- Maintenance
- we always build system_info OVAL probe, fixed configure output accordingly
- warn when the user requests to generate an ARF from XCCDF 1.1
- fixed a segfault when loading an OVAL file with invalid family attribute
- added --thin-results CLI override to oscap xccdf eval
- added --without-syschar CLI override to oscap xccdf eval
- fixed a segfault when freeing xccdf_policy of the default profile
- removed ARF schematron workaround when there are no applicable checks
- fixed verbose output in oscap xccdf generate fix
- do not filter fix by applicability when generating remediations from results
- fixed memory leaks, resource leaks and other minor issues
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=169
- separated stdout and stderr in SCE results and HTML report
- HTML reports contain [ref] links for rules and groups
- Maintenance
- fixed ARF errors reported by the SCAPval tool
- fixed CVE parsing (issue #550)
- fixed namespace of ARF vocabulary according to NIST SP800-126 errata
- fixed exporting OVAL Windows namespaces
- fixed injecting xccdf:check-content-ref references in ARF results
- fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248)
- fixed oscap-docker man page (RHBZ #1387166)
- fixed memory leaks and resource leaks
- small fixes and refactoring, test suite fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=167
- New features
- separated stdout and stderr in SCE results and HTML report
- HTML reports contain [ref] links for rules and groups
- Maintenance
- fixed ARF errors reported by the SCAPval tool
- fixed CVE parsing (issue #550)
- fixed namespace of ARF vocabulary according to NIST SP800-126 errata
- fixed exporting OVAL Windows namespaces
- fixed injecting xccdf:check-content-ref references in ARF results
- fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248)
- fixed oscap-docker man page (RHBZ #1387166)
- fixed memory leaks and resource leaks
- small fixes and refactoring, test suite fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=166
- New features
- huge speed-up of generating HTML reports and guides
- support remote datastream components (issue #526)
- support tailoring of external datastreams
- various attributes of remediation scripts are now shown in HTML report (issue #541)
- new option generating OVAL results without system characteristics
- remediation scripts in HTML report are now collapsed
- support for extracting Ansible playbooks
- enabled fetching remote resources in OVAL module
- added Wind River Linux CPE
- Maintenance
- updated jQuery and bootstrap libraries in HTML reports
- extended, improved and updated user manual
- fixed issues with proxy in oscap-docker (RHBZ #1351952)
- fixed a bug in OVAL arithmetic function
- fixed a segmentation fault (issue #529)
- fixed results of XCCDF rules with @role="unscored" (issue #525)
- fixed invalid characters in OVAL results (issue #468)
- fixed a segmentation fault in tailoring (RHBZ #1367896)
- updated SUSE 11 CPE
- fixed many memory issues
- large refactoring of datastream module
- new tests in upstream test suite
- various small fixes and improvements
- openscap-1.2.10 / 29-06-2016
- New features
- support --benchmark-id when running `oscap xccdf generate guide`
- added CPE support for OpenSUSE 42.1
- Maintenance
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=163
- oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths
- enabled offline scanning in many probes
- support for SCE in data streams
- many improvements of verbose mode
- verbose messages can be written on stderr
- runlevel probe supports SUSE systems
- new upstream tests
- Maintenance
- a lot of refactoring
- fixes in various tests
- OCILs are correctly placed in datastreams (issue #364)
- oscap-vm can work with fusermount when guestunmount is not available
- fixed oscap-docker HTTP communication issues (issue #304)
- fixed oscap-docker tracebacks (issue #303, #317)
- fixed container mounting in oscap-docker (issue #329)
- added Fedora 25 CPE
- only non-empty profiles are built (rhbz#1256879, rhbz#1302230)
- fixed compiler errors on RHEL5 and SLES11
- fixed sorting of groups in HTML report (issue #342)
- fixed version/@time and version/@update in XCCDF Benchmark
- fixed CPE definitions to work also in offline mode
- fixed sysctl probe (issue #258)
- fixed manual page for oscap-ssh (rhbz#1299969)
- updated user manuals and manual pages
- updated .gitignore
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=161
- New features
- oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths
- enabled offline scanning in many probes
- support for SCE in data streams
- many improvements of verbose mode
- verbose messages can be written on stderr
- runlevel probe supports SUSE systems
- new upstream tests
- Maintenance
- a lot of refactoring
- fixes in various tests
- OCILs are correctly placed in datastreams (issue #364)
- oscap-vm can work with fusermount when guestunmount is not available
- fixed oscap-docker HTTP communication issues (issue #304)
- fixed oscap-docker tracebacks (issue #303, #317)
- fixed container mounting in oscap-docker (issue #329)
- added Fedora 25 CPE
- only non-empty profiles are built (rhbz#1256879, rhbz#1302230)
- fixed compiler errors on RHEL5 and SLES11
- fixed sorting of groups in HTML report (issue #342)
- fixed version/@time and version/@update in XCCDF Benchmark
- fixed CPE definitions to work also in offline mode
- fixed sysctl probe (issue #258)
- fixed manual page for oscap-ssh (rhbz#1299969)
- updated user manuals and manual pages
- updated .gitignore
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=156
- New features
- OVAL 5.11.1 fully supported
- oscap-vm - tool for offline scanning of virtual machines
- verbose mode
- added SLED, SLES and OpenSUSE CPE names
- show profile description in HTML report and guide
- group rules by PCI DSS identifier in HTML report
- preliminary support for Ansible Playbooks within xccdf:fix
- added "How to contribute" and "Versioning" documents
- Maintenance
- using bziped RHSA documents in oscap-docker
- fixed errors of sysctl probe
- fixed skip-valid option (issue #203)
- fixed segmentation faults in SCE content reporting (issue #231)
- fixed tracebacks of scap-as-rpm
- fixed invalid memory reads in rpmverifyfile probe (issue #212)
- updated README and user manual
- many small bugfixes and new tests
- openscap-new-inventory.patch: upstreamed
- fix-missing-include.dif: refreshed, 1 hunk upstream
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=143
- New features
- introduced OpenSCAP user manual
- improved OVAL 5.11.1 support
- added OVAL 5.11.1 XSD schemas and schematrons
- support for core/platform schema versions
- support for check_existence attribute in state entities
- support for CIM datetime format
- amended behavior of mask attribute
- added support for remote .xml.bz2 files (use with --fetch-remote-resources)
- rewrote oscap-docker to python, deeper integration with Atomic Host
- introduced CPE name for Fedora 24 to the internal dictionary
- HTML report & guide
- results can be grouped by according to various aspects
- printing supported (interactive elements are now hidden when printing)
- table of content now shows only selected items (rule & groups)
- references to RHSA are presented as links to website (rhbz#1243808)
- Maintenance
- scap-as-rpm can now build source rpm packages (srpms) (trac#469)
- scap-as-rpm now supports python3
- refactored oval processing into oval_session structure
- many smaller bugfixes and new tests
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=132
- new features
- OVAL 5.11 support 99.8% completed!
- new symlink probe introduced
- new process58 test capabilities
- added possible_value support for external variables
- added possible_restriction support for external variables
- improved IP address comparisons
- Added Scientific Linux CPEs
- Added oscap-docker tool
- Created man-page for oscap-ssh
- HTML changes
- improved visibility of selected XCCDF profile in guides and reports
- render rule-result/message contents in reports
- maintenance
- Tests now pass on ppc64 little endian arch (rhbz#1215220)
- partition probe now supports remount, bind and move mount options
- Patched NIST OVAL-5.11 schemas to be backward compatible with
OVAL-5.10 (rhbz#1220262)
- fixed scap-as-rpm to work with vintage python (2.6)
- better error reporting when a probe dies (i.e. due to OOM killer)
- dropped selinux policy from upstream (rhbz#1209969)
- fix segfault on invalid selectors (rhbz#1220944)
- solaris support patches: file-system zones, systeminfo improvements
- many smaller fixes and new tests
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=127
- new features
- oscap-ssh -- handy utility to run remote scan over ssh
- glob_to_regexp OVAL function added
- HTML changes
- show rationale elements
- show fixtext elements
- show Benchmark's front-matter, description and notices
- show warnings for Groups and Rules
- improved handling of multiple fixes within a single Rule
- scroll evaluation characteristic if they overflow
- maintenance
- OVAL 5.11 schema fixes
- Coverity and memory leak fixes
- skip transient files when traversing /proc (trac#457)
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=125
- new features
- OVAL 5.11 support turned on by default
- included OVAL 5.11 schematron rules
- DataStream can now contain OVAL 5.11
- `oscap ds sds-compose` now supports --skip-valid parameter
- HTML report changes
- Notably increased level of OVAL details
- Table of contents is now generated for HTML guides
- maitenance
- rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting
- solaris build fixes
- xccdf:fix/instance processing fixes
- improved (none) epoch processing in rpm probe
- environmentvariable58 now emits warning messages when appropriate
- offline mode improvements
- other bugfixes
- openscap-1.2.1 update
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=123
- API changes
- 5.11 schemas updated (from RC1 to gold)
- oscap_source_new_from_memory can take bzip2ed content
- HTML report changes
- severity bar is now reversed (left-to-right)
- maintenance
- rhbz#1165139 - fix probe cancelation
- dozen of bugfixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=121
- new features
- native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2')
- improved performance on huge XML documents, especially DataStreams
- minimized use of temp files to absolute minimum
- added OVAL-5.11 release candidate schemas
- API changes
- overall 50 new symbols added to public API
- introduced oscap_source abstraction for input files
- further info: http://isimluk.livejournal.com/4859.html
- all the parsers converted to use oscap_source abstraction
- introduced ds_sds_session, high level API for playing with Source DataStreams
- introduced cpe_session, abstraction to approach multiple CPE resources
- introduced ds_rds_session, high level API for playing with Result DataStreams
(ARF files)
- deprecated dozens of API calls dependent on filepath
- introduced API for waivers (xccdf:override) and modification of ARF
- initial support for waivers in HTML Report
- dozens of small improvements
- maintenance
- dozens of small fixes
- dozens of memory leaks (whole test suite is now leak free)
- updated gnulib
- Remove unused build require on libnl-1_1 according to the
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=117
- Hint towards `oscap info` when profile is not found in oscap tool
- HTML report changes:
- Source OVAL results from ARF if available
- Highlight notchecked rules, treat them as rules that need attention
- HTML guide changes:
- Variable Substitution improvements
- Show benchmark title
- Show info about selected profile
- Avoid cdf12:notice, show only its contents
- bugfixes:
- improved handling of fqdn in XCCDF
- memory leaks
- static analysis fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=116
- HTML report and guide redesign
- dropped support for docbook
- Introduced new probes (that are to be part of OVAL 5.11)
- probe_systemdunitproperty
- probe_systemdunitdependency
- introduced raw bindings for python3
- dozens of small bug fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=112
- xccdf_session_export_arf must not return 0 if the export failed
- expose xccdf_policy_get_value_of_item as public API
- skip "Signature" when parsing sds_index without spewing out an error
- return non-zero when cannot resolve XCCDF
- consider the last set-value as the effective set-value and export only one
- test suite fixes
- do not destroy SVG data in XCCDFs when generating guide or report
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=110
- fixes related to Asset Reporting Format
- Inject arf:report/@id into nested
rule-result/check/check-content-ref/@href
- Add hostname for each fqdn when generating ARF asset identification
data
- Add all MAC addresses from target-facts to ARF as asset
identification data
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=106
