Skip to content

v1.10.2 — ODP tooling, artifact lifecycle & CSP hardening

Choose a tag to compare

View all tags
@clem-field clem-field released this 11 Jul 18:46
v1.10.2
This tag was signed with the committer’s verified signature.
clem-field
GPG key ID: 6BAB1F98BE4CFE69
Verified
Learn about vigilant mode.
4302718
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SPARC v1.10.2

Feature + hardening release on top of v1.10.1.

Added

  • Bulk ODP file import for baselines/profiles — upload Organization-Defined Parameter values as JSON / YAML / XML and preview a non-destructive diff (changed / unchanged / unknown / invalid) before applying. API-first: POST /api/v1/profile_documents/:id/parameters/import/{preview,confirm}.
  • Artifact review-cadence API — version-history timeline (/versions) and freshness (/freshness: last-reviewed, next-due, overdue) endpoints to drive ODP validation and continuous-monitoring workflows.
  • Document parse-failure notifications — the uploading user is emailed when a document parse fails or is reaped as stalled. Opt-in; sends only when SMTP is configured (SPARC_ENABLE_SMTP).
  • Opt-in copy-per-version artifact retention (SPARC_ARTIFACT_COPY_PER_VERSION) — each evidence version can hold an independent physical copy of its content, the foundation for per-version WORM / S3 Object Lock. Reference-based retention (no duplication) remains the default.
  • Artifact storage-hygiene reaper — a scheduled, report-only sweep for orphaned storage blobs and dangling OSCAL back-matter references. Destructive cleanup is gated behind SPARC_ARTIFACT_REAPER_PURGE.

Changed / Security

  • Content-Security-Policy hardening — all remaining inline <script> blocks were refactored to Stimulus controllers, eliminating CSP violations during Turbo (client-side) navigation. A permanent Playwright regression guard exercises real Turbo nav.
  • Completed per-endpoint API documentation and greened the API inventory gate.
  • Refreshed the continuous CVE-disposition review cadence.
  • Publish-gate and review-workflow behavior covered by additional Playwright + request specs.

Fixed

  • Evidence deletion no longer errors when attestations are present (artifact-version teardown guard).
  • Status-badge color contrast (accessibility).

Multi-arch (amd64/arm64) container images are published to Docker Hub + ECR and signed with cosign (keyless). Verify:

cosign verify <image> \
  --certificate-identity-regexp 'https://github.com/risk-sentinel/sparc/.github/workflows/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading