Merge pull request #14743 from marcusburghardt/remove-compliance-trestle

Remove compliance-trestle dependency (CVE-2026-45725)

Author: Mab879

.github/workflows/automatus-debian12.yaml

@@ -15,7 +15,7 @@ jobs:
       - name: Install Deps
         run: sudo apt-get update && sudo apt-get install -y cmake ninja-build python3-yaml python3-jinja2 git python3-deepdiff python3-requests jq python3-pip libxml2-utils xsltproc ansible-lint wget libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt20-dev libselinux1-dev libxslt1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libldap2-dev libpcre3-dev python3 swig libxml-parser-perl libxml-xpath-perl libperl-dev libbz2-dev librpm-dev g++ libyaml-dev libxmlsec1-dev libxmlsec1-openssl
       - name: Install deps python
-        run: pip3 install gitpython xmldiff compliance-trestle==2.4.0 lxml lxml-stubs requests
+        run: pip3 install gitpython xmldiff lxml lxml-stubs requests
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:

.github/workflows/automatus-ubuntu2204.yaml

@@ -15,7 +15,7 @@ jobs:
       - name: Install Deps
         run: sudo apt-get update && sudo apt-get install -y cmake ninja-build python3-yaml python3-jinja2 git python3-deepdiff python3-requests jq python3-pip libxml2-utils xsltproc ansible-lint wget libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt20-dev libselinux1-dev libxslt1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libldap2-dev libpcre3-dev python3 swig libxml-parser-perl libxml-xpath-perl libperl-dev libbz2-dev librpm-dev g++ libyaml-dev libxmlsec1-dev libxmlsec1-openssl
       - name: Install deps python
-        run: pip3 install gitpython xmldiff compliance-trestle==2.4.0 lxml lxml-stubs requests
+        run: pip3 install gitpython xmldiff lxml lxml-stubs requests
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:

.github/workflows/update-oscal.yml

@@ -80,8 +80,6 @@ ocp4/profiles/test.profile
 .coverage
 coverage.xml
 
-# Trestle specfic
-shared/references/oscal/.trestle/cache
 
 # Ignore user-specific CLAUDE preferences
 CLAUDE.local.md

.gitignore

@@ -184,10 +184,7 @@ endif()
 # prometheus_metrics requirements
 find_python_module(prometheus_client)
 
-# compliance-trestle requirements
 find_python_module(requests)
-find_python_module(trestle)
-
 
 # OCP4 requires non-standard extensions. Vanilla OpenSCAP 1.2 doesn't support it.
 # See also: https://github.com/ComplianceAsCode/content/issues/6798
@@ -231,7 +228,6 @@ message(STATUS "python: ${Python_EXECUTABLE} (version: ${Python_VERSION})")
 message(STATUS "python yaml module: ${PY_YAML}")
 message(STATUS "python jinja2 module: ${PY_JINJA2}")
 # Optional Python Tools
-message(STATUS "python compliance-trestle module (optional): ${PY_TRESTLE}")
 message(STATUS "python cmakelint module (optional): ${PY_CMAKELINT}")
 message(STATUS "python github (PyGitHub) module (optional): ${PY_GITHUB}")
 message(STATUS "python json2html module (optional): ${PY_JSON2HTML}")

CMakeLists.txt

@@ -704,58 +704,6 @@ $ python3 utils/compare_versions.py compare_tags v0.1.67 v0.1.68 rhel9
 It will internally clone the upstream project, checkout these tags, generate ComplianceAsCode JSON manifests, compare them and print the output.
 
 
-### `utils/oscal/build_cd_from_policy.py` – Build a Component Definition from a Policy
-
-This script builds an OSCAL Component Definition (cd) (version `1.0.4`) for an existing OSCAL profile from a policy. The script uses the
-[compliance-trestle](https://github.com/oscal-compass/compliance-trestle) library to build the component definition. The component definition can be used with the `compliance-trestle` CLI after generation.
-
-Some assumption made by this script:
-
-- The script maps control file statuses to valid OSCAL [statuses](https://pages.nist.gov/OSCAL-Reference/models/v1.1.1/system-security-plan/json-reference/#/system-security-plan/control-implementation/implemented-requirements/by-components/implementation-status) as follows:
-
-  * `pending` - `alternative`
-
-  * `not applicable`: `not-applicable`
-
-  * `inherently met`: `implemented`
-
-  * `documentation`: `implemented`
-
-  * `planned`: `planned`
-
-  * `partial`: `partial`
-
-  * `supported`: `implemented`
-
-  * `automated`: `implemented`
-
-  * `manual`: `alternative`
-
-  * `does not meet`: `alternative`
-
-- The script uses the "Section *letter*:" convention in the control notes to create statements under the implemented requirements.
-- The script maps parameter to rules uses the `xccdf_variable` field under `template.vars`
-- To determine what responses will mapped to the controls in the OSCAL profile the control id and label property from the resolved catalog is searched.
-
-It supports the following arguments:
-  - `-o`, `--output` — Path to write the cd to
-  - `-r`, `--root` — Root of the SSG project. Defaults to /content.
-  - `-v`, `--vendor-dir` — Path to the vendor directory with third party OSCAL artifacts
-  - `-p`, `--profile` — Main profile href, or name of the profile model in the trestle workspace
-  - `-pr`, `--product` — Product to build cd with
-  - `-c`, `--control` &mdash; Control to use as the source for control responses. To optionally filter by level, use the format <control_id>:<level>.
-  - `-j`, `--json` &mdash; Path to the rules_dir.json. Defaults to /content/build/rule_dirs.json.
-  - `-b`, `--build-config-yaml` &mdash; YAML file with information about the build configuration
-  - `-t`, `--component-definition-type` &mdash; Type of component definition to create. Defaults to service. Options are service or validation.
-
-An example of how to execute the script:
-
-```bash
-$ ./build_product ocp4
-$ ./utils/rule_dir_json.py
-$ ./utils/oscal/build_cd_from_policy.py -o build/ocp4.json -p fedramp_rev4_high -pr ocp4 -c nist_ocp4:high
-```
-
 ### `utils/ansible_playbook_to_role.py` &ndash; Generates Ansible Roles and pushes them to Github
 
 This script converts the Ansible playbooks created by the build system and converts them to Ansible roles and can upload them to GitHub.

docs/manual/developer/05_tools_and_utilities.md

@@ -13,8 +13,6 @@ lxml-stubs
 pycompliance
 # used in utils/controleval_metrics.py
 prometheus_client
-# used in utils/oscal
 requests
-compliance-trestle==4.0.1
 pyopenssl>=23.2.0
 pcre2