Release v1.1

* Add organize-tool for automated file/folder management
* Add workspace selection to C5-DEC interaction session
* Update user manual: SSDLC, README

Author: CryptographySandbox

CHANGELOG.md

@@ -1,3 +1,21 @@
+# 1.1 (2025-05-12)
+
+## Added
+
+- The open-source `organize-tool` to the `C5-DEC dev container` for automated file/folder management
+- Custom workspace management (e.g., a user-defined path to directory residing outside project folder) via the C5-DEC interactive session: `c5dec.sh session <workspace>`
+- Table of contents to the SSDLC manual page
+
+## Modified
+
+- User manual pages related to SSDLC to detail the new workspace management feature, AI-enabled design and specification for the C5-DEC method, the new `organize-tool`, and integrated the Transformer page
+- README to detail the roadmap items related to including privacy-aware local GenAI models and RAG capabilities and the inclusion of verified implementations of cryptographic algorithms
+
+## Removed
+
+- The manual pages for the deprecated ISMS feature
+- The Transformer manual page that has been moved to the SSDLC manual page
+
 # 1.0 (2025-05-07)
 
 Version 1.0 marks the stable release of C5-DEC.

README.md

@@ -4,7 +4,7 @@ C5-DEC, short for "Common Criteria for Cybersecurity, Cryptography, Clouds – D
 
 <img src="./docs/manual/_figures/CyFORT-C5CEC-logo.png" alt="cyfort_logo" width="500"/>
 
-C5-DEC CAD, the software component of C5-DEC, is a suite of tools for computer-aided design and development (CAD) enforcing the C5-DEC method, The method mainly deals with the creation and evaluation of secure IT systems following a structured and systematic approach, based on the [Common Criteria](https://www.commoncriteriaportal.org) standards, a secure software development life cycle (SSDLC) method, a software verification and validation model (SVVM), and our cyber-physical system security assessment (CPSSA) method.
+C5-DEC CAD, the software component of C5-DEC, is a suite of [AI-enabled](./docs/manual/ssdlc.md#ai-enabled-design-and-specification) tools for computer-aided design and development (CAD) enforcing the C5-DEC method. The method mainly deals with the creation and evaluation of secure IT systems following a structured and systematic approach, based on the [Common Criteria](https://www.commoncriteriaportal.org) standards, a secure software development life cycle (SSDLC) method, a software verification and validation model (SVVM), and our cyber-physical system security assessment (CPSSA) method.
 
 This repository contains the source code and full documentation (requirements, technical specifications, schematics, [user manual](./docs/manual/overview.md), test case specifications and test reports) of C5-DEC CAD, exemplifying the C5-DEC method, which relies on storing, interlinking and processing all software development life cycle (SDLC) artifacts in a unified manner; see our [traceability web page](https://abstractionslab.github.io/c5dec/docs/traceability/index.html) for a concrete example reflecting the technical specifications of C5-DEC CAD itself.
 
@@ -28,6 +28,8 @@ To this end, C5-DEC CAD is aimed at assisting both system/software designers/dev
 
 C5-DEC consists of two key elements that complement each other to form a coherent ensemble: a software component (C5-DEC CAD) and a knowledge base (KB) consisting of SSDLC, SVV and CPSSA methodologies as well as a [wiki of key CC concepts](./c5dec/assets/database/KnowledgeBase/0_MapofContent.md).
 
+### Knowledge base
+
 As certain parts of our KB reports rely on ISO standards (ISO/IEC/IEEE 12207, ISO 29119:2022 and ISO 29148:2018), if you wish to access them, please contact us at info@abstractionslab.lu. Simply provide evidence that you are eligible for accessing the standard(s), and upon successful verification, we will share the reports.
 
 ## Features
@@ -62,22 +64,12 @@ As certain parts of our KB reports rely on ISO standards (ISO/IEC/IEEE 12207, IS
 
 ### Secure software development life cycle (SSDLC)
 
-- The KB report is inspired by and builds on ISO/IEC/IEEE 12207 - Software life cycle processes, the European Cooperation for Space Standardization (ECSS) standard ECSS-E-ST-40C, ISO/IEC/IEEE 29119:2022 Software testing, ISO/IEC/IEEE 29148:2018 Requirements engineering, the DevSecOps Platform Independent Model (PIM) by the Software Engineering Institute (SEI) of Carnegie Mellon University (CMU), SAFECode, OWASP, as well as McGraw’s publications on software security;
-- A KB report on software verification and validation (SVV) complementing the SSDLC;
+- The SSDLC report, part of the [C5-DEC KB](#knowledge-base), is inspired by and builds on ISO/IEC/IEEE 12207 - Software life cycle processes, the European Cooperation for Space Standardization (ECSS) standard ECSS-E-ST-40C, ISO/IEC/IEEE 29119:2022 Software testing, ISO/IEC/IEEE 29148:2018 Requirements engineering, the DevSecOps Platform Independent Model (PIM) by the Software Engineering Institute (SEI) of Carnegie Mellon University (CMU), SAFECode, OWASP, as well as McGraw’s publications on software security;
+- Create [new project repositories based on C5-DEC (batteries included)](./docs/manual/ssdlc.md#c5-dec-project-creation): a fresh development repository with containerized development artifacts, all dependencies installed, templates, DocEngine, source code and technical specification processing software for enhancing [SSDLC](./docs/manual/ssdlc.md) and enforcing the C5-DEC method, powered by [Doorstop](https://github.com/doorstop-dev/doorstop), and [**AI-enabled**](./docs/manual/ssdlc.md#ai-enabled-design-and-specification) approach facilitating the generation and [processing of technical specifications](#c5-dec-vs-code-workbench-and-containerized-development-environment), documentation, and design artifacts, including requirements, test cases, and technical reports;
 - C5-DEC [DocEngine](./docs/manual/ssdlc.md#c5-dec-docengine-for-report-generation): a flexible, easily extensible, and complete publishing solution based on [Quarto](https://quarto.org/) (an open-source scientific and technical publishing system), enhanced by our Quarto configurations, dedicated LaTeX customizations and pre-render and post-render Python scripts providing a baseline automated publishing pipeline (see [SSDLC](./docs/manual/ssdlc.md) and [CCT](./docs/manual/cct.md));
-- Create new project repositories based on C5-DEC (batteries included): a fresh development repository with containerized development artifacts, all dependencies installed, templates, DocEngine, source code and technical specification processing software for enhancing [SSDLC](./docs/manual/ssdlc.md) and enforcing the C5-DEC method, powered by [Doorstop](https://github.com/doorstop-dev/doorstop);
-- [Transformer](./docs/manual/transformer.md): a module dedicated to universal document transformation and conversion based on our integration of [Doorstop](https://github.com/doorstop-dev/doorstop), [Quarto](https://github.com/quarto-dev/quarto) and [Pandoc](https://pandoc.org/).
-
-### Cryptography
+- [Transformer](./docs/manual/ssdlc.md#transformer): a suite of integrated tools dedicated to universal document transformation, format conversion, content import/export, publishing, and file management automation based on our customized use of [Doorstop](https://github.com/doorstop-dev/doorstop), [Quarto](https://github.com/quarto-dev/quarto), [pandoc](https://pandoc.org/) and [organize](https://github.com/tfeldmann/organize);
+- Another [KB](#knowledge-base) element dedicated to software verification and validation (SVV) complementing the SSDLC.
 
-- A containerized and pre-configured deployment of open-source cryptographic software in the development environment for classical cryptography: [GnuPG](https://gnupg.org/), [Kryptor](https://www.kryptor.co.uk/), [Cryptomator CLI](https://github.com/cryptomator/cli);
-- A VS Code dev container packaging of [OQS-OpenSSL provider](https://github.com/open-quantum-safe/oqs-provider) for post-quantum cryptography.
-- A [guide](./docs/manual/cryptography.md) on the use of the integrated cryptographic software.
-
-### Cyber-Physical System Security Assessment
-
-- A KB report describing the C5-DEC method for Cyber-Physical System Security Assessment (CPSSA);
-- A [guide](./docs/manual/cpssa.md) on the use of existing open-source software to enforce the CPSSA method.
 
 ### Project (resource) management
 
@@ -86,6 +78,17 @@ As certain parts of our KB reports rely on ISO standards (ISO/IEC/IEEE 12207, IS
 - [Consolidation](./docs/manual/pm.md#time-report-consolidation-assistant) of C5-DEC time sheets;
 - Dedicated software for detailed resource and [cost computations](./docs/manual/pm.md#cost-report-computation).
 
+### Cyber-Physical System Security Assessment
+
+- Our CPSSA report, a third [KB element](#knowledge-base), describing the C5-DEC method for Cyber-Physical System Security Assessment (CPSSA);
+- A [guide](./docs/manual/cpssa.md) on the use of existing open-source software to enforce the CPSSA method.
+
+### Cryptography
+
+- A containerized and pre-configured deployment of open-source cryptographic software in the development environment for classical cryptography: [GnuPG](https://gnupg.org/), [Kryptor](https://www.kryptor.co.uk/), [Cryptomator CLI](https://github.com/cryptomator/cli);
+- A VS Code dev container packaging of [OQS-OpenSSL provider](https://github.com/open-quantum-safe/oqs-provider) for post-quantum cryptography.
+- A [guide](./docs/manual/cryptography.md) on the use of the integrated cryptographic software.
+
 ## User manual
 
 Please see the [CAD user manual](./docs/manual/overview.md) to learn more about the installation, setup requirements, overall usage and specific modules of C5-DEC CAD. A concise guide for getting quickly started is given below.
@@ -98,7 +101,7 @@ You can visit our [traceability page](https://abstractionslab.github.io/c5dec/do
 
 C5-DEC CAD can be deployed using any of the following methods:
 
-1. Deployment using Docker and our shell scripts: `build-c5dec.sh` and `c5dec.sh`: our runner script (`c5dec.sh`) offers a command mode tailored to the use of the Common Criteria Toolbox (CCT) and the Project Management (PM) modules, as well as an interactive session mode (`c5dec.sh session`) for using the [Transformer](./docs/manual/transformer.md) and [Cryptography](./docs/manual/cryptography.md) features and a PQC entrypoint (`c5dec.sh pqc`).
+1. Deployment using Docker and our shell scripts: `build-c5dec.sh` and `c5dec.sh`: our runner script (`c5dec.sh`) offers a command mode tailored to the use of the Common Criteria Toolbox (CCT) and the Project Management (PM) modules, as well as an interactive session mode (`c5dec.sh session`) for using the [Transformer](./docs/manual/ssdlc.md#transformer) and [Cryptography](./docs/manual/cryptography.md) features and a PQC entrypoint (`c5dec.sh pqc`).
 2. Deployment in a containerized development environment in VS Code (**recommended for advanced usage, development, data science**): this mode is the preferred option for effective use of the Quarto-based [DocEngine](./docs/manual/ssdlc.md#c5-dec-docengine-for-report-generation), Cryptography and Transformer modules. Note that all the features available via the CLI, TUI and GUI when using the deployment model (1) would also be available using this second approach.
 
 For more details on the installation options, please see the [installation](./docs/manual/installation.md) page of the user manual.
@@ -177,12 +180,14 @@ A summary of the `c5dec.sh` runner options are provided below:
 ./c5dec.sh <command> -h
 ```
 
-- To start an interactive C5-DEC session for using the [Transformer](./docs/manual/transformer.md) and [Cryptography](./docs/manual/cryptography.md) features:
+- To start an interactive C5-DEC session for using the [Transformer](./docs/manual/ssdlc.md#transformer) and [Cryptography](./docs/manual/cryptography.md) features:
 
 ```sh
-./c5dec.sh session
+./c5dec.sh session <workspace>
 ```
 
+The argument `<workspace>` can be optionally used to provide the path to a directory on the user's file system (outside the C5-DEC folder); see the [usage section of the start page](./docs/manual/start.md#usage) for more details.
+
 - To use the [OQS-OpenSSL](./docs/manual/cryptography.md#post-quantum-cryptography-pqc) provider for post-quantum cryptography:
 
 ```sh
@@ -234,13 +239,17 @@ This would launch the GUI, as shown below, starting a web server that listens on
 
 ### C5-DEC VS Code workbench and containerized development environment
 
-Finally, within VS Code, you can access the various user interfaces in the same workbench while also benefitting from dedicated VS Code extensions integrated into our containerized development environment (e.g., Code Spell Checker, Quarto, Jupyter, Data Wrangler, Docker) as well as the code editor's own built-in features.
+Finally, using VS Code, you can access the various user interfaces in the same workbench while also benefitting from dedicated VS Code extensions integrated into our containerized development environment (e.g., Code Spell Checker, Quarto, Jupyter, Data Wrangler, Docker) as well as the code editor's own built-in features. The screenshot below highlights an example of how the [C5-DEC method lends itself to AI-powered](./docs/manual/ssdlc.md#ai-enabled-design-and-specification) capabilities.
 
 ![C5-DEC CAD in VS Code](./docs/manual/_figures/c5dec-vscode-workbench.png)
 
 ## Roadmap
 
-For details on our roadmap and features planned for future releases, please see the [Wiki](https://github.com/AbstractionsLab/c5dec/wiki) section of this repository.
+We will continue to enhance C5-DEC CAD with new features and improvements. Some of the planned features include:
+- Integrating locally stored generative AI (GenAI) models and implementing a GenAI assistant for the C5-DEC method enhancing its [AI-enabled design and technical specification](./docs/manual/ssdlc.md#ai-enabled-design-and-specification) approach with privacy-aware features and retrieval-augmented generation (RAG) capabilities;
+- Enhancing our cryptographic dependencies (e.g., [OQS-OpenSSL](https://github.com/open-quantum-safe/oqs-provider), [OpenSSH](https://www.openssh.com/)) with verified implementations, e.g., [EverCrypt](https://www.microsoft.com/en-us/research/publication/evercrypt-a-fast-veri%EF%AC%81ed-cross-platform-cryptographic-provider/) and [HACL*](https://hacl-star.github.io/HaclValeEverCrypt.html).
+
+For further details on our roadmap and features planned for future releases, please see the [Wiki](https://github.com/AbstractionsLab/c5dec/wiki) section of this repository.
 
 ## License
 

c5dec.sh

@@ -28,8 +28,22 @@ elif [ "$1" == "session" ]
 then
     # Create the Docker container and open a session for interactive use
     echo Launching an interactive C5-DEC CAD session...
+    # if the user volume is not specified, use the default
+    # Check if the user volume is specified
+    if [ -z "$2" ]
+    then
+        echo "No user directory specified. Using default: /home/$USER/c5dec/workspace"
+        echo "Host directory $(pwd)/workspace mapped to container directory /home/$USER/c5dec/workspace"
+        USER_VOLUME=$(pwd)/workspace:/home/$USER/workspace
+    else
+        echo "User directory specified: $2"
+        echo "Host directory $2 mapped to container directory /home/$USER/workspace"
+        USER_VOLUME=$2:/home/$USER/workspace
+    fi
+    # Check if the user volume is mounted
     docker run -it --rm --name $DEV_CONTAINER_NAME \
         -v $C5_VOLUME \
+        -v $USER_VOLUME \
         -p 5432:5432 \
         $DEV_IMAGE_NAME /bin/bash
 elif [ "$1" == "pqc" ]
@@ -45,7 +59,7 @@ then
     echo ---
     echo ./c5dec.sh
     echo ... to open the C5-DEC CLI help menu
-    echo ./c5dec.sh session
+    echo ./c5dec.sh session \<user_directory\>
     echo ... to start an interactive C5-DEC session
     echo ./c5dec.sh pqc
     echo ... to use the OQS-OpenSSL provider

c5dec/assets/templates/project/c5dec.sh

@@ -26,16 +26,30 @@ elif [ "$1" == "session" ]
 then
     # Create the Docker container and open a session for interactive use
     echo Launching an interactive c5dec session...
+    # if the user volume is not specified, use the default
+    # Check if the user volume is specified
+    if [ -z "$2" ]
+    then
+        echo "No user directory specified. Using default: /home/$USER/c5dec/workspace"
+        echo "Host directory $(pwd)/workspace mapped to container directory /home/$USER/c5dec/workspace"
+        USER_VOLUME=$(pwd)/workspace:/home/$USER/workspace
+    else
+        echo "User directory specified: $2"
+        echo "Host directory $2 mapped to container directory /home/$USER/workspace"
+        USER_VOLUME=$2:/home/$USER/workspace
+    fi
+    # Check if the user volume is mounted
     docker run -it --rm --name $DEV_CONTAINER_NAME \
         -v $C5_VOLUME \
+        -v $USER_VOLUME \
         -p 5432:5432 \
         $DEV_IMAGE_NAME /bin/bash
 elif [ "$1" == "help" ]
 then
     echo ---
     echo ./c5dec.sh
     echo ... to open the c5dec CLI help menu
-    echo ./c5dec.sh session
+    echo ./c5dec.sh session \<user_directory\>
     echo ... to start an interactive c5dec session
     echo ./c5dec.sh \<command\>
     echo ... to run a c5dec CLI command

c5dec/assets/templates/project/dev.Dockerfile

@@ -136,8 +136,9 @@ RUN poetry install
 # Install python virtual environment for the project
 WORKDIR /home/${user}/${c5folder}/${c5folder}
 
-# Install Doorstop
+# Install Doorstop and organize-tool
 RUN pipx install doorstop==3.0b10
+RUN pipx install organize-tool==2.4.3
 
 # Clean up unnecessary packages
 USER root

c5dec/frontend/cli/commands.py

@@ -201,9 +201,10 @@ def run_transform(args, cwd, _, catch=True, **kwargs):
     print("To export, try: doorstop export -h")
     print("To render, use: quarto render -h")
     print("To convert, use: quarto pandoc -h")
+    print("To automate file management, use: organize -h")
     print("---")
-    print("Also see Transformer page in user manual:")
-    print("c5dec/docs/manual/transformer.md OR https://github.com/AbstractionsLab/c5dec/blob/main/docs/manual/transformer.md")
+    print("Also see Transformer section of SSDLC page in user manual:")
+    print("c5dec/docs/manual/ssdlc.md OR https://github.com/AbstractionsLab/c5dec/blob/main/docs/manual/ssdlc.md")
 
 def run_cpssa(args, cwd, _, catch=True, **kwargs):
     print("---")

cleanup.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 echo C5-DEC CAD cleaning up...
 docker stop c5dec-container || true && docker rm c5dec-container
-docker rmi c5dec:v0.2.0
+docker rmi c5dec:v1.0
+docker stop c5dec-dev-container || true && docker rm c5dec-dev-container
+docker rmi c5dec-dev:v1.0
 echo Done.

dev.Dockerfile

@@ -136,8 +136,9 @@ RUN poetry install
 # Install python virtual environment for the project
 WORKDIR /home/${user}/${c5folder}/${c5folder}
 
-# Install Doorstop
+# Install Doorstop and organize-tool
 RUN pipx install doorstop==3.0b10
+RUN pipx install organize-tool==2.4.3
 
 # Clean up unnecessary packages
 USER root