- the test suite and build scripts were improved to support Debian 10
- offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes;
- the oscap-docker wrapper is no longer dependent on Atomic
- Python binding are now more robust
- HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents
- Support of multi-check rules has been improved across the whole workflow
There are other changes as well, here is the list:
* New features
- Offline mode support for environmentvariable58 probe
- The oscap-docker wrapper is available without Atomic
+ Maintenance, bug fixes
- Improved support of multi-check rules (report, remediations, console output)
- Improved HTML report look and feel, including printed version
- Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels
- Probe rpmverifyfile uses and returns canonical paths
- Improved a11y of HTML reports and guides
- Fixes and improvements for SWIG Python bindings
- #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity)
- Fixed URL link mechanism for Red Hat Errata
- New STIG Viewer URI: public.cyber.mil
- Probe selinuxsecuritycontext would not check if SELinux is enabled
- Scanner would provide information about unsupported OVAL objects
- Added more tests for offline mode (probes, remediation)
- #528 fixed: Eval SCE script when /tmp is in mode noexec
- #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=242
- HTML Guide user experience improvements
- New options in HTML report "Group By" menu
- oscap-ssh supports --oval-results (issue #863)
- Maintenance
- Support comparing state record elements with item
- Updated Bash completion
- Make Bash role headers consistent with --help output
- Fixed problems reported by Coverity (issue #909)
- Fixed CVE schema to support 4 to 7 digits CVEs
- Fix output of generated bash role missing fix message
- Fix oscap-docker to clean up temporary image (RHBZ #1454637)
- Fix Ansible remediations generation
- Add a newline between ids in xccdf info (issue #968)
- Fix unknown subtype handling in oval_subtype_parse (issue #986)
- Outsourced the pthreads feature check and setup
- Speed up in debug mode
- Refactored the Python handling in build scripts
- Prevent reading from host in offline mode (issue #1001)
- Many probes use OWN offline mode
- Improve offline mode logic in OVAL probes
- Do not use chroot in system_info probe
- Prevent a segfault in oscap_seterr on Solaris
- Out of tree build is possible
- Use chroot for RPM probes in offline mode
- PEP8 accepts lines up to 99 characters
- New configure parameter --with-oscap-temp-dir (issue #1016)
- Fixed OVAL record elements namespace and SEXP conversion
- Removed '\r' characters from help output (issue #1023)
- Full Python 3 compatibility
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=215
- New features
- HTML Guide user experience improvements
- New options in HTML report "Group By" menu
- oscap-ssh supports --oval-results (issue #863)
- Maintenance
- Support comparing state record elements with item
- Updated Bash completion
- Make Bash role headers consistent with --help output
- Fixed problems reported by Coverity (issue #909)
- Fixed CVE schema to support 4 to 7 digits CVEs
- Fix output of generated bash role missing fix message
- Fix oscap-docker to clean up temporary image (RHBZ #1454637)
- Fix Ansible remediations generation
- Add a newline between ids in xccdf info (issue #968)
- Fix unknown subtype handling in oval_subtype_parse (issue #986)
- Outsourced the pthreads feature check and setup
- Speed up in debug mode
- Refactored the Python handling in build scripts
- Prevent reading from host in offline mode (issue #1001)
- Many probes use OWN offline mode
- Improve offline mode logic in OVAL probes
- Do not use chroot in system_info probe
- Prevent a segfault in oscap_seterr on Solaris
- Out of tree build is possible
- Use chroot for RPM probes in offline mode
- PEP8 accepts lines up to 99 characters
- New configure parameter --with-oscap-temp-dir (issue #1016)
- Fixed OVAL record elements namespace and SEXP conversion
- Removed '\r' characters from help output (issue #1023)
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=212
- New features
- oscap can generate output that is compatible with STIG Viewer.
- CVRF parsing and export has been implemented.
- oscap info command has been expanded.
- The AIX platform is supported.
- Many documentation improvements.
- Numerous other improvements of existing features.
- Maintenance
- Huge cross-platform improvements.
- Memory leaks fixed (RHBZ#1485876).
- SELinux fixes.
- Many coverity fixes.
- Numerous other bugfixes.
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=185
- New features
- short profile names can be used instead of long IDs
- new option --rule allows to evaluate only a single rule
- new option --fix-type in "oscap xccdf generate fix" allows choosing
remediation script type without typing long URL
- "oscap info" shows profile titles
- OVAL details in HTML report are easier to read
- HTML report is smaller because unselected rules are removed
- HTML report supports NIST 800-171 and CJIS
- remediation scripts contain headers with useful information
- remediation scripts report progress when they run
- basic support for Oracle Linux (CPEs, runlevels)
- remediation scripts can be generated from datastreams that contain
multiple XCCDF benchmarks (issue #772)
- basic support for OVAL 5.11.2 (only schemas, no features)
- enabled offline RPM database in rpminfo probe (issue #778)
- added Fedora 28 CPE
- Maintenance
- fixed oscap-docker with Docker >= 2.0 (issue #794)
- fixed behavior of sysctl probe to be consistent with sysctl tool
- fixed generating remediation scripts (issue #723, #773)
- severity of tailored rules is not discarded (issue #739)
- fixed errors in RPM probes initialization
- oscap-docker shows all warnings reported by oscap (issue #713)
- small improvements in verbose mode
- standard C operations are used instead of custom OpenSCAP operations
- fixed compiler warnings
- fixed missing header files
- fixed resource leaks (issue #715)
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=183
- Maintenance
- we always build system_info OVAL probe, fixed configure output accordingly
- warn when the user requests to generate an ARF from XCCDF 1.1
- fixed a segfault when loading an OVAL file with invalid family attribute
- added --thin-results CLI override to oscap xccdf eval
- added --without-syschar CLI override to oscap xccdf eval
- fixed a segfault when freeing xccdf_policy of the default profile
- removed ARF schematron workaround when there are no applicable checks
- fixed verbose output in oscap xccdf generate fix
- do not filter fix by applicability when generating remediations from results
- fixed memory leaks, resource leaks and other minor issues
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=169
- separated stdout and stderr in SCE results and HTML report
- HTML reports contain [ref] links for rules and groups
- Maintenance
- fixed ARF errors reported by the SCAPval tool
- fixed CVE parsing (issue #550)
- fixed namespace of ARF vocabulary according to NIST SP800-126 errata
- fixed exporting OVAL Windows namespaces
- fixed injecting xccdf:check-content-ref references in ARF results
- fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248)
- fixed oscap-docker man page (RHBZ #1387166)
- fixed memory leaks and resource leaks
- small fixes and refactoring, test suite fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=167
- New features
- separated stdout and stderr in SCE results and HTML report
- HTML reports contain [ref] links for rules and groups
- Maintenance
- fixed ARF errors reported by the SCAPval tool
- fixed CVE parsing (issue #550)
- fixed namespace of ARF vocabulary according to NIST SP800-126 errata
- fixed exporting OVAL Windows namespaces
- fixed injecting xccdf:check-content-ref references in ARF results
- fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248)
- fixed oscap-docker man page (RHBZ #1387166)
- fixed memory leaks and resource leaks
- small fixes and refactoring, test suite fixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=166
- New features
- huge speed-up of generating HTML reports and guides
- support remote datastream components (issue #526)
- support tailoring of external datastreams
- various attributes of remediation scripts are now shown in HTML report (issue #541)
- new option generating OVAL results without system characteristics
- remediation scripts in HTML report are now collapsed
- support for extracting Ansible playbooks
- enabled fetching remote resources in OVAL module
- added Wind River Linux CPE
- Maintenance
- updated jQuery and bootstrap libraries in HTML reports
- extended, improved and updated user manual
- fixed issues with proxy in oscap-docker (RHBZ #1351952)
- fixed a bug in OVAL arithmetic function
- fixed a segmentation fault (issue #529)
- fixed results of XCCDF rules with @role="unscored" (issue #525)
- fixed invalid characters in OVAL results (issue #468)
- fixed a segmentation fault in tailoring (RHBZ #1367896)
- updated SUSE 11 CPE
- fixed many memory issues
- large refactoring of datastream module
- new tests in upstream test suite
- various small fixes and improvements
- openscap-1.2.10 / 29-06-2016
- New features
- support --benchmark-id when running `oscap xccdf generate guide`
- added CPE support for OpenSUSE 42.1
- Maintenance
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=163
- oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths
- enabled offline scanning in many probes
- support for SCE in data streams
- many improvements of verbose mode
- verbose messages can be written on stderr
- runlevel probe supports SUSE systems
- new upstream tests
- Maintenance
- a lot of refactoring
- fixes in various tests
- OCILs are correctly placed in datastreams (issue #364)
- oscap-vm can work with fusermount when guestunmount is not available
- fixed oscap-docker HTTP communication issues (issue #304)
- fixed oscap-docker tracebacks (issue #303, #317)
- fixed container mounting in oscap-docker (issue #329)
- added Fedora 25 CPE
- only non-empty profiles are built (rhbz#1256879, rhbz#1302230)
- fixed compiler errors on RHEL5 and SLES11
- fixed sorting of groups in HTML report (issue #342)
- fixed version/@time and version/@update in XCCDF Benchmark
- fixed CPE definitions to work also in offline mode
- fixed sysctl probe (issue #258)
- fixed manual page for oscap-ssh (rhbz#1299969)
- updated user manuals and manual pages
- updated .gitignore
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=161
- New features
- oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths
- enabled offline scanning in many probes
- support for SCE in data streams
- many improvements of verbose mode
- verbose messages can be written on stderr
- runlevel probe supports SUSE systems
- new upstream tests
- Maintenance
- a lot of refactoring
- fixes in various tests
- OCILs are correctly placed in datastreams (issue #364)
- oscap-vm can work with fusermount when guestunmount is not available
- fixed oscap-docker HTTP communication issues (issue #304)
- fixed oscap-docker tracebacks (issue #303, #317)
- fixed container mounting in oscap-docker (issue #329)
- added Fedora 25 CPE
- only non-empty profiles are built (rhbz#1256879, rhbz#1302230)
- fixed compiler errors on RHEL5 and SLES11
- fixed sorting of groups in HTML report (issue #342)
- fixed version/@time and version/@update in XCCDF Benchmark
- fixed CPE definitions to work also in offline mode
- fixed sysctl probe (issue #258)
- fixed manual page for oscap-ssh (rhbz#1299969)
- updated user manuals and manual pages
- updated .gitignore
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=156
- New features
- OVAL 5.11.1 fully supported
- oscap-vm - tool for offline scanning of virtual machines
- verbose mode
- added SLED, SLES and OpenSUSE CPE names
- show profile description in HTML report and guide
- group rules by PCI DSS identifier in HTML report
- preliminary support for Ansible Playbooks within xccdf:fix
- added "How to contribute" and "Versioning" documents
- Maintenance
- using bziped RHSA documents in oscap-docker
- fixed errors of sysctl probe
- fixed skip-valid option (issue #203)
- fixed segmentation faults in SCE content reporting (issue #231)
- fixed tracebacks of scap-as-rpm
- fixed invalid memory reads in rpmverifyfile probe (issue #212)
- updated README and user manual
- many small bugfixes and new tests
- openscap-new-inventory.patch: upstreamed
- fix-missing-include.dif: refreshed, 1 hunk upstream
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=143
- New features
- introduced OpenSCAP user manual
- improved OVAL 5.11.1 support
- added OVAL 5.11.1 XSD schemas and schematrons
- support for core/platform schema versions
- support for check_existence attribute in state entities
- support for CIM datetime format
- amended behavior of mask attribute
- added support for remote .xml.bz2 files (use with --fetch-remote-resources)
- rewrote oscap-docker to python, deeper integration with Atomic Host
- introduced CPE name for Fedora 24 to the internal dictionary
- HTML report & guide
- results can be grouped by according to various aspects
- printing supported (interactive elements are now hidden when printing)
- table of content now shows only selected items (rule & groups)
- references to RHSA are presented as links to website (rhbz#1243808)
- Maintenance
- scap-as-rpm can now build source rpm packages (srpms) (trac#469)
- scap-as-rpm now supports python3
- refactored oval processing into oval_session structure
- many smaller bugfixes and new tests
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=132
- new features
- OVAL 5.11 support 99.8% completed!
- new symlink probe introduced
- new process58 test capabilities
- added possible_value support for external variables
- added possible_restriction support for external variables
- improved IP address comparisons
- Added Scientific Linux CPEs
- Added oscap-docker tool
- Created man-page for oscap-ssh
- HTML changes
- improved visibility of selected XCCDF profile in guides and reports
- render rule-result/message contents in reports
- maintenance
- Tests now pass on ppc64 little endian arch (rhbz#1215220)
- partition probe now supports remount, bind and move mount options
- Patched NIST OVAL-5.11 schemas to be backward compatible with
OVAL-5.10 (rhbz#1220262)
- fixed scap-as-rpm to work with vintage python (2.6)
- better error reporting when a probe dies (i.e. due to OOM killer)
- dropped selinux policy from upstream (rhbz#1209969)
- fix segfault on invalid selectors (rhbz#1220944)
- solaris support patches: file-system zones, systeminfo improvements
- many smaller fixes and new tests
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=127
- new features
- oscap-ssh -- handy utility to run remote scan over ssh
- glob_to_regexp OVAL function added
- HTML changes
- show rationale elements
- show fixtext elements
- show Benchmark's front-matter, description and notices
- show warnings for Groups and Rules
- improved handling of multiple fixes within a single Rule
- scroll evaluation characteristic if they overflow
- maintenance
- OVAL 5.11 schema fixes
- Coverity and memory leak fixes
- skip transient files when traversing /proc (trac#457)
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=125
- new features
- OVAL 5.11 support turned on by default
- included OVAL 5.11 schematron rules
- DataStream can now contain OVAL 5.11
- `oscap ds sds-compose` now supports --skip-valid parameter
- HTML report changes
- Notably increased level of OVAL details
- Table of contents is now generated for HTML guides
- maitenance
- rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting
- solaris build fixes
- xccdf:fix/instance processing fixes
- improved (none) epoch processing in rpm probe
- environmentvariable58 now emits warning messages when appropriate
- offline mode improvements
- other bugfixes
- openscap-1.2.1 update
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=123
- API changes
- 5.11 schemas updated (from RC1 to gold)
- oscap_source_new_from_memory can take bzip2ed content
- HTML report changes
- severity bar is now reversed (left-to-right)
- maintenance
- rhbz#1165139 - fix probe cancelation
- dozen of bugfixes
OBS-URL: https://build.opensuse.org/package/show/security/openscap?expand=0&rev=121
