Remote vulnerability scanning with jOVALdi Community Edition

jOVAL is an open-source Java OVAL interpreter. The first open-source OVAL interpreter that could perform remote scanning without installation of any agent on a host. 

However, it seems that jOVAL Team, whose contribution in OVAL development sure enough is huge, does not very interested in development of open-source product anymore.

Nowadays only default plugin is available for open-source version on jOVAL engine. All binary packages since 5.10.1.2b are not publically available. The only way to get jOVAL with remote scanning option is to purchase jOVAL Professional Edition ($1,000 per user per year).

I tried to figure out the situation with available source codes of jOVAL.

First, I was able to build it and it works. The only comment about building: for current jOVAL master you should use jPE branch 1.0.1 (not master!) and jSAF branch 1.1.2.

The second thought is that it could be used for remote scanning with some bash magic, and it works fast enough.

I have just copied jovaldi dist to remote RHEL host and started default plugin job with RHEL OVAL patch content and then received results back.

Html results: