fuzz/Cargo.toml
# holger-fuzz — libFuzzer targets for Holger's untrusted parsers (lane OSSF-NEXT, 2026-10-30).
#
# The cargo-fuzz layout: `cargo fuzz run <target>` works where cargo-fuzz is installed, and
# plain stable cargo builds the same targets (fuzz/README.md has the flags). The dwarves
# forge runs every [[bin]] below nightly, seeded from corpus/<target>/, and files a crash
# as a red run. Its own workspace and lock, so the fuzz instrumentation never reaches
# Holger's graphs; a lone clone builds it from crates.io plus the path crates below.
[package]
name = "holger-fuzz"
version = "0.0.0"
edition = "2021"
license = "AGPL-3.0-only"
publish = false
[package.metadata]
cargo-fuzz = true
[workspace]
members = ["."]
[lib]
path = "src/lib.rs"
[dependencies]
libfuzzer-sys = "0.4"
holger-update-bundle = { path = "../update-bundle" }
holger-provenance = { path = "../provenance" }
holger-inspect = { path = "../server/inspect" }
holger-znippy-deb-repository = { path = "../server/repository/znippy-deb", features = ["fixtures"] }
holger-znippy-rpm-repository = { path = "../server/repository/znippy-rpm", features = ["fixtures"] }
holger-znippy-helm-repository = { path = "../server/repository/znippy-helm" }
# The wheel METADATA reader and the licence detector (pip, npm, cargo, maven …) live in
# server-lib's scanners; no default features, so no server, network or auth stack.
holger-server-lib = { path = "../server/lib", default-features = false, features = ["scanners"] }
# Seeds: the synthetic packages the tests write into corpus/.
tar = "0.4"
flate2 = "1"
zip = { version = "9", default-features = false, features = ["deflate"] }
serde_json = "1"
base64 = "0.22"
[[bin]]
name = "bundle_verify"
path = "fuzz_targets/bundle_verify.rs"
test = false
doc = false
bench = false
[[bin]]
name = "dsse_material"
path = "fuzz_targets/dsse_material.rs"
test = false
doc = false
bench = false
[[bin]]
name = "intoto_statement"
path = "fuzz_targets/intoto_statement.rs"
test = false
doc = false
bench = false
[[bin]]
name = "x509_cert"
path = "fuzz_targets/x509_cert.rs"
test = false
doc = false
bench = false
[[bin]]
name = "apk_index"
path = "fuzz_targets/apk_index.rs"
test = false
doc = false
bench = false
[[bin]]
name = "package_metadata"
path = "fuzz_targets/package_metadata.rs"
test = false
doc = false
bench = false