{
  "component-definition": {
    "uuid": "c15dd086-11e8-45e5-b155-f16b4b68f8a9",
    "metadata": {
      "title": "Debian 13 ISM Minimum Passphrase Length Component Definition",
      "last-modified": "2026-09-16T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "responsible-parties": [
        {
          "role-id": "system-administrator",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        },
        {
          "role-id": "system-security-officer",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        }
      ],
      "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.",
      "document-ids": [
        {
          "scheme": "https://ns.oscalops.net/component-definitions",
          "identifier": "debian-13-pwquality-minlen"
        }
      ],
      "props": [
        {
          "name": "assurance-state",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "technically-tested"
        },
        {
          "name": "assurance-authority",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none; self-asserted by the contributing author"
        },
        {
          "name": "endorsement",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none"
        },
        {
          "name": "publisher",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "library_component-definition contributors"
        },
        {
          "name": "publication-status",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "unpublished"
        },
        {
          "name": "artifact-slug",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "debian-13-pwquality-minlen"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-minlen/1.0.0/component-definition.json",
          "rel": "canonical",
          "text": "Reserved canonical URL; the registry is not yet published"
        }
      ]
    },
    "components": [
      {
        "uuid": "c5583c57-fc9c-4014-86b1-55c018f4e5f9",
        "type": "software",
        "title": "Debian 13 ISM Minimum Passphrase Length",
        "description": "The ISM minimum password length for the system's applicability, enforced by pam_pwquality: 15 characters on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 17 on SECRET and 20 on TOP SECRET. One drop-in per applicability, exactly one live at a time.\n\nDepends on debian-13-pwquality-base. Pair it with debian-13-pwquality-no-complexity as well: with character-class credits enabled, a shorter password can satisfy the minimum, which the verification script tests for.",
        "purpose": "Enforce the ISM minimum password length on local Debian accounts.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:minlen"
          }
        ],
        "links": [
          {
            "href": "#e57bfd80-2a20-49e3-8feb-2bdfd7e81ccf",
            "rel": "depends-on",
            "text": "pam_pwquality must be installed and enforcing"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "ff0dc6d6-19f7-4950-8a29-96e4a5710dbb",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "The ISM minimum password length, by applicability, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "7fd6de0b-3708-4013-8c97-9ba9cf947942",
                "control-id": "ism-0421",
                "description": "pam_pwquality enforces a minimum passphrase length of 15 characters on non-classified, OFFICIAL: Sensitive and PROTECTED systems, via the drop-in 50-ism-minlen-nc-os-p.conf.\n\nVerified by behaviour: the shortest passphrase the live policy accepts is measured, and nothing shorter than 15 characters is accepted. A 14-character candidate using every character class is also rejected, which shows credits are not lowering the minimum.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "implemented"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "pwquality-minlen",
                    "ns": "https://ns.oscalops.net/component-definitions/debian-passphrase-hardening",
                    "value": "15"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "equivalent"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#8a7620ba-0530-44ea-9045-24bd2885345b",
                    "rel": "reference",
                    "text": "Minimum length drop-in"
                  },
                  {
                    "href": "#c91079a7-e708-4e9b-bfd1-bc48d6792870",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ],
                "remarks": "ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once."
              },
              {
                "uuid": "88870ea4-0ab4-44b1-ab24-45db305a1689",
                "control-id": "ism-1557",
                "description": "pam_pwquality enforces a minimum passphrase length of 17 characters on SECRET systems, via the drop-in 50-ism-minlen-s.conf.\n\nVerified by behaviour on a SECRET-tier system: nothing shorter than 17 characters is accepted.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "implemented"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "pwquality-minlen",
                    "ns": "https://ns.oscalops.net/component-definitions/debian-passphrase-hardening",
                    "value": "17"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "equivalent"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#cbebd758-c0d8-434f-b39e-adc8939fd838",
                    "rel": "reference",
                    "text": "Minimum length drop-in"
                  },
                  {
                    "href": "#c91079a7-e708-4e9b-bfd1-bc48d6792870",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ],
                "remarks": "ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once."
              },
              {
                "uuid": "8ad4d6a4-87fc-4006-9f0b-66ce48081be6",
                "control-id": "ism-0422",
                "description": "pam_pwquality enforces a minimum passphrase length of 20 characters on TOP SECRET systems, via the drop-in 50-ism-minlen-ts.conf.\n\nVerified by behaviour on a TOP SECRET-tier system: nothing shorter than 20 characters is accepted.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "implemented"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "pwquality-minlen",
                    "ns": "https://ns.oscalops.net/component-definitions/debian-passphrase-hardening",
                    "value": "20"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "equivalent"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#313cdb44-0e54-4502-819a-c00ca8621d3a",
                    "rel": "reference",
                    "text": "Minimum length drop-in"
                  },
                  {
                    "href": "#c91079a7-e708-4e9b-bfd1-bc48d6792870",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ],
                "remarks": "ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once."
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "8a7620ba-0530-44ea-9045-24bd2885345b",
          "title": "Minimum length, applicability NC, OS, P",
          "description": "minlen = 15, asserting ism-0421 on non-classified, OFFICIAL: Sensitive and PROTECTED systems. Deploys to /etc/security/pwquality.conf.d/50-ism-minlen-nc-os-p.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "config/pwquality.conf.d/50-ism-minlen-nc-os-p.conf",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "ism-minlen-nc-os-p.conf",
            "media-type": "text/plain",
            "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBtaW5pbXVtIGxlbmd0aCwgYXBwbGljYWJpbGl0eSBOQywgT1MsIFAKIwojIFNvdXJjZTogQUNTQyBJU00gT1NDQUwgY2F0YWxvZ3VlIHYyMDI2LjA5LjQKIyAgIGlzbS0wNDIxICBzaW5nbGUtZmFjdG9yIHBhc3N3b3JkcyBhcmUgYSBtaW5pbXVtIG9mIDE1IGNoYXJhY3RlcnMgIChOQywgT1MsIFApCiMKIyBUaGlzIGlzIGEgcHVyZSBjaGFyYWN0ZXIgY291bnQ6IGRlYmlhbi0xMy1wd3F1YWxpdHktbm8tY29tcGxleGl0eSBzZXRzIGV2ZXJ5CiMgY3JlZGl0IHRvIDAsIHNvIG5vIGNoYXJhY3RlciBjbGFzcyBjYW4gZWFybiBiYWNrIGEgY2hhcmFjdGVyIGFnYWluc3QgaXQuIFdpdGhvdXQKIyB0aGF0IGNvbXBvbmVudCwgY3JlZGl0cyBjb3VsZCBsZXQgYSBzaG9ydGVyIHBhc3N3b3JkIHNhdGlzZnkgdGhpcyBtaW5pbXVtLgojCiMgRXhhY3RseSBvbmUgbWluaW11bSBtYXkgYmUgbGl2ZTogcHdxdWFsaXR5LmNvbmYuZCBpcyByZWFkIGluIEFTQ0lJIHNvcnQgb3JkZXIgYW5kCiMgYSBzZWNvbmQgbWlubGVuIHdvdWxkIHNpbGVudGx5IHdpbi4gVGhlIGFwcGx5IHNjcmlwdCByZW1vdmVzIHRoZSBvdGhlciB0d28uCiMKIyBJbnN0YWxsIHRvIC9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZC81MC1pc20tbWlubGVuLW5jLW9zLXAuY29uZgoKbWlubGVuID0gMTUK"
          }
        },
        {
          "uuid": "cbebd758-c0d8-434f-b39e-adc8939fd838",
          "title": "Minimum length, applicability S",
          "description": "minlen = 17, asserting ism-1557 on SECRET systems. Deploys to /etc/security/pwquality.conf.d/50-ism-minlen-s.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "config/pwquality.conf.d/50-ism-minlen-s.conf",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "ism-minlen-s.conf",
            "media-type": "text/plain",
            "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBtaW5pbXVtIGxlbmd0aCwgYXBwbGljYWJpbGl0eSBTCiMKIyBTb3VyY2U6IEFDU0MgSVNNIE9TQ0FMIGNhdGFsb2d1ZSB2MjAyNi4wOS40CiMgICBpc20tMTU1NyAgc2luZ2xlLWZhY3RvciBwYXNzd29yZHMgYXJlIGEgbWluaW11bSBvZiAxNyBjaGFyYWN0ZXJzICAoUykKIwojIFRoaXMgaXMgYSBwdXJlIGNoYXJhY3RlciBjb3VudDogZGViaWFuLTEzLXB3cXVhbGl0eS1uby1jb21wbGV4aXR5IHNldHMgZXZlcnkKIyBjcmVkaXQgdG8gMCwgc28gbm8gY2hhcmFjdGVyIGNsYXNzIGNhbiBlYXJuIGJhY2sgYSBjaGFyYWN0ZXIgYWdhaW5zdCBpdC4gV2l0aG91dAojIHRoYXQgY29tcG9uZW50LCBjcmVkaXRzIGNvdWxkIGxldCBhIHNob3J0ZXIgcGFzc3dvcmQgc2F0aXNmeSB0aGlzIG1pbmltdW0uCiMKIyBFeGFjdGx5IG9uZSBtaW5pbXVtIG1heSBiZSBsaXZlOiBwd3F1YWxpdHkuY29uZi5kIGlzIHJlYWQgaW4gQVNDSUkgc29ydCBvcmRlciBhbmQKIyBhIHNlY29uZCBtaW5sZW4gd291bGQgc2lsZW50bHkgd2luLiBUaGUgYXBwbHkgc2NyaXB0IHJlbW92ZXMgdGhlIG90aGVyIHR3by4KIwojIEluc3RhbGwgdG8gL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLzUwLWlzbS1taW5sZW4tcy5jb25mCgptaW5sZW4gPSAxNwo="
          }
        },
        {
          "uuid": "313cdb44-0e54-4502-819a-c00ca8621d3a",
          "title": "Minimum length, applicability TS",
          "description": "minlen = 20, asserting ism-0422 on TOP SECRET systems. Deploys to /etc/security/pwquality.conf.d/50-ism-minlen-ts.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "config/pwquality.conf.d/50-ism-minlen-ts.conf",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "ism-minlen-ts.conf",
            "media-type": "text/plain",
            "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBtaW5pbXVtIGxlbmd0aCwgYXBwbGljYWJpbGl0eSBUUwojCiMgU291cmNlOiBBQ1NDIElTTSBPU0NBTCBjYXRhbG9ndWUgdjIwMjYuMDkuNAojICAgaXNtLTA0MjIgIHNpbmdsZS1mYWN0b3IgcGFzc3dvcmRzIGFyZSBhIG1pbmltdW0gb2YgMjAgY2hhcmFjdGVycyAgKFRTKQojCiMgVGhpcyBpcyBhIHB1cmUgY2hhcmFjdGVyIGNvdW50OiBkZWJpYW4tMTMtcHdxdWFsaXR5LW5vLWNvbXBsZXhpdHkgc2V0cyBldmVyeQojIGNyZWRpdCB0byAwLCBzbyBubyBjaGFyYWN0ZXIgY2xhc3MgY2FuIGVhcm4gYmFjayBhIGNoYXJhY3RlciBhZ2FpbnN0IGl0LiBXaXRob3V0CiMgdGhhdCBjb21wb25lbnQsIGNyZWRpdHMgY291bGQgbGV0IGEgc2hvcnRlciBwYXNzd29yZCBzYXRpc2Z5IHRoaXMgbWluaW11bS4KIwojIEV4YWN0bHkgb25lIG1pbmltdW0gbWF5IGJlIGxpdmU6IHB3cXVhbGl0eS5jb25mLmQgaXMgcmVhZCBpbiBBU0NJSSBzb3J0IG9yZGVyIGFuZAojIGEgc2Vjb25kIG1pbmxlbiB3b3VsZCBzaWxlbnRseSB3aW4uIFRoZSBhcHBseSBzY3JpcHQgcmVtb3ZlcyB0aGUgb3RoZXIgdHdvLgojCiMgSW5zdGFsbCB0byAvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvNTAtaXNtLW1pbmxlbi10cy5jb25mCgptaW5sZW4gPSAyMAo="
          }
        },
        {
          "uuid": "19eee90a-5d16-4ac6-96ae-1d630b8ab6ba",
          "title": "Apply script",
          "description": "Installs 50-ism-minlen-nc-os-p.conf. Refuses to run unless pam_pwquality is already in the password stack.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/apply-minlen.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "apply-minlen.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgQXBwbHkgdGhlIElTTSBtaW5pbXVtIHBhc3NwaHJhc2UgbGVuZ3RoIGZvciBhIHN5c3RlbSdzIGFwcGxpY2FiaWxpdHksIG9uIGEKIyBEZWJpYW4gMTMgKHRyaXhpZSkgaG9zdC4KIwojIFVzYWdlOiBhcHBseS1taW5sZW4uc2ggPE5DfE9TfFB8U3xUUz4KIwojIFRoZSBhcmd1bWVudCBpcyB0aGUgc3lzdGVtJ3MgSVNNIGFwcGxpY2FiaWxpdHkgY29kZSwgZXhhY3RseSBhcyB0aGUgY2F0YWxvZ3VlCiMgdXNlcyBpdC4gTkMsIE9TIGFuZCBQIHNoYXJlIG9uZSBtaW5pbXVtICgxNSk7IFMgaXMgMTcgYW5kIFRTIGlzIDIwLgojCiMgUmVxdWlyZXMgZGViaWFuLTEzLXB3cXVhbGl0eS1iYXNlOiBwYW1fcHdxdWFsaXR5IG11c3QgYWxyZWFkeSBiZSBpbnN0YWxsZWQgYW5kIGluCiMgdGhlIHBhc3N3b3JkIHN0YWNrLCBvciBub3RoaW5nIGhlcmUgaXMgZW5mb3JjZWQuIFBhaXIgaXQgd2l0aAojIGRlYmlhbi0xMy1wd3F1YWxpdHktbm8tY29tcGxleGl0eSBhcyB3ZWxsLCBvciBjaGFyYWN0ZXItY2xhc3MgY3JlZGl0cyBjYW4gbGV0IGEKIyBzaG9ydGVyIHBhc3N3b3JkIHNhdGlzZnkgdGhlIG1pbmltdW0uCiMKIyBJZGVtcG90ZW50OiBzYWZlIHRvIHJlLXJ1bi4KCnNldCAtZXUKCkFQUExJQ0FCSUxJVFk9JChwcmludGYgJyVzJyAiJHsxOi19IiB8IHRyICdbOmxvd2VyOl0nICdbOnVwcGVyOl0nKQpjYXNlICIkQVBQTElDQUJJTElUWSIgaW4KCU5DfE9TfFApIFRJRVI9bmMtb3MtcCA7OwoJUykgICAgICAgVElFUj1zIDs7CglUUykgICAgICBUSUVSPXRzIDs7CgkqKSAgICAgICBlY2hvICJ1c2FnZTogJDAgPE5DfE9TfFB8U3xUUz4iID4mMjsgZXhpdCAyIDs7CmVzYWMKClsgIiQoaWQgLXUpIiAtZXEgMCBdIHx8IHsgZWNobyAiZXJyb3I6IG11c3QgcnVuIGFzIHJvb3QiID4mMjsgZXhpdCAxOyB9CgpCQVNFX0RJUj0iJChDRFBBVEg9IGNkIC0tICIkKGRpcm5hbWUgLS0gIiQwIikvLi4iICYmIHB3ZCkiCkRST1BJTj0iNTAtaXNtLW1pbmxlbi0ke1RJRVJ9LmNvbmYiClsgLWYgIiRCQVNFX0RJUi9jb25maWcvcHdxdWFsaXR5LmNvbmYuZC8kRFJPUElOIiBdIHx8IHsgZWNobyAiZXJyb3I6IG1pc3NpbmcgJERST1BJTiIgPiYyOyBleGl0IDE7IH0KCmdyZXAgLXFFICdeW14jXSpwYW1fcHdxdWFsaXR5XC5zbycgL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQgfHwgewoJZWNobyAiZXJyb3I6IHJlcXVpcmVzIGRlYmlhbi0xMy1wd3F1YWxpdHktYmFzZTogcGFtX3B3cXVhbGl0eS5zbyBpcyBub3QgaW4gL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQsIiA+JjIKCWVjaG8gIiAgICAgICBzbyBub3RoaW5nIHRoaXMgY29tcG9uZW50IGNvbmZpZ3VyZXMgd291bGQgYmUgZW5mb3JjZWQuIiA+JjIKCWV4aXQgMQp9CgplY2hvICI9PT4gaW5zdGFsbGluZyAkRFJPUElOIGZvciBhcHBsaWNhYmlsaXR5ICRBUFBMSUNBQklMSVRZIgppbnN0YWxsIC1kIC1tIDA3NTUgL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kCmluc3RhbGwgLW0gMDY0NCAiJEJBU0VfRElSL2NvbmZpZy9wd3F1YWxpdHkuY29uZi5kLyREUk9QSU4iICIvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvJERST1BJTiIKCiMgRXhhY3RseSBvbmUgbWluaW11bSBtYXkgYmUgbGl2ZTogY29uZi5kIGlzIHJlYWQgaW4gQVNDSUkgc29ydCBvcmRlciBhbmQgdGhlIGxhc3QKIyBtaW5sZW4gc2lsZW50bHkgd2lucy4KZm9yIGYgaW4gL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLzUwLWlzbS1taW5sZW4tKi5jb25mOyBkbwoJWyAiJGYiID0gIi9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZC8kRFJPUElOIiBdIHx8IHJtIC1mICIkZiIKZG9uZQoKZWNobyAiPT0+IGFwcGxpZWQuIFZlcmlmeSB3aXRoOiBzY3JpcHRzL3ZlcmlmeS1taW5sZW4uc2giCg=="
          }
        },
        {
          "uuid": "c91079a7-e708-4e9b-bfd1-bc48d6792870",
          "title": "Verification script",
          "description": "Asserts the control from behaviour, with every candidate padded to the minimum length in force, and reports separately if another configuration sets a setting this component owns.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/verify-minlen.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "verify-minlen.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoZSBJU00gbWluaW11bSBwYXNzcGhyYXNlIGxlbmd0aCBvbiBhIERlYmlhbiAxMyAodHJpeGllKSBob3N0LgojCiMgVGhlIG1pbmltdW0gaXMgbWVhc3VyZWQgZnJvbSBiZWhhdmlvdXIsIG5vdCByZWFkIGZyb20gbWlubGVuLCBzbyB0aGUgcmVzdWx0IHN0YXlzCiMgdHJ1ZSB3aGVuIGFub3RoZXIgY29tcG9uZW50IG9yIGEgbG9jYWwgcG9saWN5IGFsc28gc2V0cyBhIG1pbmltdW06IGEgc3RyaWN0ZXIgb25lCiMgc3RpbGwgc2F0aXNmaWVzIHRoZSBjb250cm9sLiBXaGVyZSB0aGUgbWluaW11bSBpbiBmb3JjZSBkaWZmZXJzIGZyb20gd2hhdCB0aGlzCiMgY29tcG9uZW50IGNvbmZpZ3VyZWQsIHNvbWV0aGluZyBvdmVycmlkZXMgYSBzZXR0aW5nIGl0IG93bnMsIGFuZCB0aGF0IGlzIHJlcG9ydGVkCiMgc2VwYXJhdGVseSwgYXMgYSBjb25mbGljdC4KIwojIFVzZXMgcHdzY29yZSgxKS4gTm8gYWNjb3VudCBpcyBjcmVhdGVkIG9yIG1vZGlmaWVkLCBzbyB0aGlzIGlzIHNhZmUgb24gYQojIHByb2R1Y3Rpb24gaG9zdC4KCnNldCAtdQoKUEFTU19DT1VOVD0wCkZBSUxfQ09VTlQ9MAoKcmVwb3J0KCkgewoJY2FzZSAiJDEiIGluIFBBU1MpIFBBU1NfQ09VTlQ9JCgoUEFTU19DT1VOVCArIDEpKSA7OyAqKSBGQUlMX0NPVU5UPSQoKEZBSUxfQ09VTlQgKyAxKSkgOzsgZXNhYwoJcHJpbnRmICclLThzICUtMTNzICVzXG4nICIkMSIgIiQyIiAiJDMiCn0KCmFjY2VwdHMoKSB7IHByaW50ZiAnJXMnICIkMSIgfCBwd3Njb3JlID4vZGV2L251bGwgMj4mMTsgfQoKY29tbWFuZCAtdiBwd3Njb3JlID4vZGV2L251bGwgMj4mMSB8fCB7IGVjaG8gImVycm9yOiBwd3Njb3JlIG5vdCBmb3VuZDsgaW5zdGFsbCBsaWJwd3F1YWxpdHktdG9vbHMiID4mMjsgZXhpdCAxOyB9CgpNSU5FPSQobHMgL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLzUwLWlzbS1taW5sZW4tKi5jb25mIDI+L2Rldi9udWxsKQpbIC1uICIkTUlORSIgXSB8fCB7IGVjaG8gImVycm9yOiBubyBJU00gbWluaW11bS1sZW5ndGggZHJvcC1pbjsgcnVuIHRoZSBhcHBseSBzY3JpcHQiID4mMjsgZXhpdCAxOyB9ClsgIiQocHJpbnRmICclc1xuJyAiJE1JTkUiIHwgd2MgLWwpIiAtZXEgMSBdIHx8IHsKCWVjaG8gImVycm9yOiBtb3JlIHRoYW4gb25lIElTTSBtaW5pbXVtIGlzIGluc3RhbGxlZDsgZXhhY3RseSBvbmUgbWF5IGJlIGxpdmU6IiA+JjIKCXByaW50ZiAnICAgICAgICAgJXNcbicgJE1JTkUgPiYyCglleGl0IDEKfQoKIyBUaGUgY29udHJvbCB0aGF0IHNldHMgdGhlIG1pbmltdW0sIGFuZCB0aGUgbWluaW11bSBpdCByZXF1aXJlcywgZm9sbG93IGZyb20gdGhlCiMgYXBwbGljYWJpbGl0eSB0aGUgaW5zdGFsbGVkIGRyb3AtaW4gcmVjb3Jkcy4KY2FzZSAiJChiYXNlbmFtZSAiJE1JTkUiKSIgaW4KCTUwLWlzbS1taW5sZW4tbmMtb3MtcC5jb25mKSBDT05UUk9MPWlzbS0wNDIxIFRIUkVTSE9MRD0xNSBBUFBMSUVTPSJOQywgT1MsIFAiIDs7Cgk1MC1pc20tbWlubGVuLXMuY29uZikgICAgICAgQ09OVFJPTD1pc20tMTU1NyBUSFJFU0hPTEQ9MTcgQVBQTElFUz0iUyIgOzsKCTUwLWlzbS1taW5sZW4tdHMuY29uZikgICAgICBDT05UUk9MPWlzbS0wNDIyIFRIUkVTSE9MRD0yMCBBUFBMSUVTPSJUUyIgOzsKCSopIGVjaG8gImVycm9yOiB1bnJlY29nbmlzZWQgZHJvcC1pbiAkTUlORSIgPiYyOyBleGl0IDEgOzsKZXNhYwpDT05GSUdVUkVEPSQoYXdrIC1GPSAnL15bWzpzcGFjZTpdXSptaW5sZW5bWzpzcGFjZTpdXSo9LyB7Z3N1YigvW1s6c3BhY2U6XV0vLCAiIiwgJDIpOyBwcmludCAkMn0nICIkTUlORSIpCgpGSUxMRVI9dmF1bHRvdHRlcm1hbmdvcXVpbHRyYXZlbmZqb3JkemVicmFwbGludGh3aWRnZXRjYXJib25oZWxpeGp1bmlwZXJtYXJyb3cKc2xpY2UoKSB7IHByaW50ZiAnJXMlcycgIiRGSUxMRVIiICIkRklMTEVSIiB8IGN1dCAtYzEtIiQxIjsgfQoKRUZGRUNUSVZFPQpuPTEKd2hpbGUgWyAiJG4iIC1sZSAxMjggXTsgZG8KCWlmIGFjY2VwdHMgIiQoc2xpY2UgIiRuIikiOyB0aGVuIEVGRkVDVElWRT0kbjsgYnJlYWs7IGZpCgluPSQoKG4gKyAxKSkKZG9uZQoKZWNobyAiQ29uZmlndXJlZCBtaW5sZW4gJENPTkZJR1VSRUQ7IG1pbmltdW0gaW4gZm9yY2UgJHtFRkZFQ1RJVkU6LXVubWVhc3VyYWJsZX07ICRDT05UUk9MIHJlcXVpcmVzICRUSFJFU0hPTEQgZm9yICRBUFBMSUVTIgplY2hvCgojIEEgc2hvcnRlciBjYW5kaWRhdGUgdXNpbmcgZXZlcnkgY2hhcmFjdGVyIGNsYXNzIGNhdGNoZXMgY3JlZGl0cyBsb3dlcmluZyB0aGUKIyBtaW5pbXVtLCB3aGljaCBhbiBhbGwtbG93ZXJjYXNlIHByb2JlIGNhbm5vdCBzZWUuCkNSRURJVEVEPSIkKHNsaWNlICQoKFRIUkVTSE9MRCAtIDUpKSlRNyNrIgppZiBbIC16ICIkRUZGRUNUSVZFIiBdOyB0aGVuCglyZXBvcnQgRkFJTCAiJENPTlRST0wiICJubyBhbGwtbG93ZXJjYXNlIHBhc3NwaHJhc2Ugb2YgdXAgdG8gMTI4IGNoYXJhY3RlcnMgaXMgYWNjZXB0ZWQ7IHRoZSBtaW5pbXVtIGNhbm5vdCBiZSBtZWFzdXJlZCIKZWxpZiBbICIkRUZGRUNUSVZFIiAtbHQgIiRUSFJFU0hPTEQiIF07IHRoZW4KCXJlcG9ydCBGQUlMICIkQ09OVFJPTCIgImEgJEVGRkVDVElWRS1jaGFyYWN0ZXIgcGFzc3BocmFzZSBpcyBhY2NlcHRlZDsgJEFQUExJRVMgcmVxdWlyZXMgYXQgbGVhc3QgJFRIUkVTSE9MRCIKZWxpZiBhY2NlcHRzICIkQ1JFRElURUQiOyB0aGVuCglyZXBvcnQgRkFJTCAiJENPTlRST0wiICJhICQoKFRIUkVTSE9MRCAtIDEpKS1jaGFyYWN0ZXIgcGFzc3BocmFzZSB1c2luZyBldmVyeSBjaGFyYWN0ZXIgY2xhc3MgaXMgYWNjZXB0ZWQ7IGNyZWRpdHMgbG93ZXIgdGhlIG1pbmltdW0gKGFwcGx5IGRlYmlhbi0xMy1wd3F1YWxpdHktbm8tY29tcGxleGl0eSkiCmVsc2UKCXJlcG9ydCBQQVNTICIkQ09OVFJPTCIgIm5vdGhpbmcgc2hvcnRlciB0aGFuICRFRkZFQ1RJVkUgY2hhcmFjdGVycyBpcyBhY2NlcHRlZDsgJEFQUExJRVMgcmVxdWlyZXMgYXQgbGVhc3QgJFRIUkVTSE9MRCIKZmkKCmlmIFsgLXogIiRFRkZFQ1RJVkUiIF07IHRoZW4KCXJlcG9ydCBGQUlMICJtaW5sZW4iICJjYW5ub3QgY29tcGFyZSBjb25maWd1cmVkIG1pbmxlbiAkQ09ORklHVVJFRCB3aXRoIHRoZSBtaW5pbXVtIGluIGZvcmNlIgplbGlmIFsgIiRFRkZFQ1RJVkUiIC1uZSAiJENPTkZJR1VSRUQiIF07IHRoZW4KCXJlcG9ydCBGQUlMICJtaW5sZW4iICJjb25maWd1cmVkICRDT05GSUdVUkVEIGluICQoYmFzZW5hbWUgIiRNSU5FIiksIGJ1dCAkRUZGRUNUSVZFIGlzIGluIGZvcmNlOyBhbm90aGVyIGNvbmZpZ3VyYXRpb24gb3ZlcnJpZGVzIGl0IgplbHNlCglyZXBvcnQgUEFTUyAibWlubGVuIiAiY29uZmlndXJlZCAkQ09ORklHVVJFRCBpbiAkKGJhc2VuYW1lICIkTUlORSIpIGlzIHRoZSBtaW5pbXVtIGluIGZvcmNlIgpmaQoKZWNobwplY2hvICJwYXNzZWQ6ICRQQVNTX0NPVU5UICBmYWlsZWQ6ICRGQUlMX0NPVU5UIgpbICIkRkFJTF9DT1VOVCIgLWVxIDAgXSB8fCBleGl0IDEK"
          }
        },
        {
          "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
          "title": "ACSC ISM OSCAL catalogue v2026.09.4",
          "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v2026.09.4"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "e57bfd80-2a20-49e3-8feb-2bdfd7e81ccf",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality must be installed and enforcing, or nothing here is applied.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}