fix: repair fork CI and stop false-green test runs

Upgrade AWS S3 dependencies and Staticcheck so the fork builds, and
refresh generated files and depaware inventories.

Make testwrapper fail on build, setup, and package failures, including
tests that time out without a final event, while still retrying marked
flaky tests. Print each package result once.

Fuzz this fork's own targets with ClusterFuzzLite instead of building
upstream through OSS-Fuzz. Fix license headers and the empty-interval
connstats assertion, upgrade artifact uploads, restrict job
permissions, and allow the upstream-only VM job to be skipped.

Author: EhabY

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,7 @@
+# Copyright (c) Tailscale Inc & AUTHORS
+# SPDX-License-Identifier: BSD-3-Clause
+
+FROM gcr.io/oss-fuzz-base/base-builder-go
+COPY . $SRC/tailscale
+WORKDIR $SRC/tailscale
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+# Copyright (c) Tailscale Inc & AUTHORS
+# SPDX-License-Identifier: BSD-3-Clause
+
+tool=github.com/AdamKorcz/go-118-fuzz-build
+ref=fc5dc53b9db8a38c394c53d6e439a1410cf8fc19
+work=$(mktemp -d)
+version=$(awk '/^go / { print $2 }' go.mod)
+goroot=$(GOTOOLCHAIN="go$version" go env GOROOT)
+# The v2 builder modifies testing internals and must match the Go toolchain.
+cp -a "$goroot/." "$work/goroot"
+chmod -R u+w "$work/goroot"
+export GOROOT="$work/goroot" GOTOOLCHAIN=local
+export PATH="$work/bin:$GOROOT/bin:$PATH"
+GOBIN="$work/bin" go install "$tool@$ref"
+mv "$work/bin/go-118-fuzz-build" "$work/bin/go-118-fuzz-build_v2"
+go get "$tool/testing@$ref"
+compile_native_go_fuzzer_v2 tailscale.com/net/dns/resolver FuzzClampEDNSSize clamp_edns_size
+compile_native_go_fuzzer_v2 tailscale.com/util/hashx Fuzz hashx
+compile_native_go_fuzzer_v2 tailscale.com/util/deephash FuzzTime deephash_time
+compile_native_go_fuzzer_v2 tailscale.com/util/deephash FuzzAddr deephash_addr

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: go

.github/workflows/test.yml

@@ -2,19 +2,7 @@
 # both PRs and merged commits, and for the latter reports failures to slack.
 name: CI
 
-env:
-  # Our fuzz job, powered by OSS-Fuzz, fails periodically because we upgrade to
-  # new Go versions very eagerly. OSS-Fuzz is a little more conservative, and
-  # ends up being unable to compile our code.
-  #
-  # When this happens, we want to disable the fuzz target until OSS-Fuzz catches
-  # up. However, we also don't want to forget to turn it back on when OSS-Fuzz
-  # can once again build our code.
-  #
-  # This variable toggles the fuzz job between two modes:
-  #  - false: we expect fuzzing to be happy, and should report failure if it's not.
-  #  - true: we expect fuzzing is broken, and should report failure if it start working.
-  TS_FUZZ_CURRENTLY_BROKEN: false
+permissions: {}
 
 on:
   push:
@@ -40,6 +28,8 @@ concurrency:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
       matrix:
@@ -116,6 +106,8 @@ jobs:
           fi
 
   windows:
+    permissions:
+      contents: read
     runs-on: windows-2022
     steps:
       - name: checkout
@@ -151,6 +143,8 @@ jobs:
         run: go test -bench . -benchtime 1x ./...
 
   vm:
+    permissions:
+      contents: read
     runs-on: ["self-hosted", "linux", "vm"]
     # VM tests run with some privileges, don't let them run on 3p PRs.
     if: github.repository == 'tailscale/tailscale'
@@ -171,6 +165,8 @@ jobs:
           XDB_CACHE_HOME: "/var/lib/ghrunner/cache"
 
   cross: # cross-compile checks, build only.
+    permissions:
+      contents: read
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
       matrix:
@@ -248,6 +244,8 @@ jobs:
 
   ios: # similar to cross above, but iOS can't build most of the repo. So, just
     #make it build a few smoke packages.
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -259,6 +257,8 @@ jobs:
           GOARCH: arm64
 
   android:
+    permissions:
+      contents: read
     # similar to cross above, but android fails to build a few pieces of the
     # repo. We should fix those pieces, they're small, but as a stepping stone,
     # only test the subset of android that our past smoke test checked.
@@ -281,65 +281,33 @@ jobs:
           GOARCH: arm64
 
   fuzz:
-    # This target periodically breaks (see TS_FUZZ_CURRENTLY_BROKEN at the top
-    # of the file), so it's more complex than usual: the 'build fuzzers' step
-    # might fail, and depending on the value of 'TS_FUZZ_CURRENTLY_BROKEN', that
-    # might or might not be fine. The steps after the build figure out whether
-    # the success/failure is expected, and appropriately pass/fail the job
-    # overall accordingly.
-    #
-    # Practically, this means that all steps after 'build fuzzers' must have an
-    # explicit 'if' condition, because the default condition for steps is
-    # 'success()', meaning "only run this if no previous steps failed".
+    permissions:
+      contents: read
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-22.04
     steps:
       - name: build fuzzers
-        id: build
-        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-        # continue-on-error makes steps.build.conclusion be 'success' even if
-        # steps.build.outcome is 'failure'. This means this step does not
-        # contribute to the job's overall pass/fail evaluation.
-        continue-on-error: true
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
-          oss-fuzz-project-name: "tailscale"
-          dry-run: false
           language: go
-      - name: report unexpectedly broken fuzz build
-        if: steps.build.outcome == 'failure' && env.TS_FUZZ_CURRENTLY_BROKEN != 'true'
-        run: |
-          echo "fuzzer build failed, see above for why"
-          echo "if the failure is due to OSS-Fuzz not being on the latest Go yet,"
-          echo "set TS_FUZZ_CURRENTLY_BROKEN=true in .github/workflows/test.yml"
-          echo "to temporarily disable fuzzing until OSS-Fuzz works again."
-          exit 1
-      - name: report unexpectedly working fuzz build
-        if: steps.build.outcome == 'success' && env.TS_FUZZ_CURRENTLY_BROKEN == 'true'
-        run: |
-          echo "fuzzer build succeeded, but we expect it to be broken"
-          echo "please set TS_FUZZ_CURRENTLY_BROKEN=false in .github/workflows/test.yml"
-          echo "to reenable fuzz testing"
-          exit 1
+          keep-unaffected-fuzz-targets: true
       - name: run fuzzers
         id: run
-        # Run the fuzzers whenever they're able to build, even if we're going to
-        # report a failure because TS_FUZZ_CURRENTLY_BROKEN is set to the wrong
-        # value.
-        if: steps.build.outcome == 'success'
-        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
-          oss-fuzz-project-name: "tailscale"
           fuzz-seconds: 300
-          dry-run: false
           language: go
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: upload crash
-        uses: actions/upload-artifact@v3
-        if: steps.run.outcome != 'success' && steps.build.outcome == 'success'
+        uses: actions/upload-artifact@v4
+        if: failure() && steps.run.outcome == 'failure'
         with:
           name: artifacts
           path: ./out/artifacts
 
   depaware:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -354,6 +322,8 @@ jobs:
           find . -name 'depaware.txt' | xargs -n1 dirname | xargs ./tool/go run github.com/tailscale/depaware --check
 
   go_generate:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -371,6 +341,8 @@ jobs:
           git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go generate'."; exit 1)
 
   go_mod_tidy:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -387,6 +359,8 @@ jobs:
           git diff --name-only --exit-code || (echo "Please run 'go mod tidy'."; exit 1)
 
   licenses:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
@@ -395,6 +369,8 @@ jobs:
         run: ./scripts/check_license_headers.sh .
 
   staticcheck:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     strategy:
       fail-fast: false # don't abort the entire matrix if one element fails
@@ -483,4 +459,5 @@ jobs:
         if: github.event_name != 'push'
         uses: re-actors/alls-green@release/v1
         with:
+          allowed-skips: ${{ github.repository != 'tailscale/tailscale' && 'vm' || '' }}
           jobs: ${{ toJSON(needs) }}

cmd/derper/depaware.txt

@@ -168,7 +168,6 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         golang.org/x/crypto/nacl/box                                 from tailscale.com/types/key+
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices
         golang.org/x/exp/maps                                        from tailscale.com/types/views
         golang.org/x/exp/slices                                      from tailscale.com/net/tsaddr+
    L    golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+

cmd/tailscale/depaware.txt

@@ -163,7 +163,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
         golang.org/x/crypto/pbkdf2                                   from software.sslmate.com/src/go-pkcs12
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices+
+        golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe+
         golang.org/x/exp/maps                                        from tailscale.com/types/views+
         golang.org/x/exp/slices                                      from tailscale.com/net/tsaddr+
         golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
@@ -213,6 +213,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         crypto/hkdf                                                  from crypto/internal/hpke+
         crypto/hmac                                                  from crypto/tls+
         crypto/md5                                                   from crypto/tls+
+        crypto/pbkdf2                                                from golang.org/x/crypto/pbkdf2
         crypto/rand                                                  from crypto/ed25519+
         crypto/rc4                                                   from crypto/tls
         crypto/rsa                                                   from crypto/tls+

cmd/tailscaled/depaware.txt

@@ -11,7 +11,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    W    github.com/alexbrainman/sspi/internal/common                 from github.com/alexbrainman/sspi/negotiate
    W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
   LD    github.com/anmitsu/go-shlex                                  from tailscale.com/tempfork/gliderlabs/ssh
-   L    github.com/aws/aws-sdk-go-v2                                 from github.com/aws/aws-sdk-go-v2/internal/ini
    L    github.com/aws/aws-sdk-go-v2/aws                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/aws-sdk-go-v2/aws/arn                         from tailscale.com/ipn/store/awsstore
    L    github.com/aws/aws-sdk-go-v2/aws/defaults                    from github.com/aws/aws-sdk-go-v2/service/ssm+
@@ -29,12 +28,18 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
+   L    github.com/aws/aws-sdk-go-v2/credentials/logincreds          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/feature/ec2/imds                from github.com/aws/aws-sdk-go-v2/config+
    L    github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config from github.com/aws/aws-sdk-go-v2/feature/ec2/imds
+   L    github.com/aws/aws-sdk-go-v2/internal/auth                   from github.com/aws/aws-sdk-go-v2/aws/signer/v4+
+   L    github.com/aws/aws-sdk-go-v2/internal/auth/smithy            from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/aws-sdk-go-v2/internal/configsources          from github.com/aws/aws-sdk-go-v2/service/ssm+
+   L    github.com/aws/aws-sdk-go-v2/internal/context                from github.com/aws/aws-sdk-go-v2/aws/retry+
+   L    github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/signin+
+   L    github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints+
    L    github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
@@ -44,7 +49,11 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
    L    github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
    L    github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
+   L    github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/aws-sdk-go-v2/service/signin                  from github.com/aws/aws-sdk-go-v2/config+
+   L    github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/signin
+   L    github.com/aws/aws-sdk-go-v2/service/signin/types            from github.com/aws/aws-sdk-go-v2/credentials/logincreds+
    L    github.com/aws/aws-sdk-go-v2/service/ssm                     from tailscale.com/ipn/store/awsstore
    L    github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/ssm
    L    github.com/aws/aws-sdk-go-v2/service/ssm/types               from github.com/aws/aws-sdk-go-v2/service/ssm+
@@ -58,20 +67,26 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
    L    github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
+   L    github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
    L    github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
    L    github.com/aws/smithy-go/document                            from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/encoding                            from github.com/aws/smithy-go/encoding/json+
    L    github.com/aws/smithy-go/encoding/httpbinding                from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
    L    github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/signin+
+   L    github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/signin+
    L    github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
    L    github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
    L    github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
+   L    github.com/aws/smithy-go/metrics                             from github.com/aws/aws-sdk-go-v2/aws/retry+
    L    github.com/aws/smithy-go/middleware                          from github.com/aws/aws-sdk-go-v2/aws+
+   L    github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/ssm+
+   L    github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
    L    github.com/aws/smithy-go/waiter                              from github.com/aws/aws-sdk-go-v2/service/ssm
@@ -376,7 +391,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/crypto/poly1305                                 from github.com/tailscale/golang-x-crypto/ssh+
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
   LD    golang.org/x/crypto/ssh                                      from tailscale.com/ssh/tailssh+
-        golang.org/x/exp/constraints                                 from golang.org/x/exp/slices+
+        golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe+
         golang.org/x/exp/maps                                        from tailscale.com/wgengine+
         golang.org/x/exp/slices                                      from tailscale.com/ipn/ipnlocal+
         golang.org/x/net/bpf                                         from github.com/mdlayher/genetlink+