chore(ci): bump go-FuSa pin from v0.47.0 to v0.48.0 - #92
Merged
Conversation
Verified locally against both pinned binaries before bumping: check, trace -req-coverage 100, cyber, vuln, and qualify all exit 0 on this repo's tree at v0.47.0 and v0.48.0 alike, with byte-for-byte identical findings — the only diff anywhere in the gated sequence is qualify's integrity hash, expected per go-FuSa's changelog (qualify.computeHash now excludes the live generatedAt timestamp and sorts results before hashing, for reproducibility). go build/go vet/go test/go test -race all clean. v0.48.0's headline change is a fix to hara.DetermineASIL (the hand-written ISO 26262-3:2018 Table 4 lookup previously inflated ratings in 8/12 S2 cells and 11/12 S3 cells). None of this repo's gated commands (check/trace/cyber/vuln/qualify) cross-validates .fusa-hara.json's recorded asil fields against S/E/C, so the bump itself introduces no new gate finding. Separately, using v0.48.0's `gofusa hara asil` and independently cross-checking against the published ISO 26262-3:2018 Table 4, two entries in this repo's own .fusa-hara.json (H-003: S2/E3/C2, and H-005: S1/E4/C2) are over-classified as ASIL-B where Table 4 gives ASIL-A. Left unchanged here since it's outside any CI gate and outside this change's scope; tracked separately. Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the pinned
gofusaCLI used by the go-FuSa continuous-conformancelifecycle job (RELAY spec §20.1.2) from
v0.47.0tov0.48.0(latestrelease).
Verification
Installed both
gofusav0.47.0 and v0.48.0 locally and ran the exactgating sequence CI runs, against this repo's own tree, on both:
gofusa check ./...— exit 0, byte-identical (no findings) on both versionsgofusa trace -req-coverage 100— 100% (94/94 reqs traced, 67/67 functions annotated) on bothgofusa cyber— 0 error / 4 warning / 93 info, identical output on bothgofusa vuln— 0 findings, identical output on bothgofusa qualify— 46/46 passed on both; only diff anywhere in the wholesequence is the integrity hash in
qualify-report.json, expected pergo-FuSa's v0.48.0 changelog (
qualify.computeHashnow excludes the livegeneratedAttimestamp and sortsresults[]before hashing, forreproducibility — not a finding)
go build ./...,go vet ./...,go test ./..., andgo test ./... -raceall clean. No
golangci-lintconfig in this repo, so not applicable.No new ERROR-level (or any-level) gate finding was surfaced by v0.48.0
vs v0.47.0.
Separate finding (not part of this change)
v0.48.0's headline fix is to
hara.DetermineASIL— the hand-written ISO26262-3:2018 Table 4 lookup in v0.47.0 and earlier inflated ASIL ratings
in 8/12 S2 cells and 11/12 S3 cells (see
go-FuSa#89). None of this
repo's gated commands cross-validate
.fusa-hara.json's recordedasilfields against its
severity/exposure/controllabilityfields, so thisbump itself doesn't surface anything there. However, using v0.48.0's new
gofusa hara asilderivation command, and independently cross-checkingagainst the published ISO 26262-3:2018 Table 4, two entries in this
repo's own
.fusa-hara.jsonappear over-classified:Both are over-classifications (conservative direction, not a
missed-hazard/under-classification), and this artifact is explicitly
documented as a SEOOC HARA whose ratings are assumptions pending the
integrator's system-level HARA. Left unchanged in this PR since it's
outside any CI gate and outside a pure pin-bump's scope — flagging here so
it can be tracked/fixed separately.
Version bump
No project version bump — checked precedent (prior go-FuSa pin bumps
#49/#61) and this repo's own version/artifact stamping is handled byan automated post-merge job (
release.yml's "regenerate safety artifactsfor vX.Y.Z" bot commit), not manually in the pin-bump PR itself, when the
bump is a clean tool-version-only change with no new findings.
Test plan
go build ./...go vet ./...go test ./...go test ./... -racegofusa check/trace/cyber/vuln/qualifyverified locally at v0.48.0 against this repo's tree (see above)