BUG OSS-Fuzz does not detect multiple repos fuzzed under a project

[34fathombelow]

Describe the bug
https://github.com/argoproj currently uses oss-fuzz to perform fuzzing on the four repositories listed below:

1. https://github.com/argoproj/argo-workflows
2. https://github.com/argoproj/argo-cd
3. https://github.com/argoproj/argo-events
4. https://github.com/argoproj/argo-rollouts

I see that #2719 was recently merged and parses the results of https://oss-fuzz-build-logs.storage.googleapis.com/status.json. I'm not sure if this fix would cover our case. I do see the main project being detected in the build results, but not each repo as listed above.

Expected behavior
Fuzzing check to detect the repos that we have enabled for fuzzing.

Additional context
I appreciate all the hard work that has gone into this project. Keep up the great work.

[naveensrinivasan]

The project clones multiple sub project in a single docker file https://github.com/google/oss-fuzz/blob/master/projects/argo/Dockerfile

[spencerschrock]

#2719 won't handle this as written. Since the main repo url is "github.com/argoproj", none of the sub projects would work.

It would be easy to convert extend the logic to fall back to searching the org: e.g.github.com/argoproj/argo-cd -> github.com/argoproj. This would result in quite a few false positives though.

[34fathombelow]

@spencerschrock I agree extending the logic would not be the best solution, as you stated this would create many false positives.

Do you have any other solutions or suggestions? I'd really like to avoid refactoring the fuzzing checks we already have in place.

[spencerschrock]

Hmm, the vast majority of main_repo fields from project.yaml files refer to a single repo. Only 6 oss-fuzz projects that point to a GitHub repo point to an org (~0.6%):

argoproj
dapr
knative
notaryproject
QubesOS
unicode-rs

We support looking for a .onefuzz file to detect microsoft OneFuzz, so I could see a similar .ossfuzz file as a possibility or even just a general .fuzzing file as a catch-all with a user filled explanation. Would be curious what other @ossf/scorecard-maintainers thoughts are.

[34fathombelow]

Thank you all for looking into this, any updates would be appreciated.

[spencerschrock]

Thank you all for looking into this, any updates would be appreciated.

Not much feedback on the issue from other Scorecard maintainers, but I can say we're planning maintainer annotations that would help address add context to situations like this. The design hasn't started, but its on our roadmap.