-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ensure that components not in datastream are not mentioned by profiles #11811
Ensure that components not in datastream are not mentioned by profiles #11811
Conversation
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
ssg/entities/profile_base.py
Outdated
def remove_components_not_included(self, components_to_not_include): | ||
rules_to_not_include = components_to_not_include.get("rules", set()) | ||
groups_to_not_include = components_to_not_include.get("groups", set()) | ||
self.selected = list(set(self.selected) - rules_to_not_include) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have a small ask. Before this change the selects in the Profile element in the built XML were sorted nicely. Now they are random, probably due to usage of sets here. I admit we're not testing it and it isn't the case for all elements. But, having the items sorted and ordered deterministically helps us when manual reviewing 2 different data streams. So it would be nice if this is preserved. You can either re-sort it here in this method or you can find a better place, I'm guessing sorting the items in the _add_selects
method could also work.
this function takes the data structure containing components which were for some reason excluded from the datastream. The function ensures that data structures of the Profile class do not include those components (rules, groups).
…y unwanted components
b628302
to
f15097e
Compare
@jan-cerny good catch, I implemented sorting. |
Code Climate has analyzed commit f15097e and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 20.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.2% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have run SCAPVAL on RHEL 8 and RHEL 9 data streams and the validation passed and the issue is fixed. I have also seen thin data streams and they look fine.
Description:
Rationale:
the mentioned PR removes unused rules / groups from the datastream, but those rules and groups are still selected (or unselected) by profiles. This breaks the SCAP standard and it produces invalid datastream.
Fixes Content is not SCAP valid #11810
Review Hints: