defenseunicorns / lula

The Compliance Validator
Apache License 2.0
152 stars 22 forks source link

Generate OSCAL Component Source Flag Instead of Catalog and Profile #563

Open CloudBeard opened 3 months ago

CloudBeard commented 3 months ago

Is your feature request related to a problem? Please describe.

Component Definitions can be built using a catalog or profile see component-definition but the lula generate component command requires the -c flag and accepts either a catalog or profile while failing if you only provide the -p for the profile.

lula generate component -c https://raw.githubusercontent.com/GSA/fedramp-automation/93ca0e20ff5e54fc04140613476fba80f08e3c7d/dist/content/rev5/baselines/json/FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.json -r ac-1

Describe the solution you'd like

Remove the -c and -p flags in favor of an -s flag for --source that accepts either the catalog or profile. (rename -c to -s flags and leave the functionality as it since it accepts both and works.)

Additional context

Add any other context or screenshots about the feature request here.

image

brandtkeller commented 3 months ago

Certainly valid issues to call out - one being that the profile flag is not currently implemented.

Second to that - i'd like to think about what the matrix of potential opportunities is - IE generation with:

If the above are all valid - maybe separation of the two could still be warranted?

CloudBeard commented 3 months ago

The catalog and profile both go in the same field and is a 1 to 1 was my original thought process.

Now I could see something along the lines of Impact Levels or another reason to map a profile of High/Mod/Low and the catalog because X control is outside of the profile but needs to be represented so needing to do a control-implementations for a catalog and a profile could be a thing.

brandtkeller commented 1 month ago

revisiting this topic - Profile generation #694 implements a --source / -s flag for the use of either profile or catalog to align to this thought.

Will require some rewiring but I do agree with your original thought and aligning to a 1:1 mapping.