CIFuzz (OSS-Fuzz in our CI)

[gilles-peskine-arm]

The OSS-Fuzz project runs various fuzzers (including the mbedtls fuzzer) on their own infrastructure continuously, updating the dependencies every few days. In addition, they provide CIFuzz, which allows running one OSS-Fuzz project on a specified commit. CIFuzz runs in GitHub actions.

Goals of this task:

• Set up what it takes to run CIFuzz for the mbedtls fuzzer manually on one commit.
• Document how to run the mbedtls fuzzer manually.
• Determine whether the code coverage measurement allows fuzzing to be skipped when a feature is not affected.

Follow-ups:

• Estimate how much enabling CIFuzz in pull requests would cost us in terms of GitHub action budget. If acceptable, enable CIFuzz in our pull request CI.
• Possibly, study how we could extend our CIFuzz integration to also run fuzzers that have mbedtls as a subproject (bignum-fuzzer, ecc-diff-fuzzer, cryptofuzz).