fix(oscal): deterministic OSCAL model write #553

brandtkeller · 2024-07-23T20:40:09Z

Description

This fix implements sorting based on the fields we currently operate within on component-definition and assessment-results to make determinism both an initial write activity as well as a corrective action.

Goal for OSCAL operations is to not assume anyone has always started with Lula - rather allowing for people to bring their OSCAL and enable Lula to provide value without strong opinionation. This is why the execution is centered on the write as opposed to creation of objects. This makes it applicable any time a file is written to - including compose, validate, evaluate, generate.

I see this change as important for those storing resources in version control. The component-definition.md document did not exist - So i've started an initial draft for iteration. we should make this a requirement each time a new model is introduced.

Please check my process - if there are more optimal ways to accomplish this I am all ears/eyes.

Edit: also added a cspell.json file to the repository to start tracking spelling because I apparently cannot spell satisfied

Related Issue

Fixes #542

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Checklist before merging

Test, docs, adr added or updated as needed
Schema Updates applied
Contributor Guide Steps followed

meganwolf0 · 2024-07-24T13:46:49Z

istio-composed.yaml is probably there accidentally, just calling it out

docs/oscal/component-definition.md

src/pkg/common/oscal/component.go

src/pkg/common/oscal/assessment-results.go

src/cmd/tools/compose.go

Co-authored-by: Megan Wolf <97549300+meganwolf0@users.noreply.github.com>

CloudBeard

Changes look good to me. Tested locally with component-definition and assessment-results and get expected results.

Im not aware of a better way to sort.

Since its machine readable I think the main sorting/ordering for the look could be done in reporting/data gathering.

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [defenseunicorns/lula](https://togithub.com/defenseunicorns/lula) | patch | `v0.4.3` -> `v0.4.4` | --- ### Release Notes <details> <summary>defenseunicorns/lula (defenseunicorns/lula)</summary> ### [`v0.4.4`](https://togithub.com/defenseunicorns/lula/releases/tag/v0.4.4) [Compare Source](https://togithub.com/defenseunicorns/lula/compare/v0.4.3...v0.4.4) This release includes new output during `lula evaluate` through the use of the `--summary` flag to better highlight areas of improved, unchanged, or worse compliance-at-a-glance. OSCAL writes for the current models supported are now written in a deterministic format. This alleviates long-lived data from being re-arranged, specifically when stored in version control. Better highlighting the areas of change as you maintain your OSCAL. As always - keeping our dependencies - project or pipeline - up to date is a constant focus of of review. ##### Features - **evaluate:** add observation summary ([#540](https://togithub.com/defenseunicorns/lula/issues/540)) ([8a07833](https://togithub.com/defenseunicorns/lula/commit/8a07833c5a563d8e857515a083137785cade5eb5)) ##### Bug Fixes - **oscal:** deterministic OSCAL model write ([#553](https://togithub.com/defenseunicorns/lula/issues/553)) ([5493df1](https://togithub.com/defenseunicorns/lula/commit/5493df122b803d11542f29cfe80dfa4d5aaa10a8)) ##### Miscellaneous - **deps:** update github/codeql-action action to v3.25.14 ([#557](https://togithub.com/defenseunicorns/lula/issues/557)) ([5bfd94f](https://togithub.com/defenseunicorns/lula/commit/5bfd94febc467e5a455ed32d97ce2e82e20409c2)) - **deps:** update github/codeql-action action to v3.25.15 ([#564](https://togithub.com/defenseunicorns/lula/issues/564)) ([60e128a](https://togithub.com/defenseunicorns/lula/commit/60e128a0a34ce8686c67e22ea2aebb61212b97fc)) - **deps:** update golang to version 1.22.5 ([#562](https://togithub.com/defenseunicorns/lula/issues/562)) ([97ff760](https://togithub.com/defenseunicorns/lula/commit/97ff7602f30f0709bd2ca16b74e53008607c3a61)) - **deps:** update module github.com/open-policy-agent/opa to v0.67.0 ([#561](https://togithub.com/defenseunicorns/lula/issues/561)) ([4378242](https://togithub.com/defenseunicorns/lula/commit/43782420b8b34362d03bcc965e00df2a850715c6)) - **docs:** fix simple demo command for evaluate file ([33fb97c](https://togithub.com/defenseunicorns/lula/commit/33fb97cccc9d4a589da65c03cc433b4f05c79d5d)) - **docs:** updated broken links ([#554](https://togithub.com/defenseunicorns/lula/issues/554)) ([8dd24b0](https://togithub.com/defenseunicorns/lula/commit/8dd24b083c86b12af8740fe788c4222f4c1c8718)) - **docs:** updated README for docs badge ([#558](https://togithub.com/defenseunicorns/lula/issues/558)) ([72fd3fc](https://togithub.com/defenseunicorns/lula/commit/72fd3fc8137477a4f10507481f8464eb5685b781)) #### What's Changed - chore(docs): correcting cli command in simple demo by [@ogijaoh](https://togithub.com/ogijaoh) in [https://github.com/defenseunicorns/lula/pull/549](https://togithub.com/defenseunicorns/lula/pull/549) - docs: updated broken links by [@meganwolf0](https://togithub.com/meganwolf0) in [https://github.com/defenseunicorns/lula/pull/554](https://togithub.com/defenseunicorns/lula/pull/554) - docs: updated README by [@meganwolf0](https://togithub.com/meganwolf0) in [https://github.com/defenseunicorns/lula/pull/558](https://togithub.com/defenseunicorns/lula/pull/558) - chore(deps): update github/codeql-action action to v3.25.14 by [@renovate](https://togithub.com/renovate) in [https://github.com/defenseunicorns/lula/pull/557](https://togithub.com/defenseunicorns/lula/pull/557) - chore(deps): update module github.com/open-policy-agent/opa to v0.67.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/defenseunicorns/lula/pull/561](https://togithub.com/defenseunicorns/lula/pull/561) - chore(deps): update golang to version 1.22.5 by [@brandtkeller](https://togithub.com/brandtkeller) in [https://github.com/defenseunicorns/lula/pull/562](https://togithub.com/defenseunicorns/lula/pull/562) - feat(evaluate): add observation details by [@meganwolf0](https://togithub.com/meganwolf0) in [https://github.com/defenseunicorns/lula/pull/540](https://togithub.com/defenseunicorns/lula/pull/540) - fix(oscal): deterministic OSCAL model write by [@brandtkeller](https://togithub.com/brandtkeller) in [https://github.com/defenseunicorns/lula/pull/553](https://togithub.com/defenseunicorns/lula/pull/553) - chore(deps): update github/codeql-action action to v3.25.15 by [@renovate](https://togithub.com/renovate) in [https://github.com/defenseunicorns/lula/pull/564](https://togithub.com/defenseunicorns/lula/pull/564) - chore(main): release 0.4.4 by [@github-actions](https://togithub.com/github-actions) in [https://github.com/defenseunicorns/lula/pull/546](https://togithub.com/defenseunicorns/lula/pull/546) #### New Contributors - [@ogijaoh](https://togithub.com/ogijaoh) made their first contribution in [https://github.com/defenseunicorns/lula/pull/549](https://togithub.com/defenseunicorns/lula/pull/549) **Full Changelog**: defenseunicorns/lula@v0.4.3...v0.4.4 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/defenseunicorns/uds-core).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

brandtkeller added 6 commits July 23, 2024 04:35

fix(component): initial component deterministic sort

a91a0de

fix(component): testing compose

ffd31a4

fix(component): testing compose with common write function

f04a3a3

fix(results): deterministic sorting of assessment-results

be9d93a

fix(docs): add component definition oscal doc

b3c7396

fix(compose): remove compose write function in favor of common function

a45e714

brandtkeller requested review from mike-winberry, CloudBeard, meganwolf0 and a team as code owners July 23, 2024 20:40

fix(cleanup): remove istio composed test file

f2580ef

brandtkeller marked this pull request as draft July 24, 2024 16:12

brandtkeller and others added 3 commits July 24, 2024 17:53

fix(assessment): add unit test for assessment results determinism

723d9ed

fix(oscal): add unit test for MakeComponentDeterministic

370e228

Merge branch 'main' into 542_deterministic_writes

e15fffa

brandtkeller marked this pull request as ready for review July 24, 2024 22:44

Merge branch 'main' into 542_deterministic_writes

8c0e249

meganwolf0 reviewed Jul 25, 2024

View reviewed changes

brandtkeller and others added 2 commits July 25, 2024 13:27

fix(docs): Update docs/oscal/component-definition.md

4c53680

Co-authored-by: Megan Wolf <97549300+meganwolf0@users.noreply.github.com>

fix(docs): update component definition docs for sort specifics

215ae21

CloudBeard approved these changes Jul 26, 2024

View reviewed changes

meganwolf0 approved these changes Jul 26, 2024

View reviewed changes

Merge branch 'main' into 542_deterministic_writes

5316cb0

brandtkeller merged commit 5493df1 into main Jul 26, 2024
4 checks passed

brandtkeller deleted the 542_deterministic_writes branch July 26, 2024 16:54

This was referenced Jul 26, 2024

chore(main): release 0.4.4 #546

Merged

chore(main): release 0.4.5 #566

Merged

github-actions bot mentioned this pull request Aug 5, 2024

chore(main): release 0.5.0 #578

Merged

This was referenced Aug 9, 2024

chore(main): release 0.5.1 #587

Merged

chore(main): release 0.6.0 #604

Merged

github-actions bot mentioned this pull request Aug 31, 2024

chore(main): release 0.7.0 #637

Merged

github-actions bot mentioned this pull request Sep 13, 2024

chore(main): release 0.8.0 #665

Merged

github-actions bot mentioned this pull request Sep 27, 2024

chore(main): release 0.9.0 #690

Merged

This was referenced Oct 11, 2024

chore(main): release 0.9.1 #734

Merged

chore(main): release 0.10.0 #736

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(oscal): deterministic OSCAL model write #553

fix(oscal): deterministic OSCAL model write #553

brandtkeller commented Jul 23, 2024 •

edited

Loading

meganwolf0 commented Jul 24, 2024

CloudBeard left a comment

fix(oscal): deterministic OSCAL model write #553

fix(oscal): deterministic OSCAL model write #553

Conversation

brandtkeller commented Jul 23, 2024 • edited Loading

Description

Related Issue

Type of change

Checklist before merging

meganwolf0 commented Jul 24, 2024

CloudBeard left a comment

Choose a reason for hiding this comment

brandtkeller commented Jul 23, 2024 •

edited

Loading