt
+#     git add _p.txt && git commit -m probe -- _p.txt   # expect BLOCKED
+#     git reset -q HEAD _p.txt; rm -f _p.txt
+# Both `trim trailing whitespace` and `fix end of files` must report Failed. If
+# the commit lands, .pre-commit-config.yaml is not being consulted.
+set -uo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+
+"$ROOT/ci/linter/run-all.sh" --staged
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    echo "pre-commit: missing linters -- run ci/linter/install-linters.sh" >&2
+    exit 2
+elif [ "$rc" -ne 0 ]; then
+    echo "pre-commit: lint failed -- fix, or commit with --no-verify" >&2
+    exit "$rc"
+fi
+
+if [ -f "$ROOT/.pre-commit-config.yaml" ]; then
+    if ! command -v pre-commit >/dev/null 2>&1; then
+        echo "pre-commit: .pre-commit-config.yaml present but pre-commit is not" \
+             "installed -- pipx install pre-commit" >&2
+        exit 2
+    fi
+    # No `pre-commit install` needed and none is wanted: that command writes to
+    # .git/hooks/, which core.hooksPath has already taken out of the picture.
+    pre-commit run --hook-stage pre-commit
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+        echo "pre-commit: .pre-commit-config.yaml hooks failed -- fix, or commit" \
+             "with --no-verify. Fixer hooks may have rewritten files; re-stage." >&2
+        exit "$rc"
+    fi
+fi
+
+exit 0

.github/actionlint.yaml

@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [builder02, lxc, docker]

.github/scripts/configure-msvc.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Configure the Windows/MSVC CI build after vcvars64.bat has initialized the
+# parent cmd process. Kept in a real bash file because a GitHub custom `cmd`
+# shell wraps inline run blocks in a .cmd file, which bash cannot parse.
+
+set -euo pipefail
+
+module_dir=$(cygpath -m "$GITHUB_WORKSPACE")
+zstd_root=$(cygpath -m \
+    "$VCPKG_INSTALLATION_ROOT/installed/x64-windows-static")
+
+ZSTD_INC="$zstd_root/include" ZSTD_LIB="$zstd_root/lib" \
+    ./configure \
+    --crossbuild=win32 \
+    --with-cc=cl \
+    --with-cc-opt='-MT -DFD_SETSIZE=1024' \
+    --with-pcre="$module_dir/pcre2-$PCRE2_VERSION" \
+    --with-zlib="$module_dir/zlib-$ZLIB_VERSION" \
+    --add-module="$module_dir"

.github/workflows/asan.yml

@@ -0,0 +1,132 @@
+name: A/UBSan
+
+# Dedicated ASan+UBSan soak — mirrors the fast build-asan job in build-test.yml
+# (same configure flags, same PGP-verified tarball) but drives it through
+# soak.sh's sustained mixed-load traffic instead of the Test::Nginx suite, the
+# same way valgrind.yml's memcheck-lite job soaks the debug build. Two
+# independent dynamic-analysis lenses on the same binary shape catch different
+# things: ASan/UBSan is fast enough to run a real request storm in CI Deep
+# and catches heap overflow / UAF outside nginx's pool blocks; Valgrind (20x
+# slower) still catches the uninitialised reads and intra-pool UAF that ASan
+# cannot see. Complementary, not redundant -- keep both.
+#
+# The asan build is a STATIC --add-module binary (the module is linked into
+# the nginx binary, there is no separate .so), so the sanitizer runtime is
+# present on every code path soak.sh exercises.
+#
+# Action pins (keep in sync with build-test.yml / valgrind.yml headers):
+# actions/checkout@v5.1.0 -> fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  NGINX_VERSION: ""
+
+on:
+  workflow_dispatch: {}
+  # Called by ci.yml, the single PR entry point.
+  workflow_call: {}
+
+concurrency:
+  group: asan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  asan-soak:
+    name: ASan/UBSan soak (60s)
+    runs-on: ${{ fromJSON(vars.POOL || '["ubuntu-latest"]') }}
+    timeout-minutes: 45
+    steps:
+      - name: Checkout module
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+
+      # `vars.POOL` is absent in forks, so do not rely on the hosted image
+      # carrying curl before the full dependency installation below.
+      - name: Install bootstrap dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ca-certificates curl python3
+
+      - name: Resolve latest mainline nginx
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          ver=$(bash "$GITHUB_WORKSPACE/ci/tools/nginx-releases.sh" mainline)
+          [ -n "$ver" ] || { echo "::error::cannot resolve nginx version"; exit 1; }
+          echo "NGINX_VERSION=$ver" >> "$GITHUB_ENV"
+
+      - name: Install dependencies
+        run: |
+          # builder02 apt profile: loose timeouts — the box runs jobs
+          # concurrently and never talks to the Azure mirror (PR #121)
+          printf '%s\n' \
+            'DPkg::Lock::Timeout "120";' \
+            'Acquire::Retries "3";' \
+            'Acquire::http::Timeout "20";' \
+            'Acquire::https::Timeout "20";' \
+            | sudo tee /etc/apt/apt.conf.d/99-ci-net > /dev/null
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential curl gnupg libpcre2-dev libzstd-dev openssl pkg-config \
+            wget zlib1g-dev zstd
+
+      - name: Cache nginx source tarball
+        id: nginx-tarball
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: nginx-${{ env.NGINX_VERSION }}.tar.gz
+          key: nginx-src-${{ env.NGINX_VERSION }}
+
+      - name: Download nginx source tarball
+        if: steps.nginx-tarball.outputs.cache-hit != 'true'
+        run: wget -q "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz"
+
+      - name: Verify nginx tarball PGP signature
+        run: |
+          set -euo pipefail
+          wget -q "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz.asc" \
+            -O "nginx-${NGINX_VERSION}.tar.gz.asc"
+          gnupghome="$(mktemp -d)"
+          export GNUPGHOME="$gnupghome"
+          chmod 700 "$gnupghome"
+          for keyfile in ci/tools/keys/*.key; do
+            gpg --quiet --import "$keyfile" 2>/dev/null
+          done
+          gpg --quiet --verify "nginx-${NGINX_VERSION}.tar.gz.asc" "nginx-${NGINX_VERSION}.tar.gz"
+          rm -rf "$gnupghome"
+
+      # soak.sh requires ok>0 and bad==0 per worker, where a zstd-magic
+      # response must ALSO decode cleanly (ci/tools/soak.sh's worker()):
+      # a green result proves the module actually compressed real
+      # responses under the sanitizer, not merely that nothing crashed.
+      # It sets its own ASAN_OPTIONS/UBSAN_OPTIONS with halt_on_error=1
+      # so the soak fails loudly on the first report.
+      - name: Configure & build nginx with ASAN + UBSAN (static --add-module)
+        env:
+          # Keep the portable SHA-256 fallback covered under the sanitizer --
+          # see build-test.yml's identical build-asan job for why.
+          NGX_ZSTD_NO_LIBCRYPTO: 1
+        run: |
+          tar -xzf "nginx-${NGINX_VERSION}.tar.gz"
+          cd "nginx-${NGINX_VERSION}"
+          SAN="-fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer -g3 -O1"
+          ./configure \
+            --with-compat \
+            --with-debug \
+            --with-cc-opt="-DZSTD_STATIC_LINKING_ONLY $SAN $(pkg-config --cflags libzstd zlib libpcre2-8)" \
+            --with-ld-opt="$SAN $(pkg-config --libs libzstd zlib libpcre2-8)" \
+            --add-module="$GITHUB_WORKSPACE"
+          make -j"$(nproc)"
+          if grep -q 'NGX_HTTP_ZSTD_HAVE_LIBCRYPTO' objs/ngx_auto_config.h; then
+            echo "libcrypto leaked into the portable-fallback build"; exit 1
+          fi
+
+      - name: ASan/UBSan soak (60s @ 4 conc)
+        run: |
+          bash ci/tools/soak.sh \
+            "$GITHUB_WORKSPACE/nginx-${NGINX_VERSION}/objs/nginx" 60 4