Integrate with Google’s OSS Fuzz service

[mhoad]

This was only just released but looks as though it could be a good addition to the SDK test suite.
https://security.googleblog.com/2021/03/fuzzing-java-in-oss-fuzz.html?m=1

[artursouza]

I am all in for this. I think it would be a great opportunity for the community to contribute.

[mhoad]

Looking into this a little bit more it seems like there is a whole process involved with this that I wasn't originally aware of that is outlined here https://google.github.io/oss-fuzz/getting-started/accepting-new-projects/

[artursouza]

@mhoad Thanks for looking into this. One day, we will "have a significant user base and/or be critical to the global IT infrastructure".

[mhoad]

@artursouza just one more thing. It seems there might be a viable path still. My understanding here is that the fuzzier itself is open source here https://github.com/CodeIntelligenceTesting/jazzer but the managed ongoing testing is it’s own separate thing. Is it an option still if we handle the infrastructure? Is that even a reasonable goal though?

[artursouza]

Let me reopen this in the meantime.

Well, is this something we can run on GitHub actions? If you can try that out and it works, we can take a PR in.