Skip to content

Migrate OSS-Fuzz feed functionality to independent infra #2892

Open

Description

@oliverchang

There are a number of issues with the current infrastructure around reliability and maintainability.

  1. [Reliability] The current communication protocol occasionally has issues. Messages get dropped (or never sent) from OSS-Fuzz, leading to inconsistent states in OSS-Fuzz-Vulns (such as missing fixes). This is because messages are only ever sent once per OSS-Fuzz crash with no ability to retry.
  2. [Reliability] The current infrastructure does not account for all cases where issues in OSS-Fuzz that started off being legitimate then gets marked as WontFix (Propagate WontFixed OSS-Fuzz vulns into withdrawn entries on oss-fuzz-vulns.  #966).
  3. [Maintainability] Domain-specific OSS-Fuzz behaviour is tied to OSV infrastructure, and nobody is familiar with it apart from @oliverchang . This also increases our maintenance burden as OSV has a dependency on gVisor and the ability to build OSS-Fuzz projects. Removing this will additionally simplify other parts of OSV (such as the need to support private Bug entities).

This will be addressed in 2 stages:

  1. Move triggering of OSS-Fuzz bisections into an independent cron job as part of OSS-Fuzz-Vulns infrastructure. This will address reliability issues, as this will be a continuously running cron job that will check both issue state and what’s already analyzed in OSV.
  2. (Some time in 2025. Details TBD). Move OSS-Fuzz specific worker functionality into independent infrastructure in OSS-Fuzz-Vulns.

Activity

  1. self-assigned this
    on Nov 25, 2024
  2. oliverchang commented on Nov 27, 2024

    @oliverchang
    CollaboratorAuthor
  3. github-actions commented on Oct 11, 2026

    @github-actions

    This issue has not had any activity for 60 days and will be automatically closed in two weeks

    See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.

  4. added
    staleThe issue or PR is stale and pending automated closure
    on Oct 11, 2026
  5. added
    backlogImportant but currently unprioritized
    and removed
    staleThe issue or PR is stale and pending automated closure
    on Oct 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    backlogImportant but currently unprioritizedcleanupCode hygiene and cleanupenhancementNew feature or requestinfrainfrastructure bugs/FRsoss-fuzz

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions