GeezerVison is showing github.com — Fuzzer Migration Follow-ups by DaveLak · Pull Request #1903 · gitpython-developers/GitPython
Conversation
DaveLak
commented
Apr 16, 2024
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
This PR addresses most unresolved review comments from #1901. It also updates the README
Addressed in This PR
- Remove shebangs from fuzz harnesses (Comment 1 & Comment 2)
- Replace shebang in
build.sh with ShellCheck directive (Comment)
- Set executable bit on
fuzzing/oss-fuzz-scripts/container-environment-bootstrap.sh to mark it executable in Git (Comment)
- Make the link text in
fuzzing/README.md for the OSS-Fuzz test status URL more descriptive (Comment)
- Fix capitalization of GitPython repository name in
fuzzing/README.md (Comment)
- Simplify read delimiter to use empty string in
build.sh's build fuzz harness loop (Comment)
- Remove unnecessary semicolons in
fuzzing/oss-fuzz-scripts/container-environment-bootstrap.sh for consistent script formatting (Comment)
- Fix various misspellings of "corpora" (Comment)
Misc
TODO / Pending Further Discussion
I felt that these items are better addressed in separate PRs.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Prefer executing these files using the OSS-Fuzz or `python` command
methods outlined in the `fuzzing/README`.
Based on feedback and discussion on:
gitpython-developers#1901
This script is meant to be sourced by the OSS-Fuzz file of the same
name, rather than executed directly. The shebang may lead to the
incorrect assumption that the script is meant for direct execution.
Replacing it with this directive instructs ShellCheck to treat
the script as a Bash script, regardless of how it is executed.
Based @EliahKagan's suggestion and feedback on:
gitpython-developers#1901
This script is executed directly, not sourced as is the case with
`build.sh`, so it should have an executable bit set to avoid ambiguity.
Based @EliahKagan's suggestion and feedback on:
gitpython-developers#1901
- Make the link text for the OSS-Fuzz test status URL more descriptive
- Fix capitalization of GitPython repository name
Based @EliahKagan's suggestion and feedback on:
gitpython-developers#1901
Replaces the null character delimiter `-d $'\0'` with the simpler
empty string `-d ''` in the fuzzing harness build loop.
This changes leverages the Bash `read` builtin behavior to avoid
unnecessary complexity and improving script readability.
Based @EliahKagan's suggestion and feedback on:
gitpython-developers#1901
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good.
I wonder if corpra should be renamed to corpora in that path as well, or if that would cause problems.
If and only if that is changed, this line would then need to be changed accordingly:
|
rsync -avc qa-assets/gitpython/corpra/ "$SEED_DATA_DIR/" && |
Unrelated to that, there is a tiny style nit commented on below (which you may even decide to leave as-is).
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
DaveLak
commented
Apr 17, 2024
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
I wonder if corpra should be renamed to corpora in that path as well, or if that would cause problems.
It definitely should but among everything else related to the fuzzing work, updating that repo feels like the lowest priority. Especially considering right now it works exactly as we need it to, I've opted to defer any changes for now.
After the outstanding change requests are addressed, I would like (and plan) to revisit https://github.com/gitpython-developers/qa-assets. I think it would benefit from a structure similar to https://github.com/bitcoin-core/qa-assets. Specifically:
- A simple README with context about what's there, why, and how to use/improve it.
- Removal of the assets related to the unrelated projects.
- Updating it so the contents of each corpus are stored in a directory named for the fuzz harness they're used by instead of opaque zip blobs. That would require updating the container bootstrap script to zip them too.
I'm happy to discuss further if you would like but that feels like it would be best in a discussion thread (or an issue on https://github.com/gitpython-developers/qa-assets, but I'm not sure there is a desire to turn issues on there.)
|
EliahKagan reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Also makes come structural improvements to how the local instructions
for running OSS-Fuzz are presented now that only the single `address`
sanitizer is a valid option.
The `undefined` sanitizer was removed from GitPython's `project.yaml`
OSS-Fuzz configuration file at the request of OSS-Fuzz project reviewers
in google/oss-fuzz#11803.
The `undefined` sanitizer is only useful in Python projects that use
native exstensions (such as C, C++, Rust, ect.), which GitPython does
not currently do. This commit updates the `fuzzing/README` reference to
that sanitizer accoirdingly.
See:
- google/oss-fuzz@b210fb2
- google/oss-fuzz#11803 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot for this follow-up and for sharing your plan of the additional improvements.
Not using zip blobs stored in the qa-assets repository is my favorite :).
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
DaveLak reacted with heart emoji
Reviewers
Byron
Byron approved these changes
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|