mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-02-13 20:32:45 +00:00
* feat: Complete migration from Prefect to Temporal BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal ## Major Changes - Replace Prefect with Temporal for workflow orchestration - Implement vertical worker architecture (rust, android) - Replace Docker registry with MinIO for unified storage - Refactor activities to be co-located with workflows - Update all API endpoints for Temporal compatibility ## Infrastructure - New: docker-compose.temporal.yaml (Temporal + MinIO + workers) - New: workers/ directory with rust and android vertical workers - New: backend/src/temporal/ (manager, discovery) - New: backend/src/storage/ (S3-cached storage with MinIO) - New: backend/toolbox/common/ (shared storage activities) - Deleted: docker-compose.yaml (old Prefect setup) - Deleted: backend/src/core/prefect_manager.py - Deleted: backend/src/services/prefect_stats_monitor.py - Deleted: Docker registry and insecure-registries requirement ## Workflows - Migrated: security_assessment workflow to Temporal - New: rust_test workflow (example/test workflow) - Deleted: secret_detection_scan (Prefect-based, to be reimplemented) - Activities now co-located with workflows for independent testing ## API Changes - Updated: backend/src/api/workflows.py (Temporal submission) - Updated: backend/src/api/runs.py (Temporal status/results) - Updated: backend/src/main.py (727 lines, TemporalManager integration) - Updated: All 16 MCP tools to use TemporalManager ## Testing - ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend) - ✅ All API endpoints functional - ✅ End-to-end workflow test passed (72 findings from vulnerable_app) - ✅ MinIO storage integration working (target upload/download, results) - ✅ Worker activity discovery working (6 activities registered) - ✅ Tarball extraction working - ✅ SARIF report generation working ## Documentation - ARCHITECTURE.md: Complete Temporal architecture documentation - QUICKSTART_TEMPORAL.md: Getting started guide - MIGRATION_DECISION.md: Why we chose Temporal over Prefect - IMPLEMENTATION_STATUS.md: Migration progress tracking - workers/README.md: Worker development guide ## Dependencies - Added: temporalio>=1.6.0 - Added: boto3>=1.34.0 (MinIO S3 client) - Removed: prefect>=3.4.18 * feat: Add Python fuzzing vertical with Atheris integration This commit implements a complete Python fuzzing workflow using Atheris: ## Python Worker (workers/python/) - Dockerfile with Python 3.11, Atheris, and build tools - Generic worker.py for dynamic workflow discovery - requirements.txt with temporalio, boto3, atheris dependencies - Added to docker-compose.temporal.yaml with dedicated cache volume ## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/) - Reusable module extending BaseModule - Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py) - Recursive search to find targets in nested directories - Dynamically loads TestOneInput() function - Configurable max_iterations and timeout - Real-time stats callback support for live monitoring - Returns findings as ModuleFinding objects ## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/) - Temporal workflow for orchestrating fuzzing - Downloads user code from MinIO - Executes AtherisFuzzer module - Uploads results to MinIO - Cleans up cache after execution - metadata.yaml with vertical: python for routing ## Test Project (test_projects/python_fuzz_waterfall/) - Demonstrates stateful waterfall vulnerability - main.py with check_secret() that leaks progress - fuzz_target.py with Atheris TestOneInput() harness - Complete README with usage instructions ## Backend Fixes - Fixed parameter merging in REST API endpoints (workflows.py) - Changed workflow parameter passing from positional args to kwargs (manager.py) - Default parameters now properly merged with user parameters ## Testing ✅ Worker discovered AtherisFuzzingWorkflow ✅ Workflow executed end-to-end successfully ✅ Fuzz target auto-discovered in nested directories ✅ Atheris ran 100,000 iterations ✅ Results uploaded and cache cleaned * chore: Complete Temporal migration with updated CLI/SDK/docs This commit includes all remaining Temporal migration changes: ## CLI Updates (cli/) - Updated workflow execution commands for Temporal - Enhanced error handling and exceptions - Updated dependencies in uv.lock ## SDK Updates (sdk/) - Client methods updated for Temporal workflows - Updated models for new workflow execution - Updated dependencies in uv.lock ## Documentation Updates (docs/) - Architecture documentation for Temporal - Workflow concept documentation - Resource management documentation (new) - Debugging guide (new) - Updated tutorials and how-to guides - Troubleshooting updates ## README Updates - Main README with Temporal instructions - Backend README - CLI README - SDK README ## Other - Updated IMPLEMENTATION_STATUS.md - Removed old vulnerable_app.tar.gz These changes complete the Temporal migration and ensure the CLI/SDK work correctly with the new backend. * fix: Use positional args instead of kwargs for Temporal workflows The Temporal Python SDK's start_workflow() method doesn't accept a 'kwargs' parameter. Workflows must receive parameters as positional arguments via the 'args' parameter. Changed from: args=workflow_args # Positional arguments This fixes the error: TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs' Workflows now correctly receive parameters in order: - security_assessment: [target_id, scanner_config, analyzer_config, reporter_config] - atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds] - rust_test: [target_id, test_message] * fix: Filter metadata-only parameters from workflow arguments SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5. The issue was that target_path and volume_mode from default_parameters were being passed to the workflow, when they should only be used by the system for configuration. Now filters out metadata-only parameters (target_path, volume_mode) before passing arguments to workflow execution. * refactor: Remove Prefect leftovers and volume mounting legacy Complete cleanup of Prefect migration artifacts: Backend: - Delete registry.py and workflow_discovery.py (Prefect-specific files) - Remove Docker validation from setup.py (no longer needed) - Remove ResourceLimits and VolumeMount models - Remove target_path and volume_mode from WorkflowSubmission - Remove supported_volume_modes from API and discovery - Clean up metadata.yaml files (remove volume/path fields) - Simplify parameter filtering in manager.py SDK: - Remove volume_mode parameter from client methods - Remove ResourceLimits and VolumeMount models - Remove Prefect error patterns from docker_logs.py - Clean up WorkflowSubmission and WorkflowMetadata models CLI: - Remove Volume Modes display from workflow info All removed features are Prefect-specific or Docker volume mounting artifacts. Temporal workflows use MinIO storage exclusively. * feat: Add comprehensive test suite and benchmark infrastructure - Add 68 unit tests for fuzzer, scanner, and analyzer modules - Implement pytest-based test infrastructure with fixtures - Add 6 performance benchmarks with category-specific thresholds - Configure GitHub Actions for automated testing and benchmarking - Add test and benchmark documentation Test coverage: - AtherisFuzzer: 8 tests - CargoFuzzer: 14 tests - FileScanner: 22 tests - SecurityAnalyzer: 24 tests All tests passing (68/68) All benchmarks passing (6/6) * fix: Resolve all ruff linting violations across codebase Fixed 27 ruff violations in 12 files: - Removed unused imports (Depends, Dict, Any, Optional, etc.) - Fixed undefined workflow_info variable in workflows.py - Removed dead code with undefined variables in atheris_fuzzer.py - Changed f-string to regular string where no placeholders used All files now pass ruff checks for CI/CD compliance. * fix: Configure CI for unit tests only - Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility - Commented out integration-tests job (no integration tests yet) - Updated test-summary to only depend on lint and unit-tests CI will now run successfully with 68 unit tests. Integration tests can be added later. * feat: Add CI/CD integration with ephemeral deployment model Implements comprehensive CI/CD support for FuzzForge with on-demand worker management: **Worker Management (v0.7.0)** - Add WorkerManager for automatic worker lifecycle control - Auto-start workers from stopped state when workflows execute - Auto-stop workers after workflow completion - Health checks and startup timeout handling (90s default) **CI/CD Features** - `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info) - `--export-sarif` flag: Export findings in SARIF 2.1.0 format - `--auto-start`/`--auto-stop` flags: Control worker lifecycle - Exit code propagation: Returns 1 on blocking findings, 0 on success **Exit Code Fix** - Add `except typer.Exit: raise` handlers at 3 critical locations - Move worker cleanup to finally block for guaranteed execution - Exit codes now propagate correctly even when build fails **CI Scripts & Examples** - ci-start.sh: Start FuzzForge services with health checks - ci-stop.sh: Clean shutdown with volume preservation option - GitHub Actions workflow example (security-scan.yml) - GitLab CI pipeline example (.gitlab-ci.example.yml) - docker-compose.ci.yml: CI-optimized compose file with profiles **OSS-Fuzz Integration** - New ossfuzz_campaign workflow for running OSS-Fuzz projects - OSS-Fuzz worker with Docker-in-Docker support - Configurable campaign duration and project selection **Documentation** - Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md) - Updated architecture docs with worker lifecycle details - Updated workspace isolation documentation - CLI README with worker management examples **SDK Enhancements** - Add get_workflow_worker_info() endpoint - Worker vertical metadata in workflow responses **Testing** - All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing - All monitoring commands tested: stats, crashes, status, finding - Full CI pipeline simulation verified - Exit codes verified for success/failure scenarios Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers. * fix: Resolve ruff linting violations in CI/CD code - Remove unused variables (run_id, defaults, result) - Remove unused imports - Fix f-string without placeholders All CI/CD integration files now pass ruff checks.
370 lines
12 KiB
Python
370 lines
12 KiB
Python
"""
|
|
Enhanced progress indicators and loading animations for FuzzForge CLI.
|
|
|
|
Provides rich progress bars, spinners, and status displays for all long-running operations.
|
|
"""
|
|
# Copyright (c) 2025 FuzzingLabs
|
|
#
|
|
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
|
|
# at the root of this repository for details.
|
|
#
|
|
# After the Change Date (four years from publication), this version of the
|
|
# Licensed Work will be made available under the Apache License, Version 2.0.
|
|
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Additional attribution and requirements are provided in the NOTICE file.
|
|
|
|
|
|
import time
|
|
from contextlib import contextmanager
|
|
from typing import Optional, Any, Dict, List
|
|
from datetime import datetime
|
|
|
|
from rich.console import Console
|
|
from rich.progress import (
|
|
Progress, SpinnerColumn, TextColumn, BarColumn, TaskProgressColumn,
|
|
TimeElapsedColumn, TimeRemainingColumn, MofNCompleteColumn
|
|
)
|
|
from rich.panel import Panel
|
|
from rich.live import Live
|
|
from rich.table import Table
|
|
from rich.text import Text
|
|
from rich import box
|
|
|
|
console = Console()
|
|
|
|
|
|
class ProgressManager:
|
|
"""Enhanced progress manager with multiple progress types."""
|
|
|
|
def __init__(self):
|
|
self.progress = None
|
|
self.live = None
|
|
|
|
def create_progress(self, show_speed: bool = False, show_eta: bool = False) -> Progress:
|
|
"""Create a rich progress instance with customizable columns."""
|
|
columns = [
|
|
SpinnerColumn(),
|
|
TextColumn("[bold blue]{task.description}"),
|
|
BarColumn(bar_width=40),
|
|
TaskProgressColumn(),
|
|
]
|
|
|
|
if show_speed:
|
|
columns.append(TextColumn("[cyan]{task.fields[speed]}/s"))
|
|
|
|
columns.extend([
|
|
TimeElapsedColumn(),
|
|
])
|
|
|
|
if show_eta:
|
|
columns.append(TimeRemainingColumn())
|
|
|
|
return Progress(*columns, console=console)
|
|
|
|
@contextmanager
|
|
def workflow_submission(self, workflow_name: str, target_path: str):
|
|
"""Progress context for workflow submission."""
|
|
with self.create_progress() as progress:
|
|
task = progress.add_task(
|
|
f"🚀 Submitting workflow: [yellow]{workflow_name}[/yellow]",
|
|
total=4
|
|
)
|
|
|
|
# Step 1: Validation
|
|
progress.update(task, description="🔍 Validating parameters...", advance=1)
|
|
yield progress, task
|
|
|
|
# Step 2: API Connection
|
|
progress.update(task, description="🌐 Connecting to API...", advance=1)
|
|
time.sleep(0.5) # Brief pause for visual feedback
|
|
|
|
# Step 3: Submission
|
|
progress.update(task, description="📤 Submitting workflow...", advance=1)
|
|
time.sleep(0.3)
|
|
|
|
# Step 4: Complete
|
|
progress.update(task, description="✅ Workflow submitted successfully!", advance=1)
|
|
|
|
@contextmanager
|
|
def data_export(self, format_type: str, record_count: int):
|
|
"""Progress context for data export operations."""
|
|
with self.create_progress(show_eta=True) as progress:
|
|
task = progress.add_task(
|
|
f"📊 Exporting {record_count} records as [yellow]{format_type.upper()}[/yellow]",
|
|
total=record_count
|
|
)
|
|
yield progress, task
|
|
|
|
@contextmanager
|
|
def file_operations(self, operation: str, file_count: int):
|
|
"""Progress context for file operations."""
|
|
with self.create_progress(show_eta=True) as progress:
|
|
task = progress.add_task(
|
|
f"📁 {operation} {file_count} files...",
|
|
total=file_count
|
|
)
|
|
yield progress, task
|
|
|
|
@contextmanager
|
|
def api_requests(self, operation: str, request_count: Optional[int] = None):
|
|
"""Progress context for API requests."""
|
|
if request_count:
|
|
with self.create_progress() as progress:
|
|
task = progress.add_task(
|
|
f"🌐 {operation}...",
|
|
total=request_count
|
|
)
|
|
yield progress, task
|
|
else:
|
|
# Indeterminate progress for unknown request count
|
|
with self.create_progress() as progress:
|
|
task = progress.add_task(
|
|
f"🌐 {operation}...",
|
|
total=None
|
|
)
|
|
yield progress, task
|
|
|
|
def create_live_stats_display(self) -> Dict[str, Any]:
|
|
"""Create a live statistics display layout."""
|
|
return {
|
|
"layout": None,
|
|
"stats_table": None,
|
|
"progress_bars": None
|
|
}
|
|
|
|
|
|
@contextmanager
|
|
def spinner(text: str, success_text: Optional[str] = None):
|
|
"""Simple spinner context manager for quick operations."""
|
|
with Progress(
|
|
SpinnerColumn(),
|
|
TextColumn("[bold blue]{task.description}"),
|
|
console=console
|
|
) as progress:
|
|
task = progress.add_task(text, total=None)
|
|
try:
|
|
yield progress
|
|
if success_text:
|
|
progress.update(task, description=f"✅ {success_text}")
|
|
time.sleep(0.5) # Brief pause to show success
|
|
except Exception as e:
|
|
progress.update(task, description=f"❌ Failed: {str(e)}")
|
|
time.sleep(0.5)
|
|
raise
|
|
|
|
|
|
@contextmanager
|
|
def step_progress(steps: List[str], title: str = "Processing"):
|
|
"""Multi-step progress with predefined steps."""
|
|
with Progress(
|
|
SpinnerColumn(),
|
|
TextColumn("[bold blue]{task.description}"),
|
|
BarColumn(bar_width=30),
|
|
MofNCompleteColumn(),
|
|
console=console
|
|
) as progress:
|
|
task = progress.add_task(f"🔄 {title}", total=len(steps))
|
|
|
|
class StepProgressController:
|
|
def __init__(self, progress_instance, task_id):
|
|
self.progress = progress_instance
|
|
self.task = task_id
|
|
self.current_step = 0
|
|
|
|
def next_step(self):
|
|
if self.current_step < len(steps):
|
|
step_text = steps[self.current_step]
|
|
self.progress.update(
|
|
self.task,
|
|
description=f"🔄 {step_text}",
|
|
advance=1
|
|
)
|
|
self.current_step += 1
|
|
|
|
def complete(self, success_text: str = "Completed"):
|
|
self.progress.update(
|
|
self.task,
|
|
description=f"✅ {success_text}",
|
|
completed=len(steps)
|
|
)
|
|
|
|
yield StepProgressController(progress, task)
|
|
|
|
|
|
def create_workflow_monitoring_display(run_id: str, workflow_name: str) -> Table:
|
|
"""Create a monitoring display for workflow execution."""
|
|
table = Table(show_header=False, box=box.ROUNDED)
|
|
table.add_column("Metric", style="bold cyan")
|
|
table.add_column("Value", justify="right")
|
|
|
|
table.add_row("Run ID", f"[dim]{run_id[:12]}...[/dim]")
|
|
table.add_row("Workflow", f"[yellow]{workflow_name}[/yellow]")
|
|
table.add_row("Status", "[orange]Running[/orange]")
|
|
table.add_row("Started", datetime.now().strftime("%H:%M:%S"))
|
|
|
|
return Panel.fit(
|
|
table,
|
|
title="🔄 Workflow Monitoring",
|
|
border_style="blue"
|
|
)
|
|
|
|
|
|
def create_fuzzing_progress_display(stats: Dict[str, Any]) -> Panel:
|
|
"""Create a rich display for fuzzing progress."""
|
|
# Main stats table
|
|
stats_table = Table(show_header=False, box=box.SIMPLE)
|
|
stats_table.add_column("Metric", style="bold")
|
|
stats_table.add_column("Value", justify="right", style="bold white")
|
|
|
|
stats_table.add_row("Executions", f"{stats.get('executions', 0):,}")
|
|
stats_table.add_row("Exec/sec", f"{stats.get('executions_per_sec', 0):.1f}")
|
|
stats_table.add_row("Crashes", f"[red]{stats.get('crashes', 0):,}[/red]")
|
|
stats_table.add_row("Coverage", f"{stats.get('coverage', 0):.1f}%")
|
|
|
|
# Progress bars
|
|
progress_table = Table(show_header=False, box=box.SIMPLE)
|
|
progress_table.add_column("Metric", style="bold")
|
|
progress_table.add_column("Progress", min_width=25)
|
|
|
|
# Execution rate progress (as percentage of target rate)
|
|
exec_rate = stats.get('executions_per_sec', 0)
|
|
target_rate = 1000 # Target 1000 exec/sec
|
|
exec_progress = min(100, (exec_rate / target_rate) * 100)
|
|
progress_table.add_row(
|
|
"Exec Rate",
|
|
create_progress_bar(exec_progress, color="green")
|
|
)
|
|
|
|
# Coverage progress
|
|
coverage = stats.get('coverage', 0)
|
|
progress_table.add_row(
|
|
"Coverage",
|
|
create_progress_bar(coverage, color="blue")
|
|
)
|
|
|
|
# Combine tables
|
|
combined = Table(show_header=False, box=None)
|
|
combined.add_column("Stats", ratio=1)
|
|
combined.add_column("Progress", ratio=1)
|
|
combined.add_row(stats_table, progress_table)
|
|
|
|
return Panel(
|
|
combined,
|
|
title="🎯 Fuzzing Progress",
|
|
border_style="green"
|
|
)
|
|
|
|
|
|
def create_progress_bar(percentage: float, color: str = "green", width: int = 20) -> Text:
|
|
"""Create a visual progress bar using Rich Text."""
|
|
filled = int((percentage / 100) * width)
|
|
bar = "█" * filled + "░" * (width - filled)
|
|
text = Text(bar, style=color)
|
|
text.append(f" {percentage:.1f}%", style="dim")
|
|
return text
|
|
|
|
|
|
def create_loading_animation(text: str) -> Live:
|
|
"""Create a loading animation with rotating spinner."""
|
|
frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"]
|
|
frame_index = 0
|
|
|
|
def get_spinner_frame():
|
|
nonlocal frame_index
|
|
frame = frames[frame_index]
|
|
frame_index = (frame_index + 1) % len(frames)
|
|
return frame
|
|
|
|
panel = Panel(
|
|
f"{get_spinner_frame()} [bold blue]{text}[/bold blue]",
|
|
box=box.ROUNDED,
|
|
border_style="cyan"
|
|
)
|
|
|
|
return Live(panel, auto_refresh=True, refresh_per_second=10)
|
|
|
|
|
|
class WorkflowProgressTracker:
|
|
"""Advanced progress tracker for workflow execution."""
|
|
|
|
def __init__(self, workflow_name: str, run_id: str):
|
|
self.workflow_name = workflow_name
|
|
self.run_id = run_id
|
|
self.start_time = datetime.now()
|
|
self.phases = []
|
|
self.current_phase = None
|
|
|
|
def add_phase(self, name: str, description: str, estimated_duration: Optional[int] = None):
|
|
"""Add a phase to the workflow progress."""
|
|
self.phases.append({
|
|
"name": name,
|
|
"description": description,
|
|
"estimated_duration": estimated_duration,
|
|
"start_time": None,
|
|
"end_time": None,
|
|
"status": "pending"
|
|
})
|
|
|
|
def start_phase(self, phase_name: str):
|
|
"""Start a specific phase."""
|
|
for phase in self.phases:
|
|
if phase["name"] == phase_name:
|
|
phase["start_time"] = datetime.now()
|
|
phase["status"] = "running"
|
|
self.current_phase = phase_name
|
|
break
|
|
|
|
def complete_phase(self, phase_name: str, success: bool = True):
|
|
"""Complete a specific phase."""
|
|
for phase in self.phases:
|
|
if phase["name"] == phase_name:
|
|
phase["end_time"] = datetime.now()
|
|
phase["status"] = "completed" if success else "failed"
|
|
self.current_phase = None
|
|
break
|
|
|
|
def get_progress_display(self) -> Panel:
|
|
"""Get the current progress display."""
|
|
# Create progress table
|
|
table = Table(show_header=True, box=box.ROUNDED)
|
|
table.add_column("Phase", style="bold")
|
|
table.add_column("Status", justify="center")
|
|
table.add_column("Duration")
|
|
|
|
for phase in self.phases:
|
|
status_emoji = {
|
|
"pending": "⏳",
|
|
"running": "🔄",
|
|
"completed": "✅",
|
|
"failed": "❌"
|
|
}
|
|
|
|
status_text = f"{status_emoji.get(phase['status'], '❓')} {phase['status'].title()}"
|
|
|
|
# Calculate duration
|
|
if phase["start_time"]:
|
|
end_time = phase["end_time"] or datetime.now()
|
|
duration = end_time - phase["start_time"]
|
|
duration_text = f"{duration.seconds}s"
|
|
else:
|
|
duration_text = "-"
|
|
|
|
table.add_row(
|
|
phase["description"],
|
|
status_text,
|
|
duration_text
|
|
)
|
|
|
|
total_duration = datetime.now() - self.start_time
|
|
title = f"🔄 {self.workflow_name} Progress (Run: {self.run_id[:8]}..., {total_duration.seconds}s)"
|
|
|
|
return Panel(
|
|
table,
|
|
title=title,
|
|
border_style="blue"
|
|
)
|
|
|
|
|
|
# Global progress manager instance
|
|
progress_manager = ProgressManager() |