youichi-uda commented on issue #5332:
URL: https://github.com/apache/arrow-rs/issues/5332#issuecomment-4378428397
Thanks @alamb — that framing is helpful. Echoing back what I'm taking from
it so I don't drift:
- Continued bug-hunting + fix PRs against arrow / arrow-ipc / parquet (and
the related rust-format crates) is welcome and lives entirely on my side. ✅
- Committing in-repo fuzz infrastructure (`{crate}/fuzz/` dirs +
ClusterFuzzLite GA wiring) into `arrow-rs` is a maintenance ask the project
hasn't decided on. I should treat that as deferred, not in-flight.
Adjusting the plan accordingly. Items **(1)–(3)** of my 2026-05-03 plan
(per-crate `fuzz/` dirs, seed corpora committed to this repo, ClusterFuzzLite
GA) — **withdrawn / parked indefinitely**. No PRs from me on that front; happy
to revisit only if a maintainer brings it up.
Item **(4) OSS-Fuzz integration** can go forward without any in-repo code
change here. Concretely:
- I host the harnesses on a personal fork branch
(`masumi-ryugo/arrow-rs:fuzz/initial-harnesses`) — already pushed, not asking
for it to be merged.
- The `google/oss-fuzz` `projects/arrow-rs/` directory (also already prepped
on a fork) clones that branch in its `Dockerfile` and builds the harnesses from
there. This is the same pattern several Rust projects use when the upstream
repo doesn't host `fuzz/`.
- Net change in `apache/arrow-rs`: **zero**. Net change in
`google/oss-fuzz`: one new `projects/arrow-rs/` directory. Maintainer
touchpoint: just the `primary_contact` / `auto_ccs` emails for crash
notifications.
If that out-of-tree model is acceptable, I can send the `google/oss-fuzz` PR
once contact emails are sorted. If a PMC member or two would like crash
notifications, please drop a Google-account email here (or DM me) and I'll list
you as `auto_ccs`. Otherwise I'll list myself as `primary_contact` only —
`arrow-rs` maintainers wouldn't be on the notification list at all unless they
ask to be.
If even the out-of-tree OSS-Fuzz integration is more than the project wants
right now, just say so and I'll keep running cargo-fuzz locally + sending fix
PRs without the OSS-Fuzz piece.
Either way, no code action from me on this issue until I hear back. The
fix-PR stream continues independently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
