fix(fuzz): unbreak ClusterFuzzLite build after the 3.11 drop#75
Merged
Conversation
… image Dropping Python 3.11 (#70) set requires-python >=3.12, which broke the ClusterFuzzLite build: OSS-Fuzz's base-builder-python still ships 3.11 (3.11.13 even on :latest), so pip aborts with ERROR: Package 'aemo-mdff-reader' requires a different Python: 3.11.13 not in '>=3.12' Bumping the pinned digest can't help until upstream ships 3.12. The library code is still 3.11-runnable — #70 changed metadata/CI only, no syntax — so ignoring the metadata gate keeps the harnesses exercising the real parser rather than losing fuzz coverage on an untrusted-input file format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
#70 (drop Python 3.11) set
requires-python = ">=3.12", which broke thefuzzjob — visible on #73:OSS-Fuzz's
base-builder-pythonstill ships Python 3.11.13 — I checked:latest, not just our pinned digest — so this isn't a stale-pin problem and dependabot bumping the digest won't fix it. Until upstream ships 3.12, the metadata check will abort every fuzz build.Fix
Pass
--ignore-requires-pythonwhen installing the package in.clusterfuzzlite/build.sh. The library code is still 3.11-runnable — #70 changed metadata and CI only, no syntax — so the harnesses keep exercising the real parser. The alternative (disable fuzzing) would drop coverage on a parser that by definition consumes untrusted files, which seems the worse trade.Comment in build.sh notes to drop the flag once
base-builder-pythonships 3.12.Note
fuzzis advisory (not a required check on main), so this wasn't blocking merges — but it was silently failing on every PR.