Skip to content

feat: mapping documents #527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eddie-knight wants to merge 11 commits into
base: main
Choose a base branch
from
Open

feat: mapping documents #527

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
380563a
chore(schema): bump Gemara dependency to v1.2.0
eddie-knight May 29, 2026
c3d396d
chore(baseline): bump gemara-version to 1.2.0 and align mapping-refer…
eddie-knight May 29, 2026
2e14237
feat(schema): add #OSPSMapping definition for OSPS mapping documents
eddie-knight May 29, 2026
b301724
feat(baseline): add Gemara MappingDocument artifacts for 14 external …
eddie-knight May 29, 2026
0685341
refactor(cmd): load and render external framework relations from Mapp…
eddie-knight May 29, 2026
1852f73
refactor(baseline): remove inline guidelines from controls now source…
eddie-knight May 29, 2026
fbc4ec5
ci: validate mapping documents against #OSPSMapping in cue-validate w…
eddie-knight May 29, 2026
53ade4e
ci: set author to openssf
eddie-knight May 29, 2026
495d664
fix(mappings): correct provably-invalid target ids in CSF, SSDF, and …
eddie-knight Jul 7, 2026
a258c05
fix(mappings): correct misattributed and inconsistently-named targets…
eddie-knight Jul 7, 2026
c8d3d6c
fix(mappings): normalize SAMM target separators to " - "
eddie-knight Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/cue-validate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,11 @@ jobs:

- name: Validate catalog against CUE schema
run: cd schema && cue vet -d '#OSPSBaseline' . ../baseline.gemara.yaml

- name: Validate mapping documents against CUE schema
run: |
cd schema
for f in ../baseline/mappings/*.yaml; do
echo "vetting $f"
cue vet -d '#OSPSMapping' . "$f"
done
201 changes: 0 additions & 201 deletions baseline/OSPS-AC.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,66 +17,6 @@ controls:
multi-factor authentication for collaborators modifying the project
repository settings or accessing sensitive data.
group: AC
guidelines:
- reference-id: BPB
entries:
- reference-id: CC-G-1
- reference-id: CRA
entries:
- reference-id: 1.2d
- reference-id: 1.2e
- reference-id: 1.2f
- reference-id: SSDF
entries:
- reference-id: PO.3.2
- reference-id: PS.1
- reference-id: PS.2
- reference-id: CSF
entries:
- reference-id: PR.A-02
- reference-id: PR.A-05
- reference-id: OpenCRE
entries:
- reference-id: 486-813
- reference-id: 124-564
- reference-id: 347-352
- reference-id: 333-858
- reference-id: 152-725
- reference-id: 201-246
- reference-id: PSSCRM
entries:
- reference-id: G2.6
- reference-id: P3.3
- reference-id: E1.2
- reference-id: E1.3
- reference-id: E1.4
- reference-id: E3.1
- reference-id: SAMM
entries:
- reference-id: Operations -Environment Management -Configuration Hardening Lvl1
- reference-id: PCIDSS
entries:
- reference-id: 2.2.1
- reference-id: 8.2.1
- reference-id: 8.3.1
- reference-id: 800-161
entries:
- reference-id: AC-4(21)
- reference-id: AC-17
- reference-id: CM-5
- reference-id: CM-6
- reference-id: IA-2
- reference-id: IA-5
- reference-id: 1.2e
- reference-id: 1.2f
- reference-id: UKSSCOP
entries:
- reference-id: Claim 1.4.2
- reference-id: Claim 2.1.5
- reference-id: Claim 2.2.2
- reference-id: BSI-TR-03185-2
entries:
- reference-id: GV.02
assessment-requirements:
- id: OSPS-AC-01.01
text: |
Expand All @@ -100,50 +40,6 @@ controls:
Reduce the risk of unauthorized access to the project's repository by
limiting the permissions granted to new collaborators.
group: AC
guidelines:
- reference-id: CRA
entries:
- reference-id: 1.2f
- reference-id: SSDF
entries:
- reference-id: PO.2
- reference-id: PO.3.2
- reference-id: PS.1
- reference-id: PS.2
- reference-id: CSF
entries:
- reference-id: PR.AA-02
- reference-id: PR.AA-05
- reference-id: OpenCRE
entries:
- reference-id: 486-813
- reference-id: 124-564
- reference-id: 802-056
- reference-id: 368-633
- reference-id: 152-725
- reference-id: PSSCRM
entries:
- reference-id: P2.3
- reference-id: E1.2
- reference-id: E3.3
- reference-id: PCIDSS
entries:
- reference-id: 2.2.1
- reference-id: 800-161
entries:
- reference-id: AC-2
- reference-id: AC-3
- reference-id: AC-4(21)
- reference-id: AC-5
- reference-id: AC-6
- reference-id: CM-5
- reference-id: CM-7
- reference-id: UKSSCOP
entries:
- reference-id: Claim 2.2.2
- reference-id: BSI-TR-03185-2
entries:
- reference-id: GV.02
assessment-requirements:
- id: OSPS-AC-02.01
text: |
Expand All @@ -167,51 +63,6 @@ controls:
Reduce the risk of accidental changes or deletion of the primary branch
of the project's repository by preventing unintentional modification.
group: AC
guidelines:
- reference-id: CRA
entries:
- reference-id: 1.2f
- reference-id: SSDF
entries:
- reference-id: PO.3.2
- reference-id: PS.1
- reference-id: PS.2
- reference-id: CSF
entries:
- reference-id: PR.A-02
- reference-id: PR.A-05
- reference-id: OpenCRE
entries:
- reference-id: 486-813
- reference-id: 124-564
- reference-id: 152-725
- reference-id: Scorecard
entries:
- reference-id: Branch-Protection
- reference-id: PSSCRM
entries:
- reference-id: P3.2
- reference-id: P3.5
- reference-id: E1.5
- reference-id: E3.1
- reference-id: PCIDSS
entries:
- reference-id: 2.2.1
- reference-id: 800-161
entries:
- reference-id: AC-3
- reference-id: AC-5
- reference-id: CM-3
- reference-id: CM-3(2)
- reference-id: CM-5
- reference-id: UKSSCOP
entries:
- reference-id: Claim 1.1.4
- reference-id: Claim 2.2.2
- reference-id: BSI-TR-03185-2
entries:
- reference-id: GV.02
- reference-id: QA.06
assessment-requirements:
- id: OSPS-AC-03.01
text: |
Expand Down Expand Up @@ -248,58 +99,6 @@ controls:
processes by limiting the permissions granted to steps within the CI/CD
pipelines.
group: AC
guidelines:
- reference-id: CRA
entries:
- reference-id: 1.2d
- reference-id: 1.2e
- reference-id: 1.2f
- reference-id: SSDF
entries:
- reference-id: PO.2
- reference-id: PO.3.2
- reference-id: PS.1
- reference-id: PS.2
- reference-id: CSF
entries:
- reference-id: PR.AA-02
- reference-id: PR.AA-05
- reference-id: OpenCRE
entries:
- reference-id: 486-813
- reference-id: 124-564
- reference-id: 347-507
- reference-id: 263-284
- reference-id: 123-124
- reference-id: SLSA
entries:
- reference-id: Producer - Choose an appropriate build platform
- reference-id: Build platform - Isolation strength - Isolated
- reference-id: PSSCRM
entries:
- reference-id: P3.2
- reference-id: SAMM
entries:
- reference-id: Operations -Environment Management -Configuration Hardening Lvl1
- reference-id: PCIDSS
entries:
- reference-id: 2.2.1
- reference-id: 8.2.1
- reference-id: 800-161
entries:
- reference-id: AC-3(8)
- reference-id: AC-4
- reference-id: AC-4(6)
- reference-id: AC-6
- reference-id: AC-20
- reference-id: AC-20(1)
- reference-id: CM-5
- reference-id: CM-7
- reference-id: UKSSCOP
entries:
- reference-id: Claim 2.1.1
- reference-id: Claim 2.1.3
- reference-id: Claim 2.2.2
assessment-requirements:
- id: OSPS-AC-04.01
text: |
Expand Down
Loading
Loading