mirror of
https://github.com/trailofbits/buttercup
synced 2026-06-21 14:11:39 +00:00
Henrik Brodin
00a7a4be33
* Use an internal_patch_id instead of indices This is the first step in being able to merge sets of PoVs and test patches against all PoVs within a task. * Discard redundant builds * Initial PoV-merging strategy Still not optimal in terms of SARIF-matching/bundling etc * Appears to be working version of merging including bundle and sarif handling * Make tests pass * Update integration test steps * Fixes and cleanup from review * Removed additional request for patched builds * Refactored some loops into find-style functions to simplify * Inline small function used once * Refactors for increased robustness and readability including additional testing * SARIF matching - additional tests and refactor * Add enumerate_task_submissions * Refactor and simplify tests using a builder Cleanup unused code * Fix read_submissions to use CrashWithId * Improvements based on review * Cache final states of PoV reproduce (#909) As these never change we can limit the load on redis by caching the results. * Merge SubmissionEntries based on patches (#910) * Cache final states of PoV reproduce As these never change we can limit the load on redis by caching the results. * Merge SubmissionEntries based on patches If a PoV in another entry is mitigated by the current entry's patch, merge the entries as athey should be considered the same ChallengeVulnerability. * Add positional argument * Hold of submitting a patch while evaluating Check each already submitted patch before submitting a new one for the same task. If any of the already submitted patches mitigates any PoV in the current SubmissionEntry - do not submit this. It will be merged later on. * Additional logging, truncate ids * Only request patch if no submitted patch mitigates Before we request a new patch, we check each of the already submitted patches to see if any of them already mitigates the PoVs in the current SubmissionEntry. If they do, this will be merged at a later stage. * PR feedback
Trail of Bits AIxCC Finals CRS
Dependencies
Follow the install instructions for the required dependencies:
- Docker install guide
- kubectl install guide
- helm install guide:
- minikube install guide
- Git LFS for some tests
Configuration
Create a new configuration file, starting from the default template:
cp \
deployment/env.template \
deployment/env
Next, configure the following options. Follow the instructions in the comments when setting the GHCR_AUTH value.
SCANTRON_GITHUB_PAT
GHCR_AUTH
OPENAI_API_KEY
ANTHROPIC_API_KEY
DOCKER_USERNAME
DOCKER_PAT
Settings specific to local development and testing
Use the hardcoded test credentials found in the comments:
AZURE_ENABLED=false
TAILSCALE_ENABLED=false
COMPETITION_API_KEY_ID: `11111111-1111-1111-1111-111111111111`
COMPETITION_API_KEY_TOKEN: `secret`
CRS_KEY_ID="515cc8a0-3019-4c9f-8c1c-72d0b54ae561"
CRS_KEY_TOKEN="VGuAC8axfOnFXKBB7irpNDOKcDjOlnyB"
CRS_API_HOSTNAME="<generated with: openssl rand -hex 16>"
BUTTERCUP_K8S_VALUES_TEMPLATE="k8s/values-minikube.template"
OTEL_ENDPOINT="<insert endpoint url from aixcc vault, is pseudo secret>"
OTEL_PROTOCOL="http"
Keep empty:
AZURE_API_BASE=""
AZURE_API_KEY=""
Commented out:
CRS_URL
CRS_API_HOSTNAME
LANGFUSE_HOST
LANGFUSE_PUBLIC_KEY
LANGFUSE_SECRET_KEY
OTEL_TOKEN
When re-running unscored rounds, set this to true:
MOCK_COMPETITION_API_ENABLED
Authentication
Docker
Log into ghcr.io:
docker login ghcr.io -u <username>
Running the CRS
Starting the services
cd deployment && make up
Stopping the services
cd deployment && make down
Sending the example-libpng task to the system
kubectl port-forward -n crs service/buttercup-competition-api 31323:1323
./orchestrator/scripts/task_crs.sh
Send a SARIF message
./orchestrator/scripts/send_sarif.sh <TASK-ID-FROM-TASK-CRS>
Simulating Unscored Round 2
kubectl port-forward -n crs service/buttercup-competition-api 31323:1323
./orchestrator/scripts/challenge.sh
Check that patches get submitted to the bundler.
kubectl logs -n crs -l app=scheduler --tail=-1 --prefix | grep "WAIT_PATCH_PASS -> SUBMIT_BUNDLE"
If needing to debug, run the following to log into the pod.
kubectl get pods -n crs
kubectl exec -it -n crs <pod-name> -- /bin/bash
Run Unscored Challenges
See UNSCORED.md