Debian 13 OpenSCAP content unavailable in Trixie ssg-debian package

Description

On Debian 13 (Trixie), PatchMon initially reports:

No SCAP content found for debian 13.

The stable Trixie package:

ssg-debian 0.1.76-1

installs Debian 11 and Debian 12 SCAP content, but does not provide:

ssg-debian13-ds.xml

The newer Debian sid package tested here contains Debian 13 SCAP content.

Environment

Tested on:

- Debian 13 / Trixie

- openscap-scanner 1.4.2+dfsg-1

- ssg-base 0.1.76-1

- Debian 13 SSG content from newer ssg-debian package 0.1.82-1 content)

The Debian 13 content was extracted from the sid package without upgrading the host to sid.

Debian 13 content

The newer SSG package provides:

/usr/share/xml/scap/ssg/content/ssg-debian13-ds.xml

OpenSCAP 1.4.2 was able to read the Debian 13 Source DataStream and expose profiles including:

- CIS Debian Benchmark for Level 1 - Server

- CIS Debian Benchmark for Level 2 - Server

- CIS Debian Benchmark for Level 1 - Workstation

- CIS Debian Benchmark for Level 2 - Workstation

- ANSSI-BP-028 profiles

- Standard System Security Profile for Debian 13

The DataStream and profiles were successfully detected by OpenSCAP. :chatgpt-content-reference{index="0"}

Successful test

A real CIS Level 1 Server evaluation was executed with:

xccdf_org.ssgproject.content_profile_cis_level1_server

The scan started successfully and evaluated Debian 13 rules with real pass, fail, notapplicable, notchecked, and error results. :chatgpt-content-reference{index="1"}

After copying the Debian 13 SSG content into:

/usr/share/xml/scap/ssg/content/

PatchMon successfully detected Debian 13 and ran the compliance scan.

Example result from the test host:

- Passed: 233

- Failed: 121

- Skipped: 423

- Scanner: OpenSCAP

- Profile: CIS Level 1 Server

Additional note

The DataStream references the Debian Trixie security OVAL resource remotely:

https://www.debian.org/security/oval/oval-definitions-trixie.xml.bz2

Without --fetch-remote-resources, OpenSCAP warns that this remote file is skipped. :chatgpt-content-reference{index="2"}

Suggested improvement

PatchMon could improve Debian 13 support by:

- detecting when OpenSCAP is installed but matching SCAP content is missing;

- distinguishing missing/unsupported content from a generic scanner error;

- documenting a supported method for installing newer SSG content independently of Debian stable package versions;

- optionally supporting managed/downloaded SCAP content separately from the distribution package;

- avoiding any silent fallback from Debian 13 to Debian 12 content.

This would make Debian 13 compliance setup clearer and safer while Debian stable packaging catches up.