google / google/osv.dev

Migrate OSS-Fuzz feed functionality to independent infra

Open
#2,892 1 comment 0 reactions 0 assignees View on GitHub
cleanup enhancement infra oss-fuzz
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

There are a number of issues with the current infrastructure around reliability and maintainability.

1. [Reliability] The current communication protocol occasionally has issues. Messages get dropped (or never sent) from OSS-Fuzz, leading to inconsistent states in OSS-Fuzz-Vulns (such as missing fixes). This is because messages are only ever sent once per OSS-Fuzz crash with no ability to retry.
2. [Reliability] The current infrastructure does not account for all cases where issues in OSS-Fuzz that started off being legitimate then gets marked as WontFix (https://github.com/google/osv.dev/issues/966).
3. [Maintainability] Domain-specific OSS-Fuzz behaviour is tied to OSV infrastructure, and nobody is familiar with it apart from @oliverchang . This also increases our maintenance burden as OSV has a dependency on gVisor and the ability to build OSS-Fuzz projects. Removing this will additionally simplify other parts of OSV (such as the need to support private Bug entities).

This will be addressed in 2 stages:

1. Move triggering of OSS-Fuzz bisections into an independent cron job as part of OSS-Fuzz-Vulns infrastructure. This will address reliability issues, as this will be a continuously running cron job that will check both issue state and what’s already analyzed in OSV.
2. (Some time in 2025. Details TBD). Move OSS-Fuzz specific worker functionality into independent infrastructure in OSS-Fuzz-Vulns.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.