Add additional scores to statements and fix minor bugs

.bazelversion

@@ -0,0 +1 @@
+8.3.1

.devcontainer/S-CORE/Dockerfile

@@ -87,5 +87,5 @@ RUN groupadd --gid $USER_GID $USERNAME \
 USER $USERNAME
 
 # Install trudag using pipx
-RUN pipx install git+https://gitlab.com/CodethinkLabs/trustable/trustable@83b4023d7e2bd2b984db2c81543266ce09a7cbf7 && \
+RUN pipx install https://gitlab.com/api/v4/projects/66600816/packages/generic/trustable/v2025.10.22/trustable-2025.10.22-py3-none-any.whl && \
     pipx ensurepath

.devcontainer/S-CORE/post_create_script.sh

@@ -5,4 +5,4 @@ source .venv/bin/activate
 
 # Install trustable
 pip install --require-hashes -r .devcontainer/S-CORE/requirements.txt
-pip install git+https://gitlab.com/CodethinkLabs/trustable/trustable@83b4023d7e2bd2b984db2c81543266ce09a7cbf7
+pip install https://gitlab.com/api/v4/projects/66600816/packages/generic/trustable/v2025.10.22/trustable-2025.10.22-py3-none-any.whl

.dotstop_extensions/validators.py

@@ -119,22 +119,22 @@ def https_response_time(configuration: dict[str, yaml]) -> tuple[float, list[Exc
     for url in urls:
         try:
             # in the reference website, an url comes together with https://
-            response = requests.get(url,timeout=5*target)
+            response = requests.get(url, timeout=6 * target)
         except requests.exceptions.ConnectionError as e:
             print(f"Critical error: target site {url} could not be reached.")
             exceptions.append(e)
             scores.append(0)
             continue
         except requests.exceptions.ReadTimeout as e:
-            print(f"Error: target site {url} could not be reached within {5*target} seconds.")
+            print(f"Error: target site {url} could not be reached within {6 * target} seconds.")
             exceptions.append(e)
             scores.append(0)
             continue
         # check whether target site is successfully called
         if response.status_code == 200:
             # if target site is successfully called, check if it is reached within target seconds
-            # recall that target/response.elapsed.microseconds>1/5, so score is accordingly refactored 
-            score = (min(1e6*target/response.elapsed.microseconds, 1.0)-0.2)*1.25
+            elapsed_seconds = max(response.elapsed.total_seconds(), 1e-6)
+            score = min(target / elapsed_seconds, 1.0)
             scores.append(score)
             continue
         scores.append(0)
@@ -185,7 +185,7 @@ def check_test_results(configuration: dict[str, yaml]) -> tuple[float, list[Exce
         for test in tests:
             # check if data for test have been captured
             command = f"SELECT COUNT(*) FROM {table} WHERE name = ?"
-            cnt = cursor.execute(command, (test)).fetchone()[0]
+            cnt = cursor.execute(command, (test,)).fetchone()[0]
             if cnt is None or cnt == 0:
                 # no data found -> assign trustability 0 and inform user
                 warnings.append(Warning(f"Could not find data for test {test}."))
@@ -396,9 +396,9 @@ def coveralls_reporter(configuration: dict[str, yaml]) -> tuple[float, list[Exce
         return (0.0, [ValueError("The repository needs to be specified in the configuration for coveralls_reporter.")])
     branch = configuration.get("branch",None)
     if branch is not None:
-        url = f"coveralls.io/github/{owner}/{repo}?branch={branch}.json"
+        url = f"https://coveralls.io/github/{owner}/{repo}.json?branch={branch}"
     else:
-        url = f"coveralls.io/github/{owner}/{repo}.json"
+        url = f"https://coveralls.io/github/{owner}/{repo}.json"
     res = requests.get(url)
     if res.status_code != 200:
         return (0.0, [RuntimeError(f"Can not reach {url} to fetch the code coverage!")])

.gitattributes

@@ -0,0 +1,3 @@
+# Keep Trustable graph and statement files byte-stable across Windows and Linux checkouts.
+.dotstop.dot text eol=lf
+TSF/trustable/**/*.md text eol=lf

.github/workflows/publish_documentation.yml

@@ -54,7 +54,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y graphviz
           pip install --require-hashes -r .devcontainer/S-CORE/requirements.txt
-          pip install git+https://gitlab.com/CodethinkLabs/trustable/trustable@83b4023d7e2bd2b984db2c81543266ce09a7cbf7
+          pip install https://gitlab.com/api/v4/projects/66600816/packages/generic/trustable/v2025.10.22/trustable-2025.10.22-py3-none-any.whl
+
+      - name: Verify trudag setup
+        run: |
+          trudag --version
+          trudag manage lint
 
       - name: Install tools
         run: |
@@ -119,7 +124,7 @@ jobs:
           git add TSF/misbehaviours.md
           git commit -m "Updated issues list" || echo "No changes to commit"
           git push origin save_historical_data && git pull
-      
+
       - name: Select persistent scoring DB (rotate if near GitHub limit)
         id: select_db
         shell: bash

.github/workflows/test_publication.yml

@@ -54,7 +54,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y graphviz
           pip install --require-hashes -r .devcontainer/S-CORE/requirements.txt
-          pip install git+https://gitlab.com/CodethinkLabs/trustable/trustable@83b4023d7e2bd2b984db2c81543266ce09a7cbf7
+          pip install https://gitlab.com/api/v4/projects/66600816/packages/generic/trustable/v2025.10.22/trustable-2025.10.22-py3-none-any.whl
 
       - name: Prepare scoring DB (test)
         shell: bash

.github/workflows/test_trudag_extensions.yml

@@ -26,7 +26,7 @@ jobs:
     - name: Install dependencies
       run: |
         pip install --require-hashes -r .devcontainer/S-CORE/requirements.txt
-        pip install git+https://gitlab.com/CodethinkLabs/trustable/trustable@83b4023d7e2bd2b984db2c81543266ce09a7cbf7
+        pip install https://gitlab.com/api/v4/projects/66600816/packages/generic/trustable/v2025.10.22/trustable-2025.10.22-py3-none-any.whl
 
     - name: Run tests
       run: |

TSF/README.md

@@ -185,13 +185,13 @@ Based on the above observations, the following steps are recommended for each up
 
 ## Assumptions of use
 
-The documentation follows the Trustable Software Framework (TSF), which is documented [here](https://codethinklabs.gitlab.io/trustable/trustable/print_page.html).
-Furthermore, the automatic generation of the TSF report and the tracking of changes to the core functionalities of the library uses _trudag_, which is developed by Codethink and located [here](https://gitlab.com/CodethinkLabs/trustable/trustable).
+The documentation follows the Trustable Software Framework (TSF), which is documented [here](https://pages.eclipse.dev/eclipse/tsf/tsf/).
+Furthermore, the automatic generation of the TSF report and the tracking of changes to the core functionalities of the library uses _trudag_, which is developed as part of TSF and released [here](https://gitlab.eclipse.org/eclipse/tsf/tsf/-/releases).
 
 
 ## Version of trudag
 
-The documentation is currently built using trudag version v2025.10.22
+The documentation is currently built using trudag version v2025.10.22, pinned to the corresponding TSF release wheel in CI and in the local devcontainer bootstrap.
 In case of new releases of trudag in the future, it is recommended to carefully review the introduced changes and rigorously test it before merging it into eclipse-score/inc_nlohmann_json.
 The following should be considered:
 

TSF/docs/risk_analysis.rst

@@ -42,6 +42,7 @@ The software under analysis (SUA) is the **header-only C++ JSON library `nlohman
   - provide JSON parsing and validation per **RFC 8259**
 - **Evidence**
   - captured extensively in `WFJ-*`, `TIJ-*`, `NJF-*`, `NPF-*`, and `PJD-*` statements, which are connected in the trustable graph to the expectation `JLEX-02`. See `Trustable Graph (JLEX-02) <https://eclipse-score.github.io/nlohmann_json/main/_images/custom_JLEX-02_graph.svg>`_.
+
     Finding: the trustable graph contains JLEX-01, which is not a S-CORE requirement any more (to be fixed with `Bug #2686 <https://github.com/eclipse-score/score/issues/2686>`_).
 
 1.2 System

TSF/trustable/no-json-faults/NJF-01.md

@@ -33,6 +33,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts the literal name null. 

TSF/trustable/no-json-faults/NJF-02.md

@@ -37,6 +37,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts the literal name true.

TSF/trustable/no-json-faults/NJF-03.md

@@ -33,6 +33,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts the literal name false.

TSF/trustable/no-json-faults/NJF-04.md

@@ -49,6 +49,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 0.95
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library does not accept any other literal name.

TSF/trustable/no-json-faults/NJF-05.1.md

@@ -34,6 +34,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts the empty array.

TSF/trustable/no-json-faults/NJF-05.2.md

@@ -39,6 +39,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.95
     Erikhu1: 0.85
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library accepts the non-empty arrays.

TSF/trustable/no-json-faults/NJF-05.3.md

@@ -35,6 +35,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 If every value candidate of a properly bounded array is accepted as singleton, then the service provided by the nlohmann/json library accepts the array.

TSF/trustable/no-json-faults/NJF-05.4.md

@@ -49,6 +49,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does not accept any improperly bounded arrays.

TSF/trustable/no-json-faults/NJF-05.5.md

@@ -26,6 +26,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.9
 ---
 
 The service provided by the nlohmann/json library does not accept arrays with improper values.

TSF/trustable/no-json-faults/NJF-05.6.0.md

@@ -19,6 +19,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.975
     Erikhu1: 0.9
+    ThomasClausnitzer: 0.95
 ---
 
 The acceptance of nested arrays by the service provided by the nlohmann/json library does not depend on the depth of nesting.

TSF/trustable/no-json-faults/NJF-05.6.md

@@ -25,6 +25,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.95
     Erikhu1: 0.95
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library accepts nested arrays.

TSF/trustable/no-json-faults/NJF-05.7.1.md

@@ -31,6 +31,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does accept comma as value separator.

TSF/trustable/no-json-faults/NJF-05.7.2.md

@@ -19,6 +19,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.9
 ---
 
 The service provided by the nlohmann/json library does not accept any other value separator.

TSF/trustable/no-json-faults/NJF-06.1.md

@@ -24,6 +24,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts the empty object.

TSF/trustable/no-json-faults/NJF-06.2.md

@@ -25,6 +25,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library does not accept improperly bounded objects.

TSF/trustable/no-json-faults/NJF-06.3.md

@@ -20,6 +20,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.95
     Erikhu1: 0.95
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library accepts the non-empty objects.

TSF/trustable/no-json-faults/NJF-06.4.1.md

@@ -47,6 +47,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 If the service provided by the nlohmann/json library recognizes the name candidate as string, then it accepts the name candidate.

TSF/trustable/no-json-faults/NJF-06.4.2.md

@@ -37,6 +37,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does not accept any other token as name.

TSF/trustable/no-json-faults/NJF-06.4.3.md

@@ -38,6 +38,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 If the service provided by the nlohmann/json library accepts the value-candidate as a singleton, then the value-candidate is accepted.

TSF/trustable/no-json-faults/NJF-06.5.1.md

@@ -36,6 +36,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.95
 ---
 
 If the service provided by the nlohmann/json library does not accept any name candidate as singleton, then the service does not accept the object candidate.

TSF/trustable/no-json-faults/NJF-06.5.2.md

@@ -24,6 +24,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.95
 ---
 
 If the service provided by the nlohmann/json library does not accept any value candidate as singleton, then the service does not accept the object candidate.

TSF/trustable/no-json-faults/NJF-06.6.0.md

@@ -27,6 +27,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.975
     Erikhu1: 0.95
+    ThomasClausnitzer: 0.85
 ---
 
 The acceptance of nested objects inside the nlohmann/json library does not depend on the depth of nesting.

TSF/trustable/no-json-faults/NJF-06.6.md

@@ -27,6 +27,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 0.95
     Erikhu1: 0.95
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library accepts the nested objects.

TSF/trustable/no-json-faults/NJF-06.7.1.md

@@ -32,6 +32,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts comma as member separator.

TSF/trustable/no-json-faults/NJF-06.7.2.md

@@ -37,6 +37,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 0.95
 ---
 
 The service provided by the nlohmann/json library does not accept any other member separator.

TSF/trustable/no-json-faults/NJF-07.1.md

@@ -22,6 +22,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does accept empty strings.

TSF/trustable/no-json-faults/NJF-07.2.md

@@ -31,6 +31,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does not accept the improperly bounded strings.

TSF/trustable/no-json-faults/NJF-07.3.md

@@ -18,6 +18,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does not accept unescaped control characters.

TSF/trustable/no-json-faults/NJF-07.4.md

@@ -43,6 +43,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library does accept escaped control characters.

TSF/trustable/no-json-faults/NJF-07.5.md

@@ -30,6 +30,7 @@ evidence:
 score:
     Jonas-Kirchhoff: 1.0
     Erikhu1: 1.0
+    ThomasClausnitzer: 1.0
 ---
 
 The service provided by the nlohmann/json library accepts UTF-16 surrogate pairs.