👷 ci(fuzz): hide crashers, add a malloc pass

[gaborbernat]

The deep fuzz job printed up to 400 bytes of each crashing input into its CI log, and the 📤 Upload crash corpus step added in #959 published crash files as a plain artifact. Logs and artifacts on a public repository are readable by anyone, so the crasher of an unfixed bug went public before its fix. The in-process driver also ran every input under pymalloc only, whose pools hide an over-read that stays inside a pool from AddressSanitizer, and tox handed the fuzz environments a random PYTHONHASHSEED per run, so a find on the hash-salted XML duplicate-attribute check might not replay.

The driver now logs a crasher only by SHA-256, length and harness, and keeps the bytes as .fuzz-crashes/crash-<sha256>, the libFuzzer artifact naming. The seed and mutation index that regenerate it go to crash-<sha256>.replay, and a deep run writes its sanitizer reports to crash-sanitizer.<pid>, because a report names the faulting function and line. The workflow uploads crashers only after encrypting each one with age v1.3.2, a checksum-pinned release binary, to the public key in the FUZZ_AGE_RECIPIENT repository variable. Without the variable it uploads nothing. Maintainers holding the identity key become the only readers, the audience OSS-Fuzz gives its reports until the fix ships. The fuzzing page of the development docs walks through the one-time key setup.

Each in-process run now executes twice, under pymalloc and under PYTHONMALLOC=malloc, over the same mutation sequence. The deep budget splits across the two passes, so the weekly 20-minute slot stays inside the six-hour job limit. fuzz and fuzz-smoke pin PYTHONHASHSEED=0, and --rng-seed now reaches the worker. The scheduled job draws a random seed per run and passes it only through the environment, since tox echoes its command line and the seed regenerates every crasher. The deep run also replays the JS minifier fixtures in tests/js/_corpus; it pointed at a directory that does not exist and never replayed them.

The roundtrip and sanitize idempotence checks skip two documented cases and nothing else: script text that breaks the script content restrictions by opening <!-- and then <script before any -->, whose serialization the standard does not promise to reparse to the same tree, and trees that reached the 512 open-element cap, past which the builder stops nesting.

Past finds (#521, #752, #949, #952) move to tests/fuzz_regressions/, and every run replays them first through every harness, through the standalone harnesses' file-argument replay and the in-process seed loop. jsoup's FuzzFixesTest replays its own finds the same way.

The malloc pass catches the class of #949, a one-past-the-end read that pymalloc hid and only the system allocator exposed. A regression of any listed fix now fails the per-PR smoke gate, and a scheduled find stays private while it waits for a fix.

[codspeed]

Merging this PR will degrade performance by 5.58%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 580 untouched benchmarks
⏩ 32 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_feature[transform-number-count-last]	552.1 µs	584.7 µs	-5.58%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing gaborbernat:fuzz/harness-hygiene (2001f89) with main (c795023)}

Footnotes

1. 32 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩