Artifact b8db5ecabd77e5b9e3eba8cca12116f89545169b2e14ee3c6b82ba868684eecf:
Lands P4-F6, closing the last unfuzzed attack surface in the release scope. transport.zig and serve.zig are the only two files a remote peer can reach with bytes it fully controls, and neither had a fuzz target: the sync_parsers_adversarial target covers the layer above them, so the HTTP framing itself — the first code to touch untrusted input — was exercised only by hand-written smoke cases. These two targets hit that framing directly.
The increment: src/transport_fuzz.zig (205 L) and src/serve_fuzz.zig (303 L), registered in the fuzz_tests.zig dispatch table alongside the existing 24 and pinned by that file's registration test. serve.zig's driveHttp is promoted to pub with a comment stating why — it is the receiveHead to handleHttpRequest seam the smoke tests and the fuzz target both need, and duplicating it would have meant fuzzing a copy of the request path rather than the real one. Both sides stay in-memory, so neither target binds a port and neither can flake in CI. dst.zig picks up the two targets plus fuzz_tests.zig itself, the latter so the registration pin has a test step to run in: zig build fuzz has none.
Evidence, re-verified on the merged tree rather than on the branch, since trunk had advanced: zig fmt --check ., zig build, and zig build test each exit 0. Both new targets run clean seeded — invoking zig build fuzz with each target name and --seed 1 exits 0 for transport_frame_garbage and for serve_request_garbage — and found no crash, leak, or UB to fix, so this step carries no pinned-seed regression. The merge reported no conflicts; a repo-wide grep for conflict markers is clean, and fossil extras is empty, so both added files are tracked and nothing referenced went unadded. by dmestas on 2026-07-19 00:17:51.
C Merge\srelease-0.1:\sAdd\stransport_frame_garbage\sand\sserve_request_garbage\sseeded\sfuzz\stargets\n\nLands\sP4-F6,\sclosing\sthe\slast\sunfuzzed\sattack\ssurface\sin\sthe\srelease\sscope.\ntransport.zig\sand\sserve.zig\sare\sthe\sonly\stwo\sfiles\sa\sremote\speer\scan\sreach\nwith\sbytes\sit\sfully\scontrols,\sand\sneither\shad\sa\sfuzz\starget:\sthe\nsync_parsers_adversarial\starget\scovers\sthe\slayer\sabove\sthem,\sso\sthe\sHTTP\nframing\sitself\s—\sthe\sfirst\scode\sto\stouch\suntrusted\sinput\s—\swas\sexercised\nonly\sby\shand-written\ssmoke\scases.\sThese\stwo\stargets\shit\sthat\sframing\sdirectly.\n\nThe\sincrement:\ssrc/transport_fuzz.zig\s(205\sL)\sand\ssrc/serve_fuzz.zig\s(303\sL),\nregistered\sin\sthe\sfuzz_tests.zig\sdispatch\stable\salongside\sthe\sexisting\s24\sand\npinned\sby\sthat\sfile's\sregistration\stest.\sserve.zig's\sdriveHttp\sis\spromoted\sto\npub\swith\sa\scomment\sstating\swhy\s—\sit\sis\sthe\sreceiveHead\sto\shandleHttpRequest\nseam\sthe\ssmoke\stests\sand\sthe\sfuzz\starget\sboth\sneed,\sand\sduplicating\sit\swould\nhave\smeant\sfuzzing\sa\scopy\sof\sthe\srequest\spath\srather\sthan\sthe\sreal\sone.\sBoth\nsides\sstay\sin-memory,\sso\sneither\starget\sbinds\sa\sport\sand\sneither\scan\sflake\sin\nCI.\sdst.zig\spicks\sup\sthe\stwo\stargets\splus\sfuzz_tests.zig\sitself,\sthe\slatter\sso\nthe\sregistration\spin\shas\sa\stest\sstep\sto\srun\sin:\szig\sbuild\sfuzz\shas\snone.\n\nEvidence,\sre-verified\son\sthe\smerged\stree\srather\sthan\son\sthe\sbranch,\ssince\ntrunk\shad\sadvanced:\szig\sfmt\s--check\s.,\szig\sbuild,\sand\szig\sbuild\stest\seach\nexit\s0.\sBoth\snew\stargets\srun\sclean\sseeded\s—\sinvoking\szig\sbuild\sfuzz\swith\seach\ntarget\sname\sand\s--seed\s1\sexits\s0\sfor\stransport_frame_garbage\sand\sfor\nserve_request_garbage\s—\sand\sfound\sno\scrash,\sleak,\sor\sUB\sto\sfix,\sso\sthis\sstep\ncarries\sno\spinned-seed\sregression.\sThe\smerge\sreported\sno\sconflicts;\sa\nrepo-wide\sgrep\sfor\sconflict\smarkers\sis\sclean,\sand\sfossil\sextras\sis\sempty,\sso\nboth\sadded\sfiles\sare\stracked\sand\snothing\sreferenced\swent\sunadded.\n D 2026-07-19T00:17:51.023 F .fossil-settings/ignore-glob 3580f973d7097226f91a27c7b61ec13d9d07880d95549f9b90ce86da5d867a23 F .github/workflows/ci.yml ea07314fee7c0374c8f662fe439a220458ef767eea381dbc2bd6ff1f18d9f079 F LICENSE 702ae7ff835a2a971dae11c5cae039803bf394b77a6d8ec9f18693e449eaaf26 F README.md 62e1f936cc2ea0e33d717539bdffd6126a639843069bd6256359f2b15cb06232 F build.zig 43c12a0eaffed3817646b3021862ee1add3b8536a85b531b7cf55319c3b0e95e F build.zig.zon 0eade544d4d7fc5a620348c6f29cc9219ff8c6d6377a05e756ca89860a524781 F docs/rfcs/draft-fossil-artifact-format-00.txt a6d542a5effeb41d0ea1e916058ccdc0a5819787f167ef1ebad7814f5680e7ad F docs/rfcs/draft-fossil-delta-format-00.txt d8025d6d75322e33887c3334a4b9cc729960028b3c994ed01e5a474e4b388fd2 F docs/rfcs/draft-fossil-repo-state-00.txt fd413bcb28001a8a07009ca0c769cfe666394ba79dd4f14a6461f2b592049595 F docs/rfcs/draft-fossil-sync-protocol-00.txt aa55791464a54ef4b651df8780ba5c46e95c723c7997d09a5b727fef658f920a F scripts/mirror-export.sh cc1130129e3c320cb9c1c5a05f505e45ece23d6bb3e0228da8e7ffe97bd5612b x F src/annotate.zig 0a6b6728099e63c84681d1e5228ebb45fafb55d65df1720358247fd6e6532c63 F src/artifact.zig c630afd9fbbcfaccd7b823105b4d05db1dc85b6af03080a6d58635ed064672ca F src/artifact_fuzz.zig 8bb359ddfe790818e109a1dd7ac0c1b5cec1a8fdc556f37e73504cdb7f933e17 F src/artifact_test.zig da999476660f7e6e1f50ed9da5c30f1c83d6b358e2cfcd265c6932959c85bdd1 F src/bisect.zig 7bfc45d3e0e339017826941463cc4e9118892d2898fbcd319e6e6ca85c4d3301 F src/checkout.zig ac48e76f22c8065f70d2a827ae00ffb99887af80950a93c1a3451a9a1ad0f403 F src/ci_test.zig ca2e42f2676fb29e389cb961432f4c09fdc203aeedb72b347608525cfc03a2b1 F src/cli.zig ae2ec7787850f9969ba32c4d0453e5eb1359eefe25f1cc2b252ecd95735840f6 F src/container.zig cef1028531f2763f94248b761c8779a1884e44bb854b8c45617494e3ead40e61 F src/container_test.zig a013652b1ed181161d3ad8fc9d8f052f7c27b61e129662632ceaf8cf189445ec F src/delta.zig e8f3a6297d47549aea146222732ccf514c39688414f0a74ba396ac91066686f3 F src/delta_fuzz.zig 9e0d8dbb8c82ca0ba1a80974c076e74e4f37072b21a10812efd5539875904719 F src/delta_test.zig b18d97e117dce8fbcc05bff6f6954effdb946bab6d36337efbe5ef64d10646a0 F src/dst.zig 4852e66b69bf459c62dd183fb665431def09279ca6d9ba20f3e00980da035100 F src/e2e.zig 252ecef77b7d79bc84c6df152d1d18e4ea128b08f009b721a479f10b4afa3677 F src/extras.zig b8b36b7d6a3d348eeaf733124e671de1dba0bd4fe3cf2acd35268dfb3cf6acfb F src/fuzz_tests.zig 94b07393229dc6aa681ac0f90bb0bb2c4d024bc6446fbefb361346942a7630eb F src/logstore.zig a26e7b006f335b0bbb9bb41ac702ea42fab1c5b4ce9b13c7d25a89c84197aed0 F src/logstore_benchmark.zig e245474e1cc4f10617866f718aab3958f13b256c609b3e5fd562f500668388c0 F src/logstore_fuzz.zig 67b7bda806397f92c3b07c94854d9fafca56710090071a1c1c8ec94d137408f8 F src/logstore_test.zig a9baaee2cf009c988832d3632f52a1eeabf36afd52c891315f7673ce28442533 F src/main.zig 314bfb1148cf1b60d78a37e7f21b69531c4b4f5dde16905ea89c411d3214399d F src/managed.zig 81ccc2d6321fe3dff91f653305ae4e73bea0b3fae7db2ab2f0cf168d9518d601 F src/merge3.zig 22c24bbea4b5fa79879c984b8208e6b0b17b4837977ac36b79821648a4f900bd F src/pack.zig 0ea96cb540b3f43f6ff8ce95a3044ce939879bc6f9bf0eb82b26aab4089009c7 F src/packaging_test.zig b802ada92f1ade1b62e3d1cfc36549c9b8d05be5430bd33d440bc93d7cd3600f F src/repocache.zig aae232a6b1b86e27c5242c0ee17ce9f2544299d99cf4936d8c2c9000e3166884 F src/repoimage.zig 7d2dc2f3c145e10e2d9ba6997705fd61a0cc0aedde8e171c253163d1279ccdd5 F src/repository.zig 6d41e75aafeddf6d6f0e0b04d280402354f2e8ee046d3027162733947a199176 F src/repository_test.zig 329c0fdfc9a84f96a94afbc5e7df5f7b2ef81651413e728ebf886e143ff5df5c F src/repostate.zig 72b063c9b779b6154940abc31c26644346d8ff9aca1ff8c7b6d0f47672ab90ec F src/repostate_test.zig 0645afa55d528f74e6cd1c84fc49568fff8c9c55956db30d48c4390f7a142599 F src/repoview.zig ec2958e1e8fd955c761d240ab80c3b3f62e3473991713c25ed5a603df984e403 F src/rfc_vectors/artifact_a1_1_sha1_manifest.txt 82d8fc78b3fbf85efe80cb05e79db40c910bf0551e55b728c6f9c2ca7a42ddb6 F src/rfc_vectors/artifact_a1_2_sha3_technote.txt 832e850f83aab2e2a754aa97591109f7f05fb41e4126c7e71c88a59d6d17e55d F src/rfc_vectors/artifact_a3_rcard_manifest.txt 47e412ef211f095e93275fadf527909e581eef42357d8437fc7e299bfc3e62a7 F src/rfc_vectors/sync_a1_round1_reply.txt 638813029b10f81303b88859279afb17095d7c779c993f4267870909acabbeb9 F src/rfc_vectors/sync_a1_round2_file_cards.txt 4fa397741f7521cc4181d5d6b04dc143187f57602384eaa688552115ecda27c2 F src/rfc_vectors/sync_a1_round2_reply.txt af956808190c79b37a384041690c36b78845b471d6c6c01d1cced6e3ee92e6b1 F src/rfc_vectors/sync_a2_reply.txt aa130a127cde210f793c7842960083c765e0ffc7b673374fabc8f0edfe03d763 F src/root.zig c0e74897f57db81c0e4ce57bb992f4fbf52139234317ca00698a2af0c1c1c9b3 F src/serve.zig a072735c12410c63d1d5ace84d7ddf30b84639848ba420207e2432e5b7dcbc27 F src/serve_fuzz.zig 3c39ea768ffa37599e2cc00c588f053870766ab91500aceb0d844a4322174687 F src/sim/faulty_file.zig 8e8a0325d0e987d1dd306588f910af5302e6456561eefae92c73c424fc1a9c94 F src/sim/gen.zig 0e237af570a73bc78e9a717a8ea59867611deb2348287765826ea4ff1942528b F src/sim/net.zig 8fb057012ce0a33f67c928cd696bc2761fea8ba4012b2daa33871b2ba5dfe772 F src/sim/oracle.zig 04b81d9472a0529d9e9d030779304c3d6c930f4db20b800ae3f9cbc5c178969a F src/sim/storage_sweep.zig 5472d632347079fb5c7e7ae300b46c6e8202b91202b1c51b181dd3c7bab8a306 F src/sim/sync_gen.zig 238d46942915b5c0e989dfc738b5927b5228468ea123e6f17b6fb593aa5cbf6e F src/sim/sync_sweep.zig 5458a84be08823d2d0fc9464665f1c3f3f26563185dc9ae24cf73259faa5d40e F src/smoke.zig d3aecf12565618a6b678eeff534230c88dbe5a02486beafcdbdf1eac9b258292 F src/storage.zig 512205eb629d5af8d50ad336f1ef49f53b455abd52ee2f9b56d20893cafad39f F src/storage_benchmark.zig 871f00fef1a34a0b2ee7b9656a217a0cf52949fdd710b642a44dc6bf12d6866e F src/sync.zig b04119b2679887c6705ed4831899ca1911ca20afe0bac865022ac8b7ad879194 F src/sync_benchmark.zig 9a4542401c880750ff6565a2ca9f1d116341d1c5af704ef4a05c2732eeec8849 F src/sync_driver.zig 722ed498ea6b76900661a085d4257e51f6416d43ac1185e8ac15140de265f67e F src/sync_driver_test.zig b50450d2938fc60aa90cd9067fc45141a965b63dc2194f42d5109919e380d7df F src/sync_fuzz.zig 3f419ec3e3c0b4ecf99376e46d111c4fae9826d08f9968e649ffdf84d10f9e61 F src/sync_test.zig b47b05d3defeef61a02c9c9817b66288c48430713737c946734dba151bb17e7e F src/transport.zig 4652b2ab7f43ccd8af5ca6ef7604f8e7cd28353450b1ec90d206b881308f8b5f F src/transport_fuzz.zig adc4ea5e22f821d868ffa57e3aafd42834f358b26d4b317cd6dbe8c76c6f733b F src/undo.zig 2e213cbe02118e37b11554620b285deae5dbf5b4d8009ae6dc229b84375b7591 F src/update.zig 0103da3d0ea12ce5710fd4268f432a52a0fb07ea7cb2ebe14af6e52395eb598c F src/update_test.zig c06e5fb6da0b1b7aa055fb2398bd03844e0dbec67ed97905135db1dffb8a2a14 F src/warmread_benchmark.zig 9421986d49deff3f720e491fb6d1c7162dc9322f4e67dd14198820c3992dc02a P 91c682fd06c5dba6eac6820f58d9f8e3a0c8ade4ea94fe5b5f604261eab7673c cec4afaf89e8d6932c6c6a67e90c31aa313b67de6bc7a25ded907977cbba579b R ab9e7863a4398eacbc37e9f77ee1e7f6 U dmestas Z c6fd7794b4bbcebaaae3867f6b5c7c83