# tool-release Published articles for tool-release. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Mutation testing comes to DAML DevFeed: [Mutation testing comes to DAML]() Original publisher: [Read original article]() Author: "Kamil Chmielewski" Published: 2026-07-08T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [mutation-testing](), [test-coverage](), [Authorization](), [Code](), [Open Source]() Tags: [applications](), [blockchain](), [bug](), [code](), [development](), [mutation-testing](), [open](), [open-source](), [production](), [test-coverage](), [testing](), [tool-release]() ### AI overview Mewt, an open-source mutation-testing engine, now supports DAML, the language used for Canton Network applications. The article explains how mutation testing exposes gaps that ordinary coverage reports can miss by generating modified versions of code and checking which changes survive the existing test suite. ### Source excerpt In April we released Mewt, our open-source mutation-testing engine that finds the gaps in your test suite. Today we're expanding it with support for DAML, the language Canton Network applications are written in. Mewt now reads DAML, generates several classes of mutants (including two built for DAML's authorization primitives), and runs them through your existing test suite to count how many mutants survive. If you want to try it, simply install Mewt from the repository, point a mewt.toml at your project and its test command, and use mewt run. For a team shipping DAML to production, that count is what a passing test run is actually worth: it puts a number on how much your suite checks, whereas a green run on its own does not. Why DAML's coverage reports lie Test coverage is the most reassuring lie in smart-contract development. Hitting 100% line coverage tells you the test runner walked the code; it does not tell you whether any test would fail if that code stopped doing what it is supposed to. We have been grading test harnesses by how many mutants they kill since at least 2019, and our primer on finding the bugs your tests don't catch shows how a green suite can still miss the bug that matters. DAML's built-in coverage measures execution at the template and choice level: which templates were created and which choices were exercised over the test run. It reports whether each choice was exercised, not what happened inside it. A test that exercises a choice once and asserts nothing about the result reports that choice as covered. The report prints the same green percentage whether the test verifies the outcome or discards it. How mutation testing works Instead of asking whether your tests reached the code, mutation testing grades your tests by sabotaging that code. The engine generates mutants, copies of the code that each carry one small deliberate change: a flipped comparison, a removed branch, a dropped party. It then runs your test suite against each one. A mutant ## gosentry brings LibAFL-grade fuzzing to Go's native interface DevFeed: [gosentry brings LibAFL-grade fuzzing to Go's native interface]() Original publisher: [Read original article]() Author: "Kevin Valerio" Published: 2026-05-12T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Go Language](), [C++]() Tags: [bug](), [c](), [c-plus-plus](), [cache](), [cli](), [fuzzing](), [go](), [research-practice](), [rust](), [security](), [testing](), [tool-release](), [toolchain](), [tooling](), [vulnerabilities](), [workflow]() ### AI overview Gosentry is a fuzzing-oriented fork of the Go toolchain that retains Go's native fuzzing interface while using LibAFL by default. It adds native struct fuzzing, Nautilus grammar-based fuzzing, additional bug detection, and campaign coverage reporting without requiring existing Go fuzz harnesses to be rewritten. ### Source excerpt Go's native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn't even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard testing.F workflow while using a stronger fuzzing stack underneath to tackle those issues. With gosentry, go test -fuzz uses LibAFL by default. It can fuzz structs natively, run grammar-based fuzzing with Nautilus, detect bug classes that it couldn't detect before, and create a fuzzing campaign coverage report in one command. If you already have Go fuzz harnesses, you don't need to rewrite them. Point them at gosentry's binary and you get all of the above through the same go test -fuzz interface, with a few new flags: ./bin/go test -fuzz=FuzzHarness --focus-on-new-code=false --catch-races=true --catch-leaks=true Figure 1: Basic gosentry usage gosentry keeps the harness API and changes the engine and the surrounding tooling -- you just tweak the CLI. You can also generate coverage reports from an existing campaign with --generate-coverage. Run it from the same package with the same -fuzz target, and no corpus path is needed; gosentry stores the campaign state under Go's fuzz cache index by package and fuzz target, so restarting the campaign resumes from the existing corpus. Why we built gosentry We started this project after we released go-panikint to improve Go fuzzing's integer overflow detection. We realized that integer overflow detection wasn't enough. Go's fuzzing ecosystem was still missing techniques that Rust, C, and C++ researchers already use every day. We often faced these gaps in our own security work using Go's vanilla fuzzer: Program comparisons (path constraints) were impossible to solve: ## Extending Ruzzy with LibAFL DevFeed: [Extending Ruzzy with LibAFL]() Original publisher: [Read original article]() Author: "Matt Schwager" Published: 2026-04-29T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Fuzzing/Fuzz testing](), [Ruby](), [Rust](), [LLVM](), [Dockerfile](), [Linux](), [Security]() Tags: [application-security](), [complex-systems](), [developers](), [fuzzing](), [linux](), [llvm](), [ruby](), [rust](), [tool-release](), [tools]() ### AI overview The article describes adding LibAFL support to Ruzzy, a coverage-guided fuzzer for pure Ruby code and Ruby C extensions. It covers building LibAFL as a standalone library, integrating it through a Dockerfile, and investigating ELF and linker issues encountered during the integration. ### Source excerpt LibAFL is all the rage in the fuzzing community these days, especially with LLVM's libFuzzer being placed in maintenance mode. Written in Rust, LibAFL claims improved performance, modularity, state-of-the-art fuzzing techniques, and libFuzzer compatibility. For these reasons, I set out to add LibAFL support to Ruzzy, our coverage-guided fuzzer for pure Ruby code and Ruby C extensions. This gives Ruby developers and security researchers access to a more advanced and actively maintained fuzzing engine without changing how they write their fuzzing harnesses. Ruzzy was originally built on top of LLVM's libFuzzer, so using LibAFL's compatibility layer should be easy enough. However, digging around in the internals of complex systems is never quite as simple as it seems. In this post, I will investigate some of the deep plumbing inside these fuzzing engines, take a detour into executable and linkable format (ELF) files, and ultimately add LibAFL support to Ruzzy. Building with libafl_libfuzzer Ruzzy currently supports Linux, so I use a Dockerfile for development and for production fuzzing campaigns. To that end, using a similar Dockerfile for LibAFL support is the simplest integration point. LibAFL provides excellent documentation and build scripts to use it as a standalone library. We need to build LibAFL as a standalone library because Ruzzy uses libFuzzer as a library. Following along with the standalone libafl_libfuzzer documentation, and with the build.sh script in hand, we can build libFuzzer.a. This is the archive that will ultimately be linked into Ruzzy's C extension and used to fuzz our target. Here are the relevant lines from our new Dockerfile: # Install Rust nightly via rustup RUN wget -qO- https://sh.rustup.rs | sh -s -- \ -y \ --default-toolchain nightly \ --component llvm-tools ENV PATH="/root/.cargo/bin:${PATH}" # Clone LibAFL RUN git clone --depth 1 https://github.com/AFLplusplus/LibAFL /libafl # Build libFuzzer.a from LibAFL's libfuzzer runtime WORKDIR ## Trailmark turns code into graphs DevFeed: [Trailmark turns code into graphs]() Original publisher: [Read original article]() Author: "Scott Arciszewski" Published: 2026-04-23T12:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Graphs](), [mutation-testing](), [Claude](), [Code](), [Claude Code](), [test-coverage](), [Tree-sitter](), [Python]() Tags: [ai](), [claude](), [claude-code](), [code](), [graphs](), [mutation-testing](), [open-source](), [python](), [research-practice](), [software](), [testing](), [tool](), [tool-release]() ### AI overview Trailmark is an open-source library that parses source code into queryable call graphs and exposes them through a Python API that Claude skills can call. The article explains how graph-level reasoning can help analyze codebases, triage surviving mutation-testing mutants by security relevance, and support Claude Code skills for tasks such as test vector generation and protocol diagramming. ### Source excerpt We're open-sourcing Trailmark, a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark "Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win." John Lambert's widely cited observation about network security applies just as well to AI-assisted software analysis. When Claude reasons about a codebase, it reasons about lists: findings from static analyzers, surviving mutants from mutation testing, and line-by-line coverage reports. But the question that actually matters is a graph question: can untrusted input reach this code, and what breaks if it's wrong? We built Trailmark to answer that question. It gives Claude a graph to think with instead of a list. We're also releasing eight Claude Code skills we've built on top of it, designed for mutation triage, test vector generation, protocol diagramming, and more. When lists fall short Mutation testing is a great example of a method that benefits from graph-level reasoning. It's one of the best ways to measure test quality. It makes small changes to your source code (e.g., swapping a < for <=, replacing + with -) and checks whether your tests catch the difference. Mutants that survive reveal gaps in your test suite that code coverage metrics might miss. The downside is that a mutation testing run on a real codebase can produce hundreds of surviving mutants of varying significance. This is very much a list. Some surviving mutants are equivalent: the mutation doesn't change the program's behavior because of structural or mathematical constraints that the mutation testing tool can't see. Some are in dead code; some are in error message formatting; some are in the finite field arithmetic that underpins every cryptographic operation in your library. A flat list of surviving mutants doesn't tell you