[boeboe]

Summary

• Dependencies: go-ocpp v0.1.5 → v0.2.0. The Go 1.26 floor is kept, and go fix ./... has been applied. The CI and release workflows are on otfabric/.github v3.3.1.

• SAST (gosec and opengrep, low/low): 16 findings → 0. Fourteen are fixed in code:

  • G304: file reads go through filepath.Clean.
  • G115: the flag binder no longer converts integer types.

  The other two are recorded as false positives in otfabric/sast-triage (PR linked below):

  • G101: the OCPPCTL_PASSWORD variable name, the same case as bacnetctl.
  • G703: scenario payload files. By the documented design they may lie outside the scenario's directory (examples/scenarios/smoke-1.6.yaml uses @../payloads/…). docs/scenarios.md now says to review a scenario from someone else as you would a script.

• Hardening: 20 defects fixed, each with a test that failed before the fix.

  • Terminal output: escape and line injection from peer strings in text and table output, and in error: lines and the --debug trace.
  • Payload rendering: text output rounded integers above 2^53 in payloads.
  • Refused connections: these were held open with no idle timeout.
  • Overflows: of timeout_ms, of the heartbeat and boot intervals, and of {N..M} station ranges (panic and endless loop).
  • Pending boot: a Pending boot wait was reset by every TriggerMessage.
  • Step timeouts: a step timeout was cut off at --timeout.
  • Scenario conditions: conditions with no value passed silently.
  • frame decode -: it read stdin without a bound.
  • Secrets in errors: --url and --header errors repeated secrets.
  • Station model: a negative or non-finite power was accepted.
  • Passwords file: a BOM in it broke the first entry.
  • server stations: it failed with long 1.6 identities.
  • Output failures: server start kept running when its output failed.
  • Busy station: server call to a busy station exited 10.

• New exit code: station_busy (exit 4), documented in docs/exitcodes.md and docs/server-config.md.

• Tests:

  • Seven new fuzz targets: FuzzFrameDecode, FuzzExpandURL, FuzzSubstitute, FuzzCheck, FuzzEscape, FuzzParsePasswords and FuzzCheckCSMSCall.
  • Hostile-peer tests for the CSMS, the station and the scenario runner.
  • Coverage went from 91.9 % to 95.3 %.

• Release notes: RELEASE.md has a ## v0.3.0 section. It is prepared, not released.

Test plan

• make check passes (coverage 95.3 %, per-package floor met).
• make e2e passes.
• go test -race -count=5 -cpu 1,2,8 ./... passes.
• go vet passes for linux/386 and linux/arm.
• SAST rescan: only the two triaged findings are left.
• scripts/interop.sh v0.5.3, run before the hardening: 1154 pass, 29 CALLERROR, 32 skip and 3 fail, the same as v0.4.1. The 3 failures are ocpp-go's schema-invalid 2.0.1 responses.
• Three full interop runs (reports/interop-v0.5.3.tsv is from the last, on the final code). Its results match v0.4.1 row for row. The second run had one extra failure, lorenzodonini 1.6 Reset ("connection closed while waiting for the response"), which did not recur in the third run or in 26 targeted Resets, with and without an open session. It is recorded here as an intermittent failure whose cause I have not found; it is not attributed to either side.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 98.00000% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/csms/answer.go	50.00%	2 Missing ⚠️
internal/station/station.go	90.00%	2 Missing ⚠️
internal/script/run.go	85.71%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!