chore: import upstream snapshot with attribution

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2022-present deepset GmbH <info@deepset.ai>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# ClusterFuzzLite / OSS-Fuzz build environment for the Haystack Atheris fuzz targets.
+# Pinned by digest for supply-chain integrity. Bump periodically (the OSS-Fuzz
+# base-builder is updated frequently with toolchain fixes); resolve a fresh digest with:
+#   docker buildx imagetools inspect gcr.io/oss-fuzz-base/base-builder-python:latest --format '{{.Manifest.Digest}}'
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:f45b69da82d8362d6cda092a6684cb25529c473699a55f7a8f58801f71f78cb4
+
+COPY . $SRC/haystack
+WORKDIR $SRC/haystack
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,26 @@
+#!/bin/bash -eu
+# SPDX-FileCopyrightText: 2022-present deepset GmbH <info@deepset.ai>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Builds the Atheris fuzz targets for ClusterFuzzLite / OSS-Fuzz.
+# `compile_python_fuzzer` is provided by the base-builder-python image.
+
+python3 -m pip install --upgrade pip
+pip3 install . --uploaded-prior-to=P1D
+
+for harness in "$SRC"/haystack/test/fuzz/fuzz_*.py; do
+  name=$(basename "$harness" .py)
+  # --collect-submodules numpy: PyInstaller's static analysis misses NumPy's
+  # dynamically-loaded submodules (e.g. numpy._core._exceptions), which makes
+  # the frozen binary crash on startup ("ModuleNotFoundError") and fails the
+  # ClusterFuzzLite bad-build check. Bundling all numpy submodules avoids that.
+  compile_python_fuzzer "$harness" --collect-submodules numpy
+
+  # Ship a seed corpus if one exists for this harness. The runner unpacks
+  # "<fuzzer>_seed_corpus.zip" next to the binary and seeds libFuzzer with it.
+  corpus_dir="$SRC/haystack/test/fuzz/corpus/$name"
+  if [ -d "$corpus_dir" ]; then
+    zip -j "$OUT/${name}_seed_corpus.zip" "$corpus_dir"/*
+  fi
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1,5 @@
+# Project configuration for ClusterFuzzLite (and a starting point for OSS-Fuzz).
+# https://google.github.io/clusterfuzzlite/
+language: python
+sanitizers:
+  - address