Hello Martin,
sorry for the delay when processing this request (other issues prevented me from sooner reaction). Anyway, pls see below.
----- Original Message -----
From: "Martin Preisler" mpreisle@redhat.com To: "Jan Lieskovsky" jlieskov@redhat.com Cc: "SCAP Security Guide" scap-security-guide@lists.fedorahosted.org, "open-scap-list" open-scap-list@redhat.com Sent: Thursday, July 28, 2016 8:01:47 PM Subject: Re: Latest OpenSCAP changes to speed up SSG builds
----- Original Message -----
From: "Jan Lieskovsky" jlieskov@redhat.com To: "Martin Preisler" mpreisle@redhat.com Cc: "SCAP Security Guide" scap-security-guide@lists.fedorahosted.org, "open-scap-list" open-scap-list@redhat.com Sent: Thursday, July 28, 2016 5:05:26 AM Subject: Re: Latest OpenSCAP changes to speed up SSG builds
[snip]
That would be helpful, yes. Thanks, Martin.
There will be some differences (for example timestamp) for sure. But the point is to ensure there won't be some other inevitable deviations (that could lead e.g. to the reduction of the file size at the end). IOW verification if those XSLT changes are that isolated enough, it won't hurt when they are used also together with old openscap code base (without other patches from upstream being applied).
I wrote a blog post about the optimizations and about the test-case I created to verify correctness. Check it out at https://martin.preisler.me/2016/07/openscap-xslt-performance-improvements-fo... and let me know if this addresses your concerns.
Feel free to run the test-case on your machine as well so that we have more data sources.
I have compared the output on two RHEL-7 machines running openscap-1.2.10 vs openscap-1.2.11 (latest 1.2-main master) and diffed both *-xccdf-1.2.xml and selected guides manually, and the results are below:
* for -xccdf-1.2 files, the output is identical:
$ diff -s ssg-rhel7-xccdf-1.2.xml ssg-rhel7-xccdf-1.2.xml-latest Files ssg-rhel7-xccdf-1.2.xml and ssg-rhel7-xccdf-1.2.xml-latest are identical
$ ls -l ssg-rhel7-xccdf-1.2.xml* -rw-r--r--. 1 iankko iankko 1839260 aug 1 18:16 ssg-rhel7-xccdf-1.2.xml -rw-rw-r--. 1 iankko iankko 1839260 aug 1 17:47 ssg-rhel7-xccdf-1.2.xml-latest
* for the modified guides template, the output differs slightly.
The 'guide-tree-leaf-id*' changes are irrelevant (looks like just different hash value) => safe.
When unified all of them to same form in both files, there are some changes in xccdf:Values yet (looks some xccdf:Values got different default selector values, pls see the attached file below. But IMHO this is just demonstration of the bug you have mentioned before) => changes pending confirmation.
The other change is just oscap version change in some element at the benchmark end => expected / safe change too.
To summary, IMHO the changes are either safe, or are demonstration of that 'default selector' xccdf:Value bug, you mentioned earlier =>
I agree this change to be safe to be applied on Jenkins slaves (IOW it's functionally identical to version in previous oscap releases).
Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
-- Martin Preisler Identity Management and Platform Security | Red Hat, Inc.