chore(rec-13/14): remove dead .github/oss-fuzz/ wrapper#84
Merged
Conversation
google/oss-fuzz#15545 was rejected 2026-05-26 (see [Unreleased] in CHANGELOG.md, prior commit). The `.github/oss-fuzz/` tree was 100% Google-infrastructure scaffolding with zero value outside the submission: - `Dockerfile` built against `gcr.io/oss-fuzz-base/base-builder` - `build.sh` consumed `$SRC` / `$LIB_FUZZING_ENGINE` / `$OUT` (OSS-Fuzz's env-var contract); the script even still carried the "Copyright 2026 Google LLC" header that dpebot's `header-check` required - `project.yaml` was the OSS-Fuzz project manifest format (`primary_contact`, `auto_ccs`, `sanitizers`, `fuzzing_engines`) - `README.md` documented the staging workflow for the submission Local fuzzing is unaffected. The actual harnesses (`fuzz_xml.cc`, `fuzz_marshal.cc`) and their build recipe (`Makefile.fuzz`) live at `Ghidra/Features/Decompiler/src/decompile/cpp/fuzz/` and are standalone — `Makefile.fuzz`'s header explicitly says it's for local reproduction and that OSS-Fuzz substituted its own engine. Cross-references updated to avoid dangling links after deletion: - `README.md` Rec 13 row drops the `[oss-fuzz project](.github/oss-fuzz/)` link and adds a parenthetical noting the submission was rejected - `Ghidra/.../fuzz/README.md` drops the "Build (OSS-Fuzz)" section, the OSS-Fuzz step in the "Adding a new harness" checklist, and the Seeds-section claim about `build.sh` packaging seed corpora automatically (no longer true) - `CHANGELOG.md` `[Unreleased]` Rec 13/14 section gets a new "Wrapper rip-out" bullet recording the file removals and the cross-reference cleanup NOT touched in this PR (deliberate scope limit, follow-up): - `docs/security/OSS_FUZZ.md` — the integration-plan doc retains its "submit to OSS-Fuzz" framing and a needs-rewrite header - `docs/security/LOADER_FUZZING.md` — same, parallel to Rec 14 - Wiring `fuzz_xml` / `fuzz_marshal` into `.github/workflows/decompiler-sanitizers.yml` for continuous-fuzzing in our own CI — its own CI-design question - Older `SprintPlanning.md` Sprint 4/5/6 "Open" rows that still list "submit `.github/oss-fuzz/` to google/oss-fuzz" — those are pre-existing unreconciled historical sprint plans Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2 tasks
CryptoJones
added a commit
that referenced
this pull request
May 27, 2026
Three pre-existing unreconciled "submit .github/oss-fuzz/ to google/oss-fuzz" rows still listed as open in SprintPlanning.md's Sprint 4, Sprint 5, and Sprint 6 sections. Strike them through with a one-line note pointing back to Sprint 10's canonical rejection row (which carries DavidKorczynski's full quote). Companion to PRs #83 (rejection-recording) and #84 (wrapper rip-out); brings SprintPlanning.md fully consistent so the document reads honestly end-to-end. No code paths affected. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
CryptoJones
added a commit
that referenced
this pull request
May 27, 2026
…state (#86) Self-audit caught: when PR #84 deleted the .github/oss-fuzz/ wrapper, the CHANGELOG bullet was updated to say only the harnesses survived, but SprintPlanning.md's Sprint 10 canonical row was left with the pre-rip-out wording — Re-scoped: the in-tree `.github/oss-fuzz/` files + the `fuzz_xml` / `fuzz_marshal` harnesses stay as our own continuous-fuzzing infrastructure … PRs #85's Sprint 4/5/6 strike-outs all said "see Sprint 10 canonical row" — so the inconsistency propagated by reference. Rewrite the Sprint 10 row to match the post-PR-#84 reality: - Only the harnesses (at Ghidra/Features/Decompiler/src/decompile/cpp/fuzz/) stay; they run locally via Makefile.fuzz. - The .github/oss-fuzz/ wrapper directory is explicitly noted as deleted in PR #84. CHANGELOG `[Unreleased]` gets a "Self-audit fix-up" bullet recording that this PR corrects the previously-shipped inconsistency, so the audit trail is honest about the slip. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CryptoJones
added a commit
that referenced
this pull request
May 27, 2026
Sprint 10 is code-closed — only Aaron-UI-action items (Automatic Dependency Submission workflow, immutable-releases toggle) and the deferred Stage 3 step 6 `-Werror` + ErrorProne ratchet (its own sprint) remain. Cut v26.1.11 to ship the [Unreleased] backlog accumulated since v26.1.10: - Rec 31 RAII Stage 2A complete (#46 marshal.cc buffer ownership) - Rec 31 RAII Stage 2B complete (#51, #73 xml.cc lvalue + global_scan lifetime) - Rec 31 RAII Stage 2C complete (#77 stack-local, #78 Element parse-tree, #82 Document return-value, #87 audit-gate) - Rec 31 RAII Stage 3 first migrations (#89 cover.cc gate, #90 comment.cc migration + gate) - Rec 28 closeout — `ignoreAudit` Stage 2 strict-by-default (#43) - Rec 13/14 OSS-Fuzz upstream submission attempted + rejected; wrapper deleted, harnesses retained for in-tree fuzzing (google/oss-fuzz#15545, #48, #49, #84) - Rec 20 RMI VMARG removed from launch.properties (#81) - release.yml Windows zip glob fix (#88) — `_windows_*` → `_win_*` so `getCurrentPlatformName()`'s `win_x86_64` token matches. Unblocks the matrix's `publish_release` job that's been silently skipped since v26.1.6. **v26.1.11 is the first release expected to actually appear on the public Releases page.** v26.1.6/8/9/10 are backlogged in drafts under "Immutable Releases" tag lockout; not recoverable under their original tags. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #83. Now that google/oss-fuzz#15545 is closed (soft policy reject — "we prefer projects with large user bases"), the
.github/oss-fuzz/tree is dead scaffolding with no purpose outside the rejected submission.What this removes
The four wrapper files were 100% Google-infrastructure-specific:
Dockerfilebuilt againstgcr.io/oss-fuzz-base/base-builderbuild.shconsumed$SRC/$LIB_FUZZING_ENGINE/$OUTand still carried "Copyright 2026 Google LLC" per dpebot'sheader-checkproject.yamlwas the OSS-Fuzz manifest format (primary_contact,auto_ccs,sanitizers,fuzzing_engines)README.mddocumented the submission staging workflowWhat stays
Local fuzzing is unaffected. The actual harnesses (
fuzz_xml.cc,fuzz_marshal.cc) and their build recipe live atGhidra/Features/Decompiler/src/decompile/cpp/fuzz/and are standalone —Makefile.fuzz's header already states "this Makefile is for local reproduction; OSS-Fuzz substitutes its own engine."Dangling-reference cleanup
README.mdRec 13 row — drop[oss-fuzz project](.github/oss-fuzz/)link; add parenthetical noting the submission rejectionGhidra/.../fuzz/README.md— drop the "Build (OSS-Fuzz)" section, the OSS-Fuzz step in "Adding a new harness," and the seeds-section claim aboutbuild.shpackaging seed corporaCHANGELOG.md[Unreleased]Rec 13/14 — append a "Wrapper rip-out" bulletOut of scope (separate follow-ups)
docs/security/OSS_FUZZ.mdanddocs/security/LOADER_FUZZING.md— both still carry the "submit to OSS-Fuzz" framing and need a separate doc-touch-up PRfuzz_xml/fuzz_marshalinto.github/workflows/decompiler-sanitizers.ymlfor continuous fuzzing — its own CI-design questionSprintPlanning.mdSprint 4/5/6 "Open" rows that still mention OSS-Fuzz submission — pre-existing unreconciled sprint plansTest plan
grep -rn "\\.github/oss-fuzz" --include="*.yml" --include="*.yaml" --include="*.sh" --include="*.gradle" --include="Makefile*"finds zero hits in build / CI / scripts — no build path depended on this directoryMakefile.fuzz(no change to that recipe)-145 / +10lines, all docs/wrapper onlyProudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/