Fedramp profiles

[brian-ruf]

Committer Notes

The id flag at the root now includes a prepended 'uuid-' to all UUIDs for alignment with recently revised OSCAL syntax.

Also modified JSON profiles so that they point to JSON catalogs instead of XML catalogs.

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Do all automated CI/CD checks pass?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you included examples of how to use your new feature(s)?
• Have you updated all OSCAL website and readme documentation affected by the changes you made? Changes to the OSCAL website can be made in the docs/content directory of your branch.

[david-waltermire]

You have conflicts on your changes. To avoid these make sure to rebase against the latest from master.

The following should fix this:

git pull -r upstream master

[david-waltermire]

@brianrufgsa I get what you are trying to fix by adding the JSON variants in by hand; it ensures that they point to the JSON variant of the catalog. The downside of this is that the JSON variants will need to be hand converted when the XML is updated or vice versa. I am not a fan of this as it will create more maintenance work and will be prone to cases where they get out of sync.

A better solution is to add a process that maps the URL references automatically on conversion. I have some ideas on how to do this. Let's talk about a way forward that leverages the CI/CD over a manual solution.

[brian-ruf]

@david-waltermire-nist I now have a batch file that both converts all my XML files to JSON, and automatically updates the XML references to JSON references in the JSON profiles at the same time.

I'd love to have that built into the CI/CD pipeline and/or conversion, but need a solution now for those that are already trying to work with the files.

[david-waltermire]

@david-waltermire-nist I now have a batch file that both converts all my XML files to JSON, and automatically updates the XML references to JSON references in the JSON profiles at the same time.

I'd love to have that built into the CI/CD pipeline and/or conversion, but need a solution now for those that are already trying to work with the files.

@brianrufgsa I would need to port your batch file to work in bash for the CI/CD. Can you post your batch file?

[david-waltermire]

This discussion relates to issue #623.

[brian-ruf]

@david-waltermire-nist below is the batch file.
It calls a visual basic script (via windows scripting host) to perform the search and replace in the JSON profiles. I suspect that would need to be replaced with a Linux equivalent for CI/CD processing.

@echo off
set xml_loc="../xml"
set json_loc="../json"
set conv_loc=https://raw.githubusercontent.com/usnistgov/OSCAL/master/json/convert/
REM set conv_loc=C:\path\to\alt\converter\location
echo XML to JSON

IF NOT EXIST %json_loc% (
echo Creating JSON folder
mkdir %json_loc%
)

REM cd ../baselines/xml
for %%f in (%xml_loc%/*profile.xml) do (
echo Converting %%~nf
java -jar saxon9he.jar -s:"%xml_loc%/%%f" -o:"%json_loc%\%%~nf.json" -xsl:"%conv_loc%oscal_profile_xml-to-json-converter.xsl" json-indent=yes 
)

for %%f in (%xml_loc%/*catalog.xml) do (
echo Converting %%~nf
java -jar saxon9he.jar -s:"%xml_loc%/%%f" -o:"%json_loc%\%%~nf.json" -xsl:"%conv_loc%/oscal_catalog_xml-to-json-converter.xsl" json-indent=yes 
)

for %%f in (%json_loc%/*profile.json) do (
echo Changing Import References to JSON for %%~nf.json
CScript "ReplaceText.vbs" "%json_loc%/%%~nf.json" "\/xml\/" "\/json\/" 
CScript "ReplaceText.vbs" "%json_loc%/%%~nf.json" "_catalog.xml" "_catalog.json" 
)

pause

[david-waltermire]

I manually merged you branch into master and found no remaining changes after I removed the generated resolved profiles and JSON content.

It looks like these changes were already committed in previous PRs or are now generated by the CI/CD. Closing.