mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-02-12 20:32:46 +00:00
* feat: Complete migration from Prefect to Temporal BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal ## Major Changes - Replace Prefect with Temporal for workflow orchestration - Implement vertical worker architecture (rust, android) - Replace Docker registry with MinIO for unified storage - Refactor activities to be co-located with workflows - Update all API endpoints for Temporal compatibility ## Infrastructure - New: docker-compose.temporal.yaml (Temporal + MinIO + workers) - New: workers/ directory with rust and android vertical workers - New: backend/src/temporal/ (manager, discovery) - New: backend/src/storage/ (S3-cached storage with MinIO) - New: backend/toolbox/common/ (shared storage activities) - Deleted: docker-compose.yaml (old Prefect setup) - Deleted: backend/src/core/prefect_manager.py - Deleted: backend/src/services/prefect_stats_monitor.py - Deleted: Docker registry and insecure-registries requirement ## Workflows - Migrated: security_assessment workflow to Temporal - New: rust_test workflow (example/test workflow) - Deleted: secret_detection_scan (Prefect-based, to be reimplemented) - Activities now co-located with workflows for independent testing ## API Changes - Updated: backend/src/api/workflows.py (Temporal submission) - Updated: backend/src/api/runs.py (Temporal status/results) - Updated: backend/src/main.py (727 lines, TemporalManager integration) - Updated: All 16 MCP tools to use TemporalManager ## Testing - ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend) - ✅ All API endpoints functional - ✅ End-to-end workflow test passed (72 findings from vulnerable_app) - ✅ MinIO storage integration working (target upload/download, results) - ✅ Worker activity discovery working (6 activities registered) - ✅ Tarball extraction working - ✅ SARIF report generation working ## Documentation - ARCHITECTURE.md: Complete Temporal architecture documentation - QUICKSTART_TEMPORAL.md: Getting started guide - MIGRATION_DECISION.md: Why we chose Temporal over Prefect - IMPLEMENTATION_STATUS.md: Migration progress tracking - workers/README.md: Worker development guide ## Dependencies - Added: temporalio>=1.6.0 - Added: boto3>=1.34.0 (MinIO S3 client) - Removed: prefect>=3.4.18 * feat: Add Python fuzzing vertical with Atheris integration This commit implements a complete Python fuzzing workflow using Atheris: ## Python Worker (workers/python/) - Dockerfile with Python 3.11, Atheris, and build tools - Generic worker.py for dynamic workflow discovery - requirements.txt with temporalio, boto3, atheris dependencies - Added to docker-compose.temporal.yaml with dedicated cache volume ## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/) - Reusable module extending BaseModule - Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py) - Recursive search to find targets in nested directories - Dynamically loads TestOneInput() function - Configurable max_iterations and timeout - Real-time stats callback support for live monitoring - Returns findings as ModuleFinding objects ## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/) - Temporal workflow for orchestrating fuzzing - Downloads user code from MinIO - Executes AtherisFuzzer module - Uploads results to MinIO - Cleans up cache after execution - metadata.yaml with vertical: python for routing ## Test Project (test_projects/python_fuzz_waterfall/) - Demonstrates stateful waterfall vulnerability - main.py with check_secret() that leaks progress - fuzz_target.py with Atheris TestOneInput() harness - Complete README with usage instructions ## Backend Fixes - Fixed parameter merging in REST API endpoints (workflows.py) - Changed workflow parameter passing from positional args to kwargs (manager.py) - Default parameters now properly merged with user parameters ## Testing ✅ Worker discovered AtherisFuzzingWorkflow ✅ Workflow executed end-to-end successfully ✅ Fuzz target auto-discovered in nested directories ✅ Atheris ran 100,000 iterations ✅ Results uploaded and cache cleaned * chore: Complete Temporal migration with updated CLI/SDK/docs This commit includes all remaining Temporal migration changes: ## CLI Updates (cli/) - Updated workflow execution commands for Temporal - Enhanced error handling and exceptions - Updated dependencies in uv.lock ## SDK Updates (sdk/) - Client methods updated for Temporal workflows - Updated models for new workflow execution - Updated dependencies in uv.lock ## Documentation Updates (docs/) - Architecture documentation for Temporal - Workflow concept documentation - Resource management documentation (new) - Debugging guide (new) - Updated tutorials and how-to guides - Troubleshooting updates ## README Updates - Main README with Temporal instructions - Backend README - CLI README - SDK README ## Other - Updated IMPLEMENTATION_STATUS.md - Removed old vulnerable_app.tar.gz These changes complete the Temporal migration and ensure the CLI/SDK work correctly with the new backend. * fix: Use positional args instead of kwargs for Temporal workflows The Temporal Python SDK's start_workflow() method doesn't accept a 'kwargs' parameter. Workflows must receive parameters as positional arguments via the 'args' parameter. Changed from: args=workflow_args # Positional arguments This fixes the error: TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs' Workflows now correctly receive parameters in order: - security_assessment: [target_id, scanner_config, analyzer_config, reporter_config] - atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds] - rust_test: [target_id, test_message] * fix: Filter metadata-only parameters from workflow arguments SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5. The issue was that target_path and volume_mode from default_parameters were being passed to the workflow, when they should only be used by the system for configuration. Now filters out metadata-only parameters (target_path, volume_mode) before passing arguments to workflow execution. * refactor: Remove Prefect leftovers and volume mounting legacy Complete cleanup of Prefect migration artifacts: Backend: - Delete registry.py and workflow_discovery.py (Prefect-specific files) - Remove Docker validation from setup.py (no longer needed) - Remove ResourceLimits and VolumeMount models - Remove target_path and volume_mode from WorkflowSubmission - Remove supported_volume_modes from API and discovery - Clean up metadata.yaml files (remove volume/path fields) - Simplify parameter filtering in manager.py SDK: - Remove volume_mode parameter from client methods - Remove ResourceLimits and VolumeMount models - Remove Prefect error patterns from docker_logs.py - Clean up WorkflowSubmission and WorkflowMetadata models CLI: - Remove Volume Modes display from workflow info All removed features are Prefect-specific or Docker volume mounting artifacts. Temporal workflows use MinIO storage exclusively. * feat: Add comprehensive test suite and benchmark infrastructure - Add 68 unit tests for fuzzer, scanner, and analyzer modules - Implement pytest-based test infrastructure with fixtures - Add 6 performance benchmarks with category-specific thresholds - Configure GitHub Actions for automated testing and benchmarking - Add test and benchmark documentation Test coverage: - AtherisFuzzer: 8 tests - CargoFuzzer: 14 tests - FileScanner: 22 tests - SecurityAnalyzer: 24 tests All tests passing (68/68) All benchmarks passing (6/6) * fix: Resolve all ruff linting violations across codebase Fixed 27 ruff violations in 12 files: - Removed unused imports (Depends, Dict, Any, Optional, etc.) - Fixed undefined workflow_info variable in workflows.py - Removed dead code with undefined variables in atheris_fuzzer.py - Changed f-string to regular string where no placeholders used All files now pass ruff checks for CI/CD compliance. * fix: Configure CI for unit tests only - Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility - Commented out integration-tests job (no integration tests yet) - Updated test-summary to only depend on lint and unit-tests CI will now run successfully with 68 unit tests. Integration tests can be added later. * feat: Add CI/CD integration with ephemeral deployment model Implements comprehensive CI/CD support for FuzzForge with on-demand worker management: **Worker Management (v0.7.0)** - Add WorkerManager for automatic worker lifecycle control - Auto-start workers from stopped state when workflows execute - Auto-stop workers after workflow completion - Health checks and startup timeout handling (90s default) **CI/CD Features** - `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info) - `--export-sarif` flag: Export findings in SARIF 2.1.0 format - `--auto-start`/`--auto-stop` flags: Control worker lifecycle - Exit code propagation: Returns 1 on blocking findings, 0 on success **Exit Code Fix** - Add `except typer.Exit: raise` handlers at 3 critical locations - Move worker cleanup to finally block for guaranteed execution - Exit codes now propagate correctly even when build fails **CI Scripts & Examples** - ci-start.sh: Start FuzzForge services with health checks - ci-stop.sh: Clean shutdown with volume preservation option - GitHub Actions workflow example (security-scan.yml) - GitLab CI pipeline example (.gitlab-ci.example.yml) - docker-compose.ci.yml: CI-optimized compose file with profiles **OSS-Fuzz Integration** - New ossfuzz_campaign workflow for running OSS-Fuzz projects - OSS-Fuzz worker with Docker-in-Docker support - Configurable campaign duration and project selection **Documentation** - Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md) - Updated architecture docs with worker lifecycle details - Updated workspace isolation documentation - CLI README with worker management examples **SDK Enhancements** - Add get_workflow_worker_info() endpoint - Worker vertical metadata in workflow responses **Testing** - All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing - All monitoring commands tested: stats, crashes, status, finding - Full CI pipeline simulation verified - Exit codes verified for success/failure scenarios Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers. * fix: Resolve ruff linting violations in CI/CD code - Remove unused variables (run_id, defaults, result) - Remove unused imports - Fix f-string without placeholders All CI/CD integration files now pass ruff checks.
422 lines
11 KiB
Markdown
422 lines
11 KiB
Markdown
# FuzzForge Temporal Architecture - Quick Start Guide
|
|
|
|
This guide walks you through starting and testing the new Temporal-based architecture.
|
|
|
|
## Prerequisites
|
|
|
|
- Docker and Docker Compose installed
|
|
- At least 2GB free RAM (core services only, workers start on-demand)
|
|
- Ports available: 7233, 8233, 9000, 9001, 8000
|
|
|
|
## Step 1: Start Core Services
|
|
|
|
```bash
|
|
# From project root
|
|
cd /path/to/fuzzforge_ai
|
|
|
|
# Start core services (Temporal, MinIO, Backend)
|
|
docker-compose up -d
|
|
|
|
# Workers are pre-built but don't auto-start (saves ~6-7GB RAM)
|
|
# They'll start automatically when workflows need them
|
|
|
|
# Check status
|
|
docker-compose ps
|
|
```
|
|
|
|
**Expected output:**
|
|
```
|
|
NAME STATUS PORTS
|
|
fuzzforge-minio healthy 0.0.0.0:9000-9001->9000-9001/tcp
|
|
fuzzforge-temporal healthy 0.0.0.0:7233->7233/tcp
|
|
fuzzforge-temporal-postgresql healthy 5432/tcp
|
|
fuzzforge-backend healthy 0.0.0.0:8000->8000/tcp
|
|
fuzzforge-minio-setup exited (0)
|
|
# Workers NOT running (will start on-demand)
|
|
```
|
|
|
|
**First startup takes ~30-60 seconds** for health checks to pass.
|
|
|
|
## Step 2: Verify Worker Discovery
|
|
|
|
Check worker logs to ensure workflows are discovered:
|
|
|
|
```bash
|
|
docker logs fuzzforge-worker-rust
|
|
```
|
|
|
|
**Expected output:**
|
|
```
|
|
============================================================
|
|
FuzzForge Vertical Worker: rust
|
|
============================================================
|
|
Temporal Address: temporal:7233
|
|
Task Queue: rust-queue
|
|
Max Concurrent Activities: 5
|
|
============================================================
|
|
Discovering workflows for vertical: rust
|
|
Importing workflow module: toolbox.workflows.rust_test.workflow
|
|
✓ Discovered workflow: RustTestWorkflow from rust_test (vertical: rust)
|
|
Discovered 1 workflows for vertical 'rust'
|
|
Connecting to Temporal at temporal:7233...
|
|
✓ Connected to Temporal successfully
|
|
Creating worker on task queue: rust-queue
|
|
✓ Worker created successfully
|
|
============================================================
|
|
🚀 Worker started for vertical 'rust'
|
|
📦 Registered 1 workflows
|
|
⚙️ Registered 3 activities
|
|
📨 Listening on task queue: rust-queue
|
|
============================================================
|
|
Worker is ready to process tasks...
|
|
```
|
|
|
|
## Step 2.5: Worker Lifecycle Management (New in v0.7.0)
|
|
|
|
Workers start on-demand when workflows need them:
|
|
|
|
```bash
|
|
# Check worker status (should show Exited or not running)
|
|
docker ps -a --filter "name=fuzzforge-worker"
|
|
|
|
# Run a workflow - worker starts automatically
|
|
ff workflow run ossfuzz_campaign . project_name=zlib
|
|
|
|
# Worker is now running
|
|
docker ps --filter "name=fuzzforge-worker-ossfuzz"
|
|
```
|
|
|
|
**Configuration** (`.fuzzforge/config.yaml`):
|
|
```yaml
|
|
workers:
|
|
auto_start_workers: true # Default: auto-start
|
|
auto_stop_workers: false # Default: keep running
|
|
worker_startup_timeout: 60 # Startup timeout in seconds
|
|
```
|
|
|
|
**CLI Control**:
|
|
```bash
|
|
# Disable auto-start
|
|
ff workflow run ossfuzz_campaign . --no-auto-start
|
|
|
|
# Enable auto-stop after completion
|
|
ff workflow run ossfuzz_campaign . --wait --auto-stop
|
|
```
|
|
|
|
## Step 3: Access Web UIs
|
|
|
|
### Temporal Web UI
|
|
- URL: http://localhost:8233
|
|
- View workflows, executions, and task queues
|
|
|
|
### MinIO Console
|
|
- URL: http://localhost:9001
|
|
- Login: `fuzzforge` / `fuzzforge123`
|
|
- View uploaded targets and results
|
|
|
|
## Step 4: Test Workflow Execution
|
|
|
|
### Option A: Using Temporal CLI (tctl)
|
|
|
|
```bash
|
|
# Install tctl (if not already installed)
|
|
brew install temporal # macOS
|
|
# or download from https://github.com/temporalio/tctl/releases
|
|
|
|
# Execute test workflow
|
|
tctl workflow run \
|
|
--address localhost:7233 \
|
|
--taskqueue rust-queue \
|
|
--workflow_type RustTestWorkflow \
|
|
--input '{"target_id": "test-123", "test_message": "Hello Temporal!"}'
|
|
```
|
|
|
|
### Option B: Using Python Client
|
|
|
|
Create `test_workflow.py`:
|
|
|
|
```python
|
|
import asyncio
|
|
from temporalio.client import Client
|
|
|
|
async def main():
|
|
# Connect to Temporal
|
|
client = await Client.connect("localhost:7233")
|
|
|
|
# Start workflow
|
|
result = await client.execute_workflow(
|
|
"RustTestWorkflow",
|
|
{"target_id": "test-123", "test_message": "Hello Temporal!"},
|
|
id="test-workflow-1",
|
|
task_queue="rust-queue"
|
|
)
|
|
|
|
print("Workflow result:", result)
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(main())
|
|
```
|
|
|
|
```bash
|
|
python test_workflow.py
|
|
```
|
|
|
|
### Option C: Upload Target and Run (Full Flow)
|
|
|
|
```python
|
|
# upload_and_run.py
|
|
import asyncio
|
|
import boto3
|
|
from pathlib import Path
|
|
from temporalio.client import Client
|
|
|
|
async def main():
|
|
# 1. Upload target to MinIO
|
|
s3 = boto3.client(
|
|
's3',
|
|
endpoint_url='http://localhost:9000',
|
|
aws_access_key_id='fuzzforge',
|
|
aws_secret_access_key='fuzzforge123',
|
|
region_name='us-east-1'
|
|
)
|
|
|
|
# Create a test file
|
|
test_file = Path('/tmp/test_target.txt')
|
|
test_file.write_text('This is a test target file')
|
|
|
|
# Upload to MinIO
|
|
target_id = 'my-test-target-001'
|
|
s3.upload_file(
|
|
str(test_file),
|
|
'targets',
|
|
f'{target_id}/target'
|
|
)
|
|
print(f"✓ Uploaded target: {target_id}")
|
|
|
|
# 2. Run workflow
|
|
client = await Client.connect("localhost:7233")
|
|
|
|
result = await client.execute_workflow(
|
|
"RustTestWorkflow",
|
|
{"target_id": target_id, "test_message": "Full flow test!"},
|
|
id=f"workflow-{target_id}",
|
|
task_queue="rust-queue"
|
|
)
|
|
|
|
print("✓ Workflow completed!")
|
|
print("Results:", result)
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(main())
|
|
```
|
|
|
|
```bash
|
|
# Install dependencies
|
|
pip install temporalio boto3
|
|
|
|
# Run test
|
|
python upload_and_run.py
|
|
```
|
|
|
|
## Step 5: Monitor Execution
|
|
|
|
### View in Temporal UI
|
|
|
|
1. Open http://localhost:8233
|
|
2. Click on "Workflows"
|
|
3. Find your workflow by ID
|
|
4. Click to see:
|
|
- Execution history
|
|
- Activity results
|
|
- Error stack traces (if any)
|
|
|
|
### View Logs
|
|
|
|
```bash
|
|
# Worker logs (shows activity execution)
|
|
docker logs -f fuzzforge-worker-rust
|
|
|
|
# Temporal server logs
|
|
docker logs -f fuzzforge-temporal
|
|
```
|
|
|
|
### Check MinIO Storage
|
|
|
|
1. Open http://localhost:9001
|
|
2. Login: `fuzzforge` / `fuzzforge123`
|
|
3. Browse buckets:
|
|
- `targets/` - Uploaded target files
|
|
- `results/` - Workflow results (if uploaded)
|
|
- `cache/` - Worker cache (temporary)
|
|
|
|
## Troubleshooting
|
|
|
|
### Services Not Starting
|
|
|
|
```bash
|
|
# Check logs for all services
|
|
docker-compose -f docker-compose.temporal.yaml logs
|
|
|
|
# Check specific service
|
|
docker-compose -f docker-compose.temporal.yaml logs temporal
|
|
docker-compose -f docker-compose.temporal.yaml logs minio
|
|
docker-compose -f docker-compose.temporal.yaml logs worker-rust
|
|
```
|
|
|
|
### Worker Not Discovering Workflows
|
|
|
|
**Issue**: Worker logs show "No workflows found for vertical: rust"
|
|
|
|
**Solution**:
|
|
1. Check toolbox mount: `docker exec fuzzforge-worker-rust ls /app/toolbox/workflows`
|
|
2. Verify metadata.yaml exists and has `vertical: rust`
|
|
3. Check workflow.py has `@workflow.defn` decorator
|
|
|
|
### Cannot Connect to Temporal
|
|
|
|
**Issue**: `Failed to connect to Temporal`
|
|
|
|
**Solution**:
|
|
```bash
|
|
# Wait for Temporal to be healthy
|
|
docker-compose -f docker-compose.temporal.yaml ps
|
|
|
|
# Check Temporal health manually
|
|
curl http://localhost:8233
|
|
|
|
# Restart Temporal if needed
|
|
docker-compose -f docker-compose.temporal.yaml restart temporal
|
|
```
|
|
|
|
### MinIO Connection Failed
|
|
|
|
**Issue**: `Failed to download target`
|
|
|
|
**Solution**:
|
|
```bash
|
|
# Check MinIO is running
|
|
docker ps | grep minio
|
|
|
|
# Check buckets exist
|
|
docker exec fuzzforge-minio mc ls fuzzforge/
|
|
|
|
# Verify target was uploaded
|
|
docker exec fuzzforge-minio mc ls fuzzforge/targets/
|
|
```
|
|
|
|
### Workflow Hangs
|
|
|
|
**Issue**: Workflow starts but never completes
|
|
|
|
**Check**:
|
|
1. Worker logs for errors: `docker logs fuzzforge-worker-rust`
|
|
2. Activity timeouts in workflow code
|
|
3. Target file actually exists in MinIO
|
|
|
|
## Scaling
|
|
|
|
### Add More Workers
|
|
|
|
```bash
|
|
# Scale rust workers horizontally
|
|
docker-compose -f docker-compose.temporal.yaml up -d --scale worker-rust=3
|
|
|
|
# Verify all workers are running
|
|
docker ps | grep worker-rust
|
|
```
|
|
|
|
### Increase Concurrent Activities
|
|
|
|
Edit `docker-compose.temporal.yaml`:
|
|
|
|
```yaml
|
|
worker-rust:
|
|
environment:
|
|
MAX_CONCURRENT_ACTIVITIES: 10 # Increase from 5
|
|
```
|
|
|
|
```bash
|
|
# Apply changes
|
|
docker-compose -f docker-compose.temporal.yaml up -d worker-rust
|
|
```
|
|
|
|
## Cleanup
|
|
|
|
```bash
|
|
# Stop all services
|
|
docker-compose -f docker-compose.temporal.yaml down
|
|
|
|
# Remove volumes (WARNING: deletes all data)
|
|
docker-compose -f docker-compose.temporal.yaml down -v
|
|
|
|
# Remove everything including images
|
|
docker-compose -f docker-compose.temporal.yaml down -v --rmi all
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
1. **Add More Workflows**: Create workflows in `backend/toolbox/workflows/`
|
|
2. **Add More Verticals**: Create new worker types (android, web, etc.) - see `workers/README.md`
|
|
3. **Integrate with Backend**: Update FastAPI backend to use Temporal client
|
|
4. **Update CLI**: Modify `ff` CLI to work with Temporal workflows
|
|
|
|
## Useful Commands
|
|
|
|
```bash
|
|
# View all logs
|
|
docker-compose -f docker-compose.temporal.yaml logs -f
|
|
|
|
# View specific service logs
|
|
docker-compose -f docker-compose.temporal.yaml logs -f worker-rust
|
|
|
|
# Restart a service
|
|
docker-compose -f docker-compose.temporal.yaml restart worker-rust
|
|
|
|
# Check service status
|
|
docker-compose -f docker-compose.temporal.yaml ps
|
|
|
|
# Execute command in worker
|
|
docker exec -it fuzzforge-worker-rust bash
|
|
|
|
# View worker Python environment
|
|
docker exec fuzzforge-worker-rust pip list
|
|
|
|
# Check workflow discovery manually
|
|
docker exec fuzzforge-worker-rust python -c "
|
|
from pathlib import Path
|
|
import yaml
|
|
for w in Path('/app/toolbox/workflows').iterdir():
|
|
if w.is_dir():
|
|
meta = w / 'metadata.yaml'
|
|
if meta.exists():
|
|
print(f'{w.name}: {yaml.safe_load(meta.read_text()).get(\"vertical\")}')"
|
|
```
|
|
|
|
## Architecture Overview
|
|
|
|
```
|
|
┌─────────────┐ ┌──────────────┐ ┌──────────────┐
|
|
│ Temporal │────▶│ Task Queue │────▶│ Worker-Rust │
|
|
│ Server │ │ rust-queue │ │ (Long-lived)│
|
|
└─────────────┘ └──────────────┘ └──────┬───────┘
|
|
│ │
|
|
│ │
|
|
▼ ▼
|
|
┌─────────────┐ ┌──────────────┐
|
|
│ Postgres │ │ MinIO │
|
|
│ (State) │ │ (Storage) │
|
|
└─────────────┘ └──────────────┘
|
|
│
|
|
┌──────┴──────┐
|
|
│ │
|
|
┌────▼────┐ ┌─────▼────┐
|
|
│ Targets │ │ Results │
|
|
└─────────┘ └──────────┘
|
|
```
|
|
|
|
## Support
|
|
|
|
- **Documentation**: See `ARCHITECTURE.md` for detailed design
|
|
- **Worker Guide**: See `workers/README.md` for adding verticals
|
|
- **Issues**: Open GitHub issue with logs and steps to reproduce
|