Hello Martin,
sorry for the delay when processing this request
(other issues prevented me from sooner reaction). Anyway,
pls see below.
----- Original Message -----
From: "Martin Preisler" <mpreisle(a)redhat.com>
To: "Jan Lieskovsky" <jlieskov(a)redhat.com>
Cc: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org>,
"open-scap-list" <open-scap-list(a)redhat.com>
Sent: Thursday, July 28, 2016 8:01:47 PM
Subject: Re: Latest OpenSCAP changes to speed up SSG builds
----- Original Message -----
> From: "Jan Lieskovsky" <jlieskov(a)redhat.com>
> To: "Martin Preisler" <mpreisle(a)redhat.com>
> Cc: "SCAP Security Guide"
<scap-security-guide(a)lists.fedorahosted.org>,
> "open-scap-list" <open-scap-list(a)redhat.com>
> Sent: Thursday, July 28, 2016 5:05:26 AM
> Subject: Re: Latest OpenSCAP changes to speed up SSG builds
>
> [snip]
>
> That would be helpful, yes. Thanks, Martin.
>
> There will be some differences (for example timestamp) for sure. But
> the point is to ensure there won't be some other inevitable deviations
> (that could lead e.g. to the reduction of the file size at the end).
> IOW verification if those XSLT changes are that isolated enough,
> it won't hurt when they are used also together with old openscap
> code base (without other patches from upstream being applied).
I wrote a blog post about the optimizations and about the test-case I
created to verify correctness. Check it out at
https://martin.preisler.me/2016/07/openscap-xslt-performance-improvements...
and let me know if this addresses your concerns.
Feel free to run the test-case on your machine as well so that we have
more data sources.
I have compared the output on two RHEL-7 machines running openscap-1.2.10 vs
openscap-1.2.11 (latest 1.2-main master) and diffed both *-xccdf-1.2.xml and
selected guides manually, and the results are below:
* for -xccdf-1.2 files, the output is identical:
$ diff -s ssg-rhel7-xccdf-1.2.xml ssg-rhel7-xccdf-1.2.xml-latest
Files ssg-rhel7-xccdf-1.2.xml and ssg-rhel7-xccdf-1.2.xml-latest are identical
$ ls -l ssg-rhel7-xccdf-1.2.xml*
-rw-r--r--. 1 iankko iankko 1839260 aug 1 18:16 ssg-rhel7-xccdf-1.2.xml
-rw-rw-r--. 1 iankko iankko 1839260 aug 1 17:47 ssg-rhel7-xccdf-1.2.xml-latest
* for the modified guides template, the output differs slightly.
The 'guide-tree-leaf-id*' changes are irrelevant (looks like just different
hash value) => safe.
When unified all of them to same form in both files, there are some changes
in xccdf:Values yet (looks some xccdf:Values got different default selector
values, pls see the attached file below. But IMHO this is just demonstration
of the bug you have mentioned before) => changes pending confirmation.
The other change is just oscap version change in some element at the benchmark
end => expected / safe change too.
To summary, IMHO the changes are either safe, or are demonstration of that
'default selector' xccdf:Value bug, you mentioned earlier =>
I agree this change to be safe to be applied on Jenkins slaves
(IOW it's functionally identical to version in previous oscap releases).
Regards, Jan
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
--
Martin Preisler
Identity Management and Platform Security | Red Hat, Inc.