v0.6.0

cfusa v0.6.0

Nine fixes: seven from an open-issue sweep (#128, #124, #126, #97, #127,
#125, #122) plus two more (#129, #137) found and fixed the same session.
Minor version bump — includes new user-facing flags/behaviors, not just
bug fixes.

Fixed

• cfusa qualify's qualified/qualificationBadge JSON fields could
  disagree (qualified: true next to qualificationBadge: "unqualified") since they were computed independently. qualified now
  requires both passing self-tests AND a declared --qualification-method.
  (#128)
• cmd_hara.c's split_array() silently dropped any hazard/safety-goal
  JSON element >=511 bytes (fixed 512-byte stack buffer, no warning) — a
  real HARA document could read 0 hazards. Now heap-allocates each element
  at its exact length; the (generous) entry-count cap now warns instead of
  silently truncating. (#124)
• CFUSA-A003 (signed/unsigned vs sizeof, CERT INT02-C) was a
  near-100% false-positive rate on real code — purely syntactic, no type
  awareness. Now does a two-pass scan for locally-visible
  size_t/unsigned-family names before flagging; self-scan on this repo
  went from 22 to 2 findings. (#126)
• cfusa safety-case hardcoded exact lowercase evidence filenames
  (hara.md, safety-plan.md, etc.), case-sensitive via stat() — broke
  on Linux CI/release for projects naming files e.g. HARA.md. New shared
  cfusa_find_file_ci() does a real case-insensitive directory-listing
  match. (#97)
• cfusa coverage --mcdc-file parsed a schema that never matched real
  llvm-cov export output, so every genuine export reported 0 MC/DC
  conditions. Fixed and verified against an actual captured llvm-cov export run (both a fully-covered and zero-covered case). (#129)

Added

• cfusa fix remediation guidance for CFUSA-CY006 (free-without-NULL,
  CWE-416/CERT-C MEM30-C). (#127)
• cfusa trace --func-coverage-strict — a genuinely per-function
  annotation-density gate (a //cfusa:req tag directly above the
  function's own definition), additive alongside the unchanged file-level
  --func-coverage. (#125)
• .fusa-dispositions.json is now enforced, not just logged.
  cfusa check/cfusa lint load it and exclude accept/mitigate-action
  findings (matched by fingerprint, never rule-wide) from the exit-code
  gate — the finding stays visible, tagged inline, and its own summary
  bucket. cfusa disposition add --fingerprint <sha256:...> is new.
  (#122)
• cfusa coverage --branch-threshold <pct> — an independent
  branch-coverage regression floor, separate from --threshold's
  line-only gate; acts as a floor alongside --dal/--asil (never
  weakens their fixed-100% branch requirement, only raises it if
  stricter). (#137)

Installation

# Linux (amd64)
curl -Lo cfusa https://github.com/SoundMatt/c-FuSa/releases/download/v0.6.0/cfusa-linux-amd64
chmod +x cfusa && sudo mv cfusa /usr/local/bin/

# macOS (arm64)
curl -Lo cfusa https://github.com/SoundMatt/c-FuSa/releases/download/v0.6.0/cfusa-darwin-arm64
chmod +x cfusa && sudo mv cfusa /usr/local/bin/

# From source
cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --install build

Verify

cfusa version
cfusa qualify

What's Changed

• fix: CFUSA qualify no longer reports self-contradictory qualified/badge (#128) by @SoundMatt in #130
• fix: cmd_hara split_array() no longer silently drops oversized entries (#124) by @SoundMatt in #131
• fix: CFUSA-A003 precision — no longer flags already-unsigned operands (#126) by @SoundMatt in #132
• fix: cfusa safety-case matches evidence filenames case-insensitively (#97) by @SoundMatt in #133
• feat: cfusa fix adds remediation guidance for CFUSA-CY006 (#127) by @SoundMatt in #134
• feat: cfusa trace --func-coverage-strict, a genuinely per-function gate (#125) by @SoundMatt in #135
• feat: wire .fusa-dispositions.json into cfusa check/lint enforcement (#122) by @SoundMatt in #136
• fix: cfusa coverage --mcdc-file parses the real llvm-cov export schema (#129) by @SoundMatt in #138
• feat: cfusa coverage --branch-threshold, an independent branch gate (#137) by @SoundMatt in #139
• chore: bump v0.5.54 -> v0.6.0 by @SoundMatt in #140

Full Changelog: v0.5.54...v0.6.0