OSCAL 1.1.0 Release

[nikitawootten-nist]

Summary

1.1.0 will be a minor release with important backwards-compatible enhances and bug-fixes around SSP, POA&M, profile, and cross-model metadata. Many of these feature enhancements have been pending release for over 12 months with neutral or positive community support.

Key takeaways and full details are below.

Changes: Key Takeaways

Models

1. SSP: Change certain elements from required to optional for non-RMF use cases.
2. SSP: improve constraints of links for cross-referencing components and indicating where components were imported from.
3. POAM: add related-findings assembly.
4. Profile: Remove with-parent-controls from the profile model.
5. Metadata: add group attribute to props
6. Metadata: add resource fragment to links (very useful for deep-linking into elements by UUID and point to sub-element UUID)
7. Metadata: add actions assembly to track approvals or request for changes status.
8. Metadata: correct how cross-references between controls and their parts are handled.
9. ⚠️ Mapping: re previous discussion, mapping, by itself or within catalog, has been moved out of the v1.1.0 release.

Profile Resolution and Process Specs

1. Aligning with model, remove with-parent-controls feature from Profile Resolution spec and unit tests.

Other

1. Website updates to reference model docs to improve performance.
2. ⚠️ We are going to include the website migration as part of the release (because of how GitHub works).

Details

Below is a list of every change that will be promoted from develop to a 1.1.0 release branch. The changes to models, docs, and code can be reviewed. All dependency changes from Dependabot and auto-committed website changes are excluded.

1. defe67ee0 Mapping model relocation 1/2: delete from develop (Mapping model relocation 1/2: delete from develop #1850)
2. 2d502f9b1 Added changes for Optional security-sensitivity-level #1798 (Added changes for #1798 #1842)
3. bc7efd38b 1797 allow local definition of asset type prop values (1797 allow local definition of asset type prop values #1821)
4. e5d24f910 Remove with-parent-controls developmental feature (Remove with-parent-controls developmental feature #1819)
5. be98b429c Removed default-mode to avoid apply-template loop when the stylesheet is applied to a document. (Restore proper mode handling for oscal-profile-test-helper.xsl #1804)
6. 7f5bf8051 Validating the current SP 800-53 catalog in oscal-content results in a missing key violation. This fixes that. (Fix broken cross reference enforcement in link rel=incorporated-into #1808)
7. 7e43b9a92 Only build and test with container on upstream (Don't build container for XSpec testing for fork-based PRs #1817)
8. 10c5efbb9 Add missing $ in Linux build setup steps (Add missing $ in Linux build setup steps #1779)
9. 97dcbc1ac Update Style for Generating Reference Model Anchors at Build Time (Update Style for Generating Reference Model Anchors at Build Time #1789)
10. ff951bd00 Feature profile resolution unittesting a (Feature profile resolution unittesting a #1770)
11. d43713a59 Specify classpath for Saxon under XSpec for Docker config for local dev environment doesn't properly set up XSpec #1743. (Specify classpath for Saxon under XSpec for #1743. #1744)
12. 574def6d0 Remove optional leveraged-authorization prop on implemented req. (Remove optional leveraged-authorization prop on implemented-requirement #1729)
13. e1861c198 Add the with-parent-controls for oscal_complete_schema.xsd (v1.0.4) lacks with-parent-controls attribute of include-controls element #1662. (Add the with-parent-controls for #1662. #1717)
14. adfae0828 Fix CSS for choice elements in outline docs (Fix CSS for choice elements in outline docs #1687)
15. d54cf495c Profile resolution how-to readmes (Profile resolution how-to readmes #1666)
16. 59ef15d23 Compatibility with Saxon 10 and 11 (Profile resolver: Compatibility with Saxon 10 and 11 #1685)
17. b267c6a0f Require (Warn) port start and end when protocol is specified. (Require (Warn) port start and end when protocol is specified. #1674)
18. fb8a0833c Fix Docker container build for local dev and debugging (Fix Docker container build for local dev and debugging #1598)
19. 95461753e Fix rel path from XSLT transform source issue, fix Profile Check Schematron Enhancements Fail in GHA Due to Relative Path Issues #1603. (Fix OSCAL Profile Schematron Relative Paths for GHA #1604)
20. d92a3b0cd Fixed improper use of allowed-values/allow-other. Ensured that all props in the OSCAL namespace are properly closed and all link rels are open for extension. (Adjustments to allowed-values/@allow-other #1579)
21. 49ba917ad Fixed syntax errors in metapaths (Fixed syntax errors in metapaths #1574)
22. 48a24583a Adds a constraint and index of by-component objects to support provided-by relation in links Provide Link Relations for by-component links in SSP #1022 (Adds a constraint and index of by-component objects to support provided-by relation in links #1022 #1452)
23. 0889a5a0c Added resource-fragment flag to link. (Adding resource-fragment flag to link #1527)
24. 30fae9d13 Add possible Schematron documentation checks (Add possible Schematron documentation checks #1501)
25. 9a1583e25 reduced the amount of 'OSCAL' references in data type documentation. (Reduced the amount of 'OSCAL' references in data type documentation #1531)
26. 354fe57ea Add profile checks with Schematron for Integrate profile checker Schematron into CI/CD oscal-content#128. (OSCAL Profile Checking with Schematron in CI/CD #1513)
27. a332ff061 Fix broken uri-use page links in updated reference docs of develop branch (Fix broken uri-use page links in updated reference docs of develop branch #1518)
28. f3371cc35 POAM related finding support, fixes POAM Item should have a related-finding assembly #1120 (POAM related finding support, fixes #1120 #1478)
29. 9e5793701 Support additional control-origination props SSP Control Implementation Scope/Origination #784 (Support additional control-origination props #784 #1460)
30. 61e19ef6f Updated data type documentation adding a note about why NCName was deprecated. Fixes Clarify Distinction Between OSCAL Data Types token and NCName in Website #1105 (Clarify difference between NCName and token data types #1480)
31. d5b66f6b0 Test modify phase, plus minor XSLT enhancements (Profile resolver: Test modify phase, plus minor XSLT enhancements #1321)
32. 988817c4b Updates to OSCAL Metaschema documentation and constraints (Updates to OSCAL Metaschema documentation and constraints #1263)
33. e5fa65f2b Implement opr:oscal-version and v:compare functions. (Implement opr:oscal-version function #1420)
34. 22f423e7a Add actions assembly to encode an action (i.e. approval) and its role, party, and approval date. (Add actions assembly to encode an action (i.e. approval) and its role, party, and approval date. #1052) ([RFC] Adding Actions to the OSCAL Metadata Assembly #1429)
35. 46e21da20 Added JSON value key for relationship type. This missing value key was discovered as part of Control Mapping in OSCAL JSON Allows an Empty Relationship Object #1458. (Mapping Relationship JSON Value Key #1462)
36. 0ed533b5e Update metaschema submodule for OSCAL Develop Branch SimpleType Type XSD Generation Missing #1454. (Update metaschema submodule for usnistgov/OSCAL#1454. #1455)
37. e93f12bb0 Fixed errors in profile resolution top-level tests based on content errors.
38. bc7b89206 imported-from relations for Add imported-from relation to links in SSP #1023. (Add imported-from link rel to relevant SSP assemblies #1403)
39. b43142a80 Create <define-assembly name="impact"> (fix Create an #assembly_oscal-ssp_impact SSP model #1129) (Create <define-assembly name="impact"> (fix #1129) #1171)
40. d3e475abc Adding link to whitelist
41. b8d5eccac More broken link fixes.
42. 6fb55e948 Fixed broken links.
43. 63b6e8688 Fixing broken links
44. b4f048501 Add assessment-assets assembly to local-definitions assembly in POAM model. assessment-assets missing in POAM's local-definitions #1291 (Add assessment-assets assembly to POAM model. #1291 #1417)
45. 6c80f4f9a Updates mapping model documentation to fix a copy and paste error. (Corrected mapping id-ref documentation #1409)
46. 3a75b0f0c Add grouping construct to props for Grouping of Properties in OSCAL documents other than Catalog #1064. (Add grouping construct to props for usnistgov/OSCAL#1064. #1412)
47. 4ef21bbd6 Added legacy Withdrawn status with deprecation entry (Added legacy Withdrawn status with deprecation entry #1419)
48. b972ec3f9 Profile alter model adjustments (Profile alter model adjustments #1418)
49. 1f01b5be2 Add remarks field to Profile model modify.alter (add/remove). Profile: add 'remarks' field to (modify.alter) add and remove #1018 (Add remarks field to Profile for modify.alter add/remove #1404)
50. 3ca36fbae Follow keep instruction for back-matter resources (Profile resolver: Follow keep instruction for back-matter resources #1378)
51. 76ff697a6 Test finish phase, plus minor XSLT enhancements and fixes (Profile resolver: Test finish phase, plus minor XSLT enhancements and fixes #1377)
52. dfb56e077 Profile Resolution spec: updated names of 'remove' directives (Profile Resolution spec: updated names of 'remove' directives #1381)
53. 0dcc24319 Clarify how to determine target catalog oscal-version (Clarify how to determine target catalog oscal-version #1386)
54. dc6a9b5d5 Profile Resolution Spec clarification: validation of imported catalogs and profiles (Profile Resolution Spec clarification: validating imports #1380)
55. 35798154f Update metaschema-docs
56. 6a7375b6c Fixes to correct metaschema validation errors.
57. feec035ef Update metaschema
58. d145dfe47 Support for control mapping (Support for control mapping #1150)
59. ef28023d2 Test merge phase, plus minor XSLT enhancements (Profile resolver: Test merge phase, plus minor XSLT enhancements #1207)
60. e88369d80 Profile resolver: Metadata tests and way of determining top UUID (Profile resolver: Metadata tests and way of determining top UUID #1175)
61. 48af7dcb3 Iterate over sequence of characters, not positions (Random function: Iterate over sequence of characters, not positions #1163)
62. 9c0e21ae3 Nonrecursive UUID functions plus XSpec tests (Nonrecursive UUID functions plus XSpec tests #1158)
63. 4b0126071 Use XSpec variable instead of entity (Use XSpec variable instead of entity #1136)
64. ee95ed8ad Profile resolver selection: XSpec additions and minor XSLT enhancements (Profile resolver selection: XSpec additions and minor XSLT enhancements #1101)
65. 98d2a7a19 reverting part constraints, since these are already handled
66. 84a7d45a1 Release 1.0 metaschema adjustments (Release 1.0 metaschema adjustments #1065)

Full Changelog: v1.0.5...v1.1.0

---

This discussion was created from the release OSCAL 1.1.0 Release.