Hello, Jan:

On 11/16/2015 05:31 AM, Jan Lieskovsky wrote:
Hello folks,

  since:
  * the above topic is appearing on the SSG mailing list pretty often
    (people searching for guidance how to possibly contribute to SSG),
  * the current documentation / wiki pages WRT to topic of contributing
    aren't well at all,

we have decided to hold a SCAP Security Guide Q/A Contributor Workshop
to happen on Tuesday in a week from now, 2015-11-24 for two hours
(from 09:00 AM - 11:00 AM Eastern Time) with the following preliminary
agenda / topics:

Excellent!

SCAP Security Guide Q/A Contributor Workshop:
-----------------------------------------------------------------------
Agenda:

* Identify existing issues / problems when attempting to contribute to SSG
* How to contribute a new rule?
 * How to design logical structure of the rule? (which existing group to place it)
 * Basic details about SSG contribution:
  * How to create and where to store XCCDF, OVAL, and remediation script?
 * (Possibly) Create a new group within SSG
 * Create all rules
 * Expected developer workflow (how to commit & test the proposed changes)
 * Test own scenario (if appropriate)
* Where's the documentation?
* Any other issues / problems identified during the call & subsequent feedback.

The above agenda is just sketch of (possible) topics to discuss.
Should you find some of the important items missing below,
let me know and I will add them.

If time permits, perhaps a discussion of cross-platform XCCDF rules and OVAL definitions (i.e., ones which are suitable for more than one platform)? Even when there are platform-specific variant evaluations, having a single rule (e.g., auditd should be active, SELinux|AppArmor should be active) would be useful.

I'd like to consider Debian and derivatives as well.

I have some difficulty adjusting SSG content for variant adaptations. The ability to easily (simply) compose content for arbitrary targets would be helpful. My difficulty might simply be that I am not familiar enough with SSG structure, though I expect there is more to it than just that.

Remediation script idempotency or lack thereof. Ones which are not should be identified as such.

As for the medium I am proposing BlueJeans. Should we need to use something
else, let me know!

Sounds good as long as it works with Linux.

Would you be interested in attending of this workshop (meet the SCAP Security
Guide upstream online and raise your voice / questions / concerns), please
let me know (OFF-LIST PREFERABLY) and I will add your name to the list
of the invited guests.

I would like to attend. I am available at the proposed time.

Regards,

Gary