fuzz: fix ci job, install cargo-fuzz first
What the developer wrote
Authored by Nick Johnson
fuzz: fix ci job, install cargo-fuzz first
Add explict bash shell for set -e fail fast default.
Use ${RUSTFLAGS:-} in fuzz.sh so an unset value expands to nothing and
any value the caller did set still gets through.
Co-authored-by: satsfy (Renato Britto) <renatobritto@protonmail.com>
What changed, and why it matters
This commit fixes the project's daily automated fuzzing test job. It adds an explicit installation step for the cargo-fuzz tool, ensures the script uses bash so error handling works correctly, and fixes a shell variable expansion quirk so custom Rust compiler flags don't break when unset. There is no change to the library code that users depend on, and no security vulnerability is present or patched.
No security action needed. Treat as a normal CI/infrastructure maintenance commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies CI configuration and a fuzzing helper script only. .github/workflows/cron-daily-fuzz.yml now installs cargo-fuzz 0.12.0 explicitly before running fuzz targets and sets shell: bash on the fuzz step. fuzz/fuzz.sh changes RUSTFLAGS=”$RUSTFLAGS $fuzz_rustflags” to RUSTFLAGS=”${RUSTFLAGS:-} ${fuzz_rustflags}” so an unset RUSTFLAGS expands to an empty string rather than producing a literal “$RUSTFLAGS” word. No runtime library code is changed.
Changed components
.github/workflows/cron-daily-fuzz.ymlfuzz/fuzz.shInspect captured patch +4 / −1
diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index 4c5c69b6..61e94c6e 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -36,8 +36,11 @@ jobs:
- uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
with:
toolchain: '1.74.0'
+ - name: Install cargo-fuzz
+ run: cargo install --locked --version 0.12.0 cargo-fuzz
- name: Fuzz shard ${{ matrix.shard_id }}
working-directory: fuzz
+ shell: bash
run: |
shard_targets=($(cargo fuzz list | sort | awk -v shard=${{ matrix.shard_id }} 'BEGIN{i=0} {if (i++ % 16 == shard) print}'))
for target in "${shard_targets[@]}"; do
diff --git a/fuzz/fuzz.sh b/fuzz/fuzz.sh
index e1d5d0b8..09df3f28 100755
--- a/fuzz/fuzz.sh
+++ b/fuzz/fuzz.sh
@@ -79,7 +79,7 @@ while :; do
if [ "$cycle_mode" = true ]; then
chrt_cmd='chrt -i 0'
fi
- RUSTFLAGS="$RUSTFLAGS $fuzz_rustflags" $chrt_cmd cargo +nightly fuzz run "$targetName" -- -max_total_time="$max_total_time"
+ RUSTFLAGS="${RUSTFLAGS:-} ${fuzz_rustflags}" $chrt_cmd cargo +nightly fuzz run "$targetName" -- -max_total_time="$max_total_time"
echo "Minimizing corpus for target $targetName"
cargo +nightly fuzz cmin "$targetName"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.