# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## 8.9.0 ### Added * Agent: Added fuzz tests for coverage recording [#3322](https://github.com/microsoft/onefuzz/pull/3322) * Agent: Added version checking in local tasks [#3517](https://github.com/microsoft/onefuzz/pull/3517) * Agent: Create directories from template specification in local task if they don't exist [#3522](https://github.com/microsoft/onefuzz/pull/3522) * CLI: Added a new command for template creation in the local task `onefuzz-task local create-template` [#3531](https://github.com/microsoft/onefuzz/pull/3531) * CLI/Deployment/Service: Support for retention policies on containers [#3501](https://github.com/microsoft/onefuzz/pull/3501) * Service: Add onefuzz service version to job created events [#3504](https://github.com/microsoft/onefuzz/pull/3504) * Service: Added a start time to job and task records [#3440](https://github.com/microsoft/onefuzz/pull/3440) ### Changed * Agent: Improved handling of unexpected breakpoints [#3493](https://github.com/microsoft/onefuzz/pull/3493) * Agent: Updated windows interceptor list [#3528](https://github.com/microsoft/onefuzz/pull/3528), [#3549](https://github.com/microsoft/onefuzz/pull/3549) * Agent: Reporting coverage on task start up, ensuring `coverage_data` is emitted at the beginning of every task instead of when `new_coverage` is identified [#3502](https://github.com/microsoft/onefuzz/pull/3502) * CLI/Deployment: Updating onefuzz cli requirements.txt to accept `>= onefuzztypes` versions [#3477](https://github.com/microsoft/onefuzz/pull/3477), [#3486](https://github.com/microsoft/onefuzz/pull/3486) * Service: Improve area/iteration path validation in notifications [#3489](https://github.com/microsoft/onefuzz/pull/3489) * Service: Remove feature flag from heartbeat metrics [#3505](https://github.com/microsoft/onefuzz/pull/3505) ### Fixed * Agent: Terminate process on timeout in Windows agents for the coverage task [#3529](https://github.com/microsoft/onefuzz/pull/3529) * Agent/Service: Bumped several C#, Python, and Rust dependencies [#3425](https://github.com/microsoft/onefuzz/pull/3425), [#3424](https://github.com/microsoft/onefuzz/pull/3424), [#3411](https://github.com/microsoft/onefuzz/pull/3411), [#3437](https://github.com/microsoft/onefuzz/pull/3437), [#3436](https://github.com/microsoft/onefuzz/pull/3436), [#3435](https://github.com/microsoft/onefuzz/pull/3435), [#3478](https://github.com/microsoft/onefuzz/pull/3478), [#3484](https://github.com/microsoft/onefuzz/pull/3484), [#3414](https://github.com/microsoft/onefuzz/pull/3414), [#3474](https://github.com/microsoft/onefuzz/pull/3474), [#3434](https://github.com/microsoft/onefuzz/pull/3434), [#3488](https://github.com/microsoft/onefuzz/pull/3488), [#3503](https://github.com/microsoft/onefuzz/pull/3503), [#3520](https://github.com/microsoft/onefuzz/pull/3520), [#3521](https://github.com/microsoft/onefuzz/pull/3521) * Agent: Fixed dependencies in `onefuzz-task` [#3552](https://github.com/microsoft/onefuzz/pull/3552) * Service: Removed unnecessary method argument in notifications processing [#3473](https://github.com/microsoft/onefuzz/pull/3473) * Service: Ignore regression work item updates when the work item is in some states [#3532](https://github.com/microsoft/onefuzz/pull/3532) ## 8.8.0 ### Added * Agent: Added Mariner Linux support for agent VMs [#3306](https://github.com/microsoft/onefuzz/pull/3306) * Service: Added support for custom ado fields that mark work items as duplicate [#3467](https://github.com/microsoft/onefuzz/pull/3467) * Service: Permanently store OneFuzz job result data - # crashing input, # regression crashing input, etc. - in Azure storage [#3380](https://github.com/microsoft/onefuzz/pull/3380), [#3439](https://github.com/microsoft/onefuzz/pull/3439) * Service: Added validation for Iteration/AreaPath on notifications when a job is submitted with a notification config and for `onefuzz debug notification test_template` [#3386](https://github.com/microsoft/onefuzz/pull/3386) ### Changed * Agent: Updated libfuzzer-fuzz basic template to include required args and make it match cli [#3429](https://github.com/microsoft/onefuzz/pull/3429) * Agent: Downgraded some debug logs from warn to debug [#3450](https://github.com/microsoft/onefuzz/pull/3450) * CLI: Removed CLI commands from the local fuzzing tasks as they can now be described via yaml template [#3428](https://github.com/microsoft/onefuzz/pull/3428) * Service: AutoScale table entries are now deleted on VMSS shutdown [#3455](https://github.com/microsoft/onefuzz/pull/3455) ### Fixed * Agent: Fixed local path generation [#3432](https://github.com/microsoft/onefuzz/pull/3432), [#3460](https://github.com/microsoft/onefuzz/pull/3460) ## 8.7.1 ### Fixed * Service: Removed deprecated Azure retention policy setting that was causing scaleset deployment errors [#3452](https://github.com/microsoft/onefuzz/pull/3452) ## 8.7.0 ### Added * Agent: Added a snapshot-based test to coverage implementation [#3368](https://github.com/microsoft/onefuzz/pull/3368) * Agent/CLI/Service: Added ability to capture crash dumps from libfuzzer, when provided [#2793](https://github.com/microsoft/onefuzz/pull/2793) [#3409](https://github.com/microsoft/onefuzz/pull/3409) * CLI/Service: Implemented `--with_tasks ` option for `onefuzz jobs get` command to expand the task information [#3343](https://github.com/microsoft/onefuzz/pull/3343) ### Changed * Agent: Migrated all the task types to the template model [#3397](https://github.com/microsoft/onefuzz/pull/3307) * Agent: Removed `srcview` code from OneFuzz since it is not currently utilized [#3376](https://github.com/microsoft/onefuzz/pull/3376) * Agent: Updated default windows VM image to windows 11 [#3374](https://github.com/microsoft/onefuzz/pull/3374) * Agent: Migrated `winapi` to `windows-rs`, the newer Microsoft supported version of the Windows API bindings for Rust [#3050](https://github.com/microsoft/onefuzz/pull/3050) * Deployment: Updated the default deployment option for `EnableWorkItemCreation` feature flag to be enabled [#3387](https://github.com/microsoft/onefuzz/pull/3387) ### Fixed * Agent: Deserialize the coverage files directly into the output files [#3410](https://github.com/microsoft/onefuzz/pull/3410) * Agent/Deployment/Service: Bumped several C#, Python, and Rust dependencies as well as the Rust edition across all Rust crates [#3396](https://github.com/microsoft/onefuzz/pull/3396), [#3161](https://github.com/microsoft/onefuzz/pull/3161), [#3346](https://github.com/microsoft/onefuzz/pull/3346), [#3391](https://github.com/microsoft/onefuzz/pull/3391), [#2870](https://github.com/microsoft/onefuzz/pull/2870), [#3392](https://github.com/microsoft/onefuzz/pull/3392), [#3402](https://github.com/microsoft/onefuzz/pull/3402) * Agent: Fixed a bug in agent `DirectoryMonitor` by adding error tolerance when attempting to fetch metadata for `CreateKind::Any` or `CreateKind::Other` events [#3393](https://github.com/microsoft/onefuzz/pull/3393) * Service: Fixed tag shadowing in logging by giving precedence to the tags produced by log messages over the tags added prior to the call, when the tag names clashed [#3388](https://github.com/microsoft/onefuzz/pull/3388) ## 8.6.3 ### Fixed * Service: Fixed another duplicate Azure DevOps work item creation case by handling `Microsoft.VSTS.Common.ResolvedReason` field when present [#3383](https://github.com/microsoft/onefuzz/pull/3383) ## 8.6.2 ### Fixed * Agent: Fixed tasks hanging when shutting down by forcefully shutting down the runtime before exiting the main task [#3378](https://github.com/microsoft/onefuzz/pull/3378) * Service: Refactored Azure DevOps template rendering to fix duplicate bugs being filed due to title truncation and added several validation tests in this area [#3370](https://github.com/microsoft/onefuzz/pull/3370) ## 8.6.1 ### Added * Service: Added feature flag to toggle Azure DevOps work item processing [#3353](https://github.com/microsoft/onefuzz/pull/3353) * Service: Requeue Azure DevOps notifications when the feature flag for work item processing is set to 'disabled' [#3358](https://github.com/microsoft/onefuzz/pull/3358) ## 8.6.0 ### Added * Agent: Implemented `debuginfo` caching [#3280](https://github.com/microsoft/onefuzz/pull/3280) ### Changed * Agent: Limit azcopy copy buffer to 512MB of RAM as the default maximum [#3293](https://github.com/microsoft/onefuzz/pull/3293) * Agent: Define local fuzzing tasks relationships through new templating model [#3117](https://github.com/microsoft/onefuzz/pull/3117) * Deployment: Replaced `--upgrade` flag with `--skip_aad_setup` flag in the deploy.py setup script [#3345](https://github.com/microsoft/onefuzz/pull/3345) * Service: Make `ServiceConfiguration` eagerly evaluated [#3136](https://github.com/microsoft/onefuzz/pull/3136) * Service: Improved `TimerRetention` performance through several UPN changes & fixes [#3289](https://github.com/microsoft/onefuzz/pull/3289) ### Fixed * Agent: Fixed resolution of sibling .NET DLLs [#3325](https://github.com/microsoft/onefuzz/pull/3325) * Agent/Service: Bumped several C# and Rust dependencies [#3319](https://github.com/microsoft/onefuzz/pull/3319), [#3320](https://github.com/microsoft/onefuzz/pull/3320), [#3317](https://github.com/microsoft/onefuzz/pull/3317), [#3297](https://github.com/microsoft/onefuzz/pull/3297), [#3301](https://github.com/microsoft/onefuzz/pull/3301), [#3291](https://github.com/microsoft/onefuzz/pull/3291), [#3195](https://github.com/microsoft/onefuzz/pull/3195), [#3328](https://github.com/microsoft/onefuzz/pull/3328) * CLI: Look for azcopy.exe in environment variable `AZCOPY` and determine if it's actually referencing a directory [#3344](https://github.com/microsoft/onefuzz/pull/3344) * CLI: Updated `repro get_files` to handle regression reports [#3340](https://github.com/microsoft/onefuzz/pull/3340) * CLI: Fixed missing `target_timeout` setting in the Libfuzzer basic template [#3334](https://github.com/microsoft/onefuzz/pull/3334) * CLI: Fixed false 'missing' dependency warning [#3331](https://github.com/microsoft/onefuzz/pull/3331) * CLI: Fixed the `debug notification test_template` command expecting a `task_id` [#3308](https://github.com/microsoft/onefuzz/pull/3308) * Deployment: Update App Registration redirect URIs if deployment uses a custom domain [#3341](https://github.com/microsoft/onefuzz/pull/3341) * Service: Fixed links in bugs filed from regression reports by populating `InputBlob` when possible [#3342](https://github.com/microsoft/onefuzz/pull/3342) * Service: Fixed several storage issues to improve platform performance and reduce spurious `404`s [#3313](https://github.com/microsoft/onefuzz/pull/3313) * Service: Added extra logging when `System.Title` is too long [#3332](https://github.com/microsoft/onefuzz/pull/3332) * Service: Render `System.Title` before trying to trim it to the max allowed size [#3329](https://github.com/microsoft/onefuzz/pull/3329) * Service: Differentiate `INVALID_JOB` and `INVALID_TASK` error codes [#3318](https://github.com/microsoft/onefuzz/pull/3318) ## 8.5.0 ### Added * Agent: Added tool to check source allowlists [#3246](https://github.com/microsoft/onefuzz/pull/3246) * Agent: Precache `debuginfo` analysis for target exe in coverage example [#3225](https://github.com/microsoft/onefuzz/pull/3225) * Agent/CLI/Service: Allow tasks environment variables to be set [#3294](https://github.com/microsoft/onefuzz/pull/3294) * CLI/Service: Correlate cli to service to facilitate event lookups in AppInsights [#3137](https://github.com/microsoft/onefuzz/pull/3137) * CLI: Added `--target_timeout` flag for qemu_user template command [#3277](https://github.com/microsoft/onefuzz/pull/3277) * Documentation: Updated Threat Model [#3215](https://github.com/microsoft/onefuzz/pull/3215) * Service: Added optional `Unless` condition when updating/re-opening Work Items [#3227](https://github.com/microsoft/onefuzz/pull/3227) * Service: Include the task ID in the prerequisite task failure message [#3219](https://github.com/microsoft/onefuzz/pull/3219) * Service: Added events retention policy passed-integration-tests [#3186](https://github.com/microsoft/onefuzz/pull/3186) ### Changed * Agent: Shrink published Rust debug info [#3247](https://github.com/microsoft/onefuzz/pull/3247), [#3252](https://github.com/microsoft/onefuzz/pull/3252) * Agent: Get rid of yanked hermit-abi versions [#3270](https://github.com/microsoft/onefuzz/pull/3270) * Documentation: Updated coverage docs to use correct quotes [#3279](https://github.com/microsoft/onefuzz/pull/3279) * Service: Better errors from Download: Make `GetFileSasUrl` nullable [#3229](https://github.com/microsoft/onefuzz/pull/3229) * Service: Changed template rendering from async to synchronous [#3241](https://github.com/microsoft/onefuzz/pull/3241) * Service: Log webhook exception as an "error" since we are retrying anyways [#3238](https://github.com/microsoft/onefuzz/pull/3238) * Service: Make `WebhookMessageEventGrid` compatible with the event grid format [#3286](https://github.com/microsoft/onefuzz/pull/3286) ### Fixed * Agent: Improved .dll redirection by setting up .local file before invoking LibFuzzer [#3269](https://github.com/microsoft/onefuzz/pull/3269) * Agent/Service: Bumped several C#, Rust dependencies, and Rust version to 1.71 [#3278](https://github.com/microsoft/onefuzz/pull/3278), [#3281](https://github.com/microsoft/onefuzz/pull/3281), [#3221](https://github.com/microsoft/onefuzz/pull/3221), [#3230](https://github.com/microsoft/onefuzz/pull/3230), [#3231](https://github.com/microsoft/onefuzz/pull/3231), [#3203](https://github.com/microsoft/onefuzz/pull/3203), [#3240](https://github.com/microsoft/onefuzz/pull/3240), [#3239](https://github.com/microsoft/onefuzz/pull/3239), [#3199](https://github.com/microsoft/onefuzz/pull/3199), [#3254](https://github.com/microsoft/onefuzz/pull/3254), [#3257](https://github.com/microsoft/onefuzz/pull/3257), [#3273](https://github.com/microsoft/onefuzz/pull/3273), [#3258](https://github.com/microsoft/onefuzz/pull/3258), [#3271](https://github.com/microsoft/onefuzz/pull/3271), [#3292](https://github.com/microsoft/onefuzz/pull/3292) * CLI/Service: Fixed regression bugs, file bugs on `regression_report` and properly reset state on duplicates [#3263](https://github.com/microsoft/onefuzz/pull/3263) * Service: Improve Azure DevOps validation problem reporting and resiliency [#3222](https://github.com/microsoft/onefuzz/pull/3222) * Service: Updated KeyVault access policy for Azure WebSites service account access [#3109](https://github.com/microsoft/onefuzz/pull/3109) * Service: Switched to default `HttpCompletion`, which is `ResponseRead` to attempt to prevent webhooks occasionally failing to send [#3259](https://github.com/microsoft/onefuzz/pull/3259) * Service: Fixed `Timestamp` response from API [#3237](https://github.com/microsoft/onefuzz/pull/3237) * Service: Trim `System.Title` if length is longer than 128 characters [#3284](https://github.com/microsoft/onefuzz/pull/3284) ## 8.4.0 ### Added * Agent: Include debug info in the release binaries to improve backtraces and debuggability [#3194](https://github.com/microsoft/onefuzz/pull/3194) * Agent: Added a timeout when closing the app insight channels [#3181](https://github.com/microsoft/onefuzz/pull/3181) * Agent: Require input marker in arguments when given an input corpus directory [#3205](https://github.com/microsoft/onefuzz/pull/3205) * Agent/CLI/Service: Added `extra_output` container, rename `extra` container [#3064](https://github.com/microsoft/onefuzz/pull/3064) * Agent: Creating `CustomMetrics` for Rust `CustomEvents` [#3188](https://github.com/microsoft/onefuzz/pull/3188) * Agent: Added prereqs for implementing caching for coverage locations and debuginfo in `coverage` task [#3218](https://github.com/microsoft/onefuzz/pull/3218) * CLI: Added command `onefuzz repro get_files` for downloading files to locally reproduce a crash [#3160](https://github.com/microsoft/onefuzz/pull/3160) * CLI: Added command `onefuzz debug notification test_template