diff --git a/test-suite/README.md b/test-suite/README.md index a52400390..15b706cf0 100644 --- a/test-suite/README.md +++ b/test-suite/README.md @@ -1,7 +1,32 @@ -A test suite capable of testing any given implementation of the Metaschema toolchain. +Contains various materials for testing any and various implementations of the Metaschema toolchain or parts of it. + +Folders here include: + +### `docs-models` + +An example metaschema for mocking up documentation generation. + +### `schema-generation` To use: under Bash, run ./run-tests.sh in folder schema-generation ./run-tests --help gives help. -./run-tests.sh [testdir] runs tests only in a particular test directory. \ No newline at end of file +./run-tests.sh [testdir] runs tests only in a particular test directory. + +### `schema-generation` + +Unit testing over handmade mini metaschemas. Due for maintenance. + +### `worked-exaples` + +With one more testing metaschemas exercising different features. + +### `metaschema-xspec` + +The *beginnings* of XSpec-based unit testing of metaschema + +### `oscal` + +Copies of OSCAL metaschemas for testing (not normative). + diff --git a/test-suite/docs-models/shadow-imported_metaschema.xml b/test-suite/docs-models/shadow-imported_metaschema.xml new file mode 100644 index 000000000..7aeeebd49 --- /dev/null +++ b/test-suite/docs-models/shadow-imported_metaschema.xml @@ -0,0 +1,26 @@ + + + + + Imported Metaschema + 1.0 + imported + http://csrc.nist.gov/ns/oscal/1.0 + + + Assembly that includes global and local flags + This assembly references a global flag that is shadowed by a global flag defined in the importing metaschema. + + +

This reference should be to the globally scoped flag "global-flag" from the imported metaschema.

+ + + + + + Global Flag - Imported Metaschema + A flag from the importing metaschema. It's scope is global and it's shadowed by the definition with the same name in the importing metaschema. + + \ No newline at end of file diff --git a/test-suite/docs-models/shadow-importing_metaschema.xml b/test-suite/docs-models/shadow-importing_metaschema.xml new file mode 100644 index 000000000..bbf11845d --- /dev/null +++ b/test-suite/docs-models/shadow-importing_metaschema.xml @@ -0,0 +1,36 @@ + + + + + Importing Metaschema + 1.0 + importing + http://csrc.nist.gov/ns/oscal/1.0 + + + + + Assembly that global flags + This assembly references a global flag that shadows a global flag defined in an imported metaschema. + including-flags + + +

This reference should be to the globally scoped flag "global-flag" from the importing metaschema. This definition is taking precedence over the other definition imported (with the same name).

+ + + + + +

This is the imported "imported-flags" assembly.

+ + + + + + + Global Flag - Importing Metaschema + A flag from the importing metaschema. It's scope is global. This should be marked as a shadowing of another imported flag. + + \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_metaschema.xml b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_metaschema.xml deleted file mode 100644 index 1832a8437..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_metaschema.xml +++ /dev/null @@ -1,72 +0,0 @@ - - - - - - - Metaschema Unit Test: allowed values - 1.0-milestone1 - metaschema-allowed-values - http://csrc.nist.gov/ns/metaschema/unit-test/allowed-values - - - parent - parent assembly - - Small odd flag - Odd integers from 1 to 11 inclusive - - One - Three - Five - Seven - Nine - Eleven - - - - - - - - - - - - - - child - child assembly - - - - - - - - Date - One of several 2020 dates - - New Year's Day 2020 - Leap Day 2020 - July Fourth 2020 - - - - - Small even flag - Even integers from 2 to 10 inclusive - - Two - Four - Six - Eight - Ten - - - - diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_baddates_FAIL.json b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_baddates_FAIL.json deleted file mode 100644 index cd3cfdf67..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_baddates_FAIL.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "parent": { - "odd-flag": 11, - "field-dates": [ - "2020-01-00", - "2020-02-30" - ], - "children": [ - { - "even-flag": 10, - "field-date": "2020-01-02" - }, - { - "even-flag": 2, - "field-date": "2020-04-31" - } - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_badvalues_FAIL.json b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_badvalues_FAIL.json deleted file mode 100644 index 56bccc286..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_badvalues_FAIL.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "parent": { - "odd-flag": 12, - "field-dates": [ - "2020-01-01", - "2020-02-29" - ], - "children": [ - { - "even-flag": 10.1, - "field-date": "2020-01-01" - }, - { - "even-flag": 3, - "field-date": "2020-07-04" - } - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_okay_PASS.xml b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_okay_PASS.xml deleted file mode 100644 index 345b7585b..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_okay_PASS.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - 2020-01-01 - - 2020-02-29 - - \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_valid_PASS.json deleted file mode 100644 index 72839e86c..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_test_valid_PASS.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "parent": { - "odd-flag": 11, - "field-dates": [ - "2020-01-01", - "2020-02-29" - ], - "children": [ - { - "even-flag": 10, - "field-date": "2020-01-01" - }, - { - "even-flag": 2, - "field-date": "2020-02-29" - } - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_xml-schema.xsd deleted file mode 100644 index 2b9df2b12..000000000 --- a/test-suite/oscal-m2-schema-generation/allowed-values/allowed-values-basic_xml-schema.xsd +++ /dev/null @@ -1,199 +0,0 @@ - - - - - Metaschema Unit Test: allowed values - 1.0-milestone1 - metaschema-allowed-values - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - Small odd flag - Odd integers from 1 to 11 inclusive - - - Small odd flag: Odd integers from 1 to 11 inclusive - - - - - - -

One

- - - - - - -

Three

- - - - - - -

Five

- - - - - - -

Seven

- - - - - - -

Nine

- - - - - - -

Eleven

- - - - - - - - - - - - child - child assembly - - - child: child assembly - - - - - - - - - Small even flag - Even integers from 2 to 10 inclusive - - - Small even flag: Even integers from 2 to 10 inclusive - - - - - - -

Two

- - - - - - -

Four

- - - - - - -

Six

- - - - - - -

Eight

- - - - - - -

Ten

- - - - - - - - - - - - Date - One of several 2020 dates - - - Date: One of several 2020 dates - - - - - - - - - - - - -

New Year's Day 2020

- - - - - - -

Leap Day 2020

- - - - - - -

July Fourth 2020

- - - - - - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-json-converter.xsl b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-json-converter.xsl deleted file mode 100644 index da8aa21f8..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-json-converter.xsl +++ /dev/null @@ -1,456 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - language-{.} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^\s*(\*|\d+\.)\s - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - &amp; - &lt; - - &quot; - - &#x2A; - &#x60; - &#x7E; - &#x5E; - - - - - - - - - - - - - - - - - "" - !\[{{$noclosebracket}}\] - - \(\) - `` - - \*\*\*\*\*\* - - \*\*\*\* - \*\* - ~~ - \^\^ - - - - < - - - - > - - </ - - > - - - - - - - - - - - - - - - - - - $1 - - - param-id='$1' - - - href='$2' - - - - alt='$1' - - - - src='$2' - - - - (.*?) - - - ([^{ @not }]*?) - - { insertion } - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.json b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.json deleted file mode 100644 index f634dbd31..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.json +++ /dev/null @@ -1,44 +0,0 @@ - - { "$schema" : "http://json-schema.org/draft-07/schema#", - "$id" : "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime-schema.json", - "$comment" : "Metaschema Unit Test: datatypes-dateTime: JSON Schema", - "type" : "object", - "definitions" : - { "examples" : - { "title" : "Examples", - "description" : "Some character strings of different sorts", - "$id" : "#/definitions/examples", - "type" : "object", - "properties" : - { "character-strings" : - { "anyOf" : - [ - { "$ref" : "#/definitions/charstring" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/charstring" }, - "minItems" : 2 } ] }, - "markup-lines" : - { "anyOf" : - [ - { "$ref" : "#/definitions/markupline" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/markupline" }, - "minItems" : 2 } ] } }, - "additionalProperties" : false }, - "charstring" : - { "title" : "Character string", - "description" : "String of characters", - "$id" : "#/definitions/charstring", - "type" : "string" }, - "markupline" : - { "title" : "Markup line", - "description" : "Characters, and more", - "$id" : "#/definitions/markupline", - "type" : "string" } }, - "properties" : - { "examples" : - { "$ref" : "#/definitions/examples" } } } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.xsd b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.xsd deleted file mode 100644 index 49e95bc93..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-schema.xsd +++ /dev/null @@ -1,285 +0,0 @@ - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - examples - - - - - - Examples - Some character strings of different sorts - - - Examples: Some character strings of different sorts - - - - - - - - - - - - Character string - String of characters - - - Character string: String of characters - - - - - - - Markup line - Characters, and more - - - Markup line: Characters, and more - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-xml-converter.xsl b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-xml-converter.xsl deleted file mode 100644 index 8ce87a7a5..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test-xml-converter.xsl +++ /dev/null @@ -1,257 +0,0 @@ - - - - - - - no - - no - - - - - - { $json-indent='yes' } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # - ## - ### - #### - ##### - ###### - - - - - - - - - - - | - --- | - - - - - | - - - | - - - - ``` - - - - ``` - - - - - - - - - - - - - - - * - - - - - - - - - - 1. - - - - - ` - - ` - - - * - - * - - - ** - - ** - - - " - - " - - - {{ - - }} - - - - [ - - ] - ( - - ) - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_metaschema.xml b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_metaschema.xml deleted file mode 100644 index 9d07fc58e..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_metaschema.xml +++ /dev/null @@ -1,40 +0,0 @@ - - - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime - - - Examples - Some character strings of different sorts - - - - - - - - - - - - Character string - String of characters - - - - Markup line - Characters, and more - - - - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS-back.xml b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS-back.xml deleted file mode 100644 index 9600fff23..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS-back.xml +++ /dev/null @@ -1,9 +0,0 @@ - - - Here's a string including punctuation ' " \ . $ - Here's a string with an ampersand & - Less-than and greater-than, as <delimiters> ... - The star aka asterisk * may be magical and maybe also the tick ` - Also, occasionally we have links and other markup. - And sometimes, we have *very confusing stuff* as well. - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.json b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.json deleted file mode 100644 index 915246302..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.json +++ /dev/null @@ -1,10 +0,0 @@ - - { "examples" : - { "character-strings" : - [ "Here's a string including punctuation ' \" \\ . $", - "Here's a string with an ampersand &", - "Less-than and greater-than, as ...", - "The star aka asterisk * may be magical and maybe also the tick `" ], - "markup-lines" : - [ "Also, occasionally we have [links](w3.org) and *other markup*.", - "And *sometimes*, we have \\*very confusing stuff\\* as well." ] } } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.xml b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.xml deleted file mode 100644 index 3f6964b2a..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_okay-PASS.xml +++ /dev/null @@ -1,11 +0,0 @@ - - - Here's a string including punctuation ' " \ . $ - Here's a string with an ampersand & - Less-than and greater-than, as <delimiters> ... - The star aka asterisk * may be magical and maybe also the tick ` - Also, occasionally we have links and other markup. - And sometimes, we have *very confusing stuff* as well. - \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_xml-schema.xsd deleted file mode 100644 index 9fc7faf96..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/charstrings-test_xml-schema.xsd +++ /dev/null @@ -1,289 +0,0 @@ - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - examples - - - - - - Examples - Some character strings of different sorts - - - Examples: Some character strings of different sorts - - - - - - - - - - - - Character string - String of characters - - - Character string: String of characters - - - - - - - - - - - Markup line - Characters, and more - - - Markup line: Characters, and more - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/char-handling/refresh.sh b/test-suite/oscal-m2-schema-generation/char-handling/refresh.sh deleted file mode 100644 index ab6c8adba..000000000 --- a/test-suite/oscal-m2-schema-generation/char-handling/refresh.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash - -# Produces Metaschema artifacts from an OSCAL Metaschema metaschema -# Including XML and JSON schemas, conversion utilities (XSLTs) and Markdown documentation - -METASCHEMAXML=charstrings-test_metaschema.xml -BASENAME=charstrings-test - -OSCALDIR=../../../.. - -if [[ -z SAXON_HOME ]]; then - echo "SAXON_HOME is not set" - exit 1 -elif [[ -z "$SAXON_HOME" ]]; then - echo "SAXON_HOME is set to the empty string" - exit 1 -fi - -SAXON=$SAXON_HOME/Saxon-HE-9.9.1-3.jar - -if [ ! -f $SAXON ]; then - echo "The saxon library was not found at: $SAXON!" - exit 1 -fi - -# Saxon CL documented here: http://www.saxonica.com/documentation9.8/using-xsl/commandline.html - -LIBDIR=$OSCALDIR/build/metaschema -XSDDIR=. -JSONDIR=. -CONVERSION_DIR=. -CURRENT_DIR=$(pwd -W) -# DOCSDIR=docs - -echo Working in $CURRENT_DIR - -MAKE_XSD="java -jar $SAXON -s:$METASCHEMAXML -o:$XSDDIR/$BASENAME-schema.xsd -xsl:$LIBDIR/xml/produce-xsd.xsl" -MAKE_JSC="java -jar $SAXON -s:$METASCHEMAXML -o:$JSONDIR/$BASENAME-schema.json -xsl:$LIBDIR/json/produce-json-schema.xsl" - -CONV_XML="java -jar $SAXON -s:$METASCHEMAXML -o:$CONVERSION_DIR/$BASENAME-xml-converter.xsl -xsl:$LIBDIR/xml/produce-xml-converter.xsl" -CONV_JSON="java -jar $SAXON -s:$METASCHEMAXML -o:$CONVERSION_DIR/$BASENAME-json-converter.xsl -xsl:$LIBDIR/json/produce-json-converter.xsl" - -EXAMPLE_BASE=charstrings-test_okay-PASS - -EXAMPLE_JSON="java -jar $SAXON -s:$EXAMPLE_BASE.xml -o:$EXAMPLE_BASE.json -xsl:$CONVERSION_DIR/$BASENAME-xml-converter.xsl json-indent=yes" -EXAMPLE_BACK="java -jar $SAXON -it -o:$EXAMPLE_BASE-back.xml -xsl:$CONVERSION_DIR/$BASENAME-json-converter.xsl json-file=$CURRENT_DIR/$EXAMPLE_BASE.json" - -# DOCS_XSLT="java -jar $SAXON -s:$METASCHEMAXML -o:$LIBDIR/temp/$BASENAME-xml-docs-md.xsl -xsl:$LIBDIR/xml/produce-and-run-documentor.xsl" - -# Now ... -echo -echo Producing JSON and XML schemas and tools from $METASCHEMAXML ... -$MAKE_XSD -echo _ Made XSD ________________________ $XSDDIR/$BASENAME-schema.xsd -$MAKE_JSC -echo _ Made JSON Schema ________________ $JSONDIR/$BASENAME-schema.json -$CONV_XML -echo _ Made XML-to-JSON converter ______ $CONVERSION_DIR/$BASENAME-xml-converter.xsl -$CONV_JSON -echo _ Made JSON-to-XML converter ______ $CONVERSION_DIR/$BASENAME-json-converter.xsl -$EXAMPLE_JSON -echo _ Produced $EXAMPLE_BASE.json from $EXAMPLE_BASE.xml -$EXAMPLE_BACK -echo _ Produced $EXAMPLE_BASE-back.xml from $EXAMPLE_BASE.json - -# $DOCS_XSLT -# echo _ Made Metaschema documentation _ $DOCSDIR/${BASENAME}_xml.md $DOCSDIR/json_${BASENAME}_json.md -# echo diff --git a/test-suite/oscal-m2-schema-generation/collapsible/collapsible-no-op_metaschema.xml b/test-suite/oscal-m2-schema-generation/collapsible/collapsible-no-op_metaschema.xml deleted file mode 100644 index 85a8b0d28..000000000 --- a/test-suite/oscal-m2-schema-generation/collapsible/collapsible-no-op_metaschema.xml +++ /dev/null @@ -1,29 +0,0 @@ - - - - - - - Metaschema Unit Test: collapsible-no-op - 1.0-milestone1 - metaschema-collapsible-no-op - http://csrc.nist.gov/ns/metaschema/unit-test/collapsible-no-op - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_json-schema.json b/test-suite/oscal-m2-schema-generation/collapsible/collapsible_json-schema.json deleted file mode 100644 index 36ee58639..000000000 --- a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_json-schema.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/collapsible-schema.json", - "$comment": "Metaschema Unit Test: collapsible: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "anyOf": [ - {"$ref": "#/definitions/prop"}, - { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 2 - } - ] - } - }, - "required": ["props"], - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "object", - "properties": { - "name": { - "title": "A simple flag", - "description": "A simpleflag", - "type": "string" - }, - "STRVALUE": { - "anyOf": [ - {"type": "string"}, - { - "type": "array", - "items": {"type": "string"}, - "minItems": 2 - } - ] - } - }, - "required": ["STRVALUE"], - "additionalProperties": false - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": ["parent"] -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_metaschema.xml b/test-suite/oscal-m2-schema-generation/collapsible/collapsible_metaschema.xml deleted file mode 100644 index 06846ab15..000000000 --- a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_metaschema.xml +++ /dev/null @@ -1,32 +0,0 @@ - - - - - - - Metaschema Unit Test: collapsible - 1.0-milestone1 - metaschema-collapsible - http://csrc.nist.gov/ns/metaschema/unit-test/collapsible - - - parent - parent assembly - - - - - - - - - prop - prop field - - A simple flag - A simpleflag - - - diff --git a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_multiple_PASS.json b/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_multiple_PASS.json deleted file mode 100644 index ed63af828..000000000 --- a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_multiple_PASS.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "parent": { - "props": [ - { - "name": "name1", - "STRVALUE": [ "value1", "value3" ] - }, - { - "name": "name2", - "STRVALUE": [ "value2", "value4" ] - } - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_singleton_PASS.json b/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_singleton_PASS.json deleted file mode 100644 index 7839a4bc6..000000000 --- a/test-suite/oscal-m2-schema-generation/collapsible/collapsible_test_singleton_PASS.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "parent": { - "props": [ - { - "name": "name1", - "STRVALUE": "value1" - }, - { - "name": "name2", - "STRVALUE": "value2" - } - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_json-schema.json deleted file mode 100644 index 2cc6e7546..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_json-schema.json +++ /dev/null @@ -1,59 +0,0 @@ - - { "$schema" : "http://json-schema.org/draft-07/schema#", - "$id" : "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime-schema.json", - "$comment" : "Metaschema Unit Test: datatypes-dateTime: JSON Schema", - "type" : "object", - "definitions" : - { "parent" : - { "title" : "parent", - "description" : "parent assembly", - "$id" : "#/definitions/parent", - "type" : "object", - "properties" : - { "flag-date" : - { "type" : "string", - "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))(Z|[+-][0-9]{2}:[0-9]{2})?$", - "title" : "Date Flag", - "description" : "date flag, time zone optional" }, - "field-dates" : - { "anyOf" : - [ - { "$ref" : "#/definitions/field-date" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/field-date" }, - "minItems" : 2 } ] }, - "children" : - { "anyOf" : - [ - { "$ref" : "#/definitions/child" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/child" }, - "minItems" : 2 } ] } }, - "required" : - [ "flag-date" ], - "additionalProperties" : false }, - "child" : - { "title" : "child", - "description" : "child assembly", - "$id" : "#/definitions/child", - "type" : "object", - "properties" : - { "field-date" : - { "$ref" : "#/definitions/field-date" } }, - "required" : - [ "field-date" ], - "additionalProperties" : false }, - "field-date" : - { "title" : "Date", - "description" : "Time zone optional", - "$id" : "#/definitions/field-date", - "type" : "string", - "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))(Z|[+-][0-9]{2}:[0-9]{2})?$" } }, - "properties" : - { "parent" : - { "$ref" : "#/definitions/parent" } }, - "required": [ "parent" ] } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_metaschema.xml deleted file mode 100644 index f453f5e21..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_metaschema.xml +++ /dev/null @@ -1,46 +0,0 @@ - - - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime - - - parent - parent assembly - - Date Flag - date flag, time zone optional - - - - - - - - - - - - - child - child assembly - - - - - - - Date - Time zone optional - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_tricky_FAIL.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_tricky_FAIL.json deleted file mode 100644 index f9c55531c..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_tricky_FAIL.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "parent": { - "flag-date": "2019-08-22", - "field-dates": [ - "2019-09-28Z", - "2020-06-31", - "BAD-1999-09-09-WORSE" - ], - "children": { - "field-date": "1990-08-22T12:20:00=05:00" - } - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_valid_PASS.json deleted file mode 100644 index de928f06a..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_test_valid_PASS.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "parent": { - "flag-date": "2019-08-22", - "field-dates": [ - "2019-09-28Z", - "2019-12-02-08:00", - "2019-12-31Z", - "2016-02-29", - "2000-01-01", - "2001-06-29" - - ], - "children": { - "field-date": "1990-08-22T12:20:00-05:00" - } - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_xml-schema.xsd deleted file mode 100644 index 686b39453..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-date_xml-schema.xsd +++ /dev/null @@ -1,79 +0,0 @@ - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - Date Flag - date flag, time zone optional - - - Date Flag: date flag, time zone optional - - - - - - - - child - child assembly - - - child: child assembly - - - - - - - - - - - Date - Time zone optional - - - Date: Time zone optional - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_json-schema.json deleted file mode 100644 index 955805bb0..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_json-schema.json +++ /dev/null @@ -1,59 +0,0 @@ - - { "$schema" : "http://json-schema.org/draft-07/schema#", - "$id" : "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime-schema.json", - "$comment" : "Metaschema Unit Test: datatypes-dateTime: JSON Schema", - "type" : "object", - "definitions" : - { "parent" : - { "title" : "parent", - "description" : "parent assembly", - "$id" : "#/definitions/parent", - "type" : "object", - "properties" : - { "flag-datetime-notz" : - { "type" : "string", - "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})?$", - "title" : "Date and Time Flag", - "description" : "datetime flag" }, - "field-datetimes-notz" : - { "anyOf" : - [ - { "$ref" : "#/definitions/field-datetime-notz" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/field-datetime-notz" }, - "minItems" : 2 } ] }, - "children" : - { "anyOf" : - [ - { "$ref" : "#/definitions/child" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/child" }, - "minItems" : 2 } ] } }, - "required" : - [ "flag-datetime-notz" ], - "additionalProperties" : false }, - "child" : - { "title" : "child", - "description" : "child assembly", - "$id" : "#/definitions/child", - "type" : "object", - "properties" : - { "field-datetime-notz" : - { "$ref" : "#/definitions/field-datetime-notz" } }, - "required" : - [ "field-datetime-notz" ], - "additionalProperties" : false }, - "field-datetime-notz" : - { "title" : "Date and Time", - "description" : "No time zone", - "$id" : "#/definitions/field-datetime-notz", - "type" : "string", - "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})?$" } }, - "properties" : - { "parent" : - { "$ref" : "#/definitions/parent" } }, - "required": [ "parent" ] } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_metaschema.xml deleted file mode 100644 index 00dbfa79b..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_metaschema.xml +++ /dev/null @@ -1,46 +0,0 @@ - - - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime - - - parent - parent assembly - - Date and Time Flag - datetime flag - - - - - - - - - - - - - child - child assembly - - - - - - - Date and Time - No time zone - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_test_valid_PASS.json deleted file mode 100644 index a2e59f9bd..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_test_valid_PASS.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "parent": { - "flag-datetime-notz": "2019-08-22T12:20:00", - "field-datetimes-notz": [ - "2019-09-28T23:20:50.52", - "2019-09-28T23:20:50.52Z", - "2019-12-02T16:39:57-08:00", - "2019-12-02T16:39:57", - "2019-12-31T23:59:59Z", - "2016-02-29T23:59:59Z" - ], - "children": { - "field-datetime-notz": "1990-08-22T12:20:00" - } - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_xml-schema.xsd deleted file mode 100644 index 21941c09b..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime-no-tz_xml-schema.xsd +++ /dev/null @@ -1,79 +0,0 @@ - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - Date and Time Flag - datetime flag - - - Date and Time Flag: datetime flag - - - - - - - - child - child assembly - - - child: child assembly - - - - - - - - - - - Date and Time - No time zone - - - Date and Time: No time zone - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_json-schema.json deleted file mode 100644 index 6c8db3519..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_json-schema.json +++ /dev/null @@ -1,84 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime-schema.json", - "$comment": "Metaschema Unit Test: datatypes-dateTime: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "flag-datetime": { - "title": "Date and Time Flag", - "description": "datetime flag", - "type": "string", - "format": "date-time", - "pattern": "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$" - }, - "field-datetimes": { - "anyOf": [ - { - "$ref": "#/definitions/field-datetime" - }, - { - "type": "array", - "items": { - "$ref": "#/definitions/field-datetime" - }, - "minItems": 2 - } - ] - }, - "children": { - "anyOf": [ - { - "$ref": "#/definitions/child" - }, - { - "type": "array", - "items": { - "$ref": "#/definitions/child" - }, - "minItems": 2 - } - ] - } - }, - "required": [ - "flag-datetime" - ], - "additionalProperties": false - }, - "child": { - "title": "child", - "description": "child assembly", - "$id": "#/definitions/child", - "type": "object", - "properties": { - "field-datetime": { - "$ref": "#/definitions/field-datetime" - } - }, - "required": [ - "field-datetime" - ], - "additionalProperties": false - }, - "field-datetime": { - "title": "Date and Time", - "description": "With time zone", - "$id": "#/definitions/field-datetime", - "type": "string", - "format": "date-time", - "pattern": "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$" - } - }, - "properties": { - "parent": { - "$ref": "#/definitions/parent" - } - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_metaschema.xml deleted file mode 100644 index 058fd10fa..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_metaschema.xml +++ /dev/null @@ -1,46 +0,0 @@ - - - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-dateTime - - - parent - parent assembly - - Date and Time Flag - datetime flag - - - - - - - - - - - - - child - child assembly - - - - - - - Date and Time - With time zone - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_test_valid_PASS.json deleted file mode 100644 index 9f56668a8..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_test_valid_PASS.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "parent": { - "flag-datetime": "2019-08-22T12:20:00-05:00", - "field-datetimes": [ - "2019-09-28T23:20:50.52Z", - "2019-12-02T16:39:57-08:00", - "2019-12-31T23:59:59Z", - "2016-02-29T23:59:59Z" - ], - "children": { - "field-datetime": "1990-08-22T12:20:00-05:00" - } - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_xml-schema.xsd deleted file mode 100644 index d6eb3d7bd..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-datetime_xml-schema.xsd +++ /dev/null @@ -1,89 +0,0 @@ - - - - - Metaschema Unit Test: datatypes-dateTime - 1.0-milestone1 - metaschema-datatypes-dateTime - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - Date and Time Flag - datetime flag - - - Date and Time Flag: datetime flag - - - - - - - - child - child assembly - - - child: child assembly - - - - - - - - - - - Date and Time - With time zone - - - Date and Time: With time zone - - - - - - - - - - The xs:dateTime with a required timezone. - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_json-schema.json deleted file mode 100644 index baa515d1a..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_json-schema.json +++ /dev/null @@ -1,107 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-schema.json", - "$comment": "Metaschema Unit Test: datatypes: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "field-date": {"$ref": "#/definitions/field-date"}, - "field-plaintext": {"$ref": "#/definitions/field-plaintext"}, - "field-flag-plaintext": {"$ref": "#/definitions/field-flag-plaintext"}, - "field-richtext": {"$ref": "#/definitions/field-richtext"}, - "field-flag-richtext": {"$ref": "#/definitions/field-flag-richtext"}, - "field-prose": {"$ref": "#/definitions/field-prose"}, - "field-flag-prose": {"$ref": "#/definitions/field-flag-prose"} - }, - "additionalProperties": false - }, - "field-date": { - "title": "Date", - "description": "With time zone", - "$id": "#/definitions/field-date", - "type": "string", - "pattern": "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))(Z|[+-][0-9]{2}:[0-9]{2})$" - }, - "field-plaintext": { - "title": "Plain text", - "description": "plain text, no markup", - "$id": "#/definitions/field-plaintext", - "type": "string" - }, - "field-flag-plaintext": { - "title": "Plain text", - "description": "plain text, no markup", - "$id": "#/definitions/field-flag-plaintext", - "type": "object", - "properties": { - "length": { - "title": "Length", - "description": "The length.", - "type": "integer", - "minimum": 1, - "multipleOf": 1.0 - }, - "STRVALUE": {"type": "string"} - }, - "required": ["STRVALUE"], - "additionalProperties": false - }, - "field-richtext": { - "title": "Rich text", - "description": "Rich text supports markup", - "$id": "#/definitions/field-richtext", - "type": "string" - }, - "field-flag-richtext": { - "title": "Rich text", - "description": "Rich text supports markup", - "$id": "#/definitions/field-flag-richtext", - "type": "object", - "properties": { - "length": { - "title": "Length", - "description": "The length.", - "type": "integer", - "multipleOf": 1.0, - "minimum": 1 - }, - "RICHTEXT": {"type": "string"} - }, - "required": ["RICHTEXT"], - "additionalProperties": false - }, - "field-prose": { - "title": "Prose", - "description": "Prose permits multiple paragraphs, lists, tables etc.", - "$id": "#/definitions/field-prose", - "type": "string" - }, - "field-flag-prose": { - "title": "Prose", - "description": "Prose permits multiple paragraphs, lists, tables etc.", - "$id": "#/definitions/field-flag-prose", - "type" : "object", - "properties": { - "length": { - "title": "Length", - "description": "The length.", - "type": "integer", - "multipleOf": 1.0, - "minimum": 1 - }, - "PROSE": {"type": "string"} - }, - "required": ["PROSE"], - "additionalProperties": false - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_metaschema.xml deleted file mode 100644 index 89ff57c44..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_metaschema.xml +++ /dev/null @@ -1,77 +0,0 @@ - - - - - - - Metaschema Unit Test: datatypes - 1.0-milestone1 - metaschema-datatypes - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes - - - parent - parent assembly - - - - - - - - - - - - - Date - With time zone - - - - Plain text - plain text, no markup - - - - Plain text - plain text, no markup - - Length - The length. - - - - - Rich text - Rich text supports markup - - - - Rich text - Rich text supports markup - - Length - The length. - - - - - Prose - Prose permits multiple paragraphs, lists, tables etc. - - - - Prose - Prose permits multiple paragraphs, lists, tables etc. - - Length - The length. - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_bad-date_FAIL.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_bad-date_FAIL.json deleted file mode 100644 index f49273496..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_bad-date_FAIL.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "$schema": "datatypes-prose_json-schema.json", - "parent": { - "date": "2019-06-31", - "plaintext": "Some *plain* text", - "richtext": "Some *rich* text", - "prose": { - "RICHTEXT": "Here's some *extra prose*", - "big": "yes" - } - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_valid_PASS.json deleted file mode 100644 index 33f2d3075..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_test_valid_PASS.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "parent": { - "field-date": "2019-07-08TZ", - "field-plaintext": "Some *plain* text", - "field-richtext": "Some *rich* text", - "field-prose": "Here's some *extra prose*" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_xml-schema.xsd deleted file mode 100644 index 6946c6cbd..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-prose_xml-schema.xsd +++ /dev/null @@ -1,413 +0,0 @@ - - - - - Metaschema Unit Test: datatypes - 1.0-milestone1 - metaschema-datatypes - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - - Prose - Prose permits multiple paragraphs, lists, tables etc. - - - Prose: Prose permits multiple paragraphs, lists, tables etc. - - - - - - - - - Prose - Prose permits multiple paragraphs, lists, tables etc. - - - Prose: Prose permits multiple paragraphs, lists, tables etc. - - - - - - - - - - - - Date - With time zone - - - Date: With time zone - - - - - - - - - - - Plain text - plain text, no markup - - - Plain text: plain text, no markup - - - - - - - - - - - Plain text - plain text, no markup - - - Plain text: plain text, no markup - - - - - - - - Length - The length. - - - Length: The length. - - - - - - - - - - Rich text - Rich text supports markup - - - Rich text: Rich text supports markup - - - - - - - - - Rich text - Rich text supports markup - - - Rich text: Rich text supports markup - - - - - - - Length - The length. - - - Length: The length. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The xs:date with a required timezone. - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_json-schema.json deleted file mode 100644 index 696747e77..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_json-schema.json +++ /dev/null @@ -1,60 +0,0 @@ - - { "$schema" : "http://json-schema.org/draft-07/schema#", - "$id" : "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-uri-schema.json", - "$comment" : "Metaschema Unit Test: URIs: JSON Schema", - "type" : "object", - "definitions" : - { "parent" : - { "title" : "parent", - "description" : "parent assembly", - "$id" : "#/definitions/parent", - "type" : "object", - "properties" : - { "uri-flag" : - { "title" : "Universal Resource Identifier Flag", - "description" : "Per W3C", - "type" : "string", - "format" : "uri" }, - "uri-reference-flag" : - { "title" : "Universal Resource Identifier Reference Flag", - "description" : "Per W3C, can be a relative URI", - "type" : "string", - "format" : "uri-reference" }, - "uri-fields" : - { "anyOf" : - [ - { "$ref" : "#/definitions/uri-field" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/uri-field" }, - "minItems" : 2 } ] }, - "uri-reference-fields" : - { "anyOf" : - [ - { "$ref" : "#/definitions/uri-reference-field" }, - - { "type" : "array", - "items" : - { "$ref" : "#/definitions/uri-reference-field" }, - "minItems" : 2 } ] } }, - "required" : - [ "uri-flag", - "uri-reference-flag" ], - "additionalProperties" : false }, - "uri-field" : - { "title" : "Universal Resource Identifier Flag", - "description" : "Per W3C", - "$id" : "#/definitions/uri-field", - "type" : "string", - "format" : "uri" }, - "uri-reference-field" : - { "title" : "Universal Resource Identifier Flag", - "description" : "Per W3C", - "$id" : "#/definitions/uri-reference-field", - "type" : "string", - "format" : "uri-reference" } }, - "properties" : - { "parent" : - { "$ref" : "#/definitions/parent" } }, - "required": [ "parent" ] } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_metaschema.xml deleted file mode 100644 index 503a8e225..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_metaschema.xml +++ /dev/null @@ -1,48 +0,0 @@ - - - - - - - Metaschema Unit Test: URIs - 1.0-milestone1 - metaschema-datatypes-uri - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-uri - - - parent - parent assembly - - Universal Resource Identifier Flag - Per W3C - - - Universal Resource Identifier Reference Flag - Per W3C, can be a relative URI - - - - - - - - - - - - - - Universal Resource Identifier Flag - Per W3C - - - - Universal Resource Identifier Flag - Per W3C - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_broken_FAIL.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_broken_FAIL.json deleted file mode 100644 index f3d397c10..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_broken_FAIL.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "parent": { - "uri-flag": "//pages.nist.gov/OSCAL", - "uri-reference-flag": "c:\\OSCAL", - "uri-fields": [ - "https://www.w3.org{}", - "https://www.w3.org/%%%%", - "http://www.nist.gov?x-y=z" - ], - "uri-reference-fields": [ "(|)" ] - - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_valid_PASS.json deleted file mode 100644 index a9ccf6c8b..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_test_valid_PASS.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "parent": { - "uri-flag": "http://pages.nist.gov/OSCAL", - "uri-reference-flag": "OSCAL", - "uri-fields": [ - "gopher://loc.gov", - "https://www.w3.org", - "http://www.nist.gov" - ], - "uri-reference-fields": "myhomepage.html" - } -} diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_xml-schema.xsd deleted file mode 100644 index cf7d847a0..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uri_xml-schema.xsd +++ /dev/null @@ -1,110 +0,0 @@ - - - - - Metaschema Unit Test: URIs - 1.0-milestone1 - metaschema-datatypes-uri - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - Universal Resource Identifier Flag - Per W3C - - - Universal Resource Identifier Flag: Per W3C - - - - - - Universal Resource Identifier Reference Flag - Per W3C, can be a relative URI - - - Universal Resource Identifier Reference Flag: Per W3C, can be a relative URI - - - - - - - - Universal Resource Identifier Flag - Per W3C - - - Universal Resource Identifier Flag: Per W3C - - - - - - - - - - - Universal Resource Identifier Flag - Per W3C - - - Universal Resource Identifier Flag: Per W3C - - - - - - - - - - A URI - - - - - - Requires a scheme with colon per RFC 3986 - - - - - - - A URI reference, such as a relative URL - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_json-schema.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_json-schema.json deleted file mode 100644 index 6f5d7cd2d..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_json-schema.json +++ /dev/null @@ -1,45 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-uri-schema.json", - "$comment": "Metaschema Unit Test: UUID Datatype: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "uuid-flag": { - "title": "Universally Unique Identifier Flag", - "description": "A version 4 UUID per RFC 4122.", - "type": "string", - "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" - }, - "uuid-fields": { - "anyOf": [ - {"$ref": "#/definitions/uuid-field"}, - { - "type": "array", - "items": {"$ref": "#/definitions/uuid-field"}, - "minItems": 2 - } - ] - } - }, - "required": ["uuid-flag"], - "additionalProperties": false - }, - "uuid-field": { - "title": "Universally Unique Identifier Field", - "description": "A version 4 UUID per RFC 4122.", - "$id": "#/definitions/uuid-field", - "type": "string", - "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": ["parent"] -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_metaschema.xml b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_metaschema.xml deleted file mode 100644 index 8d2d06481..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_metaschema.xml +++ /dev/null @@ -1,35 +0,0 @@ - - - - - - - Metaschema Unit Test: UUID Datatype - 1.0-milestone2 - metaschema-datatypes-uuid - http://csrc.nist.gov/ns/metaschema/unit-test/datatypes-uri - - - parent - parent assembly - - Universally Unique Identifier Flag - A version 4 UUID per RFC 4122. - - - - - - - - - - Universally Unique Identifier Field - A version 4 UUID per RFC 4122. - - - diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_valid_PASS.json deleted file mode 100644 index 7426f312b..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_valid_PASS.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "parent": { - "uuid-flag": "6b034d60-d2d3-4b64-b0f2-e230efca09d3", - "uuid-fields": [ - "f70e7c83-f063-4928-992b-14617b58cb69", - "4b1344c3-88e2-4435-939a-feb000e554f4", - "398f9ba5-b95d-4fa2-9e33-a12b85d1e182", - "01d5b087-56f9-4379-ba06-a65042edbb6a" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_version-1-invalid_FAIL.json b/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_version-1-invalid_FAIL.json deleted file mode 100644 index c4460df94..000000000 --- a/test-suite/oscal-m2-schema-generation/datatypes/datatypes-uuid_test_version-1-invalid_FAIL.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "uuid-flag": "157f7b90-a113-11ea-bb37-0242ac130002" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-basic_json-schema.json b/test-suite/oscal-m2-schema-generation/flag/flag-basic_json-schema.json deleted file mode 100644 index 94ec64556..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-basic_json-schema.json +++ /dev/null @@ -1,35 +0,0 @@ - - { "$schema" : "http://json-schema.org/draft-07/schema#", - "$id" : "http://csrc.nist.gov/ns/oscal/unit-testing/flag-basic-schema.json", - "$comment" : "Metaschema Unit Test: flag: basic flag: JSON Schema", - "type" : "object", - "definitions" : - { "parent" : - { "title" : "parent", - "description" : "parent assembly", - "$id" : "#/definitions/parent", - "type" : "object", - "properties" : - { "flag" : - { "type" : "string", - "title" : "Flag", - "description" : "A basic flag" }, - "flag-required" : - { "type" : "string", - "title" : "Required Flag", - "description" : "A basic required flag" }, - "flag-constrained" : - { "type" : "number", - "pattern" : "^(\\+|-)?([0-9]+(\\.[0-9]*)?|\\.[0-9]+)$", - "title" : "Constrained Flag", - "description" : "With decimal values", - "enum" : - [ 1.0, - 1.1 ] } }, - "required" : - [ "flag-required" ], - "additionalProperties" : false } }, - "properties" : - { "parent" : - { "$ref" : "#/definitions/parent" } }, - "required": [ "parent" ] } \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-basic_metaschema.xml b/test-suite/oscal-m2-schema-generation/flag/flag-basic_metaschema.xml deleted file mode 100644 index eff6c1596..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-basic_metaschema.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - - Metaschema Unit Test: flag: basic flag - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/oscal/unit-testing/flag-basic - - - parent - parent assembly - - - - - - - - Flag - A basic flag - - - Required Flag - A basic required flag - - - Constrained Flag - With decimal values - - one-dot-oh - one-dot-one - - - diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_datatype_FAIL.json b/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_datatype_FAIL.json deleted file mode 100644 index 57ef1304e..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_datatype_FAIL.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "parent": { - "flag-required": "string", - "flag-constrained": "c" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_simple_PASS.json b/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_simple_PASS.json deleted file mode 100644 index 42413f3d5..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-basic_test_simple_PASS.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "parent": { - "flag-required": "string", - "flag-constrained": 1.1 - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-basic_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/flag/flag-basic_xml-schema.xsd deleted file mode 100644 index 3c4890c8d..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-basic_xml-schema.xsd +++ /dev/null @@ -1,78 +0,0 @@ - - - - - Metaschema Unit Test: flag: basic flag - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - Flag - A basic flag - - - Flag: A basic flag - - - - - - Required Flag - A basic required flag - - - Required Flag: A basic required flag - - - - - - Constrained Flag - With decimal values - - - Constrained Flag: With decimal values - - - - - - -

one-dot-oh

- - - - - - -

one-dot-one

- - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-override_metaschema.xml b/test-suite/oscal-m2-schema-generation/flag/flag-override_metaschema.xml deleted file mode 100644 index 5a8a7a925..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-override_metaschema.xml +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - - Metaschema Unit Test: flag: basic flag - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/oscal/unit-testing/flag-basic - - - parent - parent assembly - - - - - - - Z - - - - - - - - Child 1 - A child with a unique set of properties. - - - - - E - F - - - - - - - - Child 2 - A child with a unique set of properties. - - - - - G - H - - - - - - - - Property A - A property with a name. - - Property Name - With valid values - - A - B - - - - - - Property B - A property with a name. - - - - - Property Name - With valid values - - X - Y - - - diff --git a/test-suite/oscal-m2-schema-generation/flag/flag-override_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/flag/flag-override_xml-schema.xsd deleted file mode 100644 index cd7d67da9..000000000 --- a/test-suite/oscal-m2-schema-generation/flag/flag-override_xml-schema.xsd +++ /dev/null @@ -1,152 +0,0 @@ - - - - - Metaschema Unit Test: flag: basic flag - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - - - Child 1 - A child with a unique set of properties. - - - Child 1: A child with a unique set of properties. - - - - - - - - - - - Child 2 - A child with a unique set of properties. - - - Child 2: A child with a unique set of properties. - - - - - - - - - - - Property A - A property with a name. - - - Property A: A property with a name. - - - - - - - - Property Name - With valid values - - - Property Name: With valid values - - - - - - -

A

- - - - - - -

B

- - - - - - - - - - - - - - Property B - A property with a name. - - - Property B: A property with a name. - - - - - - - - Property Name - With valid values - - - Property Name: With valid values - - - - - - -

X

- - - - - - -

Y

- - - - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_json-schema.json deleted file mode 100644 index 8aaa720ac..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_json-schema.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array-bounded-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 2, - "maxItems": 3 - } - }, - "required": ["props"], - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "string" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_metaschema.xml deleted file mode 100644 index cbcdb8723..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array-bounded - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-inside_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-inside_PASS.json deleted file mode 100644 index 5cc14ea81..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-inside_PASS.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": [ "test1", "test2", "test3" ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-singleton_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-singleton_FAIL.json deleted file mode 100644 index a8ca337a3..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-singleton_FAIL.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": [ "test1" ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-upper_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-upper_FAIL.json deleted file mode 100644 index 53009e998..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_test_array-upper_FAIL.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": [ "test1", "test2", "test3", "test4" ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_xml-schema.xsd deleted file mode 100644 index 09f11c1ee..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-bounded_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_metaschema.xml deleted file mode 100644 index 2b810007b..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as - - - parent - parent assembly - - - - - - - - - prop - prop field - - \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_validation-schematron-FAIL b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_validation-schematron-FAIL deleted file mode 100644 index e69de29bb..000000000 diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_xml-schema.xsd deleted file mode 100644 index 5fef8c75d..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-invalid-max_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_json-schema.json deleted file mode 100644 index 2b7ea3545..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_json-schema.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array-optional-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 1 - } - }, - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "string" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_metaschema.xml deleted file mode 100644 index 15b7e3f81..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array-optional - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_empty_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_empty_FAIL.json deleted file mode 100644 index 856aada17..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_empty_FAIL.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "parent": { - "props": [ - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_valid_PASS.json deleted file mode 100644 index c039e833a..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_test_valid_PASS.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "parent": { - "props": [ - "test1" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_xml-schema.xsd deleted file mode 100644 index ceaf9fe75..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array-optional_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array_json-schema.json deleted file mode 100644 index cf8df333f..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_json-schema.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 1 - } - }, - "required": ["props"], - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "string" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-array_metaschema.xml deleted file mode 100644 index f28c4f313..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-array - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_singleton_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_singleton_FAIL.json deleted file mode 100644 index 5b0ebbb75..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_singleton_FAIL.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": "test1" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_valid_PASS.json deleted file mode 100644 index 6a8a6114d..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_test_valid_PASS.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "parent": { - "props": [ - "test1", - "test2", - "test3" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-array_xml-schema.xsd deleted file mode 100644 index e7dad984d..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-array_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_json-schema.json deleted file mode 100644 index 69e132f56..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_json-schema.json +++ /dev/null @@ -1,48 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-by-key-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "type": "object", - "minProperties": 1, - "additionalProperties": { - "allOf": [ - { - "type": "object", - "$ref": "#/definitions/prop" - }, - { "not": { "type": "string" } } - ] - } - } - }, - "required": ["props"], - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "object", - "properties": { - "STRVALUE": { - "type": "string" - } - }, - "required": ["STRVALUE"], - "additionalProperties": false - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_metaschema.xml deleted file mode 100644 index 8124958ad..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_metaschema.xml +++ /dev/null @@ -1,35 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-by-key - - - parent - parent assembly - - - - - - - - - prop - prop field - - - ID - Identifier - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_invalid-child_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_invalid-child_FAIL.json deleted file mode 100644 index 3008f9513..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_invalid-child_FAIL.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "parent": { - "props": { - "id1": {"STRVALUE": "test1"}, - "id2": "test2" - } - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_valid_PASS.json deleted file mode 100644 index f0b784ed3..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_test_valid_PASS.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "parent": { - "props": { - "id3": {"STRVALUE": "test3"}, - "id2": {"STRVALUE": ""}, - "id1": {"STRVALUE": "test1"} - } - } -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_xml-schema.xsd deleted file mode 100644 index 84c39ea57..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-by-key_xml-schema.xsd +++ /dev/null @@ -1,62 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - ID - Identifier - - - ID: Identifier - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_json-schema.json deleted file mode 100644 index 59e98d248..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_json-schema.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-singleton-or-array-optional-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "anyOf": [ - { - "$ref": "#/definitions/prop" - }, - { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 2 - } - ] - } - }, - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "string" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_metaschema.xml deleted file mode 100644 index 82db8d79e..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-singleton-or-array-optional - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_empty_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_empty_FAIL.json deleted file mode 100644 index 856aada17..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_empty_FAIL.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "parent": { - "props": [ - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_invalid-array-singleton_FAIL.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_invalid-array-singleton_FAIL.json deleted file mode 100644 index c039e833a..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_invalid-array-singleton_FAIL.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "parent": { - "props": [ - "test1" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-array_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-array_PASS.json deleted file mode 100644 index 76f187e01..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-array_PASS.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "parent": { - "props": [ - "test1", "test2" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-singleton_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-singleton_PASS.json deleted file mode 100644 index 68f6dde04..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_test_valid-singleton_PASS.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": "test1" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_xml-schema.xsd deleted file mode 100644 index d3fdff2b8..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array-optional_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_json-schema.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_json-schema.json deleted file mode 100644 index 89d426c98..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_json-schema.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/group-as-singleton-or-array-schema.json", - "$comment": "Metaschema Unit Test: group-as: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "anyOf": [ - { - "$ref": "#/definitions/prop" - }, - { - "type": "array", - "items": {"$ref": "#/definitions/prop"}, - "minItems": 2 - } - ] - } - }, - "required": ["props"], - "additionalProperties": false - }, - "prop": { - "title": "prop", - "description": "prop field", - "$id": "#/definitions/prop", - "type": "string" - } - }, - "properties": { - "parent": {"$ref": "#/definitions/parent"} - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_metaschema.xml b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_metaschema.xml deleted file mode 100644 index 0061aa53a..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_metaschema.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - http://csrc.nist.gov/ns/metaschema/unit-test/group-as-singleton-or-array - - - parent - parent assembly - - - - - - - - - prop - prop field - - diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_singleton_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_singleton_PASS.json deleted file mode 100644 index 5b0ebbb75..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_singleton_PASS.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "parent": { - "props": "test1" - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_valid-array_PASS.json b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_valid-array_PASS.json deleted file mode 100644 index 6a8a6114d..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_test_valid-array_PASS.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "parent": { - "props": [ - "test1", - "test2", - "test3" - ] - } -} \ No newline at end of file diff --git a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_xml-schema.xsd deleted file mode 100644 index af3b32c36..000000000 --- a/test-suite/oscal-m2-schema-generation/group-as/group-as-singleton-or-array_xml-schema.xsd +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Metaschema Unit Test: group-as - 1.0-milestone1 - metaschema-group-as - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - prop - prop field - - - prop: prop field - - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_json-schema.json b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_json-schema.json deleted file mode 100644 index 56973a9f9..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_json-schema.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/json-value-key-field-schema.json", - "$comment": "Metaschema Unit Test: json-value-key-field: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "props": { - "anyOf": [ - { - "$ref": "#/definitions/prop" - }, - { - "type": "array", - "items": { - "$ref": "#/definitions/prop" - }, - "minItems": 2 - } - ] - } - }, - "additionalProperties": false - }, - "prop": { - "title": "Property", - "description": "A value with a name, attributed to the containing control, subcontrol, part, or group.", - "$id": "#/definitions/prop", - "type": "object", - "properties": { - "id": { - "type": "string", - "title": "Identifier", - "description": "Unique identifier of the containing object" - }, - "ns": { - "type": "string", - "title": "Namespace", - "description": "A namespace qualifying the name." - }, - "class": { - "type": "string", - "title": "Class", - "description": "Indicating the type or classification of the containing object" - } - }, - "minProperties": 1, - "maxProperties": 4 - } - }, - "properties": { - "parent": { - "$ref": "#/definitions/parent" - } - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_metaschema.xml b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_metaschema.xml deleted file mode 100644 index 697767be3..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_metaschema.xml +++ /dev/null @@ -1,53 +0,0 @@ - - - - - - - Metaschema Unit Test: json-value-key-field - 1.0-milestone1 - json-value-key-field - http://csrc.nist.gov/ns/metaschema/unit-test/json-value-key-field - - - parent - parent assembly - - - - - - - - - Property - A value with a name, attributed to the containing control, subcontrol, part, - or group. - - - - - - - - - Name - Identifying the purpose and intended use of the property, part or other object. - - - Identifier - Unique identifier of the containing object - - - Namespace - A namespace qualifying the name. - - - Class - Indicating the type or classification of the containing object - - diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_test_valid_PASS.json b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_test_valid_PASS.json deleted file mode 100644 index d57eb4987..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_test_valid_PASS.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "parent": { - "props": [ - { - "prop1": "value1" - }, - { - "prop1": "value1", - "id": "id2", - "ns": "https://nist.gov/blah", - "class": "class1" - }, - { - "prop1": "value1", - "id": "id2", - "blah": "https://nist.gov/blah", - "class": "class1" - } - ] - } -} diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_xml-schema.xsd deleted file mode 100644 index 60dfd3df9..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-field_xml-schema.xsd +++ /dev/null @@ -1,90 +0,0 @@ - - - - - Metaschema Unit Test: json-value-key-field - 1.0-milestone1 - json-value-key-field - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - Property - A value with a name, attributed to the containing control, subcontrol, part, - or group. - - - Property: A value with a name, attributed to the containing control, subcontrol, part, - or group. - - - - - - - - Name - Identifying the purpose and intended use of the property, part or other object. - - - Name: Identifying the purpose and intended use of the property, part or other object. - - - - - - Identifier - Unique identifier of the containing object - - - Identifier: Unique identifier of the containing object - - - - - - Namespace - A namespace qualifying the name. - - - Namespace: A namespace qualifying the name. - - - - - - Class - Indicating the type or classification of the containing object - - - Class: Indicating the type or classification of the containing object - - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_json-schema.json b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_json-schema.json deleted file mode 100644 index 303b9e702..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_json-schema.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "http://csrc.nist.gov/ns/metaschema/unit-test/json-value-key-label-schema.json", - "$comment": "Metaschema Unit Test: json-value-key-label: JSON Schema", - "type": "object", - "definitions": { - "parent": { - "title": "parent", - "description": "parent assembly", - "$id": "#/definitions/parent", - "type": "object", - "properties": { - "links": { - "anyOf": [ - { - "$ref": "#/definitions/link" - }, - { - "type": "array", - "items": { - "$ref": "#/definitions/link" - }, - "minItems": 2 - } - ] - } - }, - "additionalProperties": false - }, - "link": { - "title": "Link", - "description": "A reference to a local or remote resource", - "$id": "#/definitions/link", - "type": "object", - "properties": { - "href": { - "type": "string", - "format": "uri-reference", - "title": "hypertext reference", - "description": "A link to a document or document fragment (actual, nominal or projected)" - }, - "rel": { - "type": "string", - "title": "Relation", - "description": "Purpose of the link" - }, - "media-type": { - "type": "string", - "title": "Media type", - "description": "Describes the media type of a linked resource" - }, - "text": { - "type": "string" - } - }, - "required": [ - "text", - "href" - ], - "additionalProperties": false - } - }, - "properties": { - "parent": { - "$ref": "#/definitions/parent" - } - }, - "required": [ "parent" ] -} diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_metaschema.xml b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_metaschema.xml deleted file mode 100644 index 3db977775..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_metaschema.xml +++ /dev/null @@ -1,48 +0,0 @@ - - - - - - - Metaschema Unit Test: json-value-key-label - 1.0-milestone1 - json-value-key-label - http://csrc.nist.gov/ns/metaschema/unit-test/json-value-key-label - - - parent - parent assembly - - - - - - - - - Link - A reference to a local or remote resource - text - - - - - - - hypertext reference - A link to a document or document fragment (actual, nominal or projected) - - - - Relation - Purpose of the link - - - Media type - Describes the media type of a linked resource - - diff --git a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_xml-schema.xsd b/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_xml-schema.xsd deleted file mode 100644 index 2af6cef7e..000000000 --- a/test-suite/oscal-m2-schema-generation/json-value-key/json-value-key-label_xml-schema.xsd +++ /dev/null @@ -1,88 +0,0 @@ - - - - - Metaschema Unit Test: json-value-key-label - 1.0-milestone1 - json-value-key-label - parent - - - - - - parent - parent assembly - - - parent: parent assembly - - - - - - - - - - - Link - A reference to a local or remote resource - - - Link: A reference to a local or remote resource - - - - - - - - hypertext reference - A link to a document or document fragment (actual, nominal or projected) - - - hypertext reference: A link to a document or document fragment (actual, nominal or projected) - - - - - - Relation - Purpose of the link - - - Relation: Purpose of the link - - - - - - Media type - Describes the media type of a linked resource - - - Media type: Describes the media type of a linked resource - - - - - - - - - A URI reference, such as a relative URL - - - - - - diff --git a/test-suite/oscal-m2-schema-generation/run-tests.sh b/test-suite/oscal-m2-schema-generation/run-tests.sh deleted file mode 100644 index 4e2f2622d..000000000 --- a/test-suite/oscal-m2-schema-generation/run-tests.sh +++ /dev/null @@ -1,355 +0,0 @@ -#!/bin/bash - - -if [ -z ${OSCAL_SCRIPT_INIT+x} ]; then - source "$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)/../../scripts/include/common-environment.sh" -fi - -source "$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)/../../scripts/include/init-schema-generation.sh" -source "$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)/../../scripts/include/init-schematron.sh" - -# configuration -UNIT_TESTS_DIR=$(get_abs_path "${METASCHEMA_SCRIPT_DIR}/../test-suite/schema-generation") -METASCHEMA_SCHEMA=$(get_abs_path "${METASCHEMA_SCRIPT_DIR}/../toolchains/oscal-m2/lib/metaschema.xsd") -DEBUG="false" - -# Option defaults -KEEP_TEMP_SCRATCH_DIR=false - -usage() { # Function: Print a help message. - cat << EOF -Usage: $0 [options] [test dir] -Run all build scripts - --h, -help, Display help --v Provide verbose output ---scratch-dir DIR Generate temporary artifacts in DIR - If not provided a new directory will be - created under \$TMPDIR if set or in /tmp. ---keep-temp-scratch-dir If a scratch directory is automatically - created, it will not be automatically removed. -EOF -} - -OPTS=`getopt -o w:vh --long scratch-dir:,keep-temp-scratch-dir,help -n "$0" -- "$@"` -if [ $? != 0 ] ; then echo -e "Failed parsing options." >&2 ; usage ; exit 1 ; fi - -# Process arguments -eval set -- "$OPTS" -while [ $# -gt 0 ]; do - arg="$1" - case "$arg" in - --scratch-dir) - SCRATCH_DIR="$(realpath "$2")" - shift # past unit_test_dir - ;; - --keep-temp-scratch-dir) - KEEP_TEMP_SCRATCH_DIR=true - ;; - -v) - VERBOSE=true - ;; - -h|--help) - usage - exit 0 - ;; - --) # end of options - shift - break; - ;; - *) # unknown option - echo -e "Unhandled option: $1" - exit 1 - ;; - esac - shift # past argument -done - -OTHER_ARGS=$@ # save the arg - -if [ -z "${SCRATCH_DIR+x}" ]; then - SCRATCH_DIR="$(mktemp -d)" - if [ "$KEEP_TEMP_SCRATCH_DIR" != "true" ]; then - function CleanupScratchDir() { - rc=$? - if [ "$VERBOSE" = "true" ]; then - echo -e "" - echo -e "${P_INFO}Cleanup${P_END}" - echo -e "${P_INFO}=======${P_END}" - echo -e "${P_INFO}Deleting scratch directory:${P_END} ${SCRATCH_DIR}" - fi - rm -rf "${SCRATCH_DIR}" - exit $rc - } - trap CleanupScratchDir EXIT - fi -fi - -generate_and_validate_schema() { - local unit_test_collection_dir="$1"; shift - local unit_test_path_prefix="$1"; shift - local metaschema="$1"; shift - local schema_output="$1"; shift - local format="$1"; shift - - metaschema_relative=$(get_rel_path "$unit_test_collection_dir" "$metaschema") - - if [ "$VERBOSE" = "true" ]; then - echo -e " ${P_INFO}Generating ${format^^} schema for '${P_END}${metaschema_relative}${P_INFO}' as '${P_END}$schema_output${P_INFO}'.${P_END}" - fi - - result=$(generate_schema "$format" "$metaschema" "$schema_output") - cmd_exitcode=$? - if [ -n "$result" ]; then - >&2 echo -e "${result}" - fi - if [ $cmd_exitcode -ne 0 ]; then - >&2 echo -e " ${P_ERROR}Failed to generate ${format^^} schema for '${P_END}${metaschema_relative}${P_ERROR}'.${P_END}" - return 1 - fi - - result=$(validate_schema "$format" "$schema_output") - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - if [ -n "$result" ]; then - >&2 echo -e "${result}" - fi - >&2 echo -e " ${P_ERROR}Failed to validate generated ${format^^} schema '${P_END}$schema_output${P_ERROR}'.${P_END}" - return 2; - fi - echo -e " ${P_OK}Generated valid ${format^^} schema for '${P_END}${metaschema_relative}${P_OK}' as '${P_END}$schema_output${P_OK}'.${P_END}" - - # diff the generated schema with the expected schema - case ${format} in - xml) - expected_schema="${unit_test_path_prefix}_xml-schema.xsd" - diff_tool="diff" - ;; - json) - expected_schema="${unit_test_path_prefix}_json-schema.json" - diff_tool="json-diff" - ;; - esac - expected_schema_relative=$(get_rel_path "$unit_test_collection_dir" "$expected_schema") - - # Only perform this check if an expected schema exists - if [ -f "$expected_schema" ]; then - diff=$("$diff_tool" "$expected_schema" "$schema_output") - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - echo -e " ${P_ERROR}Generated ${format^^} schema '${P_END}${schema_output}${P_ERROR}' doesn't match expected schema '${P_END}${expected_schema_relative}${P_ERROR}'.${P_END}" - echo -e "${P_ERROR}${diff}${P_END}" - return 3; - else - echo -e " ${P_OK}Generated ${format^^} schema matches expected schema '${P_END}${expected_schema_relative}${P_OK}'.${P_END}" - fi - fi - return 0; -} - -run_test_instances() { - local unit_test_collection_dir="$1"; shift - local unit_test_collection_name="$1"; shift - local unit_test_name="$1"; shift - local schema="$1"; shift - local format="$1"; shift - - exitcode=0 - while IFS= read -d $'\0' -r test_instance ; do - test_instance_file=$(basename -- "$test_instance") - test_instance_name="${test_instance_file/${unit_test_collection_name}-${unit_test_name}_test_/}" - shopt -s extglob - test_instance_name="${test_instance_name%%.@(xml|json)}" - shopt -u extglob - condition="${test_instance_name##*_}" - test_instance_name="${test_instance_name%_*}" - - if [ "$VERBOSE" = "true" ]; then - echo -e " ${P_INFO}Evaluating test instance:${P_END} ${test_instance_name} = ${condition}" - fi - - result=$(validate "$schema" "$test_instance" "$format" 2>&1) - cmd_exitcode=$? - - case "$condition" in - PASS) - if [ $cmd_exitcode -ne 0 ]; then - echo -e " ${P_ERROR}${format^^} test instance '${P_END}${test_instance_name}${P_ERROR}' failed. Expected PASS.${P_END}" - echo -e "${P_ERROR}${result}${P_END}" - exitcode=1 - else - echo -e " ${P_OK}${format^^} test instance '${P_END}${test_instance_name}${P_OK}' passed.${P_END}" - fi - ;; - FAIL) - if [ $cmd_exitcode -eq 0 ]; then - echo -e " ${P_ERROR}${format^^} test instance '${P_END}${test_instance_name}${P_ERROR}' passed. Expected FAIL.${P_END}" - echo -e "${P_ERROR}${result}${P_END}" - exitcode=1 - else - echo -e " ${P_OK}${format^^} test instance '${P_END}${test_instance_name}${P_OK}' passed.${P_END}" - fi - ;; - *) - echo -e "${P_ERROR}Unsupported condition '$condition' for test instance '$test_instance_name'.${P_END}" - exitcode=1 - ;; - esac - done < <(find "$unit_test_collection_dir" -maxdepth 1 -name "${unit_test_collection_name}-${unit_test_name}_test_*.${format}" -type f -print0) - return $exitcode; -} - -echo -e "" -echo -e "${P_INFO}Running Unit Tests${P_END}" -echo -e "${P_INFO}==================${P_END}" - -if [ "$VERBOSE" = "true" ]; then - echo -e "${P_INFO}Using scratch directory:${P_END} ${SCRATCH_DIR}" -fi - -# compile the schematron -metaschema_lib=$(get_abs_path "${METASCHEMA_SCRIPT_DIR}/../toolchains/oscal-m2/lib") -schematron="$metaschema_lib/metaschema-check.sch" -compiled_schematron="${SCRATCH_DIR}/metaschema-schematron-compiled.xsl" - -build_schematron "$schematron" "$compiled_schematron" -cmd_exitcode=$? -if [ $cmd_exitcode -ne 0 ]; then - echo -e "${P_ERROR}Compilation of Schematron '${P_END}${schematron}${P_ERROR}' failed.${P_END}" - exit 1 -fi -# the following is needed by the compiled template -cp "${metaschema_lib}/metaschema-compose.xsl" "${SCRATCH_DIR}" -cp "${metaschema_lib}/oscal-datatypes-check.xsl" "${SCRATCH_DIR}" - -test_dirs=() -if [ -n "$1" ]; then - test_dirs+=("$1") -else - while read -r -d $'\0' dir; do - test_dirs+=("$dir") - done < <(find "$UNIT_TESTS_DIR" -mindepth 1 -maxdepth 1 -type d -print0) -fi - -if [ "$VERBOSE" == "true" ]; then - echo -e "${P_INFO}Executing tests in:${P_END}" - for test_dir in ${test_dirs[@]}; do - echo -e " ${test_dir}" - done -fi - -exitcode=0 -for unit_test_collection_dir in "${test_dirs[@]}" -do - # get absolute and relative paths of the unit test collection - unit_test_collection_dir=$(get_abs_path "$unit_test_collection_dir") - unit_test_collection_name=$(basename -- "$unit_test_collection_dir") - echo -e "${P_INFO}Processing unit test collection:${P_END} ${unit_test_collection_name}" - - metaschema_units=() - while read -r -d $'\0' unit; do - metaschema_units+=("$unit") - done < <(find "$unit_test_collection_dir" -maxdepth 1 -name "*_metaschema.xml" -type f -print0) - - unit_test_collection_scratch_dir="$SCRATCH_DIR/$unit_test_collection_name" - mkdir -p "$unit_test_collection_scratch_dir" - - for metaschema in ${metaschema_units[@]}; do - metaschema_file="$(basename -- "$metaschema")" - unit_test_name="${metaschema_file/_metaschema.xml/}" - unit_test_path_prefix="$unit_test_collection_dir/${unit_test_name}" - - echo -e "${P_INFO}Processing unit test:${P_END} ${unit_test_name}" - - unit_test_scratch_dir_prefix="$unit_test_collection_scratch_dir/$unit_test_name" - - metaschema_relative=$(realpath --relative-to="$unit_test_collection_dir" "$metaschema") - - # first validate the metaschema - if [ "$VERBOSE" = "true" ]; then - echo -e " ${P_INFO}Validating Metaschema:${P_END} ${metaschema_relative}" - fi - result=$(validate_xml "$METASCHEMA_SCHEMA" "$metaschema" 2>&1) - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - echo -e " ${P_ERROR}Metaschema '${P_END}${metaschema_relative}${P_ERROR}' is not XML Schema valid.${P_END}" - echo -e "${P_ERROR}${result}${P_END}" - exitcode=1 - continue - fi - - if [ "$VERBOSE" = "true" ]; then - echo -e " ${P_OK}Metaschema '${P_END}${metaschema_relative}${P_OK}' is XML Schema valid.${P_END}" - fi - - svrl_result="${unit_test_scratch_dir_prefix}.svrl" - result=$(validate_with_schematron "$compiled_schematron" "$metaschema" "$svrl_result" 2>&1) - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - if [ -f "${unit_test_path_prefix}_validation-schematron-FAIL" ]; then - if [ "$VERBOSE" = "true" ]; then - echo -e " ${P_OK}Metaschema '${P_END}${metaschema_relative}${P_OK}' was expected to fail the schematron checks.${P_END}" - fi - continue; - else - echo -e " ${P_ERROR}Metaschema '${P_END}${metaschema_relative}${P_ERROR}' did not pass the schematron checks.${P_END}" - echo -e "${P_ERROR}${result}${P_END}" - exitcode=1 - continue; - fi - fi - - json_schema_valid=true - if [ "$DEBUG" == "true" ]; then - # skip this step and use the expected schema as the schema - json_schema="${unit_test_path_prefix}_json-schema.json" - else - # Now generate the JSON schema - json_schema="${unit_test_scratch_dir_prefix}_generated-json-schema.json" - - generate_and_validate_schema "$unit_test_collection_dir" "$unit_test_path_prefix" "$metaschema" "$json_schema" "json" - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - json_schema_valid=false - exitcode=1 - continue; - fi - fi - - xml_schema_valid=true - if [ "$DEBUG" == "true" ]; then - # skip this step and use the expected schema as the schema - xml_schema="${unit_test_path_prefix}_json-schema.json" - else - # Now generate the XML schema - xml_schema="${unit_test_scratch_dir_prefix}_generated-xml-schema.xsd" - generate_and_validate_schema "$unit_test_collection_dir" "$unit_test_path_prefix" "$metaschema" "$xml_schema" "xml" - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - xml_schema_valid=false - exitcode=1 - continue; - fi - fi - - # now run test instances - if [ "$json_schema_valid" = "true" ]; then - run_test_instances "$unit_test_collection_dir" "$unit_test_collection_name" "$unit_test_name" "$json_schema" "json" - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - exitcode=1 - fi - fi - - if [ "$xml_schema_valid" = "true" ]; then - run_test_instances "$unit_test_collection_dir" "$unit_test_collection_name" "$unit_test_name" "$xml_schema" "xml" - cmd_exitcode=$? - if [ $cmd_exitcode -ne 0 ]; then - exitcode=1 - fi - fi - - done -done - -exit $exitcode diff --git a/test-suite/oscal-m2-schema-generation/testing.md b/test-suite/oscal-m2-schema-generation/testing.md deleted file mode 100644 index 08e3e01b6..000000000 --- a/test-suite/oscal-m2-schema-generation/testing.md +++ /dev/null @@ -1,29 +0,0 @@ -# Running the unit tests - -So far we have unit testing in place for JSON schema generation and for validating correctness of generated schemas by validating instances known to be good or bad. - -We will be extending this to cover XSD generation, generation of XML and JSON conversion tooling, and the correctness of those conversions. - -Metaschemas should follow this naming convention. Note the use of underscores as delimiters between parts of this name. - -where -- `$TESTSET` represents a subdirectory name for a set of tests, such as `datatypes` -- `$SCOPE` is a keyword for a subset of tests in `$TESTSET`, such as `date` -- `$KEYWORD` is a keyword indicating a particular teste -- `$EXPECT` is `PASS` or `FAIL` depending on whether a test instance is known to be valid (it should PASS) or invalid (it should FAIL) - - -`$TESTSET-$SCOPE_metaschema.xml` is recognized as a Metaschema - -`$TESTSET-$SCOPE_test_$KEYWORD_$EXPECT.json is` recognized as a JSON instance to be tested against the Schema produced for the `$TESTSET-$SCOPE` metaschema. - -Note that different keywords can be used to distinguish tests expected to be valid or invalid to the metaschema indicated by `$TESTSET-$SCOPE`. - -Examples: - -- `datatypes-datetime-no-tz_metaschema.xml` - A metaschema for validating the `datatypes-datetime-no-tz` family of tests -- `datatypes-date_test_valid_PASS.json` is a JSON instance expected to be found valid to the schema defined by (derived from) the metaschema -- `datatypes-date_test_tricky_FAIL.json` is a JSON instance expected to be found *invalid* to the schema defined by (derived from) the metaschema - - - diff --git a/test-suite/oscal/update-metaschema_M3-patches.xsl b/test-suite/oscal/update-metaschema_M3-patches.xsl deleted file mode 100644 index 62e12e2d4..000000000 --- a/test-suite/oscal/update-metaschema_M3-patches.xsl +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - - - - - - - - The Base64 alphabet in RFC 2045 - aligned with XSD. - - - - - - - - - yes - - - - - - \ No newline at end of file diff --git a/test-suite/oscal/update-metaschema_declarations.xsl b/test-suite/oscal/update-metaschema_declarations.xsl deleted file mode 100644 index c0da5f8e8..000000000 --- a/test-suite/oscal/update-metaschema_declarations.xsl +++ /dev/null @@ -1,113 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - href="../../support/lib/metaschema-check.sch" type="application/xml" schematypens="http://purl.oclc.org/dsdl/schematron" - - - - - - - - - - - { @name } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - yes - - - - - - - - - - - - - - - - yes - - - - - - - - . - - - - - - - - - - \ No newline at end of file diff --git a/test-suite/oscal/update-metaschema_documentation.xsl b/test-suite/oscal/update-metaschema_documentation.xsl deleted file mode 100644 index 4bd69ac0f..000000000 --- a/test-suite/oscal/update-metaschema_documentation.xsl +++ /dev/null @@ -1,66 +0,0 @@ - - - - - - - - - - - - - - - - { (root-name,use-name,@name)[1] } { local-name(.) => - substring-after('define-') } - - - { (root-name,use-name,@name)[1] } { local-name(.) => - substring-after('define-') } ... - - - - - - - - - - - - - - - - - - - - - - - -

- -

- - - - - - - - The Base64 alphabet in RFC 2045 - aligned with XSD. - - \ No newline at end of file diff --git a/test-suite/oscal/update-metaschema_finish.xsl b/test-suite/oscal/update-metaschema_finish.xsl deleted file mode 100644 index c1e47c15b..000000000 --- a/test-suite/oscal/update-metaschema_finish.xsl +++ /dev/null @@ -1,65 +0,0 @@ - - - - - - - - - - - - - - ../../toolchains/xslt-M4/validate - - - - href="{ $schema-dir }/metaschema-check.sch" type="application/xml" schematypens="http://purl.oclc.org/dsdl/schematron" - - - - - - - - - - - - - - http://csrc.nist.gov/ns/oscal/metaschema/1.0 { $schema-dir }/metaschema.xsd - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/test-suite/oscal/update-oscalM3-metaschema.xpl b/test-suite/oscal/update-oscalM3-metaschema.xpl deleted file mode 100644 index d8b27abfd..000000000 --- a/test-suite/oscal/update-oscalM3-metaschema.xpl +++ /dev/null @@ -1,68 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/test-suite/oscal/v1.0.0/examples/computer-build_metaschema.xml b/test-suite/oscal/v1.0.0/examples/computer-build_metaschema.xml new file mode 100644 index 000000000..41416466d --- /dev/null +++ b/test-suite/oscal/v1.0.0/examples/computer-build_metaschema.xml @@ -0,0 +1,57 @@ + + + + + + Computer Build + 1.0 + computer-build + http://csrc.nist.gov/ns/computer-build/1.0 + http://csrc.nist.gov/ns/computer-build/1.0 + + + Computer Build + A description of the components used to build a computer. + + Computer Build Identifier + A unique id for a given build + + + + + + + + + + Computer Component + A description of a component used to build a computer. + + Computer Component Identifier + A unique id for a given component + + + + + + + + + + Component Name + A name of a component used to build a computer. + + + + Description + A description of a component used in a computer build. + + + + Model + The model code of a computer component. + + diff --git a/test-suite/oscal/v1.0.0/metaschema-browser.xsl b/test-suite/oscal/v1.0.0/metaschema-browser.xsl new file mode 100644 index 000000000..c8d17ac91 --- /dev/null +++ b/test-suite/oscal/v1.0.0/metaschema-browser.xsl @@ -0,0 +1,396 @@ + + + + + + + + + + + + + + + + +
+ +
+ + + +

+ +

+ + + +
+

+ : + flag

+ + +
+ + + +
+

+ : + + field + +

+ + +

Supports inline encoding

 +

True whenever given (presence signifies Boolean value)

 + + + +
+

The field supports:

+
    + +
+
+ + + + +
+ + + +
+

+ : + + assembly + +

+ + + + +
+ + + + + + + + (group as + + + ) + + + + (datatype: + + + ) + + + + (addressable by + + + ) + + + + (required) + + + + + +
  • + Flag + + + + + + (optional) + + +
    • +     + + + + + + +
    +

    The assembly has the following contents (in order):

    +
      + + +
    +
    +     + + + + +
  • + A + n + + + + + + + +
    • +     + + (zero or one) + + (one) + + +
    + + 
    +           
+
    + +
    +     + + + + + + + + + + + + + + + + + + + + +

    The short name (file identifier) for this schema shall be . It is used internally when an + identifier is called for, and may appear in file names of schema artifacts.

    +     + + + : + + + + +
    + +     + + +
  • A choice between +
      + +
    +
    • +     + + +
  • Prose contents (paragraphs and lists)
    • +     + + +
    + +
    +     + + + + + + + + + + + +

    + +

    +     + + +

    + +

    +     + + + + + + + + + + + + + + + + + + + + + + + + + + + + < + + + + =" + + " + + > + + + + + + + + + + + + </ + > + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +     diff --git a/test-suite/oscal/v1.0.0/metaschema-poll.xsl b/test-suite/oscal/v1.0.0/metaschema-poll.xsl new file mode 100644 index 000000000..cfb47ef1e --- /dev/null +++ b/test-suite/oscal/v1.0.0/metaschema-poll.xsl @@ -0,0 +1,59 @@ + + + + + + + + + + { current-grouping-key() } + + + + + + , '{ current-grouping-key() }' + + + + + , '{ current-grouping-key() }' + + + + + , '{ current-grouping-key() }' + + + + + + + + { current-grouping-key() }: + + + + + + + + + + + + + \ No newline at end of file diff --git a/test-suite/oscal/v1.0.0/oscal_assessment-common_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_assessment-common_metaschema.xml new file mode 100644 index 000000000..a2be9f79e --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_assessment-common_metaschema.xml @@ -0,0 +1,1707 @@ + + + OSCAL Assessment Layer Format -- Common Modules + 1.0.0 + oscal-assessment-common + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    This contains all modules common to the assessment plan, assessment results, and POAM models.

    +

    The root of the OSCAL Assessment Plan format is assessment-plan.

    +

    The root of the OSCAL Assessment Results format is assessment-results.

    +

    The root of the OSCAL Plan of Action and Milestones (POA&M) format is plan-of-action-and-milestones.

    +     + + + + + + + Import System Security Plan + Used by the assessment plan and POA&M to import information about the system. + + System Security Plan Reference + >A resolvable URL reference to the system security plan for the system being assessed. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter resource in the same document.

    +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + + + +     + + + + + + Assessment-Specific Control Objective + A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions. + + +

    The specified control-id must be a valid value within the baseline identified by the target system's SSP via the import-profile statement.

    +     +     + + + Objective Description + A human-readable description of this control objective. + + + + + + + + + + + + + + + + + + + + + + +     + + Assessment Method + A local definition of a control objective. Uses catalog syntax for control objective and assessment activities. + + Assessment Method Universally Unique Identifier + Uniquely identifies this defined assessment method. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for a given assessment method across revisions of the document. + + + + Assessment Method Description + A human-readable description of this assessment method. + + + + + + + + + + + + + + + + + Activity + Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment. + + Assessment Activity Universally Unique Identifier + Uniquely identifies this assessment activity. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for a given included activity across revisions of the document. + + + + Included Activity Title + The title for this included activity. + + + Included Activity Description + A human-readable description of this included activity. + + + + + + + + + Step + Identifies an individual step in a series of steps related to an activity, such as an assessment test or examination procedure. + + + Step Universally Unique Identifier + Uniquely identifies a step. This UUID may be referenced elsewhere in an OSCAL document when referring to this step. A UUID should be consistently used for a given test step across revisions of the document. + + + + Step Title + The title for this step. + + + Step Description + A human-readable description of this step. + + + + + + + + + +

    This can be optionally used to define the set of controls and control objectives that are assessed by this step.

    +     +     + + + +

    Identifies the roles, and optionally the parties, associated with this step that is part of an assessment activity.

    +     +     + +     + + + + +

    Since multiple party-uuid entries can be provided, each role-id must be referenced only once.

    +     +     +     +     + + related-controls + +

    This can be optionally used to define the set of controls and control objectives that are assessed or remediated by this activity.

    +     +     + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + +     + + + + The assessment method to use. This typically appears on parts with the name "assessment". + + + + The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence. + The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). + The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior. + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + + Task + Represents a scheduled event or milestone, which may be associated with a series of assessment actions. + + Task Universally Unique Identifier + Uniquely identifies this assessment task. + + + Task Type + The type of task. + + + The task represents a planned milestone. + The task represents a specific assessment action to be performed. + + + + + + + Task Title + The title for this task. + + + Task Description + A human-readable description of this task. + + + + + + + + + Event Timing + The timing under which the task is intended to occur. + + + + On Date Condition + The task is intended to occur on the specified date. + + On Date Condition + The task must occur on the specified date. + + + + On Date Range Condition + The task is intended to occur within the specified date range. + + Start Date Condition + The task must occur on or after the specified date. + + + End Date Condition + The task must occur on or before the specified date. + + + + Frequency Condition + The task is intended to occur at the specified frequency. + + Period + The task must occur after the specified period has elapsed. + + + Time Unit + The unit of time for the period. + + + The period is specified in seconds. + The period is specified in minutes. + The period is specified in hours. + The period is specified in days. + The period is specified in calendar months. + The period is specified in calendar years. + + + + + + + + + Task Dependency + Used to indicate that a task is dependent on another task. + + + Task Universally Unique Identifier Reference + References a unique task by UUID. + + + + + + + + + + + Associated Activity + Identifies an individual activity to be performed as part of a task. + + + Activity Universally Unique Identifier Reference + References an activity defined in the list of activities. + + + + + + + + + + + +

    Identifies the person or organization responsible for performing a specific role defined by the activity.

    +     +     + + subject + + + +     + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + subject + + +

    The assessment subjects that the activity was performed against.

    +     +     + + + +

    Identifies the person or organization responsible for performing a specific role related to the task.

    +     +     + +     +     + + + + + + + Reviewed Controls and Control Objectives + Identifies the controls being assessed and their control objectives. + + + Control Objective Description + A human-readable description of control objectives. + + + + + + + + + + Assessed Controls + Identifies the controls being assessed. In the assessment plan, these are the planned controls. In the assessment results, these are the actual controls, and reflects any changes from the plan. + + + + Assessed Controls Description + A human-readable description of in-scope controls specified for assessment. + + + + + + + + + + All + A key word to indicate all. + + + include-control + + +

    Used to select a control for inclusion by the control's identifier. Specific control statements can be selected by their statement identifier.

    +     +     +     + + exclude-control + + +

    Used to select a control for exclusion by the control's identifier. Specific control statements can be excluded by their statement identifier.

    +     +     + +     + +

    The include-all, specifies all control identified in the baseline are included in the scope if this assessment, as specified by the include-profile statement within the linked SSP.

    +

    Any control specified within exclude-controls must first be within a range of explicitly included controls, via include-controls or include-all.

    +     +     + + + Referenced Control Objectives + Identifies the control objectives of the assessment. In the assessment plan, these are the planned objectives. In the assessment results, these are the assessed objectives, and reflects any changes from the plan. + + + + Control Objectives Description + A human-readable description of this collection of control objectives. + + + + + + + + + + All + A key word to indicate all. + + + include-objective + + +

    Used to select a control objective for inclusion by the control objective's identifier.

    +     +     +     + + exclude-objective + + +

    Used to select a control objective for exclusion by the control objective's identifier.

    +     +     + +     + +

    The include-all field, specifies all control objectives for any in-scope control. In-scope controls are defined in the control-selection.

    +

    Any control objective specified within exclude-controls must first be within a range of explicitly included control objectives, via include-objectives or include-all.

    +     +     + +     + +

    In the context of an assessment plan, this construct is used to identify the controls and control objectives that are to be assessed. In the context of an assessment result, this construct is used to identify the actual controls and objectives that were assessed, reflecting any changes from the plan.

    +

    When resolving the selection of controls and control objectives, the following processing will occur:

    +

    1. Controls will be resolved by creating a set of controls based on the control-selections by first handling the includes, and then removing any excluded controls.

    +

    2. The set of control objectives will be resolved from the set of controls that was generated in the previous step. The set of control objectives is based on the control-objective-selection by first handling the includes, and then removing any excluded control objectives.

    +     +     + + + Select Control + Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope. + + + + Include Specific Statements + Used to constrain the selection to only specificity identified statements. + + + + + + + Select Objective + Used to select a control objective for inclusion/exclusion based on the control objective's identifier. + + + + + + Assessment Subject Placeholder + Used when the assessment subjects will be determined as part of one or more other assessment activities. These assessment subjects will be recorded in the assessment results in the assessment log. + + Assessment Subject Placeholder Universally Unique Identifier + Uniquely identifies a set of assessment subjects that will be identified by a task or an activity that is part of a task. + + + + Assessment Subject Placeholder Description + A human-readable description of intent of this assessment subject placeholder. + + + Assessment Subject Source + Assessment subjects will be identified while conducting the referenced activity-instance. + + + Task Universally Unique Identifier + Uniquely identifies an assessment activity to be performed as part of the event. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for this schedule across revisions of the document. + + + + + + + + + + + + + + Subject of Assessment + Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope. + + Subject Type + Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement. + + + The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results. + The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results. + The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results. + The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results. + The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results. + + + + + + Include Subjects Description + A human-readable description of the collection of subjects being included in this assessment. + + + + + + + + + + All + A key word to indicate all. + + + include-subject + + + + + exclude-subject + + + + + +

    Processing of an include/exclude pair starts with processing the include, then removing matching entries in the exclude.

    +     +     + + + Select Assessment Subject + Identifies a set of assessment subjects to include/exclude by UUID. + + + type + + + + + + + + + + + + + + Subject Universally Unique Identifier Reference + A pointer to a component, inventory-item, location, party, user, or resource using it's UUID. + + + + Subject Universally Unique Identifier Reference Type + Used to indicate the type of object pointed to by the uuid-ref within a subject. + + + Component + Inventory Item + Location + Interview Party + User + Resource or Artifact + + + + + + Identifies the Subject + A pointer to a resource based on its universally unique identifier (UUID). Use type to indicate whether the identified resource is a component, inventory item, location, user, or something else. + + + type + + + + + Subject Reference Title + The title or name for the referenced subject. + + + + + + + + + + +

    The subject reference UUID could point to an item defined in the SSP, AP, or AR.

    +

    Tools should check look for the ID in every file imported directly or indirectly.

    +     +     + + + + Assessment Assets + Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions. + + + component + + +

    Used to add any components for tools used during the assessment. These are represented here to avoid mixing with system components.

    +

    The technology tools used by the assessor to perform the assessment, such as vulnerability scanners. In the assessment plan these are the intended tools. In the assessment results, these are the actual tools used, including any differences from the assessment plan.

    +     +     + + Assessment Platform + Used to represent the toolset used to perform aspects of the assessment. + + + Assessment Platform Universally Unique Identifier + Uniquely identifies this assessment Platform. + + + + Assessment Platform Title + The title or name for the assessment platform. + + + + + + + + + Uses Component + The set of components that are used by the assessment platform. + + + Component Universally Unique Identifier Reference + A reference to a component that is implemented as part of an inventory item. + + + + + + + + + + + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + +     +     +     + + + + +

    Since multiple assessment component entries can be provided, each component must have a unique uuid.

    +     +     +     +     + + + + Objective Status + Captures an assessor's conclusions regarding the degree to which an objective is satisfied. + + Finding Target Type + Identifies the type of the target. + + + A reference to a control statement identifier within a control. + A reference to a control objective identifier within a control. + + + +

    The target will always be a reference to: 1) a control statement, or 2) a control objective. In the former case, there is always a single top-level statement within a control. Thus, if the entire control is targeted, this statement identifier can be used.

    +     +     + + Finding Target Identifier Reference + Identifies the specific target qualified by the type. + + + + Objective Status Title + The title for this objective status. + + + Objective Status Description + A human-readable description of the assessor's conclusions regarding the degree to which an objective is satisfied. + + + + + + + + + Objective Status + A determination of if the objective is satisfied or not within a given system. + + Objective Status State + An indication as to whether the objective is satisfied or not. + + + The objective has been completely satisfied. + The objective has not been completely satisfied, but may be partially satisfied. + + + + + Objective Status Reason + The reason the objective was given it's status. + + + The target system or system component satisfied all the conditions. + The target system or system component did not satisfy all the conditions. + Some other event took place that is not a pass or a fail. + + + +

    Reason may contain any value, and should be used to communicate additional information regarding the status.

    +     +     + + + +     + + +

    The implementation-status is used to qualify the status value to indicate the degree to which the control was found to be implemented.

    +     +     + +     +     + + + Observation + Describes an individual observation. + + Observation Universally Unique Identifier + Uniquely identifies this observation. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given observation across revisions. + + + + Observation Title + The title for this observation. + + + Observation Description + A human-readable description of this assessment observation. + + + + + + + + + Observation Method + Identifies how the observation was made. + + + + An inspection was performed. + An interview was performed. + A manual or automated test was performed. + This is only for use when converting historic content to OSCAL, where the conversion process cannot initially identify the appropriate method(s). + + + + + + Observation Type + Identifies the nature of the observation. More than one may be used to further qualify and enable filtering. + + + + A difference between the SSP implementation statement, and actual implementation. + An observation about the status of a the associated control objective. + A mitigating factor was identified. + An assessment finding. Used for observations made by tools, penetration testing, and other means. + An observation from a past assessment, which was converted to OSCAL at a later date. + + + + + + +

    Used to identify the individual and/or tool that gathered the evidence resulting in the observation identification.

    +     +     + + subject + + +

    Identifies who was interviewed, or what was tested or inspected.

    +     +     + + + Relevant Evidence + Links this observation to relevant evidence. + + + Relevant Evidence Reference + >A resolvable URL reference to relevant evidence. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter resource in the same document.

    +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + + Relevant Evidence Description + A human-readable description of this evidence. + + + + + + + + + +     + + collected field + Date/time stamp identifying when the finding information was collected. + + + expires field + Date/time identifying when the finding information is out-of-date and no longer valid. Typically used with continuous assessment scenarios. + + +     + + + +     + + + Origin + Identifies the source of the finding, such as a tool, interviewed person, or activity. + + + actor + + + + + + + + + + Originating Actor + The actor that produces an observation, a finding, or a risk. One or more actor type can be used to specify a person that is using a tool. + + Actor Type + The kind of actor. + + + A reference to a tool component defined with the assessment assets. + A reference to an assessment-platform defined with the assessment assets. + A reference to a party defined within the document metadata. + + + + + Actor Universally Unique Identifier Reference + A pointer to the tool or person based on the associated type. + + + Actor Role + For a party, this can optionally be used to specify the role the actor was performing. + + + + + + + + + + + + + Task Reference + Identifies an individual task for which the containing object is a consequence of. + + Task Universally Unique Identifier Reference + References a unique task by UUID. + + + + + + + + + + + +

    Identifies the person or organization responsible for performing a specific role defined by the activity.

    +     +     + + subject + + +

    The assessment subjects that the task was performed against.

    +     +     + + Identified Subject + Used to detail assessment subjects that were identfied by this task. + + + Assessment Subject Placeholder Universally Unique Identifier Reference + References a unique assessment subject placeholder defined by this task. + + + + subject + + +

    The assessment subjects that the task identified, which will be used by another task through a subject-placeholder reference. Such a task will "consume" these subjects.

    +     +     +     +     + +     + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + + + Threat ID + A pointer, by ID, to an externally-defined threat. + id + + Threat Type Identification System + Specifies the source of the threat information. + + + The value conforms to FedRAMP definitions. + + + + + Threat Information Resource Reference + An optional location for the threat data, from which this ID originates. + + + + + Identified Risk + An identified risk. + + Risk Universally Unique Identifier + Uniquely identifies this risk. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given risk across revisions. + + + + Risk Title + The title for this risk. + + + Risk Description + A human-readable summary of the identified risk, to include a statement of how the risk impacts the system. + + + + + Risk Statement + An summary of impact for how the risk affects the system. + + + + + + + + + Status + Describes the status of the associated risk. + + + The risk has been identified. + The identified risk is being investigated. (Open risk) + Remediation activities are underway, but are not yet complete. (Open risk) + A risk deviation, such as false positive, risk reduction, or operational requirement has been submitted for approval. (Open risk) + A risk deviation, such as false positive, risk reduction, or operational requirement has been approved. (Open risk) + The risk has been resolved. + + + + + + +

    Used to identify the individual and/or tool that identified this risk.

    +     +     + + + + + + + + + + Mitigating Factor + Describes an existing mitigating factor that may affect the overall determination of the risk, with an optional link to an implementation statement in the SSP. + + + Mitigating Factor Universally Unique Identifier + Uniquely identifies this mitigating factor. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given mitigating factor across revisions. + + + Implementation UUID + Points to an implementation statement in the SSP. + + + + Mitigating Factor Description + A human-readable description of this mitigating factor. + + + + + + + + + subject + + +

    Links identifiable elements of the system to this mitigating factor, such as an inventory-item or component.

    +     +     +     +     + + + Risk Resolution Deadline + The date/time by which the risk must be resolved. + + + + + + + Risk Log + A log of all risk-related tasks taken. + + + Risk Log Entry + Identifies an individual risk response that occurred as part of managing an identified risk. + + + Risk Log Entry Universally Unique Identifier + Uniquely identifies a risk log entry. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for this schedule across revisions of the document. + + + + Title + The title for this risk log entry. + + + Risk Task Description + A human-readable description of what was done regarding the risk. + + + Start + Identifies the start date and time of the event. + + + End + Identifies the end date and time of the event. If the event is a point in time, the start and end will be the same date and time. + + + + + + + + + + + + status-change + +

    Identifies a change in risk status made resulting from the task described by this risk log entry. This allows the risk's status history to be captured as a sequence of risk log entries.

    +     +     + + Risk Response Reference + Identifies an individual risk response that this log entry is for. + + + Response Universally Unique Identifier Reference + References a unique risk response by UUID. + + + + + + + + + + + +

    This is used to identify the task(s) that this log entry was generated for.

    +     +     + +     +     + +     + + + The type of remediation tracking entry. Can be multi-valued. + + + Contacted vendor to determine the status of a pending fix to a known vulnerability. + Information related to the current state of response to this risk. + A significant step in the response plan has been achieved. + An activity was completed that reduces the likelihood or impact of this risk. + An activity was completed that eliminates the likelihood or impact of this risk. + + The risk is no longer applicable to the system. + A deviation request was made to the authorizing official. + A previously submitted deviation request has been modified. + The authorizing official approved the deviation. + The authorizing official rejected the deviation. + + +     +     +     + + + Related Observation + Relates the finding to a set of referenced observations that were used to determine the finding. + + + Observation Universally Unique Identifier Reference + References an observation defined in the list of observations. + + +     + + + The risk has been confirmed to be a false positive. + The risk has been accepted. No further action will be taken. + The risk has been adjusted. + A numeric value indicating the sequence in which risks should be addressed. (Lower numbers are higher priority) + + + +     + + + Logged By + Used to indicate who created a log entry in what role. + + Party UUID Reference + A pointer to the party who is making the log entry. + + + Actor Role + A point to the role-id of the role in which the party is making the log entry. + + + + + Risk Status + Describes the status of the associated risk. + + + The risk has been identified. + The identified risk is being investigated. (Open risk) + Remediation activities are underway, but are not yet complete. (Open risk) + A risk deviation, such as false positive, risk reduction, or operational requirement has been submitted for approval. (Open risk) + A risk deviation, such as false positive, risk reduction, or operational requirement has been approved. (Open risk) + The risk has been resolved. + + + + + + Characterization + A collection of descriptive data about the containing object from a specific origin. + + + + + + + + + +

    metadata about the specific actor that generated this descriptive data.

    +     +     + + Facet + An individual characteristic that is part of a larger set produced by the same actor. + + + Facet Name + The name of the risk metric within the specified system. + + + Naming System + Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash. + + + + + The facet is from an unknown taxonomy. The meaning of the name is tool or organization specific. + + + + + + + + + + Facet Value + Indicates the value of the facet. + + + + + + + + + + + + + Indicates if the facet is 'initial' as first identified, or 'adjusted' indicating that the value has be changed after some adjustments have been made (e.g., to identify residual risk). + + + As first identified. + Indicates that residual risk remains after some adjustments have been made. + + + + General likelihood rating. + General impact rating. + General risk rating. + General severity rating. + + + Likelihood as defined by FedRAMP. The class can be used to specify 'initial' and 'adjusted' risk states. + Impact as defined by FedRAMP. The class can be used to specify 'initial' and 'adjusted' risk states. + Risk as calculated according to FedRAMP. The class can be used to specify 'initial' and 'adjusted' risk states. + + + An identifier managed by the CVE program (see https://cve.mitre.org/). + + + Base: Access Vector + Base: Access Complexity + Base: Authentication + Base: Confidentiality Impact + Base: Integrity Impact + Base: Availability Impact + Temporal: Exploitability + Temporal: Remediation Level + Temporal: Report Confidence + Environmental: Collateral Damage Potential + Environmental: Target Distribution + Environmental: Confidentiality Requirement + Environmental: Integrity Requirement + Environmental: Availability Requirement + + + Local + Network Adjacent + Network + + + High + Medium + Low + + + Multiple + Single + None + + + None + Partial + Complete + + + Unproven + Proof-of-Concept + Functional + High + Not Defined + + + Official Fix + Temporary Fix + Workaround + Unavailable + Not Defined + + + Unconfirmed + Uncorroborated + Confirmed + Not Defined + + + None + Low (light loss) + Low Medium + Medium High + High (catastrophic loss) + Not Defined + + + + + + + + + + + Base: Attack Vector + Base: Attack Complexity + Base: Privileges Required + Base: User Interaction + Base: Scope + Base: Confidentiality Impact + Base: Integrity Impact + Base: Availability Impact + Temporal: Exploit Code Maturity + Temporal: Remediation Level + Temporal: Report Confidence + Environmental: Modified Attack Vector + Environmental: Modified Attack Complexity + Environmental: Modified Privileges Required + Environmental: Modified User Interaction + Environmental: Modified Scope + Environmental: Modified Confidentiality + Environmental: Modified Integrity + Environmental: Modified Availability + Environmental: Confidentiality Requirement Modifier + Environmental: Integrity Requirement Modifier + Environmental: Availability Requirement Modifier + + + Network + Adjacent + Local + Physical + + + High + Low + + + None + Low + High + + + None + Required + + + Unchanged + Changed + + + Not Defined + Unproven + Proof-of-Concept + Functional + High + + + Not Defined + Official Fix + Temporary Fix + Workaround + Unavailable + + + Not Defined + Unknown + Reasonable + Confirmed + + + Not Defined + Low + Medium + High + + + Not Defined + Network + Adjacent + Local + Physical + + + Not Defined + High + Low + + + Not Defined + None + Low + High + + + Not Defined + None + Required + + + Not Defined + Unchanged + Changed + + + +     +     + + + Risk Response + Describes either recommended or an actual plan for addressing the risk. + + Remediation Universally Unique Identifier + Uniquely identifies this remediation. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given remediation across revisions. + + + Remediation Intent + Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner. + + + Recommended Remediation + The actions intended to resolve the risk. + This remediation activities were performed to address the risk. + + + + + + Response Title + The title for this response activity. + + + Response Description + A human-readable description of this response plan. + + + + + + + + + + +

    Used to identify the individual and/or tool that generated this recommended or planned response.

    +     +     + + + + Required Asset + Identifies an asset required to achieve remediation. + + + Required Universally Unique Identifier + Uniquely identifies this required asset. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given required asset across revisions. + + + + subject + + +

    Identifies an asset associated with this requirement, such as a party, system component, or inventory-item.

    +     +     + + Title for Required Asset + The title for this required asset. + + + Description of Required Asset + A human-readable description of this required asset. + + + + + + + + +     + + + The UUID of the person or organization who made the recommendation + The UUID of the tool that made the recommendation + + +     + + + + +     + + + + + + The risk will be eliminated. + The risk will be reduced. + The risk will be transferred to another organization or entity. + The risk will continue to exist without further efforts to address it. (Sometimes referred to as "Operationally required") + The risk will be partially transferred to another organization or entity. + Plans will be made to address the risk impact if the risk occurs. (This is a form of mitigation.) + No response, such as when the identified risk is found to be a false positive. + + +     + + + + Objective ID + Points to an assessment objective. + + + + + Assessment Part + A partition of an assessment plan or results or a child of another part. + part + + + Part Identifier + A unique identifier for a specific part instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same part across minor revisions of the document. + + + Part Name + A textual label that uniquely identifies the part's semantic type. + + + + An assessment asset. + An assessment method. + Describes a set of control objectives. + + + + + + Part Namespace + A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name. + +

    Provides a means to segment the value space for the name, so that different organizations and individuals can assert control over the allowed names and associated text used in a part. This allows the semantics associated with a given name to be defined on an organization-by-organization basis.

    +

    An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.

    +

    When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.

    +     +     + + Part Class + A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Part Title + A name given to the part, which may be used by a tool for display and navigation. + + + + + + + Part Text + Permits multiple paragraphs, lists, tables etc. + + + + + + + + + + + + + The assessment method to use. This typically appears on parts with the name "assessment". + + + + The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence. + The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). + The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior. + + + + +

    A part provides for logical partitioning of prose, and can be thought of as a grouping structure (e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.

    +

    A part can be assigned an optional id, which allows for internal and external references to the textual concept contained within a part. A id provides a means for an OSCAL profile, or a higher layer OSCAL model to reference a specific part within a catalog. For example, an id can be used to reference or to make modifications to a control statement in a profile.

    +

    Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics. Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations. Each organization is responsible for governance of their own extensions, and is strongly encouraged to publish their extensions as standards to their user community. If no ns is provided, the name is expected to be in the "OSCAL" namespace.

    +

    To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a DNS or other globally defined organization name should be used. For example, if FedRAMP and DoD both extend OSCAL, FedRAMP will use the ns "https://fedramp.gov", while DoD will use the ns "https://defense.gov" for any organization specific name.

    +

    Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.

    +     +     + +     diff --git a/test-suite/oscal/v1.0.0/oscal_assessment-plan_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_assessment-plan_metaschema.xml new file mode 100644 index 000000000..13a5ff80b --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_assessment-plan_metaschema.xml @@ -0,0 +1,126 @@ + + + OSCAL Assessment Plan Model + 1.0.0 + oscal-ap + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL assessment plan format is used to describe the information typically provided by an assessor during the preparation for an assessment.

    +

    The root of the OSCAL assessment plan format is assessment-plan. +

    +     + + + + + + Security Assessment Plan (SAP) + An assessment plan, such as those provided by a FedRAMP assessor. + assessment-plan + + Assessment Plan Universally Unique Identifier + Uniquely identifies this assessment plan. This UUID must be changed each time the content of the plan changes. + + + + + +

    Used by the SAP to import information about the system being assessed.

    +     +     + + + Local Definitions + Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP. + + + component + + +

    Used to add any components, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + + +

    Used to add any inventory-items, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + user + + +

    Used to add any users, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + + objectives-and-methods + + + + + + + + +     + + + + +

    Since multiple component entries can be provided, each component must have a unique uuid.

    +     +     + + + +

    A given uuid must be assigned only once to a user.

    +     +     +     +     + + Assessment Plan Terms and Conditions + Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition. + + + + + + + + Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment. + Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure. + Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment. + Defines any assessment activities which the system owner or authorizing official explicitly prohibits from being performed as part of the assessment. + Defines conditions related to the delivery of the assessment results, such as when to deliver, how, and to whom. + Defines any supposition made by the assessor. Has child 'item' parts for each assumption. + An explanation of practices, procedures, and rules used in the course of the assessment. + + + + + + + + + + + + + + + + + + + +     +     + + + + +     diff --git a/test-suite/oscal/v1.0.0/oscal_assessment-results_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_assessment-results_metaschema.xml new file mode 100644 index 000000000..10fa3cab3 --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_assessment-results_metaschema.xml @@ -0,0 +1,339 @@ + + + + OSCAL Assessment Results Model + 1.0.0 + oscal-ar + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL assessment results format is used to describe the information typically provided by an assessor following an assessment.

    +

    The root of the OSCAL assessment results format is assessment-results. +

    +     + + + + + + Security Assessment Results (SAR) + Security assessment results, such as those provided by a FedRAMP assessor in the FedRAMP Security Assessment Report. + assessment-results + + Assessment Results Universally Unique Identifier + Uniquely identifies this assessment results file. This UUID must be changed each time the content of the results changes. + + + + + +

    Used by the SAR to import information about the original plan for assessing the system.

    +     +     + + + Local Definitions + Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP. + + + objectives-and-methods + + + + + + activity + + + + + + + + result + + + + +     +     + + + + + + + + + + + + + Assessment Result + Used by the assessment results and POA&M. In the assessment results, this identifies all of the assessment observations and findings, initial and residual risks, deviations, and disposition. In the POA&M, this identifies initial and residual risks, deviations, and disposition. + + Results Universally Unique Identifier + Uniquely identifies this set of results. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given set of results across revisions. + + + + Results Title + The title for this set of results. + + + + Results Description + A human-readable description of this set of test results. + + + + start field + Date/time stamp identifying the start of the evidence collection reflected in these results. + + + end field + Date/time stamp identifying the end of the evidence collection reflected in these results. In a continuous motoring scenario, this may contain the same value as start if appropriate. + + + + + + + + + + + Local Definitions + Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP. + + + component + + +

    Used to add any components, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + + +

    Used to add any inventory-items, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + user + + +

    Used to add any users, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + + + +

    This needs to be defined in the results if an assessment platform used is different from the one described in the assessment plan. Else the platform(s) defined in the plan may be referenced within the results.

    +     +     + + + assessment-task + + +     + + + + +

    Since multiple component entries can be provided, each component must have a unique uuid.

    +     +     + + + +

    A given uuid must be assigned only once to a user.

    +     +     +     +     + + + +

    The Assessment Results control-selection ignores any control selection in the Assessment Plan and re-selects controls from the baseline identified by the SSP.

    +

    The Assessment Results control-objective-selection ignores any control objective selection in the Assessment Plan and re-selects control objectives from the baseline identified by the SSP.

    +

    Any additional control objectives defined in the Assessment Plan local-definitions do not need to be re-defined in the Assessment Results local-definitions; however, if they were explicitly referenced with an Assessment Plan control-objective-selection, they need to be selected again in the Assessment Results control-objective-selection.

    +     +     + + + Attestation Statements + A set of textual statements, typically written by the assessor. + + + + + + + + part + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + + Assessment Log + A log of all assessment-related actions taken. + + + Assessment Log Entry + + Identifies the result of an action and/or task that occurred as part of executing an assessment plan or an assessment event that occurred in producing the assessment results. + + + Assessment Log Entry Universally Unique Identifier + Uniquely identifies an assessment event. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for this schedule across revisions of the document. + + + + Action Title + The title for this event. + + + + Action Description + A human-readable description of this event. + + + Start + Identifies the start date and time of an event. + + + End + Identifies the end date and time of an event. If the event is a point in time, the start and end will be the same date and time. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +     +     + + + Finding + Describes an individual finding. + + Finding Universally Unique Identifier + Uniquely identifies this finding. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. Once assigned, a UUID should be consistently used for a given finding across revisions. + + + + Finding Title + The title for this finding. + + + + Finding Description + A human-readable description of this finding. + + + + + + + + + + + + +

    Used to identify the individual and/or tool generated this finding.

    +     +     + + target + + + Implementation Statement UUID + Identifies the implementation statement in the SSP to which this finding is related. + + + + Related Observation + Relates the finding to a set of referenced observations that were used to determine the finding. + + + Observation Universally Unique Identifier Reference + References an observation defined in the list of observations. + + + + + Associated Risk + Relates the finding to a set of referenced risks that were used to determine the finding. + + + Risk Universally Unique Identifier Reference + References an risk defined in the list of risks. + + + +     +     + + + + Import Assessment Plan + Used by assessment-results to import information about the original plan for assessing the system. + + Assessment Plan Reference + >A resolvable URL reference to the assessment plan governing the assessment activities. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter + resource in the same document.

    + +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + + +     + +     diff --git a/test-suite/oscal/v1.0.0/oscal_catalog_metaschema-COMPOSED.xml b/test-suite/oscal/v1.0.0/oscal_catalog_metaschema-COMPOSED.xml new file mode 100644 index 000000000..00246790c --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_catalog_metaschema-COMPOSED.xml @@ -0,0 +1,3099 @@ + + OSCAL Control Catalog Model + 1.0.0 + oscal-catalog + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL Control Catalog format can be used to describe a collection of security controls and related control enhancements, along with contextualizing documentation and metadata. The root of the Control Catalog format is catalog.

    +     + + Catalog + A collection of controls. + catalog + + Catalog Universally Unique Identifier + A globally unique identifier for this catalog instance. This UUID should be changed when this document is revised. + + + + + + + + + + + + + + +

    Back matter including references and resources.

    +     +     +     + + + + +

    Catalogs may use one or more group objects to subdivide the control contents of a catalog.

    +

    An OSCAL catalog model provides a structured representation of control information.

    +     + + A small catalog with a single control + + A Miniature Catalog + + A Single Control + + + +     + + Control Group + A group of controls, or of groups of controls. + + Group Identifier + A unique identifier for a specific group instance that can be used to reference the group within this and in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same group across minor revisions of the document. + + + Group Class + A textual label that provides a sub-type or characterization of the group. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Group Title + A name given to the group, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + + + A human-readable label for the parent context. + An alternative identifier, whose value is easily sortable among other such values in the document. + + + +

    Catalogs can use a group to collect related controls into a single grouping. That can be useful to group controls into a family or other logical grouping.

    +

    A group may have its own properties, statements, parameters, and references, which are inherited by all members of that group.

    +     + + + My Group + + + Control + + + +     + + Control + A structured information object representing a security or privacy control. Each security or privacy control within the Catalog is defined by a distinct control instance. + + Control Identifier + A unique identifier for a specific control instance that can be used to reference the control in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same control across minor revisions of the document. + + + Control Class + A textual label that provides a sub-type or characterization of the control. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Control Title + A name given to the control, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + A human-readable label for the parent context. + An alternative identifier, whose value is easily sortable among other such values in the document. + The status of a control. For example, a value of 'withdrawn' can indicate that the control has been withdrawn and should no longer be used. + + + The control is no longer used. + + + The link cites an external resource related to this control. + The link identifies another control with bearing to this control. + The link identifies another control that must be present if this control is present. + The link identifies other control content where this control content is now addressed. + + + +

    Controls may be grouped using group, and controls may be partitioned using part or further enhanced (extended) using control.

    +

    A control must have a part with the name "statement", which represents the textual narrative of the control. This "statement" part must occur only once, but may have nested parts to allow for multiple paragraphs or sections of text.

    +     + + + Control 1 + + +     + + Part + A partition of a control's definition or a child of another part. + + Part Identifier + A unique identifier for a specific part instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same part across minor revisions of the document. + + + Part Name + A textual label that uniquely identifies the part's semantic type. + + + An introduction to a control or a group of controls. + A set of control implementation requirements. + An individual item within a control statement. + Additional information to consider when selecting, implementing, assessing, and monitoring a control. + Describes a set of assessment objectives. + Describes a method-based assessment over a set of assessment objects. + Provides a list of assessment objects. + + + + + Part Namespace + A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name. + +

    Provides a means to segment the value space for the name, so that different organizations and individuals can assert control over the allowed names and associated text used in a part. This allows the semantics associated with a given name to be defined on an organization-by-organization basis.

    +

    An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.

    +

    When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.

    +     +     + + Part Class + A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Part Title + A name given to the part, which may be used by a tool for display and navigation. + + + + + + Part Text + Permits multiple paragraphs, lists, tables etc. + + + + + + + + + + + A human-readable label for the parent context. + An alternative identifier, whose value is easily sortable among other such values in the document. + + + + The assessment method to use. This typically appears on parts with the name "assessment". + + + + The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence. + The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). + The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior. + + + + +

    A part provides for logical partitioning of prose, and can be thought of as a grouping structure (e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.

    +

    A part can be assigned an optional id, which allows for internal and external references to the textual concept contained within a part. A id provides a means for an OSCAL profile, or a higher layer OSCAL model to reference a specific part within a catalog. For example, an id can be used to reference or to make modifications to a control statement in a profile.

    +

    Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics. Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations. Each organization is responsible for governance of their own extensions, and is strongly encouraged to publish their extensions as standards to their user community. If no ns is provided, the name is expected to be in the "OSCAL" namespace.

    +

    To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a DNS or other globally defined organization name should be used. For example, if FedRAMP and DoD both extend OSCAL, FedRAMP will use the ns "https://fedramp.gov", while DoD will use the ns "https://defense.gov" for any organization specific name.

    +

    Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.

    +     + + Multiple Parts with Different Organization-Specific Names + + Something FedRAMP Cares About + Something DoD Cares About + + +     + + Parameter + Parameters provide a mechanism for the dynamic assignment of value(s) in a control. + param + + Parameter Identifier + A unique identifier for a specific parameter instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same parameter across minor revisions of the document. + + + Parameter Class + A textual label that provides a characterization of the parameter. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +     +     + + + + + + + + + + Parameter Label + A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned. + +

    The label value should be suitable for inline display in a rendered catalog.

    +     +     + + Parameter Usage Description + Describes the purpose and use of a parameter + + + constraint + + + + guideline + + + + + value + + +

    A set of values provided in a catalog can be redefined at any higher layer of OSCAL (e.g., Profile).

    +     +     + + select + +

    A set of parameter value choices, that may be picked from to set the parameter value.

    +     +     +     + +     + +

    In a catalog, a parameter is typically used as a placeholder for the future assignment of a parameter value, although the OSCAL model allows for the direct assignment of a value if desired by the control author. The value may be optionally used to specify one or more values. If no value is provided, then it is expected that the value will be provided at the Profile or Implementation layer.

    +

    A parameter can include a variety of metadata options that support the future solicitation of one or more values. A label provides a textual placeholder that can be used in a tool to solicit parameter value input, or to display in catalog documentation. The desc provides a short description of what the parameter is used for, which can be used in tooling to help a user understand how to use the parameter. A constraint can be used to provide criteria for the allowed values. A guideline provides a recommendation for the use of a parameter.

    +     +     + + Constraint + A formal or informal expression of a constraint or test + + + Constraint Description + A textual summary of the constraint to be applied. + + + Constraint Test + A test expression which is expected to be evaluated by a tool. + + + + Constraint test + A formal (executable) expression of a constraint + + + + + + + + Guideline + A prose statement that provides a recommendation for the use of a parameter. + + + Guideline Text + Prose permits multiple paragraphs, lists, tables etc. + + + + + Parameter Value + A parameter value or set of values. + + + Selection + Presenting a choice among alternatives + + Parameter Cardinality + Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted. + + + Only one value is permitted. + One or more values are permitted. + + + + + + Choice + A value selection among several such options + choice + value + + + + +

    A set of parameter value choices, that may be picked from to set the parameter value.

    +     +     + + Depends on + Another parameter invoking this one + + + Control Identifier Reference + A reference to a control with a corresponding id value. + + + Publication metadata + Provides information about the publication and availability of the containing document. + + + Document Title + A name given to the document, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + Indicates the organization that created this content. + Indicates the organization for which this content was created. + Indicates the organization responsible for all content represented in the "document". + + + The link identifies the authoritative location for this file. Defined by RFC 6596. + The link identifies an alternative location or format for this file. Defined by the HTML Living Standard + + This link identifies a resource containing the latest version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + +     +     + + Revision History Entry + An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first). + + + Document Title + A name given to the document revision, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + The link identifies the authoritative location for this file. Defined by RFC 6596. + The link identifies an alternative location or format for this file. Defined by the HTML Living Standard + + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + + + +

    While published, last-modified, oscal-version, and version are not required, values for these entries should be provided if the information is known. For a revision entry to be considered valid, at least one of the following items must be provided: published, last-modified, version, or a link with a rel of source.

    +     +     + + Location + A location, with associated metadata that can be referenced. + + Location Universally Unique Identifier + A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document. + + + + Location Title + A name given to the location, which may be used by a tool for display and navigation. + + + +

    Typically, the physical address of the location will be used here. If this information is sensitive, then a mailing address can be used instead.

    +     +     + + + +

    This is a contact email associated with the location.

    +     +     + + + +

    A phone number used to contact the location.

    +     +     + + Location URL + The uniform resource locator (URL) for a web site or Internet presence associated with the location. + + + + + + + + + +     + + + Characterizes the kind of location. + + + A location that contains computing assets. A class can be used to indicate a subclass of data-center. + + + The location is a data-center used for normal operations. + The location is a data-center used for fail-over or backup operations. + + +     + + Location Reference + References a location defined in metadata. + + + + + + + + Location Reference + References a location defined in metadata. + + + + + + + + Party (organization or person) + A responsible entity which is either a person or an organization. + + Party Universally Unique Identifier + A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given party across revisions of the document. + + + Party Type + A category describing the kind of party the object describes. + + + An individual. + A group of individuals formed for a specific purpose. + + + + + + Party Name + The full name of the party. This is typically the legal name associated with the party. + + + Party Short Name + A short common name, abbreviation, or acronym for the party. + + + Party External Identifier + An identifier for a person or organization using a designated scheme. e.g. an Open Researcher and Contributor ID (ORCID) + id + + + External Identifier Schema + Indicates the type of external identifier. + + + The identifier is Open Researcher and Contributor ID (ORCID). + + + + + + + + + + + + + +

    This is a contact email associated with the party.

    +     +     + + + +

    A phone number used to contact the party.

    +     +     + + + + + + + + + + Organizational Affiliation + Identifies that the party object is a member of the organization associated with the provided UUID. + + + + + + + +

    Parties of both the person or organization type can be associated with an organization using the member-of-organization.

    +     +     + +     + + + A mail stop associated with the party. + The name or number of the party's office. + The formal job title of a person. + + +     + + Party Reference + References a party defined in metadata. + + + + + + + + Role + Defines a function assumed or expected to be assumed by a party in a specific situation. + + Role Identifier + A unique identifier for a specific role instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same role across minor revisions of the document. + +

    OSCAL has defined a set of standardized roles for consistent use in OSCAL documents. This allows tools consuming OSCAL content to infer specific semantics when these roles are used. These roles are documented in the specific contexts of their use (e.g., responsible-party, responsible-role). When using such a role, it is necessary to define these roles in this list, which will then allow such a role to be referenced.

    +     +     + + + Role Title + A name given to the role, which may be used by a tool for display and navigation. + + + Role Short Name + A short common name, abbreviation, or acronym for the role. + + + Role Description + A summary of the role's purpose and associated responsibilities. + + + + + + + + + + +

    Permissible values to be determined closer to the application (e.g. by a receiving authority).

    +     +     + + Role Identifier Reference + A reference to the roles served by the user. + + + + + + + + Back matter + A collection of resources, which may be included directly or by reference. + + + Resource + A resource associated with content in the containing document. A resource may be directly included in the document base64 encoded or may point to one or more equivalent internet resources. + + + Resource Universally Unique Identifier + A globally unique identifier that can be used to reference this defined resource elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + Resource Title + A name given to the resource, which may be used by a tool for display and navigation. + + + Resource Description + A short summary of the resource used to indicate the purpose of the resource. + + + + + + + + + Citation + A citation consisting of end note text and optional structured bibliographic data. + + + Citation Text + A line of citation text. + + + + + + + + + +

    The text is used to define the endnote text, without any required bibliographic structure. If structured bibliographic data is needed, then the biblio can be used for this purpose.

    +

    A biblio can be used to capture a structured bibliographical citation in an appropriate format.

    +     +     + + Resource link + A pointer to an external resource with an optional hash for verification and change detection. + + + Hypertext Reference + A resolvable URI reference to a resource. + + + + + + +

    When appearing as part of a resource/rlink, the hash applies to the resource referenced by the href.

    +     +     +     + +

    This construct is different from link, which makes no provision for a hash or formal title.

    +

    Multiple rlink can be included for a resource. In such a case, all provided rlink items are intended to be equivalent in content, but may differ in structure. A media-type is used to identify the format of a given rlink, and can be used to differentiate a items in a collection of rlinks. The media-type also provides a hint to the OSCAL document consumer about the structure of the resource referenced by the rlink.

    +     +     + + Base64 + The Base64 alphabet in RFC 2045 - aligned with XSD. + value + + File Name + Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded. + + + + +     + + + Identifies the type of resource represented. + For resources representing a published document, this represents the version number of that document. + For resources representing a published document, this represents the publication date of that document. + + + + Indicates the resource is an organization's logo. + Indicates the resource represents an image. + Indicates the resource represents an image of screen content. + Indicates the resource represents an applicable law. + Indicates the resource represents an applicable regulation. + Indicates the resource represents an applicable standard. + Indicates the resource represents applicable guidance. + Indicates the resource provides a list of relevant acronyms. + Indicates the resource cites relevant information. + Indicates the resource is a policy. + Indicates the resource is a procedure. + Indicates the resource is guidance document related to the subject system of an SSP. + Indicates the resource is guidance document a user's guide or administrator's guide. + Indicates the resource is guidance document a administrator's guide. + Indicates the resource represents rules of behavior content. + Indicates the resource represents a plan. + Indicates the resource represents an artifact, such as may be reviewed by an assessor. + Indicates the resource represents evidence, such as to support an assessment findiing. + Indicates the resource represents output from a tool. + Indicates the resource represents machine data, which may require a tool or analysis for interpretation or presentation. + Indicates the resource represents notes from an interview, such as may be collected during an assessment. + Indicates the resource is a set of questions, possibly with responses. + Indicates the resource is a report. + Indicates the resource is a formal agreement between two or more parties. + + + + + +

    Ensures that each rlink item references a unique resource.

    +     +     + + + +

    Ensures that all base64 resources have a unique filename.

    +     +     + + + +

    A title is required when a citation is provided.

    +     +     +     +     + +

    A resource can be used in two ways. 1) it may point to an specific retrievable network resource using a rlink, or 2) it may be included as an attachment using a base64. A resource may contain multiple rlink and base64 entries that represent alternative download locations (rlink) and attachments (base64) for the same resource. Both rlink and base64 allow for a media-type to be specified, which is used to distinguish between different representations of the same resource (e.g., Microsoft Word, PDF). When multiple rlink and base64 items are included for a given resource, all items must contain equivalent information. This allows the document consumer to choose a preferred item to process based on a the selected item's media-type. This is extremely important when the items represent OSCAL content that is represented in alternate formats (i.e., XML, JSON, YAML), allowing the same OSCAL data to be processed from any of the available formats indicated by the items.

    +

    When a resource includes a citation, then the title and citation properties must both be included.

    +     +     +     + + + + + + +

    Provides a collection of identified resource objects that can be referenced by a link with a rel value of "reference" and an href value that is a fragment "#" followed by a reference to a reference identifier. Other specialized link "rel" values also use this pattern when indicated in that context of use.

    +     + + Use of link, citation, and resource + +

    The following is a contrived example to show the use of link, citation, and resource.

    +     + + + My citation + + + + + + + +     +     + + Property + An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values. + prop + + Property Name + A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object. + + + A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value. + + + + + Property Universally Unique Identifier + A unique identifier that can be used to reference this property elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document. + + + Property Namespace + A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name. + +

    Provides a means to segment the value space for the name, so that different organizations and individuals can assert control over the allowed names and associated values used in a property. This allows the semantics associated with a given name/value pair to be defined on an organization-by-organization basis.

    +

    An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.

    +

    When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.

    +     +     + + Property Value + Indicates the value of the attribute, characteristic, or quality. + + + Property Class + A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +     +     + + + + +

    Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.

    +

    Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.

    +     +     + + Link + A reference to a local or remote resource + + Hypertext Reference + A resolvable URL reference to a resource. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter + resource in the same document.

    +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + Relation + Describes the type of relationship provided by the link. This can be an indicator of the link's purpose. + + + Reference + + + + + +

    The media-type provides a hint about the content model of the referenced resource. A valid entry from the IANA Media Types registry SHOULD be used.

    +     +     + + + Link Text + A textual label to associate with the link, which may be used for presentation in a tool. + + + + + + + + + + + + + + + + +

    To provide a cryptographic hash for a remote target resource, a local reference to a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.

    +

    The OSCAL link is a roughly based on the HTML link element.

    +     + + Providing for link integrity + +

    The following is a contrived example to show the use of link, citation, and resource.

    +     + + My Hashed Resource + ...snip... + + + + C2E9C1..snip..F88D2E + + + + +     +     + + Responsible Party + A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object. + + Responsible Role + The role that the party is responsible for. + + + + + +

    Specifies one or more parties that are responsible for performing the associated role.

    +     +     + + + + + + + +     + + + + + + + + +     + + Responsible Role + A reference to one or more roles with responsibility for performing a function relative to the containing object. + + Responsible Role ID + The role that is responsible for the business function. + + + + + + + + + + + + + + + + Hash + A representation of a cryptographic digest generated over a resource using a specified hash algorithm. + value + + Hash algorithm + Method by which a hash is derived + + + The SHA-224 algorithm as defined by NIST FIPS 180-4. + + The SHA-256 algorithm as defined by NIST FIPS 180-4. + + The SHA-384 algorithm as defined by NIST FIPS 180-4. + + The SHA-512 algorithm as defined by NIST FIPS 180-4. + + The SHA3-224 algorithm as defined by NIST FIPS 202. + + The SHA3-256 algorithm as defined by NIST FIPS 202. + + The SHA3-384 algorithm as defined by NIST FIPS 202. + + The SHA3-512 algorithm as defined by NIST FIPS 202. + + + + +

    Any other value used MUST be a value defined in the W3C XML Security Algorithm Cross-Reference Digest Methods (W3C, April 2013) or RFC 6931 Section 2.1.5 New SHA Functions.

    +     +     + +

    A hash value can be used to authenticate that a referenced resource is the same resources as was pointed to by the author of the reference.

    +     +     + + Media Type + Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. + + + Remarks + Additional commentary on the containing object. + + + Publication Timestamp + The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included. + +

    This value represents the point in time when the OSCAL document was published. Typically, this date value will be machine generated at the time the containing document is published.

    +

    In some cases, an OSCAL document may be derived from some source material in a different format. In such a case, the published value should indicate when the OSCAL document was published, not the source material. Where necessary, the publication date of the original source material can be captured as a named property or custom metadata construct.

    +

    A publisher of OSCAL content can use this data point along with its siblings last-modified and version to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + Last Modified Timestamp + The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included. + +

    This value represents the point in time when the OSCAL document was last updated, or at the point of creation the creation date. Typically, this date value will be machine generated at time of creation or modification.

    +

    In some cases, an OSCAL document may be derived from some source material in a different format. In such a case, the last-modified value should indicate the modification time of the OSCAL document, not the source material.

    +

    A publisher of OSCAL content can use this data point along with its siblings published and version to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + Document Version + A string used to distinguish the current version of the document from other previous (and future) versions. + +

    A version string may be a release number, sequence number, date, or other identifier suffcient to distinguish between different document versions. This version is typically set by the document owner or by the tool used to maintain the content.

    +

    While not required, it is recommended that OSCAL content authors use Semantic Versioning as a format for version strings. This allows for the easy identification of a version tree consisting of major, minor, and patch numbers.

    +

    A publisher of OSCAL content can use this data point along with its siblings published and last-modified to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + OSCAL version + The OSCAL model version the document was authored against. + +

    Indicates the version of the OSCAL model to which this data set conforms, for example 1.1.0 or 1.0.0-M1. That can be used as a hint by a tool to indicate which version of the OSCAL XML or JSON schema to use for validation.

    +     +     + + Email Address + An email address as defined by RFC 5322 Section 3.4.1. + + + Telephone Number + Contact number by telephone. + number + + type flag + Indicates the type of phone number. + + + A home phone number. + An office phone number. + A mobile phone number. + + + + + + Address + A postal address for the location. + + type + + + + + + + City + City, town or geographical region for the mailing address. + + + State + State, province or analogous geographical region for mailing address + + + Postal Code + Postal or ZIP code for mailing address + + + Country Code + The ISO 3166-1 alpha-2 country code for the mailing address. + + + + + + + + Address line + A single line of an address. + + + Address Type + Indicates the type of address. + + + A home address. + A work address. + + + + + Document Identifier + A document identifier qualified by an identifier scheme. A document identifier provides a globally unique identifier for a group of documents that are to be treated as different versions of the same document. If this element does not appear, or if the value of this element is empty, the value of "document-id" is equal to the value of the "uuid" flag of the top-level root element. + identifier + + Document Identification Scheme + Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters. + + + A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record. + + + + +

    This element is optional, but it will always have a valid value, as if it is missing the value of "document-id" is assumed to be equal to the UUID of the root. This requirement allows for document creators to retroactively link an update to the original version, by providing a document-id on the new document that is equal to the uuid of the original document.

    +     +     +     diff --git a/test-suite/oscal/v1.0.0/oscal_catalog_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_catalog_metaschema.xml new file mode 100644 index 000000000..c40f33411 --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_catalog_metaschema.xml @@ -0,0 +1,197 @@ + + + + + +]> + + OSCAL Control Catalog Model + 1.0.0 + oscal-catalog + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL Control Catalog format can be used to describe a collection of security controls and related control enhancements, along with contextualizing documentation and metadata. The root of the Control Catalog format is catalog. +

    +     + + + + Catalog + A collection of controls. + catalog + + Catalog Universally Unique Identifier + A globally unique identifier for this catalog instance. This UUID should be changed when this document is revised. + + + + + + + + + + + + + + + + +

    Back matter including references and resources.

    +     +     +     + + + + +

    Catalogs may use one or more group objects to subdivide the control contents of a catalog.

    +

    An OSCAL catalog model provides a structured representation of control information.

    +     + + A small catalog with a single control + + A Miniature Catalog + + A Single Control + + + +     + + Control Group + A group of controls, or of groups of controls. + + + Group Identifier + A unique identifier for a specific group instance that can be used to reference the group within this and in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same group across minor revisions of the document. + + + Group Class + A textual label that provides a sub-type or characterization of the group. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Group Title + A name given to the group, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + &allowed-values-control-group-property-name; + + + +

    Catalogs can use a group to collect related controls into a single grouping. That can be useful to group controls into a family or other logical grouping.

    +

    A group may have its own properties, statements, parameters, and references, which are inherited by all members of that group.

    +     + + + My Group + + + Control + + + +     + + Control + A structured information object representing a security or privacy control. Each security or privacy control within the Catalog is defined by a distinct control instance. + + + Control Identifier + A unique identifier for a specific control instance that can be used to reference the control in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same control across minor revisions of the document. + + + Control Class + A textual label that provides a sub-type or characterization of the control. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Control Title + A name given to the control, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + + + &allowed-values-control-group-property-name; + The status of a control. For example, a value of 'withdrawn' can indicate that the control has been withdrawn and should no longer be used. + + + The control is no longer used. + + + The link cites an external resource related to this control. + The link identifies another control with bearing to this control. + The link identifies another control that must be present if this control is present. + The link identifies other control content where this control content is now addressed. + + + +

    Controls may be grouped using group, and controls may be partitioned using part or further enhanced (extended) using control.

    +

    A control must have a part with the name "statement", which represents the textual narrative of the control. This "statement" part must occur only once, but may have nested parts to allow for multiple paragraphs or sections of text.

    +     + + + Control 1 + + +     +     diff --git a/test-suite/oscal/v1.0.0/oscal_complete_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_complete_metaschema.xml new file mode 100644 index 000000000..82989c7ff --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_complete_metaschema.xml @@ -0,0 +1,24 @@ + + + + + +]> + + OSCAL Unified Model of Models + 1.0.0 + oscal-complete + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal/1.0 + +

    This format represents a combination of all of the OSCAL models.

    +     + + + + + + + +     diff --git a/test-suite/oscal/v1.0.0/oscal_component_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_component_metaschema.xml new file mode 100644 index 000000000..ed1880ef2 --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_component_metaschema.xml @@ -0,0 +1,432 @@ + + + + + + + + + + + +]> + + OSCAL Component Definition Model + 1.0.0 + oscal-component-definition + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL Component Definition Model can be used to describe the implementation of controls in a component or a set of components grouped as a capability. A component can be either a technical component, or a documentary component. A technical component is a component that is implemented in hardware (physical or virtual) or software. A documentary component is a component implemented in a document, such as a process, procedure, or policy.

    +

    The root of the OSCAL Implementation Component format is component-definition. +

    +

    NOTE: This documentation is a work in progress. As a result, documentation for many of the information elements is missing or incomplete.

    +     + + + + + Component Definition + A collection of component descriptions, which may optionally be grouped by capability. + component-definition + + Component Definition Universally Unique Identifier + A globally unique identifier for this component definition instance. This UUID should be changed when this document is revised. + + + + + + + + component + + + + + + + + + + + +

    Since multiple component entries can be provided, each component must have a unique uuid.

    +     +     + + + +

    A given component must not be referenced more than once within the same capability.

    +     +     +     +     + + + Import Component Definition + Loads a component definition from another resource. + + Hyperlink Reference + A link to a resource that defines a set of components and/or capabilities to import into this collection. + + + + + Component + A defined component that can be part of an implemented system. + + Component Identifier + The unique identifier for the component. + + + type + + + + Component Title + A human readable name for the component. + + + Component Description + A description of the component, including information about its function. + + + Purpose + A summary of the technological or business purpose of the component. + + + + + + + + + + + + + +

    Used for service components to define the protocols supported by the service.

    +     +     + + + + + + +     + + + + + + + &allowed-values-component_component_property-name; + &allowed-values-component_inventory-item_property-name; + + + + + + + + + + &allowed-values-component_component_link-rel; + This component uses the network provided by the identified network component. + + + + + + + + &allowed-values-responsible-roles-operations; + &allowed-values-responsible-roles-component-production; + + + + &allowed-values-property-name-asset-type-values; + + + + + + + + The component allows an authenticated scan. + The component does not allow an authenticated scan. + + + + The component is virtualized. + The component is not virtualized. + + + + The component is publicly accessible. + The component is not publicly accessible. + + + + The component is implemented within the system boundary. + The component is implemented outside the system boundary. + + + + + + + + + + + + + + + + + + + + &allowed-values-component_component_software; + + + + + + + &allowed-values-component_component_service; + + + + + + + + + + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     + +

    Components may be products, services, APIs, policies, processes, plans, guidance, standards, or other tangible items that enable security and/or privacy.

    +

    The type indicates which of these component types is represented.

    +

    A group of components may be aggregated into a capability. For example, an account management capability that consists of an account management process, and a Lightweight Directory Access Protocol (LDAP) software implementation.

    +

    Capabilities are expressed by combining one or more components.

    +     +     + + + Component Type + A category describing the purpose of the component. + + + &allowed-values-component-type; + + + + + + Capability + A grouping of other components and/or capabilities. + + Capability Identifier + A unique identifier for a capability. + + + Capability Name + The capability's human-readable name. + + + + Capability Description + A summary of the capability. + + + + + + + + + + + + + + + + + + + +

    A given component must not be referenced more than once within the same capability.

    +     +     +     +     + + Incorporates Component + + TBD + + Component Reference + A reference to a component by its identifier + + + + Component Description + A description of the component, including information about its function. + + + + + + Control Implementation Set + Defines how the component or capability supports a set of controls. + + Control Implementation Set Identifier + A unique identifier for the set of implemented controls. + + + +

    A URL reference to the source catalog or profile for which this component is implementing controls for.

    +     +     + + + Control Implementation Description + A description of how the specified set of controls are implemented for the containing component or capability. + + + + + + + + + + + + + + + + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     +     + +

    Use of set-parameter in this context, sets the parameter for all related controls referenced in an implemented-requirement. If the same parameter is also set in a specific implemented-requirement, then the new value will override this value.

    +     +     + + Control Implementation + Describes how the containing component or capability implements an individual control. + + Control Implementation Identifier + A unique identifier for a specific control implementation. + + + + + Control Implementation Description + A description of how the specified control is implemented for the containing component or capability. + + + + + + + + + + + + + + + + + + + + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + + +

    Since statement entries can be referenced using the statement's statement-id, each statement must be referenced only once.

    +     +     +     +     + + Control Statement Implementation + Identifies which statements within a control are addressed. + + +

    A reference to the specific implemented statement associated with a control.

    +     +     + + Control Statement Reference Universally Unique Identifier + A globally unique identifier that can be used to reference this control statement entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + Statement Implementation Description + A summary of how the containing control statement is implemented by the component or capability. + + + + + + + + + + + + + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     +     diff --git a/test-suite/oscal/v1.0.0/oscal_control-common_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_control-common_metaschema.xml new file mode 100644 index 000000000..373fb8347 --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_control-common_metaschema.xml @@ -0,0 +1,271 @@ + + + + + +]> + + OSCAL Control Catalog Format -- Common Models + 1.0.0 + oscal-catalog-common + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + + + + + + Part + A partition of a control's definition or a child of another part. + + + Part Identifier + A unique identifier for a specific part instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same part across minor revisions of the document. + + + Part Name + A textual label that uniquely identifies the part's semantic type. + + + + An introduction to a control or a group of controls. + A set of control implementation requirements. + An individual item within a control statement. + Additional information to consider when selecting, implementing, assessing, and monitoring a control. + Describes a set of assessment objectives. + Describes a method-based assessment over a set of assessment objects. + Provides a list of assessment objects. + + + + + + Part Namespace + A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name. + +

    Provides a means to segment the value space for the name, so that different organizations and individuals can assert control over the allowed names and associated text used in a part. This allows the semantics associated with a given name to be defined on an organization-by-organization basis.

    +

    An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.

    +

    When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.

    +     +     + + Part Class + A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns. + + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Part Title + A name given to the part, which may be used by a tool for display and navigation. + + + + + + Part Text + Permits multiple paragraphs, lists, tables etc. + + + + + + + + + + + + + &allowed-values-control-group-property-name; + + + + The assessment method to use. This typically appears on parts with the name "assessment". + + + + The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence. + The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). + The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior. + + + + +

    A part provides for logical partitioning of prose, and can be thought of as a grouping structure (e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.

    +

    A part can be assigned an optional id, which allows for internal and external references to the textual concept contained within a part. A id provides a means for an OSCAL profile, or a higher layer OSCAL model to reference a specific part within a catalog. For example, an id can be used to reference or to make modifications to a control statement in a profile.

    +

    Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics. Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations. Each organization is responsible for governance of their own extensions, and is strongly encouraged to publish their extensions as standards to their user community. If no ns is provided, the name is expected to be in the "OSCAL" namespace.

    +

    To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a DNS or other globally defined organization name should be used. For example, if FedRAMP and DoD both extend OSCAL, FedRAMP will use the ns "https://fedramp.gov", while DoD will use the ns "https://defense.gov" for any organization specific name. +

    +

    Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.

    +     + + Multiple Parts with Different Organization-Specific Names + + Something FedRAMP Cares About + Something DoD Cares About + + +     + + + + + + Parameter + Parameters provide a mechanism for the dynamic assignment of value(s) in a control. + + param + + + Parameter Identifier + A unique identifier for a specific parameter instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same parameter across minor revisions of the document. + + + + Parameter Class + A textual label that provides a characterization of the parameter. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +     +     + + + + + + + + + + + Parameter Label + A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned. + +

    The label value should be suitable for inline display in a rendered catalog.

    +     +     + + Parameter Usage Description + Describes the purpose and use of a parameter + + + constraint + + + + guideline + + + + + + + value + + +

    A set of values provided in a catalog can be redefined at any higher layer of OSCAL (e.g., Profile).

    +     +     + + select + +

    A set of parameter value choices, that may be picked from to set the parameter value.

    +     +     +     + + +     + +

    In a catalog, a parameter is typically used as a placeholder for the future assignment of a parameter value, although the OSCAL model allows for the direct assignment of a value if desired by the control author. The value may be optionally used to specify one or more values. If no value is provided, then it is expected that the value will be provided at the Profile or Implementation layer.

    +

    A parameter can include a variety of metadata options that support the future solicitation of one or more values. A label provides a textual placeholder that can be used in a tool to solicit parameter value input, or to display in catalog documentation. The desc provides a short description of what the parameter is used for, which can be used in tooling to help a user understand how to use the parameter. A constraint can be used to provide criteria for the allowed values. A guideline provides a recommendation for the use of a parameter.

    +     +     + + + + Constraint + A formal or informal expression of a constraint or test + + + + Constraint Description + A textual summary of the constraint to be applied. + + + + Constraint Test + A test expression which is expected to be evaluated by a tool. + + + + Constraint test + A formal (executable) expression of a constraint + + + + + + + + Guideline + A prose statement that provides a recommendation for the use of a parameter. + + + Guideline Text + Prose permits multiple paragraphs, lists, tables etc. + + + + + + + + Parameter Value + A parameter value or set of values. + + + + Selection + Presenting a choice among alternatives + + Parameter Cardinality + Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted. + + + Only one value is permitted. + One or more values are permitted. + + + + + + Choice + A value selection among several such options + choice + value + + + + + + +

    A set of parameter value choices, that may be picked from to set the parameter value.

    +     +     + + + Depends on + Another parameter invoking this one + + + Control Identifier Reference + A reference to a control with a corresponding id value. + +     diff --git a/test-suite/oscal/v1.0.0/oscal_implementation-common_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_implementation-common_metaschema.xml new file mode 100644 index 000000000..a6dd0b6bf --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_implementation-common_metaschema.xml @@ -0,0 +1,681 @@ + + + + + + + + + + + +]> + + OSCAL Implementation Common Information + 1.0.0 + oscal-implementation-common + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + + + + + + + + + Component + A defined component that can be part of an implemented system. + + Component Identifier + The unique identifier for the component. + + + + type + + + + Component Title + A human readable name for the system component. + + + Component Description + A description of the component, including information about its function. + + + Purpose + A summary of the technological or business purpose of the component. + + + + + + + + + Status + Describes the operational status of the system component. + + State + The operational status. + + + The component is being designed, developed, or implemented. + The component is currently operational and is available for use in the system. + The component is no longer operational. + Some other state. + + + + + + + + + + + + + +

    Used for service components to define the protocols supported by the service.

    +     +     + +     + + + + Relative placement of component ('internal' or 'external') to the system. + UUID of the related leveraged-authorization assembly in this SSP. + UUID of the component as it was assigned in the leveraged system's SSP. + + + + + + &allowed-values-component_inventory-item_property-name; + + &allowed-values-component_component_property-name; + + + + + + + + &allowed-values-component_component_link-rel; + This component uses the network provided by the identified network component. + + + + + + + &allowed-values-responsible-roles-operations; + &allowed-values-responsible-roles-component-production; + + + + &allowed-values-property-name-asset-type-values; + + + + The component allows an authenticated scan. + The component does not allow an authenticated scan. + + + + The component is publicly accessible. + The component is not publicly accessible. + + + + The component is virtualized. + The component is not virtualized. + + + + The component is implemented within the system boundary. + The component is implemented outside the system boundary. + + + + + + + + + + + + + + + The name of the company or organization + + + + + + + + + + A link to an online information provided by the authorizing body. + + + + + + + &allowed-values-component_component_software; + + + + + + + &allowed-values-component_component_service; + + + + + + + + + Title of the Interconnection Security Agreement (ISA). + Date of the Interconnection Security Agreement (ISA). + The name of the remote interconnected system. + An Internet Protocol Version 4 interconnection address + An Internet Protocol Version 6 interconnection address + An Internet Protocol Version 6 interconnection address + + + The identified IP address is for this system. + The identified IP address is for the remote system to which this system is connected. + + + + A link to the system interconnection agreement. + + + Interconnection Security Agreement (ISA) point of contact (POC) for this system. + Interconnection Security Agreement (ISA) point of contact (POC) for the remote interconnected system. + Interconnection Security Agreement (ISA) authorizing official for this system. + Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system. + + + + + + Data from the remote system flows into this system. + Data from this system flows to the remote system. + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     + +

    Components may be products, services, application programming interface (APIs), policies, processes, plans, guidance, standards, or other tangible items that enable security and/or privacy.

    +

    The type indicates which of these component types is represented.

    + +

    When defining a service component where are relationship to other components is known, one or more link entries with rel values of provided-by and used-by can be used to link to the specific component identifier(s) that provide and use the service respectively.

    +     +     + + + Component Type + A category describing the purpose of the component. + + + The system as a whole. + An external system, which may be a leveraged system or the other side of an interconnection. + &allowed-values-component-type; + A physical or virtual network. + + + + + + Service Protocol Information + Information about the protocol used to provide a service. + + Service Protocol Information Universally Unique Identifier + A globally unique identifier that can be used to reference this service protocol entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + Protocol Name + The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry. + + +

    The short name of the protocol (e.g., https).

    +     +     + + + Protocol Title + A human readable name for the protocol (e.g., Transport Layer Security). + + + + + +     + + Port Range + Where applicable this is the IPv4 port range on which the service operates. + + Start + Indicates the starting port number in a port range + +

    Should be a number within a permitted range

    +     +     + + End + Indicates the ending port number in a port range + +

    Should be a number within a permitted range

    +     +     + + Transport + Indicates the transport type. + + + Transmission Control Protocol + User Datagram Protocol + + + + +

    To be validated as a natural number (integer >= 1). A single port uses the same value for start and end. Use multiple 'port-range' entries for non-contiguous ranges.

    +     + + + + + + + +     + + + Implementation Status + Indicates the degree to which the a given control is implemented. + + Implementation State + Identifies the implementation status of the control or control objective. + + + The control is fully implemented. + The control is partially implemented. + There is a plan for implementing the control as explained in the remarks. + There is an alternative implementation for this control as explained in the remarks. + This control does not apply to this system as justified in the remarks. + + + + + + + + + + + + + System User + A type of user that interacts with the system based on an associated role. + + User Universally Unique Identifier + The unique identifier for the user class. + + + + User Title + A name given to the user, which may be used by a tool for display and navigation. + + + User Short Name + A short common name, abbreviation, or acronym for the user. + + + User Description + A summary of the user's purpose within the system. + + + + + + + + + + + + + + + + + + + The type of user, such as internal, external, or general-public. + The user's privilege level within the system, such as privileged, non-privileged, no-logical-access. + + + A user account for a person or entity that is part of the organization who owns or operates the system. + A user account for a person or entity that is not part of the organization who owns or operates the system. + A user of the system considered to be outside + + + This role has elevated access to the system, such as a group or system administrator. + This role has typical user-level access to the system without elevated access. + This role has no access to the system, such as a manager who approves access as part of a process. + + + &allowed-values-responsible-roles-operations; + + + +

    Permissible values to be determined closer to the application, such as by a receiving authority.

    +     +     + + Privilege + Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege. + + + Privilege Title + A human readable name for the privilege. + + + Privilege Description + A summary of the privilege's purpose within the system. + + + + + + + + Functions Performed + Describes a function performed for a given authorized privilege by this user class. + + + + + + + Inventory Item + A single managed inventory item within the system. + + + Inventory Item Universally Unique Identifier + A globally unique identifier that can be used to reference this inventory item entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + + Inventory Item Description + A summary of the inventory item stating its purpose within the system. + + + + + + + + + + + + + Implemented Component + The set of components that are implemented in a given system inventory item. + + + + Component Universally Unique Identifier Reference + A reference to a component that is implemented as part of an inventory item. + + + + + + + + + + + + + + + + +

    This construct is used to either: 1) associate a party or parties to a role defined on the component using the responsible-role construct, or 2) to define a party or parties that are responsible for a role defined within the context of the containing inventory-item. +

    +     +     + +     + + + + + + + &allowed-values-component_component_property-name; + &allowed-values-component_inventory-item_property-name; + + + + + + + + &allowed-values-responsible-roles-operations; + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + +     + + + The Internet Protocol v4 Address of the asset. + The Internet Protocol v6 Address of the asset. + The full-qualified domain name (FQDN) of the asset. + A Uniform Resource Identifier (URI) for the asset. + A serial number for the asset. + The NetBIOS name for the asset. + The media access control (MAC) address for the asset. + The physical location of the asset's hardware (e.g., Data Center ID, Cage#, Rack#, or other meaningful location identifiers). + is the asset subjected to network scans? (yes/no) + + + + + The model number of the hardware used by the asset. + + The name of the operating system used by the asset. + + The version of the operating system used by the asset. + + The software product name used by the asset. + + The software product version used by the asset. + + The software product patch level used by the asset. + + + + + &allowed-values-component_inventory-item_property-name; + + + + &allowed-values-property-name-asset-type-values; + + + + The name of the company or organization + + + + + The asset is included in periodic vulnerability scanning. + The asset is not included in periodic vulnerability scanning. + + + + A reference to the baseline template used to configure the asset. + + + + + &allowed-values-responsible-roles-operations; + &allowed-values-responsible-roles-component-production; + + + + + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + + + Source Resource Reference + A reference to an OSCAL catalog or profile providing the referenced control or subcontrol definition. + + + + Control Statement Reference + A reference to a control statement by its identifier + + + Set Parameter Value + Identifies the parameter that will be set by the enclosed value. + + + + + Parameter Value + A parameter value or set of values. + value + + + + + + + + + + System Identification + A unique identifier for the system described by this system security plan. + id + + Identification System Type + Identifies the identification system from which the provided identifier was assigned. + + + The identifier was assigned by FedRAMP. + A Universally Unique Identifier (UUID) as defined by RFC4122. + + + + + + + + + Parameter ID + A reference to a parameter within a control, who's catalog has been imported into the current implementation context. + + + System ISSO + + + +     diff --git a/test-suite/oscal/v1.0.0/oscal_metadata_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_metadata_metaschema.xml new file mode 100644 index 000000000..3f1d4ba3c --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_metadata_metaschema.xml @@ -0,0 +1,947 @@ + + + + + + OSCAL Document Metadata Description + 1.0.0 + oscal-metadata + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + + + + + + Publication metadata + Provides information about the publication and availability of the containing document. + + + Document Title + A name given to the document, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + Indicates the organization that created this content. + Indicates the organization for which this content was created. + Indicates the organization responsible for all content represented in the "document". + + + The link identifies the authoritative location for this file. Defined by RFC 6596. + The link identifies an alternative location or format for this file. Defined by the HTML Living Standard + This link identifies a resource containing the latest version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + +     +     + + + Revision History Entry + An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first). + + + Document Title + A name given to the document revision, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + The link identifies the authoritative location for this file. Defined by RFC 6596. + The link identifies an alternative location or format for this file. Defined by the HTML Living Standard + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829. + + + +

    While published, last-modified, oscal-version, and version are not required, values for these entries should be provided if the information is known. For a revision entry to be considered valid, at least one of the following items must be provided: published, last-modified, version, or a link with a rel of source.

    +     +     + + + Location + A location, with associated metadata that can be referenced. + + Location Universally Unique Identifier + A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document. + + + + Location Title + A name given to the location, which may be used by a tool for display and navigation. + + + +

    Typically, the physical address of the location will be used here. If this information is sensitive, then a mailing address can be used instead.

    +     +     + + + + +

    This is a contact email associated with the location.

    +     +     + + + + +

    A phone number used to contact the location.

    +     +     + + Location URL + The uniform resource locator (URL) for a web site or Internet presence associated with the location. + + + + + + + + + + +     + + + Characterizes the kind of location. + + + A location that contains computing assets. A class can be used to indicate a subclass of data-center. + + + The location is a data-center used for normal operations. + The location is a data-center used for fail-over or backup operations. + + +     + + + Location Reference + References a location defined in metadata. + + + + + + + + + + + + Location Reference + References a location defined in metadata. + + + + + + + + + + + Party (organization or person) + A responsible entity which is either a person or an organization. + + Party Universally Unique Identifier + A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given party across revisions of the document. + + + Party Type + A category describing the kind of party the object describes. + + + An individual. + A group of individuals formed for a specific purpose. + + + + + + + Party Name + The full name of the party. This is typically the legal name associated with the party. + + + Party Short Name + A short common name, abbreviation, or acronym for the party. + + + + Party External Identifier + An identifier for a person or organization using a designated scheme. e.g. an Open Researcher and Contributor ID (ORCID) + id + + + + External Identifier Schema + Indicates the type of external identifier. + + + The identifier is Open Researcher and Contributor ID (ORCID). + + + + + + + + + + + + + + +

    This is a contact email associated with the party.

    +     +     + + + + +

    A phone number used to contact the party.

    +     +     + + + + + + + + + + + Organizational Affiliation + Identifies that the party object is a member of the organization associated with the provided UUID. + + + + + + + +

    Parties of both the person or organization type can be associated with an organization using the member-of-organization. +

    +     +     + +     + + + A mail stop associated with the party. + The name or number of the party's office. + The formal job title of a person. + + +     + + + Party Reference + References a party defined in metadata. + + + + + + + + + + + Role + Defines a function assumed or expected to be assumed by a party in a specific situation. + + + Role Identifier + A unique identifier for a specific role instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same role across minor revisions of the document. + +

    OSCAL has defined a set of standardized roles for consistent use in OSCAL documents. This allows tools consuming OSCAL content to infer specific semantics when these roles are used. These roles are documented in the specific contexts of their use (e.g., responsible-party, responsible-role). When using such a role, it is necessary to define these roles in this list, which will then allow such a role to be referenced.

    +     +     + + + Role Title + A name given to the role, which may be used by a tool for display and navigation. + + + Role Short Name + A short common name, abbreviation, or acronym for the role. + + + + Role Description + A summary of the role's purpose and associated responsibilities. + + + + + + + + + + +

    Permissible values to be determined closer to the application (e.g. by a receiving authority).

    +     +     + + + Role Identifier Reference + A reference to the roles served by the user. + + + + + + + + + + + + + Back matter + A collection of resources, which may be included directly or by reference. + + + Resource + A resource associated with content in the containing document. A resource may be directly included in the document base64 encoded or may point to one or more equivalent internet resources. + + + Resource Universally Unique Identifier + A globally unique identifier that can be used to reference this defined resource elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + Resource Title + A name given to the resource, which may be used by a tool for display and navigation. + + + + Resource Description + A short summary of the resource used to indicate the purpose of the resource. + + + + + + + + + + Citation + A citation consisting of end note text and optional structured bibliographic data. + + + Citation Text + A line of citation text. + + + + + + + + + + +

    The text is used to define the endnote text, without any required bibliographic structure. If structured bibliographic data is needed, then the biblio can be used for this purpose.

    +

    A biblio can be used to capture a structured bibliographical citation in an appropriate format.

    +     +     + + Resource link + A pointer to an external resource with an optional hash for verification and change detection. + + + Hypertext Reference + A resolvable URI reference to a resource. + + + + + + +

    When appearing as part of a resource/rlink, the hash applies to the resource referenced by the href. +

    +     +     +     + +

    This construct is different from link, which makes no provision for a hash or formal title.

    +

    Multiple rlink can be included for a resource. In such a case, all provided rlink items are intended to be equivalent in content, but may differ in structure. A media-type is used to identify the format of a given rlink, and can be used to differentiate a items in a collection of rlinks. The media-type also provides a hint to the OSCAL document consumer about the structure of the resource referenced by the rlink. +

    +     +     + + + Base64 + The Base64 alphabet in RFC 2045 - aligned with XSD. + value + + File Name + Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded. + + + + + +     + + + Identifies the type of resource represented. + For resources representing a published document, this represents the version number of that document. + For resources representing a published document, this represents the publication date of that document. + + + + + + Indicates the resource is an organization's logo. + Indicates the resource represents an image. + Indicates the resource represents an image of screen content. + Indicates the resource represents an applicable law. + Indicates the resource represents an applicable regulation. + Indicates the resource represents an applicable standard. + Indicates the resource represents applicable guidance. + Indicates the resource provides a list of relevant acronyms. + Indicates the resource cites relevant information. + + Indicates the resource is a policy. + Indicates the resource is a procedure. + Indicates the resource is guidance document related to the subject system of an SSP. + Indicates the resource is guidance document a user's guide or administrator's guide. + Indicates the resource is guidance document a administrator's guide. + Indicates the resource represents rules of behavior content. + Indicates the resource represents a plan. + + Indicates the resource represents an artifact, such as may be reviewed by an assessor. + Indicates the resource represents evidence, such as to support an assessment findiing. + Indicates the resource represents output from a tool. + Indicates the resource represents machine data, which may require a tool or analysis for interpretation or presentation. + Indicates the resource represents notes from an interview, such as may be collected during an assessment. + Indicates the resource is a set of questions, possibly with responses. + Indicates the resource is a report. + Indicates the resource is a formal agreement between two or more parties. + + + + + +

    Ensures that each rlink item references a unique resource.

    +     +     + + + +

    Ensures that all base64 resources have a unique filename. +

    +     +     + + + +

    A title is required when a citation is provided.

    +     +     +     +     + +

    A resource can be used in two ways. 1) it may point to an specific retrievable network resource using a rlink, or 2) it may be included as an attachment using a base64. A resource may contain multiple rlink and base64 entries that represent alternative download locations (rlink) and attachments (base64) for the same resource. Both rlink and base64 allow for a media-type to be specified, which is used to distinguish between different representations of the same resource (e.g., Microsoft Word, PDF). When multiple rlink and base64 items are included for a given resource, all items must contain equivalent information. This allows the document consumer to choose a preferred item to process based on a the selected item's media-type. This is extremely important when the items represent OSCAL content that is represented in alternate formats (i.e., XML, JSON, YAML), allowing the same OSCAL data to be processed from any of the available formats indicated by the items.

    +

    When a resource includes a citation, then the title and citation properties must both be included.

    +     +     +     + + + + + + +

    Provides a collection of identified resource objects that can be referenced by a link with a rel value of "reference" and an href value that is a fragment "#" followed by a reference to a reference identifier. Other specialized link "rel" values also use this pattern when indicated in that context of use.

    +     + + + Use of link, citation, and resource + +

    The following is a contrived example to show the use of link, citation, and resource.

    +     + + + My citation + + + + + + + +     +     + + + + + + Property + An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values. + prop + + Property Name + A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object. + + + A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value. + + + + + Property Universally Unique Identifier + A unique identifier that can be used to reference this property elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document. + + + + + Property Namespace + A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name. + +

    Provides a means to segment the value space for the name, so that different organizations and individuals can assert control over the allowed names and associated values used in a property. This allows the semantics associated with a given name/value pair to be defined on an organization-by-organization basis.

    +

    An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.

    +

    When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.

    +     +     + + Property Value + Indicates the value of the attribute, characteristic, or quality. + + + Property Class + A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns. + + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +     +     + + + + +

    Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.

    +

    Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.

    +     +     + + + Link + A reference to a local or remote resource + + Hypertext Reference + A resolvable URL reference to a resource. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter + resource in the same document.

    + +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + Relation + Describes the type of relationship provided by the link. This can be an indicator of the link's purpose. + + + Reference + + + + + +

    The media-type provides a hint about the content model of the referenced resource. A valid entry from the IANA Media Types registry SHOULD be used.

    +     +     + + + Link Text + A textual label to associate with the link, which may be used for presentation in a tool. + + + + + + + + + + + + + + + + +

    To provide a cryptographic hash for a remote target resource, a local reference to a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.

    +

    The OSCAL link is a roughly based on the HTML link element. +

    +     + + Providing for link integrity + +

    The following is a contrived example to show the use of link, citation, and resource.

    +     + + My Hashed Resource + ...snip... + + + + C2E9C1..snip..F88D2E + + + + +     +     + + + Responsible Party + A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object. + + Responsible Role + The role that the party is responsible for. + + + + + +

    Specifies one or more parties that are responsible for performing the associated role. +

    +     +     + + + + + + + +     + + + + + + + + +     + + Responsible Role + A reference to one or more roles with responsibility for performing a function relative to the containing object. + + Responsible Role ID + The role that is responsible for the business function. + + + + + + + + + + + + + + + + + + Hash + A representation of a cryptographic digest generated over a resource using a specified hash algorithm. + value + + Hash algorithm + Method by which a hash is derived + + + The SHA-224 algorithm as defined by NIST FIPS 180-4. + + The SHA-256 algorithm as defined by NIST FIPS 180-4. + + The SHA-384 algorithm as defined by NIST FIPS 180-4. + + The SHA-512 algorithm as defined by NIST FIPS 180-4. + + The SHA3-224 algorithm as defined by NIST FIPS 202. + + The SHA3-256 algorithm as defined by NIST FIPS 202. + + The SHA3-384 algorithm as defined by NIST FIPS 202. + + The SHA3-512 algorithm as defined by NIST FIPS 202. + + + + +

    Any other value used MUST be a value defined in the W3C XML Security Algorithm Cross-Reference Digest Methods (W3C, April 2013) or RFC 6931 Section 2.1.5 New SHA Functions.

    +     +     + +

    A hash value can be used to authenticate that a referenced resource is the same resources as was pointed to by the author of the reference.

    +     +     + + + Media Type + Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. + + + + + Remarks + Additional commentary on the containing object. + + + + + + + Publication Timestamp + The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included. + +

    This value represents the point in time when the OSCAL document was published. Typically, this date value will be machine generated at the time the containing document is published.

    +

    In some cases, an OSCAL document may be derived from some source material in a different format. In such a case, the published value should indicate when the OSCAL document was published, not the source material. Where necessary, the publication date of the original source material can be captured as a named property or custom metadata construct.

    +

    A publisher of OSCAL content can use this data point along with its siblings last-modified and version to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + + Last Modified Timestamp + The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included. + +

    This value represents the point in time when the OSCAL document was last updated, or at the point of creation the creation date. Typically, this date value will be machine generated at time of creation or modification.

    +

    In some cases, an OSCAL document may be derived from some source material in a different format. In such a case, the last-modified value should indicate the modification time of the OSCAL document, not the source material.

    +

    A publisher of OSCAL content can use this data point along with its siblings published and version to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + Document Version + A string used to distinguish the current version of the document from other previous (and future) versions. + +

    A version string may be a release number, sequence number, date, or other identifier suffcient to distinguish between different document versions. This version is typically set by the document owner or by the tool used to maintain the content.

    +

    While not required, it is recommended that OSCAL content authors use Semantic Versioning as a format for version strings. This allows for the easy identification of a version tree consisting of major, minor, and patch numbers.

    +

    A publisher of OSCAL content can use this data point along with its siblings published and last-modified to establish a sequence of successive revisions of a given OSCAL-based publication. The metadata for previous revisions can be represented as a revision in this object.

    +     +     + + OSCAL version + The OSCAL model version the document was authored against. + +

    Indicates the version of the OSCAL model to which this data set conforms, for example 1.1.0 or 1.0.0-M1. That can be used as a hint by a tool to indicate which version of the OSCAL XML or JSON schema to use for validation.

    +     +     + + + Email Address + An email address as defined by RFC 5322 Section 3.4.1. + + + + + Telephone Number + Contact number by telephone. + number + + type flag + Indicates the type of phone number. + + + A home phone number. + An office phone number. + A mobile phone number. + + + + + + + Address + A postal address for the location. + + type + + + + + + + + City + City, town or geographical region for the mailing address. + + + State + State, province or analogous geographical region for mailing address + + + Postal Code + Postal or ZIP code for mailing address + + + Country Code + The ISO 3166-1 alpha-2 country code for the mailing address. + + + + + + + + + Address line + A single line of an address. + + + + Address Type + Indicates the type of address. + + + A home address. + A work address. + + + + + + + Document Identifier + A document identifier qualified by an identifier scheme. A document identifier provides a globally unique identifier for a group of documents that are to be treated as different versions of the same document. If this element does not appear, or if the value of this element is empty, the value of "document-id" is equal to the value of the "uuid" flag of the top-level root element. + identifier + + + + Document Identification Scheme + Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters. + + + A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record. + + + + +

    This element is optional, but it will always have a valid value, as if it is missing the value of "document-id" is assumed to be equal to the UUID of the root. This requirement allows for document creators to retroactively link an update to the original version, by providing a document-id on the new document that is equal to the uuid of the original document.

    +     +     + + + +     diff --git a/test-suite/oscal/v1.0.0/oscal_poam_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_poam_metaschema.xml new file mode 100644 index 000000000..8b899625d --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_poam_metaschema.xml @@ -0,0 +1,152 @@ + + + + OSCAL Plan of Action and Milestones (POA&M) Model + 1.0.0 + oscal-poam + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL Plan of Action and Milestones (POA&M) format is used to describe the information typically provided by an assessor during the preparation for an assessment.

    +

    The root of the OSCAL Plan of Action and Milestones (POA&M) format is plan-action-milestones. +

    +     + + + + + + + Plan of Action and Milestones (POA&M) + A plan of action and milestones which identifies initial and residual risks, deviations, and disposition, such as those required by FedRAMP. + plan-of-action-and-milestones + + POA&M Universally Unique Identifier + Uniquely identifies this POA&M. This UUID must be changed each time the content of the POA&M changes. + + + + + + +

    Used by the POA&M to import information about the system.

    +     +     + + + + + + + + + + + + + + + + +     + +

    Either an OSCAL-based SSP must be imported, or a unique system-id must be specified. Both may be present.

    +     +     + + Local Definitions + Allows components, and inventory-items to be defined within the POA&M for circumstances where no OSCAL-based SSP exists, or is not delivered with the POA&M. + + + component + + +

    Used to add any components, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + + + +

    Used to add any inventory-items, not defined via the System Security Plan (AR->AP->SSP)

    +     +     + +     + + + + +

    Since multiple component entries can be provided, each component must have a unique uuid.

    +     +     +     +     + + + POA&M Item + Describes an individual POA&M item. + + POA&M Item Universally Unique Identifier + Uniquely identifies the POA&M entry. This UUID may be referenced elsewhere in an OSCAL document when referring to this information. A UUID should be consistently used for a given POA&M item across revisions of the document. + + + + POA&M Item Title + The title or name for this POA&M item . + + + + POA&M Item Description + A human-readable description of POA&M item. + + + + + + + + + Origin + Identifies the source of the finding, such as a tool or person. + + + + actor + + + + +

    Used to identify the individual and/or tool generated this poam-item.

    +     +     + + + + + + + + Related Observation + Relates the poam-item to a set of referenced observations that were used to determine the finding. + + + Observation Universally Unique Identifier Reference + References an observation defined in the list of observations. + + + + + + Associated Risk + Relates the finding to a set of referenced risks that were used to determine the finding. + + + Risk Universally Unique Identifier Reference + References an risk defined in the list of risks. + + + +     +     +     diff --git a/test-suite/oscal/v1.0.0/oscal_profile_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_profile_metaschema.xml new file mode 100644 index 000000000..2066fb9ff --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_profile_metaschema.xml @@ -0,0 +1,436 @@ + + + +]> + + OSCAL Profile Model + 1.0.0 + oscal-profile + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    A profile designates a selection and configuration of controls from one or more catalogs, along with a series of operations over them. The topmost element in the OSCAL profile XML schema is profile.

    +     + + + + + + Profile + Each OSCAL profile is defined by a Profile element + profile + + Catalog Universally Unique Identifier + A globally unique identifier for this profile instance. This UUID should be changed when this document is revised. + + + + + + + + + + + +

    An OSCAL document that describes a tailoring of controls from one or more catalogs, with possible modification of multiple controls. It provides mechanisms by which controls may be selected (import), merged or (re)structured (merge), and amended (modify). OSCAL profiles may select subsets of controls, set parameter values for them in application, and even adjust the representation of controls as given in and by a catalog. They may also serve as sources for further modification in and by other profiles, that import them.

    +     +     + + Import resource + The import designates a catalog, profile, or other resource to be included (referenced and potentially modified) by this profile. The import also identifies which controls to select using the include-all, include-controls, and exclude-controls directives. + + Catalog or Profile Reference + A resolvable URL reference to the base catalog or profile that this profile is tailoring. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter + resource in the same document.

    + +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URL pointing to the location of the referenced resource. A relative URL will be resolved relative to the location of the document containing the link.

    +     +     + + + + +

    Identifies that all controls are to be included from the imported catalog or profile.

    +     +     + + include-controls + + +

    Identifies a subset of controls to import from the referenced catalog or profile by control identifier or match pattern.

    +     +     +     + + exclude-controls + + +

    Identifies which controls to exclude, or eliminate, from the set of included controls by control identifier or match pattern.

    +     +     +     + +

    A profile must be based on an existing OSCAL catalog or another OSCAL profile. An import indicates such a source whose controls are to be included (referenced and modified) in a profile. This source will either be a catalog whose controls are given (by value), or a profile with its own control imports.

    +

    The contents of the import element indicate which controls from the source will be included. Controls from the source catalog or profile may be either selected, using the include-all or include-controls directives, or de-selected (using an exclude-controls directive).

    +     + + + + + +     + + Merge controls + A Merge element merges controls in resolution. + + + + + + + + +

    The contents of the merge element may be used to reorder or restructure controls by indicating an order and/or structure in resolution.

    +

    Implicitly, a merge element is also a filter: controls that are included in a profile, but not included (implicitly or explicitly) in the scope of a merge element, will not be merged into (will be dropped) in the resulting resolution.

    +     +     + + Combination rule + A Combine element defines whether and how to combine multiple (competing) versions of the same control + + +

    Whenever combining controls from multiple (import) pathways, an issue arises of what to do with clashing invocations (multiple competing versions of a control).

    +

    This setting permits a profile designer to apply a rule for the resolution of such cases. In a well-designed profile, such collisions would ordinarily be avoided, but this setting can be useful for defining what to do when it occurs.

    +     +     + + As is + An As-is element indicates that the controls should be structured in resolution as they are structured in their source catalogs. It does not contain any elements or attributes. + + + Combination method + How clashing controls should be handled + + + Use the first definition - the first control with a given ID is used; subsequent ones are discarded + Merge - controls with the same ID are combined + Keep - controls with the same ID are kept, retaining the clash + + + + + Custom grouping + A Custom element frames a structure for embedding represented controls in resolution. + + + + + + + + + +

    The custom element represents a custom arrangement or organization of controls in the resolution of a catalog.

    +

    While the as-is element provides for a restitution of a control set's organization (in one or more source catalogs), this element permits the definition of an entirely different structure.

    +     +     + + Control group + A group of (selected) controls or of groups of controls + + + Group Identifier + A unique identifier for a specific group instance that can be used to reference the group within this and in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same group across minor revisions of the document. + + + Group Class + A textual label that provides a sub-type or characterization of the group. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +

    A class can also be used in an OSCAL profile as a means to target an alteration to control content.

    +     +     + + + Group Title + A name given to the group, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + + + + + +

    This construct mirrors the same construct that exists in an OSCAL catalog.

    +     +     + + Modify controls + Set parameters or amend controls in resolution + + + Parameter Setting + A parameter setting, to be propagated to points of insertion + + + + Parameter ID + Indicates the value of the 'id' flag on a target parameter; i.e. which parameter to set + + + Parameter Class + A textual label that provides a characterization of the parameter. + +

    A class can be used in validation rules to express extra constraints over named items of a specific class value.

    +     +     + + + + + + + + + + Parameter Label + A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned. + +

    The label value should be suitable for inline display in a rendered catalog.

    +     +     + + Parameter Usage Description + Describes the purpose and use of a parameter + + + constraint + + + + guideline + + + + + value + + +

    Used to (re)define a parameter value.

    +     +     + + select + +     +     + + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     +     +     + + + +     +     + + Select controls + Specifies which controls to use in the containing context. + + Order + A designation of how a selection of controls in a profile is to be ordered. + + + + + + + + + + + + + include-controls + + + + + exclude-controls + + +

    Identifies which controls to exclude, or eliminate, from the set of matching includes.

    +     +     +     + +

    To be schema-valid, this element must contain either (but not both) a single include-all directive, or a sequence of include-controls directives.

    +

    If this directive is not provided, then no controls are to be inserted; i.e., all controls are included explicitly.

    +     +     + + + Insert All + Insert all controls from the imported catalog or profile resources identified in the import directive. + +

    This element provides an alternative to calling controls individually from a catalog.

    +     +     + + Call + Call a control by its ID + + + + Match Controls by Identifier + + + + + Match Controls by Pattern + Select controls by (regular expression) match on ID + + + + + +

    If with-child-controls is yes on the call to a control, no sibling callelements need to be used to call any controls appearing within it. Since generally, this is how control enhancements are represented (as controls within controls), this provides a way to include controls with all their dependent controls (enhancements) without having to call them individually.

    +     +     + + Alteration + An Alter element specifies changes to be made to an included control when a profile is resolved. + + + + + + + + + + +

    Use @control-id to indicate the scope of alteration.

    +

    It is an error for two alter elements to apply to the same control. In practice, multiple alterations can be applied (together), but it creates confusion.

    +

    At present, no provision is made for altering many controls at once (for example, to systematically remove properties or add global properties); extending this element to match multiple control IDs could provide for this.

    +     +     + + Removal + Specifies objects to be removed from a control based on specific aspects of the object that must all match. + + Reference by (assigned) name + Identify items to remove by matching their assigned name + + + Reference by class + Identify items to remove by matching their class. + + + Reference by ID + Identify items to remove indicated by their id. + + + Item Name Reference + Identify items to remove by the name of the item's information element name, e.g. title or prop + + + Item Namespace Reference + Identify items to remove by the item's ns, which is the namespace associated with a part, or prop. + + +

    Use name-ref, class-ref, id-ref or generic-identifier to indicate class tokens or ID reference, or the formal name, of the component to be removed or erased from a control, when a catalog is resolved. The control affected is indicated by the pointer on the removal's parent (containing) alter element.

    +

    To change an element, use remove to remove the element, then add to add it back again with changes.

    +     +     + + Addition + Specifies contents to be added into controls, in resolution + + Position + Where to add the new content with respect to the targeted element (beside it or inside it) + + + Preceding the id-ref target + Following the id-ref target + Inside the control or id-ref target, at the start + Inside the control or id-ref target, at the end + + + + + Reference by ID + Target location of the addition. + + + + Title Change + A name given to the control, which may be used by a tool for display and navigation. + + + + + + + + + + + + + + + + + + + &allowed-values-control-group-property-name; + + + +

    When no id-ref is given, the addition is inserted into the control targeted by the alteration at the start or end as indicated by position. Only position values of "starting" or "ending" are permitted when there is no id-ref.

    +

    id-ref, when given, should indicate, by its ID, an element inside the control to serve as the anchor point for the addition. In this case, position value may be any of the permitted values.

    +     +     + + Include contained controls with control + When a control is included, whether its child (dependent) controls are also included. + + + Include child controls with an included control. + When importing a control, only include child controls that are also explicitly called. + + + + + Pattern + A glob expression matching the IDs of one or more controls to be selected. + +     diff --git a/test-suite/oscal/v1.0.0/oscal_ssp_metaschema.xml b/test-suite/oscal/v1.0.0/oscal_ssp_metaschema.xml new file mode 100644 index 000000000..acdb41896 --- /dev/null +++ b/test-suite/oscal/v1.0.0/oscal_ssp_metaschema.xml @@ -0,0 +1,1043 @@ + + + + + + + +]> + + OSCAL System Security Plan (SSP) Model + 1.0.0 + oscal-ssp + http://csrc.nist.gov/ns/oscal/1.0 + http://csrc.nist.gov/ns/oscal + +

    The OSCAL Control SSP format can be used to describe the information typically specified in a system security plan, such as those defined in NIST SP 800-18.

    +

    The root of the OSCAL System Security Plan (SSP) format is system-security-plan.

    +     + + + + + + + + + System Security Plan (SSP) + A system security plan, such as those described in NIST SP 800-18 + system-security-plan + + System Security Plan Universally Unique Identifier + A globally unique identifier for this catalog instance. This UUID should be changed when this document is revised. + + + + + + + + + + + + + + + + Import Profile + Used to import the OSCAL profile representing the system's control baseline. + + Profile Reference + A resolvable URL reference to the profile to use as the system's control baseline. + +

    The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter + resource in the same document.

    + +

    If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

    +

    If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

    +     +     + + + +     + + + + + + System Characteristics + Contains the characteristics of the system, such as its name, purpose, and security impact level. + + + + + + System Name - Full + The full name of the system. + + + System Name - Short + A short name for the system, such as an acronym, that is suitable for display in a data table or summary list. + + + System Description + A summary of the system. + + + + + + + + + + Security Sensitivity Level + The overall information system sensitivity categorization, such as defined by FIPS-199. + + +

    Often, organizations require the security sensitivity level to correspond with the highest confidentiality, integrity, or availability level identified by security-impact-level. +

    +     +     + + + + + + + + + + +     + + + A value of 1, 2, or 3 as defined by SP 800-63-3. + + A value of 1, 2, or 3 as defined by SP 800-63-3. + + A value of 1, 2, or 3 as defined by SP 800-63-3. + + + + As defined by SP 800-63-3. + + As defined by SP 800-63-3. + + As defined by SP 800-63-3. + + + + The associated value is one of: public-cloud, private-cloud, community-cloud, government-only-cloud, hybrid-cloud, or other. + The associated value is one of: saas, paas, iaas, or other. + + + The public cloud deployment model as defined by The NIST Definition of Cloud Computing. + + The private cloud deployment model as defined by The NIST Definition of Cloud Computing. + + The community cloud deployment model as defined by The NIST Definition of Cloud Computing. + + + TODO: define + Any other type of cloud deployment model that is exclusive to the other choices. + +

    The hybrid cloud deployment model, as defined by The NIST Definition of Cloud Computing, can be supported by selecting two or more of the existing deployment models.

    +     +     + + Software as a service (SaaS) cloud service model as defined by The NIST Definition of Cloud Computing. + + Platform as a service (PaaS) cloud service model as defined by The NIST Definition of Cloud Computing. + + Infrastructure as a service (IaaS) cloud service model as defined by The NIST Definition of Cloud Computing. + + Any other type of cloud service model that is exclusive to the other choices. + + + + +

    Since responsible-party associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + &allowed-values-responsible-roles-system; + +     +     + + System Information + Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. + + + + + + + + + + Information Type + Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. + + + + Information Type Universally Unique Identifier + A globally unique identifier that can be used to reference this information type entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + title field + A human readable name for the information type. This title should be meaningful within the context of the system. + + + Information Type Description + A summary of how this information type is used within the system. + + + + Information Type Categorization + A set of information type identifiers qualified by the given identification system used, such as NIST SP 800-60. + + + Information Type Identification System + Specifies the information type identification system used. + + + Based on the section identifiers in NIST Special Publication 800-60 Volume II Revision 1. + + + + + + + + Information Type Systematized Identifier + An identifier qualified by the given identification system used, such as NIST SP 800-60. + id + + + + + + + + + + + + Confidentiality Impact Level + The expected level of impact resulting from the unauthorized disclosure of the described information. + + + + + + + + + + + + + + Integrity Impact Level + The expected level of impact resulting from the unauthorized modification of the described information. + + + + + + + + + + + + + + Availability Impact Level + The expected level of impact resulting from the disruption of access to or use of the described information or the information system. + + + + + + + + + + + + + + + + + + Is this a privacy sensitive system? yes or no + + + The system is privacy sensitive. + The system isnot privacy sensitive. + + + A link to the privacy impact assessment. + + + + + + + + A 'low' sensitivity level as defined in FIPS-199. + + A 'moderate' sensitivity level as defined in FIPS-199. + + A 'high' sensitivity level as defined in FIPS-199. + + +

    FIPS-199 taxonomy is provided here as a starting point. We will provide other taxonomies based on community requests.

    +     +     +     +     + + Base Level (Confidentiality, Integrity, or Availability) + The prescribed base (Confidentiality, Integrity, or Availability) security impact level. + + + Selected Level (Confidentiality, Integrity, or Availability) + The selected (Confidentiality, Integrity, or Availability) security impact level. + + + Adjustment Justification + If the selected security level is different from the base security level, this contains the justification for the change. + + + Security Impact Level + The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information. + + + + Security Objective: Confidentiality + A target-level of confidentiality for the system, based on the sensitivity of information within the system. + + + + Security Objective: Integrity + A target-level of integrity for the system, based on the sensitivity of information within the system. + + + + Security Objective: Availability + A target-level of availability for the system, based on the sensitivity of information within the system. + + + + + Status + Describes the operational status of the system. + + State + The current operating status. + + + The system is currently operating in production. + The system is being designed, developed, or implemented + The system is undergoing a major change, development, or transition. + The system is no longer operational. + Some other state. + + + + + + + +

    If 'other' is selected, a remark must be included to describe the current state.

    +     +     + + System Authorization Date + The date the system received its authorization. + + + Authorization Boundary + A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary. + + + Authorization Boundary Description + A summary of the system's authorization boundary. + + + + + + + + + + + +

    A visual depiction of the system's authorization boundary.

    +     +     + + remarks field + Commentary about the system's authorization boundary that enhances the diagram. + +     + + + + +

    A given uuid must be assigned only once to a diagram.

    +     +     +     +     + + Diagram + A graphic that provides a visual representation the system, or some aspect of it. + + Diagram ID + The identifier for this diagram. + + + + Diagram Description + A summary of the diagram. + +

    This description is intended to be used as alternate text to support compliance with requirements from Section 508 of the United States Workforce Rehabilitation Act of 1973. +

    +     +     + + + + + + + + Caption + A brief caption to annotate the diagram. + + + remarks field + Commentary about the diagram that enhances it. + +     + + + A reference to the diagram image. + + + + + + + + +

    A diagram must include a link with a rel value of "diagram", who's href references a remote URI or an internal reference within this document containing the diagram.

    +     + + +

    The internal reference "#diagram1" points to an attached resource defined in the back-matter as a resource. The media-type indicates that the image is a Portable Network Graphics (PNG) image.

    +     + + A boundary diagram. + + +     +     + + Network Architecture + A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture. + + + Network Architecture Description + A summary of the system's network architecture. + + + + + + + + + + + + + + + + + +

    A given uuid must be assigned only once to a diagram.

    +     +     +     + +     + + Data Flow + A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows. + + + Data Flow Description + A summary of the system's data flow. + + + + + + + + + + + + + + + + + +

    A given uuid must be assigned only once to a diagram.

    +     +     +     +     + + + + + + System Implementation + Provides information as to how the system is implemented. + + + + + + + + + + Leveraged Authorization + A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider. + + + + Leveraged Authorization Universally Unique Identifier + A globally unique identifier that can be used to reference this leveraged authorization entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + title field + A human readable name for the leveraged authorization in the context of the system. + + + + + + + + + party-uuid field + A reference to the party that manages the leveraged system. + + + + + + + A reference to the system security plan for the leveraged authorization. + + + + + + + + + + + user + + + + component + + + + + + +

    A set of inventory-item entries that represent the managed inventory instances of the system.

    +     +     + +     + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The component allows an authenticated scan. + The component does not allow an authenticated scan. + + + + + + + +

    A given uuid must be assigned only once to a user.

    +     +     +     +     + + + Control Implementation + Describes how the system satisfies a set of controls. + + + Control Implementation Description + A statement describing important things to know about how this set of control satisfaction documentation is approached. + + + + + + + + + + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     +     + +

    Use of set-parameter in this context, sets the parameter for all related controls referenced in an implemented-requirement. If the same parameter is also set in a specific implemented-requirement, then the new value will override this value.

    +     +     + + Control-based Requirement + Describes how the system satisfies an individual control. + + Control Requirement Universally Unique Identifier + A globally unique identifier that can be used to reference this control requirement entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + + + + + + + + + + + + + + + + + + + + + + + + Identifies the source of the implemented control. + + + The control is implemented by the organization owning the system, but is not specific to the system itself. + The control is implemented specifically to this system. + The control is provided by the system, but must be configured by the customer. + The control must be implemented by the customer. + This control is inherited from an underlying system. + + + Indicates all or some portion of this control is inherited from an underlying authorized system. + + + &allowed-values-responsible-roles-operations; + + + + + + + + + +

    Since all implementation statements are defined at the by-component level (e.g., type=this-system), there must be at least one by-component.

    +     +     + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + + +

    Since statement entries can be referenced using the statement's statement-id, each statement must be referenced only once.

    +     +     + + + +

    Since by-component can reference component entries using the component's uuid, each component must be referenced only once. This ensures that all implementation statements are contained in the same by-component entry.

    +     +     +     +     + + Specific Control Statement + Identifies which statements within a control are addressed. + + +

    A reference to the specific implemented statement associated with a control.

    +     +     + + Control Statement Reference Universally Unique Identifier + A globally unique identifier that can be used to reference this control statement entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + + + + + + + + + + + + + + + &allowed-values-responsible-roles-operations; + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     + + + +

    Since by-component can reference component entries using the component's uuid, each component must be referenced only once. This ensures that all implementation statements are contained in the same by-component entry.

    +     +     + +     +     + + + Component Control Implementation + Defines how the referenced component implements a set of controls. + + Component Universally Unique Identifier Reference + A reference to the component that is implementing a given control or control statement. + + + By-Component Universally Unique Identifier + A globally unique identifier that can be used to reference this by-component entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + Control Implementation Description + An implementation statement that describes how a control or a control statement is implemented within the referenced system component. + + + + + + + + + + + + +

    The implementation-status is used to qualify the status value to indicate the degree to which the control is implemented.

    +     +     + + Export + Identifies content intended for external consumption, such as with leveraged organizations. + + + Control Implementation Export Description + An implementation statement that describes the aspects of the control or control statement implementation that can be available to another system leveraging this system. + + + + + + + + + + Provided Control Implementation + Describes a capability which may be inherited by a leveraging system. + + + + Provided Universally Unique Identifier + A globally unique identifier that can be used to reference this provided entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + Provided Control Implementation Description + An implementation statement that describes the aspects of the control or control statement implementation that can be provided to another system leveraging this system. + + + + + + + + + + + + + + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + Control Implementation Responsibility + Describes a control implementation responsibility imposed on a leveraging system. + + + Responsibility Universally Unique Identifier + A globally unique identifier that can be used to reference this responsibility entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + Control Implementation Responsibility Description + An implementation statement that describes the aspects of the control or control statement implementation that a leveraging system must implement to satisfy the control provided by a leveraged system. + + + + + + + + + + + +

    A role defined at the by-component level takes precedence over the same role defined on the parent implemented-requirement or on the referenced component.

    +     +     + +     + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + +     + + + + + + + + + +     + + Inherited Control Implementation + Describes a control implementation inherited by a leveraging system. + + + + Inherited Universally Unique Identifier + A globally unique identifier that can be used to reference this inherited entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + Inherited Control Implementation Description + An implementation statement that describes the aspects of a control or control statement implementation that a leveraging system is inheriting from a leveraged system. + + + + + + + + + + + + + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + Satisfied Control Implementation Responsibility + Describes how this system satisfies a responsibility imposed by a leveraged system. + + + + Satisfied Universally Unique Identifier + A globally unique identifier that can be used to reference this satisfied entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. + + + + + Satisfied Control Implementation Responsibility Description + An implementation statement that describes the aspects of a control or control statement implementation that a leveraging system is implementing based on a requirement from a leveraged system. + + + + + + + + + + + + + + + + + +

    Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.

    +     +     +     +     + + + + + +     + + + &allowed-values-responsible-roles-operations; + &allowed-values-responsible-roles-component-production; + + + + +

    Since multiple set-parameter entries can be provided, each parameter must be set only once.

    +     +     +     +     + + + Provided UUID + Identifies a 'provided' assembly associated with this assembly. + + + + Provided UUID + Identifies a 'provided' assembly associated with this assembly. + +     diff --git a/test-suite/oscal/v1.0.0/readme.md b/test-suite/oscal/v1.0.0/readme.md new file mode 100644 index 000000000..d0437c1db --- /dev/null +++ b/test-suite/oscal/v1.0.0/readme.md @@ -0,0 +1,79 @@ +# OSCAL Metaschema + +An OSCAL Metaschema defines the the information structures that define an OSCAL model in a format-neutral form. Documentation about the meaning (semantics) and use of a given metaschema structure is provided on the Metaschema [website]. + +OSCAL Metaschemas are used to generate other OSCAL artifacts based on the metaschema description. These artifacts include: + +- XML and JSON Schemas, or *data models*, are derived from the metaschema, expressed as XSD and JSON Schema; +- Conversion scripts that can convert OSCAL content between the XML and JSON OSCAL formats, ensuring the resulting content is schema valid; +- XML and JSON [model documentation](https://pages.nist.gov/OSCAL/docs/schemas/) for use on the [OSCAL website](https://pages.nist.gov/OSCAL). + +Use of Metaschemas in OSCAL allow us to maintain seamless and consistent support for multiple OSCAL model formats, including XML and JSON. Content can also be kept up-to-date in multiple formats using generated content converters, and can be validated using generated schema. Adding support for new formats (e.g., YAML) can accomplished by extending the Metaschema tooling to produce schema and converters for other formats. + +The Metaschema syntax (an XML application) is also described and constrained with its [own schema](https://github.com/usnistgov/metaschema/blob/master/toolchains/xslt-M4/validate/metaschema.xsd), and with a [Schematron constraints set](https://github.com/usnistgov/metaschema/blob/master/toolchains/xslt-M4/validate/metaschema-check.sch). The latter is able to enforce some of the rules described below. + +#### Enumerated values + +Additionally, flags may be constrained to a set of known values listed in advance. + +This restriction can be either strict (values must be in the list for document validity) or loose (i.e. for documentation only, no effect in schemas). + +Use the `valid-values` element to restrict the permissible values for a flag. Set its attribute `allow-other='yes'` if the list is not exclusive. + +Within it `valid-values`, a `value` element's `@name` attribute assigns the permissible value, while its data content provides documentation. For example: + +```xml + + Hash algorithm + Method by which a hash is derived + + + + + + + ... +``` +## Metaschema modeling + +In the case of field and flag objects, the modeling constraints to be imposed by the result schemas (either XSD or JSON Schema) over the data set, can be determined on the basis of how they are described. Assembly definitions, however, permit not only flags to be assigned to assemblies of the defined type; additionally, they contain a `model` element for a *mode declaration*. This declaration names the subcomponents to be permitted (in documents valid to the target schemas) within any assembly of the type being defined. + +Five elements are used within `model` to define permissible contents of assemblies (elements or objects) being defined. Each of these represents a different object type. Flags are not assigned via `model` but directly in the definition; for the model, we can choose either singles or plurals of named fields or assemblies (i.e., a binary choice between cardinality constraints to be applied). This gives us four choices; additionally, we have the opportunity to use an element `prose`, once inside any assembly's model. + +Among these elements, no single `@named` attribute value (which refers a model component to its definition) may be used more than once. Additionally, no `@group-as` (on a `fields` or `assemblies`) may be reused or be the same as any `@named`. The `prose` element may be used only once. Finally, no value of `@named` or `@group-as` must be the same as a recognized name of an element directly within prose, namely (at present) `p`, `ul`, `ol`, and `pre`. + +With these limitations, a model may be defined to contain any mix of fields and assemblies. + +* `field` refers to a field definition and permits a single occurrence of the indicated field +* `field/@required='yes'` a field component is to be required in a model by any schema based on the metaschema +* `assembly` refers to an assembly definition and permits a single occurrence of the indicated assembly. +* `fields` - same as `field`, but permits the field to be repeated. In the JSON representation the multiple values are represented as any array unless `@address` is given +* `assemblies` - same as `fields`, but for assemblies. In JSON, this construct is also presented as an array unless there is an `@address` +* `prose` refers to a "region of prose", that is, a section of prose text of unspecified length. In XML, prose is represented in conventional fashion as (a sequence of) `

    ` and list elements (`