On 03/12/2013 06:15 AM, Simon Lukasik wrote:
oscap already supports remote URI if the URI is used within
check-content-ref/@href. You can enable this functionality by
--fetch-remote-resources command-line option.

I had hoped that XCCDF documents (and thus relative or absolute references therein to associated documents) could be identified by URI with at least support for http and https schemes.

This would allow, for example, placing SCAP content in a version control repository (exposed secondarily via HTTP) or web service from which definitive copies could be obtained at a time chosen by the requestor, obviating the need for a separate, less timely distribution scheme (I'm intending to do this, by the way).

Such a means of distribution does not preclude methods such as XML Catalog to provide locally cached copies of the content. I am of course aware that such a scheme could be implemented independently of Open SCAP.

I was not aware that remote resources are not fetched by default. NIST FDCC and USGCB content assume the opposite, and customarily provide more frequently updated documents such as patch checks as HTTP references.

However, I am afraid to allow remote URI even on the command-line. Some
of the risks are discussed at https://fedorahosted.org/openscap/ticket/213 .

I do not subscribe to the theory that remote fetches are a potential risk. I will be happy to defend this carefree attitude vigorously and at length.

Even if one warrants that remote fetches offer some risks, these could be obviated by providing a mode of operation for those who fear them, as has already been done for href attributes, and an obverse mode for those who embrace them.

I will also (at the risk of citing a document for which I have grave misgivings) mention that NIST SP 800-126r2 ยง3.10 provides a method by which document integrity can be assured. Please do not read any other part of that publication. Prefer the prior version for now.

Both XCCDF and OVAL have allowed XML digital signatures for many years. NIST IR 7802 discusses such use in detail. I have not seen anyone actually doing this.

XCCDF has always defined href and similar attributes as XML Schema anyURI, though I am unaware of any normative reference specifying minimal scheme support. Thus far I have only seen http used. If libcurl is being used, would it not offer both multiple scheme support as well as TLS certificate validation?