feat: v0.5.46 — x-FuSa spec v1.13.0/v1.14.0 conformance - #72
Merged
Conversation
…ra/safety-case/sas/sci schemas, content-quality baseline, coverage metrics) Closes #71. Schema conformance (x-FuSa spec §1.2.5/§9.2/§9.3): - .fusa-hara.json: three cross-referenced collections (operationalSituations[]/hazards[]/safetyGoals[]) replace the old flat hazards[] shape; safetyGoals[].fssrRefs is now MUST/>=1 entry, cross- checked against .fusa-reqs.json. `hara init` scaffolds empty collections (never dummy rows); `hara show`/--format json add a completeness block. - fmea.json: ratingScale, per-function-templated failureMode/effect/cause (varies with the actual function found, not a fixed string), actionPriority, summary.componentsInProject/coveragePct. - tara.json: SFOP impact object (safety/financial/operational/privacy) per ISO 21434 Clause 15.7 instead of one generic severity; assets/threats are now discovered by scanning for network/file/auth/memory-input functions instead of a placeholder-filled template; summary.assetInventoryMethod. - safety-case --format json is new: nodes[]/edges[]/completeness using the six real GSN node types; solution nodes only cite evidence that actually exists in the project. - sas --format json: checklist[]/summary, `present` reflects a real evidence-file check; always also writes the sas.md companion. - sci --format json: files→artifacts, sha256→hash (sha256:-prefixed per §2.7 — a field named "hash" carries an algorithm-prefixed value, unlike a field named for its algorithm). Content-quality baseline (§1.6/§1.6.1/§1.6.2): - New qualitybar module: FUSA-STUB001 (always ERROR, a placeholder/ template-text deny-list scan; suppressible only via .fusa-dispositions.json, never attestation) and FUSA-STUB002 (WARNING by default, a distinct-value-ratio check across >=10 entries), wired into hara/fmea/tara/safety-case/sas. - --strict/--require-attestation and --attest <reviewer> on the same five commands. A non-stale, genuinely-independent attestation (content hash matches the artifact's current substantive content) suppresses FUSA-STUB002; a self-attestation or a stale hash falls back to "heuristic" (fail-safe). Coverage metrics: - --min-coverage N on fmea/tara (mirrors trace --func-coverage); N=0 disables the gate. componentsInProject/assetsInProject exclude test files, matching trace --func-coverage's own denominator. Fixes found along the way: - fmea.json/fmea.csv could contain invalid JSON/CSV when the function-name scanner misdetected a quoted string literal as a function name — every free-text field is now escaped for its target format. - cmd_safety_rules.c's HARA002/003/004 engine rules still read the old flat .fusa-hara.json shape; updated to the new nested fields and scoped to the hazards/safetyGoals arrays so they don't cross-match a same-named nested key in a sibling collection. - Two spurious CFUSA-CY002 (uncontrolled format string) false positives in my own new fprintf-in-macro calls, caused by a line-continuation backslash landing between the FILE* arg and the format-string literal. Regenerated this repo's own .fusa-hara.json (migrated from the retired .cfusa-hara.json, including recomputed ASIL values), fmea.json/fmea.csv, tara.json/tara.md, and added safety-case.json against the new schemas — c-FuSa dogfooding its own spec conformance work. New tests: tests/test_xfusa_v114.c (qualitybar unit tests + per-command schema/coverage/attestation integration tests); updated test_safety_rules.c fixtures and test_gap_coverage.c assertions for the new field names. 39/39 test binaries pass; line coverage 85.0% (gate: 80%). Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
cfusa found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
| const char *start = p, *end = NULL; | ||
| for (; *p; p++) { | ||
| if (in_str) { | ||
| if (*p == '\\') { p++; continue; } |
| int depth = 0, in_str = 0; | ||
| for (; *p; p++) { | ||
| if (in_str) { | ||
| if (*p == '\\') { p++; continue; } |
| } | ||
| if (*p == '"') { in_str = 1; continue; } | ||
| if (*p == '{') depth++; | ||
| else if (*p == '}') { depth--; if (depth == 0) { p++; break; } } |
| const char *start = p; | ||
| for (; *p; p++) { | ||
| if (in_str) { | ||
| if (*p == '\\') { p++; continue; } |
| const char *doc_end = json + len; | ||
| for (; p < doc_end && *p; p++) { | ||
| if (in_str) { | ||
| if (*p == '\\') { p++; continue; } |
…deQL)
CodeQL flagged 5 high-severity "file created with default (potentially
0666) permissions" alerts across the files this PR touched: fopen(path,
"w") relies on the process umask for its actual mode, whereas
open(path, O_WRONLY|O_CREAT|O_TRUNC, 0600) is explicit and doesn't depend
on umask. cmd_capabilities.c already established this pattern in the
codebase for the same reason; added a shared cfusa_fopen_write() helper in
utils.c and switched every fopen(..., "w") call in the files this PR
introduced/rewrote (hara/fmea/tara/safety-case/sas/sci, plus the new
test file) to use it.
Regenerated fmea.json/fmea.csv/tara.json/tara.md/safety-case.{json,md}
after the utils.c change (function count shifted slightly since
cfusa_fopen_write itself is now part of the public-function surface FMEA
scans).
Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
…n Linux cfusa_fopen_write() (added in the previous commit) calls open()/fdopen(). Without _POSIX_C_SOURCE, strict -std=c99 glibc headers hide fdopen()'s prototype, so gcc/clang implicitly declare it as returning `int`; the truncated 32-bit "pointer" assigned to a FILE* then segfaults on first use. Every other file in this codebase that calls open()/fdopen() already carries this exact guard (cmd_capabilities.c, cmd_qualify.c, cmd_impact.c, cmd_release.c, cmd_audit_pack.c) — utils.c was the one new call site that missed it, and every test binary that exercises hara/fmea/tara/ safety-case/sas (all of which now route through cfusa_fopen_write) segfaulted on Linux CI as a result (macOS's libc doesn't gate fdopen() on the C standard version, so this passed locally and on the macOS runner). Reproduced and confirmed fixed in an ubuntu:22.04 container (39/39 test binaries, including the 7 that segfaulted in CI: test_hara, test_safety_commands, test_cli_commands, test_commands2, test_hara_advanced, test_gap_coverage, test_xfusa_v114). Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #71. Brings
hara/fmea/tara/safety-case/sas/sciinto conformance with x-FuSa spec §1.2.5/§9.2/§9.3 schemas, implements the §1.6/§1.6.1/§1.6.2 content-quality baseline (FUSA-STUB001/002 detection + attestation), and addssummary.coveragePct/--min-coveragetofmea/tara..fusa-hara.jsonnow has the three cross-referenced collections (operationalSituations[]/hazards[]/safetyGoals[]), withsafetyGoals[].fssrRefsas a MUST, ≥1 entry field cross-checked against.fusa-reqs.json.hara initscaffolds empty collections (never dummy rows);hara show/--format jsonadd acompletenessblock.fmea.json:ratingScale, per-function-templatedfailureMode/effect/cause(varies with the actual function found — not one canned string),actionPriority,summary.componentsInProject/coveragePct.tara.json: an SFOPimpactobject (safety/financial/operational/privacy) instead of one generic severity; assets/threats are now discovered by scanning for network/file/auth/memory-input functions instead of a placeholder-filled template.safety-case --format jsonis new:nodes[]/edges[]/completenessusing the six real GSN node types;solutionnodes only cite evidence that actually exists.sas --format json:checklist[]/summary,presentreflects a real evidence-file check; always also writes thesas.mdcompanion.sci --format json:files→artifacts,sha256→hash(sha256:-prefixed per §2.7).qualitybarmodule:FUSA-STUB001(always ERROR, disposition-suppressible only) andFUSA-STUB002(WARNING by default, attestation-suppressible), wired intohara/fmea/tara/safety-case/sasvia new--strict/--require-attestation/--attest <reviewer>flags.--min-coverage Nonfmea/tara, mirroringtrace --func-coverage; excludes test files from the denominator..fusa-hara.json(migrated off the retired.cfusa-hara.json, with corrected ASIL values),fmea.json/fmea.csv,tara.json/tara.md, and addedsafety-case.json— dogfooding the new schemas.fmea(an unescaped function-name false-positive), updatedcmd_safety_rules.c'sHARA002/003/004engine rules for the new schema, and fixed two self-inflictedCFUSA-CY002false positives.Test plan
ctest --test-dir build— 39/39 test binaries pass, including newtests/test_xfusa_v114.clcov/cfusa coverage --threshold 80— 85.0% line coverage (gate: 80%)cfusa hara/fmea/tara/safety-case --format jsonoutput validated as well-formed JSON (python3 -m json.tool) and free ofFUSA-STUB001-pattern placeholder textcfusa check --dir .shows no new findings attributable to this change (fixed 2 self-inflictedCY002false positives)