# cub installer fuzz — does OUR tool handle bad input?

**UNOFFICIAL/EXPERIMENTAL.** Live receipt generated by `scripts/run-cub-installer-fuzz.mjs`; do not hand-edit. Regenerate with `npm run cub-installer:fuzz`.

**Claim.** Fuzzing CUB INSTALLER (not Helm) with careless + adversarial inputs: an unknown input key is a hard error (the footgun Helm absorbs), bad base/namespace/image are validated, and shell-metacharacter inputs do not execute. Any crash, injection, or silent-swallow is reported as a bug to fix. This tests our own tool.

This is the lane that matters for *us*: not Helm's footguns, but whether **`cub installer`** handles careless and adversarial input cleanly — or has bugs. 96 cases across 8 packages.

**Serious bugs (crash / injection / silent-swallow): 0.** Honest rough-edge findings: **24**. Overall: **pass**.

| Behavior | Count | Share | Meaning |
| --- | --- | --- | --- |
| rejected-unknown | 24 | 25% | cub errored on an unknown input key — **the footgun Helm absorbs silently** |
| rejected-validation | 24 | 25% | cub errored on a bad base / namespace / image / missing required input |
| rendered | 8 | 8% | cub accepted it and rendered — now visible in the Unit, not silent |
| namespace-not-validated | 16 | 17% | **finding** — cub rendered an invalid namespace (no DNS-1123 check); visible, caught at apply |
| namespace-rough-error | 8 | 8% | **finding** — a too-long namespace failed with an opaque filesystem error, not a clean message |
| rejected-no-injection | 8 | 8% | injection input rejected; no shell execution |
| rendered-no-injection | 8 | 8% | injection input accepted but did **not** execute (safe) |

## Bugs (crash / injection / silent-swallow)

| Package | Case | Behavior | Detail |
| --- | --- | --- | --- |
| — | — | — | none found |

## Honest findings (rough edges — not serious bugs, but worth fixing)

- **namespace-not-validated** — 16 case(s) across 8 package(s): cub rendered an invalid namespace into 6 file(s) — caught only at k8s apply, not by cub
- **namespace-rough-error** — 8 case(s) across 8 package(s): opaque error on a bad namespace (not a clean validation): Error: write <tmp> open <tmp> file name too long

## Per package

| Package | Base | Outcome |
| --- | --- | --- |
| bitnami/nginx/24.0.2 | http-clusterip | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/redis | default | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/mysql | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/mongodb | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/rabbitmq | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/postgresql | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/apache | default | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/memcached | default | 7 caught/validated · 5 rendered · 0 bug |

- The headline contrast with the [Helm fuzz](../bad-decisions-fuzz/summary.md): an unknown `--set` key Helm **silently absorbs**; the same key as a cub `--input` is a **hard error** ("unknown input"). cub's inputs are declared/typed, so the careless-typo footgun is caught at the tool.
- Honest: this hunts for *cub's* bugs. A crash, a shell injection, or a silent swallow is reported here as a defect to fix — not hidden.
- Receipt: `runs/cub-installer-fuzz/receipt.yaml`.