Stream: announcements

Topic: roc-fuzz 0.1.0


view this post on Zulip Luke Boswell (Aug 08 2026 at 01:05):

Ever wanted to fuzz pure Roc code ... well now you can use roc-fuzz!!!

https://github.com/lukewilliamboswell/roc-fuzz

The platform wraps libFuzzer and provides everything in a easy to use setup so you can build a normal roc app and you get a self contained fuzz target with running, minimizing, and corpus compaction features.

roc build --fuzz my_target_app.roc
./my_target_app --help
./my_target_app run

Currently supports Linux x64 musl -- but aarch64 Macos and x64 Windows are probably coming soon. I haven't tried building all the libraries and testing on those targets yet.

view this post on Zulip Luke Boswell (Aug 08 2026 at 01:07):

This work originated from @Brendan Hansknecht who the heavy lifting regarding setting up libFuzzer and ensuring Roc is capable of supporting this use case. I forked some of his earlier work in this space and was able to package it up in our modern syntax and make a release.

view this post on Zulip Luke Boswell (Aug 08 2026 at 01:25):

Also if you are not familiar with fuzz testing in general, I added both a beginner and advanced guides and documentation which walk you through how to do it well.

view this post on Zulip Luke Boswell (Aug 08 2026 at 01:49):

Also if you are working on a Roc builtin or PRs for Roc this can be very helpful to surface bugs. @Eric Rogstad @JRI98 @Dzmitry Misiuk

I found one yesterday in the builtins just while testing this https://github.com/roc-lang/roc/issues/10660

view this post on Zulip Austin Clements (Aug 08 2026 at 02:32):

Awesome I’ve been wanting this!!

view this post on Zulip Luke Boswell (Aug 14 2026 at 22:14):

If you haven't tried out fuzz testing yet, I highly recommend you give it a try.

I've been using it a lot on everything and it's surfacing so many bugs and invariants across my packages (and even Roc builtins).

I've also had an excellent experience with AI Agents helping me to scope out and build/run the fuzz targets too. Just be sure you repeatedly remind Claude or Codex that this is software quality and not security analysis :sweat_smile: -- because apparently fuzz = bad

view this post on Zulip kaza (Aug 14 2026 at 22:52):

I've been finding it really useful. Thanks for making this!


Last updated: Sep 03 2026 at 15:16 UTC