fix: repair fork CI and stop false-green test runs

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,7 @@
+# Copyright (c) Tailscale Inc & AUTHORS
+# SPDX-License-Identifier: BSD-3-Clause
+
+FROM gcr.io/oss-fuzz-base/base-builder-go
+COPY . $SRC/tailscale
+WORKDIR $SRC/tailscale
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+# Copyright (c) Tailscale Inc & AUTHORS
+# SPDX-License-Identifier: BSD-3-Clause
+
+tool=github.com/AdamKorcz/go-118-fuzz-build
+ref=fc5dc53b9db8a38c394c53d6e439a1410cf8fc19
+work=$(mktemp -d)
+version=$(awk '/^go / { print $2 }' go.mod)
+goroot=$(GOTOOLCHAIN="go$version" go env GOROOT)
+# The v2 builder modifies testing internals and must match the Go toolchain.
+cp -a "$goroot/." "$work/goroot"
+chmod -R u+w "$work/goroot"
+export GOROOT="$work/goroot" GOTOOLCHAIN=local
+export PATH="$work/bin:$GOROOT/bin:$PATH"
+GOBIN="$work/bin" go install "$tool@$ref"
+mv "$work/bin/go-118-fuzz-build" "$work/bin/go-118-fuzz-build_v2"
+go get "$tool/testing@$ref"
+compile_native_go_fuzzer_v2 tailscale.com/net/dns/resolver FuzzClampEDNSSize clamp_edns_size
+compile_native_go_fuzzer_v2 tailscale.com/util/hashx Fuzz hashx
+compile_native_go_fuzzer_v2 tailscale.com/util/deephash FuzzTime deephash_time
+compile_native_go_fuzzer_v2 tailscale.com/util/deephash FuzzAddr deephash_addr

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: go

.github/workflows/test.yml

@@ -2,19 +2,7 @@
 # both PRs and merged commits, and for the latter reports failures to slack.
 name: CI
 
-env:
-  # Our fuzz job, powered by OSS-Fuzz, fails periodically because we upgrade to
-  # new Go versions very eagerly. OSS-Fuzz is a little more conservative, and
-  # ends up being unable to compile our code.
-  #
-  # When this happens, we want to disable the fuzz target until OSS-Fuzz catches
-  # up. However, we also don't want to forget to turn it back on when OSS-Fuzz
-  # can once again build our code.
-  #
-  # This variable toggles the fuzz job between two modes:
-  #  - false: we expect fuzzing to be happy, and should report failure if it's not.
-  #  - true: we expect fuzzing is broken, and should report failure if it start working.
-  TS_FUZZ_CURRENTLY_BROKEN: false
+permissions: {}
 
 on:
   push:
@@ -40,6 +28,8 @@ concurrency:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
       matrix:
@@ -116,6 +106,8 @@ jobs:
           fi
 
   windows:
+    permissions:
+      contents: read
     runs-on: windows-2022
     steps:
       - name: checkout
@@ -148,9 +140,12 @@ jobs:
         # Don't use -bench=. -benchtime=1x.
         # Somewhere in the layers (powershell?)
         # the equals signs cause great confusion.
-        run: go test -bench . -benchtime 1x ./...
+        # testwrapper retries tests marked with flakytest.Mark.
+        run: go run ./cmd/testwrapper ./... -bench . -benchtime 1x
 
   vm:
+    permissions:
+      contents: read
     runs-on: ["self-hosted", "linux", "vm"]
     # VM tests run with some privileges, don't let them run on 3p PRs.
     if: github.repository == 'tailscale/tailscale'
@@ -171,6 +166,8 @@ jobs:
           XDB_CACHE_HOME: "/var/lib/ghrunner/cache"
 
   cross: # cross-compile checks, build only.
+    permissions:
+      contents: read
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
       matrix:
@@ -248,6 +245,8 @@ jobs:
 
   ios: # similar to cross above, but iOS can't build most of the repo. So, just
     #make it build a few smoke packages.
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -259,6 +258,8 @@ jobs:
           GOARCH: arm64
 
   android:
+    permissions:
+      contents: read
     # similar to cross above, but android fails to build a few pieces of the
     # repo. We should fix those pieces, they're small, but as a stepping stone,
     # only test the subset of android that our past smoke test checked.
@@ -281,65 +282,33 @@ jobs:
           GOARCH: arm64
 
   fuzz:
-    # This target periodically breaks (see TS_FUZZ_CURRENTLY_BROKEN at the top
-    # of the file), so it's more complex than usual: the 'build fuzzers' step
-    # might fail, and depending on the value of 'TS_FUZZ_CURRENTLY_BROKEN', that
-    # might or might not be fine. The steps after the build figure out whether
-    # the success/failure is expected, and appropriately pass/fail the job
-    # overall accordingly.
-    #
-    # Practically, this means that all steps after 'build fuzzers' must have an
-    # explicit 'if' condition, because the default condition for steps is
-    # 'success()', meaning "only run this if no previous steps failed".
+    permissions:
+      contents: read
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-22.04
     steps:
       - name: build fuzzers
-        id: build
-        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-        # continue-on-error makes steps.build.conclusion be 'success' even if
-        # steps.build.outcome is 'failure'. This means this step does not
-        # contribute to the job's overall pass/fail evaluation.
-        continue-on-error: true
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
-          oss-fuzz-project-name: "tailscale"
-          dry-run: false
           language: go
-      - name: report unexpectedly broken fuzz build
-        if: steps.build.outcome == 'failure' && env.TS_FUZZ_CURRENTLY_BROKEN != 'true'
-        run: |
-          echo "fuzzer build failed, see above for why"
-          echo "if the failure is due to OSS-Fuzz not being on the latest Go yet,"
-          echo "set TS_FUZZ_CURRENTLY_BROKEN=true in .github/workflows/test.yml"
-          echo "to temporarily disable fuzzing until OSS-Fuzz works again."
-          exit 1
-      - name: report unexpectedly working fuzz build
-        if: steps.build.outcome == 'success' && env.TS_FUZZ_CURRENTLY_BROKEN == 'true'
-        run: |
-          echo "fuzzer build succeeded, but we expect it to be broken"
-          echo "please set TS_FUZZ_CURRENTLY_BROKEN=false in .github/workflows/test.yml"
-          echo "to reenable fuzz testing"
-          exit 1
+          keep-unaffected-fuzz-targets: true
       - name: run fuzzers
         id: run
-        # Run the fuzzers whenever they're able to build, even if we're going to
-        # report a failure because TS_FUZZ_CURRENTLY_BROKEN is set to the wrong
-        # value.
-        if: steps.build.outcome == 'success'
-        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
-          oss-fuzz-project-name: "tailscale"
           fuzz-seconds: 300
-          dry-run: false
           language: go
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: upload crash
-        uses: actions/upload-artifact@v3
-        if: steps.run.outcome != 'success' && steps.build.outcome == 'success'
+        uses: actions/upload-artifact@v4
+        if: failure() && steps.run.outcome == 'failure'
         with:
           name: artifacts
           path: ./out/artifacts
 
   depaware:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -354,6 +323,8 @@ jobs:
           find . -name 'depaware.txt' | xargs -n1 dirname | xargs ./tool/go run github.com/tailscale/depaware --check
 
   go_generate:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -371,6 +342,8 @@ jobs:
           git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go generate'."; exit 1)
 
   go_mod_tidy:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -387,6 +360,8 @@ jobs:
           git diff --name-only --exit-code || (echo "Please run 'go mod tidy'."; exit 1)
 
   licenses:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -395,6 +370,8 @@ jobs:
         run: ./scripts/check_license_headers.sh .
 
   staticcheck:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
@@ -483,4 +460,5 @@ jobs:
         if: github.event_name != 'push'
         uses: re-actors/alls-green@release/v1
         with:
+          allowed-skips: ${{ github.repository != 'tailscale/tailscale' && 'vm' || '' }}
           jobs: ${{ toJSON(needs) }}

cmd/derper/depaware.txt

@@ -168,7 +168,6 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         golang.org/x/crypto/nacl/box                                 from tailscale.com/types/key+
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices
         golang.org/x/exp/maps                                        from tailscale.com/types/views
         golang.org/x/exp/slices                                      from tailscale.com/net/tsaddr+
    L    golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+

cmd/tailscale/depaware.txt

@@ -163,7 +163,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
         golang.org/x/crypto/pbkdf2                                   from software.sslmate.com/src/go-pkcs12
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices+
+        golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe+
         golang.org/x/exp/maps                                        from tailscale.com/types/views+
         golang.org/x/exp/slices                                      from tailscale.com/net/tsaddr+
         golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
@@ -213,6 +213,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         crypto/hkdf                                                  from crypto/internal/hpke+
         crypto/hmac                                                  from crypto/tls+
         crypto/md5                                                   from crypto/tls+
+        crypto/pbkdf2                                                from golang.org/x/crypto/pbkdf2
         crypto/rand                                                  from crypto/ed25519+
         crypto/rc4                                                   from crypto/tls
         crypto/rsa                                                   from crypto/tls+

cmd/tailscaled/depaware.txt

@@ -11,7 +11,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    W    github.com/alexbrainman/sspi/internal/common                 from github.com/alexbrainman/sspi/negotiate
    W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
   LD    github.com/anmitsu/go-shlex                                  from tailscale.com/tempfork/gliderlabs/ssh
-   L    github.com/aws/aws-sdk-go-v2                                 from github.com/aws/aws-sdk-go-v2/internal/ini
    L    github.com/aws/aws-sdk-go-v2/aws                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/aws-sdk-go-v2/aws/arn                         from tailscale.com/ipn/store/awsstore
    L    github.com/aws/aws-sdk-go-v2/aws/defaults                    from github.com/aws/aws-sdk-go-v2/service/ssm+
@@ -29,12 +28,18 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
+   L    github.com/aws/aws-sdk-go-v2/credentials/logincreds          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/feature/ec2/imds                from github.com/aws/aws-sdk-go-v2/config+
    L    github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config from github.com/aws/aws-sdk-go-v2/feature/ec2/imds
+   L    github.com/aws/aws-sdk-go-v2/internal/auth                   from github.com/aws/aws-sdk-go-v2/aws/signer/v4+
+   L    github.com/aws/aws-sdk-go-v2/internal/auth/smithy            from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/aws-sdk-go-v2/internal/configsources          from github.com/aws/aws-sdk-go-v2/service/ssm+
+   L    github.com/aws/aws-sdk-go-v2/internal/context                from github.com/aws/aws-sdk-go-v2/aws/retry+
+   L    github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/signin+
+   L    github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints+
    L    github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
@@ -44,7 +49,11 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
    L    github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
    L    github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
+   L    github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/aws-sdk-go-v2/service/signin                  from github.com/aws/aws-sdk-go-v2/config+
+   L    github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/signin
+   L    github.com/aws/aws-sdk-go-v2/service/signin/types            from github.com/aws/aws-sdk-go-v2/credentials/logincreds+
    L    github.com/aws/aws-sdk-go-v2/service/ssm                     from tailscale.com/ipn/store/awsstore
    L    github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/ssm
    L    github.com/aws/aws-sdk-go-v2/service/ssm/types               from github.com/aws/aws-sdk-go-v2/service/ssm+
@@ -58,20 +67,26 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
    L    github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
+   L    github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
    L    github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
    L    github.com/aws/smithy-go/document                            from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/encoding                            from github.com/aws/smithy-go/encoding/json+
    L    github.com/aws/smithy-go/encoding/httpbinding                from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
    L    github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/signin+
+   L    github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
    L    github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
    L    github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
+   L    github.com/aws/smithy-go/metrics                             from github.com/aws/aws-sdk-go-v2/aws/retry+
    L    github.com/aws/smithy-go/middleware                          from github.com/aws/aws-sdk-go-v2/aws+
+   L    github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/ssm+
+   L    github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
    L    github.com/aws/smithy-go/waiter                              from github.com/aws/aws-sdk-go-v2/service/ssm
@@ -376,7 +391,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/crypto/poly1305                                 from github.com/tailscale/golang-x-crypto/ssh+
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
   LD    golang.org/x/crypto/ssh                                      from tailscale.com/ssh/tailssh+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices+
+        golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe+
         golang.org/x/exp/maps                                        from tailscale.com/wgengine+
         golang.org/x/exp/slices                                      from tailscale.com/ipn/ipnlocal+
         golang.org/x/net/bpf                                         from github.com/mdlayher/genetlink+