go-tuf
go-tuf copied to clipboard
Switch to using native fuzz tests
#275 introduced some JSON unmarshal hardening and uses a fuzzer to generate test data for the hardening.
We should port the test to use the native fuzzer available in Go 1.18 (and newer) to reduce our third-party dependencies.
Originally posted by @Zenithar in https://github.com/theupdateframework/go-tuf/pull/275#discussion_r925470086
Does this mean importing the native fuzzer in place of the 3rd party fuzzer in the source code and then running go mod tidy?
(New to golang. Hence a bit verbose)
I'm not familiar with the state of fuzzing in Go, but it might also be necessary to port the fuzzing logic to the API of the native fuzzer.
Closing since the code base changed and we no longer have the same tests.
Thanks for raising this 👍