OVAL 5.11 Woes

Gabe Alford redhatrises at gmail.com
Wed Apr 22 13:15:48 UTC 2015


Branching is not a bad idea. We could also develop platform build code that
could handle specific version/os use cases as another option.

Gabe

On Wed, Apr 22, 2015 at 7:00 AM, Steve Grubb <sgrubb at redhat.com> wrote:

> On Wednesday, April 22, 2015 10:50:36 AM Šimon Lukašík wrote:
> > And here comes the problem, SCAP-Security-Guide contains multiple
> > separate guidances each for a different target (RHEL6, RHEL7, or
> > Fedora). Majority of contributors are used to build all the guidances by
> > a single build process on RHEL6 or RHEL7.
>
> Perhaps its time for a branch in SSG. One for OVAL 5.10 and one for OVAL
> 5.11.
> Then at some future point we can ship SSG and new openscap. to both RHEL6
> and
> 7. This is possible because legally there is no validated scanner for
> RHEL6 &
> 7. Any validation will be under some new release of SCAP because 1.2
> specifically limits validation to RHEL5. So, any validated scanner for
> RHEL6 or
> 7 will be able to process the new content. I feel very comfortable in
> making
> this recommendation.
>
> The bridge between SCAP 1.2 and what's next will be the current generation
> of
> scanners. They can use he current OVAL 5.10 branch. I would only make
> important changes there as needed and focus mostly on 5.11 because that is
> what every product will have to certify to on RHEL6 or 7.
>
> -Steve
>
> > At the time of writing neither RHEL6 nor RHEL7 tooling include support
> > for OVAL 5.11. So, the tools on RHEL6 and RHEL7 will be limited in
> > processing OVAL 5.11 (SSG/Fedora) content.
> >
> > At the same time, there is value in moving the edge and start building
> > OVAL 5.11 (systemd) content for Fedora target. We will test systemd
> > checks in Fedora and move them to RHEL7 STIG later on.
> >
> > Hence, it seems that the best way to proceed is buildtime magic: Build
> > Fedora content only when the tools are capable building it. Downside is
> > that RHEL6/RHEL7 contributors will not be able to build Fedora content
> > (until OpenSCAP 1.2.2 update hits their systems)
> >
> > Jan Černý has already started adding systemd support to SSG/Fedora in
> >
> >      https://github.com/OpenSCAP/scap-security-guide/pull/527
> >
> > Ideas?
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150422/266fbba8/attachment.html>


More information about the scap-security-guide mailing list