UNOFFICIAL/EXPERIMENTAL. Live receipt generated by scripts/run-cub-installer-fuzz.mjs; do not hand-edit. Regenerate with npm run cub-installer:fuzz.
Claim. Fuzzing CUB INSTALLER (not Helm) with careless + adversarial inputs: an unknown input key is a hard error (the footgun Helm absorbs), bad base/namespace/image are validated, and shell-metacharacter inputs do not execute. Any crash, injection, or silent-swallow is reported as a bug to fix. This tests our own tool.
This is the lane that matters for us: not Helm's footguns, but whether cub installer handles careless and adversarial input cleanly - or has bugs. 96 cases across 8 packages.
Serious bugs (crash / injection / silent-swallow): 0. Honest rough-edge findings: 24. Overall: pass.
| Behavior | Count | Share | Meaning |
|---|---|---|---|
| rejected-unknown | 24 | 25% | cub errored on an unknown input key - the footgun Helm absorbs silently |
| rejected-validation | 24 | 25% | cub errored on a bad base / namespace / image / missing required input |
| rendered | 8 | 8% | cub accepted it and rendered - now visible in the Unit, not silent |
| namespace-not-validated | 16 | 17% | finding - cub rendered an invalid namespace (no DNS-1123 check); visible, caught at apply |
| namespace-rough-error | 8 | 8% | finding - a too-long namespace failed with an opaque filesystem error, not a clean message |
| rejected-no-injection | 8 | 8% | injection input rejected; no shell execution |
| rendered-no-injection | 8 | 8% | injection input accepted but did not execute (safe) |
Bugs (crash / injection / silent-swallow)
| Package | Case | Behavior | Detail |
|---|---|---|---|
| - | - | - | none found |
Honest findings (rough edges - not serious bugs, but worth fixing)
- namespace-not-validated - 16 case(s) across 8 package(s): cub rendered an invalid namespace into 6 file(s) - caught only at k8s apply, not by cub
- namespace-rough-error - 8 case(s) across 8 package(s): opaque error on a bad namespace (not a clean validation): Error: write <tmp> open <tmp> file name too long
Per package
| Package | Base | Outcome |
|---|---|---|
| bitnami/nginx/24.0.2 | http-clusterip | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/redis | default | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/mysql | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/mongodb | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/rabbitmq | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/postgresql | static-passwords | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/apache | default | 7 caught/validated · 5 rendered · 0 bug |
| bitnami/memcached | default | 7 caught/validated · 5 rendered · 0 bug |
- The headline contrast with the Helm fuzz: an unknown
--setkey Helm silently absorbs; the same key as a cub--inputis a hard error ("unknown input"). cub's inputs are declared/typed, so the careless-typo footgun is caught at the tool. - Honest: this hunts for cub's bugs. A crash, a shell injection, or a silent swallow is reported here as a defect to fix - not hidden.
- Receipt:
runs/cub-installer-fuzz/receipt.yaml.