Ensure that components not in datastream are not mentioned by profiles #11811
Conversation
vojtapolasek
added
bugfix
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
vojtapolasek
changed the title
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
ssg/entities/profile_base.py
Outdated
| def remove_components_not_included(self, components_to_not_include): | ||
| rules_to_not_include = components_to_not_include.get("rules", set()) | ||
| groups_to_not_include = components_to_not_include.get("groups", set()) | ||
| self.selected = list(set(self.selected) - rules_to_not_include) |
There was a problem hiding this comment.
I have a small ask. Before this change the selects in the Profile element in the built XML were sorted nicely. Now they are random, probably due to usage of sets here. I admit we're not testing it and it isn't the case for all elements. But, having the items sorted and ordered deterministically helps us when manual reviewing 2 different data streams. So it would be nice if this is preserved. You can either re-sort it here in this method or you can find a better place, I'm guessing sorting the items in the _add_selects method could also work.
this function takes the data structure containing components which were for some reason excluded from the datastream. The function ensures that data structures of the Profile class do not include those components (rules, groups).
…y unwanted components
vojtapolasek
force-pushed
the
fix_building_profiles_with_excluded_rules_groups
branch
from
b628302
to
f15097e
Compare
|
@jan-cerny good catch, I implemented sorting. |
|
Code Climate has analyzed commit f15097e and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 20.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.2% (0.0% change). View more on Code Climate. |
Description:
Rationale:
the mentioned PR removes unused rules / groups from the datastream, but those rules and groups are still selected (or unselected) by profiles. This breaks the SCAP standard and it produces invalid datastream.
Fixes Content is not SCAP valid #11810
Review Hints: