Security Deep nightly is failing #138

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   on May 30, 2026
2. 27Bslash6 commented on May 30, 2026

   

   27Bslash6

   on May 30, 2026

   Contributor

   More actions

   Triage (this issue was auto-filed by the new alert step in PR #137, dispatched run 26675421992):

   Fixed by #137 (verified green in that run):

   • Sanitizers (address/thread/memory) — were EXDEV os error 18
   • Kani — was exit 127 (cargo-kani not on PATH)
   • Extended Fuzzing — was the cargo-fuzz/rustix nightly build failure

   Remaining red: Atheris. Root cause is not a workflow bug — atheris==2.3.0 fails to build because clang/libFuzzer is not present on the cachekit ARC runner:

   Failed to find libFuzzer; set either $CLANG_BIN to point to your Clang
   binary, or $LIBFUZZER_LIB to point directly to your libFuzzer
   

   Fix belongs in the ARC runner image (runner/), not here: bake in clang + compiler-rt (libFuzzer) and expose CLANG_BIN. Secondary: the job resolved CPython 3.14, which atheris==2.3.0 also doesn't support — pin the Atheris job to 3.12 once clang is available.

   Until the runner has clang, Security Deep Success will stay red on Atheris alone. This issue will keep being updated (not duplicated) by the dedup in the alert step.
3. github-actions commented on May 30, 2026

   

   github-actionsBot

   on May 30, 2026 – with GitHub Actions

   ContributorAuthor

   More actions

   Security Deep failed on run 26693957972.

   • Kani: success
   • Fuzzing: success
   • Atheris: failure
   • Miri: success
   • Sanitizers: success

   Run: https://github.com/cachekit-io/cachekit-py/actions/runs/26693957972
4. 27Bslash6 commented on Jun 6, 2026

   

   27Bslash6

   on Jun 6, 2026

   Contributor

   More actions

   Resolved by #142 (ci: pin Atheris fuzzing job to Python 3.11, merged 2026-05-31).

   Root cause: the atheris-fuzzing job had no Python pin, so uv floated to cpython 3.14, for which atheris 2.3.0 ships no wheel. uv fell back to an sdist build (find_libfuzzer.sh needs clang + libFuzzer, absent on the self-hosted runner), so uv sync failed before any fuzzing ran — an install error, not a fuzz finding. #142 pins the job to Python 3.11 (newest interpreter with an atheris cp311 wheel).

   Security Deep has been green on every nightly run since 2026-06-01 (latest verified: 2026-06-05). Closing as fixed.
5. 27Bslash6

   closed this as completedon Jun 6, 2026