search

usnistgov / oscal-cli

A simple open source command line tool to support common operations over OSCAL content.
Other
41 stars 18 forks source link

Source Profile Content Missing from Resolved Profile Catalog #269

Open Rene2mt opened 3 months ago

Rene2mt commented 3 months ago

Describe the bug

The following profile content is not included in the resultant resolved profile catalog:

Who is the bug affecting?

OSCAL content developers using the OSCAL-CLI to generate resolved profile catalogs.

What is affected by this bug?

Content (e.g., roles, parties, responsible-parties defined in the profile) are missing from the generated resolved profile catalog.

When does this occur?

Always.

How do we replicate the issue?

Run the following command (update source and output file names):

/mnt/c/oscal-cli-1.0.3/bin$ ./oscal-cli profile resolve -to=xml /mnt/c/fedramp-automation/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml /mnt/c/cli-output/FedRAMP_rev5_MODERATE-baseline_resolved-profile_catalog.xml

The source profile has the following data elements: image

and image

But they are missing from the generated resolved profile catalog: image

Expected behavior (i.e. solution)

Content defined in the profile's metadata and/or back-matter should also be included in the resolved profile catalog.

Other Comments

It appears that metadata and back-matter information from the referenced source catalog is included in the resolved profile catalog; its just any additional metadata and back-matter information in the profile that gets excluded.