BUG: remove recurring fuzzer in Fuzzing results

[laurentsimon]

see curl -s https://ossfscorecard.dev/v2/github.com/ossf/scorecard/result.json | jq

project is fuzzed with [OSSFuzz GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer ...

We need to show a single GoBuiltInFuzzer.

@aidenwang9867 assigning to you.

[aidenwang9867]

np, i think this bug was introduced by me in the early fuzzing pr :/

[aidenwang9867]

In the fuzzer recording for-loop in func raw.checkFuzzFunc, fuzzers of each programming language will be reported only once along with its files (indicating those fuzzer positions) when the returned usingFuzzFunc is true, suggesting fuzzers are found for this language.

I also pulled the latest scorecard commit and ran the CLI go run . --repo ossf-tests/scorecard-check-fuzzing-golang --checks Fuzzing --format json --show-details | jq on the e2e test repo ossf-tests/scorecard-check-fuzzing-golang, where multiple go func fuzzers are defined.

It is expected to return a single GoBuildInFuzzer along with multiple fuzzer entries - and the result seems fine.
Did I miss anything?

Here's the result:

{
  "date": "2022-07-15",
  "repo": {
    "name": "github.com/ossf-tests/scorecard-check-fuzzing-golang",
    "commit": "57388033a028da894848b74816dcc0d6fcdc8a7a"
  },
  "scorecard": {
    "version": "(devel)",
    "commit": "unknown"
  },
  "score": 10,
  "checks": [
    {
      "details": [
        "Info: func FuzzReverse1(f *testing.F): reverse_test.go:24",
        "Info: func FuzzReverse2(f *testing.F): reverse_test.go:41"
      ],
      "score": 10,
      "reason": "project is fuzzed with [GoBuiltInFuzzer]",
      "name": "Fuzzing",
      "documentation": {
        "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing",
        "short": "Determines if the project uses fuzzing."
      }
    }
  ],
  "metadata": null
}

[laurentsimon]

maybe the curl results above is using an older version then? Hers's what it shows:

"reason": "project is fuzzed with [OSSFuzz GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer]",
      "details": [
        "Info: func FuzzSomething (fOo_bAR_1234 *testing.F): checks/raw/fuzzing_test.go:179",
        "Info: func FuzzSomething (fOo_bAR_1234 *testing.F): checks/raw/fuzzing_test.go:179",

A giant array of GoBuiltInFuzzer

[aidenwang9867]

maybe the curl results above is using an older version then? Hers's what it shows:

"reason": "project is fuzzed with [OSSFuzz GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer GoBuiltInFuzzer]",
      "details": [
        "Info: func FuzzSomething (fOo_bAR_1234 *testing.F): checks/raw/fuzzing_test.go:179",
        "Info: func FuzzSomething (fOo_bAR_1234 *testing.F): checks/raw/fuzzing_test.go:179",

A giant array of GoBuiltInFuzzer

Ah, there's a hell lot of go fuzzers :/

I don't know which version it uses, but I haven't modified the main logic of checkFuzzFunc after PR #1979. In the result, it seems in raw.Fuzzing, the checkFuzzFunc was called several times - but this shouldn't have been possible since I only define it to be called once.

A possible reason might be the ListProgrammingLanguages() API reports multiple "Go"s as the prominent language (something of the GitHub ListLangauge API is malfunctioning I guess?). Maybe I should drop the language duplicates before checking their fuzzers?

[laurentsimon]

/cc @naveensrinivasan

Closing this issue because the scorecard LCI does not have this problem, so it must be in the way the data was dumped. Thanks @aidenwang9867 for checking!

[aidenwang9867]

/cc @naveensrinivasan

Closing this issue because the scorecard LCI does not have this problem, so it must be in the way the data was dumped. Thanks @aidenwang9867 for checking!

Awesome! Thank you for bringing this issue up, but I'm still kind of suspicious on whether the GitHub List Langs API will give us duplicated language entries.