fuzzing: gate fuzz-only relaxations on FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

Author: N3ur0sis

fuzzing/CMakeLists.txt

@@ -44,6 +44,7 @@ foreach(header ${APP_HEADERS})
 endforeach()
 list(REMOVE_DUPLICATES APP_INCLUDE_DIRS)
 
+# Enable the app's UI auto-approve (display.c) so the harness never blocks on confirmations.
 set(_fuzz_compile_defs HAVE_AUTOAPPROVE_FOR_PERF_TESTS=1)
 message(STATUS "Bitcoin fuzz build: single structured harness")
 

fuzzing/README.md

@@ -1,7 +1,7 @@
 # Bitcoin Fuzzing
 
-Bitcoin is the advanced integration in this repository. It runs on the same
-campaign pipeline as Boilerplate and uses the SDK's framework-driven entry
+This app integrates the fuzzing framework shipped with `ledger-secure-sdk`
+(on its fuzzing-framework branch). It uses the SDK's framework-driven entry
 (`fuzz_harness_entry`) for APDU routing — the Bitcoin-specific pieces are
 per-lane weighted `fuzz_commands[]` maps (via the SDK's
 `FUZZ_PICK_COMMAND_RAW` / `FUZZ_PICK_COMMAND_STRUCTURED` override hooks),
@@ -11,16 +11,16 @@ through `os_io_rx_evt()`.
 
 ## Run it
 
-From the workspace root:
+Point `BOLOS_SDK` at a `ledger-secure-sdk` checkout on the fuzzing-framework
+branch, then run the SDK campaign script from this app's root:
 
 ```bash
-BOLOS_SDK="$(pwd)/ledger-secure-sdk" \
-  "$BOLOS_SDK"/fuzzing/scripts/app-campaign.sh \
-  --app-dir "$(pwd)/app-bitcoin-new" bitcoin-run
+export BOLOS_SDK=/path/to/ledger-secure-sdk
+"$BOLOS_SDK"/fuzzing/scripts/app-campaign.sh --app-dir "$(pwd)" bitcoin-run
 ```
 
 - **`bitcoin-run`** is the campaign name (optional); outputs go to
-  `app-bitcoin-new/.fuzz-artifacts/bitcoin-run/`. Omit for a UTC timestamp.
+  `.fuzz-artifacts/bitcoin-run/` under the app root. Omit for a UTC timestamp.
 - Defaults: **`WARMUP_SEC=30`**, **`MAIN_SEC=60`**, **`WORKERS=min(2, nproc)`**.
   For longer campaigns, raise all three (see
   `ledger-secure-sdk/fuzzing/docs/APP_CONTRACT.md`).
@@ -36,9 +36,11 @@ checked-in corpus is stale for your layout.
 ## Single harness
 
 Bitcoin builds one fuzzing harness configuration. Two small fuzz-only repairs
-are gated behind `HAVE_AUTOAPPROVE_FOR_PERF_TESTS`: a wallet-policy
+are gated behind `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION`: a wallet-policy
 repeated-pubkey bypass (the crypto mock returns a constant pubkey) and a relaxed
 cross-chain swap output-count check (so the OP_RETURN parser stays reachable).
+UI confirmations are auto-approved separately via the app's own
+`HAVE_AUTOAPPROVE_FOR_PERF_TESTS` flag (`display.c`).
 MuSig signing runs against the SDK crypto mock, so its consistency checks reject
 the mocked values early; descriptor parsing is still fully exercised.
 
@@ -260,8 +262,8 @@ files.
    in `harness/fuzz_dispatcher.c` and keep the README's slot/fault tables
    in sync when you add new targeted operations.
 5. **Adjust fuzz-only repairs** — keep repairs gated with
-   `#ifdef HAVE_AUTOAPPROVE_FOR_PERF_TESTS` and document any new one in the
-   source site that applies it.
+   `#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` and document any new one in
+   the source site that applies it.
 6. **Promote corpus inputs** — drop the hashed corpus files under
    `fuzzing/base-corpus/`. They are auto-loaded by `app-campaign.sh`
    unless their `.compat-key` is stale for the current build.

src/handler/lib/policy.c

@@ -2015,7 +2015,7 @@ int is_policy_sane(dispatcher_context_t *dispatcher_context,
             if (memcmp(pubkey_i.compressed_pubkey,
                        pubkey_j.compressed_pubkey,
                        sizeof(pubkey_i.compressed_pubkey)) == 0) {
-#ifndef HAVE_AUTOAPPROVE_FOR_PERF_TESTS
+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
                 // duplicated pubkey
                 return WITH_ERROR(-1, "Repeated pubkey in wallet policy");
 #else

src/handler/sign_psbt/swap_checks.c

@@ -41,7 +41,7 @@ bool __attribute__((noinline)) execute_swap_checks(dispatcher_context_t *dc,
 
     // Swap feature: check that wallet policy is a default one
     if (!st->account.is_default) {
-#ifdef HAVE_AUTOAPPROVE_FOR_PERF_TESTS
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
         // Fuzzing repair: force the default-wallet branch so swap validation runs.
         st->account.is_default = true;
 #else
@@ -59,7 +59,7 @@ bool __attribute__((noinline)) execute_swap_checks(dispatcher_context_t *dc,
     }
 
     if (st->warnings.missing_nonwitnessutxo || st->warnings.non_default_sighash) {
-#ifdef HAVE_AUTOAPPROVE_FOR_PERF_TESTS
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
         // Fuzzing repair: clear warnings so the swap-validation tail runs.
         st->warnings.missing_nonwitnessutxo = false;
         st->warnings.non_default_sighash = false;
@@ -93,7 +93,7 @@ bool __attribute__((noinline)) execute_swap_checks(dispatcher_context_t *dc,
         swap_dest_idx = 1;
 
         if (st->n_external_outputs != 2) {
-#ifdef HAVE_AUTOAPPROVE_FOR_PERF_TESTS
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
             // Fuzzing repair: the exact "2 external outputs" count depends on
             // mocked change-classification and is rarely hit by mutation. Relax to
             // >=1 so the OP_RETURN parser below still runs; swap_dest_idx=0 keeps the