COMPLYCTL-...ER-OPENSCAP(1)

💖 NAME 💖

complyctl-provider-openscap — the OpenSCAP scanning provider for complyctl, bestie 💅

(yes this is a <rainbow>General Commands Manual</rainbow> page, welcome, get comfy 🫶)

---

🌸 SYNOPSIS 🌸

complyctl-provider-openscap

that's it. that's the whole vibe. no flags, no args, nothing. iconic honestly ✨

---

💫 DESCRIPTION 💫

Okay so complyctl-provider-openscap is a gRPC plugin for complyctl(1) that brings compliance scanning capabilities to the party using the OpenSCAP engine 🔥 It is not invoked directly by users — no cap, you literally don't call this yourself. complyctl discovers it and launches it automatically once the provider is installed. Main character behavior, it just shows up when it's needed 💁♀️

Here's the tea on what the provider actually does: it receives assessment configurations from complyctl, generates XCCDF tailoring files that match the requested profiles, executes scans via the oscap command-line tool, and returns structured results. It also supports automatic datastream selection via CPE-based matching against the host system 🦋

Communication with complyctl uses the hashicorp/go-plugin gRPC interface, implementing three RPCs: Describe, Generate, and Scan. Three icons, one plugin 👑

---

🎀 CONFIGURATION 🎀

Configuration is provided through variables defined in assessment plan targets. These variables are passed to the provider via complyctl and are not set manually by the user. So like… hands off, it's handled 🙈

• profile (required) — the XCCDF profile ID to evaluate. Must match the pattern [a-zA-Z0-9-_.]+. Examples: cis_server_l1, xccdf_org.ssgproject.content_profile_cis. Slay 💅
• datastream (optional) — absolute path to an SSG XCCDF datastream XML file. When you omit it, the provider auto-detects the appropriate datastream by matching the system's CPE (from the os-release file) against CPE metadata embedded in the SSG datastream files. It's giving ✨psychic✨ but it's actually just metadata matching.

---

🌈 ENVIRONMENT 🌈

• SSG_CONTENT_DIR — the directory containing SSG datastream XML files. Used during auto-detection when datastream is not specified. Default: /usr/share/xml/scap/ssg/content
• OS_RELEASE_FILE — path to the os-release file used for CPE extraction during datastream auto-detection. Default: /etc/os-release
• COMPLYTIME_MACHINE_ID_FILE — path to the machine-id file used for host identification in evidence remarks. The file content is included in each Evidence.Source.Remarks field alongside the hostname so auditors can identify the host where the scan was executed. Default: /etc/machine-id

---

🧚 EXTERNAL TOOLS 🧚

Requires oscap (provided by the openscap-scanner package) at runtime. The provider locates oscap via PATH lookup. 🔍

The scap-security-guide package provides the SSG datastream files used for evaluation. Yes you need both, no you cannot skip one 🫶

---

💜 FILES 💜

• .complytime/openscap/ — the provider workspace directory. All paths below are relative to the current working directory. (iykyk 📁)
• .complytime/openscap/policy/tailoring.xml — XCCDF tailoring file generated by the Generate RPC. Contains the selected profile rules matched from the assessment configuration.
• .complytime/openscap/results/arf.xml — Asset Reporting Format (ARF) result file produced by oscap xccdf eval --results-arf during the Scan RPC.
• .complytime/openscap/results/results.xml — XCCDF results XML file produced alongside the ARF file by oscap xccdf eval --results.
• .complytime/openscap/remediations/remediation-script.sh — Bash remediation script generated by oscap xccdf generate fix during the Generate RPC.
• .complytime/openscap/remediations/remediation-playbook.yml — Ansible remediation playbook generated by oscap xccdf generate fix.
• .complytime/openscap/remediations/remediation-blueprint.toml — Blueprint remediation file generated by oscap xccdf generate fix.

Three different fix formats, all from the same command? That's range, honestly 🎯

---

🦋 EVIDENCE 🦋

The provider records an Evidence entry on each AssessmentLog returned by the Scan RPC. Receipts 📸

• Type — ARF — Asset Reporting Format. The ARF file aggregates XCCDF results, OVAL definitions, and system characteristics into a single SCAP-standard artifact. It's giving "everything in one bag" and we love that for us 👜
• Production — the ARF file is produced by running oscap xccdf eval --results-arf against the tailoring file and the SSG datastream. It is written to .complytime/openscap/results/arf.xml.
• EvaluationLog representation — each assessment log carries an Evidence entry with:
  • Source.Coordinate: workspace-relative path to the ARF file (e.g., .complytime/openscap/results/arf.xml)
  • Source.Digest: sha256:<hex> digest of the ARF file
  • Source.ReferenceID: openscap-arf

---

💀 EXIT CODES 💀

This provider is a gRPC subprocess managed by complyctl. Exit codes follow the hashicorp/go-plugin protocol and are not user-facing. So like… not your problem, not your business, the protocol handles it 🫡

---

⭐ SEE ALSO ⭐

complyctl(1), complyctl-provider-ampel(1), complyctl-provider-opa(1), oscap(8)

Project: https://github.com/complytime/complytime-providers — go say hi, the repo is right there 🔗

---

👑 COPYRIGHT 👑

Apache-2.0 — permissive and generous, as always 🌈

---

🍓 AUTHORS 🍓

Marcus Burghardt maburgha@redhat.com — thank you for your service, legend 💐

---

okay bestie that's the whole page 💖 this was the ComplyTime Manual, September 2026 edition, and yes it's COMPLYCTL-...ER-OPENSCAP(1) (we keep the name abbreviated because it's mysterious and we respect that) 🎀 now go run complyctl and let the plugin do its thing, you got this fr fr ✨🫶