fuzz: Install cargo-fuzz for verify-execution job
What the developer wrote
Authored by Ismail Daif
fuzz: Install cargo-fuzz for verify-execution job
What changed, and why it matters
This commit is a routine fix to the project's automated fuzz-testing pipeline. It adds an installation step for the 'cargo-fuzz' tool in one CI job and updates a script that generates the workflow file. There is no change to the actual Bitcoin library code that users depend on, and nothing in the commit suggests a security vulnerability or fix.
No security action needed. Reviewers may optionally verify that pinning cargo-fuzz to version 0.12.0 is intentional and that the --locked flag is acceptable for the project's supply-chain policy.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies .github/workflows/cron-daily-fuzz.yml and fuzz/generate-files.sh. It removes an outdated comment about GitHub Actions job limits and adds ‘cargo install –locked –version 0.12.0 cargo-fuzz’ to the verify-execution job. The same change is reflected in the generator script so future regenerated workflows will include it. This is purely a CI/tooling maintenance change.
Changed components
.github/workflows/cron-daily-fuzz.ymlfuzz/generate-files.shInspect captured patch +3 / −5
diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index 2993be65..b3ffff81 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -18,8 +18,6 @@ jobs:
strategy:
fail-fast: false
matrix:
- # We only get 20 jobs at a time, we probably don't want to go
- # over that limit with fuzzing because of the hour run time.
fuzz_target: [
bitcoin_arbitrary_block,
bitcoin_arbitrary_psbt,
@@ -94,6 +92,7 @@ jobs:
with:
persist-credentials: false
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+ - run: cargo install --locked --version 0.12.0 cargo-fuzz
- name: Display structure of downloaded files
run: ls -R
- run: find executed_* -type f -exec cat {} + | sort > executed
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 6d34a6fe..7777c348 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -58,7 +58,7 @@ bench = false
EOF
done
-# 2. Generate .github/workflows/fuzz.yml
+# 2. Generate .github/workflows/cron-daily-fuzz.yml
cat > "$REPO_DIR/.github/workflows/cron-daily-fuzz.yml" <<EOF
# Automatically generated by fuzz/generate-files.sh
name: Fuzz
@@ -80,8 +80,6 @@ jobs:
strategy:
fail-fast: false
matrix:
- # We only get 20 jobs at a time, we probably don't want to go
- # over that limit with fuzzing because of the hour run time.
fuzz_target: [
$(for name in $(cargo fuzz list); do echo " $name,"; done)
]
@@ -126,6 +124,7 @@ $(for name in $(cargo fuzz list); do echo " $name,"; done)
with:
persist-credentials: false
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+ - run: cargo install --locked --version 0.12.0 cargo-fuzz
- name: Display structure of downloaded files
run: ls -R
- run: find executed_* -type f -exec cat {} + | sort > executed
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.