Skip to content

feat: mapping documents - #527

Open
eddie-knight wants to merge 11 commits into
ossf:mainfrom
eddie-knight:feat/mapping-documents
Open

feat: mapping documents#527
eddie-knight wants to merge 11 commits into
ossf:mainfrom
eddie-knight:feat/mapping-documents

Conversation

@eddie-knight

@eddie-knight eddie-knight commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

This splits out the in-line mappings to standalone documents correspondings to Gemara v1.2.0+

This will be propagated to the website upon the next release.

Screenshot 2026-07-07 at 9 28 02 AM

Signed-off-by: Eddie Knight <knight@linux.com>
…ence IDs with catalog usage

Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
…framework crosswalks

Signed-off-by: Eddie Knight <knight@linux.com>
…ingDocument artifacts

Signed-off-by: Eddie Knight <knight@linux.com>
…d from mapping documents

Signed-off-by: Eddie Knight <knight@linux.com>
…orkflow

Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
…OpenCRE crosswalks

All nine ids were inherited from the original inline data and verified
against the authoritative frameworks:

- CSF 2.0: PR.A-02/PR.A-05 -> PR.AA-02/PR.AA-05 (no PR.A category
  exists; Identity Management, Authentication, and Access Control is
  PR.AA), and ID.AM.01 -> ID.AM-01 (subcategory ordinals are
  hyphen-delimited).
- SSDF v1.1: P0.3.1/P0.4.2 -> PO.3.1/PO.4.2 (digit zero for letter O),
  and 'RV 2.2' -> RV.2.2 (malformed separator).
- OpenCRE: 483-813 -> 486-813, 357-352 -> 347-352, 263-284 -> 263-184
  (transposition typos; originals return 404 from the OpenCRE API,
  corrected ids resolve and match usage elsewhere in the document).

Signed-off-by: Eddie Knight <knight@linux.com>
… in 800-161, Scorecard, SAMM, and SLSA crosswalks

All defects were inherited from the original inline data:

- 800-161: drop targets 1.2e and 1.2f from M-OSPS-AC-01; they are EU
  CRA Annex I identifiers, not SP 800-161 controls (the CRA crosswalk
  already carries them for OSPS-AC-01).
- Scorecard: reassign Binary-Artifacts from OSPS-QA-04 (multi-repo
  security requirements) to OSPS-QA-05, which owns the 'no binary
  artifacts in the repository' requirement.
- SAMM 2.0: repair entry ids that skipped or mis-split hierarchy
  levels (Requirements-driven Testing under Verification; Software
  Dependencies under Secure Build; Create and Promote under
  Strategy & Metrics) and normalize spacing so each SAMM stream is
  identified by exactly one string.
- SLSA 1.0: use one canonical spelling for the Isolated isolation
  requirement (previously five variants), split the malformed
  'Provenance generation- Exists, Authentic' into its two real
  sub-requirements, fix 'Distribute provenance - Exists' (no such
  sub-level exists on the producer requirement), and align the
  'Choose an appropriate build platform' spelling across mappings.

All 14 documents still pass cue vet against #OSPSMapping and the
repo validate command.

Signed-off-by: Eddie Knight <knight@linux.com>

@evankanderson evankanderson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I went through NIST-800-161 by hand, but then realized that I was gonna screw things up, so I wrote a pair of yq scripts:

Generate control>>spec::section mappings on repo head:

yq '.controls[] | {"id": .id} * .guidelines[] | {"id": .id, "ref": .reference-id} * .entries[] | .id + ">>" + .ref + "::" + .reference-id' baseline/OSPS-*.yaml | sort > tmp-original-maps

Generate control>>spec::section mappings on Eddie's branch:

yq '{"ref": .target-reference.reference-id} * .mappings[] | {"id": .source, "ref": .ref} * .targets[] | .id + ">>" + .ref + "::" + .entry-id' baseline/mappings/*.yaml | sort  > tmp-new-maps

Diff the two:

diff -u tmp-original-maps tmp-new-maps

Results:

-OSPS-AC-01>>800-161::1.2e
-OSPS-AC-01>>800-161::1.2f
 OSPS-AC-01>>800-161::AC-17
 OSPS-AC-01>>800-161::AC-4(21)
 OSPS-AC-01>>800-161::CM-5
@@ -1076,8 +991,8 @@
 OSPS-AC-01>>CRA::1.2d
 OSPS-AC-01>>CRA::1.2e
 OSPS-AC-01>>CRA::1.2f
-OSPS-AC-01>>CSF::PR.A-02
-OSPS-AC-01>>CSF::PR.A-05
+OSPS-AC-01>>CSF::PR.AA-02
+OSPS-AC-01>>CSF::PR.AA-05
 OSPS-AC-01>>OpenCRE::124-564
 OSPS-AC-01>>OpenCRE::152-725
 OSPS-AC-01>>OpenCRE::201-246
@@ -1133,8 +1048,8 @@
 OSPS-AC-03>>BSI-TR-03185-2::GV.02
 OSPS-AC-03>>BSI-TR-03185-2::QA.06
 OSPS-AC-03>>CRA::1.2f
-OSPS-AC-03>>CSF::PR.A-02
-OSPS-AC-03>>CSF::PR.A-05
+OSPS-AC-03>>CSF::PR.AA-02
+OSPS-AC-03>>CSF::PR.AA-05
 OSPS-AC-03>>OpenCRE::124-564
 OSPS-AC-03>>OpenCRE::152-725
 OSPS-AC-03>>OpenCRE::486-813
@@ -1164,7 +1079,7 @@
 OSPS-AC-04>>CSF::PR.AA-05
 OSPS-AC-04>>OpenCRE::123-124
 OSPS-AC-04>>OpenCRE::124-564
-OSPS-AC-04>>OpenCRE::263-284
+OSPS-AC-04>>OpenCRE::263-184
 OSPS-AC-04>>OpenCRE::347-507
 OSPS-AC-04>>OpenCRE::486-813
 OSPS-AC-04>>PCIDSS::2.2.1
@@ -1172,7 +1087,7 @@
 OSPS-AC-04>>PSSCRM::P3.2
 OSPS-AC-04>>SAMM::Operations -Environment Management -Configuration Hardening Lvl1
 OSPS-AC-04>>SLSA::Build platform - Isolation strength - Isolated
-OSPS-AC-04>>SLSA::Producer - Choose an appropriate build platform
+OSPS-AC-04>>SLSA::Choose an appropriate build platform
 OSPS-AC-04>>SSDF::PO.2
 OSPS-AC-04>>SSDF::PO.3.2
 OSPS-AC-04>>SSDF::PS.1
@@ -1189,7 +1104,7 @@
 OSPS-BR-01>>CRA::1.2f
 OSPS-BR-01>>CSF::PR.AA-02
 OSPS-BR-01>>OpenCRE::124-564
-OSPS-BR-01>>OpenCRE::357-352
+OSPS-BR-01>>OpenCRE::347-352
 OSPS-BR-01>>OpenCRE::486-813
 OSPS-BR-01>>PCIDSS::2.2.1
 OSPS-BR-01>>PCIDSS::6.4.1
@@ -1223,8 +1138,9 @@
 OSPS-BR-02>>PSSCRM::E2.1
 OSPS-BR-02>>PSSCRM::E2.6
 OSPS-BR-02>>PSSCRM::G1.4
+OSPS-BR-02>>SLSA::Build platform - Provenance generation - Authentic
+OSPS-BR-02>>SLSA::Build platform - Provenance generation - Exists
 OSPS-BR-02>>SLSA::Follow a consistent build process
-OSPS-BR-02>>SLSA::Provenance generation- Exists, Authentic
 OSPS-BR-02>>SSDF::PO.3.2
 OSPS-BR-02>>SSDF::PS.1
 OSPS-BR-02>>SSDF::PS.2
@@ -1244,7 +1160,7 @@
 OSPS-BR-03>>CRA::1.2k
 OSPS-BR-03>>OpenCRE::124-564
 OSPS-BR-03>>OpenCRE::263-184
-OSPS-BR-03>>OpenCRE::483-813
+OSPS-BR-03>>OpenCRE::486-813
 OSPS-BR-03>>PCIDSS::2.2.1
 OSPS-BR-03>>PCIDSS::2.2.7
 OSPS-BR-03>>PCIDSS::4.2.1
@@ -1287,7 +1203,7 @@
 OSPS-BR-04>>OpenCRE::208-355
 OSPS-BR-04>>OpenCRE::263-184
 OSPS-BR-04>>OpenCRE::347-352
-OSPS-BR-04>>OpenCRE::483-813
+OSPS-BR-04>>OpenCRE::486-813
 OSPS-BR-04>>OpenCRE::732-148
 OSPS-BR-04>>OpenCRE::745-356
 OSPS-BR-04>>OpenCRE::757-271
@@ -1302,7 +1218,7 @@
 OSPS-BR-04>>PSSCRM::E3.1
 OSPS-BR-04>>PSSCRM::E3.6
 OSPS-BR-04>>PSSCRM::G1.4
-OSPS-BR-04>>SLSA::Build platform - Isolation strength - isolated
+OSPS-BR-04>>SLSA::Build platform - Isolation strength - Isolated
 OSPS-BR-04>>SLSA::Choose an appropriate build platform
 OSPS-BR-04>>SLSA::Follow a consistent build process
 OSPS-BR-04>>SSDF::PS.1
@@ -1340,7 +1256,7 @@
 OSPS-BR-05>>PSSCRM::P3.1
 OSPS-BR-05>>PSSCRM::P3.5
 OSPS-BR-05>>SAMM::Implementation -Secure Build -Build Process Lvl2
-OSPS-BR-05>>SLSA::Isolation strength - isolated
+OSPS-BR-05>>SLSA::Build platform - Isolation strength - Isolated
 OSPS-BR-05>>SSDF::PO.3.2
 OSPS-BR-05>>SSDF::PS.1
 OSPS-BR-05>>SSDF::PS.2
@@ -1366,7 +1282,7 @@
 OSPS-BR-06>>PSSCRM::P3.2
 OSPS-BR-06>>PSSCRM::P3.3
 OSPS-BR-06>>SAMM::Implementation -Secure Deployment -Deployment Process Lvl3
-OSPS-BR-06>>SLSA::Distribute provenance - Exists
+OSPS-BR-06>>SLSA::Distribute provenance
 OSPS-BR-06>>SSDF::PO.5.2
 OSPS-BR-06>>SSDF::PS.2
 OSPS-BR-06>>SSDF::PS.2.1
@@ -1375,9 +1291,9 @@
 OSPS-BR-06>>UKSSCOP::Claim 1.2.2
 OSPS-BR-06>>UKSSCOP::Claim 3.1.1
 OSPS-BR-07>>BPB::S-B-5
-OSPS-BR-07>>SSDF::P0.3.1
-OSPS-BR-07>>SSDF::P0.4.2
 OSPS-BR-07>>SSDF::PO.1.1
+OSPS-BR-07>>SSDF::PO.3.1
+OSPS-BR-07>>SSDF::PO.4.2
 OSPS-BR-07>>SSDF::PO.5.1
 OSPS-BR-07>>SSDF::PW.1.2
 OSPS-BR-07>>SSDF::PW.1.3
@@ -1571,7 +1487,6 @@
 OSPS-DO-06>>UKSSCOP::3.3
 OSPS-DO-06>>UKSSCOP::Claim 1.2.1
 OSPS-DO-06>>UKSSCOP::Claim 1.2.2
-OSPS-DO-07>>::
 OSPS-GV-01>>800-161::AC-2
 OSPS-GV-01>>800-161::AC-3
 OSPS-GV-01>>800-161::IA-2
@@ -1724,7 +1639,7 @@
 OSPS-QA-01>>PSSCRM::E2.2
 OSPS-QA-01>>PSSCRM::P3.5
 OSPS-QA-01>>SAMM::Implementation -Secure Build -Build Process Lvl1
-OSPS-QA-01>>SLSA::Build platform - isolation strength - Isolated
+OSPS-QA-01>>SLSA::Build platform - Isolation strength - Isolated
 OSPS-QA-01>>SSDF::PS.1
 OSPS-QA-01>>SSDF::PS.2
 OSPS-QA-01>>SSDF::PS.3
@@ -1747,8 +1662,8 @@
 OSPS-QA-02>>CRA::2.1
 OSPS-QA-02>>CRA::2.2
 OSPS-QA-02>>CRA::2.3
+OSPS-QA-02>>CSF::ID.AM-01
 OSPS-QA-02>>CSF::ID.AM-02
-OSPS-QA-02>>CSF::ID.AM.01
 OSPS-QA-02>>ISO-18974::4.1.5
 OSPS-QA-02>>ISO-18974::4.3.1
 OSPS-QA-02>>OpenCRE::124-564
@@ -1802,9 +1717,9 @@
 OSPS-QA-03>>PSSCRM::P4.2
 OSPS-QA-03>>SAMM::Implementation -Secure Build -Build Process Lvl3
 OSPS-QA-03>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl1
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl2
-OSPS-QA-03>>SAMM::Verification -Requirements Testing -Control Verification Lvl3
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl1
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl2
+OSPS-QA-03>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl3
 OSPS-QA-03>>SSDF::PO.4.1
 OSPS-QA-03>>SSDF::PS.1
 OSPS-QA-03>>SSDF::PS.2
@@ -1820,13 +1735,12 @@
 OSPS-QA-04>>PCIDSS::6.4.2
 OSPS-QA-04>>PSSCRM::G2.2
 OSPS-QA-04>>PSSCRM::G5.4
-OSPS-QA-04>>SLSA::Build platform - isolation strength - Isolated
+OSPS-QA-04>>SLSA::Build platform - Isolation strength - Isolated
 OSPS-QA-04>>SSDF::PO.3.2
 OSPS-QA-04>>SSDF::PO.4.1
 OSPS-QA-04>>SSDF::PS.1
 OSPS-QA-04>>SSDF::PS.2
 OSPS-QA-04>>SSDF::RV.1.2
-OSPS-QA-04>>Scorecard::Binary-Artifacts
 OSPS-QA-05>>800-161::PL-8
 OSPS-QA-05>>800-161::SA-15
 OSPS-QA-05>>800-161::SR-3
@@ -1837,6 +1751,7 @@
 OSPS-QA-05>>PCIDSS::6.4.3
 OSPS-QA-05>>SSDF::PS.1
 OSPS-QA-05>>SSDF::PS.2
+OSPS-QA-05>>Scorecard::Binary-Artifacts
 OSPS-QA-06>>800-161::SA-11
 OSPS-QA-06>>800-161::SA-15
 OSPS-QA-06>>800-161::SR-3
@@ -1862,10 +1777,10 @@
 OSPS-QA-06>>PSSCRM::P4.2
 OSPS-QA-06>>PSSCRM::P4.3
 OSPS-QA-06>>PSSCRM::P4.4
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl1
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl2
+OSPS-QA-06>>SAMM::Verification -Requirements-driven Testing -Control Verification Lvl3
 OSPS-QA-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl1
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl2
-OSPS-QA-06>>SAMM::Verification-Requirements -Testing -Control Verification Lvl3
 OSPS-QA-06>>SSDF::PW.8.2
 OSPS-QA-06>>Scorecard::CI-Tests
 OSPS-QA-07>>800-161::AC-5
@@ -1990,7 +1905,7 @@
 OSPS-SA-03>>PSSCRM::P2.1
 OSPS-SA-03>>SAMM::Design -Threat Assessment -Application Risk Profile Lvl1
 OSPS-SA-03>>SAMM::Design -Threat Assessment -Threat Modeling Lvl1
-OSPS-SA-03>>SAMM::Governance -Create and Promote Lvl1
+OSPS-SA-03>>SAMM::Governance -Strategy & Metrics -Create and Promote Lvl1
 OSPS-SA-03>>SAMM::Verification -Architecture Assessment -Architecture Mitigation Lvl2
 OSPS-SA-03>>SSDF::PO.5.1
 OSPS-SA-03>>SSDF::PW.1.1
@@ -2038,8 +1953,8 @@
 OSPS-VM-01>>PSSCRM::D1.2
 OSPS-VM-01>>PSSCRM::D1.3
 OSPS-VM-01>>PSSCRM::D1.5
-OSPS-VM-01>>SAMM::Governance -Create and Promote Lvl2
 OSPS-VM-01>>SAMM::Governance -Policy & Compliance -Policy & Standards Lvl1
+OSPS-VM-01>>SAMM::Governance -Strategy & Metrics -Create and Promote Lvl2
 OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl1
 OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl2
 OSPS-VM-01>>SAMM::Implementation -Defect Management -Defect Tracking Lvl3
@@ -2069,7 +1984,7 @@
 OSPS-VM-02>>PCIDSS::12.1.1
 OSPS-VM-02>>PCIDSS::12.10.2
 OSPS-VM-02>>PCIDSS::6.3.3
-OSPS-VM-02>>SAMM::Governance -Policy&Compliance -Policy&Standards Lvl2
+OSPS-VM-02>>SAMM::Governance -Policy & Compliance -Policy & Standards Lvl2
 OSPS-VM-02>>SSDF::RV.1.3
 OSPS-VM-02>>Scorecard::Security-Policy
 OSPS-VM-02>>UKSSCOP::3.2
@@ -2162,8 +2077,8 @@
 OSPS-VM-05>>PSSCRM::P4.3
 OSPS-VM-05>>PSSCRM::P4.4
 OSPS-VM-05>>PSSCRM::P4.5
-OSPS-VM-05>>SAMM::Implementation -Secure Build-Build Process Lvl3
-OSPS-VM-05>>SAMM::Implementation -Software Dependencies Lvl3
+OSPS-VM-05>>SAMM::Implementation -Secure Build -Build Process Lvl3
+OSPS-VM-05>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
 OSPS-VM-05>>SAMM::Verification -Security Testing -Scalable Baseline Lvl1
 OSPS-VM-05>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
 OSPS-VM-05>>SSDF::PO.4
@@ -2229,17 +2144,17 @@
 OSPS-VM-06>>PSSCRM::P4.3
 OSPS-VM-06>>PSSCRM::P4.4
 OSPS-VM-06>>PSSCRM::P4.5
-OSPS-VM-06>>SAMM::Implementation -Secure Build-Build Process Lvl3
-OSPS-VM-06>>SAMM::Implementation -Software Dependencies Lvl3
+OSPS-VM-06>>SAMM::Implementation -Secure Build -Build Process Lvl3
+OSPS-VM-06>>SAMM::Implementation -Secure Build -Software Dependencies Lvl3
 OSPS-VM-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl1
 OSPS-VM-06>>SAMM::Verification -Security Testing -Scalable Baseline Lvl3
 OSPS-VM-06>>SSDF::PO.4
 OSPS-VM-06>>SSDF::PW.1.2
 OSPS-VM-06>>SSDF::PW.8.1
-OSPS-VM-06>>SSDF::RV 2.2
 OSPS-VM-06>>SSDF::RV.1.2
 OSPS-VM-06>>SSDF::RV.1.3
 OSPS-VM-06>>SSDF::RV.2.1
+OSPS-VM-06>>SSDF::RV.2.2

Summary:

  • Removed two 800-161 refs that look like a different format
  • Renamed CSF PR.A-* to PR.AA-*, ID.AM.01 to ID.AM-01
  • OpenCRE 263-284 -> 263-184 and 357-352 -> 347-352, 483-813 -> 486-813
  • Renamed a bunch of SLSA and SAMM references
  • Renamed SSDF P0.* to PO.* and RV 2.2 to RV.2.2
  • Removed an empty mapping for DO-07?
  • Moved Scorecard's Binary-Artifacts check from QA-04 to QA-05

At least a few of these appear to be correct, but I haven't done the legwork to actually check either way.

We're also (consistently) doing something weird with hyphens where we spell things as " -" (space before but not after hyphen).

- entry-id: CM-5
- entry-id: CM-6
- entry-id: IA-2
- entry-id: IA-5

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OSPS-AC also included references to 1.2e and 1.2f, which aren't here.

funnelfiasco
funnelfiasco previously approved these changes Jul 17, 2026
The SAMM crosswalk inherited an inconsistent " -" (space before, no
space after) separator between business-function / practice / stream
levels in its entry-ids. These are OSPS-authored concatenations, not
verbatim external identifiers, and the SLSA crosswalk already uses the
" - " convention throughout.

Normalize all 44 SAMM targets to " - " so the mappings corpus uses a
single separator style. Intra-word hyphens (Requirements-driven) are
untouched. cue vet against #OSPSMapping still passes and the compiled
render is unchanged apart from the separator spacing.

Signed-off-by: Eddie Knight <knight@linux.com>
@evankanderson

Copy link
Copy Markdown
Contributor

Summary:

  • Removed two 800-161 refs that look like a different format
  • Renamed CSF PR.A-* to PR.AA-*, ID.AM.01 to ID.AM-01
  • OpenCRE 263-284 -> 263-184 and 357-352 -> 347-352, 483-813 -> 486-813
  • Renamed a bunch of SLSA and SAMM references
  • Renamed SSDF P0.* to PO.* and RV 2.2 to RV.2.2
  • Removed an empty mapping for DO-07?
  • Moved Scorecard's Binary-Artifacts check from QA-04 to QA-05

Checking that these renames and moves (particularly the OpenCRE and Scorecard changes) are intentional, then I'm happy to approve.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants