fix: v0.48.0 — ISO 26262-3 Table 4 ASIL fix + audit remediation - #89
Merged
Conversation
hara.DetermineASIL mis-implemented ISO 26262-3:2018 Table 4 (Critical): 8/12 S2 cells and 11/12 S3 cells were wrong, always inflating the rating versus the standard's additive S+E+C model. Replaced with the correct reproducible rule (points=S+E+C, S1-3/E1-4/C1-3, <=6 QM/7 A/8 B/9 C/10 D), corrected the golden test values that had locked the bug in, and re-derived this repo's own dogfooded .fusa-hara.json under the fix — the highest ASIL among H-001..H-005 drops from the previously-claimed ASIL-C to ASIL-B. Also fixes: qualify.computeHash non-reproducible integrity hash (embedded generatedAt, unsorted Results), a git argument-injection path in impact.changedFiles (missing "--" pathspec separator ahead of attacker-influenced refs), a stale check-report.json committed with an absolute local path, the legacy .fusa.json shape (missing configVersion and top-level standard/asil), and CI's SARIF self-scan step masking real failures with "|| true". Unicode NFC normalization in normalizeMessage remains deliberately unpatched per the std-lib-only convention (would require golang.org/x/text). Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // interpreted by git as an option rather than a revision. | ||
| for _, ref := range []string{fromRef, toRef} { | ||
| if strings.HasPrefix(ref, "-") { | ||
| return nil, fmt.Errorf("impact: invalid ref %q: must not begin with '-'", ref) |
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A third-party audit surfaced a critical defect in
hara.DetermineASILplus several medium/low findings. This PR fixes all of them (except one deliberately left alone), bumps the version, and updates the changelog.hara.DetermineASIL(Critical): the hand-written ISO 26262-3:2018 Table 4 lookup was wrong in 8/12 S2 cells and 11/12 S3 cells, always inflating the ASIL rating versus the standard's correct additive S+E+C model. Replaced with the reproducible additive rule:points = S(1-3) + E(1-4) + C(1-3),<=6 -> QM, 7 -> A, 8 -> B, 9 -> C, 10 -> D(ASIL D only at S3+E4+C3).hara/hara_test.go's golden values, which had locked in the inflated results, are corrected..fusa-hara.jsonre-derived under the fix — this repo's own dogfooded HARA (H-001..H-005) had over-classified ASILs as a direct consequence of the bug above; the highest ASIL among them drops from the previously-claimed ASIL-C to ASIL-B.qualify.computeHashnon-reproducible integrity hash: it hashed the livegeneratedAttimestamp and didn't sortResultsbefore hashing. Now excludesgeneratedAt, canonicalizes viafusa.CanonicalizeJSON, and sortsresults[]by case name first.impact.changedFiles:git diffwas built from--from/--torefs with no--pathspec separator, so a ref beginning with-could be interpreted as an option. Refs starting with-are now rejected, and--is always inserted before the revision range.check-report.json(plain text, baked with an absolute local path) removed;.gitignorenow coverscheck-report.jsonandresults.sarif..fusa.jsonshape normalized to the current canonical form (configVersionplus top-levelstandard/asil).gofusa check --format sariffailures were unconditionally swallowed by|| truebefore the upload step. Now only exit 0/1 (clean/findings-present) are treated as producing a valid SARIF; anything higher fails the job.Deliberately not patched: Unicode NFC normalization in
normalizeMessage— a correct fix needsgolang.org/x/text, which conflicts with this repo's std-lib-only convention (go.mod has zero dependencies).Test plan
go build ./...go vet ./...go test ./...(all packages pass)gofmt -l .(clean)0.47.0->0.48.0infusa.go,README.md,docs/tool-safety-manual.md(CI's doc-version-consistency gate checks both)CHANGELOG.mdentry added