Discuss inclusion of xmldsig-core-schema.xsd in OVAL Community Github repository

[vanderpol]

@OVAL-Community/oval-board-members

Is this file intentionally in our repository? As the OVAL community did not create, nor update this file I'm wondering if this was an accidental inclusion?

https://github.com/OVAL-Community/OVAL/blob/master/oval-schemas/xmldsig-core-schema.xsd

We likely should discuss XMLDSig signing of XML content and results as well. Where should this be documented, and what version of XMLDSig does OVAL support/mandate?

[vanderpol]

In our call today, I'm not sure we reached a point of consensus on this, and after the call I did search through the OVAL xsd files and see why it's included.

<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-common-5" schemaLocation="oval-common-schema.xsd"/>
<xsd:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
xsd:annotation

I guess our best bet is just to update it to current.

[vanderpol]

And to make the xmldsig version stuff even more confusing... the version in the OVAL repository is from 2005, but somehow the current version online is from 2002 and it identical (minus commit version) from what we have in our repository. So in short, we do nothing and it's fine. Sorry for the confusion.

If you are bored try to find the current version of xmldsig and it's related schema online, it's a mess. There are references to 1.1, 1.2 and 2.0 but 1.1 is still 'current'