{
  "component-definition": {
    "uuid": "5a171151-a08d-42b5-9120-f32b54e255d1",
    "metadata": {
      "title": "Debian 13 ISM Predictable Construction Rules Component Definition",
      "last-modified": "2026-09-16T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "responsible-parties": [
        {
          "role-id": "system-administrator",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        },
        {
          "role-id": "system-security-officer",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        }
      ],
      "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.",
      "document-ids": [
        {
          "scheme": "https://ns.oscalops.net/component-definitions",
          "identifier": "debian-13-pwquality-predictability"
        }
      ],
      "props": [
        {
          "name": "assurance-state",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "technically-tested"
        },
        {
          "name": "assurance-authority",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none; self-asserted by the contributing author"
        },
        {
          "name": "endorsement",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none"
        },
        {
          "name": "publisher",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "library_component-definition contributors"
        },
        {
          "name": "publication-status",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "unpublished"
        },
        {
          "name": "artifact-slug",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "debian-13-pwquality-predictability"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-predictability/1.0.0/component-definition.json",
          "rel": "canonical",
          "text": "Reserved canonical URL; the registry is not yet published"
        }
      ]
    },
    "components": [
      {
        "uuid": "787b6f80-2be0-482c-a4d2-a2a34a9875f6",
        "type": "software",
        "title": "Debian 13 ISM Predictable Construction Rules",
        "description": "The limbs of ism-1558 that a character-level rule can enforce: monotonic runs (maxsequence), repeated characters (maxrepeat) and account-derived strings (usercheck, gecoscheck).\n\nThe word count itself is enforced by debian-13-pam-wordcount, and whether words were randomly selected is not something any available module can determine. Depends on debian-13-pwquality-base.\n\nThese are predictability constraints, not character-class complexity requirements, so they do not conflict with ism-2080.",
        "purpose": "Reject predictable passphrase constructions on local Debian accounts.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:maxrepeat"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:maxsequence"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:usercheck"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:usersubstr"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:gecoscheck"
          }
        ],
        "links": [
          {
            "href": "#fb64bf12-ed42-4f21-a0e4-46fbcb8cfc6b",
            "rel": "depends-on",
            "text": "pam_pwquality must be installed and enforcing"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "6b244643-df8e-4056-9deb-f55558c51789",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "The character-level limbs of the ISM word-sequence control, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "c0db7985-3646-4a14-a7cd-9c35c33182c0",
                "control-id": "ism-1558",
                "description": "Partially implemented. maxsequence = 4 rejects monotonic runs, maxrepeat = 3 rejects repeated characters, and usercheck, usersubstr and gecoscheck reject strings derived from the account itself.\n\nNOT ENFORCED here: the minimum word count, which debian-13-pam-wordcount enforces and which depends on this family. Nor is word provenance: a sequence of categorised words, a real sentence in natural language, and song lyrics or quotes all satisfy the rules above while being exactly what this control prohibits. Verified: all three are still accepted.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "narrower"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  },
                  {
                    "name": "residual-risk",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "Only the character-level limbs are enforced here. The word count is debian-13-pam-wordcount’s, and natural-language sentences, lyrics and categorised word lists remain accepted."
                  }
                ],
                "links": [
                  {
                    "href": "#80b0a78f-efc6-4579-8b30-a33db676a3e5",
                    "rel": "reference",
                    "text": "Predictability drop-in"
                  },
                  {
                    "href": "#bca6a4a6-fd1f-4501-af7d-9d66d1e07da8",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "80b0a78f-efc6-4579-8b30-a33db676a3e5",
          "title": "Predictable construction rules",
          "description": "maxrepeat, maxsequence, usercheck, usersubstr and gecoscheck, asserting part of ism-1558. Deploys to /etc/security/pwquality.conf.d/50-ism-predictability.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "config/pwquality.conf.d/50-ism-predictability.conf",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "ism-predictability.conf",
            "media-type": "text/plain",
            "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBwcmVkaWN0YWJsZSBjb25zdHJ1Y3Rpb25zCiMKIyBTb3VyY2U6IEFDU0MgSVNNIE9TQ0FMIGNhdGFsb2d1ZSB2MjAyNi4wOS40CiMgICBpc20tMTU1OCAgd29yZC1zZXF1ZW5jZSBjb21wb3NpdGlvbiBjb25zdHJhaW50cyAgICAgICAgICAgICAgICAgICAoYWxsKQojCiMgVGhlIGxpbWJzIG9mIGlzbS0xNTU4IHRoYXQgYSBjaGFyYWN0ZXItbGV2ZWwgcnVsZSBjYW4gZW5mb3JjZTogbW9ub3RvbmljIHJ1bnMsCiMgcmVwZWF0ZWQgY2hhcmFjdGVycywgYW5kIHN0cmluZ3MgZGVyaXZlZCBmcm9tIHRoZSBhY2NvdW50IGl0c2VsZi4gVGhlIHdvcmQgY291bnQKIyBpcyBlbmZvcmNlZCBieSBkZWJpYW4tMTMtcGFtLXdvcmRjb3VudCwgYW5kIHdoZXRoZXIgd29yZHMgd2VyZSByYW5kb21seSBzZWxlY3RlZAojIGlzIG5vdCBzb21ldGhpbmcgYW55IGF2YWlsYWJsZSBtb2R1bGUgY2FuIGRldGVybWluZS4KIwojIFRoZXNlIGFyZSBwcmVkaWN0YWJpbGl0eSBjb25zdHJhaW50cywgbm90IGNoYXJhY3Rlci1jbGFzcyBjb21wbGV4aXR5CiMgcmVxdWlyZW1lbnRzLCBzbyB0aGV5IGRvIG5vdCBjb25mbGljdCB3aXRoIGlzbS0yMDgwLgojCiMgSW5zdGFsbCB0byAvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvNTAtaXNtLXByZWRpY3RhYmlsaXR5LmNvbmYKCiMgbWF4cmVwZWF0IGJsb2NrcyAiYWFhYS4uLiIsIG1heHNlcXVlbmNlIGJsb2NrcyAiYWJjZGVmZ2giIC8gIjEyMzQ1Njc4IiBydW5zLgptYXhyZXBlYXQgPSAzCm1heHNlcXVlbmNlID0gNAoKIyBSZWplY3QgYSBwYXNzcGhyYXNlIGNvbnRhaW5pbmcgdGhlIHVzZXIncyBvd24gbmFtZSBvciBsb2dpbiwgd2hpY2ggaXMgbmVpdGhlcgojIHJhbmRvbSBub3Igc2VjcmV0Lgp1c2VyY2hlY2sgPSAxCnVzZXJzdWJzdHIgPSA0CmdlY29zY2hlY2sgPSAxCg=="
          }
        },
        {
          "uuid": "5c484091-3463-47e6-9803-8d952736177e",
          "title": "Apply script",
          "description": "Installs 50-ism-predictability.conf. Refuses to run unless pam_pwquality is already in the password stack.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/apply-predictability.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "apply-predictability.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgQXBwbHkgdGhlIGlzbS0xNTU4IGxpbWJzIGEgY2hhcmFjdGVyLWxldmVsIHJ1bGUgY2FuIGVuZm9yY2Ugb24gYSBEZWJpYW4gMTMgKHRyaXhpZSkgaG9zdDogbW9ub3RvbmljIHJ1bnMsIHJlcGVhdGVkIGNoYXJhY3RlcnMgYW5kIGFjY291bnQtZGVyaXZlZCBzdHJpbmdzLiBUaGUgd29yZCBjb3VudCBpcyBkZWJpYW4tMTMtcGFtLXdvcmRjb3VudCdzLgojCiMgUmVxdWlyZXMgZGViaWFuLTEzLXB3cXVhbGl0eS1iYXNlOiBwYW1fcHdxdWFsaXR5IG11c3QgYWxyZWFkeSBiZSBpbnN0YWxsZWQgYW5kIGluCiMgdGhlIHBhc3N3b3JkIHN0YWNrLCBvciBub3RoaW5nIHRoaXMgY29tcG9uZW50IGNvbmZpZ3VyZXMgaXMgZW5mb3JjZWQuIFRoaXMgc2NyaXB0CiMgaW5zdGFsbHMgb25lIGRyb3AtaW4gYW5kIGNoYW5nZXMgbm90aGluZyBlbHNlLgojCiMgVXNhZ2U6IGFwcGx5LXByZWRpY3RhYmlsaXR5LnNoCiMgSWRlbXBvdGVudDogc2FmZSB0byByZS1ydW4uCgpzZXQgLWV1CgpbICIkKGlkIC11KSIgLWVxIDAgXSB8fCB7IGVjaG8gImVycm9yOiBtdXN0IHJ1biBhcyByb290IiA+JjI7IGV4aXQgMTsgfQoKQkFTRV9ESVI9IiQoQ0RQQVRIPSBjZCAtLSAiJChkaXJuYW1lIC0tICIkMCIpLy4uIiAmJiBwd2QpIgpEUk9QSU49NTAtaXNtLXByZWRpY3RhYmlsaXR5LmNvbmYKCmdyZXAgLXFFICdeW14jXSpwYW1fcHdxdWFsaXR5XC5zbycgL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQgfHwgewoJZWNobyAiZXJyb3I6IHJlcXVpcmVzIGRlYmlhbi0xMy1wd3F1YWxpdHktYmFzZTogcGFtX3B3cXVhbGl0eS5zbyBpcyBub3QgaW4gL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQsIiA+JjIKCWVjaG8gIiAgICAgICBzbyBub3RoaW5nIHRoaXMgY29tcG9uZW50IGNvbmZpZ3VyZXMgd291bGQgYmUgZW5mb3JjZWQuIiA+JjIKCWV4aXQgMQp9CgplY2hvICI9PT4gaW5zdGFsbGluZyAkRFJPUElOIgppbnN0YWxsIC1kIC1tIDA3NTUgL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kCmluc3RhbGwgLW0gMDY0NCAiJEJBU0VfRElSL2NvbmZpZy9wd3F1YWxpdHkuY29uZi5kLyREUk9QSU4iICIvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvJERST1BJTiIKCmVjaG8gIj09PiBhcHBsaWVkLiBWZXJpZnkgd2l0aDogc2NyaXB0cy92ZXJpZnktcHJlZGljdGFiaWxpdHkuc2giCg=="
          }
        },
        {
          "uuid": "bca6a4a6-fd1f-4501-af7d-9d66d1e07da8",
          "title": "Verification script",
          "description": "Asserts the control from behaviour, with every candidate padded to the minimum length in force, and reports separately if another configuration sets a setting this component owns.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/verify-predictability.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "verify-predictability.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoZSBpc20tMTU1OCBsaW1icyBhIGNoYXJhY3Rlci1sZXZlbCBydWxlIGNhbiBlbmZvcmNlLCBvbiBhIERlYmlhbiAxMyBob3N0OgojIG1vbm90b25pYyBydW5zLCByZXBlYXRlZCBjaGFyYWN0ZXJzIGFuZCBhY2NvdW50LWRlcml2ZWQgc3RyaW5ncy4gVGhlIHdvcmQgY291bnQgaXMKIyBlbmZvcmNlZCBieSBkZWJpYW4tMTMtcGFtLXdvcmRjb3VudCwgYW5kIHdvcmQgcHJvdmVuYW5jZSBieSBub3RoaW5nLgojCiMgRXZlcnkgY2FuZGlkYXRlIGlzIHBhZGRlZCB0byB0aGUgbWluaW11bSBsZW5ndGggaW4gZm9yY2UsIG1lYXN1cmVkIHJhdGhlciB0aGFuCiMgcmVhZCwgc28gYSByZWplY3Rpb24gaXMgbmV2ZXIgZm9yIGxlbmd0aCB3aGVuIHRoaXMgcnVsZSBpcyB1bmRlciB0ZXN0LiBTZXR0aW5ncwojIHRoaXMgY29tcG9uZW50IG93bnMgYmVpbmcgc2V0IGVsc2V3aGVyZSBpcyByZXBvcnRlZCBzZXBhcmF0ZWx5LCBhcyBhIGNvbmZsaWN0LgojCiMgVXNlcyBwd3Njb3JlKDEpLiBObyBhY2NvdW50IGlzIGNyZWF0ZWQgb3IgbW9kaWZpZWQsIHNvIHRoaXMgaXMgc2FmZSBvbiBhCiMgcHJvZHVjdGlvbiBob3N0LgoKc2V0IC11CgpQQVNTX0NPVU5UPTAKRkFJTF9DT1VOVD0wClBBUlRJQUxfQ09VTlQ9MAoKcmVwb3J0KCkgewoJY2FzZSAiJDEiIGluCgkJUEFTUykgUEFTU19DT1VOVD0kKChQQVNTX0NPVU5UICsgMSkpIDs7CgkJUEFSVElBTCkgUEFSVElBTF9DT1VOVD0kKChQQVJUSUFMX0NPVU5UICsgMSkpIDs7CgkJKikgRkFJTF9DT1VOVD0kKChGQUlMX0NPVU5UICsgMSkpIDs7Cgllc2FjCglwcmludGYgJyUtOHMgJS0xM3MgJXNcbicgIiQxIiAiJDIiICIkMyIKfQoKYWNjZXB0cygpIHsgcHJpbnRmICclcycgIiQxIiB8IHB3c2NvcmUgPi9kZXYvbnVsbCAyPiYxOyB9Cgpjb21tYW5kIC12IHB3c2NvcmUgPi9kZXYvbnVsbCAyPiYxIHx8IHsgZWNobyAiZXJyb3I6IHB3c2NvcmUgbm90IGZvdW5kOyBpbnN0YWxsIGxpYnB3cXVhbGl0eS10b29scyIgPiYyOyBleGl0IDE7IH0KCk1JTkU9L2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLzUwLWlzbS1wcmVkaWN0YWJpbGl0eS5jb25mClsgLWYgIiRNSU5FIiBdIHx8IHsgZWNobyAiZXJyb3I6ICRNSU5FIGlzIG5vdCBpbnN0YWxsZWQ7IHJ1biB0aGUgYXBwbHkgc2NyaXB0IiA+JjI7IGV4aXQgMTsgfQoKRklMTEVSPXZhdWx0b3R0ZXJtYW5nb3F1aWx0cmF2ZW5mam9yZHplYnJhcGxpbnRod2lkZ2V0Y2FyYm9uaGVsaXhqdW5pcGVybWFycm93CnNsaWNlKCkgeyBwcmludGYgJyVzJXMnICIkRklMTEVSIiAiJEZJTExFUiIgfCBjdXQgLWMxLSIkMSI7IH0KCkZMT09SPQpuPTEKd2hpbGUgWyAiJG4iIC1sZSAxMjggXTsgZG8KCWlmIGFjY2VwdHMgIiQoc2xpY2UgIiRuIikiOyB0aGVuIEZMT09SPSRuOyBicmVhazsgZmkKCW49JCgobiArIDEpKQpkb25lCjogIiR7RkxPT1I6PTZ9IgoKZWNobyAiTWluaW11bSBpbiBmb3JjZTogJEZMT09SIGNoYXJhY3RlcnMiCmVjaG8KClNFUV9PSz0wCmFjY2VwdHMgIiQoc2xpY2UgJCgoRkxPT1IgLSA2KSkpYWJjZGVmZ2giIHx8IFNFUV9PSz0xClJFUF9PSz0wCmFjY2VwdHMgIiQoc2xpY2UgJCgoRkxPT1IgLSA1KSkpYWFhYWFhIiB8fCBSRVBfT0s9MQoKIyBOYXR1cmFsIGxhbmd1YWdlIHNhdGlzZmllcyBldmVyeSBydWxlIGhlcmUgd2hpbGUgYmVpbmcgd2hhdCB0aGUgY29udHJvbAojIHByb2hpYml0cywgc28gaXQgaXMgbWVhc3VyZWQgYW5kIHJlcG9ydGVkIHJhdGhlciB0aGFuIGFzc3VtZWQgY2xvc2VkLgpFTElHSUJMRT0wClVOQ0FVR0hUPTAKZm9yIHBocmFzZSBpbiAidGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZyIgXAoJIndlIGFsbCBsaXZlIGluIGEgeWVsbG93IHN1Ym1hcmluZSB5ZWxsb3cgc3VibWFyaW5lIiBcCgkibW9uZGF5IHR1ZXNkYXkgd2VkbmVzZGF5IHRodXJzZGF5IGZyaWRheSBzYXR1cmRheSI7IGRvCglbICIkeyNwaHJhc2V9IiAtZ2UgIiRGTE9PUiIgXSB8fCBjb250aW51ZQoJRUxJR0lCTEU9JCgoRUxJR0lCTEUgKyAxKSkKCWFjY2VwdHMgIiRwaHJhc2UiICYmIFVOQ0FVR0hUPSQoKFVOQ0FVR0hUICsgMSkpCmRvbmUKCmlmIFsgIiRTRVFfT0siIC1lcSAxIF0gJiYgWyAiJFJFUF9PSyIgLWVxIDEgXTsgdGhlbgoJcmVwb3J0IFBBUlRJQUwgImlzbS0xNTU4IiBcCgkJIm1vbm90b25pYyBzZXF1ZW5jZXMgYW5kIHJlcGVhdHMgcmVqZWN0ZWQ7ICRVTkNBVUdIVC8kRUxJR0lCTEUgbmF0dXJhbC1sYW5ndWFnZSBjb25zdHJ1Y3Rpb25zIGFjY2VwdGVkOyB3b3JkIGNvdW50IGlzIG5vdCBlbmZvcmNlZCBoZXJlIgplbHNlCglyZXBvcnQgRkFJTCAiaXNtLTE1NTgiICJtb25vdG9uaWMgc2VxdWVuY2UgYW5kL29yIHJlcGVhdCBydWxlcyBhcmUgbm90IGVuZm9yY2VkIgpmaQoKT1ZFUlJJREVTPScnCmZvciBmIGluIC9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYgL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLyouY29uZjsgZG8KCVsgLWYgIiRmIiBdICYmIFsgIiRmIiAhPSAiJE1JTkUiIF0gfHwgY29udGludWUKCWZvciBrZXkgaW4gbWF4cmVwZWF0IG1heHNlcXVlbmNlIHVzZXJjaGVjayB1c2Vyc3Vic3RyIGdlY29zY2hlY2s7IGRvCgkJZ3JlcCAtcUUgIl5bWzpzcGFjZTpdXSoka2V5KFtbOnNwYWNlOl1dKj18W1s6c3BhY2U6XV0qXCQpIiAiJGYiICYmCgkJCU9WRVJSSURFUz0iJE9WRVJSSURFUyAka2V5KCQoYmFzZW5hbWUgIiRmIikpIgoJZG9uZQpkb25lClsgLXogIiRPVkVSUklERVMiIF0gJiYKCXJlcG9ydCBQQVNTICJzZXR0aW5ncyIgInRoZSBzZXR0aW5ncyB0aGlzIGNvbXBvbmVudCBvd25zIGFyZSBzZXQgaGVyZSBhbmQgbm93aGVyZSBlbHNlIiB8fAoJcmVwb3J0IEZBSUwgInNldHRpbmdzIiAic2V0dGluZ3MgdGhpcyBjb21wb25lbnQgb3ducyBhcmUgYWxzbyBzZXQgZWxzZXdoZXJlOiRPVkVSUklERVMiCgplY2hvCmVjaG8gInBhc3NlZDogJFBBU1NfQ09VTlQgIHBhcnRpYWw6ICRQQVJUSUFMX0NPVU5UICBmYWlsZWQ6ICRGQUlMX0NPVU5UIgpbICIkRkFJTF9DT1VOVCIgLWVxIDAgXSB8fCBleGl0IDEK"
          }
        },
        {
          "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
          "title": "ACSC ISM OSCAL catalogue v2026.09.4",
          "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v2026.09.4"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "fb64bf12-ed42-4f21-a0e4-46fbcb8cfc6b",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality must be installed and enforcing, or nothing here is applied.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}