Vendor OpenSSL for the fuzz build to survive apt/pkg-config outages

[Saurabh Singh (saurabh500)]

Summary

The GH-Rust Fuzz Test pipeline (definitionId=2207, "Rust TDS Lib Fuzz Testing") intermittently fails on main. This PR makes the fuzz build independent of apt-provided OpenSSL so those runs stop going red.

Work item: AB#47459

Root cause (not a fuzz crash)

I investigated the recent failing runs (168173, 168079, 167989 — all 2026-08-19). In every case the "Run Fuzzer" step fails at build time, not at fuzz time:

error: failed to run custom build command for `openssl-sys v0.9.117`
Error: failed to build fuzz script: ... cargo build --manifest-path .../mssql-tds/fuzz/Cargo.toml ... --bin fuzz_token_stream
##[error]Bash exited with code '1'.

openssl-sys cannot locate OpenSSL because libssl-dev/pkg-config were not installed (intermittent apt/mirror outage on the CI agent). This is not a libFuzzer crash:

• No fuzz-crashes-* pipeline artifacts were produced (log shows No artifacts directory found).
• The fuzz targets that did build (e.g. fuzz_tds_client in build 168173) ran to completion with oom/timeout/crash: 0/0/0 and reported No crashes found.

So the fuzz stage is silently skipped whenever the agent can't apt install OpenSSL, and the pipeline reports a build failure.

Fix

Enable the openssl vendored feature in mssql-tds/fuzz/Cargo.toml, target-gated to the same cfg(all(not(windows), not(target_os = "macos"))) targets where mssql-tds already links OpenSSL. openssl-sys then compiles OpenSSL from source, so the fuzz build no longer depends on apt-provided libssl-dev/pkg-config.

[target.'cfg(all(not(windows), not(target_os = "macos")))'.dependencies]
openssl = { version = "0.10.66", features = ["vendored"] }

This is a shared openssl-sys (also backs native-tls), so no new crate is introduced — only the vendored build path is turned on for the fuzz crate.

Testing

• cargo metadata --manifest-path mssql-tds/fuzz/Cargo.toml --no-deps parses cleanly.
• cargo bfmt passes.
• The fuzz crate is its own workspace (excluded from the main workspace), so bclippy/btest on the workspace are unaffected; the vendored build is exercised by the Linux fuzz pipeline itself.

Notes

Draft pending a green GH-Rust Fuzz Test run on this branch. Associated ADO bug AB#47459 documents the failing runs and links build 168173 as evidence.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 92.1%

📦 Project: mssql-tds + mssql-odbc + mssql-py-core ℹ️ Note: diff coverage is reported, not enforced.

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

🔗 Quick Links

View Azure DevOps Build · Coverage Report