yaml-cpp: initial integration

[initializedd]

Initial integration support for a popular C++ YAML library.

[github-actions]

initializedd is integrating a new project:
- Main repo: https://github.com/jbeder/yaml-cpp
- Criticality score: 0.61008

[DavidKorczynski]

Are maintainers on board with this? I remember the project was approached previously: jbeder/yaml-cpp#963

[initializedd]

Are maintainers on board with this? I remember the project was approached previously: jbeder/yaml-cpp#963

I have not approached the maintainers of yaml-cpp.
Although, I believe it should be fine since the project is covered under the MIT license agreement.

[DavidKorczynski]

we need maintainer approval that they are happy to receive and fix bugs

[initializedd]

we need maintainer approval that they are happy to receive and fix bugs

I will open an issue on the yaml-cpp repository and reference this PR.

[jbeder]

Hey, maintainer of yaml-cpp here. As evidenced by my lack of response to your first PR (sorry, @DavidKorczynski!) I don't have a ton of time for this library. I mostly just approve small PRs for bugfixes. I see the concern

The only expectation of integrating into OSS-Fuzz is that bugs will be fixed. This is not a "hard" requirement in that no one enforces this and the main point is if bugs are not fixed then it is a waste of resources to run the fuzzers, which we would like to avoid.

I can't commit to fixing all bugs that OSS-Fuzz comes out with, but I can commit to reviewing any PRs that fix those bugs. @initializedd, would you be willing to commit to (at least trying to) fix bugs?

[DavidKorczynski]

I can't commit to fixing all bugs that OSS-Fuzz comes out with, but I can commit to reviewing any PRs that fix those bugs. @initializedd, would you be willing to commit to (at least trying to) fix bugs?

The caveat here is that the bugs found are following the Google disclosure policy, which means they will be publicised after 90 days if not fixed (and will be made public once they are fixed too if pre the 90 day deadline).

[initializedd]

@initializedd, would you be willing to commit to (at least trying to) fix bugs?

I am definitely happy to commit to fixing bugs.

@DavidKorczynski In that case, I assume I would need to add myself to auto_ccs to receive notifications of bugs that have been discovered?