Over on the Google Security blog, Jonathan Metzman announced the release of ClusterFuzzLite, which is “a continuous fuzzing solution that runs as part of CI/CD workflows to find vulnerabilities faster than ever before“. ClusterFuzzLite is a descendant of OSS-Fuzz, which we looked at in 2017.
Large projects including systemd and curl are already using ClusterFuzzLite during code review, with positive results. According to Daniel Stenberg, author of curl, “When the human reviewers nod and have approved the code and your static code analyzers and linters can’t detect any more issues, fuzzing is what takes you to the next level of code maturity and robustness. OSS-Fuzz and ClusterFuzzLite help us maintain curl as a quality project, around the clock, every day and every commit.”
[…] To learn more, check out the ClusterFuzzLite documentation. ClusterFuzzLite currently supports GitHub Actions, Google Cloud Build and Prow. We built this with CI system extensibility in mind, and adding support for other CI systems is straightforward. Please contact us if you’re interested in contributing support, or have any questions, feedback or feature requests.