OpenSCAP issues with test_ref= unk

[wagner-robert]

All,
There are several places in the OVAL file that have something like

<criteria operator="OR">
  <criterion comment="Rocky Linux 8 must be installed"
     test_ref="oval:org.rockylinux.rlsa:tst:unk"/>
  </criteria>

OpenSCAP error:
File ... line 458: Element ....criterion attribute 'test_ref': [facet 'pattern'] The value 'oval:org.rockylinux.rlsa:test:unk' is not accepted by the pattern 'oval:[A-Za-z0-9_-.]+:tst:[1-9][0-9]*'

This occurs many times.

I don't see that string in apollo: https://apollo.build.resf.org/v2/advisories?filters.type=TYPE_SECURITY&filters.includeRpms=true

Any ideas where it comes from?

[wagner-robert]

Ok, Looking at two different OVAL files -
oval.py 8 > rocky-linux-8-.oval
and
oval.py 9 > rocky-linux-9-.oval

It seems that anytime the oval.py runs for 8 and it sees a reference to "Rocky Linux 9 must be installed" it flags it as "unk". The opposite is true for 9 - any reference to "Rocky Linux 8 must be installed" also gets flagged as "unk"

The RL8 has the correct test_ref:

    <criterion comment="Rocky Linux 8 must be installed"
      test_ref="oval:org.rockylinux.rlsa:tst:20247868002"/>

The RL9 file has:

    <criterion comment="Rocky Linux 9 must be installed"
      test_ref="oval:org.rockylinux.rlsa:tst:20250426002"/>

[wagner-robert]

Going to the documents page for Apollo: https://apollo.build.resf.org/docs#/v2_compat/list_advisories_compat_v2_v2_advisories_get their sample code seems to run just fine:

curl -X 'GET' \
  'https://apollo.build.resf.org/v2/advisories?filters.product=Rocky%20Linux%209&filters.type=TYPE_SECURITY&filters.fetchRelated=true&page=1&limit=100' \
  -H 'accept: application/json'

It does pull down both RL 8 and RL 9 stuff . RLSA-2024:8117 is an example with both

Not sure if this is a problem with apollo sending RL8 or the program needs to handle RL8 stuff better when pulling RL9 down.

You can test various GET commands from the docs website.

[NeilHanlon]

Hi @wagner-robert -- thank you for this, and for your advocacy on the issue. I wanted to share that a request for comments has been posted regarding wants and needs for fixing/updating the errata system. I invite you to check out the thread and provide feedback https://forums.rockylinux.org/t/apollo-errata-you-a-ciq-ospo-request-for-comment/18102

Regarding this issue, I will try and take a look but can't promise much at this time.

Thanks!