Migrate OSS-Fuzz feed functionality to independent infra
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
There are a number of issues with the current infrastructure around reliability and maintainability.
1. [Reliability] The current communication protocol occasionally has issues. Messages get dropped (or never sent) from OSS-Fuzz, leading to inconsistent states in OSS-Fuzz-Vulns (such as missing fixes). This is because messages are only ever sent once per OSS-Fuzz crash with no ability to retry.
2. [Reliability] The current infrastructure does not account for all cases where issues in OSS-Fuzz that started off being legitimate then gets marked as WontFix (https://github.com/google/osv.dev/issues/966).
3. [Maintainability] Domain-specific OSS-Fuzz behaviour is tied to OSV infrastructure, and nobody is familiar with it apart from @oliverchang . This also increases our maintenance burden as OSV has a dependency on gVisor and the ability to build OSS-Fuzz projects. Removing this will additionally simplify other parts of OSV (such as the need to support private Bug entities).
This will be addressed in 2 stages:
1. Move triggering of OSS-Fuzz bisections into an independent cron job as part of OSS-Fuzz-Vulns infrastructure. This will address reliability issues, as this will be a continuously running cron job that will check both issue state and what’s already analyzed in OSV.
2. (Some time in 2025. Details TBD). Move OSS-Fuzz specific worker functionality into independent infrastructure in OSS-Fuzz-Vulns.
Contributor guide
Assessment
This issue has not been assessed yet.