On 03/11/2013 11:06 AM, Simon Lukasik wrote:
On 02/21/2013 01:28 AM, Jeffrey Blank wrote:
> So this already got committed.
> It may make more sense to generate the zipfile on local hosts as part of
> RPM %install, or in individual subproject Makefiles.
> The relevant standards doc is:
> ...which does state that providing a zipfile is a reasonable way to
> provide content.
I failed to found this exact proposition. Could you please help me to
find it in that document? Or any other in some of the SCAP standard manuals?
I just checked IR 7511 as well as all three versions of SP 800-126 and
can find no normative citation.
IR 7511 has a single parenthetical reference in §3.3.1.
The NIST SCAP validation tool accepts both individual documents and ones
collected into a zip archive.
NIST has customarily provided FDCC and USGCB content as zip archives.
However, archives are not mandated by the relevant standards.
I am interested because I am looking into support of zip file in the
OpenSCAP (no promises, just looking there).
What would be quite useful is to specify content using a URI with
support for http, https, and file schemes (file being the default scheme
for unadorned file names). While additional schemes besides those
(perhaps zip or jar) might prove useful, my personal preference would be
for http, https, and file.