But the issue is right now there isn't motivation to do that. Let me explain -
the Red Hat Enterprise Linux 6 CVE OVAL changes pretty quickly (to my knowledge
it's updated every 12 hours). So instructing oscap / scap-workbench tools to
use cached XML file from some chosen location would be prone to "false sense
of security" (suppose 2 weeks outdated "Red_Hat_Enterprise_Linux_6.xml" file
that would be used to scan the system in question rather than more recent one -
this could result in state the system wouldn't be reported as vulnerable to
pretty lot of CVE issues).
Maybe we could consider enhancing the current implementation (to honour
remote OVAL timestamps / MD5 sums and use cached version if possible).
But this:
* First needs scap-workbench RFE ticket,
* Itself is subject of upstream discussion, and can be closed as hard /
impossible to implement properly.