Skip to content

Commit c9c72eb

Browse files
vbakkevbakke
committed
Removed 'uuid:' in dependsOn: 
1 parent a659ac5 commit c9c72eb

File tree

8 files changed

+41
-70
lines changed

8 files changed

+41
-70
lines changed

‎src/assets/YAML/default/BuildAndDeployment/Deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ Build and Deployment:
182182
A documented inventory of dependencies used in artifacts like container images and containers
183183
exists.
184184
dependsOn:
185-
- uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts
185+
- 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts
186186
- SBOM of components
187187
difficultyOfImplementation:
188188
knowledge: 2
@@ -249,7 +249,7 @@ Build and Deployment:
249249
measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically).
250250
dependsOn:
251251
- Defined deployment process
252-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
252+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
253253
difficultyOfImplementation:
254254
knowledge: 2
255255
time: 2

‎src/assets/YAML/default/CultureAndOrganization/Process.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ Culture and Organization:
103103
usefulness: 3
104104
level: 2
105105
dependsOn:
106-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # inventory of production components
106+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # inventory of production components
107107
implementation:
108108
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo
109109
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify

‎src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ Implementation:
6868
usefulness: 4
6969
level: 3
7070
dependsOn:
71-
- uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging
71+
- e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging
7272
implementation:
7373
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops
7474
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies
@@ -150,7 +150,7 @@ Implementation:
150150
usefulness: 4
151151
level: 3
152152
dependsOn:
153-
- uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2
153+
- e7598ac4-b082-4e56-b7df-e2c6b426a5e2
154154
implementation:
155155
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops
156156
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies
@@ -182,7 +182,7 @@ Implementation:
182182
usefulness: 3
183183
level: 3
184184
dependsOn:
185-
- uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2
185+
- e7598ac4-b082-4e56-b7df-e2c6b426a5e2
186186
implementation:
187187
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops
188188
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies

‎src/assets/YAML/default/InformationGathering/TestKPI.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ Information Gathering:
9090
usefulness: 3
9191
level: 2
9292
dependsOn:
93-
- uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches
93+
- 8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches
9494
implementation: []
9595
references:
9696
samm2:
@@ -151,8 +151,8 @@ Information Gathering:
151151
usefulness: 3
152152
level: 4
153153
dependsOn:
154-
- uuid:86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR
155-
- uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches
154+
- 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR
155+
- 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches
156156
implementation: []
157157
references:
158158
samm2:

‎src/assets/YAML/default/TestAndVerification/Consolidation.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ Test and Verification:
2121
- The number of network hops required to reach the asset (recommended)
2222
- Authentication requirements for access (recommended)
2323
dependsOn:
24-
- uuid:44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher:
25-
#- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO
26-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
24+
- 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher:
25+
#- 3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO
26+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
2727
implementation:
2828
references:
2929
samm2:
@@ -372,9 +372,9 @@ Test and Verification:
372372
resources: 2
373373
usefulness: 2
374374
dependsOn:
375-
- uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV
376-
- uuid:6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion
377-
- uuid:185d5a74-19dc-4422-be07-44ea35226783 # Office Hours
375+
- f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV
376+
- 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion
377+
- 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours
378378
level: 3
379379
description: |-
380380
For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.

‎src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ Test and Verification:
142142
implementation:
143143
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/netassert
144144
dependsOn:
145-
- uuid:4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments
145+
- 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments
146146
references:
147147
samm2:
148148
- V-ST-A-2

‎src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ Test and Verification:
159159
- 8.28 # Secure coding
160160
isImplemented: false
161161
dependsOn:
162-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
162+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
163163
Static analysis for all components/libraries:
164164
uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054
165165
risk: Used components like libraries and legacy applications might have vulnerabilities
@@ -173,7 +173,7 @@ Test and Verification:
173173
dependsOn:
174174
- Static analysis for important client side components
175175
- Static analysis for important server side components
176-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
176+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
177177
implementation: []
178178
references:
179179
samm2:
@@ -209,7 +209,7 @@ Test and Verification:
209209
dependsOn:
210210
- Static analysis for important client side components
211211
- Static analysis for important server side components
212-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
212+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
213213
references:
214214
samm2:
215215
- V-ST-A-2
@@ -244,7 +244,7 @@ Test and Verification:
244244
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension
245245
dependsOn:
246246
- Defined build process
247-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
247+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
248248
references:
249249
samm2:
250250
- V-ST-A-2
@@ -277,7 +277,7 @@ Test and Verification:
277277
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension
278278
dependsOn:
279279
- Defined build process
280-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
280+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
281281
references:
282282
samm2:
283283
- V-ST-A-2
@@ -333,7 +333,7 @@ Test and Verification:
333333
usefulness: 4
334334
level: 3
335335
dependsOn:
336-
- uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server
336+
- d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server
337337
implementation:
338338
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/cisa-kev
339339
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/epss
@@ -357,8 +357,8 @@ Test and Verification:
357357
level: 3
358358
dependsOn:
359359
- Defined build process
360-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
361-
- uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV
360+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
361+
- f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV
362362
implementation:
363363
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js
364364
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit
@@ -390,7 +390,7 @@ Test and Verification:
390390
level: 2
391391
dependsOn:
392392
- Defined build process
393-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
393+
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
394394
implementation:
395395
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che
396396
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack

‎yaml-generation/generateDimensions.php‎

Lines changed: 16 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,6 @@
44

55
$errorMsg = array();
66
$implementationReferenceFile = "src/assets/YAML/default/implementations.yaml";
7-
$metadata = readYaml("src/assets/YAML/meta.yaml");
8-
9-
$teams = $metadata["teams"];
10-
if (sizeof($teams) == 0) {
11-
echo "Warning: No teams defined";
12-
}
13-
$teamsImplemented = array();
14-
foreach ($teams as $team) {
15-
$teamsImplemented[$team] = false;
16-
}
177

188
$files = glob("src/assets/YAML/default/*/*.yaml");
199
$dimensions = array();
@@ -67,12 +57,12 @@
6757

6858
foreach ($elements as $activityName => $activity) {
6959
if (!array_key_exists("level", $activity)) {
70-
array_push($errorMsg,"Missing 'level' attribute in activity: $activityName");
60+
array_push($errorMsg,"Missing 'level' attribute in activity: '$activityName'");
7161
}
7262

7363
// echo "$subdimension | $activityName\n";
7464
if (!array_key_exists("uuid", $activity)) {
75-
array_push($errorMsg, "$activityName is missing an uuid in $dimension");
65+
array_push($errorMsg, "'$activityName' is missing an uuid in '$dimension'");
7666
} else {
7767
$uuid = $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"];
7868
$tmp_activityName = getActivityNameByUuid($uuid, $dimensionsAggregated);
@@ -89,34 +79,6 @@
8979
if (!array_key_exists("tags", $activity)) {
9080
$dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"];
9181
}
92-
if (!array_key_exists("teamsImplemented", $activity)) {
93-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array();
94-
}
95-
$evidenceImplemented = array();
96-
if (array_key_exists("teamsEvidence", $activity) && is_array($activity["teamsEvidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) {
97-
foreach ($activity["teamsEvidence"] as $team => $evidenceForTeam) {
98-
if(!is_string($activity["teamsEvidence"][$team])) {
99-
echo "teamsEvidence for team $team in $activityName is not a string, ignoring";
100-
continue;
101-
}
102-
if (strlen($activity["teamsEvidence"][$team]) > 0) {
103-
$evidenceImplemented[$team] = true;
104-
} else {
105-
echo "Warning: '$activityName -> evidence -> $team' has no evidence set but should have";
106-
}
107-
}
108-
}
109-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] =
110-
array_merge(
111-
$teamsImplemented,
112-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"],
113-
$evidenceImplemented
114-
);
115-
if (!array_key_exists("openCRE", $activity["references"])) {
116-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array();
117-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"];
118-
}
119-
// can be removed in 2025
12082
if (array_key_exists("isImplemented", $activity)) {
12183
unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["isImplemented"]);
12284
}
@@ -136,13 +98,13 @@
13698
$dependsOnUuid = $matches[2];
13799
$dependsOn = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated);
138100
if (is_null($dependsOn)) {
139-
array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: $activityName)");
140-
} else if ($matches[1] == "") {
141-
echo "WARNING: DependsOn is not prefixed by 'uuid:' for $dependsOnUuid (in activity: $activityName)\n";
101+
array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: '$activityName')");
102+
} else if ($matches[1] != "") {
103+
echo "WARNING: DependsOn is prefixed by deprecated 'uuid:' for $dependsOnUuid (in activity: '$activityName'). Use activity name, or the uuid only\n";
142104
}
143105

144-
// echo "exchanged $dependsOnUuid with name $dependsOnActivityName\n";
145-
$dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOn;
106+
// Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below.
107+
$dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{ $dependsOnUuid # $dependsOn }";
146108

147109
} else {
148110
if (is_null(getUuidByActivityName($dependsOn, $dimensionsAggregated))) {
@@ -195,6 +157,15 @@
195157

196158
// Store generated data
197159
$dimensionsString = yaml_emit($dimensionsAggregated);
160+
161+
// Post-process to convert quoted UUID comments to inline comments
162+
// Pattern: `- '{ uuid #comment }'` becomes: `- uuid #comment`
163+
$dimensionsString = preg_replace(
164+
"/^(\s+- )'{\s*([0-9a-f-]+)\s+(#[^'}]*)\s*}'$/m",
165+
"$1$2 $3",
166+
$dimensionsString
167+
);
168+
198169
$targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml";
199170
echo "\nStoring to $targetGeneratedFile\n";
200171
file_put_contents($targetGeneratedFile, $dimensionsString);

0 commit comments

Comments
 (0)