From 179a69b0e8c1cd05bb2dc738227f261d740d797d Mon Sep 17 00:00:00 2001
From: David Waltermire <david.waltermire@gsa.gov>
Date: Sun, 10 Nov 2024 21:46:22 -0500
Subject: [PATCH 1/2] Use correct digest character lengths. Fixes #2053

---
 src/metaschema/oscal_metadata_metaschema.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/metaschema/oscal_metadata_metaschema.xml b/src/metaschema/oscal_metadata_metaschema.xml
index f29d69d4be..02e822f4d1 100644
--- a/src/metaschema/oscal_metadata_metaschema.xml
+++ b/src/metaschema/oscal_metadata_metaschema.xml
@@ -940,10 +940,10 @@
             </remarks>
         </define-flag>
         <constraint>
-            <matches target=".[@algorithm=('SHA-224','SHA3-224')]" regex="^[0-9a-fA-F]{28}$"/>
-            <matches target=".[@algorithm=('SHA-256','SHA3-256')]" regex="^[0-9a-fA-F]{32}$"/>
-            <matches target=".[@algorithm=('SHA-384','SHA3-384')]" regex="^[0-9a-fA-F]{48}$"/>
-            <matches target=".[@algorithm=('SHA-512','SHA3-512')]" regex="^[0-9a-fA-F]{64}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-224" target=".[@algorithm=('SHA-224','SHA3-224')]" regex="^[0-9a-fA-F]{56}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-256" target=".[@algorithm=('SHA-256','SHA3-256')]" regex="^[0-9a-fA-F]{64}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-384" target=".[@algorithm=('SHA-384','SHA3-384')]" regex="^[0-9a-fA-F]{96}$"/>
+            <matches id="oscal-check-hash-length-SHA2-3-512" target=".[@algorithm=('SHA-512','SHA3-512')]" regex="^[0-9a-fA-F]{128}$"/>
         </constraint>
     </define-field>
 

From 7fce8b1219bc4d873d649eda7d8327871937f616 Mon Sep 17 00:00:00 2001
From: RS-Credentive <robert.sherwood@credentive.com>
Date: Mon, 5 Aug 2024 09:21:10 +0000
Subject: [PATCH 2/2] Fix Datatype references

---
 .../oscal_assessment-common_metaschema.xml     | 18 +++++++++---------
 .../oscal_assessment-results_metaschema.xml    |  8 ++++----
 .../oscal_implementation-common_metaschema.xml |  6 +++---
 src/metaschema/oscal_metadata_metaschema.xml   | 12 ++++++------
 4 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/src/metaschema/oscal_assessment-common_metaschema.xml b/src/metaschema/oscal_assessment-common_metaschema.xml
index 137b3a2932..3a3b34144b 100644
--- a/src/metaschema/oscal_assessment-common_metaschema.xml
+++ b/src/metaschema/oscal_assessment-common_metaschema.xml
@@ -243,7 +243,7 @@
                   <define-assembly name="on-date" min-occurs="1">
                      <formal-name>On Date Condition</formal-name>
                      <description>The task is intended to occur on the specified date.</description>
-                     <define-flag name="date" as-type="dateTime-with-timezone" required="yes">
+                     <define-flag name="date" as-type="date-time-with-timezone" required="yes">
                         <formal-name>On Date Condition</formal-name>
                         <description>The task must occur on the specified date.</description>
                      </define-flag>
@@ -251,11 +251,11 @@
                   <define-assembly name="within-date-range" min-occurs="1">
                      <formal-name>On Date Range Condition</formal-name>
                      <description>The task is intended to occur within the specified date range.</description>
-                     <define-flag name="start" as-type="dateTime-with-timezone" required="yes">
+                     <define-flag name="start" as-type="date-time-with-timezone" required="yes">
                         <formal-name>Start Date Condition</formal-name>
                         <description>The task must occur on or after the specified date.</description>
                      </define-flag>
-                     <define-flag name="end" as-type="dateTime-with-timezone" required="yes">
+                     <define-flag name="end" as-type="date-time-with-timezone" required="yes">
                         <formal-name>End Date Condition</formal-name>
                         <description>The task must occur on or before the specified date.</description>
                      </define-flag>
@@ -263,7 +263,7 @@
                   <define-assembly name="at-frequency" min-occurs="1">
                      <formal-name>Frequency Condition</formal-name>
                      <description>The task is intended to occur at the specified frequency.</description>
-                     <define-flag name="period" as-type="positiveInteger" required="yes">
+                     <define-flag name="period" as-type="positive-integer" required="yes">
                         <formal-name>Period</formal-name>
                         <description>The task must occur after the specified period has elapsed.</description>
                      </define-flag>
@@ -948,11 +948,11 @@
                <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
             </model>
          </define-assembly>
-         <define-field name="collected" as-type="dateTime-with-timezone" min-occurs="1" max-occurs="1">
+         <define-field name="collected" as-type="date-time-with-timezone" min-occurs="1" max-occurs="1">
             <formal-name>Collected Field</formal-name>
             <description>Date/time stamp identifying when the finding information was collected.</description>
          </define-field>
-         <define-field name="expires" as-type="dateTime-with-timezone" min-occurs="0" max-occurs="1">
+         <define-field name="expires" as-type="date-time-with-timezone" min-occurs="0" max-occurs="1">
             <formal-name>Expires Field</formal-name>
             <description>Date/time identifying when the finding information is out-of-date and no longer valid. Typically used with continuous assessment scenarios.</description>
          </define-field>
@@ -1191,7 +1191,7 @@
             </model>
          </define-assembly>
 
-         <define-field name="deadline" as-type="dateTime-with-timezone">
+         <define-field name="deadline" as-type="date-time-with-timezone">
             <formal-name>Risk Resolution Deadline</formal-name>
             <description>The date/time by which the risk must be resolved.</description>
          </define-field>
@@ -1221,11 +1221,11 @@
                         <formal-name>Risk Task Description</formal-name>
                         <description>A human-readable description of what was done regarding the risk.</description>
                      </define-field>
-                     <define-field name="start" as-type="dateTime-with-timezone" min-occurs="1" max-occurs="1">
+                     <define-field name="start" as-type="date-time-with-timezone" min-occurs="1" max-occurs="1">
                         <formal-name>Start</formal-name>
                         <description>Identifies the start date and time of the event.</description>
                      </define-field>
-                     <define-field name="end" as-type="dateTime-with-timezone" max-occurs="1">
+                     <define-field name="end" as-type="date-time-with-timezone" max-occurs="1">
                         <formal-name>End</formal-name>
                         <description>Identifies the end date and time of the event. If the event is a point in time, the start and end will be the same date and time.</description>
                      </define-field>
diff --git a/src/metaschema/oscal_assessment-results_metaschema.xml b/src/metaschema/oscal_assessment-results_metaschema.xml
index 405f4594b9..d32327f5be 100644
--- a/src/metaschema/oscal_assessment-results_metaschema.xml
+++ b/src/metaschema/oscal_assessment-results_metaschema.xml
@@ -80,11 +80,11 @@
         <description>A human-readable description of this set of test results.</description>
       </define-field>
 
-      <define-field name="start" as-type="dateTime-with-timezone" min-occurs="1" max-occurs="1">
+      <define-field name="start" as-type="date-time-with-timezone" min-occurs="1" max-occurs="1">
         <formal-name>start field</formal-name>
         <description>Date/time stamp identifying the start of the evidence collection reflected in these results.</description>
       </define-field>
-      <define-field name="end" as-type="dateTime-with-timezone" max-occurs="1">
+      <define-field name="end" as-type="date-time-with-timezone" max-occurs="1">
         <formal-name>end field</formal-name>
         <description>Date/time stamp identifying the end of the evidence collection reflected in these results. In a continuous motoring scenario, this may contain the same value as start if appropriate.</description>
       </define-field>
@@ -205,11 +205,11 @@
                 <formal-name>Action Description</formal-name>
                 <description>A human-readable description of this event.</description>
               </define-field>
-              <define-field name="start" as-type="dateTime-with-timezone" min-occurs="1" max-occurs="1">
+              <define-field name="start" as-type="date-time-with-timezone" min-occurs="1" max-occurs="1">
                 <formal-name>Start</formal-name>
                 <description>Identifies the start date and time of an event.</description>
               </define-field>
-              <define-field name="end" as-type="dateTime-with-timezone" max-occurs="1">
+              <define-field name="end" as-type="date-time-with-timezone" max-occurs="1">
                 <formal-name>End</formal-name>
                 <description>Identifies the end date and time of an event. If the event is a point in time, the start and end will be the same date and time.</description>
               </define-field>
diff --git a/src/metaschema/oscal_implementation-common_metaschema.xml b/src/metaschema/oscal_implementation-common_metaschema.xml
index c9eaebbfd9..0ca2aec2f0 100644
--- a/src/metaschema/oscal_implementation-common_metaschema.xml
+++ b/src/metaschema/oscal_implementation-common_metaschema.xml
@@ -210,7 +210,7 @@
                         <enum value="isa-authorizing-official-local">Interconnection Security Agreement (ISA) authorizing official for this system.</enum>
                         <enum value="isa-authorizing-official-remote">Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system.</enum>
                   </allowed-values>
-                  <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='isa-date']/@value" datatype="dateTime"/>
+                  <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='isa-date']/@value" datatype="date-time"/>
                   <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv4-address']/@value" datatype="ip-v4-address" />
                   <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv6-address']/@value" datatype="ip-v6-address" />
                   <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='direction']/@value">
@@ -280,14 +280,14 @@
       <define-assembly name="port-range">
             <formal-name>Port Range</formal-name>
             <description>Where applicable this is the IPv4 port range on which the service operates.</description>
-            <define-flag name="start" as-type="nonNegativeInteger">
+            <define-flag name="start" as-type="non-negative-integer">
                   <formal-name>Start</formal-name>
                   <description>Indicates the starting port number in a port range</description>
                   <remarks>
                         <p>Should be a number within a permitted range</p>
                   </remarks>
             </define-flag>
-            <define-flag name="end" as-type="nonNegativeInteger">
+            <define-flag name="end" as-type="non-negative-integer">
                   <formal-name>End</formal-name>
                   <description>Indicates the ending port number in a port range</description>
                   <remarks>
diff --git a/src/metaschema/oscal_metadata_metaschema.xml b/src/metaschema/oscal_metadata_metaschema.xml
index 02e822f4d1..fcc0ec58b0 100644
--- a/src/metaschema/oscal_metadata_metaschema.xml
+++ b/src/metaschema/oscal_metadata_metaschema.xml
@@ -554,7 +554,7 @@
                         </remarks>
                     </define-assembly>
 
-                    <define-field name="base64" as-type="base64Binary">
+                    <define-field name="base64" as-type="base64">
                         <formal-name>Base64</formal-name>
                         <description>A resource encoded using the Base64 alphabet defined by <a href="https://www.rfc-editor.org/rfc/rfc2045.html">RFC 2045</a>.</description>
                         <json-value-key>value</json-value-key>
@@ -573,7 +573,7 @@
                         <enum value="version">For resources representing a published document, this represents the version number of that document.</enum>
                         <enum value="published">For resources representing a published document, this represents the publication date of that document.</enum>
                     </allowed-values>
-                    <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='published']/@value" datatype="dateTime-with-timezone"/>
+                    <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='published']/@value" datatype="date-time-with-timezone"/>
                     <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value">
                         <!-- More general. Applies across all models. -->
                         <enum value="logo">Indicates the resource is an organization's logo.</enum>
@@ -836,7 +836,7 @@
             <formal-name>Action Universally Unique Identifier</formal-name>
             <description>A unique identifier that can be used to reference this defined action elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document.</description>
         </define-flag>
-        <define-flag name="date" as-type="dateTime-with-timezone">
+        <define-flag name="date" as-type="date-time-with-timezone">
             <formal-name>Action Occurrence Date</formal-name>
             <description>The date and time when the action occurred.</description>
         </define-flag>
@@ -973,7 +973,7 @@
     <!-- #################### -->
     <!-- # Local constructs # -->
     <!-- #################### -->
-    <define-field name="published" as-type="dateTime-with-timezone" scope="local">
+    <define-field name="published" as-type="date-time-with-timezone" scope="local">
         <formal-name>Publication Timestamp</formal-name>
         <description>The date and time the document was last made available.</description>
         <remarks>
@@ -983,7 +983,7 @@
         </remarks>
     </define-field>
 
-    <define-field name="last-modified" as-type="dateTime-with-timezone" scope="local">
+    <define-field name="last-modified" as-type="date-time-with-timezone" scope="local">
         <formal-name>Last Modified Timestamp</formal-name>
         <description>The date and time the document was last stored for later retrieval.</description>
         <remarks>
@@ -1010,7 +1010,7 @@
         </remarks>
     </define-field>
 
-    <define-field name="email-address" as-type="email" scope="local">
+    <define-field name="email-address" as-type="email-address" scope="local">
         <formal-name>Email Address</formal-name>
         <description>An email address as defined by <a
                 href="https://tools.ietf.org/html/rfc5322#section-3.4.1">RFC 5322 Section