Artifact cec4afaf89e8d6932c6c6a67e90c31aa313b67de6bc7a25ded907977cbba579b:
The 24 existing fuzz targets cover the delta, artifact, sync-parser and logstore layers, but not the two CLI-layer modules that consume bytes an untrusted remote peer chose. `sync_parsers_adversarial` covers the layer above; the HTTP framing itself was unfuzzed. These are the last two wire surfaces on the release bar, and they are what a hostile peer reaches first.
What landed:
- `src/transport_fuzz.zig` — `frameGarbage`, registered as `transport_frame_garbage`. Client-side §4/§4.1 framing and redirect policy: the round-trip law (whatever `frame` produces, `unframe` returns exactly those plaintext bytes), mutation of framed containers (bit damage never survives as *different* plaintext — it either fails the container's Adler-32/zlib checks or, in the length-field range the §4.1 compression-length erratum makes a capacity bound, decodes back to the same bytes), and garbage `Location` headers through `resolveRedirect`. Totality is the asserted contract: every input yields a value whose postconditions hold or a declared member of `TransportError`.
- `src/serve_fuzz.zig` — `requestGarbage`, registered as `serve_request_garbage`. Server-side HTTP request path: raw bytes into `std.http.Server.receiveHead`, then `handleHttpRequest`'s dispatch (`classifyXfer` -> body read -> responder -> reply framing). It does not re-feed `handleXfer` in isolation — that decoding is already fuzzed twice — it reaches it only as the tail of a full-path dispatch, which is the point. Asserted contract: any `receiveHead` error is a clean rejection, `handleHttpRequest` returns void, and any produced response begins with an HTTP/1.1 status line.
- `src/serve.zig`: `driveHttp` becomes `pub`. It is the request-path seam two callers need and neither should reimplement — the §4 smoke tests and this fuzz target. In-memory reader/writer on both sides, so the target binds no port and cannot flake in CI.
- `src/fuzz_tests.zig`: both targets registered in the `targets` table, and `targets` becomes `pub` for a new structural registration pin. An unregistered target compiles, passes review, and is then never run by any invocation; the pin asserts every target the release bar names is actually reachable from the runner, so the registration cannot rot.
- `src/dst.zig`: aggregates both new files plus `fuzz_tests.zig` into `zig build test`. This root is the one that reaches serve.zig and transport.zig relatively while carrying the `zit` dep those two import; `zig build fuzz` has no test step, so it is also the only place the registration pin can run.
No bug found, so no fix and no pinned-seed regression in this commit — both surfaces held over the seeded runs below. The targets are the standing check, not a one-time sweep.
Test evidence (this worktree, after `fossil update` absorbed the sibling `zit open` commit 5ba418801d and its 8 modified files):
- `zig build fuzz -- transport_frame_garbage --seed 1 --rounds 2000` — clean, no crash/leak/UB. - `zig build fuzz -- serve_request_garbage --seed 1 --rounds 2000` — clean, no crash/leak/UB. - `zig build test` — green, including the new registration pin and the fixed-seed smoke tests at the foot of both new files. - `zig build` and `zig fmt --check .` — green.
No borrowed technique in this change. by dmestas on 2026-07-19 00:10:09.
C Add\stransport_frame_garbage\sand\sserve_request_garbage\sseeded\sfuzz\stargets\n\nThe\s24\sexisting\sfuzz\stargets\scover\sthe\sdelta,\sartifact,\ssync-parser\sand\nlogstore\slayers,\sbut\snot\sthe\stwo\sCLI-layer\smodules\sthat\sconsume\sbytes\san\nuntrusted\sremote\speer\schose.\s`sync_parsers_adversarial`\scovers\sthe\slayer\nabove;\sthe\sHTTP\sframing\sitself\swas\sunfuzzed.\sThese\sare\sthe\slast\stwo\swire\nsurfaces\son\sthe\srelease\sbar,\sand\sthey\sare\swhat\sa\shostile\speer\sreaches\nfirst.\n\nWhat\slanded:\n\n-\s`src/transport_fuzz.zig`\s—\s`frameGarbage`,\sregistered\sas\n\s\s`transport_frame_garbage`.\sClient-side\s§4/§4.1\sframing\sand\sredirect\n\s\spolicy:\sthe\sround-trip\slaw\s(whatever\s`frame`\sproduces,\s`unframe`\n\s\sreturns\sexactly\sthose\splaintext\sbytes),\smutation\sof\sframed\scontainers\n\s\s(bit\sdamage\snever\ssurvives\sas\s*different*\splaintext\s—\sit\seither\sfails\n\s\sthe\scontainer's\sAdler-32/zlib\schecks\sor,\sin\sthe\slength-field\srange\sthe\n\s\s§4.1\scompression-length\serratum\smakes\sa\scapacity\sbound,\sdecodes\sback\sto\n\s\sthe\ssame\sbytes),\sand\sgarbage\s`Location`\sheaders\sthrough\n\s\s`resolveRedirect`.\sTotality\sis\sthe\sasserted\scontract:\severy\sinput\n\s\syields\sa\svalue\swhose\spostconditions\shold\sor\sa\sdeclared\smember\sof\n\s\s`TransportError`.\n\n-\s`src/serve_fuzz.zig`\s—\s`requestGarbage`,\sregistered\sas\n\s\s`serve_request_garbage`.\sServer-side\sHTTP\srequest\spath:\sraw\sbytes\sinto\n\s\s`std.http.Server.receiveHead`,\sthen\s`handleHttpRequest`'s\sdispatch\n\s\s(`classifyXfer`\s->\sbody\sread\s->\sresponder\s->\sreply\sframing).\sIt\sdoes\n\s\snot\sre-feed\s`handleXfer`\sin\sisolation\s—\sthat\sdecoding\sis\salready\sfuzzed\n\s\stwice\s—\sit\sreaches\sit\sonly\sas\sthe\stail\sof\sa\sfull-path\sdispatch,\swhich\n\s\sis\sthe\spoint.\sAsserted\scontract:\sany\s`receiveHead`\serror\sis\sa\sclean\n\s\srejection,\s`handleHttpRequest`\sreturns\svoid,\sand\sany\sproduced\sresponse\n\s\sbegins\swith\san\sHTTP/1.1\sstatus\sline.\n\n-\s`src/serve.zig`:\s`driveHttp`\sbecomes\s`pub`.\sIt\sis\sthe\srequest-path\sseam\n\s\stwo\scallers\sneed\sand\sneither\sshould\sreimplement\s—\sthe\s§4\ssmoke\stests\n\s\sand\sthis\sfuzz\starget.\sIn-memory\sreader/writer\son\sboth\ssides,\sso\sthe\n\s\starget\sbinds\sno\sport\sand\scannot\sflake\sin\sCI.\n\n-\s`src/fuzz_tests.zig`:\sboth\stargets\sregistered\sin\sthe\s`targets`\stable,\n\s\sand\s`targets`\sbecomes\s`pub`\sfor\sa\snew\sstructural\sregistration\spin.\sAn\n\s\sunregistered\starget\scompiles,\spasses\sreview,\sand\sis\sthen\snever\srun\sby\n\s\sany\sinvocation;\sthe\spin\sasserts\severy\starget\sthe\srelease\sbar\snames\sis\n\s\sactually\sreachable\sfrom\sthe\srunner,\sso\sthe\sregistration\scannot\srot.\n\n-\s`src/dst.zig`:\saggregates\sboth\snew\sfiles\splus\s`fuzz_tests.zig`\sinto\n\s\s`zig\sbuild\stest`.\sThis\sroot\sis\sthe\sone\sthat\sreaches\sserve.zig\sand\n\s\stransport.zig\srelatively\swhile\scarrying\sthe\s`zit`\sdep\sthose\stwo\n\s\simport;\s`zig\sbuild\sfuzz`\shas\sno\stest\sstep,\sso\sit\sis\salso\sthe\sonly\n\s\splace\sthe\sregistration\spin\scan\srun.\n\nNo\sbug\sfound,\sso\sno\sfix\sand\sno\spinned-seed\sregression\sin\sthis\scommit\s—\nboth\ssurfaces\sheld\sover\sthe\sseeded\sruns\sbelow.\sThe\stargets\sare\sthe\nstanding\scheck,\snot\sa\sone-time\ssweep.\n\nTest\sevidence\s(this\sworktree,\safter\s`fossil\supdate`\sabsorbed\sthe\ssibling\n`zit\sopen`\scommit\s5ba418801d\sand\sits\s8\smodified\sfiles):\n\n-\s`zig\sbuild\sfuzz\s--\stransport_frame_garbage\s--seed\s1\s--rounds\s2000`\s—\n\s\sclean,\sno\scrash/leak/UB.\n-\s`zig\sbuild\sfuzz\s--\sserve_request_garbage\s--seed\s1\s--rounds\s2000`\s—\n\s\sclean,\sno\scrash/leak/UB.\n-\s`zig\sbuild\stest`\s—\sgreen,\sincluding\sthe\snew\sregistration\spin\sand\sthe\n\s\sfixed-seed\ssmoke\stests\sat\sthe\sfoot\sof\sboth\snew\sfiles.\n-\s`zig\sbuild`\sand\s`zig\sfmt\s--check\s.`\s—\sgreen.\n\nNo\sborrowed\stechnique\sin\sthis\schange.\n D 2026-07-19T00:10:09.253 F .fossil-settings/ignore-glob 3580f973d7097226f91a27c7b61ec13d9d07880d95549f9b90ce86da5d867a23 F LICENSE 702ae7ff835a2a971dae11c5cae039803bf394b77a6d8ec9f18693e449eaaf26 F README.md 62e1f936cc2ea0e33d717539bdffd6126a639843069bd6256359f2b15cb06232 F build.zig 4bc7076a0a8ae829e0860d78027c84f78a3cb40fb2733891a16ac1ebed18715d F build.zig.zon 0eade544d4d7fc5a620348c6f29cc9219ff8c6d6377a05e756ca89860a524781 F docs/rfcs/draft-fossil-artifact-format-00.txt a6d542a5effeb41d0ea1e916058ccdc0a5819787f167ef1ebad7814f5680e7ad F docs/rfcs/draft-fossil-delta-format-00.txt d8025d6d75322e33887c3334a4b9cc729960028b3c994ed01e5a474e4b388fd2 F docs/rfcs/draft-fossil-repo-state-00.txt fd413bcb28001a8a07009ca0c769cfe666394ba79dd4f14a6461f2b592049595 F docs/rfcs/draft-fossil-sync-protocol-00.txt aa55791464a54ef4b651df8780ba5c46e95c723c7997d09a5b727fef658f920a F src/annotate.zig 0a6b6728099e63c84681d1e5228ebb45fafb55d65df1720358247fd6e6532c63 F src/artifact.zig c630afd9fbbcfaccd7b823105b4d05db1dc85b6af03080a6d58635ed064672ca F src/artifact_fuzz.zig 8bb359ddfe790818e109a1dd7ac0c1b5cec1a8fdc556f37e73504cdb7f933e17 F src/artifact_test.zig da999476660f7e6e1f50ed9da5c30f1c83d6b358e2cfcd265c6932959c85bdd1 F src/bisect.zig 7bfc45d3e0e339017826941463cc4e9118892d2898fbcd319e6e6ca85c4d3301 F src/checkout.zig ac48e76f22c8065f70d2a827ae00ffb99887af80950a93c1a3451a9a1ad0f403 F src/cli.zig ae2ec7787850f9969ba32c4d0453e5eb1359eefe25f1cc2b252ecd95735840f6 F src/container.zig cef1028531f2763f94248b761c8779a1884e44bb854b8c45617494e3ead40e61 F src/container_test.zig a013652b1ed181161d3ad8fc9d8f052f7c27b61e129662632ceaf8cf189445ec F src/delta.zig e8f3a6297d47549aea146222732ccf514c39688414f0a74ba396ac91066686f3 F src/delta_fuzz.zig 9e0d8dbb8c82ca0ba1a80974c076e74e4f37072b21a10812efd5539875904719 F src/delta_test.zig b18d97e117dce8fbcc05bff6f6954effdb946bab6d36337efbe5ef64d10646a0 F src/dst.zig 4852e66b69bf459c62dd183fb665431def09279ca6d9ba20f3e00980da035100 F src/e2e.zig 252ecef77b7d79bc84c6df152d1d18e4ea128b08f009b721a479f10b4afa3677 F src/extras.zig b8b36b7d6a3d348eeaf733124e671de1dba0bd4fe3cf2acd35268dfb3cf6acfb F src/fuzz_tests.zig 94b07393229dc6aa681ac0f90bb0bb2c4d024bc6446fbefb361346942a7630eb F src/logstore.zig a26e7b006f335b0bbb9bb41ac702ea42fab1c5b4ce9b13c7d25a89c84197aed0 F src/logstore_benchmark.zig e245474e1cc4f10617866f718aab3958f13b256c609b3e5fd562f500668388c0 F src/logstore_fuzz.zig 67b7bda806397f92c3b07c94854d9fafca56710090071a1c1c8ec94d137408f8 F src/logstore_test.zig a9baaee2cf009c988832d3632f52a1eeabf36afd52c891315f7673ce28442533 F src/main.zig 314bfb1148cf1b60d78a37e7f21b69531c4b4f5dde16905ea89c411d3214399d F src/managed.zig 81ccc2d6321fe3dff91f653305ae4e73bea0b3fae7db2ab2f0cf168d9518d601 F src/merge3.zig 22c24bbea4b5fa79879c984b8208e6b0b17b4837977ac36b79821648a4f900bd F src/pack.zig 0ea96cb540b3f43f6ff8ce95a3044ce939879bc6f9bf0eb82b26aab4089009c7 F src/packaging_test.zig 0697e7e19ac575d0b09f957256a90de524192b03128b15210bd37fec767097a4 F src/repocache.zig aae232a6b1b86e27c5242c0ee17ce9f2544299d99cf4936d8c2c9000e3166884 F src/repoimage.zig 7d2dc2f3c145e10e2d9ba6997705fd61a0cc0aedde8e171c253163d1279ccdd5 F src/repository.zig 6d41e75aafeddf6d6f0e0b04d280402354f2e8ee046d3027162733947a199176 F src/repository_test.zig 329c0fdfc9a84f96a94afbc5e7df5f7b2ef81651413e728ebf886e143ff5df5c F src/repostate.zig 72b063c9b779b6154940abc31c26644346d8ff9aca1ff8c7b6d0f47672ab90ec F src/repostate_test.zig 0645afa55d528f74e6cd1c84fc49568fff8c9c55956db30d48c4390f7a142599 F src/repoview.zig ec2958e1e8fd955c761d240ab80c3b3f62e3473991713c25ed5a603df984e403 F src/rfc_vectors/artifact_a1_1_sha1_manifest.txt 82d8fc78b3fbf85efe80cb05e79db40c910bf0551e55b728c6f9c2ca7a42ddb6 F src/rfc_vectors/artifact_a1_2_sha3_technote.txt 832e850f83aab2e2a754aa97591109f7f05fb41e4126c7e71c88a59d6d17e55d F src/rfc_vectors/artifact_a3_rcard_manifest.txt 47e412ef211f095e93275fadf527909e581eef42357d8437fc7e299bfc3e62a7 F src/rfc_vectors/sync_a1_round1_reply.txt 638813029b10f81303b88859279afb17095d7c779c993f4267870909acabbeb9 F src/rfc_vectors/sync_a1_round2_file_cards.txt 4fa397741f7521cc4181d5d6b04dc143187f57602384eaa688552115ecda27c2 F src/rfc_vectors/sync_a1_round2_reply.txt af956808190c79b37a384041690c36b78845b471d6c6c01d1cced6e3ee92e6b1 F src/rfc_vectors/sync_a2_reply.txt aa130a127cde210f793c7842960083c765e0ffc7b673374fabc8f0edfe03d763 F src/root.zig a2a13d28a5e50138557966adf64bbe121a4a70a4de0e2933f395e30924f9140a F src/serve.zig a072735c12410c63d1d5ace84d7ddf30b84639848ba420207e2432e5b7dcbc27 F src/serve_fuzz.zig 3c39ea768ffa37599e2cc00c588f053870766ab91500aceb0d844a4322174687 F src/sim/faulty_file.zig 8e8a0325d0e987d1dd306588f910af5302e6456561eefae92c73c424fc1a9c94 F src/sim/gen.zig 0e237af570a73bc78e9a717a8ea59867611deb2348287765826ea4ff1942528b F src/sim/net.zig 8fb057012ce0a33f67c928cd696bc2761fea8ba4012b2daa33871b2ba5dfe772 F src/sim/oracle.zig 04b81d9472a0529d9e9d030779304c3d6c930f4db20b800ae3f9cbc5c178969a F src/sim/storage_sweep.zig 5472d632347079fb5c7e7ae300b46c6e8202b91202b1c51b181dd3c7bab8a306 F src/sim/sync_gen.zig 238d46942915b5c0e989dfc738b5927b5228468ea123e6f17b6fb593aa5cbf6e F src/sim/sync_sweep.zig 5458a84be08823d2d0fc9464665f1c3f3f26563185dc9ae24cf73259faa5d40e F src/smoke.zig d3aecf12565618a6b678eeff534230c88dbe5a02486beafcdbdf1eac9b258292 F src/storage.zig 512205eb629d5af8d50ad336f1ef49f53b455abd52ee2f9b56d20893cafad39f F src/storage_benchmark.zig 871f00fef1a34a0b2ee7b9656a217a0cf52949fdd710b642a44dc6bf12d6866e F src/sync.zig b04119b2679887c6705ed4831899ca1911ca20afe0bac865022ac8b7ad879194 F src/sync_benchmark.zig 9a4542401c880750ff6565a2ca9f1d116341d1c5af704ef4a05c2732eeec8849 F src/sync_driver.zig 722ed498ea6b76900661a085d4257e51f6416d43ac1185e8ac15140de265f67e F src/sync_driver_test.zig b50450d2938fc60aa90cd9067fc45141a965b63dc2194f42d5109919e380d7df F src/sync_fuzz.zig 3f419ec3e3c0b4ecf99376e46d111c4fae9826d08f9968e649ffdf84d10f9e61 F src/sync_test.zig b47b05d3defeef61a02c9c9817b66288c48430713737c946734dba151bb17e7e F src/transport.zig 4652b2ab7f43ccd8af5ca6ef7604f8e7cd28353450b1ec90d206b881308f8b5f F src/transport_fuzz.zig adc4ea5e22f821d868ffa57e3aafd42834f358b26d4b317cd6dbe8c76c6f733b F src/undo.zig 2e213cbe02118e37b11554620b285deae5dbf5b4d8009ae6dc229b84375b7591 F src/update.zig 0103da3d0ea12ce5710fd4268f432a52a0fb07ea7cb2ebe14af6e52395eb598c F src/update_test.zig c06e5fb6da0b1b7aa055fb2398bd03844e0dbec67ed97905135db1dffb8a2a14 F src/warmread_benchmark.zig 9421986d49deff3f720e491fb6d1c7162dc9322f4e67dd14198820c3992dc02a P 5ba418801d1fbf9242ca585e1904a84d55b83a9686cbf9374b832bef776efb96 R 92eb91602ebc98d1082509172b7febe9 U dmestas Z 8ba94d4cca4f3927b01966fa0fd2a64a