Skip to content

Restructure to TCASVS v5.0.0 (ASVS 5.0.0 format) + repo rename references#35

Merged
JeffreyShran merged 4 commits into
mainfrom
restructure/v5-format
Jun 17, 2026
Merged

Restructure to TCASVS v5.0.0 (ASVS 5.0.0 format) + repo rename references#35
JeffreyShran merged 4 commits into
mainfrom
restructure/v5-format

Conversation

@matreurai

@matreurai matreurai commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

Summary

Restructures the standard from the original TASVS layout to ASVS 5.0.0 format and updates all in-repo references for the OWASP/TCASVS repository rename.

Changes

  • Content migrated to versioned 5.0/ layout with ASVS 5.0.0-formatted chapters (V1–V6)
  • Requirement tables reformatted to L1/L2/L3 + CWE columns
  • Multi-format build tooling (5.0/tools/, Makefile, generate-all.sh) — JSON/CSV/CycloneDX/PDF/DOCX
  • Full old→new ID traceability (5.0/mappings/mapping_tasvs_to_tcasvs_v5.0.0.yml)
  • All references updated from the old www-project-… slug to OWASP/TCASVS
  • Original TASVS 1.0 preserved under archive/1.0-original-tasvs/

Notes

  • project.owasp.yaml website: field is intentionally left on the current page URL
    pending the OWASP Nest team relinking the project page to OWASP/TCASVS.

Migration details

See MIGRATION-SUMMARY.md — 79 original requirements mapped, 132 total, 73 gap-fills, 1 dropped.

matreurai added 2 commits May 29, 2026 08:21
@matreurai
feat: restructure TASVS to TCASVS v1.0 (ASVS 5.0.0 format)
9f696c4 
- Migrate 79 requirements across 6 chapters to ASVS 5.0.0 format (132 total)
- Add 73 gap-fill requirements for thick-client threat coverage
- Create versioned directory layout (1.0/en/) with 0x-prefix file naming
- Add Source column to all requirement tables (TASVS vs New)
- Add build tooling: parser, JSON/CSV/CycloneDX export, Makefile
- Add CI pipeline (.github/workflows/main.yml)
- Add full traceability mapping (mappings/mapping_tasvs_to_tcasvs_v1.0.yml)
- Archive original TASVS content (archive/1.0-original-tasvs/)
- Include MIGRATION-SUMMARY.md with Mermaid diagram and stats
@matreurai
Restructure TASVS to TCASVS v5.0.0 (ASVS 5.0.0 format) and update rep…
61223f7 
…o refs for OWASP/TCASVS rename

- Migrate content to 5.0/ versioned layout with ASVS 5.0.0 formatted chapters (V1-V6)
- Update all in-repo references from old www-project slug to OWASP/TCASVS
- project.owasp.yaml repositories name/url updated; website field pending Nest relink
@matreurai
matreurai requested a review from JeffreyShran June 11, 2026 15:20
@JeffreyShran

JeffreyShran commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

@matreurai. A few questions/comments please:

  1. do we need "CWE"? ref. My thought are that if we need to keep a ref, we should link instead to the OWASP CRE project? WDYT?
  2. Did you try to build a full PDF yet using the ASVS workflows?
  3. probably we can drop this excel builder now as the ASVS project make a consuamble XML/JSON (I think) as output for downstream consumption? ref

@matreurai
Address PR #35 review: drop CWE column, remove Excel builder, add con…
2da4bf6 
…tainerized build

- Drop the CWE column from all 6 chapters (132 reqs); tables are now
  | # | Description | Level | Source |. Update parser, CycloneDX export,
  5.0/Makefile, CONTRIBUTING, and issue templates accordingly.
- Remove utils/Convert-TASVS-Excel (superseded by JSON/CSV/XML/CycloneDX exports).
- Add ASVS-aligned document builder image (docker/Dockerfile + run.sh) with
  pinned fonts, pandoc, and the LaTeX packages eisvogel needs; root Makefile and
  CI now build inside it so PDF/DOCX/JSON/CSV/XML/CycloneDX generate cleanly.
- main.yml: build inside the image, validate on pull_request (release on push
  only), upload build artifacts. Add image build/publish workflow.
- Fix frontispiece license image path; ignore build/dist; force LF on scripts.
@matreurai

matreurai commented Jun 16, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks @JeffreyShran for the feedback, all three handled in 2da4bf6.

  1. CWE —> dropped it. The mappings were mostly "best fit" and felt like false precision, so I'd rather not carry them. Tables are now # | Description | Level | Source (Source = TASVS vs new). If we want external mapping later, I agree OpenCRE is the better target, as its own pass.

  2. PDF —> yes, and it didn't actually build before: the eisvogel template/header came from ASVS and assume pinned fonts + LaTeX packages the old workflow never installed, so CI would've failed. I ported the ASVS setup properly — there's now a docker/ builder image, a root Makefile, and a workflow that publishes it to GHCR. make 5.0 produces PDF/DOCX/JSON/CSV/XML/CycloneDX; built it locally, PDF comes out clean. CI now also runs on pull_request and attaches the outputs as an artifact you can download.

  3. Excel builder —> removed. The JSON/CSV/XML/CycloneDX exports cover downstream now.

JeffreyShran
JeffreyShran reviewed Jun 17, 2026
View reviewed changes
Comment thread 5.0/en/0x10-V1-Architecture-and-Threat-Modeling.md

@JeffreyShran JeffreyShran Jun 17, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matreurai we still need a review and potentially a PR for this file from the internal security architecture team

@JeffreyShran

JeffreyShran commented Jun 17, 2026

Copy link
Copy Markdown
Collaborator
@matreurai, the Vigilant 2 W U
Legendary Creature — Human Advisor
Vigilance, ward 2
Whenever Matreurai attacks, scry 1, then draw a card.
Other creatures you control have ward 1.
"Every line reviewed. Every gap closed. Nothing gets through twice."
3 / 4

@JeffreyShran
JeffreyShran merged commit 7034ce9 into main Jun 17, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JeffreyShran JeffreyShran JeffreyShran left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matreurai @JeffreyShran