Identify tool or process for document schema validation

[brandtkeller]

Knowing early what is or is-not valid OSCAL schema will be important for extending the OSCAL component files.

Provide documentation or automation for validating OSCAL schema.

[brandtkeller]

Moving to post-POC for DD objectives

[brandtkeller]

Currently no validation around the oscal files being ingested. Implementation might look like a separate command that is utilized to help document developers target problems (line/object etc) and resolve them.

[brandtkeller]

https://github.com/GoComply/oscalkit does provide this validation logic. The validation looks to occur by supplying a schema to validate a given document against.

Investigation needs to happen around how we might handle multiple versions of documents being used with a single version of the tool and what schemas we have within the compiled binary.

[brandtkeller]

Clarifying context around this issue should be separated into two categories:

• Lula needs to test (Likely E2E) that any expectations for input AND reports generated for output are valid to the OSCAL schema
• How Lula will respond to invalid oscal. Error handling should be first priority - helper commands secondary as there are existing schema validation tools available.

[CloudBeard]

Tested OSCAL-CLI github action. Seems to be solid.

Pros:
OSCAL-CLI is maintained by NIST.
OSCAL-CLI-Action is maintained by OSCAL Club.
Can be used to validate and convert each part of OSCAL

Cons:
TBD

[xee5ch]

The GitHub Action, oscal-cli-action, is maintained by the OSCAL Club community not NIST, but the core CLI is from NIST though. Let us know how we can help (I am the maintainer of that action).

[CloudBeard]

@xee5ch thanks for the call out, I updated my Pros/Cons to reflect that! Still in the early phases of testing but everything seems to be straight forward. Thanks for the hard work on it!

[xee5ch]

No worries, thanks for testing it, we have not got much feedback on it yet. You did remind me to release the updated copy defaulting to v1.0.2 of the CLI out of the oven, so hopefully it keeps delivering value. :-)

[CloudBeard]

Found issue with OSCAL-CLI validation command not being able to find json schema file: usnistgov/oscal-cli#200

Fix should be in next release.

[mike-winberry]

defenseunicorns/go-oscal#50

[brandtkeller]

document schema validation implemented in #136