openscap-utils-1.3.6-150400.11.5.1 < > , f|Gp9| á'y&_
\a+?s >3LxId0;*Xhc 㑼GsDP WޏYRRd2;y h屴 I t ? d d % 8 / 5 < `
\
4 $ L D ( o 8 x 5 9 L 5 : 5 = > ? @ F G H t I X Y \ ] | ^ b c ] d e f l u v \ w x H y z ` C openscap-utils 1.3.6 150400.11.5.1 Openscap utilities The openscap-utils package contains various utilities based on openscap library. f|Gh01-ch4c SUSE Linux Enterprise 15 SUSE LLC LGPL-2.1-or-later https://www.suse.com/ System/Monitoring https://www.open-scap.org/ linux x86_64
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
for service in oscap-scan.service ; do
sysv_service=${service%.*}
if [ ! -e /usr/lib/systemd/system/$service ] &&
[ ! -e /etc/init.d/$sysv_service ]; then
mkdir -p /run/systemd/rpm/needs-preset
touch /run/systemd/rpm/needs-preset/$service
elif [ -e /etc/init.d/$sysv_service ] &&
[ ! -e /var/lib/systemd/migrated/$sysv_service ]; then
/usr/sbin/systemd-sysv-convert --save $sysv_service || :
mkdir -p /run/systemd/rpm/needs-sysv-convert
touch /run/systemd/rpm/needs-sysv-convert/$service
fi
done
fi
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
if [ "$YAST_IS_RUNNING" != "instsys" ]; then
/usr/bin/systemctl daemon-reload || :
fi
for service in oscap-scan.service ; do
sysv_service=${service%.*}
if [ -e /run/systemd/rpm/needs-preset/$service ]; then
/usr/bin/systemctl preset $service || :
rm "/run/systemd/rpm/needs-preset/$service" || :
elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then
/usr/sbin/systemd-sysv-convert --apply $sysv_service || :
rm "/run/systemd/rpm/needs-sysv-convert/$service" || :
touch /var/lib/systemd/migrated/$sysv_service || :
fi
done
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then
# Package removal, not upgrade
/usr/bin/systemctl --no-reload disable oscap-scan.service || :
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services
test "$DISABLE_STOP_ON_REMOVAL" = yes -o \
"$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0
/usr/bin/systemctl stop oscap-scan.service
) || :
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ $1 -eq 0 ]; then
# Package removal
for service in oscap-scan.service ; do
sysv_service="${service%.*}"
rm -f "/var/lib/systemd/migrated/$sysv_service" || :
done
fi
if [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl daemon-reload || :
fi
if [ "$FIRST_ARG" -ge 1 ]; then
# Package upgrade, not uninstall
if [ -x /usr/bin/systemctl ]; then
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services
test "$DISABLE_RESTART_ON_UPDATE" = yes -o \
"$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0
/usr/bin/systemctl try-restart oscap-scan.service
) || :
fi
fi p &
; 36 ' Z ˁ큤A큤 a#f|a#a#a#a#f|a#a#a#f|f|f|a#f|Ga#f|a#a#a#a#a#a#a#2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c2017 31c743ba219cd792ebd044193162686063bcacea94c6546155ef6f65dc6cb1dd 943d768c49937f7fc1e969bbef6309471a2db3f61d83a15382fbce8f667ceaf9 ff7e52c18c6bda9e1d461f51111041cbca65af67b6956085865fa8daa0c2a02f ba19361c3bc2c17b29874141fd36c937c36d28689bab3390be11fbc1de15c2e6 73385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c 0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d88 abf9d5451a03c748170a33e8cf6e25fbb1c48ffec70eb0d6a57698dfca71f719 b527e619f881d78a7acafb289c30718c3b85b5c86957aa3847faa9815199a282 24c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc 0464708e48104f7da84d9a642ea2e770ab5bf2e2a39f435f4a124623bb370d60 92372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd2 2c552d1934dc46f6b05d11de3d0f1a06d1f314c20c6a4c23380d9c79eb5b98bb e8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0 de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8 f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8d fa7b554c7b631d2546a10e08caa775421ead8deccf7d81cc3e211f864a785333 82fb64b132eef61f9628d61f1eed6dd48a12ae0630a3c7a3b8d8d86b394c294b e53339782007018f4153e1c5bcbebc5fa4711f414ddabe28c4a6116d5819350a e7e87eea1960e9ea5df6d7c09bb7accabd372dbd14b30f2789e07db1f3b1b3f2 91329c7394c5137098b364a372d5038eb7482fdd40fec29690e9b0c7d1014c04 d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2 service root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root openscap-1.3.6-150400.11.5.1.src.rpm openscap-utils openscap-utils(x86-64) @ @ @ @ @ @ @ @ @ @
/bin/bash /bin/sh /bin/sh /bin/sh /bin/sh /usr/bin/env coreutils diffutils fillup grep libc.so.6()(64bit) libc.so.6(GLIBC_2.14)(64bit) libc.so.6(GLIBC_2.2.5)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libopenscap.so.25()(64bit) libopenscap25 libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2.5)(64bit) openscap rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) systemd systemd systemd systemd 1.3.6-150400.11.5.1 1.3.6-150400.11.5.1 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 c*c#aNaaLaZa G``r`__/@_Q_w@^^{G^ @^^]:\@\[@[[ @[
@Z@Z1@Z1@ZZ@Z
Z
Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF
U#T@T}T|X@Ty@dmueller@suse.com meissner@suse.com rfrohl@suse.com dcermak@suse.com meissner@suse.com meissner@suse.com steven.kowalik@suse.com rfrohl@suse.com rfrohl@suse.com rfrohl@suse.com meissner@suse.com meissner@suse.com meissner@suse.com rfrohl@suse.com meissner@suse.com christophe@krop.fr meissner@suse.com meissner@suse.com meissner@suse.com rfrohl@suse.com rfrohl@suse.com bjorn.lie@gmail.com rfrohl@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com jengelh@inai.de meissner@suse.com meissner@suse.com rbrown@suse.com meissner@suse.com meissner@suse.com meissner@suse.com jengelh@inai.de meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com meissner@suse.com ledest@gmail.com - require shared library in the same version or newer - added Leap 15.4 and 15.5 dictionary entries. (bsc#1203408) - openscap 1.3.6
* New features
- Select and exclude groups of rules on the command line
- The boot-time remediation service for systemd's Offline Update mode
- Memory limit control using OSCAP_PROBE_MEMORY_USAGE_RATIO environment variable
- Allow disablement of SHA-1 and MD5
- Allow providing pre-downloaded components
- Introduce OSBuild Blueprint fix type
* Maintenance, bug fix
- Fix coverity issues
- Patch the `segfault` in dpkginfo_fini()
- Add an alternative source of hostname
- Fail download on HTTP errors
- Compile "environmentvariable_probe" on Windows
- FreeBSD build and test fixes
- Add offline mode for password probe
- Initialize crypto API only once
- Fix UBI 9 scan
- oval/yamlfilecontent: Add 'null' values handling
- Do not set Rpath
- Do not split `XCCDF:requires` with multiple `idrefs`
- Allow empty /proc in offline mode
- oscap-remediate is shipped via /usr/bin
Added oscap-remediate.service.in.patch - Rename oscap-docker to oscap-containers and provide oscap-podman as well
(Relates to jsc#SLE-12852) - openscap-docker-add-suse.patch: add SLES support oscap-docker
(bsc#1179314) - ship python3 docker module always - Since upstream has moved to Python 3, switch the BuildRequires from
python-devel to python3-devel. - Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735) - add old patches - slightly renamed; cpe are needed (boo#1186735)
* openscap-opensuse-cpe.patch
* openscap-suse-cpe.patch - openscap 1.3.5
* New features
- Made schematron-based validation enabled by default for validate command of oval and xccdf modules
- Added SCAP 1.3 source data stream Schematron
- Added XML Signature Validation
- Added --enforce-signature option for eval, guide, and fix modules
- Added entity support (OVAL/yamlfilecontent)
- Allowed to clamp mtime to SOURCE_DATE_EPOCH
- Added severity and role attributes
- Added support for requires/conflicts elements of the Rule and Group (XCCDF)
- Added Kubernetes remediation to HTML report
* Maintenance, bug fix
- Fixed CMake warnings
- Made 'gpfs', 'proc' and 'sysfs' filesystems non-local
- Fixed handling of '--arg=val'-styled common options
- Documented used environment variables
- Updated man page and help texts
- Added --skip-validation option synonym for --skip-valid
- Fixed behavior of StateType operator
- Fixed some of the coverity warnings
- Ignoring namespace in XPath expressions
- Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning)
- Described SWID tags detection
- Improved documentation about --stig-viewer option
- File probe behaviour fixed (symlink traversal now behaves as defined by OVAL)
- Fixed multiple segfaults and broken test in --stig-viewer feature
- Added dpkg version comparison algorithm
- Pluged some memory leaks
- Fixed TestResult/benchmark/@href attribute
- Fixed memory allocation
- Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent)
- Changing hard coded libperl path in favor of FindPerlLibs method
- Check local filesystems when using 'filepath' element
- dropped, because not needed anymore:
* 0001-Fix-memory-allocation.patch
* openscap-new-suse.patch
* openscap-leap-cpe-15.12.patch - 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval - openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE
Leap 15.1 and 15.2 - add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301) - openscap 1.3.4
* New features
- Add support for FreeBSD
- Make use of HTTP header content-encoding: gzip if available
- Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps
* Maintenance, bug fixes
- A lot of memory leaks have been plugged
- Refactored rpmverifyfile probe and fixed memory leak
- Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions
- Fixed DOM representation of the profile platform
- Test suit: better portability, more granularity in results, inclusion of memory-related tests
- Compatibility with uClibc
- Local and remote file system detection method was improved
- Make the report a valid HTML5 document - openscap 1.3.3. Notable improvements in this release:
- a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč);
- timezone for XCCDF TestResult start and end time (thank you, Jan Černý);
- new yamlfilecontent independent probe (draft implementation),
see the proposal https://github.com/OVAL-Community/OVAL/issues/91
for additional information.
There are other changes as well, here is the list:
- Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF;
- Added ability to generate `machineconfig` fix;
- Detect ambiguous scan target (utils/oscap-podman);
- Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory;
- The data system_info probe return for offline and online modes is consistent and actual;
- Prevent crashes when complicated regexes are executed in textfilecontent58 probe;
- Fixed #1512: Severity refinement lost in generated guide;
- Fixed #1453: Pointer lost in Swig API;
- Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities;
from system_info probe;
- Fixed filepath pattern matching in offline mode in textfilecontent58 probe;
- Fixed infinite recursion in systemdunitdependency probe;
- Fixed the case when CMake couldn't find libacl or xattr.h.
- dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream - Add upstream patch to fix the scap-workbench build:
* 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch - switch back to official release
- openscap 1.3.2
- the test suite and build scripts were improved to support Debian 10
- offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes;
- the oscap-docker wrapper is no longer dependent on Atomic
- Python binding are now more robust
- HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents
- Support of multi-check rules has been improved across the whole workflow
There are other changes as well, here is the list:
* New features
- Offline mode support for environmentvariable58 probe
- The oscap-docker wrapper is available without Atomic
+ Maintenance, bug fixes
- Improved support of multi-check rules (report, remediations, console output)
- Improved HTML report look and feel, including printed version
- Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels
- Probe rpmverifyfile uses and returns canonical paths
- Improved a11y of HTML reports and guides
- Fixes and improvements for SWIG Python bindings
- #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity)
- Fixed URL link mechanism for Red Hat Errata
- New STIG Viewer URI: public.cyber.mil
- Probe selinuxsecuritycontext would not check if SELinux is enabled
- Scanner would provide information about unsupported OVAL objects
- Added more tests for offline mode (probes, remediation)
- #528 fixed: Eval SCE script when /tmp is in mode noexec
- #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage - temporary openscap 1.3.1 git snapshot
- make it build with new RPM (bsc#1160720) - use distribution-release instead of dummy-release - openscap 1.3.1
- New features
- Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation)
- Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers
- Tailoring files are included in ARF result files
- OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line
- HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition`
- OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide
- Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2
- Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool
- Maintenance and bug fixes
for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1
- removed patches accepted upstream:
rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch
test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch - obsolete removed packages: openscap-engine-sce and openscap-extra-probes - Drop gconf2-devel BuildRequires: It is not mandatory, so lets
build without this obsolete package.
- Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires:
They are also optional, but not obsolete, and previously pulled
in via gconf2-devel dependency, so lets build support for them. - openscap-1.3.0
- New features
- Introduced a virtual '(all)' profile selecting all rules
- Verbose mode is a global option in all modules
- Added Microsoft Windows CPEs
- oscap-ssh can supply SSH options into an environment variable
- Maintenance
- Removed SEXP parser
- Added Fedora 30 CPE
- Fixed many Coverity defects (memory leaks etc.)
- SCE builds are enabled by default
- Moved many low-level functions out of public API
- Removed unused and dead code
- Updated manual pages
- Numerous small fixes
- xinetd_probe.patch: fix trailing whitespace in config
- test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test
- sysctl_unittest.patch: fix sysctl unit test
- rpmverifyfile_unittest.patch: fix rpmverifyfile unit test
- rpmverify_unittest.patch: fix rpmverify unit test
- openscap-xattr.patch: removed, included by upstream - openscap-xattr.patch: build against new libattr - scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible
to match both opensuse and sles or official suse_linux_enterprise_server
names at once. (bsc#1091040) - openscap-1.2.17
- New features
- HTML Guide user experience improvements
- New options in HTML report "Group By" menu
- oscap-ssh supports --oval-results (issue #863)
- Maintenance
- Support comparing state record elements with item
- Updated Bash completion
- Make Bash role headers consistent with --help output
- Fixed problems reported by Coverity (issue #909)
- Fixed CVE schema to support 4 to 7 digits CVEs
- Fix output of generated bash role missing fix message
- Fix oscap-docker to clean up temporary image (RHBZ #1454637)
- Fix Ansible remediations generation
- Add a newline between ids in xccdf info (issue #968)
- Fix unknown subtype handling in oval_subtype_parse (issue #986)
- Outsourced the pthreads feature check and setup
- Speed up in debug mode
- Refactored the Python handling in build scripts
- Prevent reading from host in offline mode (issue #1001)
- Many probes use OWN offline mode
- Improve offline mode logic in OVAL probes
- Do not use chroot in system_info probe
- Prevent a segfault in oscap_seterr on Solaris
- Out of tree build is possible
- Use chroot for RPM probes in offline mode
- PEP8 accepts lines up to 99 characters
- New configure parameter --with-oscap-temp-dir (issue #1016)
- Fixed OVAL record elements namespace and SEXP conversion
- Removed '\r' characters from help output (issue #1023)
- Full Python 3 compatibility
- Removed basic Python implementation of oval_probes.c
- Added support for Travis CI and Sonar Cloud
- Minor fixes inspired by Sonar Cloud
- Added Fedora 29 CPE
- New tests in upstream test suite (offline mode, Ansible, etc.) - openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0
(bsc#1091040) - Replace old $RPM_* shell vars. - replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan
helper tool for this. (bsc#1083115) - disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135) - Replace references to /var/adm/fillup-templates with new
%_fillupdir macro (boo#1069468) - openscap-productid-cvrf.patch: add a --productid selector
for "oscap cvrf" as upstream does not detect the system yet.
(might go away) - openscap-1.2.16
- New features
- oscap can generate output that is compatible with STIG Viewer.
- CVRF parsing and export has been implemented.
- oscap info command has been expanded.
- The AIX platform is supported.
- Many documentation improvements.
- Numerous other improvements of existing features.
- Maintenance
- Huge cross-platform improvements.
- Memory leaks fixed (RHBZ#1485876).
- SELinux fixes.
- Many coverity fixes.
- Numerous other bugfixes.
- buildrequire procps-devel - openscap-1.2.15 / 25-08-2017
- New features
- short profile names can be used instead of long IDs
- new option --rule allows to evaluate only a single rule
- new option --fix-type in "oscap xccdf generate fix" allows choosing
remediation script type without typing long URL
- "oscap info" shows profile titles
- OVAL details in HTML report are easier to read
- HTML report is smaller because unselected rules are removed
- HTML report supports NIST 800-171 and CJIS
- remediation scripts contain headers with useful information
- remediation scripts report progress when they run
- basic support for Oracle Linux (CPEs, runlevels)
- remediation scripts can be generated from datastreams that contain
multiple XCCDF benchmarks (issue #772)
- basic support for OVAL 5.11.2 (only schemas, no features)
- enabled offline RPM database in rpminfo probe (issue #778)
- added Fedora 28 CPE
- Maintenance
- fixed oscap-docker with Docker >= 2.0 (issue #794)
- fixed behavior of sysctl probe to be consistent with sysctl tool
- fixed generating remediation scripts (issue #723, #773)
- severity of tailored rules is not discarded (issue #739)
- fixed errors in RPM probes initialization
- oscap-docker shows all warnings reported by oscap (issue #713)
- small improvements in verbose mode
- standard C operations are used instead of custom OpenSCAP operations
- fixed compiler warnings
- fixed missing header files
- fixed resource leaks (issue #715)
- fixed pkgconfig file (RHBZ #1414777)
- refactoring
- documentation fixes and improvements - Remove line-trailing whitespace from last changelog entry.
- Rename %soname to %sover to better reflect its use.
- Replace unnecessary %__-type macro indirections. - openscap-1.2.14 / 21-03-2017
- New features
- Detailed information about ARF files in 'oscap info' (issue #664)
- XSLT template creating XCCDF files from OVAL files
- Generating remediation scripts from ARF
- Significant improvements of User Manual (issue #249, #513)
- HTML report UX improvements (issue #601, #620, #622, #655)
- Warnings are shown by default
- Verbose mode is available in 'xccdf remediate' module (issue #520)
- Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698)
- Support for Anaconda remediation in HTML report
- Maintenance
- Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038)
- Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700)
- Added a warning on non-existing XCCDF Benchmarks (issue #614)
- Fixed output on terminals with white background (RHBZ #1365911, issue #512)
- Error handling in oscap-vm (RHBZ #1391754)
- Fixed SCE stderr stalling (RHBZ #1420811)
- Fixed Android OVAL schema (issue #279)
- Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824)
- Fixes based on Coverity scan report (issue #581, #634, #681)
- Fixed duplicated error messages (issue #707)
- Fixed XCCDF score calculation (issue #617)
- Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312)
- Fixed failing DataStream build if "@" is in filepath
- Fixed missing header in result-oriented Ansible remediations
- Memory leak and resource leak fixes (issue #635, #636)
- New upstream tests
- Many minor fixes and improvements - openscap-1.2.13 / 05-01-2017
- Maintenance
- we always build system_info OVAL probe, fixed configure output accordingly
- warn when the user requests to generate an ARF from XCCDF 1.1
- fixed a segfault when loading an OVAL file with invalid family attribute
- added --thin-results CLI override to oscap xccdf eval
- added --without-syschar CLI override to oscap xccdf eval
- fixed a segfault when freeing xccdf_policy of the default profile
- removed ARF schematron workaround when there are no applicable checks
- fixed verbose output in oscap xccdf generate fix
- do not filter fix by applicability when generating remediations from results
- fixed memory leaks, resource leaks and other minor issues - openscap-1.2.12 / 21-11-2016
- New features
- separated stdout and stderr in SCE results and HTML report
- HTML reports contain [ref] links for rules and groups
- Maintenance
- fixed ARF errors reported by the SCAPval tool
- fixed CVE parsing (issue #550)
- fixed namespace of ARF vocabulary according to NIST SP800-126 errata
- fixed exporting OVAL Windows namespaces
- fixed injecting xccdf:check-content-ref references in ARF results
- fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248)
- fixed oscap-docker man page (RHBZ #1387166)
- fixed memory leaks and resource leaks
- small fixes and refactoring, test suite fixes - openscap-1.2.11 / 14-10-2016
- New features
- huge speed-up of generating HTML reports and guides
- support remote datastream components (issue #526)
- support tailoring of external datastreams
- various attributes of remediation scripts are now shown in HTML report (issue #541)
- new option generating OVAL results without system characteristics
- remediation scripts in HTML report are now collapsed
- support for extracting Ansible playbooks
- enabled fetching remote resources in OVAL module
- added Wind River Linux CPE
- Maintenance
- updated jQuery and bootstrap libraries in HTML reports
- extended, improved and updated user manual
- fixed issues with proxy in oscap-docker (RHBZ #1351952)
- fixed a bug in OVAL arithmetic function
- fixed a segmentation fault (issue #529)
- fixed results of XCCDF rules with @role="unscored" (issue #525)
- fixed invalid characters in OVAL results (issue #468)
- fixed a segmentation fault in tailoring (RHBZ #1367896)
- updated SUSE 11 CPE
- fixed many memory issues
- large refactoring of datastream module
- new tests in upstream test suite
- various small fixes and improvements
- openscap-1.2.10 / 29-06-2016
- New features
- support --benchmark-id when running `oscap xccdf generate guide`
- added CPE support for OpenSUSE 42.1
- Maintenance
- oscap-docker fixed to be source compatible with both Python 2 and 3
- fixed offline mode in rpmverifypackage probe
- fixed scanning of non-RHEL containers in oscap-docker (issue #427)
- fixed regression in loading a datastream session (RHBZ #1250072)
- fixed missing SCE results in XCCDF reports (issue #394)
- fixed a segmentation fault (issue #370)
- fix error message when OVAL generator element is missing (issue #345)
- fixed failing rpminfo probe
- fixed compilation on RHEL5 (issue #393)
- new tests in upstream test suite
- test suite is able to run on Fedora 24
- fixed remediation scripts appearance in HTML guides (issue #460)
- fixed autoconf build
- small fixes, refactoring, small documentation improvements - openscap 1.2.9 release
- New features
- oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths
- enabled offline scanning in many probes
- support for SCE in data streams
- many improvements of verbose mode
- verbose messages can be written on stderr
- runlevel probe supports SUSE systems
- new upstream tests
- Maintenance
- a lot of refactoring
- fixes in various tests
- OCILs are correctly placed in datastreams (issue #364)
- oscap-vm can work with fusermount when guestunmount is not available
- fixed oscap-docker HTTP communication issues (issue #304)
- fixed oscap-docker tracebacks (issue #303, #317)
- fixed container mounting in oscap-docker (issue #329)
- added Fedora 25 CPE
- only non-empty profiles are built (rhbz#1256879, rhbz#1302230)
- fixed compiler errors on RHEL5 and SLES11
- fixed sorting of groups in HTML report (issue #342)
- fixed version/@time and version/@update in XCCDF Benchmark
- fixed CPE definitions to work also in offline mode
- fixed sysctl probe (issue #258)
- fixed manual page for oscap-ssh (rhbz#1299969)
- updated user manuals and manual pages
- updated .gitignore
- dropped fix-missing-include.dif, not needed anymore - enable the SCE (script checking engine)
packaged in "openscap-engine-sce" subpackage.
- enable the CCE (Common Configuration Enumeration) - openscap 1.2.8 release
- Maintenance
- textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757)
- fixed oscap-docker
- small improvements in verbose mode
- oscap info module shows information about tailoring files
- fixed build with CCE (issue #264)
- fixed XCCDF score computation (issue #272)
- fixed segmentation fault in variable probe (issue #277)
- fixed broken support for OVAL directives
- fixed bash completion
- plugged memory leaks
- fixed fresh static analysis (coverity) findings
- fixed shellcheck warnings
- new tests
- refactoring in datastream module
- many small bugfixes and typo fixes - openscap 1.2.7 release
- New features
- OVAL 5.11.1 fully supported
- oscap-vm - tool for offline scanning of virtual machines
- verbose mode
- added SLED, SLES and OpenSUSE CPE names
- show profile description in HTML report and guide
- group rules by PCI DSS identifier in HTML report
- preliminary support for Ansible Playbooks within xccdf:fix
- added "How to contribute" and "Versioning" documents
- Maintenance
- using bziped RHSA documents in oscap-docker
- fixed errors of sysctl probe
- fixed skip-valid option (issue #203)
- fixed segmentation faults in SCE content reporting (issue #231)
- fixed tracebacks of scap-as-rpm
- fixed invalid memory reads in rpmverifyfile probe (issue #212)
- updated README and user manual
- many small bugfixes and new tests
- openscap-new-inventory.patch: upstreamed
- fix-missing-include.dif: refreshed, 1 hunk upstream - openscap-new-inventory.patch: find out the CPE ids of
SUSE Linux Enterprise and openSUSE versions. - openscap 1.2.6 release
- New features
- introduced OpenSCAP user manual
- improved OVAL 5.11.1 support
- added OVAL 5.11.1 XSD schemas and schematrons
- support for core/platform schema versions
- support for check_existence attribute in state entities
- support for CIM datetime format
- amended behavior of mask attribute
- added support for remote .xml.bz2 files (use with --fetch-remote-resources)
- rewrote oscap-docker to python, deeper integration with Atomic Host
- introduced CPE name for Fedora 24 to the internal dictionary
- HTML report & guide
- results can be grouped by according to various aspects
- printing supported (interactive elements are now hidden when printing)
- table of content now shows only selected items (rule & groups)
- references to RHSA are presented as links to website (rhbz#1243808)
- Maintenance
- scap-as-rpm can now build source rpm packages (srpms) (trac#469)
- scap-as-rpm now supports python3
- refactored oval processing into oval_session structure
- many smaller bugfixes and new tests
- new openscap-docker subpackage - openscap-1.2.5 update
- maintenance
- smaller bugfixes
- plugged memory leaks
- fixed fresh static analysis (coverity) findings
- fixed shellcheck warnings
- fixes for Solaris platform - openscap-1.2.4 update
- new features
- OVAL 5.11 support 99.8% completed!
- new symlink probe introduced
- new process58 test capabilities
- added possible_value support for external variables
- added possible_restriction support for external variables
- improved IP address comparisons
- Added Scientific Linux CPEs
- Added oscap-docker tool
- Created man-page for oscap-ssh
- HTML changes
- improved visibility of selected XCCDF profile in guides and reports
- render rule-result/message contents in reports
- maintenance
- Tests now pass on ppc64 little endian arch (rhbz#1215220)
- partition probe now supports remount, bind and move mount options
- Patched NIST OVAL-5.11 schemas to be backward compatible with
OVAL-5.10 (rhbz#1220262)
- fixed scap-as-rpm to work with vintage python (2.6)
- better error reporting when a probe dies (i.e. due to OOM killer)
- dropped selinux policy from upstream (rhbz#1209969)
- fix segfault on invalid selectors (rhbz#1220944)
- solaris support patches: file-system zones, systeminfo improvements
- many smaller fixes and new tests - openscap-1.2.3 update
- new features
- oscap-ssh -- handy utility to run remote scan over ssh
- glob_to_regexp OVAL function added
- HTML changes
- show rationale elements
- show fixtext elements
- show Benchmark's front-matter, description and notices
- show warnings for Groups and Rules
- improved handling of multiple fixes within a single Rule
- scroll evaluation characteristic if they overflow
- maintenance
- OVAL 5.11 schema fixes
- Coverity and memory leak fixes
- skip transient files when traversing /proc (trac#457) - openscap-1.2.2 update
- new features
- OVAL 5.11 support turned on by default
- included OVAL 5.11 schematron rules
- DataStream can now contain OVAL 5.11
- `oscap ds sds-compose` now supports --skip-valid parameter
- HTML report changes
- Notably increased level of OVAL details
- Table of contents is now generated for HTML guides
- maitenance
- rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting
- solaris build fixes
- xccdf:fix/instance processing fixes
- improved (none) epoch processing in rpm probe
- environmentvariable58 now emits warning messages when appropriate
- offline mode improvements
- other bugfixes - openscap-1.2.1 update
- API changes
- 5.11 schemas updated (from RC1 to gold)
- oscap_source_new_from_memory can take bzip2ed content
- HTML report changes
- severity bar is now reversed (left-to-right)
- maintenance
- rhbz#1165139 - fix probe cancelation
- dozen of bugfixes - openscap-1.2.0 update
- new features
- native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2')
- improved performance on huge XML documents, especially DataStreams
- minimized use of temp files to absolute minimum
- added OVAL-5.11 release candidate schemas
- API changes
- overall 50 new symbols added to public API
- introduced oscap_source abstraction for input files
- further info: http://isimluk.livejournal.com/4859.html
- all the parsers converted to use oscap_source abstraction
- introduced ds_sds_session, high level API for playing with Source DataStreams
- introduced cpe_session, abstraction to approach multiple CPE resources
- introduced ds_rds_session, high level API for playing with Result DataStreams
(ARF files)
- deprecated dozens of API calls dependent on filepath
- introduced API for waivers (xccdf:override) and modification of ARF
- initial support for waivers in HTML Report
- dozens of small improvements
- maintenance
- dozens of small fixes
- dozens of memory leaks (whole test suite is now leak free)
- updated gnulib
- openscap-1.1.0-fix-bashisms.patch: upstreamed - openscap-1.1.1 update
- Hint towards `oscap info` when profile is not found in oscap tool
- HTML report changes:
- Source OVAL results from ARF if available
- Highlight notchecked rules, treat them as rules that need attention
- HTML guide changes:
- Variable Substitution improvements
- Show benchmark title
- Show info about selected profile
- Avoid cdf12:notice, show only its contents
- bugfixes:
- improved handling of fqdn in XCCDF
- memory leaks
- static analysis fixes - fix bashism in oscap-scan.cron script
- add patches:
* openscap-1.1.0-fix-bashisms.patch /bin/sh /bin/sh /bin/sh /bin/sh h01-ch4c 1719409223
1.3.6-150400.11.5.1 1.3.6-150400.11.5.1 autotailor oscap oscap-chroot oscap-remediate oscap-remediate-offline oscap-run-sce-script oscap-scan oscap-ssh oscap-vm scap-as-rpm oscap-remediate.service oscap-scan.service rcoscap-scan oscap openscap-utils oscap-scan.cron sysconfig.oscap-scan autotailor.8.gz oscap-chroot.8.gz oscap-remediate-offline.8.gz oscap-ssh.8.gz oscap-vm.8.gz oscap.8.gz scap-as-rpm.8.gz /usr/bin/ /usr/lib/systemd/system/ /usr/sbin/ /usr/share/bash-completion/completions/ /usr/share/doc/packages/ /usr/share/doc/packages/openscap-utils/ /usr/share/fillup-templates/ /usr/share/man/man8/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:34486/SUSE_SLE-15-SP4_Update/f409e49276c156675c5887317de897cd-openscap.SUSE_SLE-15-SP4_Update drpm xz 5 x86_64-suse-linux
Python script, UTF-8 Unicode text executable ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=e90d8a132b59e6527f128d151b291b3accd8e30f, for GNU/Linux 3.2.0, stripped Bourne-Again shell script, ASCII text executable Bourne-Again shell script, UTF-8 Unicode text executable Python script, ASCII text executable ASCII text ASCII text, with very long lines directory POSIX shell script, ASCII text executable troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)
R R R R
R R R R R
R R R R R R R R uab, systemd-sysvcompat utf-8 d4099dcf4333a56109aece2c7f58bf5013fd9dd84ac1dc4ad4cf672603c28681 ? p 7zXZ
! t/
A] "k%N6~8!wGm3yCނBcsm E vV\Jd6}ߌV æQ(=~H ! - e$=^$O_mqD[3[̻h1uS5eL$MGwk;i_7K]q; 5y Spx^ڵӧ.A,ZpU腔6ظDp#?jl<(
{m/?h$錘T)~V_ZӃ*x>A$[2,vj|8n
\WTȌΠ\@
",wjtCRwpS\A7>uY;Ρ; 3^. LIBUo_G_0m
վXo6-s$ZY[D-FڳȶW £?(yfF93^% hͽgs7;܅OhW@2ۏG\U@y'mȒ7';^lM JV
yAA T"?;qfPrKpO6o, #{[ } 蒳轅|]iT4Qm+_'!C紿+SS?t L=,X ySvַ8xR >)Fլ[zne E8 Ƚ2(hJD vm?pNsC/SkRAA. U%!\usnӁ̴:ʹ o0=
HKN#&{9|i905U{un]:kk#TA;kO#ih9Kh3U`N>1vhOQ#?^0N%OsqBxP jlbs]fm>C^~Yu.2j,4viR Y[>ғ3ȟXE.
sVuN0j+v*6x:2mXڪv- iW p ePcy[ʓ9(82 LUBB_3DԌ
?c#NSPy`!)km)] (ty4\\̰{*C|:]F8O(]SAC%֖1QVꬡyfVAtl%_~Pk+gg): ɊaMl`|i-9{ԭ4TAM_%E
zM{_hU~`'
sRZ:yEtaO1/Ӆn-
'gM
4ISq:Õe\rS}})\ .IKQطJ`[^-\ 'xQ|aZOө۾KQR,MDH`jl7'G^E¢[eVy0_ID%rJmT8R" \9tٯ"m * f-*+G\0['Nɽ }3ANEY#Swa\dwZu)_?GQNIG!;SJqz *J* >2>g7;r*/h zڂ/4JDށWR cEvUMgAY)i+ d D,|ғįny>t*wYdJ Q0F@ŕOyB˂&{6FtlAGۃ{o=6ʰt״bD{LNx⚭Q1=IYA,c'r* VH
K+Q @ MqBWa턯x wCUG7;tXhI9I^$Hqy PMWW)5~@"We{ !l)}3Хn"C=##]N:0'dX; #,f R\( &v` Yŝ8tM5~p
r5UNdơ$~Jr V: Y pi5e虐ܲ3=P}+ѳq -co-ڻ6\-KIZe . 6ObJݷ@m5*TE
qj!} vv^$Zsޖvߊ5~aeeOO G}F w#Ӹ#Pc%UDF F_GJ_"&
f
\p9Dhb)h<}ٚ?e^5=$?dSйTe E
=BrEX \Pϫfv1&dĘ/y%!$Q
] RpFX\ k6ԼV ! ewnW(HӚextBE4>ֹhf c7_5jI9@ pWb,uED:wjp4 7RdZl 8Dž~Yzhcaf CF ÈqO,3&k2Х| jpD 戇
ַaW)80E~cn}K#II3aL0,V3z?Hi@m2vcjv{G fNaaC4b"h Yӯa*T Qb7\c4dwo6ˣx0 v+ vqo=/}u\(@qM' Ja* P4bzFs xY8e|
Wb}DϲѰwF 4MJ,8)1wuƼyyIOh+YW2_C2 d_Ihfi7[VB=g/g}iU+`;yz$[=81BI \*ԣMx#RDEn"? }hɥ6s3=f2y>[Ǟ Rin$&l{΄ kWzYI9