scelint 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b16cbfa48415fa9683d44daf2788ade982a90ab980ed6c5149139f2d17d8c78
-  data.tar.gz: 78bb451017798298bac2460b9e2ab20761f0d1757b8d40d39880943baa4cdbc5
+  metadata.gz: a1e8f8d8e3eb96d5aa6bc36fb178f2b3cb283240ff04c37f469f4563693e94ee
+  data.tar.gz: d89de6916fd66be7a7572240e8d04606ce33201b964f58b455da8423e850d474
 SHA512:
-  metadata.gz: 661faabd127dde36f197f2bac4fad65daea62994d53d63a0df412408909d39e3c9b50de55f3a18977268f1f7a69ad1475da7e78711316c3261e3624381f02235
-  data.tar.gz: c260920fb4aa2ac12e45e7ed77c7ead6f2d2a4ce51eee488f85ffac52e081ec59f5c4f6d2f25be96bf2665b76b62a9972e4ced9f8715e69eb9a04e1d28f4a848
+  metadata.gz: 29896aa3398ae2a5503f304ec68968bf4e2944084dbbee5eee3056eba57cb843d3cc9e39eb1660bb6d679485548fed575e5a027a38ce9c3f2ef0cf2d34bc0900
+  data.tar.gz: f34b1e846bd6a188af09b9b5e5fc4fed0510c068ed05c09488ed845ba8e83f0ab46738551a005daa5a34cc4d6aef587bc8ca0a75b6a2833cc3482da452cd9243

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+### 0.7.0 / 2026-11-02
+* **BREAKING:** Report an error when files give a CE `oval-ids` for different
+  rules, as happens when two revisions of a benchmark ship together. Remove
+  the superseded files.
+
 ### 0.6.2 / 2026-11-02
 * Report the file and check when data cannot be merged instead of crashing
 * Report a `profiles`, `ce` or `checks` section that is not a hash, and a check's

data/lib/scelint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Scelint
-  VERSION = '0.6.2'
+  VERSION = '0.7.0'
 end

data/lib/scelint.rb

@@ -149,6 +149,8 @@ module Scelint
 
       merged_data_lint
 
+      check_ce_oval_ids
+
       validate
     end
 
@@ -801,8 +803,54 @@ module Scelint
       errors << "#{file}: #{e.message} (not a hash?)"
     end
 
+    # Report CEs that resolve to more than one rule
+    #
+    # A CE identifies one rule.  When two files give the same CE different
+    # oval-ids, the merged CE carries every one of them, and scan results
+    # can no longer be correlated back to a single rule with any confidence.
+    #
+    # In practice this is what a superseded benchmark file looks like from the
+    # inside: the old and new revisions both define the same CE keys, and the
+    # rule ids are where they diverge.
+    def check_ce_oval_ids
+      data.ces.each do |ce, component|
+        by_file = component.component[:fragments].each_with_object({}) do |(file, fragment), result|
+          next unless fragment.is_a?(Hash)
+
+          ids = Array(fragment['oval-ids']).select { |id| id.is_a?(String) && !id.empty? }
+          result[file] = ids unless ids.empty?
+        end
+
+        by_file.to_a.combination(2) do |(file_a, ids_a), (file_b, ids_b)|
+          next if same_rules?(ids_a, ids_b)
+
+          errors << "CE '#{ce}': conflicting oval-ids (#{ids_a.inspect} in #{file_a}, #{ids_b.inspect} in #{file_b})"
+        end
+      end
+    end
+
     private
 
+    # Return true if two sets of oval-ids name the same rules
+    #
+    # The same rule is routinely written two ways in one data set: a manual
+    # benchmark uses the bare rule id and its SCAP counterpart prefixes it, as in
+    # 'SV-230221r1017040_rule' and
+    # 'xccdf_mil.disa.stig_rule_SV-230221r1017040_rule'.  Those are not a
+    # disagreement, so the 'xccdf_<namespace>_rule_' prefix is ignored, and
+    # the remaining rule names are compared as sets.  The namespace may be
+    # written with '.' or ':', as in 'xccdf_org.ssgproject.content_rule_foo'
+    # and 'xccdf_org:ssgproject:content_rule_foo'.
+    #
+    # @param ids_a [Array<String>] A set of oval-ids
+    # @param ids_b [Array<String>] A set of oval-ids
+    # @return [Boolean]
+    def same_rules?(ids_a, ids_b)
+      rule_names = ->(ids) { ids.map { |id| id.sub(%r{\Axccdf_[^_]+_rule_}, '') }.uniq.sort }
+
+      rule_names.call(ids_a) == rule_names.call(ids_b)
+    end
+
     # Merge a ComplianceEngine::Collection object into a Hash
     #
     # Components that cannot be merged (usually because a fragment is

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scelint
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Steven Pritchard