chore: bump go-FuSa pin to v0.47.1 - #61
Merged
Merged
Conversation
go-FuSa v0.47.1 (upstream go-FuSa#87) shipped a few hours after this repo's v0.47.0 pin bump (#56), and it fixes exactly the bug that #56's commit message noted was "filed upstream": do178's text-mode summary line printed a nonsensical negative GAP count while -format json's counts were correct. Re-checked latest go-FuSa release right before acting; v0.47.1 is current as of this commit. Bump all three pin locations (ci.yml's gofusa job, ci.yml's compliance job, release.yml) to v0.47.1 so they stay identical, per this repo's own established convention. Verified locally with go-FuSa v0.47.1: full gofusa lifecycle (check/ trace/cyber/vuln/qualify/verify/coverage/hara/boundary/sci/coupling/ tara/fmea -strict/release/safety-case/audit-pack) and all 7 standards gap reports pass cleanly; do178's text-mode summary now correctly prints "0 GAP" instead of "-1 GAP", confirming the upstream fix. The ci.yml JSON-summary negative-count backstop added in #56 still passes and is left in place as a defense-in-depth regression guard even though its originating bug is now fixed upstream. go build/vet/test -race all green. Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
This was referenced Jul 30, 2026
SoundMatt
added a commit
that referenced
this pull request
Jul 30, 2026
go-FuSa v0.48.0 (upstream go-FuSa#89) fixes a critical bug in hara.DetermineASIL: the hand-written ISO 26262-3:2018 Table 4 lookup was wrong in 8/12 S2 cells and 11/12 S3 cells, always inflating the ASIL rating versus the standard's correct additive S+E+C model. It also fixes a non-reproducible qualify.computeHash (hashed the live timestamp, didn't sort results before hashing), a git argument-injection risk in impact.changedFiles, and a CI SARIF self-scan masking bug; a stale committed check-report.json was removed upstream and a legacy .fusa.json shape normalized. Bump all three pin locations (ci.yml's gofusa job, ci.yml's compliance job, release.yml) to v0.48.0 so they stay identical, per this repo's established convention (#61). Verified locally with go-FuSa v0.48.0: full gofusa lifecycle (check/ trace -req-coverage 100/cyber/vuln/trace -sec-tested 100/qualify/verify/ coverage/hara show/boundary/sci/coupling/tara/fmea -cyber -strict/ release/audit-pack) and the compliance job's additional steps (safety-case/check --output json/all 7 standards gap reports/the negative-count JSON sanity backstop) all pass cleanly, matching CI exactly. go-LIN's own dogfooded .fusa-hara.json (H-01..H-06) was already re-derived under the correct additive model back in #72, so the upstream ASIL-calculation fix surfaces no drift here: `gofusa hara show` reports the same ASIL-A/QM classifications as before, with zero gaps beyond the pre-existing fssrRefs advisories. gofusa cyber still reports the same 28 pre-existing CYBER009 INFO findings (0 error/0 warning) documented in ci.yml's comments; gofusa qualify still passes 46/46; gofusa fmea -strict still clears the content-quality gate. iec62443/slsa show a builder-field GAP when run outside CI (expected — that field is injected by ci.yml's post-release Python step using GITHUB_* env vars) but pass with 0 GAP once that step is simulated locally. go build/vet/test/test -race all green. No new ERROR/GAP/FAIL findings versus v0.47.1; no fixes required beyond the pin bump itself. Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
go-FuSa v0.47.1 (upstream go-FuSa#87) shipped a few hours after this repo's v0.47.0 pin bump (#56), and fixes exactly the DO-178C text-mode summary negative-GAP-count bug that #56's commit message flagged as "filed upstream". Re-checked
gh release list --repo SoundMatt/go-FuSaimmediately before pushing this — v0.47.1 is current as of this PR.Bumps all three pin locations (ci.yml's
gofusajob, ci.yml'scompliancejob, release.yml) to v0.47.1 so they stay identical, per this repo's own convention (documented in theci.ymlcomment above the job).Verification (local, go-FuSa v0.47.1)
go build/go vet/go test -race ./...— all greenfmea -cyber -strict/ release / safety-case / audit-pack — all pass cleanlygofusa do178's text-mode summary now prints0 GAP(previously-1 GAPunder v0.47.0)