OSCAL YAML: 1.1 or 1.2?

[aj-stein-nist]

When reviewing #1265, I was thinking about the table indicating acceptable boolean values for different data model formats, with an eye to YAML in particular.

So, are being explicit or not about what version of YAML is recommended or required for use in OSCAL as OSCAL YAML?

The YAML 1.1 specification has a looser interpretation of boolean type as discussed in this StackOverflow post.

It depends ;-)

In YAML 1.1 the bool type is defined as following:

A Boolean represents a true/false value. Booleans are formatted as English words (“true”/“false”, “yes”/“no” or “on”/“off”) for readability and may be abbreviated as a single character “y”/“n” or “Y”/“N”.

In YAML 1.2 the bool type is defined as following:

Booleans: [ true, True, false, FALSE ]

I wanted to throw this out here because we have casually discussed it before, but I have not seen someone in the user community ask. I expected them to, so thought it was worth a clearer answer in the forum and/or eventually the documentation. :-)

[aj-stein-nist]

I am going to follow up later today after discussing with @david-waltermire-nist and @wendellpiez. I want to look into some come YAML libraries (Dave looked into his use of SnakeYAML for YAML 1.1, as opposed to SnakeYAML Engine for YAML 1.2 support and their coverage). We will circle back to what we have for our implementations and what is reasonable for current and future work.