Hello,
Recently we have significantly improved handling of OVAL variables in
OpenSCAP.
I believe that SSG can leverage this improved handling to avoid
redundancies (or similar code snippets). And significantly reduce the
size of the OVAL definition file (and consequently the size of OVAL
results).
I understand that it might not be a top priority, so this is just a
heads-up.
Example: There are definitions asserting that a service X is not
installed. If you manage to refactor the service X to a variable you can
the use the very same definition/test/item/object for many services. The
evaluation results will be then distinguished by @variable_instance
attribute and by tested_variable sub-element.
So, where you can start reading? Firstly, we have a general write-up
regarding variable processing at
http://www.open-scap.org/page/Documentation#Notes_on_the_Concept_of_Multi...
Secondly, there are some tests in OpenSCAP repo which demonstrate the
usage of the variables:
https://git.fedorahosted.org/cgit/openscap.git/tree/tests/API/XCCDF/varia...
Best regards,
--
Simon Lukasik
Security Technologies