Repository navigation
ci(cflite): add the Dockerfile ClusterFuzzLite needs and fix the fuzz build - #170
Merged
Merged
Conversation
… build ClusterFuzzLite fails in build_fuzzers on every PR, for three reasons: - It runs `docker build -f .clusterfuzzlite/Dockerfile`, but the directory only had a Containerfile. Add a Dockerfile that mirrors it (same pinned base-builder-rust digest). The Containerfile stays for podman-first local builds. - build.sh copied targets from ./target/..., but cargo-fuzz writes them to ./fuzz/target/x86_64-unknown-linux-gnu/release/. The copy failed with "cannot stat". - Once built, fuzz_parser reported a leak on its first input (a single newline). The leak comes from nickel-lang-parser, which allocates AST nodes in a bumpalo arena that never runs destructors, so strings in those nodes always leak. Add fuzz_parser.options turning off leak detection for libFuzzer and ASan, and have build.sh copy each target's .options file to $OUT. ASan still reports memory-safety errors. Verified locally with the same base image: - The compile finishes and $OUT contains fuzz_parser. - A 90-second fuzz run (615 executions) produced no crashes. - With both leak switches off, the run exits 0 with no artifacts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
hyperpolymath
marked this pull request as ready for review
November 5, 2026 00:15
hyperpolymath
enabled auto-merge (squash)
November 5, 2026 00:15
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
SonarCloud failed this PR on a D security rating for new code: - Dockerfile:10 "Copying recursively might inadvertently add sensitive data to the container." `COPY . $SRC/bunsenite` sent the whole checkout, .git included, into the build image. - build.sh:13 "Use '[[' instead of '['". The image now copies only what the fuzz build reads: - Cargo.toml and Cargo.lock - src/ - benches/ (declared as [[bench]] targets) - crates/ (the patched nickel-lang-vector) - fuzz/ - .clusterfuzzlite/ (build.sh reads the per-target .options from there) The Containerfile gets the same change, to stay in sync. Nothing in these paths uses include_str!/include_bytes! on files outside them, and `cargo metadata` resolves both manifests from that subset. The "runs as root" warning stays as it is: the OSS-Fuzz base-builder image needs root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
The Dogfood Gate's "Validate K9 contracts" job (k9-ecosystem/validate-action) fails on main with four errors: - config/build.k9.ncl, config/rust-fmt.k9.ncl: "Missing K9 format marker". The K9! preamble sat on line 2, under the SPDX comment; the validator requires it as the first non-empty line, which is how the contractiles templates lay it out. K9! now comes first, SPDX second. - config/rust-fmt.k9.ncl: "Pedigree block missing 'name' field". Both config contracts now carry a pedigree name. - setup-dev-env.k9.ncl: "Hunt-level K9 file must include a 'signature' or 'signature_required' field". It is a Hunt component (it runs installers and shell commands), so its pedigree now declares signature_required = true, as contractiles/self-validating/template-hunt.k9.ncl does. The validator now reports 10 files scanned, 0 errors. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye (cherry picked from commit a94f3ea)
|
Owner
Author
|
Status at head 91d8388: ClusterFuzzLite PR (address), Validate K9 contracts and Validate DEED manifests all pass.
Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ClusterFuzzLite PR fuzzing / PR (address) fails on every PR, including #168. This PR fixes the three causes, in the order they surface.
Changes
.clusterfuzzlite/Dockerfile(new).build_fuzzersrunsdocker build -f .clusterfuzzlite/Dockerfile, but the directory only had aContainerfile.base-builder-rustdigest. This is the estate convention betlang and jtv-lang already follow..clusterfuzzlite/build.sh../fuzz/target/x86_64-unknown-linux-gnu/release/, where cargo-fuzz writes them. The old path./target/...failed withcannot stat..optionsfile to$OUT..clusterfuzzlite/fuzz_parser.options(new). Turns off leak detection for libFuzzer and ASan.fuzz_parserreported a leak on its first input, a single newline.nickel-lang-parser0.4.0. It allocates AST nodes in abumpaloarena, which never runs destructors (see theAstAllocdocs insrc/ast/alloc.rs), so strings in parsed literals always leak.Testing
I ran the compile locally in the same base image with
FUZZING_LANGUAGE=rustandSANITIZER=address:$OUTcontainedfuzz_parser.bash -n build.shpasses, and the options file parses as INI.One thing to watch: the PR job has a 15-minute timeout. Locally the compile took about 6 minutes and the run step fuzzes for 300 seconds, so the margin is small.
Generated by Claude Code