Repository navigation
Add UOS Desktop 25 product - #15154
Open
slark-yuxj wants to merge 1 commit into
Open
slark-yuxj wants to merge 1 commit into
slark-yuxj wants to merge 1 commit into
Conversation
Add a new product for UnionTech UOS Desktop 25 (codename snipe). - products/uosdesktop25: product.yml with CPE cpe:/o:uniontech:uos_desktop:25:ga:desktop, CMakeLists.txt, and a Standard System Security profile - shared/applicability/oval: OS inventory check matching the UOS Desktop 25 PRETTY_NAME in /usr/lib/os-release (the desktop variant is dpkg-based and has no uos-release package; os-release is owned by base-files) - controls/std_uosdesktop25.yml: standard security benchmark control file with 29 automated controls (files/permissions, SSH hardening, auditd, PAM, password policies, AIDE, sysctl hardening) - platform_package_overrides: Debian package names (shadow->passwd, pam->libpam-runtime, polkit->policykit-1, etc.); the shadow-utils CPE platform maps to the login package via the existing deb branch of shared/applicability/package.yml - Register the product in CMakeLists.txt, build_product, and ssg/constants.py (product_directories, FULL_NAME_TO_PRODUCT_MAPPING, MULTI_PLATFORM_LIST, MULTI_PLATFORM_MAPPING, MAKEFILE_ID_TO_PRODUCT_MAP) - Sibling PR of the UOS Server 25 product: same ID=uos in os-release, so the desktop variant is distinguished by its PRETTY_NAME Verified on a real UOS Desktop 25 Professional system (base-files 23.1-5deepin8, x86_64, apt/dpkg, kernel 6.6.0-amd64-desktop, openscap 1.3.7): - ./build_product uosdesktop25 -d builds the data stream without errors - oscap xccdf eval --profile standard identifies the OS via the CPE check and evaluates 32 selected rules (10 pass, 6 real findings such as permissive umask, /etc/shadow group ownership and permissions, world-writable files; 16 notapplicable rules scoped to server-only features)
slark-yuxj
requested review from
Mab879,
ggbecker,
jan-cerny,
marcusburghardt and
vojtapolasek
as code owners
September 29, 2026 01:33
|
Hi @slark-yuxj. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
slark-yuxj
added a commit
to slark-yuxj/content
that referenced
this pull request
Oct 8, 2026
Add a new product for UnionTech UOS Desktop 20 (codename eagle). - products/uosdesktop20: product.yml with CPE cpe:/o:uniontech:uos_desktop:20:ga:desktop, CMakeLists.txt, and a Standard System Security profile - shared/applicability/oval: OS inventory check matching the UOS Desktop 20 PRETTY_NAME in /usr/lib/os-release (the desktop variant is dpkg-based and has no uos-release package; os-release is owned by base-files) - controls/std_uosdesktop20.yml: standard security benchmark control file with 29 automated controls (files/permissions, SSH hardening, auditd, PAM, password policies, AIDE, sysctl hardening) - Register the product in CMakeLists.txt, build_product, and ssg/constants.py (product_directories, FULL_NAME_TO_PRODUCT_MAPPING, MULTI_PLATFORM_LIST, MULTI_PLATFORM_MAPPING, MAKEFILE_ID_TO_PRODUCT_MAP) - Extend the existing debian/ubuntu conditional branches of the /etc/shadow and /etc/gshadow permission/group-owner rules with "uosdesktop" in product (and a filemode@uosdesktop20 override), because UOS Desktop 20 uses the shadow group (GID 42) and mode 0640 like Debian/Ubuntu Verified on a real UOS Desktop 20 Professional system (base-files 2024.07.04+dde, x86_64, apt/dpkg, openscap 1.2.3): - ./build_product uosdesktop20 -d builds the data stream without errors - oscap xccdf eval --profile standard identifies the OS via the PRETTY_NAME CPE check and evaluates 42 rules: 14 pass, 1 genuine finding (a world-writable file created by a third-party daemon), 27 notapplicable Single self-contained commit; sibling of ComplianceAsCode#15154 (UOS Desktop 25) and ComplianceAsCode#15149 (UOS Server 25).
This was referenced Oct 8, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a new product for UnionTech UOS Desktop 25 (codename snipe).
Description:
This PR adds UOS Desktop 25 as a new supported product, as a sibling of
the UOS Server 25 product. The desktop variant is dpkg/apt-based
(Debian-like), so it differs from the server variant in package detection
and platform package overrides.
products/uosdesktop25: product.yml with CPEcpe:/o:uniontech:uos_desktop:25:ga:desktop,CMakeLists.txt, and a Standard System Security profile
shared/applicability/oval: OS inventory check matching the UOS Desktop 25PRETTY_NAME in
/usr/lib/os-release(the desktop variant is dpkg-based andhas no uos-release package; os-release is owned by base-files)
controls/std_uosdesktop25.yml: standard security benchmark control file with29 automated controls (files/permissions, SSH hardening, auditd, PAM,
password policies, AIDE, sysctl hardening)
platform_package_overrides: Debian package names (shadow->passwd,pam->libpam-runtime, polkit->policykit-1, etc.); the shadow-utils CPE platform
maps to the login package via the existing deb branch of
shared/applicability/package.ymlCMakeLists.txt,build_product, andssg/constants.pyID=uosin os-release as the server variant, so the desktop variant isdistinguished by its PRETTY_NAME
Rationale:
UnionTech UOS Desktop 25 (codename snipe) is the desktop counterpart of the
UOS Server 25 product added in #15149. It is a domestically-developed
enterprise Linux distribution in active production use. Adding it to
ComplianceAsCode lets UOS Desktop customers scan and harden their systems
with the same upstream SCAP content used for other enterprise distributions.
Review Hints:
Verified on a real UOS Desktop 25 Professional system (base-files 23.1-5deepin8,
x86_64, apt/dpkg, kernel 6.6.0-amd64-desktop, openscap 1.3.7):
./build_product uosdesktop25 -dbuilds the data stream without errorsoscap xccdf eval --profile standardidentifies the OS via the CPE checkand evaluates 32 selected rules (10 pass, 6 real findings such as permissive
umask, /etc/shadow group ownership and permissions, world-writable files;
16 notapplicable rules scoped to server-only features)
Single self-contained commit; sibling of #15149 (UOS Server 25 product PR).