You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Migrate OSS-Fuzz feed functionality to independent infra #2892
There are a number of issues with the current infrastructure around reliability and maintainability.
[Reliability] The current communication protocol occasionally has issues. Messages get dropped (or never sent) from OSS-Fuzz, leading to inconsistent states in OSS-Fuzz-Vulns (such as missing fixes). This is because messages are only ever sent once per OSS-Fuzz crash with no ability to retry.
[Maintainability] Domain-specific OSS-Fuzz behaviour is tied to OSV infrastructure, and nobody is familiar with it apart from @oliverchang . This also increases our maintenance burden as OSV has a dependency on gVisor and the ability to build OSS-Fuzz projects. Removing this will additionally simplify other parts of OSV (such as the need to support private Bug entities).
This will be addressed in 2 stages:
Move triggering of OSS-Fuzz bisections into an independent cron job as part of OSS-Fuzz-Vulns infrastructure. This will address reliability issues, as this will be a continuously running cron job that will check both issue state and what’s already analyzed in OSV.
(Some time in 2025. Details TBD). Move OSS-Fuzz specific worker functionality into independent infrastructure in OSS-Fuzz-Vulns.
Activity
Add standalone script for managing OSS-Fuzz -> OSV.
oliverchang commentedon Nov 27, 2024
Step 1 here: google/oss-fuzz-vulns#39
Add standalone script for managing OSS-Fuzz -> OSV.
github-actions commentedon Oct 11, 2026
This issue has not had any activity for 60 days and will be automatically closed in two weeks
See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.