Calling controls by match pattern and ID, both together.

[wendellpiez]

User Story:

Due to schema limitations, currently it is not possible to combine, in a single profile, calls on controls by their IDs, with calls to controls based on ID matching.

For example this is not valid to the profile model:

<import href="catalog.xml">
  <include>
    <call control-id="ac-1"/>
    <match pattern="at.*"/>
  </include>
</import>

Goals:

Make it possible to use both selection by (literal) ID, along with selection by matching, calling a single catalog in a profile.

This could be permitted via parallel imports; permitting more than one include to appear in an import statement, or relaxing the model of include.

Dependencies:

Stable demonstration and testing of profile functionality (#508).

Acceptance Criteria

• All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
• The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[david-waltermire]

@wendellpiez I'd like to discuss this with you in regards to any changes that might need to be made in RC2 to make this possible now or in the future. We need to consider making sure this change will not break backwards compatibility.

[wendellpiez]

@david-waltermire-nist agreed. Allowing include to have call*, match* instead of (call* | match*), for example, would be backward compatible as well as forward-compatible with an eventual (call|match)* model.

[david-waltermire]

This was slated for 1.1, but is going to be made possible based on the refactoring from #845. This means we can address this in RC2.