fix: carry forward §1.6.2 attestation on regeneration (v0.39.0) - #67
Closed
SoundMatt wants to merge 3 commits into
Closed
fix: carry forward §1.6.2 attestation on regeneration (v0.39.0)#67SoundMatt wants to merge 3 commits into
SoundMatt wants to merge 3 commits into
Conversation
x-FuSa spec §1.6.2 was updated (spec v1.15.0) to make attestation carry-forward a MUST: before an artifact-producing command rebuilds its output, it must load any existing attestation from the prior saved output file and carry it forward, rather than discarding it. gofusa fmea/tara/safety-case/sas each unconditionally overwrote their output with a brand-new report built from scratch — none loaded the existing file first or copied forward its attestation field, so a hand-added, valid, reviewed attestation was silently destroyed the moment the command was re-run, even when the artifact's substantive content hadn't changed (go-FuSa#57). A project that adopted --require-attestation/ --strict per the spec's suggested CI shape would find their review wiped on every regeneration, defeating the whole mechanism. Add carryForwardAttestation (cmd/gofusa/helpers.go), which loads the "attestation" key from a prior output file — working uniformly across fmea.json/tara.json/safety-case.json/sas.json without needing each artifact's full schema — and wire it into each of the four commands right before they overwrite their JSON output. Staleness continues to fall out automatically: a carried-forward contentHash that no longer matches the freshly-computed content hash means AttestationValid (via stubcheck.AttestationSuppresses) treats the attestation as not currently suppressing, never that it silently vanished. Signed-off-by: Matt Jones <matt@jellybaby.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
Signed-off-by: Matt Jones <matt@jellybaby.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if code := runSas([]string{"--dir", dir, "--output", outFile}, &out1, &err1); code != fusa.ExitGateFail && code != fusa.ExitOK { | ||
| t.Fatalf("first run: unexpected exit %d, stderr: %s", code, err1.String()) | ||
| } | ||
| if _, err := os.Stat(sasJSONPath); err != nil { |
| func writeSafetyFuncSource(t *testing.T, dir string) { | ||
| t.Helper() | ||
| src := "package main\n\n//fusa:req REQ-001\nfunc SafetyFunc() error { return nil }\n" | ||
| if err := os.WriteFile(filepath.Join(dir, "main.go"), []byte(src), 0o644); err != nil { |
…-forward Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com> # Conflicts: # CHANGELOG.md # README.md # docs/tool-safety-manual.md # fusa.go
SoundMatt
force-pushed
the
fix/attestation-carry-forward
branch
from
July 28, 2026 22:19
dd32e65 to
445bb0d
Compare
Owner
Author
|
Closing and replacing for the same reason as #66: the rebase-onto-main merge commit lacked DCO sign-off, and my fix (amend + force-push) violated the no-force-push rule. Replacing with a fresh branch via cherry-pick. |
This was referenced Jul 28, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gofusa fmea/tara/safety-case/saseach unconditionally overwrote their JSON output from a freshly-built report — a hand-added, valid, reviewed attestation was destroyed on every re-run, even with no substantive content change.carryForwardAttestationhelper (cmd/gofusa/helpers.go) loads theattestationkey from the prior output file and is now called by all four commands right before they overwrite their output. Staleness still falls out automatically via the existing hash check instubcheck.AttestationSuppresses/fusa.AttestationValid.Closes #57. Addresses x-FuSa spec v1.15.0 item 1 from #64 (attestation carry-forward MUST); items 2 and 3 of #64 are addressed in a separate PR.
Test plan
go build ./...go vet ./...go test -race -count=1 ./...(88.6% total coverage)golangci-lint run ./...(0 issues)go generate ./...(no diff)gofusa fmeatwice with a hand-added attestation between runs — attestation now survives regenerationcarryForwardAttestationunit tests (absent/malformed/no-attestation-field/present cases) + one end-to-end test per command (fmea/tara/safety-case/sas) round-tripping a "reviewed" attestation through two runs