# FuzzTest 2026-02-19 patch contract

## Baseline

- Upstream: https://github.com/google/fuzztest
- Release: `2026-02-19` (`FuzzTest 2026-02-19`)
- Git ref: `refs/tags/2026-02-19`
- Commit: `b73724d4866c22d9b64c152a2d7ac22c7ca94168`
- Pristine archive URL: https://github.com/google/fuzztest/releases/download/2026-02-19/fuzztest-2026-02-19.tar.gz
- Archive filename: `3rd/archives/fuzztest-2026-02-19.tar.gz`
- SHA256 / CPM `URL_HASH`: `SHA256=1c6e04065eb988e2c99613369db8294aa58429d392bf479740b237f1255204ef`

The committed archive must remain pristine. Local changes are represented only by patch files in this directory.

## Patch files

1. `0001-use-parent-provided-dependencies.patch`
   - Replaces upstream `cmake/BuildDependencies.cmake` `FetchContent` acquisition with checks for parent-provided targets.
   - Disables upstream testing, protobuf, and flatbuffers integration paths.
   - Uses `ANTLR4_RUNTIME_INCLUDE_DIR` for generated parser includes instead of the upstream `antlr_cpp_SOURCE_DIR` variable.

## Required parent-provided prerequisites

The parent project must provide these targets/variables before adding patched FuzzTest:

- Abseil targets required by upstream FuzzTest, represented by at least:
  - `absl::flat_hash_map`
  - `absl::random_bit_gen_ref`
  - `absl::status`
  - `absl::statusor`
  - `absl::strings`
  - `absl::string_view`
  - `absl::span`
  - `absl::flags`
  - `absl::flags_parse`
- `re2::re2`
- `GTest::gtest`
- `GTest::gmock`
- `antlr4_static`
- `ANTLR4_RUNTIME_INCLUDE_DIR`

The fuzz lane must use GoogleTest/GMock `v1.17.0` isolated from the normal C++14 test lane. Do not add normal GoogleTest 1.16 into the FuzzTest tree.

## Forbidden optional dependencies

Patched mode must not require or provide:

- `protobuf::libprotobuf`
- `flatbuffers`

`FUZZTEST_BUILD_TESTING` and `FUZZTEST_BUILD_FLATBUFFERS` are disabled. The protobuf-backed domain path is out of scope for this template.

## No-network contract

Patched FuzzTest mode must not execute remote dependency acquisition during CMake configure/build. In the patched tree, these commands/API calls are forbidden in FuzzTest-owned dependency acquisition files:

- `FetchContent_Declare`
- `FetchContent_MakeAvailable`
- `FetchContent_Populate`
- `ExternalProject_Add`
- `CPMAddPackage`
- `GIT_REPOSITORY`
- `git clone`
- remote `https://` / `http://` fallback URLs used by configure logic

Allowed references are documentation comments in this README/evidence and parent-project metadata for the pristine archive URL/hash.

## Verification commands

From the repository root:

```bash
python3 scripts/fetch_deps.py --verify-fuzztest-baseline
python3 scripts/fetch_deps.py --verify-fuzztest-patch
python3 scripts/fetch_deps.py --print-metadata fuzztest
```

The patch verification extracts `3rd/archives/fuzztest-2026-02-19.tar.gz` into a temporary directory, applies every patch in this directory, and scans the patched dependency files for forbidden remote acquisition commands.

## Rebase checklist

1. Select a new upstream FuzzTest release asset, not a moving branch.
2. Record release tag, commit SHA, archive URL, filename, and SHA256 in `cmake/deps/fuzztest.cmake`, `scripts/fetch_deps.py`, and this README.
3. Download the pristine upstream archive into `3rd/archives/` and verify SHA256 before committing.
4. Rebase patch files onto the extracted pristine source.
5. Run `python3 scripts/fetch_deps.py --verify-fuzztest-baseline --verify-fuzztest-patch`.
6. Confirm patched dependency files contain no remote fetch commands and no protobuf/flatbuffers dependency path.
7. Save evidence under `.sisyphus/evidence/`.
