Assessment Findings don't account for multiple components evaluating against the same Control ID

[meganwolf0]

Environment

Device and OS:
App version:
Kubernetes distro:
Kubernetes version:
provider:

• [ ] kyverno
• [ ] opa

Steps to reproduce

1. Aggregate multiple components that specify the same control
2. lula validate -f <oscal.yaml>

Expected result

Assessment results model should report on each Finding, or at least document the individual implemented requirement text/information

Actual Result

Findings takes only one implemented requirement text/data, which omits information that might be relevant/important from other implemented requirements

Visual Proof (screenshots, videos, text, etc)

Severity/Priority

Medium

Additional Context

[brandtkeller]

@meganwolf0 Can you elaborate on:

Assessment results model should report on each Finding, or at least document the individual implemented requirement text/information

Is this with respect to a Finding description only being from one implemented-requirement?

[meganwolf0]

@meganwolf0 Can you elaborate on:

Assessment results model should report on each Finding, or at least document the individual implemented requirement text/information

Is this with respect to a Finding description only being from one implemented-requirement?

Yeah - basically that only the text from one implemented requirement is pulled into findings.description, so you're losing some info there if there are multiple components implementing the Control