mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-02-12 21:52:47 +00:00
* feat: Complete migration from Prefect to Temporal BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal ## Major Changes - Replace Prefect with Temporal for workflow orchestration - Implement vertical worker architecture (rust, android) - Replace Docker registry with MinIO for unified storage - Refactor activities to be co-located with workflows - Update all API endpoints for Temporal compatibility ## Infrastructure - New: docker-compose.temporal.yaml (Temporal + MinIO + workers) - New: workers/ directory with rust and android vertical workers - New: backend/src/temporal/ (manager, discovery) - New: backend/src/storage/ (S3-cached storage with MinIO) - New: backend/toolbox/common/ (shared storage activities) - Deleted: docker-compose.yaml (old Prefect setup) - Deleted: backend/src/core/prefect_manager.py - Deleted: backend/src/services/prefect_stats_monitor.py - Deleted: Docker registry and insecure-registries requirement ## Workflows - Migrated: security_assessment workflow to Temporal - New: rust_test workflow (example/test workflow) - Deleted: secret_detection_scan (Prefect-based, to be reimplemented) - Activities now co-located with workflows for independent testing ## API Changes - Updated: backend/src/api/workflows.py (Temporal submission) - Updated: backend/src/api/runs.py (Temporal status/results) - Updated: backend/src/main.py (727 lines, TemporalManager integration) - Updated: All 16 MCP tools to use TemporalManager ## Testing - ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend) - ✅ All API endpoints functional - ✅ End-to-end workflow test passed (72 findings from vulnerable_app) - ✅ MinIO storage integration working (target upload/download, results) - ✅ Worker activity discovery working (6 activities registered) - ✅ Tarball extraction working - ✅ SARIF report generation working ## Documentation - ARCHITECTURE.md: Complete Temporal architecture documentation - QUICKSTART_TEMPORAL.md: Getting started guide - MIGRATION_DECISION.md: Why we chose Temporal over Prefect - IMPLEMENTATION_STATUS.md: Migration progress tracking - workers/README.md: Worker development guide ## Dependencies - Added: temporalio>=1.6.0 - Added: boto3>=1.34.0 (MinIO S3 client) - Removed: prefect>=3.4.18 * feat: Add Python fuzzing vertical with Atheris integration This commit implements a complete Python fuzzing workflow using Atheris: ## Python Worker (workers/python/) - Dockerfile with Python 3.11, Atheris, and build tools - Generic worker.py for dynamic workflow discovery - requirements.txt with temporalio, boto3, atheris dependencies - Added to docker-compose.temporal.yaml with dedicated cache volume ## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/) - Reusable module extending BaseModule - Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py) - Recursive search to find targets in nested directories - Dynamically loads TestOneInput() function - Configurable max_iterations and timeout - Real-time stats callback support for live monitoring - Returns findings as ModuleFinding objects ## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/) - Temporal workflow for orchestrating fuzzing - Downloads user code from MinIO - Executes AtherisFuzzer module - Uploads results to MinIO - Cleans up cache after execution - metadata.yaml with vertical: python for routing ## Test Project (test_projects/python_fuzz_waterfall/) - Demonstrates stateful waterfall vulnerability - main.py with check_secret() that leaks progress - fuzz_target.py with Atheris TestOneInput() harness - Complete README with usage instructions ## Backend Fixes - Fixed parameter merging in REST API endpoints (workflows.py) - Changed workflow parameter passing from positional args to kwargs (manager.py) - Default parameters now properly merged with user parameters ## Testing ✅ Worker discovered AtherisFuzzingWorkflow ✅ Workflow executed end-to-end successfully ✅ Fuzz target auto-discovered in nested directories ✅ Atheris ran 100,000 iterations ✅ Results uploaded and cache cleaned * chore: Complete Temporal migration with updated CLI/SDK/docs This commit includes all remaining Temporal migration changes: ## CLI Updates (cli/) - Updated workflow execution commands for Temporal - Enhanced error handling and exceptions - Updated dependencies in uv.lock ## SDK Updates (sdk/) - Client methods updated for Temporal workflows - Updated models for new workflow execution - Updated dependencies in uv.lock ## Documentation Updates (docs/) - Architecture documentation for Temporal - Workflow concept documentation - Resource management documentation (new) - Debugging guide (new) - Updated tutorials and how-to guides - Troubleshooting updates ## README Updates - Main README with Temporal instructions - Backend README - CLI README - SDK README ## Other - Updated IMPLEMENTATION_STATUS.md - Removed old vulnerable_app.tar.gz These changes complete the Temporal migration and ensure the CLI/SDK work correctly with the new backend. * fix: Use positional args instead of kwargs for Temporal workflows The Temporal Python SDK's start_workflow() method doesn't accept a 'kwargs' parameter. Workflows must receive parameters as positional arguments via the 'args' parameter. Changed from: args=workflow_args # Positional arguments This fixes the error: TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs' Workflows now correctly receive parameters in order: - security_assessment: [target_id, scanner_config, analyzer_config, reporter_config] - atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds] - rust_test: [target_id, test_message] * fix: Filter metadata-only parameters from workflow arguments SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5. The issue was that target_path and volume_mode from default_parameters were being passed to the workflow, when they should only be used by the system for configuration. Now filters out metadata-only parameters (target_path, volume_mode) before passing arguments to workflow execution. * refactor: Remove Prefect leftovers and volume mounting legacy Complete cleanup of Prefect migration artifacts: Backend: - Delete registry.py and workflow_discovery.py (Prefect-specific files) - Remove Docker validation from setup.py (no longer needed) - Remove ResourceLimits and VolumeMount models - Remove target_path and volume_mode from WorkflowSubmission - Remove supported_volume_modes from API and discovery - Clean up metadata.yaml files (remove volume/path fields) - Simplify parameter filtering in manager.py SDK: - Remove volume_mode parameter from client methods - Remove ResourceLimits and VolumeMount models - Remove Prefect error patterns from docker_logs.py - Clean up WorkflowSubmission and WorkflowMetadata models CLI: - Remove Volume Modes display from workflow info All removed features are Prefect-specific or Docker volume mounting artifacts. Temporal workflows use MinIO storage exclusively. * feat: Add comprehensive test suite and benchmark infrastructure - Add 68 unit tests for fuzzer, scanner, and analyzer modules - Implement pytest-based test infrastructure with fixtures - Add 6 performance benchmarks with category-specific thresholds - Configure GitHub Actions for automated testing and benchmarking - Add test and benchmark documentation Test coverage: - AtherisFuzzer: 8 tests - CargoFuzzer: 14 tests - FileScanner: 22 tests - SecurityAnalyzer: 24 tests All tests passing (68/68) All benchmarks passing (6/6) * fix: Resolve all ruff linting violations across codebase Fixed 27 ruff violations in 12 files: - Removed unused imports (Depends, Dict, Any, Optional, etc.) - Fixed undefined workflow_info variable in workflows.py - Removed dead code with undefined variables in atheris_fuzzer.py - Changed f-string to regular string where no placeholders used All files now pass ruff checks for CI/CD compliance. * fix: Configure CI for unit tests only - Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility - Commented out integration-tests job (no integration tests yet) - Updated test-summary to only depend on lint and unit-tests CI will now run successfully with 68 unit tests. Integration tests can be added later. * feat: Add CI/CD integration with ephemeral deployment model Implements comprehensive CI/CD support for FuzzForge with on-demand worker management: **Worker Management (v0.7.0)** - Add WorkerManager for automatic worker lifecycle control - Auto-start workers from stopped state when workflows execute - Auto-stop workers after workflow completion - Health checks and startup timeout handling (90s default) **CI/CD Features** - `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info) - `--export-sarif` flag: Export findings in SARIF 2.1.0 format - `--auto-start`/`--auto-stop` flags: Control worker lifecycle - Exit code propagation: Returns 1 on blocking findings, 0 on success **Exit Code Fix** - Add `except typer.Exit: raise` handlers at 3 critical locations - Move worker cleanup to finally block for guaranteed execution - Exit codes now propagate correctly even when build fails **CI Scripts & Examples** - ci-start.sh: Start FuzzForge services with health checks - ci-stop.sh: Clean shutdown with volume preservation option - GitHub Actions workflow example (security-scan.yml) - GitLab CI pipeline example (.gitlab-ci.example.yml) - docker-compose.ci.yml: CI-optimized compose file with profiles **OSS-Fuzz Integration** - New ossfuzz_campaign workflow for running OSS-Fuzz projects - OSS-Fuzz worker with Docker-in-Docker support - Configurable campaign duration and project selection **Documentation** - Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md) - Updated architecture docs with worker lifecycle details - Updated workspace isolation documentation - CLI README with worker management examples **SDK Enhancements** - Add get_workflow_worker_info() endpoint - Worker vertical metadata in workflow responses **Testing** - All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing - All monitoring commands tested: stats, crashes, status, finding - Full CI pipeline simulation verified - Exit codes verified for success/failure scenarios Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers. * fix: Resolve ruff linting violations in CI/CD code - Remove unused variables (run_id, defaults, result) - Remove unused imports - Fix f-string without placeholders All CI/CD integration files now pass ruff checks.
323 lines
9.9 KiB
Python
323 lines
9.9 KiB
Python
#!/usr/bin/env python3
|
|
# Copyright (c) 2025 FuzzingLabs
|
|
#
|
|
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
|
|
# at the root of this repository for details.
|
|
#
|
|
# After the Change Date (four years from publication), this version of the
|
|
# Licensed Work will be made available under the Apache License, Version 2.0.
|
|
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Additional attribution and requirements are provided in the NOTICE file.
|
|
|
|
"""
|
|
Install shell completion for FuzzForge CLI.
|
|
|
|
This script installs completion using Typer's built-in --install-completion command.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
import subprocess
|
|
from pathlib import Path
|
|
import typer
|
|
|
|
|
|
def run_fuzzforge_completion_install(shell: str) -> bool:
|
|
"""Install completion using the fuzzforge CLI itself."""
|
|
try:
|
|
# Use the CLI's built-in completion installation
|
|
result = subprocess.run([
|
|
sys.executable, "-m", "fuzzforge_cli.main",
|
|
"--install-completion", shell
|
|
], capture_output=True, text=True, cwd=Path(__file__).parent.parent)
|
|
|
|
if result.returncode == 0:
|
|
print(f"✅ {shell.capitalize()} completion installed successfully")
|
|
return True
|
|
else:
|
|
print(f"❌ Failed to install {shell} completion: {result.stderr}")
|
|
return False
|
|
|
|
except Exception as e:
|
|
print(f"❌ Error installing {shell} completion: {e}")
|
|
return False
|
|
|
|
|
|
def create_manual_completion_scripts():
|
|
"""Create manual completion scripts as fallback."""
|
|
scripts = {
|
|
"bash": '''
|
|
# FuzzForge CLI completion for bash
|
|
_fuzzforge_completion() {
|
|
local IFS=$'\\t'
|
|
local response
|
|
|
|
response=$(env COMP_WORDS="${COMP_WORDS[*]}" COMP_CWORD=$COMP_CWORD _FUZZFORGE_COMPLETE=bash_complete $1)
|
|
|
|
for completion in $response; do
|
|
IFS=',' read type value <<< "$completion"
|
|
|
|
if [[ $type == 'dir' ]]; then
|
|
COMPREPLY=()
|
|
compopt -o dirnames
|
|
elif [[ $type == 'file' ]]; then
|
|
COMPREPLY=()
|
|
compopt -o default
|
|
elif [[ $type == 'plain' ]]; then
|
|
COMPREPLY+=($value)
|
|
fi
|
|
done
|
|
|
|
return 0
|
|
}
|
|
|
|
complete -o nosort -F _fuzzforge_completion fuzzforge
|
|
''',
|
|
|
|
"zsh": '''
|
|
#compdef fuzzforge
|
|
|
|
_fuzzforge_completion() {
|
|
local -a completions
|
|
local -a completions_with_descriptions
|
|
local -a response
|
|
response=(${(f)"$(env COMP_WORDS="${words[*]}" COMP_CWORD=$((CURRENT-1)) _FUZZFORGE_COMPLETE=zsh_complete fuzzforge)"})
|
|
|
|
for type_and_line in $response; do
|
|
if [[ "$type_and_line" =~ ^([^,]*),(.*)$ ]]; then
|
|
local type="$match[1]"
|
|
local line="$match[2]"
|
|
|
|
if [[ "$type" == "dir" ]]; then
|
|
_path_files -/
|
|
elif [[ "$type" == "file" ]]; then
|
|
_path_files -f
|
|
elif [[ "$type" == "plain" ]]; then
|
|
if [[ "$line" =~ ^([^:]*):(.*)$ ]]; then
|
|
completions_with_descriptions+=("$match[1]":"$match[2]")
|
|
else
|
|
completions+=("$line")
|
|
fi
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if [ -n "$completions_with_descriptions" ]; then
|
|
_describe "" completions_with_descriptions -V unsorted
|
|
fi
|
|
|
|
if [ -n "$completions" ]; then
|
|
compadd -U -V unsorted -a completions
|
|
fi
|
|
}
|
|
|
|
compdef _fuzzforge_completion fuzzforge;
|
|
''',
|
|
|
|
"fish": '''
|
|
# FuzzForge CLI completion for fish
|
|
function __fuzzforge_completion
|
|
set -l response
|
|
|
|
for value in (env _FUZZFORGE_COMPLETE=fish_complete COMP_WORDS=(commandline -cp) COMP_CWORD=(commandline -t) fuzzforge)
|
|
set response $response $value
|
|
end
|
|
|
|
for completion in $response
|
|
set -l metadata (string split "," $completion)
|
|
|
|
if test $metadata[1] = "dir"
|
|
__fish_complete_directories $metadata[2]
|
|
else if test $metadata[1] = "file"
|
|
__fish_complete_path $metadata[2]
|
|
else if test $metadata[1] = "plain"
|
|
echo $metadata[2]
|
|
end
|
|
end
|
|
end
|
|
|
|
complete --no-files --command fuzzforge --arguments "(__fuzzforge_completion)"
|
|
'''
|
|
}
|
|
|
|
return scripts
|
|
|
|
|
|
def install_bash_completion():
|
|
"""Install bash completion."""
|
|
print("📝 Installing bash completion...")
|
|
|
|
# Get the manual completion script
|
|
scripts = create_manual_completion_scripts()
|
|
completion_script = scripts["bash"]
|
|
|
|
# Try different locations for bash completion
|
|
completion_dirs = [
|
|
Path.home() / ".bash_completion.d",
|
|
Path("/usr/local/etc/bash_completion.d"),
|
|
Path("/etc/bash_completion.d")
|
|
]
|
|
|
|
for completion_dir in completion_dirs:
|
|
try:
|
|
completion_dir.mkdir(exist_ok=True)
|
|
completion_file = completion_dir / "fuzzforge"
|
|
completion_file.write_text(completion_script)
|
|
print(f"✅ Bash completion installed to: {completion_file}")
|
|
|
|
# Add source line to .bashrc if not present
|
|
bashrc = Path.home() / ".bashrc"
|
|
source_line = f"source {completion_file}"
|
|
|
|
if bashrc.exists():
|
|
bashrc_content = bashrc.read_text()
|
|
if source_line not in bashrc_content:
|
|
with bashrc.open("a") as f:
|
|
f.write(f"\n# FuzzForge CLI completion\n{source_line}\n")
|
|
print("✅ Added completion source to ~/.bashrc")
|
|
|
|
return True
|
|
except PermissionError:
|
|
continue
|
|
except Exception as e:
|
|
print(f"❌ Failed to install bash completion: {e}")
|
|
continue
|
|
|
|
print("❌ Could not install bash completion (permission denied)")
|
|
return False
|
|
|
|
|
|
def install_zsh_completion():
|
|
"""Install zsh completion."""
|
|
print("📝 Installing zsh completion...")
|
|
|
|
# Get the manual completion script
|
|
scripts = create_manual_completion_scripts()
|
|
completion_script = scripts["zsh"]
|
|
|
|
# Create completion directory
|
|
comp_dir = Path.home() / ".zsh" / "completions"
|
|
comp_dir.mkdir(parents=True, exist_ok=True)
|
|
|
|
try:
|
|
completion_file = comp_dir / "_fuzzforge"
|
|
completion_file.write_text(completion_script)
|
|
print(f"✅ Zsh completion installed to: {completion_file}")
|
|
|
|
# Add fpath to .zshrc if not present
|
|
zshrc = Path.home() / ".zshrc"
|
|
fpath_line = 'fpath=(~/.zsh/completions $fpath)'
|
|
autoload_line = 'autoload -U compinit && compinit'
|
|
|
|
if zshrc.exists():
|
|
zshrc_content = zshrc.read_text()
|
|
lines_to_add = []
|
|
|
|
if fpath_line not in zshrc_content:
|
|
lines_to_add.append(fpath_line)
|
|
|
|
if autoload_line not in zshrc_content:
|
|
lines_to_add.append(autoload_line)
|
|
|
|
if lines_to_add:
|
|
with zshrc.open("a") as f:
|
|
f.write("\n# FuzzForge CLI completion\n")
|
|
for line in lines_to_add:
|
|
f.write(f"{line}\n")
|
|
print("✅ Added completion setup to ~/.zshrc")
|
|
|
|
return True
|
|
except Exception as e:
|
|
print(f"❌ Failed to install zsh completion: {e}")
|
|
return False
|
|
|
|
|
|
def install_fish_completion():
|
|
"""Install fish completion."""
|
|
print("📝 Installing fish completion...")
|
|
|
|
# Get the manual completion script
|
|
scripts = create_manual_completion_scripts()
|
|
completion_script = scripts["fish"]
|
|
|
|
# Fish completion directory
|
|
comp_dir = Path.home() / ".config" / "fish" / "completions"
|
|
comp_dir.mkdir(parents=True, exist_ok=True)
|
|
|
|
try:
|
|
completion_file = comp_dir / "fuzzforge.fish"
|
|
completion_file.write_text(completion_script)
|
|
print(f"✅ Fish completion installed to: {completion_file}")
|
|
return True
|
|
except Exception as e:
|
|
print(f"❌ Failed to install fish completion: {e}")
|
|
return False
|
|
|
|
|
|
def detect_shell():
|
|
"""Detect the current shell."""
|
|
shell_path = os.environ.get('SHELL', '')
|
|
if 'bash' in shell_path:
|
|
return 'bash'
|
|
elif 'zsh' in shell_path:
|
|
return 'zsh'
|
|
elif 'fish' in shell_path:
|
|
return 'fish'
|
|
else:
|
|
return None
|
|
|
|
|
|
def main():
|
|
"""Install completion for the current shell or all shells."""
|
|
print("🚀 FuzzForge CLI Completion Installer")
|
|
print("=" * 50)
|
|
|
|
current_shell = detect_shell()
|
|
if current_shell:
|
|
print(f"🐚 Detected shell: {current_shell}")
|
|
|
|
# Check for command line arguments
|
|
if len(sys.argv) > 1 and sys.argv[1] == "--all":
|
|
install_all = True
|
|
print("Installing completion for all shells...")
|
|
else:
|
|
# Ask user which shells to install (with default to current shell only)
|
|
if current_shell:
|
|
install_all = typer.confirm("Install completion for all supported shells (bash, zsh, fish)?", default=False)
|
|
if not install_all:
|
|
print(f"Installing completion for {current_shell} only...")
|
|
else:
|
|
install_all = typer.confirm("Install completion for all supported shells (bash, zsh, fish)?", default=True)
|
|
|
|
success_count = 0
|
|
|
|
if install_all or current_shell == 'bash':
|
|
if install_bash_completion():
|
|
success_count += 1
|
|
|
|
if install_all or current_shell == 'zsh':
|
|
if install_zsh_completion():
|
|
success_count += 1
|
|
|
|
if install_all or current_shell == 'fish':
|
|
if install_fish_completion():
|
|
success_count += 1
|
|
|
|
print("\n" + "=" * 50)
|
|
if success_count > 0:
|
|
print(f"✅ Successfully installed completion for {success_count} shell(s)!")
|
|
print("\n📋 To activate completion:")
|
|
print(" • Bash: Restart your terminal or run 'source ~/.bashrc'")
|
|
print(" • Zsh: Restart your terminal or run 'source ~/.zshrc'")
|
|
print(" • Fish: Completion is active immediately")
|
|
print("\n💡 Try typing 'fuzzforge <TAB>' to test completion!")
|
|
else:
|
|
print("❌ No completions were installed successfully.")
|
|
return 1
|
|
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main()) |