Etcd: Suggestion: Continuous Fuzzing

[yevgenypats]

Hi, I'm Yevgeny Founder of Fuzzit - Continuous fuzzing as a service platform.

We have a free plan for OSS and I would be happy to contribute a PR if that's interesting.
The PR will include the following

• go-fuzz fuzzers
• Continuous Fuzzing of master branch which will generate new corpus and look for new crashes
• Regression on every PR that will run the fuzzers through all the generated corpus and fixed crashes from previous step. This will prevent new or old bugs from crippling into master.

You can see our basic example here and you can see an example of "in the wild" integration here.

Let me know if this is something worth working on.

Also, we have a reward program. If you are interested in implementing the fuzzers and the integration yourself I’ll be happy to reward you as well as to get unbiased feedback on how smooth the integration was.

Cheers,
Yevgeny

[spzala]

@yevgenypats thanks for the suggestion. etcd team is busy with upcoming 3.4 release work but meanwhile other team members take a look at this issue and chime in, just curios that is there any CNCF projects using Fuzzit? It seems like some efforts are going to make fuzzing a first class citizen in golang itself. Thanks!

[yevgenypats]

@spzala sure no rush. We have prometheus under review and envoy in progress.

Regarding fuzzing as first class citizen this would be great but you still would need to run the fuzzers and save the corpus, crashes, logs, etc... This is where we make life easier.

[yevgenypats]

@spzala coredns currently use fuzzit (already merged into master and found some bugs:))

https://github.com/coredns/coredns

[spzala]

Thanks @yevgenypats !!

[yevgenypats]

Sure!

[yevgenypats]

@spzala friendly ping:) would love to know what the status on that.

[spzala]

@yevgenypats :) sure, we don't have any updates yet. As I mentioned earlier, the etcd team has been busy with upcoming major release but we are almost there. I planned to bring this topic to next team meeting for a quick discussion. Thanks! /cc @gyuho @xiang90 @jpbetz

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 21 days if no further activity occurs. Thank you for your contributions.