There doesn't seem to be a way to use the latest docker images (without the "v1" tag) about clusterfuzzlite HOT 4 CLOSED

On a somewhat related note, once I unpin CFLite the "security posture" of systemd is going to get worse even more. it would be great if OSS-Fuzz/CIFuzz/CFLite can somehow affect the scorecard fuzzing check (which is totally bogus as this point: ossf/scorecard#1816 (comment)).

from clusterfuzzlite.

As mentioned in google/oss-fuzz#7206 (comment) I'm planning to unpin CFLite but looking at the action it appears for some reason it uses tags to download the docker images:

$ git grep v1 actions/
actions/build_fuzzers/action.yml:  image: 'docker://gcr.io/oss-fuzz-base/clusterfuzzlite-build-fuzzers:v1'
actions/run_fuzzers/action.yml:  image: 'docker://gcr.io/oss-fuzz-base/clusterfuzzlite-run-fuzzers:v1'

The tags aren't exactly bogus. We're doing this in case we make breaking changes to the API in v2

from clusterfuzzlite.

On a somewhat related note, once I unpin CFLite the "security posture" of systemd is going to get worse even more. it would be great if OSS-Fuzz/CIFuzz/CFLite can somehow affect the scorecard fuzzing check (which is totally bogus as this point: ossf/scorecard#1816 (comment)).

I'm not happy about this situation either and i've complained to scorecards but it doesn't seem like they will budge. I agree I think pinning provides little security benefit, fuzzing (for C++) provides a big security benefit, so using CFLite without pinning makes a project more secure not less and that scorecards is wrong

from clusterfuzzlite.

The tags aren't exactly bogus. We're doing this in case we make breaking changes to the API in v2

Agreed. After a lengthy discussion in #96 I switched to the tags. For that to fully work https://github.com/google/clusterfuzzlite/releases/tag/v1 would have to be bumped automatically though. (@oliverchang bumped it yesterday manually)

using CFLite without pinning makes a project more secure not less and that scorecards is wrong

I have to admit I'm not even sure what scorecard is trying to accomplish anymore with all those checks and a few new ones. I decided to just ignore it altogether.

from clusterfuzzlite.