Blitzy logo
OverviewUse-casesSecurity
Company
DocsBlogVideos
Pricing
OverviewUse-casesSecurity
Company
DocsBlogVideos
Pricing

Zip With Blitzy zlib

Mar 31, 2026 • Carly Levinsohn • 4 min read

Zip With Blitzy zlib

What do Chrome, Cloudflare, MongoDB, file formats like PNGs or PDFs, and Kubernetes have in common? All of these products leverage zlib: a lightweight, battle-tested C library utilized for data compression and decompression embedded in the Linux kernel, Git, OpenSSL, OpenSSH, PostgreSQL, Apache, Python, Ruby, and nearly every Linux package manager.

Shipped on PlayStation and Xbox consoles, zlib was adopted into the Java Development Kit in version 1.1. First released in May 1995, the data-compression software is one of the most ubiquitous libraries in computing history. After 31 years, it is still written in C.

The CVE history contains several textbook examples of different vulnerability classes the industry is seeking to eliminate. Here are the main bugs to be aware of:

  • CVE-2018-25032: a memory corruption flaw in a release that went unpatched for almost four years.
  • CVE-2022-37434: a heap-based buffer overflow from improper bounds checking.
  • CVE-2023-45853: an integer overflow leading to yet another heap-based buffer overflow.

The Migration that Never Happens

Despite the known memory safety risks and governmental concerns, no one wants to migrate zlib. The mechanics and economics do not work.

Rust talent does not exist at scale, forcing developers into steep learning curves. Development velocity can drop upwards of 30-50% in the first three to six months of Rust adoption in production. The closest public benchmark is Google's Android Keystore rewrite: a small C++ component that took three senior engineers four months at a company with existing Rust infrastructure.

Targeting zlib is harder, requiring 24,000 lines of C implementing three RFC specifications with complex stateful compression logic. The project demands a rare intersection of DEFLATE domain expertise and Rust fluency.

A conservative estimate for a skilled team would be six to twelve months of development with the total lifecycle stretching well beyond that, as only 15% of enterprise migrations finish on time and on budget.

Plus, zlib has no one to do the work. The library is maintained by two contributors with no corporate sponsor. The organizations that depend on zlib (effectively everyone) expects the library to keep working.

The software development community agrees migrating zlib should happen, but nobody can afford to execute. For Blitzy's next open-source contribution, the platform takes on the challenge of zlib.

What Blitzy Built

Blitzy, our autonomous software development platform, produced a complete, idiomatic Rust implementation of zlib in 41 hours. The output is a production-grade library with full specification compliance and a drop-in C compatible interface. The prompt used to create the product was shorter than usual, which highlights Blitzy's decision-making process. See the pull request and project guide that recaps the work.

The achievements for the project are as follows:

  • Full DEFLATE format compliance — The Rust port implements RFC 1950 (zlib), RFC 1951 (DEFLATE), and RFC 1952 (gzip) in entirety, the same wire-format capability that every downstream consumer of zlib depends on.
  • Zero unsafe in core crate — #![forbid(unsafe_code)] enforced on zlib-rs core; all unsafe confined to FFI boundary crate. Every CVE zlib had is structurally impossible now.
  • 541 tests pass (100%) — Including ports of the canonical test/example.c (34 tests) and test/infcover.c (20 tests) harnesses, the same tests that the C version uses to prove correctness, ported and passing.
  • Drop-in C replacement — C-compatible extern "C" drop-in replacement shared library (libz.so, 540KB). Existing programs linked against zlib can swap in this library without changing a line of code. The migration cost for downstream consumers is zero.
  • Production-grade code quality — deny(clippy::all, clippy::pedantic), zero warnings, rustfmt compliant.
  • 3 working examples — zpipe (pipe compression), minigzip (gzip utility), enough (Huffman table calculator).
  • Performance-optimized release profile — Fat LTO, single codegen-unit, opt-level 3, DFA jump thread LLVM flag. Built to compete with C zlib on throughput, not just correctness.

How Autonomous Migration Changes the Math

Conventional SDLC estimates suggest that a project like migrating zlib from C to Rust takes six to twelve months of development with a skilled team. Blitzy challenges that timeline and the assumptions underpinning the lifecycle.

The translation is semantic, not syntactic. A common tool called C2Rust transpiles C syntax into Rust. Leveraging C2Rust, the output compiles, acting functionally equivalent but unsafe. Blitzy's results are fundamentally different, prioritizing memory safety as the primary consideration for migrating from C to Rust. Our output runs under Rust's full safety guarantees. Not because someone audited it after the fact, but because the compiler won't let it build otherwise. Blitzy passes 100% of zlib's canonical test suite: the same test/example.c and test/infcover.c harnesses the C implementation used to validate correctness.

The cost-benefit analysis changes. The economics of legacy migration has always been a cost-benefit problem with a common denominator: costs being too high to justify a large-scale change. The benefits are clear: fewer CVEs, lower maintenance burden, regulatory compliance, and reduced incident response. For libraries like zlib, the gap between cost and benefit will never close. Autonomous development with Blitzy decreases costs and timelines by orders of magnitude, making migration efforts in production roadmaps defensible.

Relying on an autonomous software development platform for migration creates a category shift in which migrations are worth doing for production codebases.

The question becomes not whether to migrate.

Rather, can organizations afford to do migrations the traditional way?

What's Next

Blitzy is committed to pushing the boundaries of technical excellence. If you find any gaps in the project, we thank you for reporting your findings to [email protected] and refining our PR. Review how to use Blitzy in our dev docs.

Interested in reading about our projects and how Blitzy is changing autonomous software development? Subscribe to our newsletter here and follow us on LinkedIn.

More from the blog

View all
How Blitzy Optimized Our GTM Team

How Blitzy Optimized Our GTM Team

Jun 04, 2026 • Carly Levinsohn • 3 min read

A Quick Blitzy Chat:  3 Codebases’ Takes on Prompting

A Quick Blitzy Chat: 3 Codebases’ Takes on Prompting

May 28, 2026 • Carly Levinsohn • 7 min read

Frequently asked questions

What is Blitzy?

toggle button

Blitzy enables development teams to transform six-month software projects into six-day turnarounds using Blitzy OS, an agentic platform that enables thousands of AI Agents to 'think' and cooperate for hours to bulk build software with precision. The platform builds everything AI can deliver in a precise manner, around 80% of any roadmap or new product, supplemented with a human engineering guide to complete the remaining 20% needed for production. With over 27 patents and counting, Blitzy is actively hiring PhDs and senior developers in Cambridge, MA who have a passion for building AI that leverages 'System 2 Thinking' to solve problems at inference.

Who is Blitzy for?

toggle button

Enterprises that aim to dramatically accelerate their software development velocity, development agencies with enterprise clients, development teams with complex existing products, and individuals looking to accelerate their own velocity on complex builds.

How does Blitzy's technology work?

toggle button

Our patent-pending code ingestion framework maps a curated selection of robust, reliable, and secure open source software libraries that we track by version and update frequently. Combined with our proprietary code generation technology that specializes on enforcing enterprise-class software policies, Blitzy far exceeds the utility of typical chatbots and co-pilots in creating production-ready software at scale.

Is Blitzy a coding co-pilot?

toggle button

Nope. Blitzy surpasses traditional co-pilots with its ability to autonomously generate nearly-complete code repositories, not just snippets. It features a daily-refreshed knowledge base, avoiding the pitfalls of outdated information. Blitzy's proprietary codebase representation system enables deep understanding of generated code, offering highly contextual and relevant suggestions for your entire repository.

What's my role in Blitzy's development process?

toggle button

Your team is responsible for bringing the requirements, and as an approver during the technical specification stage. We ask you to edit/approve the Technical Specification. The document is editable, so you can edit and approve to get exactly what you had in mind.

How does Blitzy decide which tasks to delegate to human developers?

toggle button

Blitzy's multi-agent system is meticulously and rigorously trained to know what it can accomplish, and what needs to be left for the human engineers. This ensures you only receive quality code and have a clear picture of remaining tasks.

Does Blitzy do more than just autonomous code generation?

toggle button

Yes. Blitzy is a comprehensive platform that provides end-to-end development assistance. We support the entire development lifecycle by taking descriptive inputs and generating software requirements documents, technical design, code structure, and generative code within repos for your product.

Is this high quality and secure?

toggle button

Quality and Security matter A LOT to us, and was one of our biggest frustrations with the co-pilots we tried on the market. This was the inspiration to develop a system trained to deliver enterprise quality. We train our agents to operate with enterprise standards with multiple QA agents checking each others work before you ever receive a line of code. Ultimately, we provide high quality code repositories, but your team should QA/QC, including testing security.

What is the typical cost of your solution?

toggle button

Blitzy uses a two-phase pricing model: evaluation followed by deployment. This structure enables enterprises to validate ROI at their preferred scale before committing to organization-wide implementation. The evaluation phase provides three options. Reverse Engineer ($0) offers an initial assessment with complete codebase reverse engineering and understanding up to 100K lines of code, Proof of Concept ($50K for 2-month term) where Blitzy delivers a guided POC to demonstrate value, or Structured Pilot ($250K for 6-month term) which fully deploys Blitzy in your environment with 5M lines onboarding and 1.25M lines generation to prove production readiness. Following successful evaluation, organizations choose between three deployment paths. Commercial ($500K typical investment per year) adopts Blitzy on one team to accelerate a defined initiative, with 20M lines onboarding included and $0.10 per line for additional onboarding, dedicated infrastructure, and SAML-SSO. Enterprise ($5M typical investment per year) rolls Blitzy out across your engineering organization with 50M lines onboarding at $0.10 per line, a Dedicated AI Solutions Consultant, and 2 Forward Deployed Engineers. Transformation ($50M typical investment per year) provides infinite code context, custom deployment, and embedded teams including a Field CTO, Dedicated AI Solutions Consultant, 6 Forward Deployed Engineers, and 2 Forward Deployed Designers for complete digital transformation. All tiers maintain SOC 2 Type II compliance, ISO 27001 Certification, and guarantee no training on your code. Pricing operates on a usage-based model at $0.20 per line generated, aligning costs directly with value delivered.

After submitting my prompt, Blitzy added functionality in my tech spec that I did not expect. What do I do?

toggle button

The system defaults to taking advantage of all technology upgrades when modernizing or upgrading to the latest technology stack. For example, if you specify an upgrade to Java 21, the system will by default implement virtual threads, as it's generally seen as a superior technical approach. If you do not want this, you must simply tell the system to 'make as few changes as possible to achieve the desired request'. Being as specific as possible about what functionality is (and is not) desired helps yield results that will align with expectations.

What do Blitzy agents rely on as a source of truth to represent my existing codebase?

toggle button

Blitzy agents rely on the actual source code of your existing codebase—not the Tech Spec documentation—when performing refactors or extending functionality. However, an accurate Tech Spec significantly aids the system's efficiency in querying the underlying representation of the code. Therefore, investing time to ensure the Tech Spec reflects the core features of the application will yield expectation-aligned results and will save time with last-mile development.

Can Blitzy work with existing products and code bases?

toggle button

Yes! Blitzy excels at working with existing codebases, using them as a foundation to ensure consistent, high-quality development. The platform enables you to add new features to existing products, generate comprehensive documentation, and tackle technical debt by upgrading legacy systems to state-of-the-art technologies or refactoring complex codebases. Our platform deploys dedicated AI agents that map and understand your codebase before generation, ensuring intelligent, contextualized development that aligns with your existing patterns and standards.

What programming languages does Blitzy support?

toggle button

Blitzy's AI platform works with all programming languages.

How should I structure my prompts for Blitzy?

toggle button

Structure and organization are crucial when prompting Blitzy. The most effective prompts follow our prompting template with clear sections for WHY (vision & purpose), WHAT (core requirements), and HOW (technical details, user experience & implementation priorities). Each section should be detailed but concise, focusing on essential information while providing relevant context. Including structured frameworks and concrete examples - like data models, user stories, or feature templates - helps Blitzy deliver more precise and purposeful solutions.

What information does Blitzy need to compile and run my code?

toggle button

During code generation, Blitzy compiles your codebase and performs runtime validation to ensure the generated code works correctly. To enable this, we require: (1) Internal dependencies - any private packages, libraries, or binaries not publicly available that your code needs to build and run, (2) Environment variables and secrets - API keys, credentials, and configuration values required for compilation and runtime (shared securely through our encrypted UI, never exposed to AI agents), and (3) Build instructions - the specific steps or scripts needed to compile your code, typically found in your README or setup documentation. This information allows Blitzy to replicate your development environment and verify that all generated code functions properly before delivery.

How can I exclude certain files or folders from Blitzy's code generation?

toggle button

Create a .blitzyignore file in your repository's root directory to specify which files or paths Blitzy should exclude during tech-spec generation and code generation. This works similarly to .gitignore - simply list the file patterns, directories, or specific files you want Blitzy to skip, using standard gitignore syntax like *.log, /build/, or config/secrets.json. To ensure Blitzy respects these exclusions, mention in both your codebase context prompt and target state prompt that Blitzy should reference the .blitzyignore file and exclude those paths from processing.

Can I cancel my project/job (code gen) once in progress?

toggle button

At this time, jobs are not cancelable. Once you submit, it consumes the assigned quota.

Build enterprise software in days, not months.

Start buildingTalk to an expert
Blitzy

Blitzy

One Kendall Square,

Cambridge,

MA 02139

© 2026 Blitzy. All rights reserved

Product

  • Overview
  • Use-cases
  • Security
  • Pricing

Company

  • About us
  • Careers

Support

  • Help
  • Service status
  • Trust center

Resources

  • Docs
  • Blog
  • Videos

Social

  • YouTube
  • LinkedIn

Legal

  • Terms of use
  • Privacy policy