Skip to content

Add OSS-Fuzz integration for 10 Go libraries: badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh, testify, pgx, viper, semver#15627

Closed
canolgun wants to merge 4 commits into
google:masterfrom
canolgun:master
Closed

Add OSS-Fuzz integration for 10 Go libraries: badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh, testify, pgx, viper, semver#15627
canolgun wants to merge 4 commits into
google:masterfrom
canolgun:master

Conversation

@canolgun

@canolgun canolgun commented Jun 7, 2026

Copy link
Copy Markdown

Adds OSS-Fuzz integration for 9 widely-used Go libraries:

# Project Stars Focus
1 dgraph-io/badger 14K+ KV store, key-value ops, crash recovery
2 gorilla/websocket 22K+ WebSocket parsing, message handling, compression
3 golang-jwt/jwt 7K+ JWT parsing, signature verification, claim validation
4 open-policy-agent/opa 9K+ Policy evaluation, Rego parsing, AST manipulation
5 go-acme/lego 6K+ ACME protocol, DNS challenge, TLS-ALPN
6 golang.org/x/crypto/ssh stdlib-ext SSH parsing, key exchange, ciphers
7 stretchr/testify 22K+ Assertion logic, mock handling, suite infrastructure
8 jackc/pgx 9K+ PostgreSQL wire protocol, binary encoding
9 spf13/viper 25K+ Configuration parsing, env binding, format handling

Each project: 4 fuzz targets + Dockerfile + build.sh + project.yaml.
Sanitizers: address, memory. Engine: libfuzzer (Go native fuzz).
All fuzz targets verified with go test -fuzz=. -fuzztime=30s.

@google-cla

google-cla Bot commented Jun 7, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions

github-actions Bot commented Jun 7, 2026

Copy link
Copy Markdown

canolgun-commits is integrating a new project, but the main_repo is missing. The criticality score cannot be computed.
canolgun-commits is integrating a new project, but the main_repo is missing. The criticality score cannot be computed.
canolgun-commits is integrating a new project, but the main_repo is missing. The criticality score cannot be computed.

@canolgun

Copy link
Copy Markdown
Author

@googlebot I signed it!

@canolgun canolgun changed the title Add OSS-Fuzz support for badger, gorilla/websocket, golang-jwt/jwt Add OSS-Fuzz integration for 9 Go libraries: badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh, testify, pgx, viper Jun 11, 2026
@canolgun

Copy link
Copy Markdown
Author

I have signed the Google CLA (canolgun@gmail.com). The CLA check at https://cla.developers.google.com/ shows signed. Please re-trigger the check.

@canolgun

Copy link
Copy Markdown
Author

CLA should now be linked to GitHub username canolgun-commits. @googlebot please recheck.

@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh,
testify, pgx, viper — 4 fuzz targets each with Dockerfile,
build.sh, fuzz_test.go, and project.yaml.

Sanitizers: address, memory
Engine: libfuzzer (Go native fuzz)
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
@canolgun canolgun changed the title Add OSS-Fuzz integration for 9 Go libraries: badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh, testify, pgx, viper Add OSS-Fuzz integration for 10 Go libraries: badger, gorilla/websocket, golang-jwt, opa, lego, crypto/ssh, testify, pgx, viper, semver Jun 11, 2026
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026

@DavidKorczynski DavidKorczynski left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please coordinate with the maintainers of these projects for approval and land the fuzzing harnesses in the upstream repositories. Each project should have its own PR with a clarification for why the given project is critical.

@canolgun

Copy link
Copy Markdown
Author

Split into 10 individual PRs (#15661-#15670) per maintainer request. Each includes criticality justification.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants