I did a quick check of the generated content against the SCAP Content
Validation Tool <
http://scap.nist.gov/revision/1.1/index.html#validation>.
I first created CPE definition and OVAL documents (available when
needed; I can check into the project after I grok proper commit
conduct). These are unfortunately required for conformance with SP 800-126.
I then noticed that the OVAL ids are not in OVAL format, so further
validation attempts will have to await assignment of OVAL-conformant
identifiers.
Also noticed: xsi:schemaLocation attributes in XCCDF and OVAL documents
should cite "canonical" URIs for desired schema documents rather than
document-relative citations they do currently, e.g.,
xsi:schemaLocation="
http://oval.mitre.org/XMLSchema/oval-common-5
http://oval.mitre.org/language/version5.8/ovaldefinition/complete/oval-co...
http://oval.mitre.org/XMLSchema/oval-definitions-5
http://oval.mitre.org/language/version5.8/ovaldefinition/complete/oval-de...
http://oval.mitre.org/XMLSchema/oval-definitions-5#independent
http://oval.mitre.org/language/version5.8/ovaldefinition/complete/indepen...
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux
http://oval.mitre.org/language/version5.8/ovaldefinition/complete/linux-d...
http://oval.mitre.org/XMLSchema/oval-definitions-5#unix
http://oval.mitre.org/language/version5.8/ovaldefinition/complete/unix-de...
As such, the documents cannot be validated using the supplied
xsi:schemaLocation attributes. For those who cannot use direct web
references, XML Catalog (examples also available) can be used to employ
local copies in lieu of direct references.
And, an OVAL version (presumably 5.8 or later) should be selected.