search

OVAL-Community / OVAL

Official repository for the Open Vulnerability and Assessment Language
33 stars 25 forks source link

Mark all unused tests and platforms as deprecated, documenting plans to remove from specification in OVAL 6.0 #154

Open vanderpol opened 3 weeks ago

vanderpol commented 3 weeks ago

Abstract With the exception of new tests that are scheduled to be added to OVAL 5.12 (formerly 5.11.2-2 or something), any OVAL test that does not have any current documented use, either from publicly available SCAP/OVAL content or documented by OVAL board members as being used in private content streams, should be marked as deprecated. The goal being to make OVAL a smaller language, which is easier to adopt. In currently available SCAP benchmarks, only 48 different types of OVAL tests are currently in use out of 179 OVAL tests in OVAL 5.11.2.

If any board member provides documentation as to why a specific OVAL test needs to remain in the specification the OVAL test will be left in the language. The goal is not to remove functionality from OVAL, but to make OVAL much easier to adopt and use. If only ~50 OVAL tests are being used, why should any OVAL application developer spend valuable time/money implementing nearly 120 other tests?

This ticket will be updated with an attached list of proposed OVAL tests to deprecate in 5.12, and remove in 6.0.

Link to Proposal Once a proposal has been put into pull request form, add a link to the PR here. If and as alternate proposals or objections are added they should be linked here as well.

Additional context Add any other context or screenshots about the enhancement.

vanderpol commented 1 week ago

The tests to be deprecated is based on the OVAL discussion #165