Add fuzzing audit report for Collector

[AdamKorcz]

The Opentelemetry Collector has undergone a fuzzing audit in collaboration with the CNCF and @reyang @jpkrohling @codeboten

The CNCF asks that fuzzing audit reports are stored in the respective projects repository. We thought this community repo is a great way to do that.

We have done the same for all previous CNCF fuzzing audits. Some examples are:

1. Helm (community repo): Report
2. containerd (website repo): Report
3. Envoy (core repo): Report
4. Lima (core repo): Report
5. Crossplane (core repo): Report

[reyang]

Thanks @AdamKorcz!

[reyang]

LGTM.

I suggest that we change "Opentelemetry" to "OpenTelemetry" (check https://github.com/open-telemetry/opentelemetry-specification/tree/main/specification#project-naming) in the pdf file, it'll be better if there is a way for folks to add comments in the PR if this is a markdown file, but I understand that CNCF prefers pdf.

[reyang]

@svrnm I think either this repo or https://github.com/open-telemetry/opentelemetry.io/ would work. Just want to get you informed in case you might have a strong preference.

[AdamKorcz]

LGTM.

I suggest that we change "Opentelemetry" to "OpenTelemetry" (check https://github.com/open-telemetry/opentelemetry-specification/tree/main/specification#project-naming) in the pdf file, it'll be better if there is a way for folks to add comments in the PR if this is a markdown file, but I understand that CNCF prefers pdf.

Updated in 2992691

[tigrannajaryan]

@AdamKorcz it is great to see fuzz tests added to the Collector. I have a couple quick questions:

1. Did fuzzing find any bugs so far?
2. I am unable to locate the fuzz tests in the contrib repo. I can see them in the core repo but not in the contrib. I may be looking at the wrong place.

[AdamKorcz]

@tigrannajaryan

1. There are no public bugs from the fuzzers. I can't comment on any private crashes here as they might have security implications, but feel free to message me on the CNCF slack. Edit: All emails on this list can view the private crashes: https://github.com/google/oss-fuzz/blob/81b41ad37a95577aa34ffa1f0711d467f897a619/projects/opentelemetry/project.yaml#L5.
2. The contrib fuzzers stalled in this PR: add fuzz tests to multiple receivers and processors opentelemetry-collector-contrib#35715, but they are running on OSS-Fuzz from my branch. Would be great to see them merged.

[svrnm]

@svrnm I think either this repo or open-telemetry/opentelemetry.io would work. Just want to get you informed in case you might have a strong preference.

No strong preference, both is fine with me.

What we could do, if we want to have it on the website, is pairing it with a blog post, so it is not just put somewhere, but also shared with our community and end users, similar to https://opentelemetry.io/blog/2024/security-audit-results/

[reyang]

@svrnm I think either this repo or open-telemetry/opentelemetry.io would work. Just want to get you informed in case you might have a strong preference.

No strong preference, both is fine with me.

What we could do, if we want to have it on the website, is pairing it with a blog post, so it is not just put somewhere, but also shared with our community and end users, similar to https://opentelemetry.io/blog/2024/security-audit-results/

@svrnm what would be the next step? Do you plan to merge this PR?

[svrnm]

@svrnm I think either this repo or open-telemetry/opentelemetry.io would work. Just want to get you informed in case you might have a strong preference.

No strong preference, both is fine with me.
What we could do, if we want to have it on the website, is pairing it with a blog post, so it is not just put somewhere, but also shared with our community and end users, similar to https://opentelemetry.io/blog/2024/security-audit-results/

@svrnm what would be the next step? Do you plan to merge this PR?

Merging works for me if we have the required amount of approvals, but if someone would sit down and write a few words I am also happy to have a blog post for it on the otel.io blog. Where the pdf lives doesn't matter, we can keep it here or we can have it as part of the blog post on the website.

[trask]

approving as I support it living either here or in website repo