Make the datastream's OVAL reference sources say Custom, and gate it

[stevebeattie]

Problem

Five OVAL definitions embedded in the datastream carried
<reference source="CIS"/> while every standalone file said Custom — and
two embedded blocks said Custom too. So the datastream disagreed both with its
sources and with itself.

Custom is the intended value — this is a missed hand-sync, not a judgement call

Commit 3f69d3f ("All of the formatting", 2025-07-18) deliberately changed
exactly these five references from CIS to Custom in the standalone files. It
touched the datastream in the same commit — 3402 lines — and left its
reference sources alone. The standalone value has been Custom ever since.

Supporting evidence: the elements carry no ref_id, and these are
Chainguard-authored checks for a DISA GPOS SRG profile rather than CIS benchmark
content, so CIS asserted a provenance that was not real.

This is the second confirmed instance of the same failure class as
openssh-sftp-server in #162: a change applied to the standalone files and not
to the datastream.

Is it user-visible?

Partly, and worth being precise about — I tested rather than assumed:

Surface	CIS present?
oscap HTML report	no (0 occurrences)
machine-readable results XML from a scan	yes
the published datastream itself	yes

No scan verdict changes. But it reaches the compliance evidence a customer
retains, and the shipped content.

Change

Convert the five, and close the gate behind them: descriptive differences in
the mirror check now fail rather than being logged.

That exemption existed only because these five instances did — failing on a
difference that changes no verdict would have meant disabling the check instead
of fixing content. With the content fixed, the exemption goes, so this class
cannot drift back in silently.

Verification

• No CIS values remain anywhere in the repo; datastream and standalone files
  now both report Custom exclusively.
• Mirror check: zero descriptive differences across all 8 files.
• Reintroducing a single CIS now fails the check, naming the file and
  definition — confirmed by mutation, then reverted.
• gofmt/go vet clean, validate_checks passes, sds-validate rc=0, and
  oscap xccdf validate reports the same 235 pre-existing errors as main.

🤖 Generated with Claude Code