fuzz: remove psbt fuzz targets and document explicit local bitcoin dependency
What the developer wrote
Authored by Ismail Daif
fuzz: remove psbt fuzz targets and document explicit local bitcoin dependency
What changed, and why it matters
This commit removes two PSBT (Partially Signed Bitcoin Transaction) fuzz testing targets from the project's automated fuzzing setup and adds a clarifying comment about why an explicit version number is needed for a local dependency. There is no change to the actual Bitcoin library code that users rely on, and nothing in the commit suggests a security vulnerability was fixed or introduced.
No security action required. This is a routine fuzzing infrastructure maintenance commit. If removing PSBT fuzz targets was intended to hide a bug, that is not evidenced in the commit or supplied references.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies three fuzzing-related files. It removes bitcoin_arbitrary_psbt and bitcoin_deserialize_psbt from the daily fuzzing CI matrix in .github/workflows/cron-daily-fuzz.yml. It also adds an explanatory comment in fuzz/Cargo.toml and fuzz/generate-files.sh noting that an explicit version = "0.33.0-beta" on the path dependency is required due to a limitation in Andrew’s tools / crate2nix (see nix-community/crate2nix#373). No runtime code is changed.
Changed components
fuzz/Cargo.tomlfuzz/generate-files.sh.github/workflows/cron-daily-fuzz.ymlInspect captured patch +5 / −3
diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index 9870e982..14ee7f4b 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -20,14 +20,12 @@ jobs:
matrix:
fuzz_target: [
bitcoin_arbitrary_block,
- bitcoin_arbitrary_psbt,
bitcoin_arbitrary_script,
bitcoin_arbitrary_transaction,
bitcoin_arbitrary_witness,
bitcoin_compare_consensus_encoding,
bitcoin_deserialize_block,
bitcoin_deserialize_prefilled_transaction,
- bitcoin_deserialize_psbt,
bitcoin_deserialize_script,
bitcoin_deserialize_transaction,
bitcoin_deserialize_witness,
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index b2084371..236af561 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -10,6 +10,8 @@ publish = false
cargo-fuzz = true
[dependencies]
+# We shouldn't need an explicit version on the next line, but Andrew's tools
+# choke on it otherwise. See https://github.com/nix-community/crate2nix/issues/373
bitcoin = { path = "../bitcoin", version = "0.33.0-beta", features = [ "serde", "arbitrary" ] }
old_bitcoin = { version = "0.32.8", package = "bitcoin" }
bitcoin_consensus_encoding = { path = "../consensus_encoding", package = "bitcoin-consensus-encoding" }
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 880a7822..1d0957b3 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -22,7 +22,9 @@ publish = false
cargo-fuzz = true
[dependencies]
-bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
+# We shouldn't need an explicit version on the next line, but Andrew's tools
+# choke on it otherwise. See https://github.com/nix-community/crate2nix/issues/373
+bitcoin = { path = "../bitcoin", version = "0.33.0-beta", features = [ "serde", "arbitrary" ] }
old_bitcoin = { version = "0.32.8", package = "bitcoin" }
bitcoin_consensus_encoding = { path = "../consensus_encoding", package = "bitcoin-consensus-encoding" }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.