OpenSCAP for SCAP 1.2 document validation and policy scanning

OpenSCAP's SCAP 1.2 problem and command-line scope

OpenSCAP addresses the operational problem of handling Security Content Automation Protocol content outside a graphical policy tool. Its `oscap` program can load, scan, validate, edit, and export SCAP documents. The repository identifies it as an NIST Certified SCAP 1.2 toolkit, while the README lists use cases involving XCCDF, OVAL, OCIL, CPE, and source data streams.

The intended user is an engineer or administrator who already has SCAP XML content and needs explicit command-line control over validation and evaluation. A compliance author can validate a data stream before relying on it. A scanning administrator can evaluate OVAL definitions or a selected XCCDF profile and save the result as XML. A report consumer can transform an existing XCCDF result document into a generated report.

This is document and policy tooling, not a general-purpose host scanner with a broad catalog of unrelated checks. The content being evaluated comes from an OVAL definition, XCCDF benchmark, profile, or data stream. OpenSCAP provides the SCAP processing layer around that content. The README does not claim that the toolkit creates policy definitions or automatically determines compliance without an XCCDF benchmark and supporting inputs.

OpenSCAP data-stream validation across SCAP components

The validation path is the clearest example of OpenSCAP's document-oriented design. The README specifies `oscap ds sds-validate` for validating a source data stream and states that all components within it are validated, including XCCDF, OVAL, OCIL, CPE, and possibly other components.

The documented input is a file named `scap-ds.xml`. The command treats that file as a SCAP data stream rather than as a single benchmark or definition document. This distinction matters when content is packaged as a collection. A problem in one component can therefore be considered as part of validating the stream, instead of requiring separate commands for every referenced component.

The README does not document a repair operation for failed validation. It also does not promise automatic correction of malformed SCAP XML. Users who need to change content should use the document-editing capability exposed by `oscap`, but the README does not give a complete editing example. A failed validation should therefore be treated as a signal to inspect the reported component and its references, not as an automatic rollback mechanism.

Because the command validates a stream as a collection, the naming and references between components matter. The repository includes a `schemas/` directory, but the README does not say that `oscap ds sds-validate` should be run against every file in that directory. The documented workflow starts with the actual SCAP data stream used by the evaluation.

OpenSCAP OVAL evaluation through files and data streams

OpenSCAP can evaluate all definitions in a standalone OVAL Definition file. The documented command takes the definition file as input and writes an OVAL Result file:

oscap oval eval --results oval-results.xml scap-oval.xml

Here, `scap-oval.xml` is the OVAL Definition file and `oval-results.xml` is the result document. This is the direct route when the OVAL content is isolated from a larger SCAP collection.

The same evaluator also supports an OVAL component inside a SCAP data stream collection. The README gives this form:

oscap oval eval --datastream-id ds.xml --oval-id xccdf.xml --results oval-results.xml scap-ds.xml

In this form, `scap-ds.xml` represents the collection, `ds.xml` identifies the data stream, and `xccdf.xml` is an OVAL component identifier supplied through `--oval-id`. The identifier's name is potentially confusing because it uses an XML-like file name, but the command and its role are explicitly documented.

The distinction matters for automation. A standalone evaluation avoids data-stream selection. The collection form requires correct stream and component identifiers, so a typo or mismatched reference can prevent the intended definitions from being evaluated. The README does not describe an interactive selection mode or explain recovery when a selected identifier does not resolve. For repeatable scans, the stream ID, OVAL ID, input collection, and result path should be recorded together.

OpenSCAP XCCDF profile and benchmark evaluation

For XCCDF, OpenSCAP can evaluate either a profile from an individual file or a benchmark inside a data stream. The profile example uses `--profile`, `--results`, and `--cpe`:

oscap xccdf eval --profile Desktop --results xccdf-results.xml --cpe cpe-dictionary.xml scap-xccdf.xml

The selected profile is `Desktop`. The CPE dictionary is supplied separately, and the output is written to `xccdf-results.xml`. This is useful when the benchmark's applicability logic depends on CPE information. The README does not say whether the CPE dictionary is optional in other invocations, so it should be included when the XCCDF input requires platform applicability.

A data-stream benchmark uses two identifiers:

oscap xccdf eval --datastream-id ds.xml --xccdf-id xccdf.xml --results xccdf-results.xml scap-ds.xml

Here, `--xccdf-id` takes the ID of a `component-ref` pointing to the desired XCCDF document. That is a narrower requirement than supplying only a file name. The selected data stream and component reference must agree with the structure of `scap-ds.xml`.

OpenSCAP separates the XCCDF document, profile selection, CPE input, and result output. That gives the caller control over what is evaluated, but it also means that identifiers and filenames must match the structure of the SCAP content. The README does not document a mechanism for merging several result files, scheduling recurring evaluations, or interpreting pass and fail counts beyond generating report output.

OpenSCAP document generation and report output

OpenSCAP can generate an XCCDF guide either without rules or with a selected profile. The documented commands are:

oscap xccdf generate guide XCCDF-FILE > XCCDF-GUIDE-FILE

oscap xccdf generate guide --profile PROFILE XCCDF-FILE > XCCDF-GUIDE-FILE

The first form generates a guide from the XCCDF file. The second selects a profile, which tells the command which profile-related content to use. The exact appearance and contents of the generated guide are not described in the README.

A report can be generated from an existing XCCDF result file:

oscap xccdf generate report XCCDF-RESULT-FILE > XCCDF-REPORT-FILE

The report is written to standard output and redirected by the shell. This makes the generation step composable with file-oriented pipelines, but the README does not document report themes, formatting options, localization options, or a machine-readable report format. The result remains an XML artifact and a generated report derived from it.

These commands are useful when a team needs repeatable document transformations. They do not prove that a system complies with a policy. Compliance interpretation depends on the XCCDF benchmark, profile, evaluation inputs, and the organization using the result. OpenSCAP's documented role is to load, evaluate, and generate artifacts from the specified content.

OpenSCAP installation and a first practical use

The README links to the OpenSCAP Developer Manual for compilation, testing, and debugging, but it does not provide a complete installation command. It does not give a package-manager command, dependency list, or release-specific installation procedure. For that reason, there is no verified one-line installation example to reproduce here.

The first practical use, once `oscap` is available, can begin with data-stream validation. The README's example uses an existing file named `scap-ds.xml`:

oscap ds sds-validate scap-ds.xml

The command is intended to validate all components contained in the stream, including XCCDF, OVAL, OCIL, and CPE. The README does not specify a success message, exit-code table, or a particular validation output file. A caller should therefore check the command status and retain the input and diagnostic output in the surrounding workflow.

For an OVAL-only file, the corresponding evaluation is:

oscap oval eval --results oval-results.xml scap-oval.xml

The repository contains build-related files including `CMakeLists.txt`, `Dockerfiles/`, and `openscap.spec`, but the README does not connect those files to a universal installation command. The Developer Manual is the documented place for compilation, testing, and debugging requirements.

OpenSCAP limitations and the wrong-tool boundary

OpenSCAP is not appropriate when official Microsoft Windows support is a requirement. The README states that Microsoft Windows support is officially void as of February 1, 2022. That is a direct project boundary, not an inference about the SCAP formats.

OpenSCAP also does not replace the policy author. A malformed profile, an unavailable OVAL definition, or an unsuitable CPE dictionary remains an input problem. The README does not claim automatic remediation, result rollback, scheduler integration, or deployment orchestration. Its documented scope is command-line document handling, validation, evaluation, and generation.

A generic XML editor may be the better choice when the task is limited to reading or manually changing one document without SCAP-specific evaluation. A dedicated SCAP processor is more relevant when the task requires selecting XCCDF or OVAL components, writing OVAL or XCCDF result files, or generating a report tied to a profile.

For a team with no benchmark, OVAL definitions, CPE dictionary, or data stream, OpenSCAP is the wrong starting point. The commands operate on SCAP content and cannot create the policy content required for a meaningful evaluation based on the documentation.

OpenSCAP maintenance, licensing, and upgrade cost

The repository is not archived, and its last push was on 2026-10-13. The recent release list includes version 1.3.15 on 2026-10-13, version 1.4.5 on 2026-10-13, and version 1.4.4 on 2026-04-09. These facts show recent repository activity, but the README does not provide release notes describing compatibility changes, migration steps, or support windows for individual releases.

The project is licensed under LGPL-2.1. The repository includes `COPYING` and `lgpl-2.1.rtf`. The licensing terms may affect how an organization distributes modified or linked components, but this article does not interpret those terms. An organization should read the license files for its own distribution model.

The README does not document upgrade effort. Because the repository includes native source, tests, schemas, CMake files, packaging material, and documentation, an upgrade should not be assumed to be a single executable replacement. The Developer Manual covers compilation, testing, and debugging, while the release-specific compatibility impact must be checked against the selected release.

The project is therefore a viable candidate for organizations with an existing SCAP pipeline, but the operational cost depends on maintaining the content, identifiers, build dependencies, and XML result workflow around `oscap`.

OpenSCAP compared with generic XML processing

A simple XML editor or general-purpose validator may be enough when the task is limited to reading or manually correcting one document. OpenSCAP is more directly aligned with SCAP data-stream validation and policy evaluation because its commands select SCAP, OVAL, and XCCDF components explicitly. It also produces OVAL and XCCDF result artifacts and can generate a guide or report from those documents.

The difference is one of semantics and output. A generic XML tool can inspect well-formedness, but it does not provide the documented `oscap ds sds-validate`, `oscap oval eval`, or `oscap xccdf eval` workflows. Conversely, OpenSCAP adds SCAP-specific document selection and result handling, so users who only need text editing may carry more setup and input-discipline cost than necessary.

For a team already consuming SCAP 1.2 content, that distinction is meaningful. For a team without a benchmark, OVAL definitions, CPE dictionary, or data stream, the project is the wrong starting point because it evaluates content rather than inventing compliance checks.

The practical adoption test is whether the organization can name its XCCDF document, profile, data stream, OVAL definition, or CPE dictionary and can define where the OVAL and XCCDF result files will be written. OpenSCAP's documented commands become useful when those inputs and outputs already exist.

Editorial conclusion

OpenSCAP suits engineers and system administrators who already work with SCAP content and need command-line validation, evaluation, or report generation. It is a poor fit when official Microsoft Windows support is required, which the README says has been void since February 1, 2022. Before adoption, verify that the required SCAP components, profiles, OVAL definitions, and result formats match the inputs used by the target system.

Frequently asked questions

Official sources

1. License: LGPL-2.1
2. OpenSCAP/openscap on GitHub
3. Project website
4. README
5. Releases