assumptions about CFLite runtime environment about clusterfuzzlite HOT 3 CLOSED

According to https://google.github.io/clusterfuzzlite/build-integration/#fuzzer-execution-environment

You should not make any assumptions on the availability of dependent packages in the execution environment and the built fuzzers should have dependencies statically linked.

I understand why fuzz targets integrated into OSS-Fuzz should be written that way but I'm not sure why CFLite should follow suit.

I definitely understand this and ideally I would like to get rid of this restriction.
But I think it is going to be easier to maintain if we only support the single mode of running fuzzers across CIFuzz and ClusterFuzzLite users.
The maintenance burden is why this restriction remains.

from clusterfuzzlite.

I think it is going to be easier to maintain

Agreed.

But unfortunately at least systemd can't be linked against some of its dependencies statically, which in turn, prevents it from being fuzzed thoroughly. Basically I have to throw away fuzz targets I use to review PRs like systemd/systemd#21454 (comment) because they can't be integrated into the CI.

from clusterfuzzlite.

On second thought I think it isn't worth it after all. I think there are easier ways to more or less achieve that using just public OSS-Fuzz corpora of the dependencies that can't be linked statically. Thanks!

from clusterfuzzlite.