ronantakizawa/codereview-bench huggingface dataset:
Repository: traefik/traefik
File: pkg/middlewares/compress/acceptencoding.go (Go)

Code before:
	"strconv"
	"strings"
)

const acceptEncodingHeader = "Accept-Encoding"

const (
	brotliName    = "br"
	gzipName      = "gzip"
	identityName  = "identity"
	wildcardName  = "*"
	notAcceptable = "not_acceptable"
)

type Encoding struct {
	Type   string
	Weight *float64
}

func getCompressionType(acceptEncoding []string, defaultType string) string {
	if defaultType == "" {
		// Keeps the pre-existing default inside Traefik.
		defaultType = brotliName
	}

	encodings, hasWeight := parseAcceptsEncoding(acceptEncoding)

	if hasWeight {
		if len(encodings) == 0 {
			return identityName
		}

		encoding := encodings[0]

		if encoding.Type == identityName && encoding.Weight != nil && *encoding.Weight == 0 {
			return notAcceptable
		}

		if encoding.Type == wildcardName && encoding.Weight != nil && *encoding.Weight == 0 {
			return notAcceptable
		}

		if encoding.Type == wildcardName {
			return defaultType
		}

		return encoding.Type
	}

	for _, dt := range []string{brotliName, gzipName} {
		if slices.ContainsFunc(encodings, func(e Encoding) bool { return e.Type == dt }) {

Review comment (suggestion):
```suggestion
	encodings, hasWeight := parseAcceptEncoding(acceptEncoding)
```

Code after:
	"strconv"
	"strings"
)

const acceptEncodingHeader = "Accept-Encoding"

const (
	brotliName    = "br"
	gzipName      = "gzip"
	identityName  = "identity"
	wildcardName  = "*"
	notAcceptable = "not_acceptable"
)

type Encoding struct {
	Type   string
	Weight *float64
}

func getCompressionType(acceptEncoding []string, defaultType string) string {
	if defaultType == "" {
		// Keeps the pre-existing default inside Traefik.
		defaultType = brotliName
	}

	encodings, hasWeight := parseAcceptEncoding(acceptEncoding)

	if hasWeight {
		if len(encodings) == 0 {
			return identityName
		}

		encoding := encodings[0]

		if encoding.Type == identityName && encoding.Weight != nil && *encoding.Weight == 0 {
			return notAcceptable
		}

		if encoding.Type == wildcardName && encoding.Weight != nil && *encoding.Weight == 0 {
			return notAcceptable
		}

		if encoding.Type == wildcardName {
			return defaultType
		}

		return encoding.Type
	}

	for _, dt := range []string{brotliName, gzipName} {
		if slices.ContainsFunc(encodings, func(e Encoding) bool { return e.Type == dt }) {
Repository: traefik/traefik
File: pkg/middlewares/compress/acceptencoding_test.go (Go)

Code before:
			expected: notAcceptable,
		},
		{
			desc:     "not acceptable (wildcard)",
			values:   []string{"compress;q=1.0, *;q=0"},
			expected: notAcceptable,
		},
		{
			desc:     "non-zero is higher than 0",
			values:   []string{"gzip, *;q=0"},
			expected: gzipName,
		},
	}

	for _, test := range testCases {
		t.Run(test.desc, func(t *testing.T) {
			t.Parallel()

			encodingType := getCompressionType(test.values, test.defaultType)

			assert.Equal(t, test.expected, encodingType)
		})
	}
}

func Test_parseEncodingAccepts(t *testing.T) {
	testCases := []struct {
		desc         string
		values       []string
		expected     []Encoding
		assertWeight assert.BoolAssertionFunc
	}{
		{
			desc:   "weight",
			values: []string{"br;q=1.0, gzip;q=0.8, *;q=0.1"},
			expected: []Encoding{
				{Type: brotliName, Weight: ptr[float64](1)},
				{Type: gzipName, Weight: ptr(0.8)},
				{Type: wildcardName, Weight: ptr(0.1)},
			},
			assertWeight: assert.True,
		},
		{
			desc:   "mixed",
			values: []string{"gzip, br;q=1.0, *;q=0"},
			expected: []Encoding{
				{Type: brotliName, Weight: ptr[float64](1)},
				{Type: gzipName},
				{Type: wildcardName, Weight: ptr[float64](0)},
			},
			assertWeight: assert.True,

Review comment (suggestion):
```suggestion
func Test_parseAcceptEncoding(t *testing.T) {
```

Code after:
			expected: notAcceptable,
		},
		{
			desc:     "not acceptable (wildcard)",
			values:   []string{"compress;q=1.0, *;q=0"},
			expected: notAcceptable,
		},
		{
			desc:     "non-zero is higher than 0",
			values:   []string{"gzip, *;q=0"},
			expected: gzipName,
		},
	}

	for _, test := range testCases {
		t.Run(test.desc, func(t *testing.T) {
			t.Parallel()

			encodingType := getCompressionType(test.values, test.defaultType)

			assert.Equal(t, test.expected, encodingType)
		})
	}
}

func Test_parseAcceptEncoding(t *testing.T) {
	testCases := []struct {
		desc         string
		values       []string
		expected     []Encoding
		assertWeight assert.BoolAssertionFunc
	}{
		{
			desc:   "weight",
			values: []string{"br;q=1.0, gzip;q=0.8, *;q=0.1"},
			expected: []Encoding{
				{Type: brotliName, Weight: ptr[float64](1)},
				{Type: gzipName, Weight: ptr(0.8)},
				{Type: wildcardName, Weight: ptr(0.1)},
			},
			assertWeight: assert.True,
		},
		{
			desc:   "mixed",
			values: []string{"gzip, br;q=1.0, *;q=0"},
			expected: []Encoding{
				{Type: brotliName, Weight: ptr[float64](1)},
				{Type: gzipName},
				{Type: wildcardName, Weight: ptr[float64](0)},
			},
			assertWeight: assert.True,
Repository: traefik/traefik
File: pkg/provider/acme/provider.go (Go)

Code before:
	if p.client != nil {
		return p.client, nil
	}

	account, err := p.initAccount(ctx)
	if err != nil {
		return nil, err
	}

	logger.Debug().Msg("Building ACME client...")

	caServer := lego.LEDirectoryProduction
	if len(p.CAServer) > 0 {
		caServer = p.CAServer
	}
	logger.Debug().Msg(caServer)

	config := lego.NewConfig(account)
	config.CADirURL = caServer
	config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)

	if len(p.CACertificates) > 0 {
		httpClient, err := p.createHTTPClient()
		if err != nil {
			return nil, err
		}

		config.HTTPClient = httpClient
	}

	client, err := lego.NewClient(config)
	if err != nil {
		return nil, err
	}

	// New users will need to register; be sure to save it
	if account.GetRegistration() == nil {
		reg, errR := p.register(ctx, client)
		if errR != nil {
			return nil, errR
		}

		account.Registration = reg
	}

	// Save the account once before all the certificates generation/storing
	// No certificate can be generated if account is not initialized
	err = p.Store.SaveAccount(p.ResolverName, account)
	if err != nil {
		return nil, err

Review comment (suggestion):
```suggestion
			return nil, fmt.Errorf("creating HTTP client: %w", err)
```

Code after:
	if p.client != nil {
		return p.client, nil
	}

	account, err := p.initAccount(ctx)
	if err != nil {
		return nil, err
	}

	logger.Debug().Msg("Building ACME client...")

	caServer := lego.LEDirectoryProduction
	if len(p.CAServer) > 0 {
		caServer = p.CAServer
	}
	logger.Debug().Msg(caServer)

	config := lego.NewConfig(account)
	config.CADirURL = caServer
	config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)

	config.HTTPClient, err = p.createHTTPClient()
	if err != nil {
		return nil, fmt.Errorf("creating HTTP client: %w", err)
	}

	client, err := lego.NewClient(config)
	if err != nil {
		return nil, err
	}

	// New users will need to register; be sure to save it
	if account.GetRegistration() == nil {
		reg, errR := p.register(ctx, client)
		if errR != nil {
			return nil, errR
		}

		account.Registration = reg
	}

	// Save the account once before all the certificates generation/storing
	// No certificate can be generated if account is not initialized
	err = p.Store.SaveAccount(p.ResolverName, account)
	if err != nil {
		return nil, err
	}

	if (p.DNSChallenge == nil || len(p.DNSChallenge.Provider) == 0) &&
		(p.HTTPChallenge == nil || len(p.HTTPChallenge.EntryPoint) == 0) &&
Repository: traefik/traefik
File: pkg/provider/acme/provider.go (Go)

Code before:
	ctx := logger.WithContext(context.Background())

	if p.client != nil {
		return p.client, nil
	}

	account, err := p.initAccount(ctx)
	if err != nil {
		return nil, err
	}

	logger.Debug().Msg("Building ACME client...")

	caServer := lego.LEDirectoryProduction
	if len(p.CAServer) > 0 {
		caServer = p.CAServer
	}
	logger.Debug().Msg(caServer)

	config := lego.NewConfig(account)
	config.CADirURL = caServer
	config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)

	if len(p.CACertificates) > 0 {
		httpClient, err := p.createHTTPClient()
		if err != nil {
			return nil, err
		}

		config.HTTPClient = httpClient
	}

	client, err := lego.NewClient(config)
	if err != nil {
		return nil, err
	}

	// New users will need to register; be sure to save it
	if account.GetRegistration() == nil {
		reg, errR := p.register(ctx, client)
		if errR != nil {
			return nil, errR
		}

		account.Registration = reg
	}

	// Save the account once before all the certificates generation/storing
	// No certificate can be generated if account is not initialized
	err = p.Store.SaveAccount(p.ResolverName, account)

Review comment (suggestion):
```suggestion
		config.HTTPClient, err = p.createHTTPClient()
```

Code after:
	ctx := logger.WithContext(context.Background())

	if p.client != nil {
		return p.client, nil
	}

	account, err := p.initAccount(ctx)
	if err != nil {
		return nil, err
	}

	logger.Debug().Msg("Building ACME client...")

	caServer := lego.LEDirectoryProduction
	if len(p.CAServer) > 0 {
		caServer = p.CAServer
	}
	logger.Debug().Msg(caServer)

	config := lego.NewConfig(account)
	config.CADirURL = caServer
	config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)

	config.HTTPClient, err = p.createHTTPClient()
	if err != nil {
		return nil, fmt.Errorf("creating HTTP client: %w", err)
	}

	client, err := lego.NewClient(config)
	if err != nil {
		return nil, err
	}

	// New users will need to register; be sure to save it
	if account.GetRegistration() == nil {
		reg, errR := p.register(ctx, client)
		if errR != nil {
			return nil, errR
		}

		account.Registration = reg
	}

	// Save the account once before all the certificates generation/storing
	// No certificate can be generated if account is not initialized
	err = p.Store.SaveAccount(p.ResolverName, account)
	if err != nil {
		return nil, err
	}
Repository: traefik/traefik
File: pkg/provider/acme/provider.go (Go)

Code before:
	if p.HTTPChallenge != nil && len(p.HTTPChallenge.EntryPoint) > 0 {
		logger.Debug().Msg("Using HTTP Challenge provider.")

		err = client.Challenge.SetHTTP01Provider(p.HTTPChallengeProvider)
		if err != nil {
			return nil, err
		}
	}

	if p.TLSChallenge != nil {
		logger.Debug().Msg("Using TLS Challenge provider.")

		err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider)
		if err != nil {
			return nil, err
		}
	}

	p.client = client
	return p.client, nil
}

func (p *Provider) createHTTPClient() (*http.Client, error) {
	tlsConfig, err := p.createClientTLSConfig()
	if err != nil {
		return nil, err
	}

	return &http.Client{
		Timeout: 2 * time.Minute,
		Transport: &http.Transport{
			Proxy: http.ProxyFromEnvironment,
			DialContext: (&net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
			}).DialContext,
			TLSHandshakeTimeout:   30 * time.Second,
			ResponseHeaderTimeout: 30 * time.Second,
			TLSClientConfig:       tlsConfig,
		},
	}, nil
}

func (p *Provider) createClientTLSConfig() (*tls.Config, error) {
	if len(p.CACertificates) > 0 {
		certPool, err := lego.CreateCertPool(p.CACertificates, p.CAUseSystemCertPool)
		if err != nil {
			return nil, err
		}

		return &tls.Config{

Review comment (suggestion):
```suggestion
		return nil, fmt.Errorf("creating client TLS config: %w", err)
```

Code after:
		if err != nil {
			return nil, err
		}
	}

	if p.TLSChallenge != nil {
		logger.Debug().Msg("Using TLS Challenge provider.")

		err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider)
		if err != nil {
			return nil, err
		}
	}

	p.client = client
	return p.client, nil
}

func (p *Provider) createHTTPClient() (*http.Client, error) {
	tlsConfig, err := p.createClientTLSConfig()
	if err != nil {
		return nil, fmt.Errorf("creating client TLS config: %w", err)
	}

	return &http.Client{
		Timeout: 2 * time.Minute,
		Transport: &http.Transport{
			Proxy: http.ProxyFromEnvironment,
			DialContext: (&net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
			}).DialContext,
			TLSHandshakeTimeout:   30 * time.Second,
			ResponseHeaderTimeout: 30 * time.Second,
			TLSClientConfig:       tlsConfig,
		},
	}, nil
}

func (p *Provider) createClientTLSConfig() (*tls.Config, error) {
	if len(p.CACertificates) > 0 || p.CAServerName != "" {
		certPool, err := lego.CreateCertPool(p.CACertificates, p.CASystemCertPool)
		if err != nil {
			return nil, fmt.Errorf("creating cert pool with custom certificates: %w", err)
		}

		return &tls.Config{
			ServerName: p.CAServerName,
			RootCAs:    certPool,
		}, nil
	}
Repository: traefik/traefik
File: pkg/provider/acme/provider.go (Go)

Code before:
	if len(p.CACertificates) > 0 {
		certPool, err := lego.CreateCertPool(p.CACertificates, p.CAUseSystemCertPool)
		if err != nil {
			return nil, err
		}

		return &tls.Config{
			ServerName: p.CATLSServerName,
			RootCAs:    certPool,
		}, nil
	}

	// Compatibility layer with the lego.
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L24-L34
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L97-L113

	customCACertsPath := os.Getenv("LEGO_CA_CERTIFICATES")
	if customCACertsPath == "" {
		return nil, nil
	}

	useSystemCertPool, _ := strconv.ParseBool(os.Getenv("LEGO_CA_SYSTEM_CERT_POOL"))

	certPool, err := lego.CreateCertPool(strings.Split(customCACertsPath, string(os.PathListSeparator)), useSystemCertPool)
	if err != nil {
		return nil, err
	}

	return &tls.Config{
		ServerName: os.Getenv("LEGO_CA_SERVER_NAME"),
		RootCAs:    certPool,
	}, nil
}

func (p *Provider) initAccount(ctx context.Context) (*Account, error) {
	if p.account == nil || len(p.account.Email) == 0 {
		var err error
		p.account, err = NewAccount(ctx, p.Email, p.KeyType)
		if err != nil {
			return nil, err
		}
	}

	// Set the KeyType if not already defined in the account
	if len(p.account.KeyType) == 0 {
		p.account.KeyType = GetKeyType(ctx, p.KeyType)
	}

	return p.account, nil
}


Review comment (suggestion):
```suggestion
		return nil, fmt.Errorf("creating cert pool: %w, err)
```

Code after:
		}

		return &tls.Config{
			ServerName: p.CAServerName,
			RootCAs:    certPool,
		}, nil
	}

	// Compatibility layer with the lego.
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L24-L34
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L97-L113

	serverName := os.Getenv("LEGO_CA_SERVER_NAME")
	customCACertsPath := os.Getenv("LEGO_CA_CERTIFICATES")

	if customCACertsPath == "" && serverName == "" {
		return nil, nil
	}

	useSystemCertPool, _ := strconv.ParseBool(os.Getenv("LEGO_CA_SYSTEM_CERT_POOL"))

	certPool, err := lego.CreateCertPool(strings.Split(customCACertsPath, string(os.PathListSeparator)), useSystemCertPool)
	if err != nil {
		return nil, fmt.Errorf("creating cert pool: %w", err)
	}

	return &tls.Config{
		ServerName: serverName,
		RootCAs:    certPool,
	}, nil
}

func (p *Provider) initAccount(ctx context.Context) (*Account, error) {
	if p.account == nil || len(p.account.Email) == 0 {
		var err error
		p.account, err = NewAccount(ctx, p.Email, p.KeyType)
		if err != nil {
			return nil, err
		}
	}

	// Set the KeyType if not already defined in the account
	if len(p.account.KeyType) == 0 {
		p.account.KeyType = GetKeyType(ctx, p.KeyType)
	}

	return p.account, nil
}

func (p *Provider) register(ctx context.Context, client *lego.Client) (*registration.Resource, error) {
	logger := log.Ctx(ctx)
Repository: traefik/traefik
File: pkg/middlewares/accesslog/logger.go (Go)

Code before:
	ctx := req.Context()
	capt, err := capture.FromContext(ctx)
	if err != nil {
		log.Ctx(ctx).Error().Err(err).Str(logs.MiddlewareType, "AccessLogs").Msg("Could not get Capture")
		return
	}

	defer func(capt capture.Capture, rw http.ResponseWriter) {
		if h.config.BufferingSize > 0 {
			h.logHandlerChan <- handlerParams{
				logDataTable: logDataTable,
			}
			return
		}

		logDataTable.DownstreamResponse = downstreamResponse{
			headers: rw.Header().Clone(),
		}

		logDataTable.DownstreamResponse.status = capt.StatusCode()
		logDataTable.DownstreamResponse.size = capt.ResponseSize()
		logDataTable.Request.size = capt.RequestSize()

		h.logTheRoundTrip(logDataTable)
	}(capt, rw)

	next.ServeHTTP(rw, reqWithDataTable)

	if _, ok := core[ClientUsername]; !ok {
		core[ClientUsername] = usernameIfPresent(reqWithDataTable.URL)
	}

	logDataTable.DownstreamResponse = downstreamResponse{
		headers: rw.Header().Clone(),
	}

	logDataTable.DownstreamResponse.status = capt.StatusCode()
	logDataTable.DownstreamResponse.size = capt.ResponseSize()
	logDataTable.Request.size = capt.RequestSize()
}

// Close closes the Logger (i.e. the file, drain logHandlerChan, etc).
func (h *Handler) Close() error {
	close(h.logHandlerChan)
	h.wg.Wait()
	return h.file.Close()
}

// Rotate closes and reopens the log file to allow for rotation by an external source.
func (h *Handler) Rotate() error {
	if h.config.FilePath == "" {

Review comment (suggestion):
Hello @hood,

Thanks for submitting this!

At a glance, I have a few comments:
the `ClientUsername` field should be handled in the defer func
the defer func should replace the code after the `next.ServeHTTP` call
if `h.config.BufferingSize > 0` the `logDataTable` should be updated as well

Could you please fix these? As well, could you please add unit tests?

Thanks again!

Code after:
	}

	core[ClientAddr] = req.RemoteAddr
	core[ClientHost], core[ClientPort] = silentSplitHostPort(req.RemoteAddr)

	if forwardedFor := req.Header.Get("X-Forwarded-For"); forwardedFor != "" {
		core[ClientHost] = forwardedFor
	}

	ctx := req.Context()
	capt, err := capture.FromContext(ctx)
	if err != nil {
		log.FromContext(log.With(ctx, log.Str(log.MiddlewareType, "AccessLogs"))).
			WithError(err).
			Errorf("Could not get Capture")
		return
	}

	defer func() {
		logDataTable.DownstreamResponse = downstreamResponse{
			headers: rw.Header().Clone(),
		}

		logDataTable.DownstreamResponse.status = capt.StatusCode()
		logDataTable.DownstreamResponse.size = capt.ResponseSize()
		logDataTable.Request.size = capt.RequestSize()

		if _, ok := core[ClientUsername]; !ok {
			core[ClientUsername] = usernameIfPresent(reqWithDataTable.URL)
		}

		if h.config.BufferingSize > 0 {
			h.logHandlerChan <- handlerParams{
				logDataTable: logDataTable,
			}
			return
		}

		h.logTheRoundTrip(logDataTable)
	}()

	next.ServeHTTP(rw, reqWithDataTable)
}

// Close closes the Logger (i.e. the file, drain logHandlerChan, etc).
func (h *Handler) Close() error {
	close(h.logHandlerChan)
	h.wg.Wait()
	return h.file.Close()
}
Repository: traefik/traefik
File: pkg/plugins/wasip.go (Go)

Code before:
//go:build !windows

package plugins

import (
	"context"
	"fmt"
	"os"

	"github.com/stealthrocket/wasi-go/imports"
	wazergo_wasip1 "github.com/stealthrocket/wasi-go/imports/wasi_snapshot_preview1"
	"github.com/stealthrocket/wazergo"
	"github.com/tetratelabs/wazero"
	wazero_wasip1 "github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1"
)

type ContextApplier func(ctx context.Context) context.Context

func Instantiate(ctx context.Context, runtime wazero.Runtime, mod wazero.CompiledModule, settings Settings) (ContextApplier, error) {
	extension := imports.DetectSocketsExtension(mod)
	if extension != nil {
		hostModule := wazergo_wasip1.NewHostModule(*extension)

		builder := imports.NewBuilder().WithSocketsExtension("auto", mod)

		envs := []string{}
		for _, env := range settings.Envs {
			envs = append(envs, fmt.Sprintf("%s=%s", env, os.Getenv(env)))
		}
		if len(envs) > 0 {
			builder.WithEnv(envs...)
		}

		if len(settings.Mounts) > 0 {
			builder.WithDirs(settings.Mounts...)
		}

		ctx, sys, err := builder.Instantiate(ctx, runtime)
		if err != nil {
			return nil, err
		}

		inst, err := wazergo.Instantiate(ctx, runtime, hostModule, wazergo_wasip1.WithWASI(sys))
		if err != nil {
			return nil, err

Review comment (suggestion):
```suggestion
	socketsExtension := imports.DetectSocketsExtension(mod)
```

Code after:
//go:build !windows

package plugins

import (
	"context"
	"fmt"
	"os"

	"github.com/stealthrocket/wasi-go/imports"
	wazergo_wasip1 "github.com/stealthrocket/wasi-go/imports/wasi_snapshot_preview1"
	"github.com/stealthrocket/wazergo"
	"github.com/tetratelabs/wazero"
	wazero_wasip1 "github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1"
)

type ContextApplier func(ctx context.Context) context.Context

// InstantiateHost instantiates the Host module according to the guest requirements (for now only SocketExtensions).
func InstantiateHost(ctx context.Context, runtime wazero.Runtime, mod wazero.CompiledModule, settings Settings) (ContextApplier, error) {
	if extension := imports.DetectSocketsExtension(mod); extension != nil {
		envs := []string{}
		for _, env := range settings.Envs {
			envs = append(envs, fmt.Sprintf("%s=%s", env, os.Getenv(env)))
		}

		builder := imports.NewBuilder().WithSocketsExtension("auto", mod)
		if len(envs) > 0 {
			builder.WithEnv(envs...)
		}

		if len(settings.Mounts) > 0 {
			builder.WithDirs(settings.Mounts...)
		}

		ctx, sys, err := builder.Instantiate(ctx, runtime)
		if err != nil {
			return nil, err
		}

		inst, err := wazergo.Instantiate(ctx, runtime, wazergo_wasip1.NewHostModule(*extension), wazergo_wasip1.WithWASI(sys))
		if err != nil {
			return nil, fmt.Errorf("wazergo instantiation: %w", err)
		}