go-fuzz-build: cannot find package "go-fuzz-dep" when using golang.org/dl/go1.16.3

[hidu]

go version 1.13 -1.16

workdir: /var/folders/72/byjy11cs0dj_z3rjtxnj_nn00000gn/T/go-fuzz-build784243105
failed to execute go build: exit status 1
WORK=/var/folders/72/byjy11cs0dj_z3rjtxnj_nn00000gn/T/go-build257732241
png.go:4: cannot find package "go-fuzz-dep" in any of:
	/Users/work/sdk/go1.13/src/go-fuzz-dep (from $GOROOT)
	/var/folders/72/byjy11cs0dj_z3rjtxnj_nn00000gn/T/go-fuzz-build784243105/gopath/src/go-fuzz-dep (from $GOPATH)

reason:

go-fuzz-build/main.go

func (c *Context) copyFuzzDep()

newDir := filepath.Join(c.workdir, "goroot", "src", "go-fuzz-dep")

but go use Default GOROOT. See the issue comment below

[josharian]

I don’t understand. I’ve been using go-fuzz successfully with many Go versions including 1.16. Can you provide steps that I can use to reproduce the issue? Thanks.

[hidu]

go-fuzz-build/main.go:

	cmd.Env = append(os.Environ(),
		"GOROOT="+filepath.Join(c.workdir, "goroot"),
		"GOPATH="+filepath.Join(c.workdir, "gopath"),
		"GO111MODULE=off",
	)

Has Set GOROOT.

But I install my go this way:
https://golang.org/doc/manage-install

go get golang.org/dl/go1.16.3
go1.16.3 download

the GOROOT has been rewrote:
https://github.com/golang/dl/blob/master/internal/version/version.go#L67

cmd.Env = dedupEnv(caseInsensitiveEnv, append(os.Environ(), "GOROOT="+root, "PATH="+newPath))

go-fuzz-build's GOROOT has been overwrote by the dl‘s go command

If i use go which install by tar file (go1.16.4.darwin-amd64.tar.gz),
without change,go-fuzz-build still use goroot,it works fine

[josharian]

I see. That’s unfortunate. How does the PR you sent improve matters?

[howardjohn]

Is there any workaround for this issue?

[thepudds]

Hi @hidu and @howardjohn

It sounds like the desire was to use something like the go1.16.3 binary installed via golang.org/dl/go1.16.3.

How are you doing that today?

I think it might work better to set your PATH variable to the bin directory with the actual go binary that is ultimately used by the go1.16.3 command, which is more direct and avoids the go1.16.3 command explicitly setting GOROOT, I think.

For example, if you are using go1.16.12 via something like:

$ go get golang.org/dl/go1.16.12 
$ go1.16.12 download

then I am suggesting trying:

$ export PATH="$(go1.16.12 env GOROOT)"/bin:"$PATH"
$ which go
/home/thepudds/sdk/go1.16.12/bin/go
$ go version
go version go1.16.12 linux/amd64
$ go env GOROOT
/home/thepudds/sdk/go1.16.12

which then seems to work with go-fuzz, at least in a basic check starting from an empty directory:

$ go mod init example
$ go install github.com/dvyukov/go-fuzz/go-fuzz@latest github.com/dvyukov/go-fuzz/go-fuzz-build@latest
$ go get github.com/dvyukov/go-fuzz/go-fuzz-dep
$ go-fuzz-build image/png
$ go-fuzz -bin=png-fuzz.zip

2021/12/26 13:01:17 workers: 8, corpus: 34 (0s ago), crashers: 0, restarts: 1/0, execs: 0 (0/sec), cover: 0, uptime: 3s

Does that work for you?

If on Windows, I think it is similar, but probably two steps with a copy/paste:

C:\> go1.16.12 env GOROOT
C:\Users\thepudds\sdk\go1.16.12
C:\> set PATH=C:\Users\thepudds\sdk\go1.16.12\bin;%PATH%
C:\> go env GOROOT
C:\Users\thepudds\sdk\go1.16.12

Finally, sorry if this is not helpful, but if not, perhaps you can comment a bit more about the exact mechanism you are using today for using something like go1.16.12 with go-fuzz (e.g., sym link, the -go flag, ...).

[hidu]

@thepudds yes it's work when i exec export PATH="$(go1.16.12 env GOROOT)"/bin:"$PATH"