Skip to content

Add support for running run, artifacts, and archive subcommands without a fuzzing harness - #356

Merged
azchin merged 2 commits into
ossf:mainfrom
br32710:auditing
Aug 21, 2026
Merged

Add support for running run, artifacts, and archive subcommands without a fuzzing harness#356
azchin merged 2 commits into
ossf:mainfrom
br32710:auditing

Conversation

@br32710

@br32710 br32710 commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Describe what changed and why.

  • New auditing type CRS is added which submits bug-candidates instead of PoVs, does not require --target-harness or --fuzz-proj-path
  • archive --all includes exchange dirs, run logs, and shared dirs even if no harness is specified
  • artifacts are returned for source-only runs
  • Added new run artifacts scope for source-only runs
  • Check for bug-candidates when --early-exit is set

User Impact

  • User-facing change
  • Internal-only change

If user-facing, describe CLI/API/config/docs impact and migration steps.

Added note about source-only CRSs in crs-development.md

Release Note / Changelog

  • I updated CHANGELOG.md ([Unreleased]) for user-facing changes
  • No changelog entry needed (internal-only refactor/test/chore)

If this PR includes deprecation or breaking behavior, include:

  • replacement path for users
  • planned removal version/release window

Validation

List tests/checks run and their results.

Checklist

  • I followed Conventional Commits
  • I updated docs for behavior/config/CLI changes
  • I added/updated tests for behavior changes
  • I considered backward compatibility and migration impact

@br32710
br32710 force-pushed the auditing branch 3 times, most recently from b25f646 to 28852ee Compare August 11, 2026 02:53
@br32710

br32710 commented Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

Note: the sanitizer and architecture fields in crs.yaml don't have as much meaning without a target harness but are still required

@azchin azchin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, please refer to the comments

Comment thread oss_crs/src/cli/crs_compose.py Outdated
Comment thread oss_crs/src/env_policy.py Outdated
Comment thread oss_crs/src/target.py Outdated
Comment on lines +395 to +399
if not (self.repo_path / ".git").exists():
self.repo_hash = hashlib.sha256(
str(self.repo_path.resolve()).encode()
).hexdigest()[:12]
return self.repo_hash

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you hash the directory contents instead of the path name? Something like a digest over file paths + sizes + mtimes

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll just remove this change for now, originally it was to try to get a more stable repo hash for the artifacts/archive subcommands

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the main reason I wanted to avoid hashing the contents was that if the source directory was changed it would be hard to find artifacts from previous runs, but I can update it.

Comment thread oss_crs/src/crs_compose.py
Comment thread oss_crs/src/templates/renderer.py Outdated
Comment thread oss_crs/src/templates/renderer.py Outdated
@br32710
br32710 force-pushed the auditing branch 3 times, most recently from fee07f0 to b36ad31 Compare August 14, 2026 19:06
@azchin

azchin commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

Looks good! LMK if there's anything else you want to add, otherwise I'll go ahead and merge

@br32710

br32710 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Reviewing again, the other thing was whether the sanitizers/architecture in crs.yaml should still be required for auditing CRSs, but removing the check might not be worth it

@br32710

br32710 commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Recent changes: updated docs, made sanitizer/architecture optional with default being to support all sanitizers/architectures to match fuzzing engine default, did not include sanitizer, fuzzing_language, and architecture environment variables for source-only runs, added target key for source-only runs based on a hash of the source path to support non-git repositories.

@br32710
br32710 force-pushed the auditing branch 2 times, most recently from ada068c to 7a980be Compare August 17, 2026 20:20
… without fuzzing harness

Signed-off-by: Brandon Luo <br32710@ll.mit.edu>

@azchin azchin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documentation and nitpicks

Comment thread docs/config/target-project.md Outdated
Comment thread docs/config/target-project.md Outdated
Comment thread oss_crs/src/env_policy.py Outdated
…only mode

Signed-off-by: Brandon Luo <br32710@ll.mit.edu>
@br32710

br32710 commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Updated documentation and removed unneeded environment variables

@azchin
azchin merged commit 6450ad2 into ossf:main Aug 21, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants