google / google/oss-fuzz

[RFC] Introducing Ruby Support to OSS-Fuzz via Ruzzy

Open
#11,967 5 comments 1 reaction 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

I'm creating this issue to discuss the details of adding Ruby support to OSS-Fuzz. Initially, Matt (@mschwager) spoke about it during monthly fuzzing collaboration meetings. If you missed those meetings, the goal is to incorporate Ruby support into OSS-Fuzz via [Ruzzy](https://github.com/trailofbits/ruzzy), a Ruby fuzzer developed by Trail of Bits. You can read about Ruzzy in the blog post "[Introducing Ruzzy, a coverage-guided Ruby fuzzer](https://blog.trailofbits.com/2024/03/29/introducing-ruzzy-a-coverage-guided-ruby-fuzzer/)". Please note that we already have a working implementation that we use locally. However, some aspects of it need improvement, and we would like to discuss these before putting together a PR.

I will focus on those concerns below first, as the rest will be easier to discuss once we create a PR with the complete code.

## Installing Ruby
Ruzzy requires at least version 3.0 of Ruby, meaning we cannot use its apt version (at least on Ubuntu 20.04). As it stands, we are installing [RVM](https://rvm.io/) and then Ruby within it in the base-builder (it's also required later in the base-runner, so it needs to be copied there).

Does that sound acceptable to you?

## Installing RVM
What is the best method for installing RVM? We are currently using their [get script](https://rvm.io/rvm/install), but it should be possible to add a RVM repository and then [install from apt using this new repository](https://github.com/rvm/ubuntu_rvm), if you prefer that way. Regrettably, direct use from apt is not feasible without adding [the repo](https://launchpad.net/~rael-gc/+archive/ubuntu/rvm).

Do you have any specific preferences?

## Building a project
We are seeking the most efficient method to transfer a project from the build environment to the execution environment, potentially necessitating a custom directory for building. Our working proof of concept copies an excessive amount of data, prompting us to experiment with [`gem install --install-dir`](https://stackoverflow.com/questions/16098757/specify-gem-installation-directory). If you have prior experience with this, we would appreciate your insights on its usage. Additionally, if you have suggestions on how to compile in the build location and relocate the project to the execution docker environemnt, we would like to hear them. This implementation will likely be similar to the Python + Atheris OSS-Fuzz language support, so we may draw inspiration from there.

## Overall
If you’d like to have a more concrete discussion, we currently have a functioning Proof of Concept. We can open a PR against this issue any time if you’d like to discuss these implementation details while reviewing the current implementation. We would greatly value your feedback and expertise while we work on the final implementation - we believe the remainder of our implementation is fairly straightforward. If you have any general questions or suggestions, we are more than happy to answer them.

Contributor guide

Open the contributing guide

Research direction

Start with the existing Ruby/Ruzzy proof of concept and the OSS-Fuzz base-builder and base-runner, using the Python + Atheris support as a comparison. Resolve the Ruby 3.0 and RVM installation choices and the build-to-execution environment transfer approach; done requires agreement on these design points and a concrete implementation PR.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, ruby
Domain
build-system, devops, testing-qa
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.