Compose single Schematron and XSpec documents #108
Conversation
- resources/validations/src/ssp.sch has Schematron - resources/validations/test/ssp.xspec has XSpec
- and apply XML formatting
This comment has been minimized.
This comment has been minimized.
- use global $fedramp-values variable - change some assertion messages to affirmative - attempt to minimize HTML Tidy's erroneous whitespace handling - remove OBE TODOs
This comment has been minimized.
This comment has been minimized.
- use @pending rather than x:pending for system inventory unit tests - make pending "when the media-type attribute lacks an allowed value " XSpec test
This comment has been minimized.
This comment has been minimized.
- change occurrences of SHOULD to should - change "FIPS 140 validated products" to "FIPS 140 validated modules"
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
- Change assertion statements to have a positive statement of the constraint - Comment out dysfuntional doc-available() "resource-rlink-required" rule. - Change sch:report role from "positive" to "information". - Comment out informational sch:report items.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
@GaryGapinski, do we know what is going on with these test failures?
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This will simplify the options in the UI.
This comment has been minimized.
This comment has been minimized.
- improve base64 regex - add checklist references
This comment has been minimized.
This comment has been minimized.
- correct XSpec base64 context to be valid base64 encoded content
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
One last comment, the rules look generally solid, and I will more thoroughly review the tests (having looked at many of them briefly; I know some got supressed reasons), but can you confirmed you worked in the wording recommendations given by @rrkane10x? It seems maybe or maybe not. I spent a good time looking for obvious signs, but not sure these made it in.
https://docs.google.com/document/d/1vZLOEBSD9HL4LkEp1H_8yHfm1ON-kLLjG9LgPc_Xl0U/edit
We also have a follow up story to look into this in a more focused way in #97 anyway, but it is something we are going to need to be mindful of moving forward.
- Use indefinite article ahead of element/attribute names - End assertion messages witha period. - Correct typos. - Remove "Section B" prefixes. - Expand initialisms and acornyms
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
- fix one regex - ensure sibling validation-reference and validation-details cite the same CMVP certificate
This comment has been minimized.
This comment has been minimized.
resources/validations/src/ssp.sch
Outdated
| <sch:rule context="oscal:base | oscal:selected"> | ||
| <sch:let name="fips-levels" | ||
| value="('fips-199-low', 'fips-199-moderate', 'fips-199-high')" /> | ||
| <sch:assert diagnostics="cia-impact-has-approved-fips-categorization-diagnostic" | ||
| id="cia-impact-has-approved-fips-categorization" | ||
| role="error" | ||
| test=". = $fips-levels">A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or | ||
| select element must have an approved value.</sch:assert> | ||
| </sch:rule> |
There was a problem hiding this comment.
Should we not be loading these from the FedRAMP values file?
There was a problem hiding this comment.
Yes. I may have done this when looking at another L/M/H that was just low|moderate|high with and without initial capitalization. The most recent commit uses the external document.
This comment has been minimized.
This comment has been minimized.
resources/validations/src/ssp.schhas Schematronresources/validations/test/ssp.xspechas XSpec