macOS users using Colima instead of Docker Desktop were hitting
missing buildx errors and had no documentation to guide them.
Add Colima as a supported Docker runtime, document buildx
installation, and ensure setup-local installs buildx automatically.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Many component test suites require a running Redis instance.
Document how to start a temporary Redis container via Docker
so these tests are not skipped or left failing.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bump cryptography to 46.0.5 in common, orchestrator, patcher,
program-model, seed-gen, and fuzzer_runner lock files to match
the fuzzer component which was already updated in #470.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add optional tmpfs storage for fuzzing corpus
Add support for storing the node-local fuzzing corpus in tmpfs (RAM-based
filesystem) for improved I/O performance during fuzzing operations.
Key changes:
- Add CORPUS_TMPFS_PATH environment variable to configure tmpfs location
- Add cross-filesystem safe operations (copy+delete fallback for EXDEV)
- Update Corpus class to use tmpfs path when enabled while maintaining
correct remote path calculation for rsync synchronization
- Add Helm chart configuration using /dev/shm (requires no host setup)
- Update fuzzer-bot, coverage-bot, merger-bot, seed-gen deployments
The feature is disabled by default. Enable by setting
global.volumes.corpusTmpfs.enabled=true in values.yaml.
Uses hostPath to /dev/shm/buttercup-corpus which is available on
Linux systems without requiring any Kubernetes host configuration.
Upgrade FastAPI from ~0.115.6 to ~0.128.0 in orchestrator to allow
starlette >= 0.49.1, fixing:
- CVE-2025-62727 (High): O(n^2) DoS via Range header in FileResponse
- CVE-2025-54121 (Medium): DoS via large multipart file parsing
The orchestrator uses FileResponse and StaticFiles (the affected
components) in the competition API UI.
Resolves: Dependabot alerts #33, #34
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
* Fix CoverageBot.run_task and add test cases
* Add setuptools as an explicit dependency
This is because a transitive dependency via clusterfuzz depends on it
* Appease ruff
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
* Fix CoverageBot.run_task and add test cases
---------
Co-authored-by: Henrik Brodin <90325907+hbrodin@users.noreply.github.com>
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
Add uv constraint-dependencies to prevent protobuf from being updated
beyond 3.20.3, which is required for compatibility with OSS-Fuzz
infrastructure.
This prevents dependabot from creating PRs like #453 that would break
the fuzzer runner.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Updates pyasn1 0.6.1 → 0.6.2 and urllib3 2.5.0 → 2.6.3 in fuzzer_runner.
These updates are from Dependabot PRs #448 and #449.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
The subprocess mock was missing __enter__ and __exit__ configuration,
causing tests to hang when ChallengeTask._run_cmd used
`with subprocess.Popen(...) as process:` context manager syntax.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Use grpcio-tools from the common venv instead of system protoc for
consistent protobuf code generation across development and CI.
Changes:
- Update protoc.sh to use `python -m grpc_tools.protoc`
- Add grpcio-tools ~=1.73.1 to common dev dependencies
- Update check-protobuf CI job to run from common venv
- Regenerate msg_pb2.py and msg_pb2.pyi with new tooling
- Document protobuf generation requirement in CLAUDE.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `# hadolint ignore=DL3006` for ARG-based FROM statements
- Add `# hadolint ignore=SC1091` for sourcing /etc/os-release
- Add `--no-install-recommends` to apt-get install commands
- Add `ca-certificates` package for HTTPS curl operations
- Add `automake` to cscope-builder stage (required for autoreconf)
- Consolidate consecutive RUN instructions in fuzzer Dockerfile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Install hadolint from GitHub releases for Dockerfile linting
- Exclude external/ and node_data_storage/ directories from shellcheck
and hadolint (contain vendored/cloned code)
- Improve merge conflict detection regex to avoid false positives
- Add SC2153 shellcheck disable directives for intentional env var names
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace deprecated `uv pip install --isolated` with direct `uv pip install`
- Fix zizmor template-injection warnings by using env variables instead of
direct template expressions in shell commands
- Quote $GITHUB_OUTPUT for proper shell escaping
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Run `ruff check --fix` across all components to fix I001 import sorting
violations in src/ and test/ directories.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Apply automated fixes from ruff (import ordering, formatting) and ty (type
checker) to all Python source files across all components:
- Reorder imports according to isort/ruff rules
- Remove unnecessary type: ignore comments
- Fix minor type issues identified by ty
- Add atexit.register(logging.shutdown) where needed
- Consistent formatting
Components affected:
- common/src/
- orchestrator/src/
- fuzzer/src/
- fuzzer_runner/src/
- patcher/src/
- program-model/src/
- seed-gen/src/
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Apply automated fixes from ruff (import ordering, formatting) to all test
files across all components:
- Reorder imports according to isort/ruff rules
- Remove unnecessary imports
- Consistent formatting
Components affected:
- fuzzer/tests/
- orchestrator/test/
- patcher/tests/
- program-model/tests/
- seed-gen/test/
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update dependencies across all components:
- Update ruff to v0.12.0
- Add ty (Astral type checker) as dev dependency
- Standardize pyproject.toml configurations
- Regenerate uv.lock files
Components updated:
- common
- orchestrator
- fuzzer
- fuzzer_runner
- patcher
- program-model
- seed-gen
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Apply automated fixes from shellcheck and shfmt to all shell scripts:
- Quote variables to prevent word splitting and globbing
- Use $(...) instead of backticks for command substitution
- Add proper shebang and set -euo pipefail where missing
- Fix array handling and iteration patterns
- Consistent indentation (4 spaces)
- Remove unnecessary curly braces and simplify expressions
Files fixed:
- deployment/*.sh
- scripts/*.sh
- orchestrator/scripts/*.sh
- fuzzer_runner/runner.sh
- protoc.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
uvx runs tools in isolated environments without requiring them as
project dependencies, which is needed for CI where project deps
aren't installed when pre-commit runs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The ty hook requires uv to run `uv run ty check src/`, but the
workflow was missing the uv installation step, causing hook
failures with exit code 127 (uv: command not found).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update lint-component target to use ty (Astral type checker) instead of mypy:
- Run ty check for all components uniformly
- Add fuzzer_runner to available components list
- Simplify type checking logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add configuration for Serena semantic code navigation:
- .mcp.json - MCP server configuration for Claude Code
- .serena/project.yml - Project-specific settings (roots, languages, ignores)
- .serena/.gitignore - Ignore cache directory
Serena provides semantic code navigation tools that understand symbol
relationships, making it easier to explore and modify the codebase.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add comprehensive documentation for local development deployment:
- Docker Desktop resource configuration (CPU, memory, disk)
- Common errors and solutions (resource insufficiency, pending pods, GHCR auth)
- Resource expectations table for different memory allocations
- macOS ARM64 (Apple Silicon) notes
- Verification steps and useful debugging commands
Also update env.template with inline comments explaining minikube resource
settings and their relationship to Docker Desktop resources.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Use project specified in oss-fuzz
This will use the contents of the oss-fuzz provided container as the
projects contents instead of a user supplied git url. This will allow to
run projects very similar to how oss-fuzz does it. It will enable
analysis of e.g. libmodbus who was previously not possible due to the
fuzzing harnesses being overwritten/shadowed by the mount of project
directory.
Use project_name for focusdir when in doubt
* feat: add git lfs support for challenge repositories
Use git-lfs when downloading challenges to handle large binary files.
* Update orchestrator/src/buttercup/orchestrator/ui/competition_api/services/challenge_service.py
Co-authored-by: Ronald Eytchison <58823072+reytchison@users.noreply.github.com>
---------
Co-authored-by: Ronald Eytchison <58823072+reytchison@users.noreply.github.com>
dependabot[bot]