cloudflare-go package hangs

[oxdead]

Output of garble version:

mvdan.cc/garble v0.15.0

Build settings:
-buildmode exe
-compiler gc
CGO_ENABLED 1
GOARCH amd64
GOOS linux
GOAMD64 v1

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build614059183=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/root/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.5'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

the app not functioning properly, when i build as:

garble build -o /tmp/test main.go

What did you see happen?

the app itself works, but the code of the cloudflare-go package (version 6@6.5.0) does not work - the app hangs on trying to execute thise function, for example:

var res *pagination.V4PagePaginationArray[accounts.Account]
res, err = client.Accounts.List(context.TODO(), accounts.AccountListParams{
	Direction: cloudflare.F(directionParm),
	Page:      cloudflare.F(float64(pageInt)),
	PerPage:   cloudflare.F(float64(perPageInt)),
})

to me it seems like a garble issue, but i am not sure, maybe cloudflare-go has some kind of anti-tamper protection for their code or what.. i checked their code and have not found anything that looked suspicious, i do not know.
here is the link to cloudflare-go repo on github

What did you expect to see?

if i build without garble as:

go build -o /tmp/test main.go

everything works as expected, no issues.

[luantak]

Can you share a minimal main.go that reproduces this issue?

[oxdead]

sure, i can provide simple example, but it requires user api token, which obviously i cannot share, sorry

it can be created at cloudflare.com after registering a free account:
profile -> API Tokens -> Create Token -> Create Custom Token

i think this permissions for token should be enough for testing:
Permissions: Account Settings: Read
Account Resources: Include: All accounts

package main

import (
	"context"

	"github.com/cloudflare/cloudflare-go/v6"
	"github.com/cloudflare/cloudflare-go/v6/accounts"
	"github.com/cloudflare/cloudflare-go/v6/option"
)

func main() {
	var client *cloudflare.Client = cloudflare.NewClient(option.WithAPIToken("PASTE-CLOUDFLARE-USER-API-TOKEN-HERE"))
	_, _ = client.Accounts.List(context.TODO(), accounts.AccountListParams{})
}

install cloudflare api package:

go get -u 'github.com/cloudflare/cloudflare-go/v6@v6.5.0'

this works fine:

go build -o cfbug main.go
./cfbug

this unfortunately panics:

/root/go/bin/garble build -o cfbug main.go
./cfbug

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0x6c86e1]

[oxdead]

simplified example above and debugged a bit, maybe it will be helpful somehow..

go without garble returns next values inside encoder.typeEncoder function:

/root/cloudflare-go/internal/apiquery/encoder.go -> func (e *encoder) typeEncoder(t reflect.Type) encoderFunc

1: entry.reflect.Type: accounts.AccountListParams entry.QuerySettings: {1 1}
5: before newTypeEncoder accounts.AccountListParams

1: entry.reflect.Type: param.Field[github.com/cloudflare/cloudflare-go/v6/accounts.AccountListParamsDirection] entry.QuerySettings: {1 1}
5: before newTypeEncoder param.Field[github.com/cloudflare/cloudflare-go/v6/accounts.AccountListParamsDirection]

1: entry.reflect.Type: accounts.AccountListParamsDirection entry.QuerySettings: {1 1}
5: before newTypeEncoder accounts.AccountListParamsDirection
6: before encoders.Store, reflect.Type: accounts.AccountListParamsDirection
6: before encoders.Store, reflect.Type: param.Field[github.com/cloudflare/cloudflare-go/v6/accounts.AccountListParamsDirection]

1: entry.reflect.Type: param.Field[string] entry.QuerySettings: {1 1}
5: before newTypeEncoder param.Field[string]

1: entry.reflect.Type: string entry.QuerySettings: {1 1}
5: before newTypeEncoder string
6: before encoders.Store, reflect.Type: string
6: before encoders.Store, reflect.Type: param.Field[string]

1: entry.reflect.Type: param.Field[float64] entry.QuerySettings: {1 1}
5: before newTypeEncoder param.Field[float64]

1: entry.reflect.Type: float64 entry.QuerySettings: {1 1}
5: before newTypeEncoder float64
6: before encoders.Store, reflect.Type: float64
6: before encoders.Store, reflect.Type: param.Field[float64]

1: entry.reflect.Type: param.Field[float64] entry.QuerySettings: {1 1}
2: encoders.Load returns
6: before encoders.Store, reflect.Type: accounts.AccountListParams

with garble it returns next values instead:

/root/cloudflare-go/internal/apiquery/encoder.go -> func (e *encoder) typeEncoder(t reflect.Type) encoderFunc

1: entry.reflect.Type: wR35IcFM.AccountListParams entry.QuerySettings: {1 1}
5: before newTypeEncoder, reflect.Type: wR35IcFM.AccountListParams

1: entry.reflect.Type: wy7bV9hpsH.IanK_n[HNVJYRNgne.AgLonkMLHNn] entry.QuerySettings: {1 1}
5: before newTypeEncoder, reflect.Type: wy7bV9hpsH.IanK_n[HNVJYRNgne.AgLonkMLHNn]

1: entry.reflect.Type: <nil> entry.QuerySettings: {1 1}
5: before newTypeEncoder, reflect.Type: <nil>

stack trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0x6c8941]

goroutine 1 [running]:
mK2_5Q0B.(*ejwWOQKw5d).cs3dxi_(0xc000a67f50, {0x0, 0x0})
	GIUEkEp5aLoZ.go:1 +0x21
mK2_5Q0B.(*ejwWOQKw5d).kskTObKWvC(0xc000a67f50, {0x0, 0x0})
	dv1QGlD.go:1 +0x397
mK2_5Q0B.(*ejwWOQKw5d).hp_a32Y5O(0xc000a67f50, {0xe9cc38?, 0xafcb20?})
	d9r081Rp.go:1 +0xf0
mK2_5Q0B.(*ejwWOQKw5d).h6rewkmD1(0xc000a67f50, {0xe9cc38, 0xafcb20})
	CgXcWn.go:1 +0x15e
mK2_5Q0B.(*ejwWOQKw5d).cs3dxi_(0xc000a67f50, {0xe9cc38, 0xafcb20})
	A6pXgm.go:1 +0x1df
mK2_5Q0B.(*ejwWOQKw5d).kskTObKWvC(0xc000a67f50, {0xe9cc38, 0xafcb20})
	dv1QGlD.go:1 +0x397
mK2_5Q0B.(*ejwWOQKw5d).h6rewkmD1.func1({0xe9cc38, 0xa9e7c0}, {0x16da240, 0x0, 0x0})
	tNBlmvgw_wux.go:1 +0x407
mK2_5Q0B.(*ejwWOQKw5d).h6rewkmD1(0xc000a67f50, {0xe9cc38, 0xa9e7c0})
	Udaqe4NSt.go:1 +0xf0
mK2_5Q0B.(*ejwWOQKw5d).cs3dxi_(0xc000a67f50, {0xe9cc38, 0xa9e7c0})
	A6pXgm.go:1 +0x1df
mK2_5Q0B.(*ejwWOQKw5d).kskTObKWvC(0xc000a67f50, {0xe9cc38, 0xa9e7c0})
	dv1QGlD.go:1 +0x397
mK2_5Q0B.JlLYuM({0xa9e7c0, 0xc00257e820}, {0x1?, 0x416806?})
	gj0360xeXbt.go:1 +0x288
HNVJYRNgne.WViC9CAYs_b.URLQuery(...)
	dLH_4p754zNB.go:1
YaLv2fpb.Dh5_lfgNM({0xe98d00, 0x16da240}, {0xbb0fbc, 0x3}, {0xc07903, 0x8}, {0xa9e7c0, 0xc00257e750}, {0x90ca60, 0xc00004a000}, ...)
	cDxXcvfJx5.go:1 +0x2fa
HNVJYRNgne.(*HU5WXHTdDY).List(0xc002580910, {0xe98d00, 0x16da240}, {{{0x0, 0x0}, {0x0, 0x0}, 0x0, 0x0, {0x0, ...}}, ...}, ...)
	S1iJssIWxzaV.go:1 +0x3c6
main.main()
	vk8dmJ.go:1 +0xd1

looks like garble does not work with reflect, cloudflare-go uses it extensively.
i see compalints in other issues on reflect too... i assume it is a complex issue and not fixable at the moment ?

is there a way to exclude a package?
for example, if i want to garble only local package1 and package2 inside my app, and leave the rest of packages ungarbled, is this a correct way to go ?

GOGARBLE=myproj/package1,myproj/package2 /root/go/bin/garble build -o cfbug main.go