Repository navigation
fix: v1.145.0 — second FuSaOps self-audit (8 bugs) + spec v1.15.1 clarification - #100
Merged
Merged
Conversation
…rification A follow-up deep audit of FuSaOps itself found 8 real defects the prior self-audit fix missed: fmea.json's standard field bypassing the CanonicalStandardID helper, capabilities.json's non-canonical iec62443 id, hara show --format json missing the common header, 5 duplicate requirement ids with no detection anywhere, adapter.Check() discarding exit codes and the §3.2 error envelope, uncategorized findings not normalizing to "other", the aggregate dropping disposition/standard/clause (re-gating on findings already waived upstream), and aggregate renderers never emitting the spec-mandated qualified "<language>/<ruleId>" form. Also resolves #99: the spec text said schemaVersion was MAJOR.MINOR only, but two independent tools already emit the full MAJOR.MINOR.PATCH — spec v1.15.1 reconciles the text to match. See CHANGELOG.md for the full per-issue breakdown. Signed-off-by: SoundMatt <SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // The runner intentionally ignores the tool's exit code; we read the file. | ||
| _, _ = a.run(ctx, root, a.tool, "check", "--format", "json", "--output", out) | ||
| _, runErr := a.run(ctx, root, a.tool, "check", "--format", "json", "--output", out) |
| //fusa:test REQ-FO-ADP006 | ||
| func TestParseToolReport(t *testing.T) { | ||
| findings, err := parseToolReport([]byte(sampleReport), fusaops.LangGo, "go-FuSa") | ||
| findings, _, err := parseToolReport([]byte(sampleReport), fusaops.LangGo, "go-FuSa") |
|
|
||
| func TestParseToolReportInvalid(t *testing.T) { | ||
| if _, err := parseToolReport([]byte("{not json"), fusaops.LangGo, "t"); err == nil { | ||
| if _, _, err := parseToolReport([]byte("{not json"), fusaops.LangGo, "t"); err == nil { |
| return nil, errors.New("testtool exited 3 (runtime/internal error)") | ||
| }, | ||
| } | ||
| _, err := a.Check(context.Background(), t.TempDir()) |
| return nil, nil | ||
| }, | ||
| } | ||
| _, err := a.Check(context.Background(), t.TempDir()) |
| } | ||
| } | ||
|
|
||
| //fusa:test REQ-FO-CORE011 |
| } | ||
| } | ||
|
|
||
| //fusa:test REQ-FO-CORE012 |
| } | ||
| if runErr != nil { | ||
| if tr.Error != nil { | ||
| return findings, fmt.Errorf("adapter %s: runtime error (%s): %s", a.name, tr.Error.Code, tr.Error.Message) |
| return findings, fmt.Errorf("adapter %s: %w", a.name, runErr) | ||
| } | ||
| if tr.Error != nil { | ||
| return findings, fmt.Errorf("adapter %s: runtime error (%s): %s", a.name, tr.Error.Code, tr.Error.Message) |
| } | ||
|
|
||
| // validCategories is the x-FuSa spec §4 closed, extensible category enum. | ||
| var validCategories = map[string]bool{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #91, closes #92, closes #93, closes #94, closes #95, closes #96, closes #97, closes #98, closes #99.
A follow-up deep audit of FuSaOps itself (run immediately after the prior 10-bug self-audit fix shipped as v1.144.0) found 8 more real defects plus one genuine spec ambiguity:
standardfield bypassed the existingCanonicalStandardIDhelper every sibling package uses"iec62443"instead of"iec62443-4-1"/"iec62443-4-2"hara show --format jsonwas the one artifact command (of six) missing the §3.1 common header.fusa-reqs.json, with no detection mechanism anywhereadapter.Check()discarded the tool's exit code and never decoded the §3.2 error envelope — a crashed (exit 3) run was treated as cleancategorywasn't normalized to"other"for unrecognized values, unlike severityFindingdroppeddisposition/standard/clause— the disposition gap was behavioral: an upstream-waived ERROR finding still gated FuSaOps' own exit code"<language>/<ruleId>"formAlso resolves #99: two independent tools (FuSaOps and py-FuSa) already emit the full
MAJOR.MINOR.PATCHspec version, contradicting the spec'sMAJOR.MINOR-only text — spec v1.15.1 reconciles the prose to match established practice rather than demanding a retrofit.See CHANGELOG.md for the full per-issue breakdown.
Test plan
go build ./...,go vet ./...cleango test ./...— all packages pass, including new regression tests for each fix (Gates/QualifiedRuleID, FindDuplicateIDs, normaliseCategory, exit-3 handling, HasErrors+disposition, hara common header)