feat: mapping documents - #527
Open
eddie-knight wants to merge 11 commits into
Open
Conversation
Signed-off-by: Eddie Knight <knight@linux.com>
…ence IDs with catalog usage Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
…framework crosswalks Signed-off-by: Eddie Knight <knight@linux.com>
…ingDocument artifacts Signed-off-by: Eddie Knight <knight@linux.com>
…d from mapping documents Signed-off-by: Eddie Knight <knight@linux.com>
…orkflow Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
…OpenCRE crosswalks All nine ids were inherited from the original inline data and verified against the authoritative frameworks: - CSF 2.0: PR.A-02/PR.A-05 -> PR.AA-02/PR.AA-05 (no PR.A category exists; Identity Management, Authentication, and Access Control is PR.AA), and ID.AM.01 -> ID.AM-01 (subcategory ordinals are hyphen-delimited). - SSDF v1.1: P0.3.1/P0.4.2 -> PO.3.1/PO.4.2 (digit zero for letter O), and 'RV 2.2' -> RV.2.2 (malformed separator). - OpenCRE: 483-813 -> 486-813, 357-352 -> 347-352, 263-284 -> 263-184 (transposition typos; originals return 404 from the OpenCRE API, corrected ids resolve and match usage elsewhere in the document). Signed-off-by: Eddie Knight <knight@linux.com>
… in 800-161, Scorecard, SAMM, and SLSA crosswalks All defects were inherited from the original inline data: - 800-161: drop targets 1.2e and 1.2f from M-OSPS-AC-01; they are EU CRA Annex I identifiers, not SP 800-161 controls (the CRA crosswalk already carries them for OSPS-AC-01). - Scorecard: reassign Binary-Artifacts from OSPS-QA-04 (multi-repo security requirements) to OSPS-QA-05, which owns the 'no binary artifacts in the repository' requirement. - SAMM 2.0: repair entry ids that skipped or mis-split hierarchy levels (Requirements-driven Testing under Verification; Software Dependencies under Secure Build; Create and Promote under Strategy & Metrics) and normalize spacing so each SAMM stream is identified by exactly one string. - SLSA 1.0: use one canonical spelling for the Isolated isolation requirement (previously five variants), split the malformed 'Provenance generation- Exists, Authentic' into its two real sub-requirements, fix 'Distribute provenance - Exists' (no such sub-level exists on the producer requirement), and align the 'Choose an appropriate build platform' spelling across mappings. All 14 documents still pass cue vet against #OSPSMapping and the repo validate command. Signed-off-by: Eddie Knight <knight@linux.com>
eddie-knight
force-pushed
the
feat/mapping-documents
branch
from
July 7, 2026 14:11
a26eb21 to
a258c05
Compare
evankanderson
left a comment
Contributor
There was a problem hiding this comment.
I went through NIST-800-161 by hand, but then realized that I was gonna screw things up, so I wrote a pair of yq scripts:
Generate control>>spec::section mappings on repo head:
yq '.controls[] | {"id": .id} * .guidelines[] | {"id": .id, "ref": .reference-id} * .entries[] | .id + ">>" + .ref + "::" + .reference-id' baseline/OSPS-*.yaml | sort > tmp-original-mapsGenerate control>>spec::section mappings on Eddie's branch:
yq '{"ref": .target-reference.reference-id} * .mappings[] | {"id": .source, "ref": .ref} * .targets[] | .id + ">>" + .ref + "::" + .entry-id' baseline/mappings/*.yaml | sort > tmp-new-mapsDiff the two:
diff -u tmp-original-maps tmp-new-mapsResults:
-OSPS-AC-01>>800-161::1.2e
-OSPS-AC-01>>800-161::1.2f
OSPS-AC-01>>800-161::AC-17
OSPS-AC-01>>800-161::AC-4(21)
OSPS-AC-01>>800-161::CM-5
@@ -1076,8 +991,8 @@
OSPS-AC-01>>CRA::1.2d
OSPS-AC-01>>CRA::1.2e
OSPS-AC-01>>CRA::1.2f
-OSPS-AC-01>>CSF::PR.A-02
-OSPS-AC-01>>CSF::PR.A-05
+OSPS-AC-01>>CSF::PR.AA-02
+OSPS-AC-01>>CSF::PR.AA-05
OSPS-AC-01>>OpenCRE::124-564
OSPS-AC-01>>OpenCRE::152-725
OSPS-AC-01>>OpenCRE::201-246
@@ -1133,8 +1048,8 @@
OSPS-AC-03>>BSI-TR-03185-2::GV.02
OSPS-AC-03>>BSI-TR-03185-2::QA.06
OSPS-AC-03>>CRA::1.2f
-OSPS-AC-03>>CSF::PR.A-02
-OSPS-AC-03>>CSF::PR.A-05
+OSPS-AC-03>>CSF::PR.AA-02
+OSPS-AC-03>>CSF::PR.AA-05
OSPS-AC-03>>OpenCRE::124-564
OSPS-AC-03>>OpenCRE::152-725
OSPS-AC-03>>OpenCRE::486-813
@@ -1164,7 +1079,7 @@
OSPS-AC-04>>CSF::PR.AA-05
OSPS-AC-04>>OpenCRE::123-124
OSPS-AC-04>>OpenCRE::124-564
-OSPS-AC-04>>OpenCRE::263-284
+OSPS-AC-04>>OpenCRE::263-184
OSPS-AC-04>>OpenCRE::347-507
OSPS-AC-04>>OpenCRE::486-813
OSPS-AC-04>>PCIDSS::2.2.1
@@ -1172,7 +1087,7 @@
OSPS-AC-04>>PSSCRM::P3.2
OSPS-AC-04>>SAMM::Operations -Environment Management -Configuration Hardening Lvl1
OSPS-AC-04>>SLSA::Build platform - Isolation strength - Isolated
-OSPS-AC-04>>SLSA::Producer - Choose an appropriate build platform
+OSPS-AC-04>>SLSA::Choose an appropriate build platform
OSPS-AC-04>>SSDF::PO.2
OSPS-AC-04>>SSDF::PO.3.2
OSPS-AC-04>>SSDF::PS.1
@@ -1189,7 +1104,7 @@
OSPS-BR-01>>CRA::1.2f
OSPS-BR-01>>CSF::PR.AA-02
OSPS-BR-01>>OpenCRE::124-564
-OSPS-BR-01>>OpenCRE::357-352
+OSPS-BR-01>>OpenCRE::347-352
OSPS-BR-01>>OpenCRE::486-813
OSPS-BR-01>>PCIDSS::2.2.1
OSPS-BR-01>>PCIDSS::6.4.1
@@ -1223,8 +1138,9 @@
OSPS-BR-02>>PSSCRM::E2.1
OSPS-BR-02>>PSSCRM::E2.6
OSPS-BR-02>>PSSCRM::G1.4
+OSPS-BR-02>>SLSA::Build platform - Provenance generation - Authentic
+OSPS-BR-02>>SLSA::Build platform - Provenance generation - Exists
OSPS-BR-02>>SLSA::Follow a consistent build process
-OSPS-BR-02>>SLSA::Provenance generation- Exists, Authentic
OSPS-BR-02>>SSDF::PO.3.2
OSPS-BR-02>>SSDF::PS.1
OSPS-BR-02>>SSDF::PS.2
@@ -1244,7 +1160,7 @@
OSPS-BR-03>>CRA::1.2k
OSPS-BR-03>>OpenCRE::124-564
OSPS-BR-03>>OpenCRE::263-184
-OSPS-BR-03>>OpenCRE::483-813
+OSPS-BR-03>>OpenCRE::486-813
OSPS-BR-03>>PCIDSS::2.2.1
OSPS-BR-03>>PCIDSS::2.2.7
OSPS-BR-03>>PCIDSS::4.2.1
@@ -1287,7 +1203,7 @@
OSPS-BR-04>>OpenCRE::208-355
OSPS-BR-04>>OpenCRE::263-184
OSPS-BR-04>>OpenCRE::347-352
-OSPS-BR-04>>OpenCRE::483-813
+OSPS-BR-04>>OpenCRE::486-813
OSPS-BR-04>>OpenCRE::732-148
OSPS-BR-04>>OpenCRE::745-356
OSPS-BR-04>>OpenCRE::757-271
@@ -1302,7 +1218,7 @@
OSPS-BR-04>>PSSCRM::E3.1
OSPS-BR-04>>PSSCRM::E3.6
OSPS-BR-04>>PSSCRM::G1.4
-OSPS-BR-04>>SLSA::Build platform - Isolation strength - isolated
+OSPS-BR-04>>SLSA::Build platform - Isolation strength - Isolated
OSPS-BR-04>>SLSA::Choose an appropriate build platform
OSPS-BR-04>>SLSA::Follow a consistent build process
OSPS-BR-04>>SSDF::PS.1
@@ -1340,7 +1256,7 @@
OSPS-BR-05>>PSSCRM::P3.1
OSPS-BR-05>>PSSCRM::P3.5
OSPS-BR-05>>SAMM::Implementation -Secure Build -Build Process Lvl2
-OSPS-BR-05>>SLSA::Isolation strength - isolated
+OSPS-BR-05>>SLSA::Build platform - Isolation strength - Isolated
OSPS-BR-05>>SSDF::PO.3.2
OSPS-BR-05>>SSDF::PS.1
OSPS-BR-05>>SSDF::PS.2
@@ -1366,7 +1282,7 @@
OSPS-BR-06>>PSSCRM::P3.2
OSPS-BR-06>>PSSCRM::P3.3
OSPS-BR-06>>SAMM::Implementation -Secure Deployment -Deployment Process Lvl3
-OSPS-BR-06>>SLSA::Distribute provenance - Exists
+OSPS-BR-06>>SLSA::Distribute provenance
OSPS-BR-06>>SSDF::PO.5.2
OSPS-BR-06>>SSDF::PS.2
OSPS-BR-06>>SSDF::PS.2.1
@@ -1375,9 +1291,9 @@
OSPS-BR-06>>UKSSCOP::Claim 1.2.2
OSPS-BR-06>>UKSSCOP::Claim 3.1.1
OSPS-BR-07>>BPB::S-B-5
-OSPS-BR-07>>SSDF::P0.3.1
-OSPS-BR-07>>SSDF::P0.4.2
OSPS-BR-07>>SSDF::PO.1.1
+OSPS-BR-07>>SSDF::PO.3.1
+OSPS-BR-07>>SSDF::PO.4.2
OSPS-BR-07>>SSDF::PO.5.1
OSPS-BR-07>>SSDF::PW.1.2
OSPS-BR-07>>SSDF::PW.1.3
@@ -1571,7 +1487,6 @@
OSPS-DO-06>>UKSSCOP::3.3
OSPS-DO-06>>UKSSCOP::Claim 1.2.1
OSPS-DO-06>>UKSSCOP::Claim 1.2.2
-OSPS-DO-07>>::
OSPS-GV-01>>800-161::AC-2
OSPS-GV-01>>800-161::AC-3
OSPS-GV-01>>800-161::IA-2
@@ -1724,7 +1639,7 @@
OSPS-QA-01>>PSSCRM::E2.2
OSPS-QA-01>>PSSCRM::P3.5
OSPS-QA-01>>SAMM::Implementation -Secure Build -Build Process Lvl1
-OSPS-QA-01>>SLSA::Build platform - isolation strength - Isolated
+OSPS-QA-01>>SLSA::Build platform - Isolation strength - Isolated
OSPS-QA-01>>SSDF::PS.1
OSPS-QA-01>>SSDF::PS.2
OSPS-QA-01>>SSDF::PS.3
@@ -1747,8 +1662,8 @@
OSPS-QA-02>>CRA::2.1
OSPS-QA-02>>CRA::2.2
OSPS-QA-02>>CRA::2.3
+OSPS-QA-02>>CSF::ID.AM-01
OSPS-QA-02>>CSF::ID.AM-02
-OSPS-QA-02>>CSF::ID.AM.01
OSPS-QA-02>>ISO-18974::4.1.5
OSPS-QA-02>>ISO-18974::4.3.1
OSPS-QA-02>>OpenCRE::124-564
@@ -1802,9 +1717,9 @@
OSPS-QA-03>>PSSCRM::P4.2
OSPS-QA-03>>SAMM::Implementation -Secure Build -Build Process Lvl3
OSPS-QA-03>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl1
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl2
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl3
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl1
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl2
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl3
OSPS-QA-03>>SSDF::PO.4.1
OSPS-QA-03>>SSDF::PS.1
OSPS-QA-03>>SSDF::PS.2
@@ -1820,13 +1735,12 @@
OSPS-QA-04>>PCIDSS::6.4.2
OSPS-QA-04>>PSSCRM::G2.2
OSPS-QA-04>>PSSCRM::G5.4
-OSPS-QA-04>>SLSA::Build platform - isolation strength - Isolated
+OSPS-QA-04>>SLSA::Build platform - Isolation strength - Isolated
OSPS-QA-04>>SSDF::PO.3.2
OSPS-QA-04>>SSDF::PO.4.1
OSPS-QA-04>>SSDF::PS.1
OSPS-QA-04>>SSDF::PS.2
OSPS-QA-04>>SSDF::RV.1.2
-OSPS-QA-04>>Scorecard::Binary-Artifacts
OSPS-QA-05>>800-161::PL-8
OSPS-QA-05>>800-161::SA-15
OSPS-QA-05>>800-161::SR-3
@@ -1837,6 +1751,7 @@
OSPS-QA-05>>PCIDSS::6.4.3
OSPS-QA-05>>SSDF::PS.1
OSPS-QA-05>>SSDF::PS.2
+OSPS-QA-05>>Scorecard::Binary-Artifacts
OSPS-QA-06>>800-161::SA-11
OSPS-QA-06>>800-161::SA-15
OSPS-QA-06>>800-161::SR-3
@@ -1862,10 +1777,10 @@
OSPS-QA-06>>PSSCRM::P4.2
OSPS-QA-06>>PSSCRM::P4.3
OSPS-QA-06>>PSSCRM::P4.4
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl1
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl2
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl3
OSPS-QA-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl1
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl2
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl3
OSPS-QA-06>>SSDF::PW.8.2
OSPS-QA-06>>Scorecard::CI-Tests
OSPS-QA-07>>800-161::AC-5
@@ -1990,7 +1905,7 @@
OSPS-SA-03>>PSSCRM::P2.1
OSPS-SA-03>>SAMM::Design -Threat Assessment -Application Risk Profile Lvl1
OSPS-SA-03>>SAMM::Design -Threat Assessment -Threat Modeling Lvl1
-OSPS-SA-03>>SAMM::Governance -Create and Promote Lvl1
+OSPS-SA-03>>SAMM::Governance -Strategy & Metrics -Create and Promote Lvl1
OSPS-SA-03>>SAMM::Verification -Architecture Assessment -Architecture Mitigation Lvl2
OSPS-SA-03>>SSDF::PO.5.1
OSPS-SA-03>>SSDF::PW.1.1
@@ -2038,8 +1953,8 @@
OSPS-VM-01>>PSSCRM::D1.2
OSPS-VM-01>>PSSCRM::D1.3
OSPS-VM-01>>PSSCRM::D1.5
-OSPS-VM-01>>SAMM::Governance -Create and Promote Lvl2
OSPS-VM-01>>SAMM::Governance -Policy & Compliance -Policy & Standards Lvl1
+OSPS-VM-01>>SAMM::Governance -Strategy & Metrics -Create and Promote Lvl2
OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl1
OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl2
OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl3
@@ -2069,7 +1984,7 @@
OSPS-VM-02>>PCIDSS::12.1.1
OSPS-VM-02>>PCIDSS::12.10.2
OSPS-VM-02>>PCIDSS::6.3.3
-OSPS-VM-02>>SAMM::Governance -Policy&Compliance -Policy&Standards Lvl2
+OSPS-VM-02>>SAMM::Governance -Policy & Compliance -Policy & Standards Lvl2
OSPS-VM-02>>SSDF::RV.1.3
OSPS-VM-02>>Scorecard::Security-Policy
OSPS-VM-02>>UKSSCOP::3.2
@@ -2162,8 +2077,8 @@
OSPS-VM-05>>PSSCRM::P4.3
OSPS-VM-05>>PSSCRM::P4.4
OSPS-VM-05>>PSSCRM::P4.5
-OSPS-VM-05>>SAMM::Implementation -Secure Build-Build Process Lvl3
-OSPS-VM-05>>SAMM::Implementation -Software Dependencies Lvl3
+OSPS-VM-05>>SAMM::Implementation -Secure Build -Build Process Lvl3
+OSPS-VM-05>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
OSPS-VM-05>>SAMM::Verification -Security Testing -Scalable Baseline Lvl1
OSPS-VM-05>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
OSPS-VM-05>>SSDF::PO.4
@@ -2229,17 +2144,17 @@
OSPS-VM-06>>PSSCRM::P4.3
OSPS-VM-06>>PSSCRM::P4.4
OSPS-VM-06>>PSSCRM::P4.5
-OSPS-VM-06>>SAMM::Implementation -Secure Build-Build Process Lvl3
-OSPS-VM-06>>SAMM::Implementation -Software Dependencies Lvl3
+OSPS-VM-06>>SAMM::Implementation -Secure Build -Build Process Lvl3
+OSPS-VM-06>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
OSPS-VM-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl1
OSPS-VM-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
OSPS-VM-06>>SSDF::PO.4
OSPS-VM-06>>SSDF::PW.1.2
OSPS-VM-06>>SSDF::PW.8.1
-OSPS-VM-06>>SSDF::RV 2.2
OSPS-VM-06>>SSDF::RV.1.2
OSPS-VM-06>>SSDF::RV.1.3
OSPS-VM-06>>SSDF::RV.2.1
+OSPS-VM-06>>SSDF::RV.2.2Summary:
- Removed two 800-161 refs that look like a different format
- Renamed CSF
PR.A-*toPR.AA-*,ID.AM.01toID.AM-01 - OpenCRE
263-284->263-184and357-352->347-352,483-813->486-813 - Renamed a bunch of SLSA and SAMM references
- Renamed SSDF
P0.*toPO.*andRV 2.2toRV.2.2 - Removed an empty mapping for DO-07?
- Moved Scorecard's
Binary-Artifactscheck from QA-04 to QA-05
At least a few of these appear to be correct, but I haven't done the legwork to actually check either way.
We're also (consistently) doing something weird with hyphens where we spell things as " -" (space before but not after hyphen).
| - entry-id: CM-5 | ||
| - entry-id: CM-6 | ||
| - entry-id: IA-2 | ||
| - entry-id: IA-5 |
Contributor
There was a problem hiding this comment.
OSPS-AC also included references to 1.2e and 1.2f, which aren't here.
funnelfiasco
previously approved these changes
Jul 17, 2026
The SAMM crosswalk inherited an inconsistent " -" (space before, no space after) separator between business-function / practice / stream levels in its entry-ids. These are OSPS-authored concatenations, not verbatim external identifiers, and the SLSA crosswalk already uses the " - " convention throughout. Normalize all 44 SAMM targets to " - " so the mappings corpus uses a single separator style. Intra-word hyphens (Requirements-driven) are untouched. cue vet against #OSPSMapping still passes and the compiled render is unchanged apart from the separator spacing. Signed-off-by: Eddie Knight <knight@linux.com>
funnelfiasco
approved these changes
Aug 3, 2026
Contributor
Checking that these renames and moves (particularly the OpenCRE and Scorecard changes) are intentional, then I'm happy to approve. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This splits out the in-line mappings to standalone documents correspondings to Gemara v1.2.0+
This will be propagated to the website upon the next release.