Is there any interest in prebuilt distributions? about atheris HOT 12 CLOSED

I'll make some prebuilt distributions available, either in the same package or a separate one. Expect this done within a few days.

from atheris.

FWIW, my use case is for pure python. Namely, I'm trying to make CrossHair be able to work alongside a fuzzer and share corpus examples in both directions. Making it trivial for people to install the fuzzer alongside CrossHair is really important, however.

I guess if you'd prefer to encourage direct atheris users to build locally, I could also just build a fork and publish it separately on PyPI?

from atheris.

Hi,

I've published prebuilt binary packages to https://test.pypi.org/project/atheris/1.0.13/ for Linux 64 bit, Python 3.5-3.9. (That's test PyPI). Could you test them out and see if they work reasonably? Deployment code is also pushed to the prebuilt branch.

from atheris.

Oh, and as for Windows: nope, nothing stopping us from supporting Windows. I didn't put any effort into it because Google rarely uses Windows and Python is rarely used on Windows, but it's possible. PRs accepted. :)

I'll probably switch entirely to GitHub actions sometime soon.

from atheris.

This would actually be fairly easy. The main reason we didn't is that when fuzzing native code, the version of libFuzzer needs to roughly correspond to the version of Clang used to build the extensions.

However, that doesn't matter for people only fuzzing Python. @inferno-chromium Do you have an opinion?

from atheris.

This would actually be fairly easy. The main reason we didn't is that when fuzzing native code, the version of libFuzzer needs to roughly correspond to the version of Clang used to build the extensions.

However, that doesn't matter for people only fuzzing Python. @inferno-chromium Do you have an opinion?

Yes right, prebuilts does not help to match clang version with one used to build extension. And you need to build extension anyway locally with some clang, so can't escape from that. Do you really need to build llvm from source, why not use prebuilt clang packages ?

from atheris.

from atheris.

Friendly ping on this. 😄 Do you have concerns or recommendations about a separate prebuilt distribution on PyPI, if it was named appropriately? ("atheris-pure-python"?)

from atheris.

Awesome! I've confirmed pip installation locally (via docker, I'm on mac):

>>> import atheris
>>> atheris.__file__
'/usr/local/lib/python3.8/site-packages/atheris.cpython-38-x86_64-linux-gnu.so'

WDYT about mac/windows? I've seen other folks have success with cibuildwheel in github actions. Would be happy to experiment myself a little if that would help!

from atheris.

from atheris.

So, I didn't quite get cibuildwheel to work, but a simple script in this GitHub action builds for me!
Feel free to pull it in if you like (it would be manually triggered under the Actions tab, and you'd then manually upload the wheel to PyPI, though either of those could be automated too)

I think I hadn't noticed originally that Windows isn't supported. Apparently, libfuzzer does work on Windows: the main blockers would be the various shell scripts and such that we use during setup? Or is there a more fundamental problem that would prevent this from working?

from atheris.

Thanks for the GitHub action!

Prebuilt releases are now on PyPI for both Linux and Mac. I didn't use the GitHub action yet because I don't want to build Linux with a script and Mac with a Github action; I'd rather they be consistent. However, I'll probably need to switch to entirely Github actions eventually, to best support M1 Macs other Mac versions.

from atheris.