Vendor OpenSSL for the fuzz build to survive apt mirror outages - #362
Draft
Saurabh Singh (saurabh500) wants to merge 1 commit into
Draft
Vendor OpenSSL for the fuzz build to survive apt mirror outages#362Saurabh Singh (saurabh500) wants to merge 1 commit into
Saurabh Singh (saurabh500) wants to merge 1 commit into
Conversation
The scheduled fuzz pipeline builds fuzz targets that link system OpenSSL via mssql-tds (native-tls plus the direct openssl dependency). When the Ubuntu apt mirror is transiently unreachable, libssl-dev and pkg-config can't be installed and openssl-sys fails to build, failing the fuzz runs with no crash (FuzzCrashesFound=false). Build OpenSSL from vendored source for the fuzz crate only so the harness compiles without system libssl-dev/pkg-config; the shipped library build is unchanged. AB#47487 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The scheduled GH-Rust Fuzz Test pipeline (ADO definitionId 2207) had failing runs on 2026-08-19 (builds 167989, 168079, 168173) that were not fuzz crashes. They failed because the Linux dependency install (
scripts/install-deps.sh) could not reach the Ubuntu apt mirror (azure.archive.ubuntu.com, connection timed out) across all 5 retries, sopkg-configandlibssl-devwere never installed.mssql-tdslinks system OpenSSL on Linux (vianative-tlsand a directopenssldependency), soopenssl-sys 0.9.117failed to build and the fuzz target binaries never compiled.Evidence from build 167989 (
Run Fuzzerstep):FuzzCrashesFoundwasfalseon every run and "Prepare Crash Artifacts" was skipped, so no crash artifact was produced — libFuzzer never ran because the harness didn't compile.Change
Build OpenSSL from vendored source for the fuzz crate only, by adding
openssl = { version = "0.10.66", features = ["vendored"] }scoped to non-Windows/non-macOS targets inmssql-tds/fuzz/Cargo.toml. This makesopenssl-sys(shared by bothnative-tlsand the directopenssldependency) compile from source, so the fuzz build no longer needslibssl-dev/pkg-configfrom apt. Only a C compiler and perl are required, both already present on the CI image.Scoped to the fuzz crate (
publish = false); the shippedmssql-tdslibrary build is unchanged.Testing
cargo metadatainmssql-tds/fuzzconfirms the manifest resolves and the vendoredopenssldependency is correctly scoped to Linux/other non-macOS Unix targets.cargo fuzzcompilation is Linux/nightly-only and will be validated by the pipeline.Related work item
Fixes AB#47487