Remove Support for OVAL 5.10 #9604

Mab879 · 2022-09-30T17:09:08Z

Description:

This PR removes OVAL 5.10 support from the project.

Rationale:

Implements #9451

Since we no longer build OVAL 5.10 we will not pass SCAP 1.2.

github-actions · 2022-09-30T17:10:02Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

...x_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/oval/shared.xml

matejak · 2022-10-03T09:24:43Z

It looks like that the datastream diff failed in this PR - there was a change in the OVAL. Any ideas what happened?

matejak · 2022-10-03T14:48:43Z

The systemd-related test will fail in Automatus, because the container environment doesn't work well with this systemd-related rule.

matejak · 2022-10-03T15:00:01Z

One more thing - the build_product script offers the possibility to select the OVAL version - either the 5.10 should be removed, or the whole option could be removed.

ggbecker · 2022-10-05T07:17:24Z

What about these occurrences of 5.10 in the project? Do we need to remove them?

linux_os/guide/services/obsolete/r_services/no_host_based_files/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/services/obsolete/r_services/no_user_host_based_files/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_antivirus_definitions_updated/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/rhcos4.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/integrity/fips/etc_system_fips_exists/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/updating/clean_components_post_updating/oval/shared.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/updating/clean_components_post_updating/oval/sle12.xml:
  1: <def-group oval_version="5.10">

linux_os/guide/system/software/updating/clean_components_post_updating/oval/sle15.xml:
  1: <def-group oval_version="5.10">

Similarly for "5.11", do we need to explicitly state the oval_version attribute?

Mab879 · 2022-10-05T15:58:54Z

What about these occurrences of 5.10 in the project? Do we need to remove them?

It might be a good idea and I will remove those references.

Similarly for "5.11", do we need to explicitly state the oval_version attribute?

The build system will automatically add it.

jan-cerny · 2022-10-06T12:42:11Z

CMakeLists.txt

@@ -145,11 +145,12 @@ cmake_dependent_option(ENABLE_PYTHON_COVERAGE "Enable Python tests with coverage
 find_package(OpenSCAP REQUIRED)

 if (SSG_TARGET_OVAL_MAJOR_VERSION EQUAL "5" AND SSG_TARGET_OVAL_VERSION_MINOR EQUAL "11" AND NOT "${OSCAP_V_OUTPUT}" MATCHES "OVAL Version: 5.11")
-    message(FATAL_ERROR "Your version of OpenSCAP does not support OVAL 5.11, please switch the OVAL target version to 5.10 or lower. $ cmake -DSSG_TARGET_OVAL_MINOR_VERSION=10 ../")
+    message(FATAL_ERROR "Your version of OpenSCAP does not support OVAL 5.11, please upgrade to a newer version of OpenSCAP.")


Maybe we can go even further and remove this check, because the "OVAL Version: 5.11" has been introduced in OpenSCAP 1.2.2 so the error happens on RHEL 7.1 and older and I don't think anybody uses these old systems for content development.

It seems reasonable to me. Some basic research shows that OpenSCAP 1.2.2+ is in Fedora, RHEL, Ubuntu, Debian, and OpenSUSE.

jan-cerny · 2022-10-06T13:09:20Z

build_product

@@ -85,7 +85,7 @@ print_help()
 	printf '%s\n' "Wipes out contents of the 'build' directory and builds only and only the given products."
 	printf 'Usage: %s [-o|--oval <VERSION>] [-b|--builder <BUILDER>] [-j|--jobs <arg>] [--(no-)debug] [--(no-)derivatives] [--(no-)ansible-playbooks] [--(no-)bash-scripts] [-d|--(no-)datastream-only] [-p|--(no-)profiling] [-h|--help] [<product-1>] ... [<product-n>] ...\n' "$0"
 	printf '\t%s\n' "<product>: Products to build, ALL means all products (defaults for <product>: 'ALL')"
-	printf '\t%s\n' "-o, --oval: OVAL version. Can be one of: '5.10', '5.11' and 'auto' (default: 'auto')"
+	printf '\t%s\n' "-o, --oval: OVAL version. Can be one of: '5.11' or 'auto' (default: 'auto')"


Does it make sense to keep the option here when it basically has no effect?

Main reason I kept was for backword compability you still set 5.11 if you want to. If we don't see this as a valid reason and don't see OVAL 5.12 coming out, we may want to remove this.

codeclimate · 2022-10-06T19:46:57Z

Code Climate has analyzed commit b165f2d and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 0.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 40.8% (0.0% change).

View more on Code Climate.

openshift-ci · 2022-10-06T21:13:37Z

@Mab879: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-high	`b165f2d`	link	true	`/test e2e-aws-rhcos4-high`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

matejak

LGTM, and it seems to work, good riddance.

Coverage difference can be disregarded, as there are minor changes to files that don't have test coverage.

Mab879 added 4 commits September 30, 2022 11:01

Remove OVAL 5.10 from GH Actions

9f4d405

Remove SCAPVAL 1.2 from stablization

3b0d0b6

Since we no longer build OVAL 5.10 we will not pass SCAP 1.2.

Remove OVAL 5.10 from the build system

051ed18

Remove if statements around OVAL 5.10

cf72228

Mab879 added Infrastructure Our content build system Highlight This PR/Issue should make it to the featured changelog. labels Sep 30, 2022

Mab879 added this to the 0.1.65 milestone Sep 30, 2022

matejak reviewed Oct 3, 2022

View reviewed changes

...x_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/oval/shared.xml Show resolved Hide resolved

matejak self-assigned this Oct 3, 2022

Fix backend_krb5_config in configure_kerberos_crypto_policy

4f5ddc7

Fix more OVAL 5.10 references

d95b1bf

Remove 5.10 oval_version attributes

b58a742

jan-cerny reviewed Oct 6, 2022

View reviewed changes

Remove check for OpenSCAP OVAL version as that is no longer needed

b165f2d

jan-cerny requested a review from matejak October 7, 2022 12:18

matejak approved these changes Oct 11, 2022

View reviewed changes

matejak merged commit 7f96de4 into ComplianceAsCode:master Oct 11, 2022

Mab879 deleted the remove_oval_5_10 branch October 11, 2022 14:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove Support for OVAL 5.10 #9604

Remove Support for OVAL 5.10 #9604

Mab879 commented Sep 30, 2022

github-actions bot commented Sep 30, 2022

matejak commented Oct 3, 2022

matejak commented Oct 3, 2022

matejak commented Oct 3, 2022

ggbecker commented Oct 5, 2022 •

edited

Mab879 commented Oct 5, 2022

jan-cerny Oct 6, 2022

Mab879 Oct 6, 2022

jan-cerny Oct 6, 2022

Mab879 Oct 6, 2022

jan-cerny Oct 7, 2022

codeclimate bot commented Oct 6, 2022

openshift-ci bot commented Oct 6, 2022 •

edited

matejak left a comment •

edited

Remove Support for OVAL 5.10 #9604

Remove Support for OVAL 5.10 #9604

Conversation

Mab879 commented Sep 30, 2022

Description:

Rationale:

github-actions bot commented Sep 30, 2022

matejak commented Oct 3, 2022

matejak commented Oct 3, 2022

matejak commented Oct 3, 2022

ggbecker commented Oct 5, 2022 • edited

Mab879 commented Oct 5, 2022

jan-cerny Oct 6, 2022

Choose a reason for hiding this comment

Mab879 Oct 6, 2022

Choose a reason for hiding this comment

jan-cerny Oct 6, 2022

Choose a reason for hiding this comment

Mab879 Oct 6, 2022

Choose a reason for hiding this comment

jan-cerny Oct 7, 2022

Choose a reason for hiding this comment

codeclimate bot commented Oct 6, 2022

openshift-ci bot commented Oct 6, 2022 • edited

matejak left a comment • edited

Choose a reason for hiding this comment

ggbecker commented Oct 5, 2022 •

edited

openshift-ci bot commented Oct 6, 2022 •

edited

matejak left a comment •

edited