holger-fuzz
libFuzzer targets for Holger's untrusted parsers, in the cargo-fuzz layout (lane OSSF-NEXT, 2026-10-30). The table of targets and what each reads is in src/lib.rs.
| target | parser |
bundle_verify |
update bundle: znippy index + members, core.json, the pinned-signer verify path |
dsse_material |
DSSE / Sigstore bundle / PEP 740 / cosign / npm material, then verify_artifact |
intoto_statement |
in-toto statement + SLSA predicate |
x509_cert |
DER, certificate identity, SCTs |
apk_index |
APKINDEX.tar.gz and its signature segment |
package_metadata |
first byte picks: deb control, rpm header, Helm chart, Chart.yaml, wheel METADATA, declared licence, the inspector over every format |
Run
With cargo-fuzz (nightly): cargo fuzz run <target>.
With plain stable cargo (what the dwarves forge does nightly):
RUSTFLAGS="--cfg fuzzing -Cpasses=sancov-module -Cllvm-args=-sanitizer-coverage-level=4 \
-Cllvm-args=-sanitizer-coverage-inline-8bit-counters -Cllvm-args=-sanitizer-coverage-pc-table \
-Cllvm-args=-sanitizer-coverage-trace-compares" \
cargo build --release --manifest-path fuzz/Cargo.toml --bins --target-dir <dir>
<dir>/release/<target> -max_total_time=600 -artifact_prefix=<out>/ <scratch-corpus> fuzz/corpus/<target>A crash is a bug: add its input as a regression test in the crate that owns the parser, fix it, and keep the input in corpus/<target>/.
Seeds
corpus/<target>/ holds the seeds src/seeds.rs makes (synthetic packages and the provenance crate's real public material). cargo test --manifest-path fuzz/Cargo.toml runs every seed through its target on stable and fails when a seed is not committed; HOLGER_FUZZ_WRITE_SEEDS=1 writes them. A package_metadata seed begins with its selector byte, so no seed begins with a package's magic number.