Skip to content

Commit 9a77bad

Browse files
AdamKorczAdamKorcz
committed
add oss-fuzz build script, seeds and dictionaries
Signed-off-by: Adam Korczynski <[email protected]>
1 parent 8a4f390 commit 9a77bad

File tree

5 files changed

+130
-0
lines changed

5 files changed

+130
-0
lines changed

‎test/fuzz/dictionaries/FuzzEvaluatePolicyAgainstJSON.dict

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
"{\"authorityMatches\":{\"keyatt\":{\"signatures\":null,\"attestations\":{\"vuln-key\":[{\"subject\":\"PLACEHOLDER\",\"issuer\":\"PLACEHOLDER\"}]}},\"keysignature\":{\"signatures\":[{\"subject\":\"PLACEHOLDER\",\"issuer\":\"PLACEHOLDER\"}],\"attestations\":null},\"keylessatt\":{\"signatures\":null,\"attestations\":{\"custom-keyless\":[{\"subject\":\"PLACEHOLDER\",\"issuer\":\"PLACEHOLDER\"}]}}}}"
2+
# Below is from https://github.com/rc0r/afl-fuzz/blob/master/dictionaries/json.dict
3+
"0"
4+
",0"
5+
":0"
6+
"0:"
7+
"-1.2e+3"
8+
9+
"true"
10+
"false"
11+
"null"
12+
13+
"\"\""
14+
",\"\""
15+
":\"\""
16+
"\"\":"
17+
18+
"{}"
19+
",{}"
20+
":{}"
21+
"{\"\":0}"
22+
"{{}}"
23+
24+
"[]"
25+
",[]"
26+
":[]"
27+
"[0]"
28+
"[[]]"
29+
30+
"''"
31+
"\\"
32+
"\\b"
33+
"\\f"
34+
"\\n"
35+
"\\r"
36+
"\\t"
37+
"\\u0000"
38+
"\\x00"
39+
"\\0"
40+
"\\uD800\\uDC00"
41+
"\\uDBFF\\uDFFF"
42+
43+
"\"\":0"
44+
"//"
45+
"/**/"

‎test/fuzz/dictionaries/FuzzImportKeyPairLoadPrivateKey.dict

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
"-----BEGIN RSA PRIVATE KEY-----"
2+
"-----END RSA PRIVATE KEY-----"
3+
"-----BEGIN PRIVATE KEY-----"
4+
"-----END PRIVATE KEY-----"
5+
"-----BEGIN PUBLIC KEY-----"
6+
"-----END PUBLIC KEY-----"
7+
"-----BEGIN PGP PRIVATE KEY BLOCK-----"
8+
"Version: BCPG C# v1.6.1.0"
9+
"-----END PGP PRIVATE KEY BLOCK-----"
10+
"-----BEGIN EC PRIVATE KEY-----"
11+
"-----END EC PRIVATE KEY-----"
12+
"-----BEGIN ENCRYPTED COSIGN PRIVATE KEY-----"
13+
"-----END ENCRYPTED COSIGN PRIVATE KEY-----"
14+

‎test/fuzz/oss_fuzz_build.sh

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2024 The Sigstore Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
go get github.com/AdamKorcz/go-118-fuzz-build/testing
18+
19+
mv ./pkg/cosign/keys_test.go ./pkg/cosign/keys_test_keep_in_fuzz_scope.go
20+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/cosign/attestation FuzzGenerateStatement FuzzGenerateStatement
21+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/cosign/cue FuzzValidateJSON FuzzValidateJSON_cue
22+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/cosign/rego FuzzValidateJSON FuzzValidateJSON_rego
23+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/cosign FuzzImportKeyPairLoadPrivateKey FuzzImportKeyPairLoadPrivateKey
24+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/cosign FuzzSigVerify FuzzSigVerify
25+
compile_native_go_fuzzer github.com/sigstore/cosign/v2/pkg/policy FuzzEvaluatePolicyAgainstJSON FuzzEvaluatePolicyAgainstJSON
26+
27+
zip -j $OUT/FuzzEvaluatePolicyAgainstJSON_seed_corpus.zip test/fuzz/seeds/FuzzEvaluatePolicyAgainstJSON_seed*
28+
zip -j $OUT/FuzzEvaluatePolicyAgainstJSON_seed_corpus.zip $SRC/go-fuzz-corpus/json/corpus/*
29+
zip -j $OUT/FuzzValidateJSON_cue_seed_corpus.zip $SRC/go-fuzz-corpus/json/corpus/*
30+
zip -j $OUT/FuzzValidateJSON_rego_seed_corpus.zip $SRC/go-fuzz-corpus/json/corpus/*
31+
zip -j $OUT/FuzzGenerateStatement_seed_corpus.zip $SRC/go-fuzz-corpus/json/corpus/*
32+
cp $SRC/afl-fuzz/dictionaries/json.dict $OUT/FuzzValidateJSON_cue.dict
33+
cp $SRC/afl-fuzz/dictionaries/json.dict $OUT/FuzzValidateJSON_rego.dict
34+
cp $SRC/afl-fuzz/dictionaries/json.dict $OUT/FuzzGenerateStatement.dict
35+
cp test/fuzz/dictionaries/FuzzImportKeyPairLoadPrivateKey.dict $OUT/

‎test/fuzz/seeds/FuzzEvaluatePolicyAgainstJSON_seed1

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package sigstore
2+
isCompliant[response] {
3+
attestationsKeylessATT := input.authorityMatches.keylessatt.attestations
4+
result = (count(attestationsKeylessATT) == 1)
5+
attestationsKeyATT := input.authorityMatches.keyatt.attestations
6+
result = (count(attestationsKeyATT) == 1)
7+
keySignature := input.authorityMatches.keysignature.signatures
8+
result = (count(keySignature) == 1)
9+
10+
errorMsg = ""
11+
warnMsg = "Throw warning error even if succeeded"
12+
13+
response := {
14+
"result" : result,
15+
"error" : errorMsg,
16+
"warning" : warnMsg
17+
}
18+
}

‎test/fuzz/seeds/FuzzEvaluatePolicyAgainstJSON_seed2

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package sigstore
2+
import "struct"
3+
import "list"
4+
authorityMatches: {
5+
keyatt: {
6+
attestations: struct.MaxFields(1) & struct.MinFields(1)
7+
},
8+
keysignature: {
9+
signatures: list.MaxItems(1) & list.MinItems(1)
10+
},
11+
if( len(authorityMatches.keylessatt.attestations) < 2) {
12+
keylessattMinAttestations: 2
13+
keylessattMinAttestations: "Error"
14+
},
15+
keylesssignature: {
16+
signatures: list.MaxItems(1) & list.MinItems(1)
17+
}
18+
}

0 commit comments

Comments
 (0)