OSCAL specification should be auto-generated in other formats

[redhatrises]

User Story:

As an OSCAL developer, maintainer, new member, potential member, new user, etc. and a follow on to #203, I would want the OSCAL schema to be auto-generated in other formats such as XML, JSON, and YAML. This would allow OSCAL to broaden its audience and reach in the community. It would also allow developers, users, and vendors to use their preferred format-of-choice which would further OSCAL's usage and development as well as adoption and usage.

Goals:

Auto-generate all OSCAL schema outputs (XML, JSON, YAML, future, etc.) and eliminate the need to create the OSCAL spec in X language(s). This could be something equivalent to make release which then gets pushed to schema repository automatically.

Dependencies:

#203 should be resolved first.

Acceptance Criteria

Describe what must be completed for this issue to be resolved.

[david-waltermire]

@redhatrises We are working on a metaschema implementation (#186, #193, #202), which allows us to generate XML and JSON schema, XML and JSON schema documentation, and converters capable of round-tripping between XML and JSON. This work is laying the foundation to support additional formats in the future using the same general approach. We are currently working to migrate to this metaschema approach, which will be a big time savings going forward and will help to ensure that all formats and documentation stay in sync, which has been growing a problem for us.

If you are interested in this work, we are working on the metaschema in PR #201.

[david-waltermire]

We are also making sure that metaschema utilities that generate XML and JSON schema, and documentation are scriptable, allowing a CI/CD system to generate these automatically.

[shawndwells]

Reviewed the metaschema utilities and don't see how they're useful. XML and JSON are output formats, not input.

The example profiles such as FedRAMP High (https://github.com/usnistgov/OSCAL/blob/master/examples/FedRAMP/FedRAMP_HIGH-baseline_profile.xml are 5,000 lines long. Is it really expected people will create 5,000 line profiles from scratch, in XML?

-edit-
For example, in trying to create the DHS 4300A profile, I have to constantly scroll up and down in the file, copy and paste things around -- it's completely off putting. Having to do this for dozens of agencies easily means maintaining 100,000 lines of code or more. All by hand.

[david-waltermire]

@shawndwells This issue is not about input/output formats. Its about generating schema for supported formats. We should move this conversation to #203, which is about defining alternate editor friendly formats.

The FedRAMP profiles were generated out of a database. They are too large and complex in what they need to do to generated by hand.

FWIW, I agree that editing a complex profile by hand in XML, JSON, YAML or any other machine parsable format is not ideal or even workable. The OSCAL community needs tooling to help with this that outputs the profile in a supported format. Maybe you could work on something like this?

[david-waltermire]

This is a duplicate of #68.