Skip to content

Commit 7cd6933

Browse files
benrulandbenruland
authored
Merge branch 'ComplianceAsCode:master' into bsi-app-4.4
2 parents d561197 + efb6e59 commit 7cd6933

361 files changed

Lines changed: 399256 additions & 1548 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/gate.yaml‎

Lines changed: 3 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,14 @@ jobs:
3535
- name: Update CA certificates
3636
run: update-ca-certificates
3737
- name: Zypper add factory repo - to install bats and ShellCheck
38-
run: zypper --non-interactive ar https://download.opensuse.org/repositories/openSUSE:/Backports:/SLE-15-SP5/standard/openSUSE:Backports:SLE-15-SP5.repo
38+
run: zypper --non-interactive ar https://download.opensuse.org/repositories/openSUSE:/Backports:/SLE-15-SP5/standard/openSUSE:Backports:SLE-15-SP5.repo
3939
- name: Zypper auto import keys
4040
run: zypper --gpg-auto-import-keys --non-interactive ref
4141
- name: Zypper refs
4242
run: zypper refs
4343
- name: Zypper refresh
44-
run: zypper refresh
45-
- name: Install Deps
44+
run: zypper refresh
45+
- name: Install Deps
4646
run: zypper install -y git cmake make bats openscap-utils python3 python3-rpm python3-pip python3-devel python3-PyYAML python3-Jinja2 python3-setuptools libxslt-tools libxml2-tools ShellCheck
4747
- name: Upgrade pip python
4848
run: pip install pip --upgrade
@@ -135,52 +135,6 @@ jobs:
135135
run: ctest -j2 --output-on-failure -E unique-stigids
136136
working-directory: ./build
137137

138-
validate-fedora:
139-
name: Build, Test on Fedora Latest (Container)
140-
runs-on: ubuntu-latest
141-
container:
142-
image: fedora:latest
143-
steps:
144-
- name: Install Deps
145-
run: dnf install -y cmake make openscap-utils python3-pyyaml bats ansible python3-pip ShellCheck git gcc gcc-c++ python3-devel
146-
- name: Checkout
147-
uses: actions/checkout@v4
148-
- name: Install deps python
149-
run: pip install pcre2 -r requirements.txt -r test-requirements.txt
150-
- name: Build
151-
run: |-
152-
./build_product \
153-
alinux2 \
154-
alinux3 \
155-
anolis23 \
156-
anolis8 \
157-
chromium \
158-
fedora \
159-
firefox \
160-
rhcos4 \
161-
rhel7 \
162-
rhel8 \
163-
rhel9 \
164-
uos20 \
165-
ocp4 \
166-
eks
167-
env:
168-
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED=ON -DSSG_OVAL_SCHEMATRON_VALIDATION_ENABLED=OFF"
169-
- name: Test
170-
run: ctest -j2 --output-on-failure -E unique-stigids
171-
working-directory: ./build
172-
- name: "Set git safe directory, ref: https://github.com/actions/checkout/issues/760"
173-
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
174-
- name: Upload coverage to Code Climate # Requires: git package
175-
if: ${{ github.repository == 'ComplianceAsCode/content' }}
176-
uses: paambaati/codeclimate-action@v5.0.0
177-
env:
178-
CC_TEST_REPORTER_ID: e67e068471d32b63f8e9561dba8f6a3f84dcc76b05ebfd98e44ced1a91cff854
179-
with:
180-
coverageLocations: build/tests/coverage.xml:coverage.py
181-
- name: Validate gitmailmap
182-
run: grep -E "\S" .mailmap | grep -Ev '^#' | git check-mailmap --stdin
183-
184138
validate-fedora-rawhide:
185139
name: Build, Test on Fedora Rawhide (Container)
186140
runs-on: ubuntu-latest

‎.github/workflows/gate_fedora.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Gate
2+
on:
3+
merge_group:
4+
branches: [ 'master' ]
5+
push:
6+
branches: ['*', '!stabilization*', '!stable*', 'master' ]
7+
pull_request:
8+
branches: [ 'master', 'stabilization*' ]
9+
jobs:
10+
validate-fedora:
11+
name: Build, Test on Fedora Latest (Container)
12+
runs-on: ubuntu-latest
13+
container:
14+
image: fedora:latest
15+
steps:
16+
- name: Install Deps
17+
run: dnf install -y cmake make openscap-utils python3-pyyaml bats ansible python3-pip ShellCheck git gcc gcc-c++ python3-devel
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
- name: Install deps python
21+
run: pip install pcre2 -r requirements.txt -r test-requirements.txt
22+
- name: Build
23+
run: |-
24+
./build_product \
25+
alinux2 \
26+
alinux3 \
27+
anolis23 \
28+
anolis8 \
29+
chromium \
30+
fedora \
31+
firefox \
32+
rhcos4 \
33+
rhel7 \
34+
rhel8 \
35+
rhel9 \
36+
uos20 \
37+
ocp4 \
38+
eks
39+
env:
40+
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED=ON -DSSG_OVAL_SCHEMATRON_VALIDATION_ENABLED=OFF"
41+
- name: Test
42+
run: ctest -j2 --output-on-failure -E unique-stigids
43+
working-directory: ./build
44+
- name: "Set git safe directory, ref: https://github.com/actions/checkout/issues/760"
45+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
46+
- name: Upload coverage to Code Climate # Requires: git package
47+
if: ${{ github.repository == 'ComplianceAsCode/content' }}
48+
uses: paambaati/codeclimate-action@v5.0.0
49+
env:
50+
CC_TEST_REPORTER_ID: e67e068471d32b63f8e9561dba8f6a3f84dcc76b05ebfd98e44ced1a91cff854
51+
with:
52+
coverageLocations: build/tests/coverage.xml:coverage.py
53+
- name: Validate gitmailmap
54+
run: grep -E "\S" .mailmap | grep -Ev '^#' | git check-mailmap --stdin

‎.github/workflows/k8s-content.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ jobs:
1414
uses: metal-toolbox/container-push/.github/workflows/container-push.yml@main
1515
with:
1616
name: k8scontent
17-
tag: latest
17+
tag: ${GITHUB_SHA}
18+
latest: true
1819
registry_org: complianceascode
1920
dockerfile_path: ./Dockerfiles/ocp4_content
2021
licenses: BSD

‎.github/workflows/update-oscal.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Update vendored OSCAL content
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Run weekly at 05:00 on Sunday
7+
- cron: "0 5 * * 0"
8+
9+
jobs:
10+
update-oscal:
11+
name: Update content
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write
15+
pull-requests: write
16+
strategy:
17+
matrix:
18+
variables:
19+
- catalog-source: "https://raw.githubusercontent.com/usnistgov/oscal-content/690f517daaf3a6cbb4056d3cde6eae2756765620/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json"
20+
profile-source: "https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/json/FedRAMP_rev5_HIGH-baseline_profile.json"
21+
profile-name: "fedramp_rev5_high"
22+
catalog-name: "nist_rev5_800_53"
23+
- catalog-source: "https://raw.githubusercontent.com/usnistgov/oscal-content/690f517daaf3a6cbb4056d3cde6eae2756765620/nist.gov/SP800-53/rev4/json/NIST_SP-800-53_rev4_catalog.json"
24+
profile-source: "https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev4/baselines/json/FedRAMP_rev4_HIGH-baseline_profile.json"
25+
profile-name: "fedramp_rev4_high"
26+
catalog-name: "nist_rev4_800_53"
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
- name: Install Python
31+
uses: actions/setup-python@v5
32+
with:
33+
python-version: '3.9'
34+
- name: Install python deps
35+
run: pip3 install requests compliance-trestle==2.4.0
36+
- name: Update catalogs
37+
run: |
38+
rm -rf "catalogs/${{ matrix.variables.catalog-name }}"
39+
trestle import -f "${{ matrix.variables.catalog-source }}" -o "${{ matrix.variables.catalog-name }}"
40+
working-directory: ./shared/references/oscal
41+
- name: Update profiles
42+
run: |
43+
rm -rf "profiles/${{ matrix.variables.profile-name }}"
44+
trestle import -f "${{ matrix.variables.profile-source }}" -o "${{ matrix.variables.profile-name }}"
45+
trestle href --name "${{ matrix.variables.profile-name }}" -hr "trestle://catalogs/${{ matrix.variables.catalog-name }}/catalog.json"
46+
working-directory: ./shared/references/oscal
47+
- name: Update content
48+
uses: peter-evans/create-pull-request@v5.0.2
49+
with:
50+
base: master
51+
branch: "oscal-update-${{ github.run_id }}"
52+
delete-branch: true
53+
commit-message: "Update OSCAL content in shared/references/oscal"
54+
title: "Update upstream OSCAL content from usnistogv and GSA"
55+
body: |
56+
Updates upstream OSCAL content
57+
- usnistgov NIST 800-53 from "${{ matrix.variables.catalog-source }}"
58+
- GSA FedRAMP OSCAL profiles from "${{ matrix.variables.profile-source }}"
59+
60+
Auto-generated by the [update-oscal](https://github.com/ComplianceAsCode/content/blob/master/.github/workflows/update-oscal.yml) workflow.
61+
add-paths: |
62+
shared/references/oscal/

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,6 @@ ocp4/profiles/test.profile
7979
# Ignore coverage files
8080
.coverage
8181
coverage.xml
82+
83+
# Trestle specfic
84+
shared/references/oscal/.trestle/cache

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,11 @@ The PR ...
6969
* ... passes PR gating tests, or failing tests are waived in a comment by the reviewer explaining the reasoning.
7070
* ... adheres to the [coding style](docs/manual/developer/04_style_guide.md#complianceascode-style-guide).
7171
* ... has been tested. The following options allow for testing various aspects of the project:
72-
* [SSG Test Suite](tests/README.md) for rule tests to ensure that OVAL checks are correct and test the ability of remediations to satisfy those checks.
72+
* [Automatus](tests/README.md) for rule tests to ensure that OVAL checks are correct and test the ability of remediations to satisfy those checks.
7373
Every testable rule that is newly created or that just got modified has to have at least one test scenario.
7474
If a PR interacts with a testable rule without tests, the author shall supply a test scenario as part of the PR to get it merged.
7575
* [BATS framework](tests/unit/bash) for bash tests that allows for fast and exhaustive testing of remediations that are parametrized by Jinja2.
76-
* [Unit tests](tests/unit) that test components of the build system as well as components of the SSG Test Suite.
76+
* [Unit tests](tests/unit) that test components of the build system as well as components of the Automatus.
7777
* Ad-hoc tests that are integrated into the `ctest` chain directly, i.e. the shellcheck test.
7878
* ... updates READMEs, man pages or other documentation when changes of described behavior are introduced.
7979
* ... doesn't contain merge commits - those can be removed by rebasing.

‎Dockerfiles/test_suite-sle15‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ARG ADDITIONAL_PACKAGES
77

88
RUN true \
99
&& zypper --non-interactive in openssh-clients openssh-server openscap-utils \
10-
python3 python3-rpm tar \
10+
python3 python3-rpm tar gawk\
1111
$ADDITIONAL_PACKAGES \
1212
&& true
1313

‎applications/openshift/master/file_groupowner_openvswitch/rule.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ severity: medium
2020
references:
2121
cis@ocp4: 1.1.10
2222

23-
platform: ocp4-node-on-sdn or ocp4-node-on-ovn
24-
2523
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/openvswitch/.*", group="root") }}}'
2624

2725
ocil: |-

‎applications/openshift/master/file_groupowner_ovs_conf_db/rule.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ documentation_complete: true
22

33
prodtype: ocp4
44

5+
platform: ocp4-node
6+
57
title: 'Verify Group Who Owns The Open vSwitch Configuration Database'
68

79
description: |-
@@ -26,8 +28,6 @@ references:
2628
nist: CM-6,CM-6(1)
2729
srg: SRG-APP-000516-CTR-001325
2830

29-
platform: ocp4-node-on-sdn or ocp4-node-on-ovn
30-
3131
ocil_clause: |-
3232
<code>/etc/openvswitch/conf.db</code> does not have a group owner of
3333
code>hugetlbfs</code> on architectures other than s390x or <code>openvswitch</code>

‎applications/openshift/master/file_groupowner_ovs_conf_db/tests/ocp4/e2e.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
default_result: NOT-APPLICABLE
2+
default_result: PASS

0 commit comments

Comments
 (0)