Skip to content

feat: register Shellphish CRS six pipelines#163

Open
occia wants to merge 16 commits intomainfrom
feat/shellphish-crs-integration
Open

feat: register Shellphish CRS six pipelines#163
occia wants to merge 16 commits intomainfrom
feat/shellphish-crs-integration

Conversation

@occia
Copy link
Copy Markdown
Collaborator

@occia occia commented Apr 2, 2026

Summary

  • Remove the old monolithic crs-shellphish registration
  • Add 6 per-pipeline registrations, each pointing to a dedicated branch in shellphish-oss-crs

Pipeline Architecture

The source repo shellphish-oss-crs uses a branch-per-pipeline model:

  • The main branch is for development and contains no crs.yaml (gitignored). All code changes go into main.
  • Each pipeline branch merges from main and adds its own crs.yaml. This is the only difference from main.
  • Each pipeline is a multi-component composition — different pipelines share many of the same build and run modules (e.g., canonical-build, AFL++, coverage tracers).
  • See the per-pipeline docs for component details (pipeline architecture, validation results, input/output specification, and inter/intra-component sharing, etc).

All pipelines are tested/testing under the following three C projects and Java projects, including target builds, fuzzing, crash detection, PoV submission, seed sync (sharing and import).

  • C: c/sanity-mock-c-delta-01, c/afc-lcms-full-01, c/asc-nginx-delta-01
  • JVM: jvm/sanity-mock-java-delta-01, jvm/atlanta-imaging-delta-01, jvm/atlanta-activemq-delta-01
CRS Name Branch Doc Description
crs-shellphish-c-fuzzers crs-shellphish-c-fuzzers doc AFL++ + LibFuzzer parallel ensemble with seed/PoV exchange
crs-shellphish-discoveryguy crs-shellphish-discoveryguy doc LLM vulnerability discovery (code-swipe ranking, CodeQL, semgrep, clang-indexer) + AFL++ fuzzing
crs-shellphish-aijon crs-shellphish-aijon doc LLM-driven IJON annotation (code-swipe, CodeQL, semgrep, clang-indexer) + AFL++ with coverage-build feedback
crs-shellphish-grammar crs-shellphish-grammar doc LLM grammar generation (Grammar-Guy) + coverage-guided refinement (GrammarRoomba) + AFL++ Nautilus mutator
crs-shellphish-jvm-fuzzers crs-shellphish-jvm-fuzzers doc Jazzer (libFuzzer for JVM) with LOSAN sanitizers for Java-specific vulnerabilities
crs-shellphish-quickseed crs-shellphish-quickseed doc LLM seed generation (CodeQL sinks, ANTLR4 func-index, code-swipe ranking) + Jazzer fuzzing

Besides, some integration details are listed at #127 .

occia added 14 commits March 17, 2026 13:14
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
…gistrations

Signed-off-by: occia <blbllhy@gmail.com>
Signed-off-by: occia <blbllhy@gmail.com>
@occia occia requested a review from azchin April 2, 2026 05:25
occia added 2 commits April 2, 2026 10:33
Signed-off-by: occia <blbllhy@gmail.com>
@occia
Copy link
Copy Markdown
Collaborator Author

occia commented Apr 2, 2026

  • Splitted as crs-shellphish-c-fuzzers-aflpp and crs-shellphish-c-fuzzers-libfuzzer
  • Fixed Shellphish Jazzer parallel fuzzing bug
  • Now redo testing for changed parts (Done)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant