platforms: in the rule no longer works

[jhrozek]

Description of problem:

We have a rule applications/openshift/api-server/api_server_api_priority_flowschema_catch_all that is supposed to run on a subset of OCP releases only. This doesn't work anymore.

The rule selects the platforms like this:

prodtype: ocp4


platforms:
  - ocp4.8
  - ocp4.9
  - ocp4.10

SCAP Security Guide Version:

today's master

Operating System Version:

OCP 4.10

Steps to Reproduce:

1. build the content
2. run the rule xccdf_org.ssgproject.content_rule_api_server_api_priority_flowschema_catch_all

Actual Results:

not applicable

Expected Results:

pass/fail

Additional Information/Debugging Steps:

Using git bisect, it seems like the last commit where the selection works is 9fcf5e2 and the first one where it doesn't is 6a8bc3c

I'm going to attach debug logs from both a good and a bad run.

[jhrozek]

notaplicable.log
pass.log

[evgenyz]

It looks like the problem is with platform Id. In the rule it is <xccdf-1.2:platform idref="#ocp4.10"/> and the platform itself is <xccdf-1.2:platform idref="cpe:/a:redhat:openshift_container_platform:4.10"/>.

[evgenyz]

BTW, profile references platform correctly.

[evgenyz]

It looks like it has already been fixed in cpe_applicability branch.

[jhrozek]

It looks like it has already been fixed in cpe_applicability branch.

Can we backport this fix to master sooner than when this branch merged? This is breaking some rules we had already released ...

[evgenyz]

It looks like it has already been fixed in cpe_applicability branch.

Can we backport this fix to master sooner than when this branch merged? This is breaking some rules we had already released

As soon as we figure out what exactly it was.

[evgenyz]

Note:

platforms:
  - ocp4.8 or ocp4.9 or ocp4.10

does work as intended.

[evgenyz]

We should deprecate list-like notation.

[jhrozek]

We should deprecate list-like notation.

Fine by me!

[marcusburghardt]

@evgenyz can you confirm if this issue can be closed, please?

[evgenyz]

Have we deprecated / dropped the platforms keyword?

[evgenyz]

I mean, we can close it, but the broken misleading platforms is how we got into this problem in the first place.