Hello Shawn,
thank you for your review.
> On 9/17/13 11:39 AM, Jan Lieskovsky wrote:
>
>
>
> 0001-Add-FEDORA-Makefile-README-and-scap-security-guide.s.patch
> From cdb777a21d597945269c855f4d40c867749e0ab9 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Tue, 17 Sep 2013 16:20:23
> +0200
> Subject: [PATCH 1/8] Add FEDORA Makefile, README, and
> scap-security-guide.spec files.
>
>
> Signed-off-by: Jan Lieskovsky <jlieskov(a)redhat.com> ---
> FEDORA/Makefile | 58
> +++++++++++++++++++++++++++++++++++++++++
> FEDORA/README | 30 +++++++++++++++++++++
> FEDORA/scap-security-guide.spec | 53 +++++++++++++++++++++++++++++++++++++
> 3 files changed, 141 insertions(+)
> create mode 100644 FEDORA/Makefile
> create mode 100644 FEDORA/README
> create mode 100644 FEDORA/scap-security-guide.spec
>
> For the directory structure, use Fedora19 vs FEDORA
We would like to avoid explicit Fedora version in the main subdirectory
yet =>
As of right now it's not clear / agreed yet (we will need to agree
on this within our team yet), if in six months when Fedora-20 will
be released it will get its own subdirectory, or till that time we
will come with scripts which would just replace 'fedora19',
Fedora-19's name, Fedora-19 CPE etc. in the content with their
Fedora-20 counterparts in the repository, and deal with the need
of two packages on the srpm / rpm level only.
Evaluating pros and cons of each of the approach right now.
But replaced it with 'Fedora' for now at least.
>
>
>
>
> diff --git a/FEDORA/Makefile b/FEDORA/Makefile
> new file mode 100644
> index 0000000..be0086d
> --- /dev/null
> +++ b/FEDORA/Makefile
> @@ -0,0 +1,58 @@
> +IN = input
> +OUT = output
> +TRANS = transforms
> +UTILS = utils
> +DIST = dist
> +
> +ID = fedora-19
> ID = ssg
>
> ID is used to identify the content provider, which in the Makefile, generates
> the ssg-${os}-xccdf.xml files. In the various make commands, 'fedora' should
> be changed to 'fedora19'
Oh, didn't know the ID stands for content provider.
Anyway, updated the third version below it to reflect ssg at the beginning
(and added just PROD variable [PRODUCT]) to identify Fedora-19.
>
>
>
>
> +
> +all: shorthand2xccdf guide content dist
> +
> +shorthand-guide:
> + xsltproc -o $(OUT)/$(ID)-shorthand.xml $(IN)/guide.xslt $(IN)/guide.xml
> + xmllint --format --output $(OUT)/$(ID)-shorthand.xml
> $(OUT)/$(ID)-shorthand.xml
> +
> +shorthand2xccdf: shorthand-guide
> + xsltproc -o $(OUT)/unlinked-unresolved-fedora-xccdf.xml
> $(TRANS)/shorthand2xccdf.xslt $(OUT)/$(ID)-shorthand.xml
> + oscap xccdf resolve -o $(OUT)/unlinked-fedora-xccdf.xml
> $(OUT)/unlinked-unresolved-fedora-xccdf.xml
> as an example, the above should be:
>
> +shorthand2xccdf: shorthand-guide
> + xsltproc -o $(OUT)/unlinked-unresolved-fedora19-xccdf.xml
> $(TRANS)/shorthand2xccdf.xslt $(OUT)/$(ID)-shorthand.xml
> + oscap xccdf resolve -o $(OUT)/unlinked-fedora19-xccdf.xml
> $(OUT)/unlinked-unresolved-fedora-xccdf.xml
Right, updated the Fedora Makefile it to result into the form recommended
above.
>
>
>
>
> +
> +checks:
> + xmlwf $(IN) / checks / *.xml
> + $(TRANS)/combinechecks.py $(IN)/checks > $(OUT)/unlinked-fedora-oval.xml
> + xmllint --format --output $(OUT)/unlinked-fedora-oval.xml
> $(OUT)/unlinked-fedora-oval.xml
> +
> +guide: shorthand2xccdf
> +# remove auxiliary Groups which are only for use in tables, and not
> guide output.
> +# specifying a nonexistent profile, "allrules," to make oscap print
> all Rules
> + xsltproc -o $(OUT)/unlinked-fedora-xccdf-guide.xml
> $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-fedora-xccdf.xml
> + xsltproc -o $(OUT)/unlinked-notest-fedora-xccdf-guide.xml
> $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-fedora-xccdf.xml
> + oscap xccdf generate guide --profile allrules
> $(OUT)/unlinked-notest-fedora-xccdf-guide.xml > $(OUT)/$(ID)-guide.html
> +
> +content: shorthand2xccdf guide checks
> + $(TRANS)/cpe_generate.py $(OUT)/unlinked-fedora-oval.xml
> $(IN)/checks/platform/fedora-cpe-dictionary.xml $(ID)
> + $(TRANS)/relabelids.py unlinked-fedora-xccdf.xml $(ID)
> +
> +validate-xml:
> + oscap xccdf validate-xml $(OUT)/$(ID)-xccdf.xml
> + oscap oval validate-xml $(OUT)/$(ID)-oval.xml
> + oscap oval validate-xml $(OUT)/$(ID)-cpe-oval.xml
>
> here we'd want ssg-$(ID)-xccdf.xml
Updated too.
>
>
>
> +
> +validate: validate-xml
> + cd $(OUT); ../$(UTILS)/verify-references.py --rules-with-invalid-checks
> --ovaldefs-unused $(ID)-xccdf.xml
> + oscap oval validate-xml --schematron $(OUT)/$(ID)-oval.xml
> +
> +# items in dist are expected for distribution in an rpm
> +dist: guide content
> + mkdir -p $(DIST)/guide $(DIST)/content
> + cp $(OUT)/*-guide.html $(DIST)/guide
> + cp $(OUT)/$(ID)-xccdf.xml $(DIST)/content
> + cp $(OUT)/$(ID)-oval.xml $(DIST)/content
> + cp $(OUT)/$(ID)-cpe-dictionary.xml $(DIST)/content
> + cp $(OUT)/$(ID)-cpe-oval.xml $(DIST)/content
> +
> +eval-common: content
> + oscap xccdf eval --profile common $(OUT)/$(ID)-xccdf.xml
> +
> +clean:
> + rm -f $(OUT)/*.xml $(OUT)/*.html $(OUT)/*.xhtml $(OUT)/*.pdf $(OUT)/*.spec
> $(OUT)/*.tar $(OUT)/*.gz $(OUT)/*.ini $(OUT)/*.csv
> + rm -rf $(DIST)/content $(DIST)/guide
> diff --git a/FEDORA/README b/FEDORA/README
> new file mode 100644
> index 0000000..c3c94db
> --- /dev/null
> +++ b/FEDORA/README
> @@ -0,0 +1,30 @@
> +Directory Structure of scap-security-guide
> +------------------------------------------
> +
> +The input directory contains source files that generate SCAP content, such
> as
> +XCCDF and OVAL. Since a single large XML file is an impractical format for
> +multiple authors to collaborate on editing SCAP content, efforts are made to
> +keep logically related guidance and checking content in individual files.
> +
> +The transforms directory contains resources that enable the files inside the
> +input directory (or output directory) to be combined and reformatted into
> +valid SCAP formats or human-readable formats.
> +
> +The output directory is used as a storage area for items generated by the
> files
> +in the inputs directory. It should be empty in the repository, and built on
> +users' individual systems (and rely on its .gitignore file to keep such
> files
> +out). The output directory contains transitional output (which may only
> exist
> +in order to be further transformed) as well as final output.
> +
> +The references directory should contain documents which are specified as
> +references from within the SCAP content, or documents that are "seeds,"
viz.
> +documents whose prose will be translated into SCAP formats, as well as other
> +examples of SCAP content.
> +
> +The utils directory contains helper scripts and other items that are useful
> to
> +developers but are not essential to producing the project's output.
> +
> +The dist directory contains final outputs, which could be shipped in an RPM
> for
> +consumption by end-users. Updating the Makefile to copy an item from the
> +outputs directory to the dist directory indicates that an item is considered
> a
> +final output.
> diff --git a/FEDORA/scap-security-guide.spec
> b/FEDORA/scap-security-guide.spec
> new file mode 100644
> index 0000000..6042ba6
> --- /dev/null
> +++ b/FEDORA/scap-security-guide.spec
> @@ -0,0 +1,53 @@
> +
> +# IMPORTANT NOTE: This spec file is solely dedicated to make changes to the
> +# Fedora's scap-security-guide package. If you want to apply changes against
> +# the main RHEL-6 scap-security-guide RPM content, use
> scap-security-guide.spec
> +# file one level up - in the main scap-security-guide directory (instead of
> +# this one).
> +
> +Name: scap-security-guide
> +Version: 0.1
> +Release: 1.fc19
> +Summary: Security guidance and baselines in SCAP formats
> +Group: Applications/System
> +License: Public Domain
> +URL:
https://fedorahosted.org/scap-security-guide/ +Source0:
>
http://fedorapeople.org/~jlieskov/% {name}-%{version}.tar.gz
> +BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
> +BuildArch: noarch
> +BuildRequires: coreutils, libxslt, expat, python, openscap-utils >= 0.9.1,
> python-lxml
> +Requires: filesystem, openscap-utils >= 0.9.1
> +
> +%description
> +The scap-security-guide project provides security configuration guidance in
> +formats of the Security Content Automation Protocol (SCAP). It provides a
> +catalog of practical hardening advice and links it to government
> requirements
> +where applicable. The project bridges the gap between generalized policy
> +requirements and specific implementation guidance.
> +%prep
> +%setup -q
> +
> +
> +%build
> +cd FEDORA && make dist
> +
> +
> +%install
> +rm -rf $RPM_BUILD_ROOT
> +mkdir -p $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19
> +
> +# Add in core content (SCAP, guide)
> +cp -r FEDORA/dist/* $RPM_BUILD_ROOT/usr/share/xml/scap/ssg/fedora/19
> +
> +
> +%clean
> +rm -rf $RPM_BUILD_ROOT
> +
> +
> +%files
> +%defattr(-,root,root,-)
> +/usr/share/xml/scap/ssg/fedora/19/*
> +
> +%changelog
> +* Tue Sep 17 2013 Jan iankko Lieskovsky <jlieskov(a)redhat.com> 0.1-1
> +- Initial Fedora SSG RPM.
> --
> 1.7.11.7
>
Attached below is (all-in-one-form since I don't want to spam SSG ML
with all the patches again) third version of the patch, which:
- includes the changes from version #2, namely:
Second version:
* included testcheck.py and utils/verify-input-sanity.py scripts,
* removed attestation parts and CCE definitions:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
* updated FEDORA rpm license to be just Public Domain:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
- and adds the following:
Third version:
* rename main subdirectory from 'FEDORA' to 'Fedora',
* preserve original SSG id, introduce new PROD variable to track Fedora version,
* make the XML output files format to be: ssg-${os}-xccdf.xml:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Septemb...
Also tested:
* Fedora make {content, dist, validate, checks, eval-common, clean} rules to work
properly,
* Fedora tarball / srpm / rpm generation to work properly,
* for the common profile content confirmed the tests still work properly (return
particular
result on F-19, notapplicable on F-17),
* confirmed ./testcheck.py script works and returns reasonable results.
Please review && let me know.
Thank you && Regards, Jan.
--