Skip to content

Upgrade OSCAL artifacts to 1.2.2 and enrich with security-as-code data #1284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
spoorcc merged 4 commits into from
Jun 17, 2026
Merged

Upgrade OSCAL artifacts to 1.2.2 and enrich with security-as-code data #1284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2ae3818
Upgrade OSCAL artifacts to 1.2.2 and enrich with security-as-code data
claude Jun 17, 2026
c5d956b
Auto-generate compliance_track.rst and control_register.rst from Pyth…
claude Jun 17, 2026
4ebd8c3
refactor: move control register to pytm-free tm_controls_data module
claude Jun 17, 2026
527889e
fix: address review findings in compliance tooling and docs
claude Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion CHANGELOG.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,19 @@ Release 0.15.0 (unreleased)

* Implement C-043: add ``pip-audit`` OSV gate to the release workflow; publishing is blocked if
any known vulnerability is found in dfetch's runtime dependencies
* Add CRA Compliance Track B: OSCAL 1.1.2 Component Definition mapping all CRA Annex I Part I
* Add CRA Compliance Track B: OSCAL 1.2.2 Component Definition mapping all CRA Annex I Part I
essential requirements (ECR-a–m) through prEN 40000-1-4 Security Objectives to dfetch controls;
covers Part II via prEN 40000-1-3; introduces controls C-043 (release-gate CVE check), C-044
(data minimisation policy), and C-046 (exploit mitigation inventory)
* Upgrade OSCAL artifacts to 1.2.2: both the prEN 40000-1-4 catalog and the Component Definition
now declare ``oscal-version: 1.2.2``; the catalog gains ``parties``, ``roles``, and
``responsible-parties`` in its metadata; the Component Definition adds a ``purpose`` field on
the component, a ``supplier`` party, ``document-ids`` for stable cross-referencing,
``responsible-roles``, and ``evidence`` links on every implemented-requirement pointing to the
concrete code or CI workflow file that implements the control — turning the compliance mapping
into a machine-verifiable security-as-code artifact; the back-matter is enriched with references
to the OpenSSF Scorecard, SLSA Source Provenance, Sigstore attestation, in-toto test results,
CodeQL, and dependency-review workflows

Release 0.14.0 (released 2026-06-14)
====================================
Expand Down
192 changes: 77 additions & 115 deletions doc/explanation/compliance_track.rst
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 9 additions & 7 deletions doc/explanation/control_register.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
.. This file is auto-generated by ``python -m security.compliance --control-register``.
Do not edit manually — edit security/compliance_data.py or the threat model files instead.

.. _control_register:

Control Register
================

All controls implemented by dfetch, sorted by ID. Risk-driven controls emerge
from the :doc:`threat models <security>`; compliance-only controls address CRA
requirements not independently surfaced by the risk analysis.
All controls implemented by dfetch, sorted by ID. Risk-driven controls emerge from the :doc:`threat models <security>`; compliance-only controls address CRA requirements not independently surfaced by the risk analysis.

.. list-table::
:header-rows: 1
Expand Down Expand Up @@ -69,7 +70,7 @@ requirements not independently surfaced by the risk analysis.
C-009
- Actions commit-SHA pinning
- Risk-driven
- `.github/workflows/ <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
- `.github/workflows/*.yml <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
* - .. _c-010:

C-010
Expand All @@ -81,19 +82,19 @@ requirements not independently surfaced by the risk analysis.
C-011
- Minimal workflow permissions
- Risk-driven
- `.github/workflows/ <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
- `.github/workflows/*.yml <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
* - .. _c-012:

C-012
- persist-credentials: false
- Risk-driven
- `.github/workflows/ <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
- `.github/workflows/*.yml <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
* - .. _c-013:

C-013
- Harden-runner (egress block)
- Risk-driven
- `.github/workflows/ <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
- `.github/workflows/*.yml <https://github.com/dfetch-org/dfetch/tree/main/.github/workflows>`_
* - .. _c-015:

C-015
Expand Down Expand Up @@ -221,3 +222,4 @@ requirements not independently surfaced by the risk analysis.
- Exploit mitigation inventory
- Compliance-only
- :doc:`compliance_track`

29 changes: 16 additions & 13 deletions doc/explanation/security_pipeline.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,19 @@ to produce the two RST threat-model pages (:doc:`threat_model_supply_chain` and
sequence diagram, and tables for assets, threats, and controls.

**Compliance pipeline** —
`security/compliance_data.py <https://github.com/dfetch-org/dfetch/blob/main/security/compliance_data.py>`_
defines the 46 dfetch controls and their mapping to CRA essential requirements
`security/tm_controls_data.py <https://github.com/dfetch-org/dfetch/blob/main/security/tm_controls_data.py>`_
defines all dfetch controls (Track A: risk-driven; Track B: compliance-only controls
in ``compliance_data.py``) and their mapping to CRA essential requirements
and prEN 40000-1-4 security objectives.
`security/compliance.py <https://github.com/dfetch-org/dfetch/blob/main/security/compliance.py>`_
reads those definitions together with the static OSCAL catalog and generates
:doc:`compliance_track` (human-readable RST mapping tables) and
:doc:`compliance_track` (human-readable RST mapping tables),
:doc:`control_register` (the full control register with GitHub references), and
`security/dfetch.component-definition.json <https://github.com/dfetch-org/dfetch/blob/main/security/dfetch.component-definition.json>`_
(machine-readable OSCAL 1.1.2 Component Definition; 1.1.2 is the pinned version —
NIST released 1.2.2 in April 2026, migration not yet performed). The
:doc:`control_register` page is maintained manually and references controls
defined in ``compliance_data.py``.
(machine-readable OSCAL 1.2.2 Component Definition). The Component Definition
includes the supplier party, component purpose, and ``evidence`` links on each
implemented-requirement pointing to the concrete code or CI file that implements
the control — making the mapping machine-verifiable.

**Release attestations** — GitHub Actions generates five cryptographic attestation
types *about dfetch itself* during every release, signed by Sigstore and verifiable
Expand Down Expand Up @@ -90,16 +92,17 @@ of their choice:
- CRA Annex I → prEN 40000-1-4 SO.* → dfetch control traceability tables

* - :doc:`control_register`
- RST (maintained)
- All 46 dfetch controls (C-001 to C-046) with references and status
- RST (generated)
- All dfetch controls with type, references, and status
Comment on lines +95 to +96

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Control-register description says “status”, but that column is not present.

control_register.rst currently exposes ID, Name, Type, and Reference only. This row should not claim status is included.

Suggested wording 
-     - All dfetch controls with type, references, and status
+     - All dfetch controls with type and references
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- RST (generated)
- All dfetch controls with type, references, and status
- RST (generated)
- All dfetch controls with type and references
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@doc/explanation/security_pipeline.rst` around lines 95 - 96, The
documentation in security_pipeline.rst claims that the control_register.rst
includes a "status" column, but the actual control_register.rst file only
exposes ID, Name, Type, and Reference columns. Remove the mention of "status"
from the line "All dfetch controls with type, references, and status" to
accurately reflect what columns are actually present in control_register.rst.
Update the text to only list the columns that actually exist in the control
register.


* - `security/dfetch.component-definition.json <https://github.com/dfetch-org/dfetch/blob/main/security/dfetch.component-definition.json>`_
- OSCAL 1.1.2 JSON (pinned)
- Machine-readable Component Definition; maps dfetch controls to CRA ECRs
- OSCAL 1.2.2 JSON (generated)
- Machine-readable Component Definition; maps dfetch controls to CRA ECRs;
includes supplier party, component purpose, and evidence links to code

* - `security/cra_pren_4000014_oscal_catalog.json <https://github.com/dfetch-org/dfetch/blob/main/security/cra_pren_4000014_oscal_catalog.json>`_
- OSCAL 1.1.2 JSON (pinned)
- Static prEN 40000-1-4 catalog (input to compliance pipeline, not generated)
- OSCAL 1.2.2 JSON (static)
- Static prEN 40000-1-4 catalog; includes parties, roles, and responsible-parties

* - :ref:`Release attestations <verify-integrity>`
- Sigstore-signed (GitHub Actions)
Expand Down
Loading
Loading