oscal-compass / compliance-trestle

An opinionated tooling platform for managing compliance as code, using continuous integration and NIST's OSCAL standard.
https://oscal-compass.github.io/compliance-trestle
Apache License 2.0
169 stars 61 forks source link

Rendering system and component structure to a diagram #1743

Open butler54 opened 3 weeks ago

butler54 commented 3 weeks ago

Issue description / feature objectives

This is speculative for discussion

SSPs typically have a large number of diagrams. Today that would be supported by an external image reference. The defacto way that is suggested under trestle is to use drawio and check it in as code.

However, drawio files, while xml, are from a SCM management PoV binary blobs. This brings two issues:

  1. What "as code" image formats could be used.
  2. If required to generate images from the oscal model (for example to build a diagram of the components and sub-components in an SSP). what format could be used.

At a high level mermaid.js is proposed as:

  1. Support from major SCM makers (GitHub and GitLab) as an integrated extension of markdown
  2. Is focused on IT including support for some UML flavours
  3. Is not a drawing format. There are limited methods to manipulate the diagrams layout. While this might not be perfect for a sales deck.

Caveats / Assumptions

Completion Criteria

jpower432 commented 2 weeks ago

@butler54 I think this might be related to #1617. Wondering if this could be an issue under this Epic. What do you think?