deps(go-oscal): upgrade to v0.3.0

go.mod

@@ -3,7 +3,7 @@ module github.com/defenseunicorns/lula
 go 1.22.1
 
 require (
-	github.com/defenseunicorns/go-oscal v0.2.5
+	github.com/defenseunicorns/go-oscal v0.3.0
 	github.com/hashicorp/go-version v1.6.0
 	github.com/kyverno/kyverno-json v0.0.3-alpha.2
 	github.com/open-policy-agent/opa v0.61.0

go.sum

@@ -77,8 +77,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/daviddengcn/go-colortext v1.0.0 h1:ANqDyC0ys6qCSvuEK7l3g5RaehL/Xck9EX8ATG8oKsE=
 github.com/daviddengcn/go-colortext v1.0.0/go.mod h1:zDqEI5NVUop5QPpVJUxE9UO10hRnmkD5G4Pmri9+m4c=
-github.com/defenseunicorns/go-oscal v0.2.5 h1:r8A2sXz/VTjVIf4Er/WyDSTyqUteek5AHeKEAT2XzTU=
-github.com/defenseunicorns/go-oscal v0.2.5/go.mod h1:4JXNIFmWK1VBHpmXicW/g65MizUEHKUexy3Lb2lH2/I=
+github.com/defenseunicorns/go-oscal v0.3.0 h1:DxkbVSqetXFZku+bi53pHQaE1+iLgHw0R3PMeIwb4Mw=
+github.com/defenseunicorns/go-oscal v0.3.0/go.mod h1:4JXNIFmWK1VBHpmXicW/g65MizUEHKUexy3Lb2lH2/I=
 github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
 github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
 github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=

src/cmd/evaluate/evaluate.go

@@ -128,8 +128,12 @@ func EvaluateResults(thresholdResult oscalTypes_1_1_2.Result, newResult oscalTyp
 	findings := make(map[string][]oscalTypes_1_1_2.Finding, 0)
 	result := true
 
-	findingMapThreshold := oscal.GenerateFindingsMap(thresholdResult.Findings)
-	findingMapNew := oscal.GenerateFindingsMap(newResult.Findings)
+	if thresholdResult.Findings == nil || newResult.Findings == nil {
+		return false, nil, fmt.Errorf("Results must contain findings to evaluate")
+	}
+
+	findingMapThreshold := oscal.GenerateFindingsMap(*thresholdResult.Findings)
+	findingMapNew := oscal.GenerateFindingsMap(*newResult.Findings)
 
 	// For a given oldResult - we need to prove that the newResult implements all of the oldResult findings/controls
 	// We are explicitly iterating through the findings in order to collect a delta to display

src/cmd/evaluate/evaluate_test.go

@@ -12,7 +12,7 @@ func TestEvaluateResultsPassing(t *testing.T) {
 	message.NoProgress = true
 
 	mockThresholdResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",
@@ -25,7 +25,7 @@ func TestEvaluateResultsPassing(t *testing.T) {
 	}
 
 	mockEvaluationResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",
@@ -52,7 +52,7 @@ func TestEvaluateResultsPassing(t *testing.T) {
 func TestEvaluateResultsFailed(t *testing.T) {
 	message.NoProgress = true
 	mockThresholdResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",
@@ -65,7 +65,7 @@ func TestEvaluateResultsFailed(t *testing.T) {
 	}
 
 	mockEvaluationResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",
@@ -93,10 +93,55 @@ func TestEvaluateResultsFailed(t *testing.T) {
 
 }
 
+func TestEvaluateResultsNoFindings(t *testing.T) {
+	message.NoProgress = true
+	mockThresholdResult := oscalTypes_1_1_2.Result{
+		Findings: &[]oscalTypes_1_1_2.Finding{},
+	}
+
+	mockEvaluationResult := oscalTypes_1_1_2.Result{
+		Findings: &[]oscalTypes_1_1_2.Finding{},
+	}
+
+	status, _, err := EvaluateResults(mockThresholdResult, mockEvaluationResult)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// If status is false - then something went wrong
+	if !status {
+		t.Fatal("error - evaluation failed")
+	}
+
+}
+
+func TestEvaluateResultsNoThreshold(t *testing.T) {
+	message.NoProgress = true
+	mockThresholdResult := oscalTypes_1_1_2.Result{}
+
+	mockEvaluationResult := oscalTypes_1_1_2.Result{
+		Findings: &[]oscalTypes_1_1_2.Finding{
+			{
+				Target: oscalTypes_1_1_2.FindingTarget{
+					TargetId: "ID-1",
+					Status: oscalTypes_1_1_2.ObjectiveStatus{
+						State: "satisfied",
+					},
+				},
+			},
+		},
+	}
+
+	_, _, err := EvaluateResults(mockThresholdResult, mockEvaluationResult)
+	if err == nil {
+		t.Fatal("error - expected error, got nil")
+	}
+}
+
 func TestEvaluateResultsNewFindings(t *testing.T) {
 	message.NoProgress = true
 	mockThresholdResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",
@@ -109,7 +154,7 @@ func TestEvaluateResultsNewFindings(t *testing.T) {
 	}
 	// Adding two new findings
 	mockEvaluationResult := oscalTypes_1_1_2.Result{
-		Findings: []oscalTypes_1_1_2.Finding{
+		Findings: &[]oscalTypes_1_1_2.Finding{
 			{
 				Target: oscalTypes_1_1_2.FindingTarget{
 					TargetId: "ID-1",

src/cmd/validate/validate.go

@@ -129,7 +129,7 @@ func ValidateOnPath(path string) (findingMap map[string]oscalTypes_1_1_2.Finding
 func ValidateOnCompDef(compDef oscalTypes_1_1_2.ComponentDefinition) (map[string]oscalTypes_1_1_2.Finding, []oscalTypes_1_1_2.Observation, error) {
 
 	// Populate a map[uuid]Validation into the validations
-	validations := oscal.BackMatterToMap(compDef.BackMatter)
+	validations := oscal.BackMatterToMap(*compDef.BackMatter)
 
 	// TODO: Is there a better location for context?
 	ctx := context.Background()
@@ -138,8 +138,18 @@ func ValidateOnCompDef(compDef oscalTypes_1_1_2.ComponentDefinition) (map[string
 	findings := make(map[string]oscalTypes_1_1_2.Finding)
 	observations := make([]oscalTypes_1_1_2.Observation, 0)
 
-	for _, component := range compDef.Components {
-		for _, controlImplementation := range component.ControlImplementations {
+	if *compDef.Components == nil {
+		return findings, observations, fmt.Errorf("no components found in component definition")
+	}
+
+	for _, component := range *compDef.Components {
+		// If there are no control-implementations, skip to the next component
+		controlImplementations := *component.ControlImplementations
+		if controlImplementations == nil {
+			continue
+		}
+
+		for _, controlImplementation := range controlImplementations {
 			rfc3339Time := time.Now()
 			for _, implementedRequirement := range controlImplementation.ImplementedRequirements {
 				spinner := message.NewProgressSpinner("Validating Implemented Requirement - %s", implementedRequirement.UUID)
@@ -163,75 +173,76 @@ func ValidateOnCompDef(compDef oscalTypes_1_1_2.ComponentDefinition) (map[string
 				var pass, fail int
 				// IF the implemented requirement contains a link - check for Lula Validation
 
-				for _, link := range implementedRequirement.Links {
-					var result types.Result
-					var err error
-					// Current identifier is the link text
-					if link.Text == "Lula Validation" {
-						sharedUuid := uuid.NewUUID()
-						observation := oscalTypes_1_1_2.Observation{
-							Collected: rfc3339Time,
-							Methods:   []string{"TEST"},
-							UUID:      sharedUuid,
-						}
-						// Remove the leading '#' from the UUID reference
-						id := strings.Replace(link.Href, "#", "", 1)
-						observation.Description = fmt.Sprintf("[TEST] %s - %s\n", implementedRequirement.ControlId, id)
-						// Check if the link exists in our pre-populated map of validations
-						if val, ok := validations[id]; ok {
-							// If the validation has already been evaluated, use the result from the evaluation - otherwise perform the validation
-							if val.Evaluated {
-								result = val.Result
+				if implementedRequirement.Links != nil {
+					for _, link := range *implementedRequirement.Links {
+						var result types.Result
+						var err error
+						// Current identifier is the link text
+						if link.Text == "Lula Validation" {
+							sharedUuid := uuid.NewUUID()
+							observation := oscalTypes_1_1_2.Observation{
+								Collected: rfc3339Time,
+								Methods:   []string{"TEST"},
+								UUID:      sharedUuid,
+							}
+							// Remove the leading '#' from the UUID reference
+							id := strings.Replace(link.Href, "#", "", 1)
+							observation.Description = fmt.Sprintf("[TEST] %s - %s\n", implementedRequirement.ControlId, id)
+							// Check if the link exists in our pre-populated map of validations
+							if val, ok := validations[id]; ok {
+								// If the validation has already been evaluated, use the result from the evaluation - otherwise perform the validation
+								if val.Evaluated {
+									result = val.Result
+								} else {
+									result, err = ValidateOnTarget(ctx, id, val.Target)
+									if err != nil {
+										return map[string]oscalTypes_1_1_2.Finding{}, []oscalTypes_1_1_2.Observation{}, err
+									}
+									// Store the result in the validation object
+									val.Result = result
+									val.Evaluated = true
+									validations[id] = val
+								}
+							} else {
+								return map[string]oscalTypes_1_1_2.Finding{}, []oscalTypes_1_1_2.Observation{}, fmt.Errorf("Back matter Validation %v not found", id)
+							}
+
+							// Individual result state
+							if result.Passing > 0 && result.Failing <= 0 {
+								result.State = "satisfied"
 							} else {
-								result, err = ValidateOnTarget(ctx, id, val.Target)
-								if err != nil {
-									return map[string]oscalTypes_1_1_2.Finding{}, []oscalTypes_1_1_2.Observation{}, err
+								result.State = "not-satisfied"
+							}
+
+							// Add remarks if Result has Observations
+							var remarks string
+							if len(result.Observations) > 0 {
+								for k, v := range result.Observations {
+									remarks += fmt.Sprintf("%s: %s\n", k, v)
 								}
-								// Store the result in the validation object
-								val.Result = result
-								val.Evaluated = true
-								validations[id] = val
 							}
-						} else {
-							return map[string]oscalTypes_1_1_2.Finding{}, []oscalTypes_1_1_2.Observation{}, fmt.Errorf("Back matter Validation %v not found", id)
-						}
 
-						// Individual result state
-						if result.Passing > 0 && result.Failing <= 0 {
-							result.State = "satisfied"
-						} else {
-							result.State = "not-satisfied"
-						}
+							observation.RelevantEvidence = &[]oscalTypes_1_1_2.RelevantEvidence{
+								{
+									Description: fmt.Sprintf("Result: %s\n", result.State),
+									Remarks:     remarks,
+								},
+							}
 
-						// Add remarks if Result has Observations
-						var remarks string
-						if len(result.Observations) > 0 {
-							for k, v := range result.Observations {
-								remarks += fmt.Sprintf("%s: %s\n", k, v)
+							relatedObservation := oscalTypes_1_1_2.RelatedObservation{
+								ObservationUuid: sharedUuid,
 							}
-						}
 
-						observation.RelevantEvidence = []oscalTypes_1_1_2.RelevantEvidence{
-							{
-								Description: fmt.Sprintf("Result: %s\n", result.State),
-								Remarks:     remarks,
-							},
-						}
+							pass += result.Passing
+							fail += result.Failing
 
-						relatedObservation := oscalTypes_1_1_2.RelatedObservation{
-							ObservationUuid: sharedUuid,
+							// Coalesce slices and objects
+							relatedObservations = append(relatedObservations, relatedObservation)
+							tempObservations = append(tempObservations, observation)
 						}
 
-						pass += result.Passing
-						fail += result.Failing
-
-						// Coalesce slices and objects
-						relatedObservations = append(relatedObservations, relatedObservation)
-						tempObservations = append(tempObservations, observation)
 					}
-
 				}
-
 				// Using language from Assessment Results model for Target Objective Status State
 				var state string
 				if finding.Target.Status.State == "not-satisfied" {
@@ -253,7 +264,7 @@ func ValidateOnCompDef(compDef oscalTypes_1_1_2.ComponentDefinition) (map[string
 					Type:     "objective-id",
 				}
 
-				finding.RelatedObservations = relatedObservations
+				finding.RelatedObservations = &relatedObservations
 
 				findings[implementedRequirement.ControlId] = finding
 				observations = append(observations, tempObservations...)
@@ -336,7 +347,7 @@ func WriteReport(report oscalTypes_1_1_2.AssessmentResults, assessmentFilePath s
 	var b bytes.Buffer
 
 	var sar = oscalTypes_1_1_2.OscalModels{
-		AssessmentResults: tempAssessment,
+		AssessmentResults: &tempAssessment,
 	}
 
 	yamlEncoder := yaml.NewEncoder(&b)

src/pkg/common/oscal/assessment-results.go

@@ -21,7 +21,7 @@ func NewAssessmentResults(data []byte) (oscalTypes_1_1_2.AssessmentResults, erro
 		return oscalTypes_1_1_2.AssessmentResults{}, err
 	}
 
-	return oscalModels.AssessmentResults, nil
+	return *oscalModels.AssessmentResults, nil
 }
 
 func GenerateAssessmentResults(findingMap map[string]oscalTypes_1_1_2.Finding, observations []oscalTypes_1_1_2.Observation) (oscalTypes_1_1_2.AssessmentResults, error) {
@@ -51,7 +51,7 @@ func GenerateAssessmentResults(findingMap map[string]oscalTypes_1_1_2.Finding, o
 		Version:      "0.0.1",
 		OscalVersion: OSCAL_VERSION,
 		Remarks:      "Assessment Results generated from Lula",
-		Published:    rfc3339Time,
+		Published:    &rfc3339Time,
 		LastModified: rfc3339Time,
 	}
 
@@ -68,12 +68,12 @@ func GenerateAssessmentResults(findingMap map[string]oscalTypes_1_1_2.Finding, o
 				ControlSelections: []oscalTypes_1_1_2.AssessedControls{
 					{
 						Description:     "Controls Assessed by Lula",
-						IncludeControls: controlList,
+						IncludeControls: &controlList,
 					},
 				},
 			},
-			Findings:     findings,
-			Observations: observations,
+			Findings:     &findings,
+			Observations: &observations,
 		},
 	}
 

src/pkg/common/oscal/component.go

@@ -13,23 +13,30 @@ import (
 
 // NewOscalComponentDefinition consumes a byte array and returns a new single OscalComponentDefinitionModel object
 // Standard use is to read a file from the filesystem and pass the []byte to this function
-func NewOscalComponentDefinition(data []byte) (oscalTypes_1_1_2.ComponentDefinition, error) {
+func NewOscalComponentDefinition(data []byte) (componentDefinition oscalTypes_1_1_2.ComponentDefinition, err error) {
 	var oscalModels oscalTypes_1_1_2.OscalModels
 
-	err := yaml.Unmarshal(data, &oscalModels)
+	err = yaml.Unmarshal(data, &oscalModels)
 	if err != nil {
-		fmt.Printf("Error marshalling yaml: %s\n", err.Error())
-		return oscalModels.ComponentDefinition, err
+		return componentDefinition, err
 	}
 
-	return oscalModels.ComponentDefinition, nil
+	if oscalModels.ComponentDefinition == nil {
+		return componentDefinition, fmt.Errorf("No Component Definition found in the provided data")
+	}
+
+	return *oscalModels.ComponentDefinition, nil
 }
 
 // Map an array of resources to a map of UUID to validation object
 func BackMatterToMap(backMatter oscalTypes_1_1_2.BackMatter) map[string]types.Validation {
 	resourceMap := make(map[string]types.Validation)
 
-	for _, resource := range backMatter.Resources {
+	if backMatter.Resources == nil {
+		return nil
+	}
+
+	for _, resource := range *backMatter.Resources {
 		if resource.Title == "Lula Validation" {
 			var validation types.Validation