-
Notifications
You must be signed in to change notification settings - Fork 185
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Required 'asset-id' prop under inventory-items>implemented-components #2043
Comments
@Telos-sa - OSCAL schema never had an I am guessing you are using the If such assembly is needed by others as well, we need to work it with the community, BUT it cannot be mandated since it will cause backward incompatibility. |
I am using oscal-cli version v1.0.3 from https://github.com/usnistgov/oscal-cli. The error log is suggesting that inventory-items>implemented-components requires a prop with name="asset-id". There is no implemented-components>asset-id element. The issue I see with this, is that there is nothing in the v1.1.2 metaschema that indicates that props is a required element for implemented-components, and also nothing indicating that a prop with name="asset-id" is required. |
I am sorry for misunderstanding your note above. This is a constraint documented with all OSCAL constraints in the References. For this particular constraint, please see: https://pages.nist.gov/OSCAL-Reference/models/v1.1.2/system-security-plan/json-reference/#/system-security-plan/system-implementation/inventory-items The cardinality is documented in References under the
This information (the documentation) is automatically generated front eh OSCAL metaschema definition. I can provide details (where to find it ) , if interest exists. |
If no additional information is needed under this issue, I recommend we close it. |
What is the user story for this constraint? This section already requires a component-uuid, so is it requiring the id of the asset as well? In most cases the uuid is adequate for establishing a reference point. And also recommending that this constraint is removed, and if it can't be removed, at least make this 'props' sub-element required (as it is required by the validator). |
A system's
The Making the Reducing the number of constraints is something that I am open to do as long as it is not affecting tools' ability of understanding the data or degrades OSCAL's ability of representing high-quality data in support of automation. Obtaining community's support for this request is also expected. |
We have just encountered this as well and I was about to open a new issue for it, but found this one. The constraint is currently being enforced here: It really shouldn't be in the OSCAL metaschema constraints at all as it was a FedRAMP-specific requirement. In any case, it does not make sense under @iMichaela if you agree with its removal, I am happy to submit a PR for it. |
User Story
The oscal-cli requires there be a prop under inventory-items>implemented-components with name="asset-id". This is not outlined anywhere in the schema or the outline of the SSP.
Goals
Reflect in the schema and outline that the 'props' array is required and that one matching name="asset-id" is necessary.
Alternatively, "asset-id" could be changed into an actual (required) schema element under implemented-components rather than being represented as a prop.
Dependencies
No response
Acceptance Criteria
(For reviewers: The wiki has guidance on code review and overall issue review for completeness.)
Revisions
No response
The text was updated successfully, but these errors were encountered: