Security release/candidate 1

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,18 @@
+# ClusterFuzzLite / OSS-Fuzz build image for keep-core's native Go fuzz targets.
+# base-builder-go provides the Go toolchain plus the compile_native_go_fuzzer
+# helper used by build.sh.
+#
+# Digest-pinned: the :latest tag floats and the image is rebuilt upstream
+# continuously; an unpinned base silently changes the build environment (and
+# is a supply-chain vector) on every CI run. Bump the digest deliberately —
+# resolve the current one with:
+#   curl -s "https://gcr.io/v2/oss-fuzz-base/base-builder-go/manifests/latest" \
+#     -H "Authorization: Bearer $(curl -s 'https://gcr.io/v2/token?service=gcr.io&scope=repository:oss-fuzz-base/base-builder-go:pull' | jq -r .token)" \
+#     -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" -I | grep -i docker-content-digest
+FROM gcr.io/oss-fuzz-base/base-builder-go@sha256:cf761fd9baac42fff453259755067a7ad8ad70dbbe7db5027211e9fabc5cac40
+
+# The ClusterFuzzLite build_fuzzers action supplies the checked-out repo as the
+# Docker build context; copy it in and build from there.
+COPY . $SRC/keep-core
+WORKDIR $SRC/keep-core
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/README.md

@@ -0,0 +1,104 @@
+# Continuous fuzzing
+
+This directory wires keep-core's native Go fuzz targets (the `Fuzz*` functions
+under `pkg/**/fuzz_test.go`) into **ClusterFuzzLite** — OSS-Fuzz's self-hosted
+variant that runs in this repo's own GitHub Actions and **works on private
+repos**. That last property is why ClusterFuzzLite, not OSS-Fuzz, is the right
+tool for this fork (OSS-Fuzz only fuzzes public projects).
+
+## Files
+
+| file | purpose |
+|---|---|
+| `Dockerfile` | build image (`base-builder-go`) |
+| `build.sh` | compiles every `Fuzz*` target into a libFuzzer binary (path-qualified output names — several `Fuzz*` funcs share a name across packages) |
+| `project.yaml` | `language: go` |
+| `../.github/workflows/cflite_pr.yml` | per-PR fuzzing of changed code (fast, exits on first crash) |
+| `../.github/workflows/cflite_batch.yml` | scheduled longer run over all targets |
+
+## Adding / regenerating targets
+
+`build.sh` must list one `compile_native_go_fuzzer` line per `Fuzz*` target.
+CI enforces this (`check_targets.sh` runs on every PR and fails on drift).
+Regenerate after adding targets:
+
+```sh
+for f in $(grep -rln "func Fuzz.*testing.F" pkg/ --include="*_test.go" | sort); do
+  d=$(dirname "$f"); p="github.com/keep-network/keep-core/$d"
+  pref=$(echo "$d" | sed 's#^pkg/##; s#/#_#g')
+  grep -oE "func (Fuzz[A-Za-z0-9_]+)\(" "$f" | sed -E 's/func (Fuzz[A-Za-z0-9_]+)\(/\1/' \
+    | while read fn; do echo "compile_native_go_fuzzer $p $fn ${pref}_${fn}"; done
+done
+```
+
+## Enabling corpus persistence (batch mode)
+
+Batch fuzzing benefits from carrying the corpus between runs — without it
+every nightly run restarts from the in-tree seeds and the 1800s budget is a
+smoke test, not coverage-accumulating fuzzing. To enable:
+
+1. Create a private storage repo, e.g. `tlabs-xyz/keep-core-security-fuzz-corpus`.
+2. Add a `PERSONAL_ACCESS_TOKEN` repo secret. It MUST be a **fine-grained
+   PAT scoped to the storage repo only**, with `Contents: Read and write`
+   as its only permission. Never use a classic PAT here: the token is
+   interpolated into a clone URL inside a job that executes
+   repo-controlled build code (`build.sh`, `Dockerfile`), so an
+   over-scoped token would hand that code access to everything it can
+   reach. Set an expiry and rotate it.
+3. Uncomment the `storage-repo*` lines in `cflite_batch.yml` (and
+   `upload-build`). Keep persistence OUT of `cflite_pr.yml`: PR jobs run
+   proposed code and must not see the token at all.
+
+Until then, each batch run starts from the in-tree seed corpus.
+
+## Fork-lifecycle policy (why this exists)
+
+This is a **private fork** of the public `github.com/keep-network/keep-core`.
+Fuzzing finds bugs in code; whether a finding is fork-relevant depends on how
+far the fork has diverged. Two facts drive the policy:
+
+- **Fixes do not flow back automatically.** A bug fixed upstream stays open in
+  this fork until deliberately back-merged (this engagement already hit exactly
+  that: upstream's OOB fix was incomplete and had to be back-merged by hand).
+- **Fork-divergent code gets no upstream coverage.** OSS-Fuzz on the upstream
+  cannot see code that only exists here.
+
+Policy:
+
+1. **Run ClusterFuzzLite here** (this directory) so the fork's own code —
+   including divergent paths — is fuzzed in its own CI.
+2. **Track upstream `main`**: reconcile within a bounded window (e.g. N commits
+   or one release) so shared-parser fixes found upstream reach the fork.
+3. **Contribute the fuzz targets upstream** (below) so the shared parsers get
+   continuous OSS-Fuzz coverage at Google's scale, and so this fork inherits
+   that coverage on the shared code after each reconcile.
+
+## OSS-Fuzz for the public upstream
+
+The same `Dockerfile` / `build.sh` / targets work for OSS-Fuzz once the
+`Fuzz*` targets are merged into `github.com/keep-network/keep-core`. To enroll
+the upstream, open a PR to `google/oss-fuzz` adding `projects/keep-core/` with:
+
+- `project.yaml`:
+
+  ```yaml
+  homepage: "https://github.com/keep-network/keep-core"
+  language: go
+  primary_contact: "<security contact email>"
+  main_repo: "https://github.com/keep-network/keep-core"
+  fuzzing_engines:
+    - libfuzzer
+  sanitizers:
+    - address
+  ```
+
+- a `Dockerfile` that `git clone`s the upstream repo (instead of `COPY .`):
+
+  ```dockerfile
+  FROM gcr.io/oss-fuzz-base/base-builder-go
+  RUN git clone --depth 1 https://github.com/keep-network/keep-core $SRC/keep-core
+  WORKDIR $SRC/keep-core
+  COPY build.sh $SRC/
+  ```
+
+- the same `build.sh` from this directory.

.clusterfuzzlite/build.sh

@@ -0,0 +1,64 @@
+#!/bin/bash -eu
+#
+# ClusterFuzzLite / OSS-Fuzz build script for keep-core native (testing.F)
+# fuzz targets. Compiles every Fuzz* target into a libFuzzer binary. Output
+# names are path-qualified because several Fuzz funcs share a name across
+# packages (e.g. FuzzEphemeralPublicKeyMessageUnmarshal in gjkr/dkg/signing).
+#
+# Regenerate the target list with:
+#   grep -rhoE "func (Fuzz[A-Za-z0-9_]+)\(f \*testing.F\)" pkg/ --include="*_test.go"
+
+cd "$SRC/keep-core"
+
+# Fuzzers don't need VCS build stamping, and stamping can fail in the build
+# container (git "dubious ownership" / detached checkout). Disable it.
+export GOFLAGS="-buildvcs=false ${GOFLAGS:-}"
+
+# compile_native_go_fuzzer rewrites each testing.F target onto the OSS-Fuzz
+# libFuzzer shim; pull it into the module graph (build-container only, not
+# committed to go.mod). Pinned to a commit SHA: this fetch happens outside
+# go.sum protection on every CI build, so an unpinned HEAD would execute
+# whatever upstream pushes. Bump deliberately.
+go get github.com/AdamKorcz/go-118-fuzz-build/testing@a70c2aa677fa43583571959478decabe02a96cd6
+
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/dkg/result FuzzDKGResultHashSignatureMessageUnmarshal beacon_dkg_result_FuzzDKGResultHashSignatureMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/entry FuzzSignatureShareMessageUnmarshal beacon_entry_FuzzSignatureShareMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzEphemeralPublicKeyMessageUnmarshal beacon_gjkr_FuzzEphemeralPublicKeyMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzMemberCommitmentsMessageUnmarshal beacon_gjkr_FuzzMemberCommitmentsMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzPeerSharesMessageUnmarshal beacon_gjkr_FuzzPeerSharesMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzSecretSharesAccusationsMessageUnmarshal beacon_gjkr_FuzzSecretSharesAccusationsMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzMemberPublicKeySharePointsMessageUnmarshal beacon_gjkr_FuzzMemberPublicKeySharePointsMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzPointsAccusationsMessageUnmarshal beacon_gjkr_FuzzPointsAccusationsMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/beacon/gjkr FuzzMisbehavedEphemeralKeysMessageUnmarshal beacon_gjkr_FuzzMisbehavedEphemeralKeysMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/bitcoin FuzzNewScriptFromVarLenData bitcoin_FuzzNewScriptFromVarLenData
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/bitcoin FuzzTransactionDeserialize bitcoin_FuzzTransactionDeserialize
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/net/libp2p FuzzIdentityUnmarshal net_libp2p_FuzzIdentityUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/net/security/handshake FuzzAct1MessageUnmarshal net_security_handshake_FuzzAct1MessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/net/security/handshake FuzzAct2MessageUnmarshal net_security_handshake_FuzzAct2MessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/net/security/handshake FuzzAct3MessageUnmarshal net_security_handshake_FuzzAct3MessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/protocol/announcer FuzzAnnouncementMessageUnmarshal protocol_announcer_FuzzAnnouncementMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/protocol/inactivity FuzzClaimSignatureMessageUnmarshal protocol_inactivity_FuzzClaimSignatureMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzSigningDoneMessageUnmarshal tbtc_FuzzSigningDoneMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzCoordinationMessageUnmarshal tbtc_FuzzCoordinationMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzNoopProposalUnmarshal tbtc_FuzzNoopProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzHeartbeatProposalUnmarshal tbtc_FuzzHeartbeatProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzDepositSweepProposalUnmarshal tbtc_FuzzDepositSweepProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzRedemptionProposalUnmarshal tbtc_FuzzRedemptionProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzMovingFundsProposalUnmarshal tbtc_FuzzMovingFundsProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tbtc FuzzMovedFundsSweepProposalUnmarshal tbtc_FuzzMovedFundsSweepProposalUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzEphemeralPublicKeyMessageUnmarshal tecdsa_dkg_FuzzEphemeralPublicKeyMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzTssRoundOneMessageUnmarshal tecdsa_dkg_FuzzTssRoundOneMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzTssRoundTwoMessageUnmarshal tecdsa_dkg_FuzzTssRoundTwoMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzTssRoundThreeMessageUnmarshal tecdsa_dkg_FuzzTssRoundThreeMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzTssFinalizationMessageUnmarshal tecdsa_dkg_FuzzTssFinalizationMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/dkg FuzzResultSignatureMessageUnmarshal tecdsa_dkg_FuzzResultSignatureMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzEphemeralPublicKeyMessageUnmarshal tecdsa_signing_FuzzEphemeralPublicKeyMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundOneMessageUnmarshal tecdsa_signing_FuzzTssRoundOneMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundTwoMessageUnmarshal tecdsa_signing_FuzzTssRoundTwoMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundThreeMessageUnmarshal tecdsa_signing_FuzzTssRoundThreeMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundFourMessageUnmarshal tecdsa_signing_FuzzTssRoundFourMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundFiveMessageUnmarshal tecdsa_signing_FuzzTssRoundFiveMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundSixMessageUnmarshal tecdsa_signing_FuzzTssRoundSixMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundSevenMessageUnmarshal tecdsa_signing_FuzzTssRoundSevenMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundEightMessageUnmarshal tecdsa_signing_FuzzTssRoundEightMessageUnmarshal
+compile_native_go_fuzzer github.com/keep-network/keep-core/pkg/tecdsa/signing FuzzTssRoundNineMessageUnmarshal tecdsa_signing_FuzzTssRoundNineMessageUnmarshal

.clusterfuzzlite/check_targets.sh

@@ -0,0 +1,40 @@
+#!/bin/bash -eu
+#
+# Drift guard: fails when the set of native Fuzz* targets under pkg/
+# diverges from the compile_native_go_fuzzer registration list in
+# build.sh. Without this, a new Fuzz* function compiles fine under
+# `go test` but silently receives zero ClusterFuzzLite coverage.
+#
+# Compares exact (package, function) pairs — not counts — because
+# several Fuzz functions share a name across packages.
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+module="github.com/keep-network/keep-core"
+
+# Work from the repo root so grep emits relative paths: the absolute path
+# never enters the sed pattern, where regex metacharacters in a checkout
+# location could otherwise misparse the target list.
+cd "$repo_root"
+
+expected="$(
+	grep -rn --include='*_test.go' -E '^func Fuzz[A-Za-z0-9_]+\(f \*testing\.F\)' pkg |
+		sed -E "s|^(.+)/[^/]+\.go:[0-9]+:func (Fuzz[A-Za-z0-9_]+)\(.*$|$module/\1 \2|" |
+		sort -u
+)"
+
+registered="$(
+	grep -E '^compile_native_go_fuzzer ' .clusterfuzzlite/build.sh |
+		awk '{print $2, $3}' |
+		sort -u
+)"
+
+if ! diff <(echo "$expected") <(echo "$registered") >&2; then
+	echo >&2
+	echo "Fuzz target drift detected:" >&2
+	echo "  < targets found in pkg/ but not registered in .clusterfuzzlite/build.sh" >&2
+	echo "  > targets registered in build.sh but missing from pkg/" >&2
+	echo "Add/remove the matching compile_native_go_fuzzer line(s)." >&2
+	exit 1
+fi
+
+echo "OK: $(echo "$expected" | wc -l) fuzz targets, build.sh registration list in sync."

.clusterfuzzlite/project.yaml

@@ -0,0 +1,11 @@
+# ClusterFuzzLite project configuration. For CFLite only `language` is required;
+# it is consumed by the build_fuzzers / run_fuzzers GitHub Actions.
+#
+# (The OSS-Fuzz integration for the PUBLIC upstream repo lives in the
+# google/oss-fuzz repo under projects/keep-core/ and carries additional fields
+# — homepage, primary_contact, main_repo, auto_ccs. See README.md.)
+language: go
+fuzzing_engines:
+  - libfuzzer
+sanitizers:
+  - address

.dockerignore

@@ -1,5 +1,8 @@
 # Hidden files and directories.
 .*
+# ...except the ClusterFuzzLite build files, which must reach the build context.
+!.clusterfuzzlite
+!.clusterfuzzlite/**
 
 # Top-level directories unrelated to the build.
 docs*/
@@ -29,6 +32,9 @@ token-tracker/
 # Go stuff.
 **/gen/_contracts
 **/gen/**/*.go
+# ...but keep the committed protobuf message code (gen/pb); the ClusterFuzzLite
+# build does not run protoc, and the unmarshaler fuzz targets need it.
+!**/gen/pb/*.go
 !**/gen/gen.go
 !**/gen/cmd/cmd.go
 

.github/workflows/cflite_batch.yml

@@ -0,0 +1,46 @@
+name: ClusterFuzzLite batch fuzzing
+
+# Scheduled longer fuzzing run over all targets to grow the corpus and reach
+# deeper bugs than per-PR fuzzing can. Does not exit on first crash.
+#
+# Corpus/crash persistence requires a storage repo + a PERSONAL_ACCESS_TOKEN
+# secret; uncomment the storage-repo lines once those exist (see
+# .clusterfuzzlite/README.md). Without persistence the run still fuzzes but
+# starts from the in-tree seed corpus each time.
+on:
+  schedule:
+    - cron: "0 2 * * *" # daily, offset from the -race job (midnight)
+  workflow_dispatch:
+
+# No security-events permission: this repo has no GitHub Advanced
+# Security, so SARIF upload to code scanning would 403. Crash artifacts
+# are reported via the action's run output and artifacts instead.
+permissions:
+  contents: read
+
+jobs:
+  Batch:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+      - name: Build fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05 # v1
+        with:
+          language: go
+          sanitizer: ${{ matrix.sanitizer }}
+          # upload-build: true
+      - name: Run fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 1800
+          mode: "batch"
+          sanitizer: ${{ matrix.sanitizer }}
+          # storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/tlabs-xyz/keep-core-security-fuzz-corpus.git
+          # storage-repo-branch: main
+          # storage-repo-branch-coverage: gh-pages

.github/workflows/cflite_pr.yml

@@ -0,0 +1,62 @@
+name: ClusterFuzzLite PR fuzzing
+
+# Builds the native Go fuzz targets and fuzzes only the code changed in a PR
+# (code-change mode), giving fast per-PR feedback. Exits on the first crash.
+# Complements the nightly -race job and the batch fuzzer below.
+on:
+  pull_request:
+    paths:
+      - "pkg/**"
+      - ".clusterfuzzlite/**"
+      # Infra the fuzz build depends on: a change here can break the
+      # CFLite build without touching pkg/, and would otherwise only be
+      # caught by the nightly batch run.
+      - "go.mod"
+      - "go.sum"
+      - ".dockerignore"
+      - ".github/workflows/cflite_pr.yml"
+      - ".github/workflows/cflite_batch.yml"
+
+# No security-events permission: this repo has no GitHub Advanced
+# Security, so SARIF upload to code scanning would 403. Crash artifacts
+# are reported via the action's run output and artifacts instead.
+permissions:
+  contents: read
+
+jobs:
+  target-sync:
+    # build.sh's registration list is a second source of truth: a new
+    # Fuzz* function that is not registered silently gets zero CFLite
+    # coverage. Fail the PR instead.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check fuzz targets are registered in build.sh
+        run: ./.clusterfuzzlite/check_targets.sh
+
+  PR:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        # Go native fuzzing builds under libFuzzer + AddressSanitizer.
+        sanitizer: [address]
+    steps:
+      - name: Build fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05 # v1
+        with:
+          language: go
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Run fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 300
+          mode: "code-change"
+          sanitizer: ${{ matrix.sanitizer }}