Skip to content

[pull] master from google:master - #182

Merged
pull[bot] merged 2 commits into
threatcode:masterfrom
google:master
Jul 21, 2026
Merged

[pull] master from google:master#182
pull[bot] merged 2 commits into
threatcode:masterfrom
google:master

Conversation

@pull

@pull pull Bot commented Jul 21, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

OSS-Fuzz Team and others added 2 commits July 21, 2026 09:41
PiperOrigin-RevId: 951540756
…15894)

## Overview

Several main_repo properties of the project.yaml files are outadated or
invalid. We're using this property as source of truth for the
repositories on Clusterfuzz, so it should be updated and correct.

All projects were investigated against their `Dockerfile`s, build
scripts, and upstream Git mirrors. 67 projects have been updated with
valid, active Git repositories and verified via automated `git clone
--depth 1` checks.

---

## Root Causes of Failures

The failures fall into four main categories:

1. **Non-Git Version Control Systems (SVN / Mercurial / Fossil / Bazaar
/ Tarballs)**
- Projects configured with SVN (`svn.code.sf.net`, `svn.apache.org`,
`svn.freebsd.org`, `svn.xvid.org`), Mercurial (`hg.mozilla.org`,
`www.mercurial-scm.org`), Fossil web interfaces (`sqlite.org/src/dir`),
Launchpad Bazaar URLs, or direct `.tar.bz2` download links.
- *Resolution*: Updated to official Git repositories or maintained Git
mirrors (e.g. `"https://github.com/sqlite/sqlite"`,
`"https://github.com/mozilla/gecko-dev"`,
`"https://github.com/apache/xerces2-j"`).

2. **Incompatible & Blocked Protocols (`git://`, `git@`, and HTTP 403
blocks)**
- Projects using the unencrypted `git://` protocol (port 9418) or SSH
(`git@github.com:`), which fail in sandboxed Cloud Run environments.
- Projects on GitLab / GNOME / Gitea instances where automated cloning
without `.git` or via standard agents returned `HTTP 403 Forbidden` /
connect tunnel errors.
- *Resolution*: Converted to HTTPS Git URLs and official GitHub/GitLab
mirror endpoints (e.g. `"https://github.com/GNOME/glib"`,
`"https://github.com/typetools/checker-framework"`).

3. **Malformed URLs & Web Directory Paths**
- URLs pointing to GitHub organization roots rather than repositories
(e.g., `https://github.com/argoproj`, `https://github.com/knative`,
`https://github.com/dapr`).
- URLs containing GitHub branch/folder web views (`/tree/master/...`) or
Gitiles web UI links (`/+/refs/heads/master`).
- URLs with trailing whitespace or extra command arguments (e.g.
`libpng-proto`).
- *Resolution*: Corrected to the specific primary repository root (e.g.
`"https://github.com/argoproj/argo-cd"`,
`"https://github.com/knative/serving"`,
`"https://android.googlesource.com/platform/external/cbor-java"`).

4. **Relocated & Renamed Upstream Repositories**
- Projects whose original upstream hosting was shut down (e.g. Heptapod)
or moved to new GitHub/GitLab organizations (e.g., `openpyxl`, `cffi`).
- *Resolution*: Updated to the current active upstream Git repositories.

---

## Detailed Summary of Changes

The table below lists all 67 modified projects with the previous and
updated `main_repo` links as the primary columns:

| Previous `main_repo` (Before) | Updated `main_repo` (After) | Project
Name | Project Config Link |
| :--- | :--- | :--- | :--- |
| `"https://github.com/argoproj"` |
`"https://github.com/argoproj/argo-cd"` | **argo** |
[argo/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/argo/project.yaml)
|
| `"https://www.bearssl.org/git/BearSSL"` |
`"https://bearssl.org/git/BearSSL"` | **bearssl** |
[bearssl/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/bearssl/project.yaml)
|
| `'https://github.com/guidovranken/bignum-fuzzer'` |
`"https://github.com/sjamaan/bignum-fuzzer"` | **bignum-fuzzer** |
[bignum-fuzzer/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/bignum-fuzzer/project.yaml)
|
| `"https://github.com/bminor/binutils-gdb"` |
`"https://sourceware.org/git/binutils-gdb"` | **binutils** |
[binutils/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/binutils/project.yaml)
|
| `"https://code.launchpad.net/~leonardr/beautifulsoup/bs4"` |
`"https://git.launchpad.net/beautifulsoup"` | **bs4** |
[bs4/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/bs4/project.yaml)
|
|
`"https://android.googlesource.com/platform/external/cbor-java/+/refs/heads/master"`
| `"https://android.googlesource.com/platform/external/cbor-java"` |
**cbor-java** |
[cbor-java/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/cbor-java/project.yaml)
|
| `"https://foss.heptapod.net/pypy/cffi"` |
`"https://github.com/python-cffi/cffi"` | **cffi** |
[cffi/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/cffi/project.yaml)
|
| `"git@github.com:typetools/checker-framework.git"` |
`"https://github.com/typetools/checker-framework"` |
**checker-framework** |
[checker-framework/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/checker-framework/project.yaml)
|
| `"https://github.com/guidovranken/cryptofuzz"` |
`"https://github.com/MozillaSecurity/cryptofuzz"` | **cryptofuzz** |
[cryptofuzz/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/cryptofuzz/project.yaml)
|
| `"https://github.com/dapr"` | `"https://github.com/dapr/dapr"` |
**dapr** |
[dapr/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/dapr/project.yaml)
|
| `"git://thekelleys.org.uk/dnsmasq.git"` |
`"https://thekelleys.org.uk/git/dnsmasq"` | **dnsmasq** |
[dnsmasq/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/dnsmasq/project.yaml)
|
| `"https://svn.code.sf.net/p/docutils/code/trunk"` |
`"https://repo.or.cz/docutils"` | **docutils** |
[docutils/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/docutils/project.yaml)
|
| `"https://github.com/example/my-api"` |
`"https://github.com/google/oss-fuzz"` | **example** |
[example/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/example/project.yaml)
|
| `"https://hg.mozilla.org/mozilla-central/"` |
`"https://github.com/mozilla/gecko-dev"` | **firefox** |
[firefox/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/firefox/project.yaml)
|
| `"https://svn.code.sf.net/p/freeimage/svn/"` |
`"https://github.com/WinMerge/freeimage"` | **freeimage** |
[freeimage/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/freeimage/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/gdk-pixbuf.git"` |
`"https://github.com/GNOME/gdk-pixbuf"` | **gdk-pixbuf** |
[gdk-pixbuf/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/gdk-pixbuf/project.yaml)
|
| `"https://git.osgeo.org/gitea/geos/geos.git"` |
`"https://github.com/libgeos/geos"` | **geos** |
[geos/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/geos/project.yaml)
|
| `"git://git.ghostscript.com/ghostpdl.git"` |
`"https://github.com/ArtifexSoftware/ghostpdl"` | **ghostscript** |
[ghostscript/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/ghostscript/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/glib"` |
`"https://github.com/GNOME/glib"` | **glib** |
[glib/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/glib/project.yaml)
|
| `"https://svn.code.sf.net/p/gnucobol/code/branches/gnucobol-3.x"` |
`"https://github.com/OCamlPro/gnucobol"` | **gnucobol** |
[gnucobol/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/gnucobol/project.yaml)
|
| `"git://git.gnupg.org/gnupg.git"` | `"https://github.com/gpg/gnupg"` |
**gnupg** |
[gnupg/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/gnupg/project.yaml)
|
| `"https://github.com/google/go-cmp/cmp"` |
`"https://github.com/google/go-cmp"` | **go-cmp** |
[go-cmp/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/go-cmp/project.yaml)
|
| `"https://foss.heptapod.net/graphicsmagick/graphicsmagick"` |
`"https://github.com/GraphicsMagick/GraphicsMagick"` |
**graphicsmagick** |
[graphicsmagick/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/graphicsmagick/project.yaml)
|
| `"https://github.com/apache/hive/tree/master/"` |
`"https://github.com/apache/hive"` | **hive** |
[hive/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/hive/project.yaml)
|
| `"git://w1.fi/srv/git/hostap.git"` | `"https://w1.fi/hostap.git"` |
**hostap** |
[hostap/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/hostap/project.yaml)
|
| `"https://svn.code.sf.net/p/hsqldb/svn/"` |
`"https://github.com/hsqldb/hsqldb"` | **hsqldb** |
[hsqldb/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/hsqldb/project.yaml)
|
| `"https://github.com/hyperium/"` |
`"https://github.com/hyperium/http"` | **hyperium** |
[hyperium/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/hyperium/project.yaml)
|
| `"git://git.ghostscript.com/jbig2dec.git"` |
`"https://github.com/ArtifexSoftware/jbig2dec"` | **jbig2dec** |
[jbig2dec/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/jbig2dec/project.yaml)
|
| `"git@github.com:google/jimfs.git"` |
`"https://github.com/google/jimfs"` | **jimfs** |
[jimfs/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/jimfs/project.yaml)
|
| `"https://github.com/knative"` |
`"https://github.com/knative/serving"` | **knative** |
[knative/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/knative/project.yaml)
|
| `"https://svn.code.sf.net/p/lame/svn/trunk/lame"` |
`"https://github.com/Distrotech/lame"` | **lame** |
[lame/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/lame/project.yaml)
|
| `"git://git.gnunet.org/libmicrohttpd2.git"` |
`"https://github.com/Karlson2k/libmicrohttpd"` | **libmicrohttpd2** |
[libmicrohttpd2/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libmicrohttpd2/project.yaml)
|
| `"https://git.code.sf.net/p/libpng/code libpng-code"` |
`"https://github.com/pnggroup/libpng"` | **libpng-proto** |
[libpng-proto/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libpng-proto/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/librsvg.git"` |
`"https://github.com/GNOME/librsvg"` | **librsvg** |
[librsvg/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/librsvg/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/libsoup.git"` |
`"https://github.com/GNOME/libsoup"` | **libsoup** |
[libsoup/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libsoup/project.yaml)
|
| `"git://gcc.gnu.org/git/gcc.git"` | `"https://gcc.gnu.org/git/gcc"` |
**libstdcpp** |
[libstdcpp/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libstdcpp/project.yaml)
|
| `"http://svn.freebsd.org/base/head/sys/teken/"` |
`"https://github.com/freebsd/freebsd-src"` | **libteken** |
[libteken/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libteken/project.yaml)
|
| `"https://git.xiph.org/theora.git"` |
`"https://gitlab.xiph.org/xiph/theora"` | **libtheora** |
[libtheora/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libtheora/project.yaml)
|
| `"git://people.freedesktop.org/~dvdhrm/libtsm"` |
`"https://github.com/kmscon/libtsm"` | **libtsm** |
[libtsm/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libtsm/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/libxml2.git"` |
`"https://github.com/GNOME/libxml2"` | **libxml2** |
[libxml2/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libxml2/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/libxslt.git"` |
`"https://github.com/GNOME/libxslt"` | **libxslt** |
[libxslt/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/libxslt/project.yaml)
|
| `"https://www.mercurial-scm.org/repo/hg"` |
`"https://github.com/facebook/sapling"` | **mercurial** |
[mercurial/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/mercurial/project.yaml)
|
| `"git://git.ghostscript.com/mupdf.git"` |
`"https://github.com/ArtifexSoftware/mupdf"` | **mupdf** |
[mupdf/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/mupdf/project.yaml)
|
| `"git://git.code.sf.net/p/net-snmp/code"` |
`"https://github.com/net-snmp/net-snmp"` | **net-snmp** |
[net-snmp/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/net-snmp/project.yaml)
|
| `"https://github.com/notaryproject"` |
`"https://github.com/notaryproject/notary"` | **notary** |
[notary/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/notary/project.yaml)
|
| `"https://hg.mozilla.org/projects/nss"` |
`"https://github.com/nss-dev/nss"` | **nss** |
[nss/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/nss/project.yaml)
|
| `"https://bitbucket.nwtime.org/pc/ntp.git"` |
`"https://github.com/ntp-project/ntp"` | **ntp** |
[ntp/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/ntp/project.yaml)
|
| `"https://foss.heptapod.net/openpyxl/openpyxl"` |
`"https://github.com/ericgazoni/openpyxl"` | **openpyxl** |
[openpyxl/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/openpyxl/project.yaml)
|
|
`"https://sourceforge.net/projects/pidgin/files/Pidgin/2.14.4/pidgin-2.14.4.tar.bz2"`
| `"https://github.com/pidgin/pidgin"` | **pidgin** |
[pidgin/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/pidgin/project.yaml)
|
| `"https://github.com/guidovranken/piex.git"` |
`"https://android.googlesource.com/platform/external/piex"` | **piex** |
[piex/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/piex/project.yaml)
|
| `"https://git.osgeo.org/gitea/postgis/postgis.git"` |
`"https://github.com/postgis/postgis"` | **postgis** |
[postgis/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/postgis/project.yaml)
|
| `"https://git.postgresql.org/git/postgresql"` |
`"https://github.com/postgres/postgres"` | **postgresql** |
[postgresql/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/postgresql/project.yaml)
|
| `"http://github.com/matthewwithanm/python-markdownify"` |
`"https://github.com/matthewwithanm/python-markdownify"` |
**python-markdownify** |
[python-markdownify/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/python-markdownify/project.yaml)
|
| `"git://code.qt.io/qt/qt5.git"` | `"https://code.qt.io/qt/qt5"` |
**qt** |
[qt/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/qt/project.yaml)
|
| `"https://github.com/QubesOS"` |
`"https://github.com/QubesOS/qubes-app-linux-input-proxy"` |
**qubes-os** |
[qubes-os/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/qubes-os/project.yaml)
|
| `"http://www.litech.org/radvd"` |
`"https://github.com/radvd-project/radvd"` | **radvd** |
[radvd/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/radvd/project.yaml)
|
| `"https://hg.mozilla.org/mozilla-central/"` |
`"https://github.com/mozilla/gecko-dev"` | **spidermonkey** |
[spidermonkey/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/spidermonkey/project.yaml)
|
| `"https://hg.mozilla.org/mozilla-central/"` |
`"https://github.com/mozilla/gecko-dev"` | **spidermonkey-ufi** |
[spidermonkey-ufi/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/spidermonkey-ufi/project.yaml)
|
| `"https://sqlite.org/src/dir"` | `"https://github.com/sqlite/sqlite"`
| **sqlite3** |
[sqlite3/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/sqlite3/project.yaml)
|
|
`"https://github.com/openjdk/jdk/tree/master/src/java.xml/share/classes"`
| `"https://github.com/openjdk/jdk"` | **stax** |
[stax/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/stax/project.yaml)
|
| `"https://gitlab.gnome.org/GNOME/tinysparql"` |
`"https://github.com/GNOME/tinysparql"` | **tinysparql** |
[tinysparql/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/tinysparql/project.yaml)
|
| `"https://git.torproject.org/tor.git"` |
`"https://gitlab.torproject.org/tpo/core/tor"` | **tor** |
[tor/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/tor/project.yaml)
|
| `"https://github.com/unicode-rs"` |
`"https://github.com/unicode-rs/unicode-normalization"` | **unicode-rs**
|
[unicode-rs/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/unicode-rs/project.yaml)
|
| `"https://xenbits.xen.org/git-http/xen.git"` |
`"https://github.com/xen-project/xen"` | **xen** |
[xen/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/xen/project.yaml)
|
| `"http://svn.apache.org/repos/asf/xerces/java/trunk"` |
`"https://github.com/apache/xerces2-j"` | **xerces** |
[xerces/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/xerces/project.yaml)
|
| `"https://svn.apache.org/repos/asf/xerces/c/trunk"` |
`"https://github.com/apache/xerces-c"` | **xerces-c** |
[xerces-c/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/xerces-c/project.yaml)
|
| `"http://svn.xvid.org/trunk"` |
`"https://github.com/Distrotech/xvidcore"` | **xvid** |
[xvid/project.yaml](file:///usr/local/google/home/javanlacerda/repos/oss-fuzz/projects/xvid/project.yaml)
|

---

## Verification and Testing

1. **Automated `git clone --depth 1` Verification**: All 67 updated
repository URLs were tested with live `git clone --depth 1` over HTTPS
in an isolated temporary workspace directory. 100% of tested
repositories succeeded and were immediately cleaned up.
2. **YAML Syntax Validation**: All modified `project.yaml` files were
validated to ensure valid YAML syntax and formatting.

---------

Signed-off-by: Javan Lacerda <javanlacerda@google.com>
@pull pull Bot locked and limited conversation to collaborators Jul 21, 2026
@pull pull Bot added the ⤵️ pull label Jul 21, 2026
@pull
pull Bot merged commit ea7eeb3 into threatcode:master Jul 21, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant