Repository navigation
Pin rust-FuSa to v0.3.10 instead of floating on unpinned (default branch) #10
Description
This repo's CI currently references rust-FuSa via unpinned (default branch) rather than an explicit version pin:
cargo install --git https://github.com/SoundMatt/rust-FuSa rsfusa --locked
has no --tag — add --tag v0.3.10.
This is a reproducibility and stability risk: an upstream change to rust-FuSa's default branch can silently change or break this repo's CI with no corresponding commit in this repo to explain why.
This is part of an ecosystem-wide policy decision to pin every x-Net repo (all languages) to an explicit, deliberately-upgraded rust-FuSa version, matching what the Go x-Net repos already do (and are being updated to do consistently, see the parallel go-FuSa v0.36.0 pin-update pass).
Note that pinning to v0.3.10 (today's latest) may surface checks that were not being enforced before, since floating on main meant this repo was already exposed to whatever the newest checks are anyway -- so behavior should be similar, but flag that verification is still required.
This issue will be actioned directly as part of this pass, not left open.
Activity
fix: pin rust-FuSa to v0.3.10 in CI instead of floating on default br…
SoundMatt commentedon Jul 28, 2026
Fixed in #11 (merged, auto-closed this issue).
--tag v0.3.10(was floating with no tag).Installing rsfusa v0.3.10 (https://github.com/SoundMatt/rust-FuSa?tag=v0.3.10#2ae104fd).|| true: the two non-suppressed safety steps both succeeded cleanly —rsfusa qualify(16/16 cases passed) andrsfusa release(SBOM, provenance, artifact manifest all written without error).