1## Building Jazzer from source 2 3### Dependencies 4 5Jazzer has the following dependencies when being built from source: 6 7* [Bazelisk](https://github.com/bazelbuild/bazelisk) or the version of Bazel specified in [`.bazelversion`](.bazelversion) 8* One of the following C++ compilers: 9 * [Clang](https://clang.llvm.org/) 9.0+ (clang-cl on Windows) 10 * Xcode (Xcode.app is required, not just the developer tools) 11 * GCC (should work with `--repo_env=CC=gcc`, but is not tested) 12 13It is recommended to use [Bazelisk](https://github.com/bazelbuild/bazelisk) to automatically download and install Bazel. 14Simply download the release binary for your OS and architecture and ensure that it is available in the `PATH`. 15The instructions below will assume that this binary is called `bazel` - Bazelisk is a thin wrapper around the actual Bazel binary and can be used interchangeably. 16 17### Compiling 18 19Assuming the dependencies are installed, build Jazzer from source and run it as follows: 20 21```bash 22$ git clone https://github.com/CodeIntelligenceTesting/jazzer 23$ cd jazzer 24# Note the double dash used to pass <arguments> to Jazzer rather than Bazel. 25$ bazel run //:jazzer -- <arguments> 26``` 27 28You can also build your own version of the release binaries: 29 30```bash 31$ bazel build //:jazzer_release 32... 33INFO: Found 1 target... 34Target //:jazzer_release up-to-date: 35 bazel-bin/jazzer_release.tar.gz 36... 37``` 38 39### Running the tests 40 41To run the tests, execute the following command: 42 43```bash 44$ bazel test //... 45``` 46 47#### Debugging 48 49If you need to debug an issue that can only be reproduced by an integration test (`java_fuzz_target_test`), you can start Jazzer in debug mode via `--config=debug`. 50The JVM running Jazzer will suspend until a debugger connects on port 5005 (or the port specified via `DEFAULT_JVM_DEBUG_PORT`). 51 52### Formatting 53 54Run `./format.sh` to format all source files in the way enforced by the "Check formatting" CI job. 55 56## Releasing (CI employees only) 57 58Requires an account on [Sonatype](https://issues.sonatype.org) with access to the `com.code-intelligence` group as well as a YubiKey with the signing key. 59 60### One-time setup 61 621. Install GPG prerequisites via `sudo apt-get install gnupg2 gnupg-agent scdaemon pcscd`. 632. Execute `mkdir -p ~/.gnupg && echo use-agent >> ~/.gnupg/gpg.conf` to enable GPG's smart card support. 643. Execute `cat deploy/maven.pub | gpg --import` to import the public key used for Maven signatures 654. Plug in the YubiKey and execute `gpg --card-status` to generate a key stub. 66 If you see a `No such device` error, retry after executing `killall gpg-agent; killall pcscd` to remove existing locks on the YubiKey. 67 68### Per release 69 701. Update `JAZZER_VERSION` in [`maven.bzl`](maven.bzl). 712. Create a release, using the auto-generated changelog as a base for the release notes. 723. Trigger the "Release" GitHub Actions workflow for the tag. 73 This builds release archives for GitHub as well as the multi-architecture jar for the `com.code-intelligence:jazzer` Maven artifact. 744. Create a GitHub release and upload the contents of the `jazzer_releases` artifact from the workflow run. 755. Check out the tag locally and, with the YubiKey plugged in, run `bazel run //deploy` with the following environment variables to upload the Maven artifacts: 76 * `JAZZER_JAR_PATH`: local path of the multi-architecture `jazzer.jar` contained in the `jazzer` artifact of the "Release" workflow 77 * `MAVEN_USER`: username on https://oss.sonatype.org 78 * `MAVEN_PASSWORD`: password on https://oss.sonatype.org 79 80 The YubiKey blinks repeatedly and needs a touch to confirm each individual signature. 816. Log into https://oss.sonatype.org, select both staging repositories and "Close" them. 82 Wait and refresh, then select them again and "Release" them. 837. Locally, with Docker credentials available, run `docker/push_all.sh` to build and push the `cifuzz/jazzer` and `cifuzz/jazzer-autofuzz` Docker images. 84 85### Updating the hosted javadocs 86 87Javadocs are hosted at https://codeintelligencetesting.github.io/jazzer-docs, which is populated from https://github.com/CodeIntelligenceTesting/jazzer-docs. 88 89To update the docs after a release with API changes, follow these steps to get properly linked cross-references: 90 911. Delete the contents of the `jazzer-api` subdirectory of `jazzer-docs`. 922. Run `bazel build --//deploy:linked_javadoc //deploy:jazzer-api-docs` and unpack the jar into the `jazzer-api` subdirectory of `jazzer-docs`. 933. Commit and push the changes, then wait for them to be published (can take a minute). 944. Repeat the same steps with `jazzer-api` replaced by `jazzer` and then by `jazzer-junit`. 95