Duplicate controls when importing from resolved profile

Open

#360 opened on Aug 12, 2026 0 comments 0 reactions 1 assignee View on GitHub

@selenaxiao-nist is already working on this.

Since Aug 12, 2026.

Assessment

This issue has not been assessed yet.

bug

Cloning https://github.com/usnistgov/oscal-cli/issues/315
ProfileResolver doesn't resolve profiles correctly in the following case:

A produced profile can have multiple copies of controls

When importing from a resolved profile.

The specific steps I used to find this issue were:

oscal-cli profile resolve --to=xml liboscal-java/src/test/resources/content/test-oscal-version-profile.xml source-profile.xml
Create another profile (say, derived-profile.xml)
Have <import href="source-profile.xml> <include-all /> </import> inside derived-profile.xml
oscal-cli profile resolve --to=xml derived-profile.xml
Lo and behold, the generated profile has duplicates of the controls in it

Only one set of controls from the imported profile in the resolved profile

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.