Benji Vesterby closed issue #48: Stale open issues: #37, #38, #39 appear resolved but not closed at Developer Network / Zig Shared Projects / hsm

Benji Vesterby
2026-03-24T14:34:45Z

Description

Three security issues are still in "opened" state but appear to have been resolved in the codebase:

#37 - selectPiv silently swallows Applet Not Found error

Current code (`src/piv/piv.zig:86-92`): `selectPiv` now catches `SlotNotFound` from the short AID and retries with the full AID. If both fail, the error propagates. A dedicated test at line 620 (`selectPiv retries full AID after short AID not found`) verifies this behavior.

#38 - CI Configuration Allows Build Failures

Current CI (`.gitlab-ci.yml:122`): `allow_failure: false` is explicitly set on the build-examples job. The issue references `allow_failure: true` which is no longer present.

#39 - Missing Fuzz Testing for APDU and TLV Parsers

Current code:

`src/apdu.zig:463-484` -- APDU fuzz harness with 4 corpus files

`src/tlv.zig:552-590` -- TLV fuzz harness with 6 corpus files

`.gitlab-ci.yml:127-139` -- `fuzz-parsers` CI job

Recommendation

Review and close #37, #38, #39 with resolution evidence if confirmed.