Add .cargo/config.toml for fuzz cfg flags
What the developer wrote
Authored by Joost Jager
Add .cargo/config.toml for fuzz cfg flags
Set fuzzing, secp256k1_fuzz, and hashes_fuzz cfg flags in
fuzz/.cargo/config.toml so they are automatically applied to plain
cargo commands (cargo test, cargo run) run from the fuzz directory.
Remove the now-redundant RUSTFLAGS from the README crash reproduction
examples, the CI cargo test step, and generate_fuzz_coverage.sh.
The honggfuzz and cargo-fuzz docs are unchanged because those tools
build their own RUSTFLAGS env var (which overrides config.toml) and
require the flags to be exported separately.
AI tools were used in preparing this commit.
What changed, and why it matters
This change is purely a developer tooling cleanup. It moves three special Rust compiler flags used only for fuzz testing into a Cargo configuration file inside the fuzz directory, so developers no longer have to type them by hand. It does not change any production code, user-facing behavior, or security-sensitive logic.
No security action needed. Reviewers may optionally confirm that the config.toml rustflags exactly match the removed RUSTFLAGS and that CI still passes.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds fuzz/.cargo/config.toml containing rustflags = [“–cfg=fuzzing”, “–cfg=secp256k1_fuzz”, “–cfg=hashes_fuzz”] and removes the equivalent RUSTFLAGS exports from CI, a coverage script, and README examples. The flags are still applied automatically when cargo commands are run from the fuzz directory. honggfuzz/cargo-fuzz paths keep their own RUSTFLAGS because those tools override config.toml. No source code or cryptographic logic is modified.
Changed components
fuzz/.cargo/config.toml.github/workflows/build.ymlcontrib/generate_fuzz_coverage.shfuzz/README.mdInspect captured patch +4 / −5
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6d51279..b7bae91 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -241,7 +241,7 @@ jobs:
- name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
run: |
cd fuzz
- RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz" cargo test --verbose --color always --lib --bins -j8
+ cargo test --verbose --color always --lib --bins -j8
cargo clean
- name: Run fuzzers
run: cd fuzz && ./ci-fuzz.sh && cd ..
diff --git a/contrib/generate_fuzz_coverage.sh b/contrib/generate_fuzz_coverage.sh
index 09d3765..22826ca 100755
--- a/contrib/generate_fuzz_coverage.sh
+++ b/contrib/generate_fuzz_coverage.sh
@@ -55,8 +55,6 @@ fi
# Create output directory if it doesn't exist
mkdir -p "$OUTPUT_DIR"
-export RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz"
-
# dont run this command when running in CI
if [ "$OUTPUT_CODECOV_JSON" = "0" ]; then
cargo llvm-cov --html --ignore-filename-regex "fuzz/" --output-dir "$OUTPUT_DIR"
diff --git a/fuzz/.cargo/config.toml b/fuzz/.cargo/config.toml
new file mode 100644
index 0000000..8651378
--- /dev/null
+++ b/fuzz/.cargo/config.toml
@@ -0,0 +1,2 @@
+[build]
+rustflags = ["--cfg=fuzzing", "--cfg=secp256k1_fuzz", "--cfg=hashes_fuzz"]
diff --git a/fuzz/README.md b/fuzz/README.md
index 0516ca7..4af7039 100644
--- a/fuzz/README.md
+++ b/fuzz/README.md
@@ -134,7 +134,6 @@ mkdir -p ./test_cases/$TARGET
echo $HEX | xxd -r -p > ./test_cases/$TARGET/any_filename_works
export RUST_BACKTRACE=1
-export RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz"
cargo test
```
@@ -152,7 +151,7 @@ Alternatively, you can use the `stdin_fuzz` feature to pipe the crash input dire
creating test case files on disk:
```shell
-echo -ne '\x2d\x31\x36\x38\x37\x34\x09\x01...' | RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz" cargo run --features stdin_fuzz --bin full_stack_target
+echo -ne '\x2d\x31\x36\x38\x37\x34\x09\x01...' | cargo run --features stdin_fuzz --bin full_stack_target
```
Panics will abort the process directly (the crate uses `panic = "abort"`), resulting in a
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.