Resolving 'draft' status on Pages deployment

[wendellpiez]

With the Pages site up we can now perform review with external and NIST partners and revise to final form.

We need to

• establish criteria for removing 'draft' banner (assuming ongoing maintenance)
• see to it the Pages site meets these criteria

The site is here: https://pages.nist.gov/oscal-tools

[wendellpiez]

Ducks to get lined up here include the NIST software publishing checklist in development.

Scanning this list:

• This is a demo site, thus informational (not intended for re-use)
• Continuous testing was conducted during development
• Documentation is available (site supports demonstrations)
• Top level page of site is pages.nist.gov/oscal-tools
• Docs include
  • Site itself
  • Folder level readmes in backend repo
  • Each demo has its own (brief) instructions and explanation
  • Pointers and links
  • License/disclaimer is posted here: https://pages.nist.gov/oscal-tools/about/
  • MIDAS registration
  • The CSX demos have been registered (as a publication)
  • The site as a whole has not
• The software does not require access to any data provided by NIST
• The published site is at pages.nist.gov/oscal-tools
  • the site backend along with associated tools repository is available at https://github.com/usnistgov/oscal-tools
  • (some) demos are available on line in the Pages site (passive delivery, no back end, all client)
  • additionally, for download and use, users may clone or fork the repository, or copy and serve the utilities ad hoc
  • Software releases / updates are managed through Git
  • Patches provided if/as necessary
  • Necessary updates are provided as OSCAL versions increment (see usnistgov/OSCAL)
  • Different projects / folders in either/both site or repository may update on their own schedules
  • Data storage is being managed by consolidating via git and relying on ubiquity of copies as well as Github for backup
  • Same for backup / restoration
  • Retention policy: the lifespan of this repository is tied to OSCAL. As long as OSCAL remains active this repository is likely to prove useful as a starting point and clearing house.
  • Impact levels
  • Confidentiality LOW: There is no classified or confidential data or PII on this site or in the back end repository.
  • Integrity LOW: Data consists of documents and source code requiring interpreter or compiler (not executable natively), and functions standalone.
  • Availability LOW: As this resource is published for the purposes only of documenting and demonstrating capabilities for emulation or critique, and not of providing operations, its availability should not be critical at any given time.
  • The software is available via the link https://github.com/usnistgov/oscal-tools
  • No binary downloads are offered, requiring confirmation via checksums; all resources are encoded using standard data serializations such as HTML and XML (UTF-8) and can be inspected and tested independently of any runtime.
  • The applications run standalone without any connectivity to NIST servers (or any external servers) required. A generic web host such as is provided in Github Pages is the only dependency to serve the demonstrations themselves.
  • Users will be notified of updates as R&D continues via regular OSCAL community channels (see https://pages.nist.gov/OSCAL/contribute/)
  • Code releases are not versioned currently; the demonstrations function independently
  • No binaries or executables are available or necessary. Code demonstrated runs entirely in the browser using W3C-conformant (web) standards including XML, CSS and XSLT 3.0.
  • The codebase has a single direct external dependency on SaxonJS, a Javascript library provided (free for use) by Saxonica, Inc. See the licensing terms here. [nb a link checker will be blind to this]
  • Our managers are apprised of and approve of our maintenance plan
  • User are notified of release management via OSCAL channels and repository subscription notifications
  • Feature updates of third-party library (SaxonJS) may be performed as needed
  • Bugs can be reported via Github https://github.com/usnistgov/oscal-tools/issues

tbd

• [ ] Lifecycle Planning: Anticipated end of active development [date]
• [ ] Lifecycle Planning: Anticipated end of active support [date]
• [ ] Lifecycle Planning: Anticipated date when software should be archived [date]

[wendellpiez]

After discussion with @david-waltermire-nist we've decided on the following plan:

• [ ] Continue to conduct internal and external reviews by sharing the link to draft Pages site - but these will not be a blocker
• [ ] Review checklist above and update top-level site documentation if/as necessary to reflect policies. Annotate this Issue with further links to policy statements/disclaimers
• [ ] Remove 'draft' banner on the basis of the above

Since two of the items above require (possibly minimal) site revisions, there will be a PR for this Issue.

@david-waltermire-nist unless you have further input I plan to proceed on this with help from @iMichaela if/as necessary.

I also expect to solicit input from the MIDAS (NIST data repository) maintainers regarding the lifecycle planning questions.

Draft answers:

1. Anticipated end of active development: unknown/indeterminate [this is part of OSCAL project]
2. Anticipated end of active support: unknown/indeterminate [same]
3. Anticipated date when software should be archived [isn't Github doing this? this is open-source software]