Repository: sigstore/rekor
Pull request #1258 (2022-12-29 15:57:56)

types: refactor multiple fuzzers
Signed-off-by: AdamKorcz <adam@adalogics.com>

<!--
Thanks for opening a pull request! Please do not just delete this text.  The three fields below are mandatory.

Please remember to:
- This PR requires an issue. If it is a new feature, the issue should proceed the PR and will have allowed sufficent time for discussions to take place. Pleases use
issue tags such as "Closes #XYZ" or "Resolves sigstore/repo-name#XYZ".
  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
- ensure your commits are signed-off, as sigstore uses the [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) using `git commit -s`, or `git commit -s --amend` if you want to amend already existing commits
- lastly, ensure there are no merge commits!

Thank you :)
-->

#### Summary
<!--
 Explain the **motivation** for making this change. What existing problem does the pull request solve? How can reviewers test this PR?
-->

Adds a fuzzer for intoto v0.0.2

Does the following changes to multiple types fuzzers:

1. Silences the logger.
2. Creates the artifact file if the artifact bytes are `nil` for the properties.
3. Hardcodes the version to avoid unnecessary time in the semver dependency.
4. Moves the fuzzers to their v0.0.1 directory to initiate the relevant entry in the VersionMap. For example here:
https://github.com/sigstore/rekor/blob/26f44cd4ba51119da6b9557edcadabe3a97ae2af/pkg/types/helm/v0.0.1/entry.go#L46-L50


#### Release Note
<!--
Add a release note for each of the following conditions:

* Config changes (additions, deletions, updates)
* API additions—new endpoint, new response fields, or newly accepted request parameters
* Database changes (any)
* Websocket additions or changes
* Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
* New features and improvements, including behavioural changes, UI changes and CLI changes
* Bug fixes and fixes of previous known issues
* Deprecation warnings, breaking changes, or compatibility notes

If no release notes are required write NONE. Use past-tense.

-->

#### Documentation
<!--

Does this change require an update to documentation? How will users implement your new feature?

Please reference a PR within https://docs.sigstore.dev

-->


Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index da086cb..12f0360 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,7 +34,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.8.1
 
       - name: Extract version of Go to use
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index f541f65..ceeece9 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
         language: [ 'go' ]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 98eb6d5..b11cf98 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -56,7 +56,7 @@ jobs:
   container-build:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -79,7 +79,7 @@ jobs:
     steps:
       - name: download minisign
         run: sudo add-apt-repository ppa:dysfunctionalprogramming/minisign && sudo apt-get update && sudo apt-get install minisign
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -111,7 +111,7 @@ jobs:
     steps:
       - name: download minisign
         run: sudo add-apt-repository ppa:dysfunctionalprogramming/minisign && sudo apt-get update && sudo apt-get install minisign
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Docker Build
         run: docker-compose build
       - name: Extract version of Go to use
@@ -134,7 +134,7 @@ jobs:
     needs: build
 
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Docker Build
         run: docker-compose build
       - name: Extract version of Go to use
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-20.04
     needs: build
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Create git branch
         run: git switch -c harness-test-branch
       - name: Extract version of Go to use
diff --git a/.github/workflows/scorecard_action.yml b/.github/workflows/scorecard_action.yml
index 7c5c6ae..4d17b6a 100644
--- a/.github/workflows/scorecard_action.yml
+++ b/.github/workflows/scorecard_action.yml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
index 19f2cbb..b1a59a1 100644
--- a/.github/workflows/validate-release.yml
+++ b/.github/workflows/validate-release.yml
@@ -43,7 +43,7 @@ jobs:
       COSIGN_IMAGE: gcr.io/projectsigstore/cosign:v1.13.1@sha256:fd5b09be23ef1027e1bdd490ce78dcc65d2b15902e1f4ba8e04f3b4019cc1057
 
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 8e9f20b..6640a49 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -29,7 +29,7 @@ jobs:
     name: license boilerplate check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -48,7 +48,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
diff --git a/pkg/fuzz/fuzz_utils.go b/pkg/fuzz/fuzz_utils.go
new file mode 100644
index 0000000..9fb33b3
--- /dev/null
+++ b/pkg/fuzz/fuzz_utils.go
@@ -0,0 +1,74 @@
+//
+// Copyright 2022 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fuzz
+
+import (
+	"net/url"
+	"os"
+	"path/filepath"
+
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+
+	fuzz "github.com/AdaLogics/go-fuzz-headers"
+
+	"github.com/sigstore/rekor/pkg/log"
+	"github.com/sigstore/rekor/pkg/types"
+)
+
+func CreateProps(ff *fuzz.ConsumeFuzzer) (types.ArtifactProperties, func(), error) {
+	props := types.ArtifactProperties{}
+	ff.GenerateStruct(&props) //nolint:all
+
+	if props.ArtifactBytes == nil {
+		artifactBytes, err := ff.GetBytes()
+		if err != nil {
+			return props, nil, err
+		}
+		artifactFile, err := os.Create("ArtifactFile")
+		if err != nil {
+			return props, nil, err
+		}
+		defer artifactFile.Close()
+
+		artifactPath, err := filepath.Abs("ArtifactFile")
+		if err != nil {
+			return props, nil, err
+		}
+		artifactURL, err := url.Parse(artifactPath)
+		if err != nil {
+			return props, nil, err
+		}
+		props.ArtifactPath = artifactURL
+
+		_, err = artifactFile.Write(artifactBytes)
+		return props, func() {
+			os.Remove("ArtifactFile")
+		}, err
+
+	}
+	return props, func() {}, nil
+}
+
+func SetFuzzLogger() {
+	config := zap.NewProductionConfig()
+	config.Level = zap.NewAtomicLevelAt(zapcore.FatalLevel)
+	logger, err := config.Build()
+	if err != nil {
+		panic(err)
+	}
+	log.Logger = logger.Named("rekor-fuzz-logger").Sugar()
+}


Test patch:
diff --git a/pkg/types/cose/fuzz_test.go b/pkg/types/cose/fuzz_test.go
index 5bdd8eb..3769899 100644
--- a/pkg/types/cose/fuzz_test.go
+++ b/pkg/types/cose/fuzz_test.go
@@ -17,13 +17,18 @@ package cose
 
 import (
 	"context"
+	"sync"
 	"testing"
 
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
 	"github.com/sigstore/rekor/pkg/types"
 )
 
+var initter sync.Once
+
 func FuzzCreateProposedEntry(f *testing.F) {
 	f.Fuzz(func(t *testing.T, version string) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
 		ctx := context.Background()
 		brt := New()
 		props := types.ArtifactProperties{}
diff --git a/pkg/types/helm/fuzz_test.go b/pkg/types/helm/v0.0.1/fuzz_test.go
similarity index 74%
rename from pkg/types/helm/fuzz_test.go
rename to pkg/types/helm/v0.0.1/fuzz_test.go
index 52c8a9a..417385b 100644
--- a/pkg/types/helm/fuzz_test.go
+++ b/pkg/types/helm/v0.0.1/fuzz_test.go
@@ -18,19 +18,32 @@ package helm
 import (
 	"bytes"
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/helm"
 )
 
+var initter sync.Once
+
 func FuzzHelmCreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := helm.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
@@ -44,7 +57,7 @@ func FuzzHelmCreateProposedEntry(f *testing.F) {
 
 func FuzzHelmProvenanceUnmarshal(f *testing.F) {
 	f.Fuzz(func(t *testing.T, provenanceData []byte) {
-		p := &Provenance{}
+		p := &helm.Provenance{}
 		r := bytes.NewReader(provenanceData)
 		p.Unmarshal(r)
 	})
diff --git a/pkg/types/intoto/fuzz_test.go b/pkg/types/intoto/v0.0.1/fuzz_test.go
similarity index 73%
rename from pkg/types/intoto/fuzz_test.go
rename to pkg/types/intoto/v0.0.1/fuzz_test.go
index aa9cb0b..0909c20 100644
--- a/pkg/types/intoto/fuzz_test.go
+++ b/pkg/types/intoto/v0.0.1/fuzz_test.go
@@ -17,19 +17,32 @@ package intoto
 
 import (
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/intoto"
 )
 
+var initter sync.Once
+
 func FuzzIntotoCreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := intoto.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
diff --git a/pkg/types/intoto/v0.0.2/fuzz_test.go b/pkg/types/intoto/v0.0.2/fuzz_test.go
new file mode 100644
index 0000000..cfbacc3
--- /dev/null
+++ b/pkg/types/intoto/v0.0.2/fuzz_test.go
@@ -0,0 +1,55 @@
+//
+// Copyright 2022 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package intoto
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	fuzz "github.com/AdaLogics/go-fuzz-headers"
+
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/intoto"
+)
+
+var initter sync.Once
+
+func FuzzIntotoCreateProposedEntry(f *testing.F) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.2"
+
+		ff := fuzz.NewConsumer(propsData)
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := intoto.New()
+		entry, err := it.CreateProposedEntry(context.Background(), version, props)
+		if err != nil {
+			t.Skip()
+		}
+		_, err = it.UnmarshalEntry(entry)
+		if err != nil {
+			t.Skip()
+		}
+	})
+}
diff --git a/pkg/types/rekord/fuzz_test.go b/pkg/types/rekord/v0.0.1/fuzz_test.go
similarity index 73%
rename from pkg/types/rekord/fuzz_test.go
rename to pkg/types/rekord/v0.0.1/fuzz_test.go
index d5bd3f9..c16a26f 100644
--- a/pkg/types/rekord/fuzz_test.go
+++ b/pkg/types/rekord/v0.0.1/fuzz_test.go
@@ -17,19 +17,32 @@ package rekord
 
 import (
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/rekord"
 )
 
+var initter sync.Once
+
 func FuzzRekordCreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := rekord.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
diff --git a/pkg/types/rfc3161/fuzz_test.go b/pkg/types/rfc3161/v0.0.1/fuzz_test.go
similarity index 72%
rename from pkg/types/rfc3161/fuzz_test.go
rename to pkg/types/rfc3161/v0.0.1/fuzz_test.go
index 583b694..87d2a3d 100644
--- a/pkg/types/rfc3161/fuzz_test.go
+++ b/pkg/types/rfc3161/v0.0.1/fuzz_test.go
@@ -17,19 +17,32 @@ package rfc3161
 
 import (
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/rfc3161"
 )
 
+var initter sync.Once
+
 func FuzzRfc3161CreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := rfc3161.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
diff --git a/pkg/types/rpm/fuzz_test.go b/pkg/types/rpm/v0.0.1/fuzz_test.go
similarity index 73%
rename from pkg/types/rpm/fuzz_test.go
rename to pkg/types/rpm/v0.0.1/fuzz_test.go
index df72c72..fbb77fd 100644
--- a/pkg/types/rpm/fuzz_test.go
+++ b/pkg/types/rpm/v0.0.1/fuzz_test.go
@@ -17,19 +17,32 @@ package rpm
 
 import (
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/rpm"
 )
 
+var initter sync.Once
+
 func FuzzRpmCreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := rpm.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
diff --git a/pkg/types/tuf/fuzz_test.go b/pkg/types/tuf/v0.0.1/fuzz_test.go
similarity index 73%
rename from pkg/types/tuf/fuzz_test.go
rename to pkg/types/tuf/v0.0.1/fuzz_test.go
index 477dd0a..44ba59e 100644
--- a/pkg/types/tuf/fuzz_test.go
+++ b/pkg/types/tuf/v0.0.1/fuzz_test.go
@@ -17,19 +17,32 @@ package tuf
 
 import (
 	"context"
+	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
-	"github.com/sigstore/rekor/pkg/types"
+	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/types/tuf"
 )
 
+var initter sync.Once
+
 func FuzzTufCreateProposedEntry(f *testing.F) {
-	f.Fuzz(func(t *testing.T, version string, propsData []byte) {
+	f.Fuzz(func(t *testing.T, propsData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		version := "0.0.1"
+
 		ff := fuzz.NewConsumer(propsData)
-		props := types.ArtifactProperties{}
-		ff.GenerateStruct(&props)
-		it := New()
+
+		props, cleanup, err := fuzzUtils.CreateProps(ff)
+		if err != nil {
+			t.Skip()
+		}
+		defer cleanup()
+
+		it := tuf.New()
 		entry, err := it.CreateProposedEntry(context.Background(), version, props)
 		if err != nil {
 			t.Skip()
diff --git a/tests/oss_fuzz.sh b/tests/oss_fuzz.sh
index c79d66a..7339ee4 100755
--- a/tests/oss_fuzz.sh
+++ b/tests/oss_fuzz.sh
@@ -38,10 +38,11 @@ compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/cose FuzzCreateProp
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/alpine FuzzPackageUnmarshal FuzzPackageUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/jar FuzzJarUnmarshal FuzzJarUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/hashedrekord FuzzHashedRekord FuzzHashedRekord
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto FuzzIntotoCreateProposedEntry FuzzIntotoCreateProposedEntry
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/tuf FuzzTufCreateProposedEntry FuzzTufCreateProposedEntry
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rfc3161 FuzzRfc3161CreateProposedEntry FuzzRfc3161CreateProposedEntry
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rpm FuzzRpmCreateProposedEntry FuzzRpmCreateProposedEntry
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm FuzzHelmCreateProposedEntry FuzzHelmCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.1 FuzzIntotoCreateProposedEntry FuzzIntotoCreateProposedEntry_v001
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.2 FuzzIntotoCreateProposedEntry FuzzIntotoCreateProposedEntry_v002
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/tuf/v0.0.1 FuzzTufCreateProposedEntry FuzzTufCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rfc3161/v0.0.1 FuzzRfc3161CreateProposedEntry FuzzRfc3161CreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rpm/v0.0.1 FuzzRpmCreateProposedEntry FuzzRpmCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHelmCreateProposedEntry FuzzHelmCreateProposedEntry
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm FuzzHelmProvenanceUnmarshal FuzzHelmProvenanceUnmarshal
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rekord FuzzRekordCreateProposedEntry FuzzRekordCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rekord/v0.0.1 FuzzRekordCreateProposedEntry FuzzRekordCreateProposedEntry