fix: carry forward §1.6.2 attestation on regeneration (v0.44.0) - #74
Merged
Conversation
x-FuSa spec §1.6.2 was updated (spec v1.15.0) to make attestation carry-forward a MUST: before an artifact-producing command rebuilds its output, it must load any existing attestation from the prior saved output file and carry it forward, rather than discarding it. gofusa fmea/tara/safety-case/sas each unconditionally overwrote their output with a brand-new report built from scratch — none loaded the existing file first or copied forward its attestation field, so a hand-added, valid, reviewed attestation was silently destroyed the moment the command was re-run, even when the artifact's substantive content hadn't changed (go-FuSa#57). A project that adopted --require-attestation/ --strict per the spec's suggested CI shape would find their review wiped on every regeneration, defeating the whole mechanism. Add carryForwardAttestation (cmd/gofusa/helpers.go), which loads the "attestation" key from a prior output file — working uniformly across fmea.json/tara.json/safety-case.json/sas.json without needing each artifact's full schema — and wire it into each of the four commands right before they overwrite their JSON output. Staleness continues to fall out automatically: a carried-forward contentHash that no longer matches the freshly-computed content hash means AttestationValid (via stubcheck.AttestationSuppresses) treats the attestation as not currently suppressing, never that it silently vanished. Signed-off-by: Matt Jones <matt@jellybaby.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if code := runSas([]string{"--dir", dir, "--output", outFile}, &out1, &err1); code != fusa.ExitGateFail && code != fusa.ExitOK { | ||
| t.Fatalf("first run: unexpected exit %d, stderr: %s", code, err1.String()) | ||
| } | ||
| if _, err := os.Stat(sasJSONPath); err != nil { |
| func writeSafetyFuncSource(t *testing.T, dir string) { | ||
| t.Helper() | ||
| src := "package main\n\n//fusa:req REQ-001\nfunc SafetyFunc() error { return nil }\n" | ||
| if err := os.WriteFile(filepath.Join(dir, "main.go"), []byte(src), 0o644); err != nil { |
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces #71 (closed — that branch picked up an unsigned auto-generated merge commit from a conflict-free
git merge origin/main, which silently skips-seven when the surrounding shell command used it for other commits). Same content, rebuilt via cherry-pick + squash onto current main (which now includes #72 and #73), a single properly-signed commit, no merge commits.gofusa fmea/tara/safety-case/saseach unconditionally overwrote their JSON output from a freshly-built report — a hand-added, valid, reviewed attestation was destroyed on every re-run, even with no substantive content change.carryForwardAttestationhelper (cmd/gofusa/helpers.go) loads theattestationkey from the prior output file and is now called by all four commands right before they overwrite their output. Staleness still falls out automatically via the existing hash check instubcheck.AttestationSuppresses/fusa.AttestationValid.Closes #57. Addresses x-FuSa spec v1.15.0 item 1 from #64 (attestation carry-forward MUST) — items 2 and 3 of #64 were addressed in #72 (already merged).
Test plan
go build ./...go vet ./...go test -race -count=1 ./...(88.5% total coverage)golangci-lint run ./...(0 issues)go generate ./...(no diff)carryForwardAttestationunit tests + one end-to-end test per command (fmea/tara/safety-case/sas) round-tripping a "reviewed" attestation through two runs