128a9a554b- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)Marcus Meissner2017-11-14 14:29:43 +00:00
c298f4a117- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes.Marcus Meissner2017-11-14 12:15:40 +00:00
7f3f508bf4Accepting request 518767 from security
Dominique Leuenberger
2017-08-28 13:16:32 +00:00
be41d8de13- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715)Marcus Meissner2017-08-25 13:42:56 +00:00
a814530fd4Accepting request 486410 from security
Yuchen Lin
2017-04-12 15:35:15 +00:00
90f776a3a7- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvementsMarcus Meissner2017-03-21 12:22:06 +00:00
d4ba59b1a5Accepting request 449070 from security
Dominique Leuenberger
2017-01-09 10:01:01 +00:00
66bcb524f7- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issuesMarcus Meissner2017-01-06 14:38:48 +00:00
ec7d4313b9Accepting request 441166 from security
Dominique Leuenberger
2016-11-22 17:58:17 +00:00
4bb4bf0fc8- New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixesMarcus Meissner2016-11-21 09:41:33 +00:00
76f0dfc61c- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixesMarcus Meissner2016-11-21 09:40:53 +00:00
dd23f9a623Accepting request 435870 from security
Dominique Leuenberger
2016-10-19 11:14:04 +00:00
477af14752- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running oscap xccdf generate guide - added CPE support for OpenSUSE 42.1 - MaintenanceMarcus Meissner2016-10-18 07:16:58 +00:00
6f127116f5Accepting request 391973 from security
Dominique Leuenberger
2016-04-30 21:31:39 +00:00
555cce08b2- New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignoreMarcus Meissner2016-04-28 15:54:23 +00:00
0be622f517- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignoreMarcus Meissner2016-04-28 12:53:05 +00:00
27c5679785Accepting request 378600 from security
Dominique Leuenberger
2016-03-26 14:27:37 +00:00
8d54ea3b8e- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstreamMarcus Meissner2015-12-03 13:08:43 +00:00
8d852f0048Accepting request 340304 from security
Stephan Kulow
2015-10-25 18:13:06 +00:00
26630cb11cAccepting request 337016 from security
Dominique Leuenberger
2015-10-14 14:44:34 +00:00
9e48751654- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.Marcus Meissner2015-10-09 14:57:21 +00:00
2593aea15d- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new testsMarcus Meissner2015-10-05 11:46:16 +00:00
90426d344bAccepting request 315206 from security
Stephan Kulow
2015-07-08 04:59:43 +00:00
c1283142d9- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new testsMarcus Meissner2015-06-22 09:42:15 +00:00
308772d933Accepting request 306169 from security
Stephan Kulow
2015-05-11 17:38:55 +00:00
cd55f7dc7d- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)Marcus Meissner2015-05-03 07:56:39 +00:00
20401bd4cdAccepting request 294719 from security
Dominique Leuenberger
2015-04-10 07:51:03 +00:00
124567a319- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - oscap ds sds-compose now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes - openscap-1.2.1 updateMarcus Meissner2015-04-07 09:36:35 +00:00
ad0890887fAccepting request 280877 from security
Dominique Leuenberger
2015-01-14 10:44:52 +00:00
36c6eae53e- openscpa-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixesMarcus Meissner2015-01-12 09:44:35 +00:00
5789663ceaAccepting request 263739 from security
Dominique Leuenberger
2014-12-03 21:48:19 +00:00
85a3903be3- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - Remove unused build require on libnl-1_1 according to theMarcus Meissner2014-12-02 12:45:22 +00:00
f503b7ad65- openscap-1.1.1 update - Hint towards oscap info when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixesMarcus Meissner2014-12-01 12:39:14 +00:00
c36700dc75Accepting request 263389 from home:Ledest:bashismsMarcus Meissner2014-12-01 12:33:36 +00:00
81e8ad109fAccepting request 247494 from security
Stephan Kulow
2014-09-05 07:34:20 +00:00
618821d9a6- openscap-1.1.0 update - HTML report and guide redesign - dropped support for docbook - Introduced new probes (that are to be part of OVAL 5.11) - probe_systemdunitproperty - probe_systemdunitdependency - introduced raw bindings for python3 - dozens of small bug fixesMarcus Meissner2014-09-03 12:10:47 +00:00
b9b0ea120cAccepting request 239982 from security
Stephan Kulow
2014-07-10 06:17:37 +00:00
ce95a2fa9b- openscap-1.0.9 update - xccdf_session_export_arf must not return 0 if the export failed - expose xccdf_policy_get_value_of_item as public API - skip "Signature" when parsing sds_index without spewing out an error - return non-zero when cannot resolve XCCDF - consider the last set-value as the effective set-value and export only one - test suite fixes - do not destroy SVG data in XCCDFs when generating guide or reportMarcus Meissner2014-07-02 12:59:37 +00:00
937a2adb2dAccepting request 238127 from security
Stephan Kulow
2014-06-23 07:23:59 +00:00
58c0105121Accepting request 238064 from home:elvigia:branches:securityMarcus Meissner2014-06-20 09:02:46 +00:00
e4d6f7f8cdAccepting request 228095 from security
Stephan Kulow
2014-03-30 05:55:59 +00:00
Marcus Meissner
Dominique Leuenberger
Yuchen Lin
Stephan Kulow