Fuzz Infrastructure

//! Trust-boundary fuzz target for `chio_credentials::verify_chio_passport_jwt_vc_json`.

#![no_main]

use chio_credentials::fuzz::fuzz_jwt_vc_verify;
use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    fuzz_jwt_vc_verify(data);
});

//! Trust-boundary fuzz target for `chio-core-types` `CapabilityToken` and `ChioReceipt` canonical-JSON deserialization.

#![no_main]

use chio_core_types::{capability::token::CapabilityToken, receipt::body::ChioReceipt};
use chio_fuzz::canonical_json::canonical_json_mutate;
use libfuzzer_sys::{fuzz_mutator, fuzz_target};

fuzz_target!(|data: &[u8]| {
    // Try CapabilityToken first; on success, drive the verify path.
    if let Ok(token) = serde_json::from_slice::<CapabilityToken>(data) {
        // Signature verification is fail-closed: we accept Ok(false) /
        // Err(_) as expected outcomes. The point is that the call must
        // not panic on any structurally valid CapabilityToken.
        let _ = token.verify_signature();
    }

    // Try ChioReceipt independently. Same byte stream, different typed
    // deserializer, different fail-closed surface.
    if let Ok(receipt) = serde_json::from_slice::<ChioReceipt>(data) {
        let _ = receipt.verify_signature();
    }
});

fuzz_mutator!(|data: &mut [u8], size: usize, max_size: usize, seed: u32| {
    canonical_json_mutate(data, size, max_size, seed)
});

# Reads fuzz/owners.toml to find the owning crate for the named fuzz
# target, computes sha256 of the input seed, then either:
#
#   --mode libfuzzer    Writes a libtest #[test] fn that calls the fuzz
#                       wrapper directly with the seed bytes. Output:
#                       crates/<owner>/tests/regression_<target>_<sha16>.rs.
#                       The 16-hex prefix plus target component avoids
#                       filename collisions when one owner crate hosts
#                       multiple targets or accumulates multiple promoted
#                       seeds.
#
#   --mode proptest     Writes the same regression test plus a paired
#                       proptest property when the owner crate has proptest
#                       in [dev-dependencies]. When proptest is missing,
#                       emits the plain regression test and prints a warning.
#
#   --mode adversarial  Promotes a libFuzzer crash that decodes cleanly
#                       through one of the trust-boundary surfaces into
#                       a triage-pending case under
#                       crates/core/chio-adversarial-suite/cases/<class>/<sha>.json
#                       with `expected_verdict: "DENY"` placeholder and
#                       `pending: true`. Requires --class (one of the
#                       eight attack classes) and --threat-id (a
#                       chio-threat-model.v1.json identifier). The
#                       pending flag is stripped only by a human triager.
#                       No regression .rs file is emitted; the
#                       adversarial harnesses already iterate the
#                       bundled cases.
#
# In all three modes the seed is moved into fuzz/corpus/<target>/<sha>.bin
# so future fuzz runs continue exercising it. Re-promoting a seed whose
# --input path already resolves to the canonical corpus location is a
# no-op (the script does not delete the corpus seed under itself).

jobs:
  budget-check:
    name: fuzz-budget
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
      - name: Verify 30-day fuzz budget
        env:
          GH_TOKEN: ${{ github.token }}
          GH_FUZZ_BUDGET_RATE_LIMIT_MODE: warn
          GH_FUZZ_BUDGET_CAP_MODE: warn
          GH_FUZZ_BUDGET_WORKFLOWS: cflite_pr.yml,cflite_batch.yml,fuzz.yml
        run: |
          set -euo pipefail
          # PR-time CFLite is an advisory release qualification signal. Report
          # budget exhaustion without blocking unrelated PRs while the shared
          # trailing window is already over cap.
          scripts/check-fuzz-budget.sh "${{ github.repository }}"

  changed-target-sampling:
    name: changed-target-sampling
    needs: budget-check
    runs-on: ubuntu-latest
    # The 25-target full sweep has a 50-minute fuzz budget before build time.
    timeout-minutes: 75

- name: Compute changed targets
  id: targets
  if: steps.mode.outputs.full == 'false'
  run: |
    set -euo pipefail
    base_sha="${{ github.event.pull_request.base.sha }}"
    head_sha="${{ github.event.pull_request.head.sha }}"
    merge_base="$(git merge-base "${base_sha}" "${head_sha}")"
    echo "merge-base: ${merge_base}"
    git diff --name-only "${merge_base}" "${head_sha}" > changed.txt
    mapfile -t targets < <(yq -p=toml -r '.targets | keys | .[]' \
      fuzz/target-map.toml)
    fired=()
    for tgt in "${targets[@]}"; do
      mapfile -t triggers < <(yq -p=toml -r \
        ".targets.${tgt}.triggers[]" fuzz/target-map.toml)
      for trig in "${triggers[@]}"; do
        regex="$(printf '%s' "${trig}" | sed -e 's|\.|\\.|g' \
          -e 's|\*\*|__DSTAR__|g' -e 's|\*|[^/]*|g' \
          -e 's|__DSTAR__|.*|g')"
        if grep -qE "^${regex}$" changed.txt; then
          fired+=("${tgt}")
          break
        fi
      done
    done
    # Inventory fallback: builder, workflow, and target-map edits
    # can break changed-target sampling without matching a source
    # trigger. Run the full inventory for those control-plane edits.
    if grep -qE '^(\.cargo/|\.clusterfuzzlite/|\.github/workflows/cflite_pr\.yml$|Cargo\.(toml|lock)$|fuzz/(Cargo\.toml|target-map\.toml)$|Makefile$|scripts/(ci-pr-tier|spec-drift-check|check-review-slices)\.(sh|py)$)' changed.txt; then
      echo "fuzz inventory edit detected; firing the full inventory"
      fired=("${targets[@]}")
    fi
    if ((${#fired[@]} == 0)); then
      : > fired.txt
    else
      printf '%s\n' "${fired[@]}" | sort -u > fired.txt
    fi
    fired_count="$(wc -l < fired.txt | tr -d ' ')"
    printf 'fired targets: %s\n' "${fired_count}"
    cat fired.txt
    {
      echo "count=${fired_count}"
      printf 'targets<<EOF\n%s\nEOF\n' "$(cat fired.txt)"
    } >> "${GITHUB_OUTPUT}"

- name: Run ClusterFuzzLite changed-target sampling without corpus storage
  if: steps.mode.outputs.full == 'false' && steps.targets.outputs.count != '0'
  uses: google/clusterfuzzlite/actions/run_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
  env:
    CHIO_CFLITE_TARGETS: ${{ steps.targets.outputs.targets }}
  with:
    language: rust
    fuzz-seconds: ${{ steps.mode.outputs.fuzz_seconds }}
    mode: code-change
    sanitizer: address
    github-token: ${{ secrets.GITHUB_TOKEN }}
    report-unreproducible-crashes: false

- name: Pick today's target
  id: pick
  env:
    FORCED_TARGET: ${{ inputs.target }}
  run: |
    set -euo pipefail
    mapfile -t targets < <(yq -p=toml -r '.targets | keys | .[]' \
      fuzz/target-map.toml | sort)
    if (( ${#targets[@]} == 0 )); then
      echo "fuzz/target-map.toml has no targets" >&2
      exit 1
    fi
    if [[ -n "${FORCED_TARGET}" ]]; then
      picked="${FORCED_TARGET}"
      if ! printf '%s\n' "${targets[@]}" | grep -Fxq -- "${picked}"; then
        echo "unknown forced fuzz target: ${picked}" >&2
        exit 1
      fi
    else
      day_index=$(( $(date -u +%s) / 86400 ))
      picked="${targets[$(( day_index % ${#targets[@]} ))]}"
    fi
    printf 'picked: %s (rotation cycle: %d targets)\n' \
      "${picked}" "${#targets[@]}"
    {
      echo "target=${picked}"
      echo "cycle_size=${#targets[@]}"
    } >> "${GITHUB_OUTPUT}"

# ClusterFuzzLite project config for Chio.
#
# Storage backend: backbay-labs/chio-fuzz-corpus sibling private repo (no GCS).
# The repo is created out-of-band before the first cflite_batch.yml run.
#
# NOTE: ClusterFuzzLite reads the corpus storage-repo as an input to
# the `run_fuzzers` and `build_fuzzers` GitHub Actions, NOT from
# project.yaml. The `storage-repo:` input is wired with `FUZZ_CORPUS_PAT`
# in `.github/workflows/cflite_pr.yml` and `.github/workflows/cflite_batch.yml`.
language: rust
primary_contact: "security@backbay.io"
auto_ccs:
  - "security@backbay.io"
  - "fuzzing@backbay.io"
sanitizers:
  - address
  - undefined
architectures:
  - x86_64
fuzzing_engines:
  - libfuzzer
report_to_oss_fuzz: false

fn owners_toml_covers_all_matrix_targets() {
    assert_eq!(
        sorted(owners_toml_targets()),
        sorted(workflow_fuzz_targets())
    );
}