Add Absolution-based stateful fuzzing framework

.clusterfuzzlite/Dockerfile

@@ -1,14 +1,12 @@
-# Base image with clang toolchain
+# SDK ClusterFuzzLite Dockerfile. Builds the Absolution-driven SDK self-fuzz
+# targets defined under fuzzing/sdk-fuzz/ (see .clusterfuzzlite/build.sh).
 FROM gcr.io/oss-fuzz-base/base-builder:v1
 
 RUN pip3 install --break-system-packages --no-cache-dir pillow>=3.4.0
 RUN apt update && apt install -y ninja-build zip
 
-# Copy the project's source code.
 COPY . $SRC/ledger-secure-sdk
 
-# Working directory for build.sh
 WORKDIR $SRC/ledger-secure-sdk
 
-# Copy build.sh into $SRC dir.
 COPY ./.clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -1,22 +1,25 @@
 #!/bin/bash -e
 
-pushd fuzzing
-cmake -S . -B build -DCMAKE_C_COMPILER=clang -DCMAKE_BUILD_TYPE=Debug \
-            -G Ninja -DCMAKE_EXPORT_COMPILE_COMMANDS=On \
-            -DBOLOS_SDK=/src/ledger-secure-sdk/ -DTARGET=flex \
-            -DAPP_BUILD_PATH=/src/ledger-secure-sdk/
-# Generates .zip for initial corpus in clusterFuzz
-for dir in harness/*; do
-    if [ -d "$dir" ]; then
-        fuzzer_name=$(basename "$dir")
-        zip_name="${fuzzer_name}_seed_corpus.zip"
-        echo "Zipping corpus from $dir into $zip_name"
+# SDK self-fuzz targets under fuzzing/sdk-fuzz/ are Absolution-driven: absolution_add_fuzzer() regenerates each harness from the model, using the same app contract as real apps.
 
-        (cd "$dir" && zip -q -r "$zip_name" .)
+SDK_DIR="${SRC:-/src}/ledger-secure-sdk"
 
-        mv "$dir/$zip_name" "$OUT/"
-    fi
+pushd "${SDK_DIR}/fuzzing/sdk-fuzz"
+
+cmake -S . -B build-absolution \
+      -DCMAKE_C_COMPILER=clang \
+      -DCMAKE_BUILD_TYPE=Debug \
+      -G Ninja \
+      -DCMAKE_EXPORT_COMPILE_COMMANDS=On \
+      -DBOLOS_SDK="${SDK_DIR}" \
+      -DTARGET=flex \
+      -DAPP_BUILD_PATH="${SDK_DIR}"
+
+cmake --build build-absolution
+
+for fuzzer in ./build-absolution/fuzz_*; do
+    [[ -f "${fuzzer}" && -x "${fuzzer}" ]] || continue
+    cp "${fuzzer}" "${OUT}/"
 done
-cmake --build build
-mv ./build/fuzz_* "${OUT}"
+
 popd

.github/workflows/clusterfuzzlite.yml

@@ -0,0 +1,18 @@
+name: ClusterFuzzLite fuzzing tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: '0 13 * * 6'  # 13:00 UTC every Saturday
+
+permissions: read-all
+
+jobs:
+  Fuzzing:
+    uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_clusterfuzz_tests.yml@v1
+    with:
+      exec_mode: ${{ github.event_name }}

.gitignore

@@ -20,4 +20,13 @@ unit-tests/lib_*/build/
 build
 fuzzing/build/
 fuzzing/out/
-fuzzing/mock/generated/
+fuzzing/mock/_generated/
+# SDK self-fuzz generated artifacts
+fuzzing/sdk-fuzz/invariants/*.zon
+fuzzing/sdk-fuzz/mock/scenario_layout.h
+.fuzz-artifacts/
+*.profraw
+*.profdata
+
+# LSP
+compile_commands.json