[pull] master from google:master

projects/iniparser/project.yaml

@@ -0,0 +1,12 @@
+homepage: "https://gitlab.com/iniparser/iniparser"
+language: c
+primary_contact: "iniparser@gmail.com"
+main_repo: "https://gitlab.com/iniparser/iniparser"
+file_github_issue: true
+auto_ccs:
+  - "iniparser@moellendorf.eu"
+sanitizers:
+  - address
+  - memory:
+     experimental: True
+  - undefined

projects/phosphor-certificate-manager/Dockerfile

@@ -0,0 +1,24 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder
+RUN apt-get update && apt-get install -y pkg-config libsystemd-dev libssl-dev libboost-all-dev systemd
+RUN pip3 install Inflection Mako meson ninja PyYAML jsonschema
+
+RUN git clone --depth 1 https://github.com/openbmc/phosphor-certificate-manager.git phosphor-certificate-manager
+WORKDIR phosphor-certificate-manager
+COPY build.sh sdbusplus.patch stdplus.patch meson.patch parse_cert_fuzzer.cpp fuzzing_meson.build $SRC/
+COPY corpus $SRC/corpus/

projects/phosphor-certificate-manager/build.sh

@@ -0,0 +1,66 @@
+#!/bin/bash -eu
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+# Disable C99 extension warning in C++ (triggered by SD_BUS_ERROR_NULL in systemd headers)
+export CXXFLAGS="$CXXFLAGS -Wno-c99-extensions"
+
+# Download subprojects (only top-level ones)
+meson subprojects download
+
+# Reset subprojects if they exist (for local rebuilding)
+if [ -d subprojects/sdbusplus ]; then git -C subprojects/sdbusplus checkout -- .; fi
+if [ -d subprojects/stdplus ]; then git -C subprojects/stdplus checkout -- .; fi
+
+# Apply patch to meson.build and meson.options to enable fuzzing
+git apply $SRC/meson.patch
+
+# Copy fuzzer files into the source tree
+mkdir -p fuzzing
+cp $SRC/parse_cert_fuzzer.cpp fuzzing/
+cp $SRC/fuzzing_meson.build fuzzing/meson.build
+
+# Clean build directory
+rm -rf builddir
+
+# Configure the project with Meson (this will download nested subprojects like stdplus)
+meson setup builddir \
+    -Dfuzzing=enabled \
+    -Dfuzzing_engine="$LIB_FUZZING_ENGINE" \
+    -Dtests=disabled \
+    -Dallow-expired=enabled \
+    -Dwerror=false \
+    -Ddefault_library=static \
+    --buildtype=debugoptimized
+
+# NOW patch the subprojects
+# Patch sdbusplus missing include
+sed -i '1s/^/#include <unistd.h>\n/' subprojects/sdbusplus/include/sdbusplus/event.hpp
+
+# Apply systemd compatibility patch to sdbusplus
+git -C subprojects/sdbusplus apply $SRC/sdbusplus.patch
+
+# Apply libc++ compatibility patch to stdplus
+git -C subprojects/stdplus apply $SRC/stdplus.patch
+
+# Build the fuzzer
+ninja -C builddir fuzzing/parse_cert_fuzzer
+
+# Copy the fuzzer to $OUT
+cp builddir/fuzzing/parse_cert_fuzzer $OUT/
+
+# Package seed corpus
+zip -j $OUT/parse_cert_fuzzer_seed_corpus.zip $SRC/corpus/*

projects/phosphor-certificate-manager/corpus/seed_expired.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIICzjCCAbagAwIBAgIUP9qXqH/i0yW8YOVNiacGQ17iRW4wDQYJKoZIhvcNAQEL
+BQAwITEQMA4GA1UECgwHRnV6emluZzENMAsGA1UEAwwEU2VlZDAeFw0xMDAxMDEw
+MDAwMDBaFw0yMDAxMDEwMDAwMDBaMCExEDAOBgNVBAoMB0Z1enppbmcxDTALBgNV
+BAMMBFNlZWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCho5QeYNmI
+5OJB+ZaGKdoxutrkyQyTCIP36WjpiXd71lWzZpfU27oEewHiGoCRH817c7L1c3JH
+Z5LSVOGOnRG0c9DRu6Llp1KJkiY4FvGZVRz9EZJeD70nONlk4RYDBsTKYcOTZFNA
+Th0hbmpTcPudOKF29jTCOFAz3n77GWKh4+FBCDiwQ11Sz01dBlPb52Aq4dY7LMWM
+akAvkk2YxTAKfu+kgkg3a9FliUwm4peimZ5+jS3uG3MXGqIr5o8RKVy+7mMdPui9
+NSjWPIlWKnq+0oH41NmcT5nHea3mr9uR0kVPXY8CcLo8FlK6r5NwTp1uzmaItbRN
+8FB3k8gCZBBZAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEysL64hkxD4+bSOQvvJ
+f73M58WJqOpbgW4LV5+eLE/x1hQ9Ys/AuWnfX+avNNXBoKPWaMd1ek1xfmRk0PXb
+j1aThgRsKGzfMHhTjRVwNuvPouSql3KZ+BS9SK19Q0kEQpchIBRWGZJwGHpCI8yy
+dpTMPGdCkCzsf/S1e0OZNaQFl+8XeFAc5WdntXmwDHclIUMYa+L0X1z2W++s5QyQ
+zbVwLOeNpwo/bFqqCZXvnB5y6iFserk2D0FALs9H3+e5kNbgPKefL9NaeRERu3VM
+MlocFSsr8sVYQpPD//zq8Zsruuw6Trr+OOt4Moaea/kEKze6QFLN3zNFSQiPb9lT
+Vto=
+-----END CERTIFICATE-----

projects/phosphor-certificate-manager/corpus/seed_pre_epoch.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIICzjCCAbagAwIBAgIUdvLqtKxwl32Zf3oMUSgfEONMR88wDQYJKoZIhvcNAQEL
+BQAwITEQMA4GA1UECgwHRnV6emluZzENMAsGA1UEAwwEU2VlZDAeFw02OTEyMzEy
+MzU5NTlaFw0zMDAxMDEwMDAwMDBaMCExEDAOBgNVBAoMB0Z1enppbmcxDTALBgNV
+BAMMBFNlZWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhuhJA5+8k
+OiP53aOUpRjc2LHHSOgp7FuQrvh1kY6EHIxggf+fFqAbiaNrH+4Nfl/Cr7Q8FSFe
++S3kty76sLlU4UNEluPRxPG83Pn+n1ApFy+laBvBj3F4YDVMuMKmo7THTSqJ/fLH
+WHplPK1McsNttSJ8O51lGHpM8Wfq3lttmjM35ZTubUmBoe+PXAotY/2r5JTH4X7S
+MhlLu6IJY9ueZezj62PZlcN2Q1lRt7DxmJtX5jh7IR4q9jf3cUylD8tGoMZfj6Zh
+RN+pxo5a6MIF6tyv6BU7wYzMFGSTo3sXaSBN3no54M+Xa2SFGsb7dahMXeTc6PcA
+fF0geEQ3CWy/AgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFlE97PDC9lB7OkEOYq4
+UhIqfmKVHXvJOloU8H/aH3cRg/Cxmkxwq+JFVRg8sgdEYvUw9cLK05aTen8M29ZF
+c3htda+WQj5z1ht3HS+JH8q1xRvBNhfQTFXq1l3cxp9JQkeDQaK08Xnh+UcUMFdB
+/ZZNpCGH67RBKsgZywTgpxJauwrc8E1rhCyesIM9ZOLGLsf28LBvqPUkH8QNEqPi
+AQodAxrJjLkJk6IAr6DG/FVwi5s3olziQs8dtLzKXLsk/+jafP5DF21r/WaSgaqJ
+E6i/b3RmoWSTb3CfgpJTsQrDzR8MtfZeQwGExYirVus3PWBCTVFYSUdYakOxlRaS
+abc=
+-----END CERTIFICATE-----

projects/phosphor-certificate-manager/corpus/seed_rsa.pem

@@ -0,0 +1,47 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCxgt4YpFkH2Y2c
+s4EXq95UKYClm6SZd733ZuxjBGiCXSNdbezpxhGRHYhuaeqJDe0dbVtGmttJwWhv
+/yKmvGOLQN7U20LXUpFQMLICj3e9vf6KBt9QLejcoHfPrY9d1Uyy52KDgSio+t0D
+mPOvOQV8dWKllUvGizdFgkiN5ofA/d4tCoeLgCq3uTIxE7L4V8P4/j0kXZ3wucDe
+irwwFJl6A6228h0hEh421SVES/7GZ6ykHO2LREz4hFac8XT2cHr61IFf2jlMgLKA
+ZqPGnA7TUrGwiW7cJ/XZWXHCW+tqK7UBjfTm1j3rteRHjaS7ao0w2xMRM1PKa0fO
++bLi/H29AgMBAAECggEAUCjz2Jbm6YeRzpC1HBZt2P3A7YhCpVcQfxeIahKEi1I5
+9Sf903exWSHICWxlEC0sxZwrms+1dTIU0naZlEgAf9L0jZTSM2BC5L6ItGVLQnD4
+8CW4VIHW5ULFuA/9bPc0opmgwBfkX6Khic1ZRehvFMwBlxq7VFZryETUNNhEt55r
+MNE6E5dbWB5uGmjkvpDJr8Y0q2RhCQcAmpUAZl0BvBV7UVIamO1PdTjueRNKnv4S
+dm/rY+WiF65ohpFyTXCZxaw8zuklIE3v/1rwvHyQnaT+MLhFqEaPEGYK55xQUSME
+0pWj+0HfXZdNG9bjw5Dbev3lWqK6k9Z+/QEyRofWtQKBgQDuDI5nYz38010PDCx9
+Ok9xKGWkwlGEpSpzin9xmiBKMbzUwuHyiZUfKoTYuo4sBtdraphYVkEw5kZrXAYe
+1Xk/fV4ueidd1juaIzDfXQRRo42uGotA5t869AWNI+Cn2gFYvU06O3DacGtxX3wT
+5O4bY59AWf9bJChkG0mhSvTX1wKBgQC+5abgGJtRt3fBUkpSUXyAPYcgeFIkyaKC
+LOfgwdUz+1c+nqyc64QnvgSl0w2fhRdmcRMCJe0YX/wW/1WaqiGiJbCAE1QRrU9c
+OMAXITkqngkyEvc2giP/ro3l5vwd2ELgC7qhWf26nDLfClK0XCIykhkovINyV8um
+Mf69MnWUiwKBgCzTdnlnicOzNYHg4/vM4CrJ1aIZ6WnWBFFvkiIdSNlP1mQmMpAO
+cmNFCXEaaC1IOIaEsx1nWK1Rn48V7B0gS8212Oddn04fSmfzGn/lLywEZWiUnQZi
+s0SRsP3r9KEG/1vrgcBmcxDfPIxD08SXRnMn5lQi3mAWRfjb3pid2c9PAoGAAcGl
+LmyriS3x+SJjsqwzRA7M3nyc7N+6Eg6Nt6Cw8ICAhf/5wJveJGt4KXpupqgX1gZ2
+UU++BbpkXGXPCNRF6PMF07fZzyvUDhorkkro9r5rgT1xbtv1rtWRUqs0aKXjv6H7
+/p4QWpYzVaAHsMckPWjguGI7p2KtagMNv/nl4Q8CgYBqbhjz4GBUUCXbuxyWFHMG
+Wcgccb+pdNnNzu4VRx++qhOdMWeCPsdtDM2rOo9Doq1RBCXyfBzl/c7sIbrtrw9l
+vNF1yOlozPcf8KoBJwJI6UOOugVp9vPCzRRkDwwsKp1LUro7F/IHbmHs6IP3zRSR
+nFfuGuU+kP1E8+3J2HOg3Q==
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDKzCCAhOgAwIBAgIUbjZ3wOh+IAoVIRLn1dkz0I0grlcwDQYJKoZIhvcNAQEL
+BQAwJTEQMA4GA1UECgwHRnV6emluZzERMA8GA1UEAwwIU2VlZCBSU0EwHhcNMjYw
+NzAyMTQ0MjEzWhcNMjcwNzAyMTQ0MjEzWjAlMRAwDgYDVQQKDAdGdXp6aW5nMREw
+DwYDVQQDDAhTZWVkIFJTQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALGC3hikWQfZjZyzgRer3lQpgKWbpJl3vfdm7GMEaIJdI11t7OnGEZEdiG5p6okN
+7R1tW0aa20nBaG//Iqa8Y4tA3tTbQtdSkVAwsgKPd729/ooG31At6Nygd8+tj13V
+TLLnYoOBKKj63QOY8685BXx1YqWVS8aLN0WCSI3mh8D93i0Kh4uAKre5MjETsvhX
+w/j+PSRdnfC5wN6KvDAUmXoDrbbyHSESHjbVJURL/sZnrKQc7YtETPiEVpzxdPZw
+evrUgV/aOUyAsoBmo8acDtNSsbCJbtwn9dlZccJb62ortQGN9ObWPeu15EeNpLtq
+jTDbExEzU8prR875suL8fb0CAwEAAaNTMFEwHQYDVR0OBBYEFCWIpiGvzga9Jdop
+qW9czEBry5PNMB8GA1UdIwQYMBaAFCWIpiGvzga9JdopqW9czEBry5PNMA8GA1Ud
+EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAGhUZ/G1pFlrXZC4w2Uip+wx
+Djt7nesUwlcAtsq4xo+QJPNs/vDKbmwh400866/M5N2eUO+6HVezNxdSK8Yio3wI
+9/tTur6L6yrp/TuBVynPsW+bXccYtRaijN4AsmU+SUzgdCluv9uujOD7WwxBmVau
+k2g3E4Ippwhh7g1Mi96xKdWkEuzCppi/ddHr+Is5TVX6AS7VH2LbYCVYeI9RZ2dW
+w/phUnBEuzeydWPscuQCTZRg59eHPPAtdaSqNX7QcvN3AJ4TvSrTQglxgUgT9sNL
+us8YZiG+fDwCQuwWx4lE0zJXgTf064YvNM1XyM08ZV8hlUiSrlWKiBurn6ePFjU=
+-----END CERTIFICATE-----

projects/phosphor-certificate-manager/fuzzing_meson.build

@@ -0,0 +1,27 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+message('Entering fuzzing directory')
+fuzz_engine_link_args = get_option('fuzzing_engine').split()
+
+executable(
+    'parse_cert_fuzzer',
+    'parse_cert_fuzzer.cpp',
+    include_directories: include_directories('..'),
+    dependencies: [cert_manager_dep],
+    link_args: fuzz_engine_link_args,
+    install: true,
+)

projects/phosphor-certificate-manager/meson.patch

@@ -0,0 +1,55 @@
+diff --git a/meson.build b/meson.build
+index 03f3031..1db67d5 100644
+--- a/meson.build
++++ b/meson.build
+@@ -27,7 +27,7 @@ has_cli11 = meson.get_compiler('cpp').has_header_symbol(
+ if not has_cli11
+     cli11_proj = subproject('cli11', required: false)
+     assert(cli11_proj.found(), 'CLI11 is required')
+-    cli11_dep = cli11_proj.get_variable('CLI11_dep')
++    cli11_dep = cli11_proj.get_variable('cli11_dep')
+ endif
+
+ systemd_dep = dependency('systemd')
+@@ -87,9 +87,17 @@ if get_option('ca-cert-extension').allowed()
+     subdir('bmc-vmi-ca')
+ endif
+
+-subdir('dist')
++if not get_option('fuzzing').allowed()
++    subdir('dist')
++endif
++
+
+ if get_option('tests').allowed()
+     subdir('test')
+ endif
+
++if get_option('fuzzing').allowed()
++    subdir('fuzzing')
++endif
++
++
+diff --git a/meson.options b/meson.options
+index 35752e6..7298697 100644
+--- a/meson.options
++++ b/meson.options
+@@ -38,3 +38,18 @@ option(
+     value: 'enabled',
+     description: 'Allow expired certificates',
+ )
++
++option(
++    'fuzzing',
++    type: 'feature',
++    value: 'disabled',
++    description: 'Build fuzz targets',
++)
++
++option(
++    'fuzzing_engine',
++    type: 'string',
++    value: '-fsanitize=fuzzer',
++    description: 'Fuzzing engine link arguments',
++)
++

projects/phosphor-certificate-manager/parse_cert_fuzzer.cpp

@@ -0,0 +1,52 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//##############################################################################
+
+#include "x509_utils.hpp"
+#include <cstdint>
+#include <cstddef>
+#include <string>
+#include <memory>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    std::string pem(reinterpret_cast<const char*>(data), size);
+    try {
+        auto cert = phosphor::certs::parseCert(pem);
+        if (cert) {
+            // Validate start date
+            phosphor::certs::validateCertificateStartDate(*cert);
+
+            // Validate in SSL context
+            phosphor::certs::validateCertificateInSSLContext(*cert);
+
+            // Validate against an empty store.
+            // Since validateCertificateAgainstStore allows trust chain errors,
+            // this should not throw for typical untrusted certs, but will
+            // exercise the verification logic.
+            std::unique_ptr<X509_STORE, decltype(&::X509_STORE_free)> x509Store(
+                X509_STORE_new(), &X509_STORE_free);
+            if (x509Store) {
+                phosphor::certs::validateCertificateAgainstStore(*x509Store, *cert);
+            }
+        }
+    } catch (const std::exception& e) {
+        // Catch expected exceptions to prevent the fuzzer from treating them as crashes.
+    } catch (...) {
+        // Catch any other unexpected exceptions.
+    }
+    return 0;
+}

projects/phosphor-certificate-manager/project.yaml

@@ -0,0 +1,12 @@
+homepage: "https://github.com/openbmc/phosphor-certificate-manager"
+language: c++
+primary_contact: "pedroysb@google.com" # Using your LDAP as contact
+main_repo: "https://github.com/openbmc/phosphor-certificate-manager.git"
+sanitizers:
+  - address
+  - undefined
+fuzzing_engines:
+  - libfuzzer
+auto_ccs:
+  - javanlacerda@google.com
+  - cloud-ti-fuzzing+bugs@google.com

projects/phosphor-certificate-manager/sdbusplus.patch

@@ -0,0 +1,22 @@
+diff --git a/src/event.cpp b/src/event.cpp
+index 7be3df2..ebbc24d 100644
+--- a/src/event.cpp
++++ b/src/event.cpp
+@@ -153,9 +153,14 @@ source event::add_oneshot_timer(sd_event_time_handler_t handler, void* data,
+
+     source s{*this};
+
+-    auto rc = sd_event_add_time_relative(
+-        eventp, &s.sourcep, CLOCK_BOOTTIME, time.count(), accuracy.count(),
+-        handler, data);
++    uint64_t now_usec;
++    auto rc = sd_event_now(eventp, CLOCK_BOOTTIME, &now_usec);
++    if (rc >= 0)
++    {
++        rc = sd_event_add_time(
++            eventp, &s.sourcep, CLOCK_BOOTTIME, now_usec + time.count(),
++            accuracy.count(), handler, data);
++    }
+
+     if (rc < 0)
+     {