Fix Rule CPE Name inheritance

[yuumasato]

Description:

• Conversion of platforms to cpe_name was not done when a rule inherited a platform from a parent group.

Rationale:

• This fixes applicability of rules inheriting it from the parent group, most notably machine.
• Fixes RHEL7 - rules that are not applicable to containers are evaluated in container scan #6938

[openscap-ci]

Changes identified:
Others:
 Changes in Python files.

Show details

Others:
 Python abstract syntax tree change found in ssg/build_yaml.py.
 Python abstract syntax tree change found in tests/test_machine_only_rules.py.

Recommended tests to execute:
 (cd build && cmake ../ && ctest -j4)

[JAORMX]

/retest

[JAORMX]

I'd really like to see e2e-aws-ocp4-cis-node passing, we do use an overridden platform in that scenario (ocp4-master), so it's relevant to this change IMO.

[mildas]

Rerun of the test that found #6938 passed on this change. Looks good to me.

[jan-cerny]

It would be amazing to have a test for this.

[yuumasato]

@jan-cerny @vojtapolasek Do you have suggestions how to test this "implicit inheritance"?

(A) I would write a test that checks if a specific rule whose parent group.yml has CPE machine gets built with a platform cpe:/a:machine. But the rule applicability could change and the test start to fail.

(B) Ideally, we need a test content tree to build and include into a test product so that we a have stable test from content tree to DS, but that seem too much work for this PR.

I think it would be good to have this test content tree, and actually a lot of tests could be built on top of that.
But I'd go for the approach (A). Given that the implicit inheritance may go away after #6772 is unblocked and the PCI-DSS benchmark generation is fixed with "squashed" platforms (with use of Applicability Language)
Thoughts?

[vojtapolasek]

I think the proposal A is good for this case. This state should be only temporary anyway. How about checking the datastream like this:
if group has some platform specified:
for all rules within this group:
check if the rule contains the same platform

I am not sure what you mean by "But the rule applicability could change and the test start to fail.".

[pep8speaks]

Hello @yuumasato! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! 🍻

Comment last updated at 2021-05-05 10:26:29 UTC

[yuumasato]

/retest

[yuumasato]

@vojtapolasek Enhanced the test per feedback. Now it goes through all available data streams and prints every error it finds.

[vojtapolasek]

/retest