Demo or sample project for Python?

[heitorlessa]

Hey, firstly, thank you for this. I've just discovered it through OSSF Scorecard -- are there any demo in Python or known project adopting this project I could learn more from?

The only bit I'm confused is defining the target - docs were mostly focused on C, and the Python build integration didn't cover the target bit.

What I've tried so far (no target yet): aws-powertools/powertools-lambda-python#2684.

I also noticed you seem to have integration with hypothesis, any working sample would be much appreciated!

Thank you!

[jonathanmetzman]

Hi,
I'm not so familiar with the Python fuzzing, but there are a bunch of OSS-Fuzz examples you can take a look at for inspiration:
https://github.com/search?q=repo%3Agoogle%2Foss-fuzz+python+language%3Ayaml&type=code
This is one that uses hypothesis.

Actually, OSS-Fuzz itself uses ClusterFuzzLite for python fuzzing and can be learned from: https://github.com/google/oss-fuzz/tree/master/.clusterfuzzlite though it is a bit weird and may not be the best example.

Please let me know if you have more questions or how I can help.

[heitorlessa]

This is great (should've tried using GH Search 🤦🏻 ) -- the main area I got confused is how to define a target, since the docs didn't cover that piece.

I'll take look at these examples and would happily make a PR to improve the docs once I get it working.

Thank you!!

[juju4]

also interested in more details example to fuzz a python sdk, if possible independently of underlying API.
have some controls in python module but imho, most of the security depends on the REST API below which is a separate project.
Did an initial test but getting "ERROR: Package 'python-openobserve' requires a different Python: 3.8.3 not in '>3.9'"
https://github.com/juju4/python-openobserve/actions/runs/15668705059/job/44136249264