docs: correct the Container Platform SRG record and point at the standard - #41
Merged
Merged
Conversation
…dard This repository recorded the DISA Container Platform SRG as released at V2R1 and no longer served from the public download path. Both halves were wrong. The current release is V2R4, benchmark date 28 October 2025, and it retrieves normally. The error came from the release sweep behind the claim, which probed V1R1, V2R1, V2R2, V2R3 and V3R1 and stopped one short of V2R4. Every probe returned 404, and that was read as the package having been withdrawn rather than as the sweep having missed it. A control on the same directory returning 200 for the Web Server SRG confirmed only that the path was sound, which is what made the wrong conclusion look verified. It is now pinned at V2R4, and retrieval points at datopsis/container- hardening, which owns retrieval, digest verification, and rendering of the DISA sources and holds this one rendered a file per rule. The DISA download index is still unscrapeable, which is part of why rendering is centralised there rather than repeated per image. ADR-0010 keeps its number and its decision. The Application Server SRG is still not applicable, on evidence that never depended on this. The section that was wrong says so in place rather than being quietly rewritten. The status snapshot's handoff section is updated: the standard exists now, so it records what that repository already holds and what adopting it will require here, rather than what it might need.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository recorded the DISA Container Platform SRG as released at V2R1 and no longer served from the public download path. Both halves were wrong. The current release is V2R4, benchmark date 28 October 2025, and it retrieves normally.
How the error happened
The release sweep behind the claim probed V1R1, V2R1, V2R2, V2R3 and V3R1 — and stopped one short of V2R4. Every probe returned 404, and that was read as the package having been withdrawn rather than as the sweep having missed it.
What made it look verified was the control: the same directory returned 200 for
U_Web_Server_V3R3_SRG.zip, which confirmed the path and method were sound. That ruled out a broken probe but said nothing about whether the right filename had been tried. A 404 sweep is evidence about the names probed and nothing else.What changed
unresolvedpinned,975a9e421e62e0ea…datopsis/container-hardeningThe register now points retrieval at
datopsis/container-hardening, which owns retrieval, digest verification, and rendering of the DISA sources, and already holds this SRG rendered one file per rule. The DISA download index remains unscrapeable — a JavaScript portal with no links in its HTML — which is part of why rendering is centralised there rather than repeated per image.Only the CIS benchmark is still unpinned. Its terms require an account holder and forbid reproduction, and it does not block the spine.
ADR-0010
Keeps its number and its decision. The Application Server SRG is still not applicable, on evidence — 27 of 137 rules presupposing a management interface or hosted applications, 18 referring to accounts — that never depended on any of this.
The section that was wrong says so in place rather than being quietly rewritten, per the convention that reasoning survives the decision.
Also
docs/STATUS.md's handoff section assumed the standard did not exist yet. It does, so it now records what that repository already holds — 391 rendered rules, nine pinned sources, weekly digest verification — and what adopting it will require here, including carrying in the GPOS SRG as the image-level control source.Checks
build-trace-matrix.py --checkreports no drift