{
  "component-definition": {
    "uuid": "244ed2fb-e310-475a-b5b4-c002ba572f53",
    "metadata": {
      "title": "Debian 13 ISM Dictionary Checking Component Definition",
      "last-modified": "2026-09-16T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "responsible-parties": [
        {
          "role-id": "system-administrator",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        },
        {
          "role-id": "system-security-officer",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        }
      ],
      "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.",
      "document-ids": [
        {
          "scheme": "https://ns.oscalops.net/component-definitions",
          "identifier": "debian-13-pwquality-dictionary"
        }
      ],
      "props": [
        {
          "name": "assurance-state",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "technically-tested"
        },
        {
          "name": "assurance-authority",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none; self-asserted by the contributing author"
        },
        {
          "name": "endorsement",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none"
        },
        {
          "name": "publisher",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "library_component-definition contributors"
        },
        {
          "name": "publication-status",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "unpublished"
        },
        {
          "name": "artifact-slug",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "debian-13-pwquality-dictionary"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-dictionary/1.0.0/component-definition.json",
          "rel": "canonical",
          "text": "Reserved canonical URL; the registry is not yet published"
        }
      ]
    },
    "components": [
      {
        "uuid": "0a283933-bb57-4cb8-b6c4-064280d959cd",
        "type": "software",
        "title": "Debian 13 ISM Dictionary Checking",
        "description": "ism-2078 requires that commonly used or compromised passwords are not used. dictcheck evaluates every candidate against the cracklib dictionary from cracklib-runtime, and badwords adds organisation-specific terms.\n\nPartially implemented, and measured rather than assumed: the stock cracklib dictionary is a common-word corpus, not a breach-credential corpus. Depends on debian-13-pwquality-base.",
        "purpose": "Reject commonly used passwords and organisation-specific terms on local Debian accounts.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:dictcheck"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:badwords"
          }
        ],
        "links": [
          {
            "href": "#c6aaa027-2fa1-4d12-a806-c29641030292",
            "rel": "depends-on",
            "text": "pam_pwquality must be installed and enforcing"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "8fda2aa1-ff06-4440-a73f-cc2ee3a321d9",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "The ISM prohibition on commonly used and compromised passwords, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "0af07420-e3c0-44a9-a0df-df1b3b3ce878",
                "control-id": "ism-2078",
                "description": "Partially implemented. dictcheck = 1 evaluates every candidate against the cracklib dictionary, and badwords rejects organisation-specific terms.\n\nMeasured on a clean Debian 13 install, with candidates padded to at or above the minimum length in force so that length cannot be the reason for rejection: 1 of 8 common breach-list passwords was rejected at a 15-character minimum, and 2 of 8 at 20. The stock cracklib dictionary is a common-word corpus, not a breach-credential corpus, so the substantive requirement is not met by this configuration alone.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.a ia-5.1_smt.b"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "equivalent"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "monthly"
                  },
                  {
                    "name": "residual-risk",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "Measured: only 1 of 8 long common passwords rejected at minlen 15. cracklib is not a breach-credential corpus."
                  }
                ],
                "links": [
                  {
                    "href": "#2b95af72-5a88-45b0-9ceb-101cf845c227",
                    "rel": "reference",
                    "text": "Dictionary drop-in"
                  },
                  {
                    "href": "#71ac359d-3b86-4752-af35-7cad91128b5c",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ],
                "remarks": "Close the residual by rebuilding the cracklib dictionary from a breach corpus with create-cracklib-dict(8) and pointing dictpath at the result, then re-running the verification script. The refresh cadence is the value bound to ia-05.01_odp.01."
              }
            ]
          },
          {
            "uuid": "32e058de-60e7-44ee-b2b4-842b9523562d",
            "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
            "description": "The SP 800-53 Rev 5 dictionary element, from oscal-content release v1.4.0.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v1.4.0"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "NIST"
              }
            ],
            "links": [
              {
                "href": "#afd178e1-5b19-45b3-8179-db808eae36de",
                "rel": "reference",
                "text": "Pinned SP 800-53 catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "2d7e880e-0ce6-4916-8524-e3b7d0912ff5",
                "control-id": "ia-5.1",
                "description": "This component claims only IA-5(1)(a), the list of commonly used, expected or compromised passwords, and binds the parameter for how often that list is updated.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "monthly"
                  }
                ],
                "links": [
                  {
                    "href": "#71ac359d-3b86-4752-af35-7cad91128b5c",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "set-parameters": [
                  {
                    "param-id": "ia-05.01_odp.01",
                    "values": [
                      "monthly, and immediately upon notification of a credential compromise affecting the system"
                    ],
                    "remarks": "Cadence for refreshing the cracklib dictionary that backs dictcheck. Bound to the ism-2078 residual."
                  }
                ],
                "statements": [
                  {
                    "statement-id": "ia-5.1_smt.a",
                    "uuid": "a6a9df0e-a9d5-51af-877a-71efb17ab8c9",
                    "description": "dictcheck = 1 evaluates candidates against the cracklib dictionary, and the refresh cadence is bound to ia-05.01_odp.01. Measured effectiveness is low: 1 of 8 long common passwords was rejected at minlen 15. cracklib is a common-word corpus, not a list of compromised passwords, so this element is partial and the substantive requirement is unmet until a breach corpus is loaded.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "partial"
                      },
                      {
                        "name": "correlates-ism-control",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "ism-2078"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ]
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "2b95af72-5a88-45b0-9ceb-101cf845c227",
          "title": "Dictionary checking",
          "description": "dictcheck = 1 and the organisation word list, asserting ism-2078. Deploys to /etc/security/pwquality.conf.d/50-ism-dictionary.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "config/pwquality.conf.d/50-ism-dictionary.conf",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "ism-dictionary.conf",
            "media-type": "text/plain",
            "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBjb21tb25seSB1c2VkIGFuZCBjb21wcm9taXNlZCBwYXNzd29yZHMKIwojIFNvdXJjZTogQUNTQyBJU00gT1NDQUwgY2F0YWxvZ3VlIHYyMDI2LjA5LjQKIyAgIGlzbS0yMDc4ICBjb21tb25seSB1c2VkIC8gY29tcHJvbWlzZWQgcGFzc3dvcmRzIGFyZSBub3QgdXNlZCAgICAgIChhbGwpCiMKIyBkaWN0Y2hlY2sgZXZhbHVhdGVzIGV2ZXJ5IGNhbmRpZGF0ZSBhZ2FpbnN0IHRoZSBjcmFja2xpYiBkaWN0aW9uYXJ5IHNoaXBwZWQgYnkKIyBjcmFja2xpYi1ydW50aW1lLiBUaGF0IGlzIGEgY29tbW9uLXdvcmQgY29ycHVzLCBub3QgYSBicmVhY2gtY3JlZGVudGlhbCBjb3JwdXMsCiMgc28gdGhpcyBpcyBhIHBhcnRpYWwgaW1wbGVtZW50YXRpb247IHNlZSB0aGUgY29tcG9uZW50IFJFQURNRS4KIwojIEluc3RhbGwgdG8gL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLzUwLWlzbS1kaWN0aW9uYXJ5LmNvbmYKCmRpY3RjaGVjayA9IDEKCiMgT3JnYW5pc2F0aW9uLXNwZWNpZmljIHRlcm1zIHRoYXQgbXVzdCBuZXZlciBhcHBlYXIgaW4gYSBwYXNzcGhyYXNlLiBFeHRlbmQgdGhpcwojIGxpc3Qgd2l0aCBwcm9kdWN0IG5hbWVzLCBwcm9qZWN0IGNvZGUgbmFtZXMgYW5kIHNpdGUgbmFtZXMuCmJhZHdvcmRzID0gcGFzc3dvcmQgcGFzc3BocmFzZSBkZWJpYW4gdHJpeGllIG9mZmljaWFsIHByb3RlY3RlZCBzZWNyZXQK"
          }
        },
        {
          "uuid": "0923076e-0f82-4eb3-9ff7-fd939b5b5d6e",
          "title": "Apply script",
          "description": "Installs 50-ism-dictionary.conf. Refuses to run unless pam_pwquality is already in the password stack.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/apply-dictionary.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "apply-dictionary.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgQXBwbHkgZGljdGlvbmFyeSBjaGVja2luZyBmb3IgY29tbW9ubHkgdXNlZCBwYXNzd29yZHMgKGlzbS0yMDc4KSBvbiBhIERlYmlhbiAxMyAodHJpeGllKSBob3N0LCB1c2luZyB0aGUgY3JhY2tsaWIgZGljdGlvbmFyeSBmcm9tIGNyYWNrbGliLXJ1bnRpbWUgcGx1cyBhbiBvcmdhbmlzYXRpb24gd29yZCBsaXN0LgojCiMgUmVxdWlyZXMgZGViaWFuLTEzLXB3cXVhbGl0eS1iYXNlOiBwYW1fcHdxdWFsaXR5IG11c3QgYWxyZWFkeSBiZSBpbnN0YWxsZWQgYW5kIGluCiMgdGhlIHBhc3N3b3JkIHN0YWNrLCBvciBub3RoaW5nIHRoaXMgY29tcG9uZW50IGNvbmZpZ3VyZXMgaXMgZW5mb3JjZWQuIFRoaXMgc2NyaXB0CiMgaW5zdGFsbHMgb25lIGRyb3AtaW4gYW5kIGNoYW5nZXMgbm90aGluZyBlbHNlLgojCiMgVXNhZ2U6IGFwcGx5LWRpY3Rpb25hcnkuc2gKIyBJZGVtcG90ZW50OiBzYWZlIHRvIHJlLXJ1bi4KCnNldCAtZXUKClsgIiQoaWQgLXUpIiAtZXEgMCBdIHx8IHsgZWNobyAiZXJyb3I6IG11c3QgcnVuIGFzIHJvb3QiID4mMjsgZXhpdCAxOyB9CgpCQVNFX0RJUj0iJChDRFBBVEg9IGNkIC0tICIkKGRpcm5hbWUgLS0gIiQwIikvLi4iICYmIHB3ZCkiCkRST1BJTj01MC1pc20tZGljdGlvbmFyeS5jb25mCgpncmVwIC1xRSAnXlteI10qcGFtX3B3cXVhbGl0eVwuc28nIC9ldGMvcGFtLmQvY29tbW9uLXBhc3N3b3JkIHx8IHsKCWVjaG8gImVycm9yOiByZXF1aXJlcyBkZWJpYW4tMTMtcHdxdWFsaXR5LWJhc2U6IHBhbV9wd3F1YWxpdHkuc28gaXMgbm90IGluIC9ldGMvcGFtLmQvY29tbW9uLXBhc3N3b3JkLCIgPiYyCgllY2hvICIgICAgICAgc28gbm90aGluZyB0aGlzIGNvbXBvbmVudCBjb25maWd1cmVzIHdvdWxkIGJlIGVuZm9yY2VkLiIgPiYyCglleGl0IDEKfQoKZWNobyAiPT0+IGluc3RhbGxpbmcgJERST1BJTiIKaW5zdGFsbCAtZCAtbSAwNzU1IC9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZAppbnN0YWxsIC1tIDA2NDQgIiRCQVNFX0RJUi9jb25maWcvcHdxdWFsaXR5LmNvbmYuZC8kRFJPUElOIiAiL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLyREUk9QSU4iCgplY2hvICI9PT4gYXBwbGllZC4gVmVyaWZ5IHdpdGg6IHNjcmlwdHMvdmVyaWZ5LWRpY3Rpb25hcnkuc2giCg=="
          }
        },
        {
          "uuid": "71ac359d-3b86-4752-af35-7cad91128b5c",
          "title": "Verification script",
          "description": "Asserts the control from behaviour, with every candidate padded to the minimum length in force, and reports separately if another configuration sets a setting this component owns.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/verify-dictionary.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "verify-dictionary.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoYXQgY29tbW9ubHkgdXNlZCBwYXNzd29yZHMgYXJlIHJlamVjdGVkIChpc20tMjA3OCkgb24gYSBEZWJpYW4gMTMgaG9zdC4KIwojIEV2ZXJ5IGNhbmRpZGF0ZSBpcyBwYWRkZWQgdG8gdGhlIG1pbmltdW0gbGVuZ3RoIGluIGZvcmNlLCBtZWFzdXJlZCByYXRoZXIgdGhhbgojIHJlYWQsIHNvIGEgcmVqZWN0aW9uIGlzIG5ldmVyIGZvciBsZW5ndGggd2hlbiB0aGlzIHJ1bGUgaXMgdW5kZXIgdGVzdC4gU2V0dGluZ3MKIyB0aGlzIGNvbXBvbmVudCBvd25zIGJlaW5nIHNldCBlbHNld2hlcmUgaXMgcmVwb3J0ZWQgc2VwYXJhdGVseSwgYXMgYSBjb25mbGljdC4KIwojIFVzZXMgcHdzY29yZSgxKS4gTm8gYWNjb3VudCBpcyBjcmVhdGVkIG9yIG1vZGlmaWVkLCBzbyB0aGlzIGlzIHNhZmUgb24gYQojIHByb2R1Y3Rpb24gaG9zdC4KCnNldCAtdQoKUEFTU19DT1VOVD0wCkZBSUxfQ09VTlQ9MApQQVJUSUFMX0NPVU5UPTAKCnJlcG9ydCgpIHsKCWNhc2UgIiQxIiBpbgoJCVBBU1MpIFBBU1NfQ09VTlQ9JCgoUEFTU19DT1VOVCArIDEpKSA7OwoJCVBBUlRJQUwpIFBBUlRJQUxfQ09VTlQ9JCgoUEFSVElBTF9DT1VOVCArIDEpKSA7OwoJCSopIEZBSUxfQ09VTlQ9JCgoRkFJTF9DT1VOVCArIDEpKSA7OwoJZXNhYwoJcHJpbnRmICclLThzICUtMTNzICVzXG4nICIkMSIgIiQyIiAiJDMiCn0KCmFjY2VwdHMoKSB7IHByaW50ZiAnJXMnICIkMSIgfCBwd3Njb3JlID4vZGV2L251bGwgMj4mMTsgfQoKY29tbWFuZCAtdiBwd3Njb3JlID4vZGV2L251bGwgMj4mMSB8fCB7IGVjaG8gImVycm9yOiBwd3Njb3JlIG5vdCBmb3VuZDsgaW5zdGFsbCBsaWJwd3F1YWxpdHktdG9vbHMiID4mMjsgZXhpdCAxOyB9CgpNSU5FPS9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZC81MC1pc20tZGljdGlvbmFyeS5jb25mClsgLWYgIiRNSU5FIiBdIHx8IHsgZWNobyAiZXJyb3I6ICRNSU5FIGlzIG5vdCBpbnN0YWxsZWQ7IHJ1biB0aGUgYXBwbHkgc2NyaXB0IiA+JjI7IGV4aXQgMTsgfQoKRklMTEVSPXZhdWx0b3R0ZXJtYW5nb3F1aWx0cmF2ZW5mam9yZHplYnJhcGxpbnRod2lkZ2V0Y2FyYm9uaGVsaXhqdW5pcGVybWFycm93CnNsaWNlKCkgeyBwcmludGYgJyVzJXMnICIkRklMTEVSIiAiJEZJTExFUiIgfCBjdXQgLWMxLSIkMSI7IH0KCkZMT09SPQpuPTEKd2hpbGUgWyAiJG4iIC1sZSAxMjggXTsgZG8KCWlmIGFjY2VwdHMgIiQoc2xpY2UgIiRuIikiOyB0aGVuIEZMT09SPSRuOyBicmVhazsgZmkKCW49JCgobiArIDEpKQpkb25lCjogIiR7RkxPT1I6PTZ9IgoKZWNobyAiTWluaW11bSBpbiBmb3JjZTogJEZMT09SIGNoYXJhY3RlcnMiCmVjaG8KCiMgQ29tbW9uIHBhc3N3b3JkcywgcGFkZGVkIHRvIHRoZSBtaW5pbXVtIGluIGZvcmNlOiBhIHNob3J0ZXIgb25lIGlzIHJlamVjdGVkIGZvcgojIExFTkdUSCwgd2hpY2ggcHJvdmVzIG5vdGhpbmcgYWJvdXQgdGhlIGRpY3Rpb25hcnkuCldFQUtfVE9UQUw9MApXRUFLX1JFSkVDVEVEPTAKZm9yIGJhc2UgaW4gcGFzc3dvcmQgbGV0bWVpbiBxd2VydHkgd2VsY29tZSBtb25rZXkgdHJ1c3RubzEgaWxvdmV5b3UgYWRtaW47IGRvCgljYW5kaWRhdGU9JGJhc2UKCXdoaWxlIFsgIiR7I2NhbmRpZGF0ZX0iIC1sdCAiJEZMT09SIiBdOyBkbyBjYW5kaWRhdGU9IiR7Y2FuZGlkYXRlfSR7YmFzZX0iOyBkb25lCglXRUFLX1RPVEFMPSQoKFdFQUtfVE9UQUwgKyAxKSkKCWFjY2VwdHMgIiRjYW5kaWRhdGUiIHx8IFdFQUtfUkVKRUNURUQ9JCgoV0VBS19SRUpFQ1RFRCArIDEpKQpkb25lCmlmIFsgIiRXRUFLX1JFSkVDVEVEIiAtZXEgIiRXRUFLX1RPVEFMIiBdOyB0aGVuCglyZXBvcnQgUEFTUyAiaXNtLTIwNzgiICJhbGwgJFdFQUtfVE9UQUwgY29tbW9uIHBhc3N3b3JkcyByZWplY3RlZCBhdCBvciBhYm92ZSB0aGUgbWluaW11bSBpbiBmb3JjZSIKZWxzZQoJcmVwb3J0IFBBUlRJQUwgImlzbS0yMDc4IiBcCgkJIm9ubHkgJFdFQUtfUkVKRUNURUQvJFdFQUtfVE9UQUwgY29tbW9uIHBhc3N3b3JkcyByZWplY3RlZCBhdCBvciBhYm92ZSB0aGUgbWluaW11bSBpbiBmb3JjZTsgY3JhY2tsaWIgaXMgbm90IGEgYnJlYWNoIGNvcnB1cyIKZmkKCiMgVGhlIG9yZ2FuaXNhdGlvbiB3b3JkIGxpc3QgaXMgdGhpcyBjb21wb25lbnQgcyBvd24sIHNvIGl0IHNob3VsZCBhbHdheXMgYml0ZS4KIyBUaGUgbGFzdCB0ZXJtIGluIHRoZSBsaXN0LCB3aGljaCBpcyB0aGUgbGVhc3QgbGlrZWx5IHRvIGJlIGluIGNyYWNrbGliIGFscmVhZHksCiMgc28gYSByZWplY3Rpb24gaXMgYXR0cmlidXRhYmxlIHRvIGJhZHdvcmRzIHJhdGhlciB0aGFuIHRoZSBkaWN0aW9uYXJ5LgpPUkc9JChhd2sgLUY9ICcvXltbOnNwYWNlOl1dKmJhZHdvcmRzW1s6c3BhY2U6XV0qPS8ge3ByaW50ICRORn0nICIkTUlORSIgfCBhd2sgJ3twcmludCAkTkZ9JykKaWYgWyAtbiAiJE9SRyIgXTsgdGhlbgoJY2FuZGlkYXRlPSRPUkcKCXdoaWxlIFsgIiR7I2NhbmRpZGF0ZX0iIC1sdCAiJEZMT09SIiBdOyBkbyBjYW5kaWRhdGU9IiR7Y2FuZGlkYXRlfSR7T1JHfSI7IGRvbmUKCWFjY2VwdHMgIiRjYW5kaWRhdGUiICYmCgkJcmVwb3J0IEZBSUwgImJhZHdvcmRzIiAidGhlIG9yZ2FuaXNhdGlvbiB3b3JkIFwiJE9SR1wiIGlzIGFjY2VwdGVkOyBiYWR3b3JkcyBpcyBub3QgaW4gZm9yY2UiIHx8CgkJcmVwb3J0IFBBU1MgImJhZHdvcmRzIiAidGhlIG9yZ2FuaXNhdGlvbiB3b3JkIGxpc3QgaXMgaW4gZm9yY2UiCmZpCgojIElBLTUoMSkoYSkgaXMgdGhpcyBjb21wb25lbnQgcywgYW5kIGlzIG9ubHkgYXMgZ29vZCBhcyB0aGUgZGljdGlvbmFyeSBiZWhpbmQgaXQuClsgIiRXRUFLX1JFSkVDVEVEIiAtZXEgIiRXRUFLX1RPVEFMIiBdICYmCglyZXBvcnQgUEFTUyAiaWEtNS4xX3NtdC5hIiAiY29tbW9uIHBhc3N3b3JkcyByZWplY3RlZCIgfHwKCXJlcG9ydCBQQVJUSUFMICJpYS01LjFfc210LmEiICJkaWN0aW9uYXJ5IGNoZWNrIGluIGZvcmNlIGJ1dCBpbmNvbXBsZXRlOyBzZWUgaXNtLTIwNzgiCgpPVkVSUklERVM9JycKZm9yIGYgaW4gL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZiAvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvKi5jb25mOyBkbwoJWyAtZiAiJGYiIF0gJiYgWyAiJGYiICE9ICIkTUlORSIgXSB8fCBjb250aW51ZQoJZm9yIGtleSBpbiBkaWN0Y2hlY2sgYmFkd29yZHM7IGRvCgkJZ3JlcCAtcUUgIl5bWzpzcGFjZTpdXSoka2V5KFtbOnNwYWNlOl1dKj18W1s6c3BhY2U6XV0qXCQpIiAiJGYiICYmCgkJCU9WRVJSSURFUz0iJE9WRVJSSURFUyAka2V5KCQoYmFzZW5hbWUgIiRmIikpIgoJZG9uZQpkb25lClsgLXogIiRPVkVSUklERVMiIF0gJiYKCXJlcG9ydCBQQVNTICJzZXR0aW5ncyIgInRoZSBzZXR0aW5ncyB0aGlzIGNvbXBvbmVudCBvd25zIGFyZSBzZXQgaGVyZSBhbmQgbm93aGVyZSBlbHNlIiB8fAoJcmVwb3J0IEZBSUwgInNldHRpbmdzIiAic2V0dGluZ3MgdGhpcyBjb21wb25lbnQgb3ducyBhcmUgYWxzbyBzZXQgZWxzZXdoZXJlOiRPVkVSUklERVMiCgplY2hvCmVjaG8gInBhc3NlZDogJFBBU1NfQ09VTlQgIHBhcnRpYWw6ICRQQVJUSUFMX0NPVU5UICBmYWlsZWQ6ICRGQUlMX0NPVU5UIgpbICIkRkFJTF9DT1VOVCIgLWVxIDAgXSB8fCBleGl0IDEK"
          }
        },
        {
          "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
          "title": "ACSC ISM OSCAL catalogue v2026.09.4",
          "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v2026.09.4"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "afd178e1-5b19-45b3-8179-db808eae36de",
          "title": "NIST SP 800-53 Rev 5 catalogue (oscal-content v1.4.0)",
          "description": "NIST SP 800-53 Revision 5 catalogue, release v1.4.0: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v1.4.0"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "c6aaa027-2fa1-4d12-a806-c29641030292",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality must be installed and enforcing, or nothing here is applied.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}