From b873de19c0d24042b534894a50cb5d3019cd4402 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Thu, 11 Feb 2021 14:01:05 +0100 Subject: [PATCH 01/66] Define _vpath_builddir macro as `build` SSG build system and tests count with build directory name `build`. For more details see: https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds --- scap-security-guide.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index de934ef..54344cb 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -1,3 +1,8 @@ +# SSG build system and tests count with build directory name `build`. +# For more details see: +# https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds +%global _vpath_builddir build + Name: scap-security-guide Version: 0.1.54 Release: 1%{?dist} From 63765dd8bb854ebada2e5f8e5f5bcf081fd67553 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Thu, 11 Feb 2021 14:01:05 +0100 Subject: [PATCH 02/66] Define _vpath_builddir macro as `build` SSG build system and tests count with build directory name `build`. For more details see: https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds --- scap-security-guide.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index de934ef..54344cb 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -1,3 +1,8 @@ +# SSG build system and tests count with build directory name `build`. +# For more details see: +# https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds +%global _vpath_builddir build + Name: scap-security-guide Version: 0.1.54 Release: 1%{?dist} From 893d396f9ff81a3a0b2be31607d9c4235720d2ac Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 12 Feb 2021 09:58:13 +0100 Subject: [PATCH 03/66] fix definition of build directory --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 54344cb..f83580c 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.54 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -69,6 +69,9 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Feb 12 2021 Vojtech Polasek - 0.1.54-2 +- fix definition of build directory + * Fri Feb 05 2021 Vojtech Polasek - 0.1.54-1 - Update to latest upstream SCAP-Security-Guide-0.1.54 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.54 From 21f968f5122fa835fd6f720c7086eb99a350453c Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 12 Feb 2021 10:35:24 +0100 Subject: [PATCH 04/66] fix build directory --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 54344cb..f83580c 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.54 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -69,6 +69,9 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Feb 12 2021 Vojtech Polasek - 0.1.54-2 +- fix definition of build directory + * Fri Feb 05 2021 Vojtech Polasek - 0.1.54-1 - Update to latest upstream SCAP-Security-Guide-0.1.54 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.54 From 1e1397c2f4f61ebdf4d3e80702355d6e9956f788 Mon Sep 17 00:00:00 2001 From: Matej Tyc Date: Wed, 10 Feb 2021 16:29:40 +0100 Subject: [PATCH 05/66] Unified the spec file with its RHEL8 counterpart. --- scap-security-guide.spec | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index f83580c..3723738 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,8 +5,11 @@ Name: scap-security-guide Version: 0.1.54 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Security guidance and baselines in SCAP formats +%if 0%{?rhel} +Group: Applications/System +%endif License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 @@ -16,9 +19,12 @@ BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 BuildRequires: cmake >= 2.8 +# To get python3 inside the buildroot require its path explicitly in BuildRequires +BuildRequires: /usr/bin/python3 BuildRequires: python%{python3_pkgversion} BuildRequires: python%{python3_pkgversion}-jinja2 BuildRequires: python%{python3_pkgversion}-PyYAML +BuildRequires: python%{python3_pkgversion}-lxml Requires: xml-common, openscap-scanner >= 1.2.5 Obsoletes: openscap-content < 0:0.9.13 Provides: openscap-content @@ -29,7 +35,7 @@ system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening advice, linked to government requirements where applicable. The project bridges the gap between generalized policy -requirements and specific implementation guidelines. The Fedora system +requirements and specific implementation guidelines. The system administrator can use the oscap CLI tool from openscap-scanner package, or the scap-workbench GUI tool from scap-workbench package to verify that the system conforms to provided guideline. Refer to scap-security-guide(8) manual page for @@ -37,6 +43,9 @@ further information. %package doc Summary: HTML formatted security guides generated from XCCDF benchmarks +%if 0%{?rhel} +Group: System Environment/Base +%endif Requires: %{name} = %{version}-%{release} %description doc @@ -45,10 +54,16 @@ hardening guidances that have been generated from XCCDF benchmarks present in %{name} package. %prep -%setup -q +%autosetup +%define cmake_defines %{nil} +%if 0%{?rhel} +%define cmake_defines -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL6:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL7:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL8:BOOLEAN=TRUE -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE -DSSG_PRODUCT_JRE:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF +%endif + +mkdir -p build %build -%cmake +%cmake %{cmake_defines} %cmake_build %install @@ -69,6 +84,9 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Feb 12 2021 Matej Tyc - 0.1.54-3 +- Moved the spec file closer to the RHEL one. + * Fri Feb 12 2021 Vojtech Polasek - 0.1.54-2 - fix definition of build directory From f82a4f42378fe3d72c48060d5e14ca1539219f49 Mon Sep 17 00:00:00 2001 From: Matej Tyc Date: Tue, 16 Feb 2021 12:19:09 +0100 Subject: [PATCH 06/66] Removed the RHEL6 product build. --- scap-security-guide.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 3723738..1d5afe2 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -58,7 +58,7 @@ present in %{name} package. %define cmake_defines %{nil} %if 0%{?rhel} -%define cmake_defines -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL6:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL7:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL8:BOOLEAN=TRUE -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE -DSSG_PRODUCT_JRE:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF +%define cmake_defines -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL7:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL8:BOOLEAN=TRUE -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE -DSSG_PRODUCT_JRE:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF %endif mkdir -p build From e0b27dc7c87689a2d6ccabb7dbf3baad1a28c8a9 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 19 Mar 2021 14:14:32 +0100 Subject: [PATCH 07/66] scap-security-guide 0.1.55 --- scap-security-guide.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 1d5afe2..62b13db 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.54 -Release: 3%{?dist} +Version: 0.1.55 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats %if 0%{?rhel} Group: Applications/System @@ -84,6 +84,10 @@ mkdir -p build %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Mar 19 2021 Vojtech Polasek - 0.1.55-1 +- Update to latest upstream SCAP-Security-Guide-0.1.55 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.55 + * Fri Feb 12 2021 Matej Tyc - 0.1.54-3 - Moved the spec file closer to the RHEL one. From d1eedd270f1d750df3604ee455472d1414365a5b Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 19 Mar 2021 14:24:38 +0100 Subject: [PATCH 08/66] forgot to upload sources --- .gitignore | 1 + scap-security-guide.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1477619..d00d110 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ /scap-security-guide-0.1.52.tar.bz2 /scap-security-guide-0.1.53.tar.bz2 /scap-security-guide-0.1.54.tar.bz2 +/scap-security-guide-0.1.55.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 62b13db..f4f60a3 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.55 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats %if 0%{?rhel} Group: Applications/System @@ -84,6 +84,9 @@ mkdir -p build %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Mar 19 2021 Vojtech Polasek - 0.1.55-2 +- rebuilt + * Fri Mar 19 2021 Vojtech Polasek - 0.1.55-1 - Update to latest upstream SCAP-Security-Guide-0.1.55 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.55 diff --git a/sources b/sources index 7a2c4b2..02259d0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.54.tar.bz2) = 35d89737c5000c0fcebb36c5ad48958f95edf4563579af2a5591e0f8560fc3de8d90aad39536318ae6ab1261bf2c3e4504533604e94f68d23acc6fc153a37f96 +SHA512 (scap-security-guide-0.1.55.tar.bz2) = 3e1e3c16dac2b4ea07f164f488c2e7d0690efd64a185c9c1fb0cfe4875a4076cb207144c9232c33f9f08cc999f5284f1a221065100d699dc84168e86631912f8 From d4fc812342902bf9ce46d33aaeb9e4c337e53943 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 7 Apr 2021 11:58:42 +0200 Subject: [PATCH 09/66] scap-security-guide 0.1.55 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 1477619..d00d110 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ /scap-security-guide-0.1.52.tar.bz2 /scap-security-guide-0.1.53.tar.bz2 /scap-security-guide-0.1.54.tar.bz2 +/scap-security-guide-0.1.55.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index f83580c..c79d079 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.54 -Release: 2%{?dist} +Version: 0.1.55 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -69,6 +69,10 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Wed Apr 07 2021 Vojtech Polasek - 0.1.55-1 +- Update to latest upstream SCAP-Security-Guide-0.1.55 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.55 + * Fri Feb 12 2021 Vojtech Polasek - 0.1.54-2 - fix definition of build directory diff --git a/sources b/sources index 7a2c4b2..02259d0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.54.tar.bz2) = 35d89737c5000c0fcebb36c5ad48958f95edf4563579af2a5591e0f8560fc3de8d90aad39536318ae6ab1261bf2c3e4504533604e94f68d23acc6fc153a37f96 +SHA512 (scap-security-guide-0.1.55.tar.bz2) = 3e1e3c16dac2b4ea07f164f488c2e7d0690efd64a185c9c1fb0cfe4875a4076cb207144c9232c33f9f08cc999f5284f1a221065100d699dc84168e86631912f8 From ebc27efe3eec150949d08e9323c0d4f35c1991fb Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Thu, 13 May 2021 17:24:10 +0200 Subject: [PATCH 10/66] Fix gating.yaml name See: https://docs.fedoraproject.org/en-US/ci/gating/#_enable --- gating.yml => gating.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename gating.yml => gating.yaml (100%) diff --git a/gating.yml b/gating.yaml similarity index 100% rename from gating.yml rename to gating.yaml From 1176496c1b2ba45342958a96e14a90861cf105b4 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Thu, 13 May 2021 17:28:07 +0200 Subject: [PATCH 11/66] Fix gating.yaml name See: https://docs.fedoraproject.org/en-US/ci/gating/#_enable --- gating.yml => gating.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename gating.yml => gating.yaml (100%) diff --git a/gating.yml b/gating.yaml similarity index 100% rename from gating.yml rename to gating.yaml From 3293d4fc62b87e5f3af35c3cba131f258a5bc8f5 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Mon, 17 May 2021 15:08:36 +0200 Subject: [PATCH 12/66] Add gating configuration for RHEL --- gating.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/gating.yaml b/gating.yaml index 1f13530..b16b396 100644 --- a/gating.yaml +++ b/gating.yaml @@ -12,3 +12,11 @@ decision_context: bodhi_update_push_stable subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.ci-beaker.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} From facca30efe441262950aa38b11d7112903920c63 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 26 May 2021 15:17:03 +0200 Subject: [PATCH 13/66] scap-security-guide 0.1.56 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d00d110..300dd31 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /scap-security-guide-0.1.53.tar.bz2 /scap-security-guide-0.1.54.tar.bz2 /scap-security-guide-0.1.55.tar.bz2 +/scap-security-guide-0.1.56.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index f4f60a3..fac3148 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.55 -Release: 2%{?dist} +Version: 0.1.56 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats %if 0%{?rhel} Group: Applications/System @@ -84,6 +84,10 @@ mkdir -p build %doc %{_docdir}/%{name}/tables/*.html %changelog +* Wed May 26 2021 Vojtech Polasek - 0.1.56-1 +- Update to latest upstream SCAP-Security-Guide-0.1.56 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 + * Fri Mar 19 2021 Vojtech Polasek - 0.1.55-2 - rebuilt diff --git a/sources b/sources index 02259d0..cad4a93 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.55.tar.bz2) = 3e1e3c16dac2b4ea07f164f488c2e7d0690efd64a185c9c1fb0cfe4875a4076cb207144c9232c33f9f08cc999f5284f1a221065100d699dc84168e86631912f8 +SHA512 (scap-security-guide-0.1.56.tar.bz2) = 1c876f1a8e03f3f68de8fd5a8fd020567f0eecb1fb8b9c9f754453c2f22278944f50d06c0f4e771020e2e25facf6cecb1044d3ddb12e531428ca5aacfec3c86c From 3e0bf4f6e6ab8740862620e704cfe95fa542b96d Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 26 May 2021 17:03:19 +0200 Subject: [PATCH 14/66] scap-security-guide 0.1.56 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d00d110..300dd31 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /scap-security-guide-0.1.53.tar.bz2 /scap-security-guide-0.1.54.tar.bz2 /scap-security-guide-0.1.55.tar.bz2 +/scap-security-guide-0.1.56.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index c79d079..1b1f13a 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.55 +Version: 0.1.56 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -69,6 +69,10 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Wed May 26 2021 Vojtech Polasek - 0.1.56-1 +- Update to latest upstream SCAP-Security-Guide-0.1.56 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 + * Wed Apr 07 2021 Vojtech Polasek - 0.1.55-1 - Update to latest upstream SCAP-Security-Guide-0.1.55 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.55 diff --git a/sources b/sources index 02259d0..cad4a93 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.55.tar.bz2) = 3e1e3c16dac2b4ea07f164f488c2e7d0690efd64a185c9c1fb0cfe4875a4076cb207144c9232c33f9f08cc999f5284f1a221065100d699dc84168e86631912f8 +SHA512 (scap-security-guide-0.1.56.tar.bz2) = 1c876f1a8e03f3f68de8fd5a8fd020567f0eecb1fb8b9c9f754453c2f22278944f50d06c0f4e771020e2e25facf6cecb1044d3ddb12e531428ca5aacfec3c86c From 2930a649dd75f05a4af1f864bd2ee6a4590eafb8 Mon Sep 17 00:00:00 2001 From: Matej Tyc Date: Tue, 8 Jun 2021 12:53:55 +0200 Subject: [PATCH 15/66] Sync the specfile with the RHEL9 one. --- ...ty-guide-0.1.57-build-system-pr-7025.patch | 477 ++++++++++++++++++ ...-0.1.57-fix-build-scap-12-ds-pr-7049.patch | 202 ++++++++ scap-security-guide.spec | 36 +- 3 files changed, 697 insertions(+), 18 deletions(-) create mode 100644 scap-security-guide-0.1.57-build-system-pr-7025.patch create mode 100644 scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch diff --git a/scap-security-guide-0.1.57-build-system-pr-7025.patch b/scap-security-guide-0.1.57-build-system-pr-7025.patch new file mode 100644 index 0000000..fd69a4b --- /dev/null +++ b/scap-security-guide-0.1.57-build-system-pr-7025.patch @@ -0,0 +1,477 @@ +From aae5be64cdeb4a41caa3f3273342373cc4f4e9b2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Wed, 19 May 2021 18:01:14 +0200 +Subject: [PATCH 1/4] Add options for building Ansible and Bash content + +This patch adds 2 new options SSG_ANSIBLE_PLAYBOOKS_ENABLED and +SSG_BASH_SCRIPTS_ENABLED which will allow user to turn on or off +building and installing profile Bash remediation scripts and profile +Ansible Playbooks. They are enabled by default, therefore the default +behavior doesn't change, but people can turn them off to speed up the +build. These options can be useful when calling cmake in downstream spec +files. +--- + CMakeLists.txt | 4 +++ + cmake/SSGCommon.cmake | 60 +++++++++++++++++++++++-------------------- + 2 files changed, 36 insertions(+), 28 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 32a0ddd240a..c309efde9bd 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -46,6 +46,8 @@ option(SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED "If enabled, shellcheck vali + option(SSG_LINKCHECKER_VALIDATION_ENABLED "If enabled, linkchecker will be used to validate URLs in all the HTML guides and tables." TRUE) + option(SSG_SVG_IN_XCCDF_ENABLED "If enabled, the built XCCDFs will include the SVG SCAP Security Guide logo." TRUE) + option(SSG_SEPARATE_SCAP_FILES_ENABLED "If enabled, separate SCAP files (OVAL, XCCDF, CPE dict, ...) will be installed alongside the source data-streams" TRUE) ++option(SSG_ANSIBLE_PLAYBOOKS_ENABLED "If enabled, Ansible Playbooks for each profile will be built and installed." TRUE) ++option(SSG_BASH_SCRIPTS_ENABLED "If enabled, Bash remediation scripts for each profile will be built and installed." TRUE) + option(SSG_JINJA2_CACHE_ENABLED "If enabled, the jinja2 templating files will be cached into bytecode. Also see SSG_JINJA2_CACHE_DIR." TRUE) + option(SSG_BATS_TESTS_ENABLED "If enabled, bats will be used to run unit-tests of bash remediations." TRUE) + set(SSG_JINJA2_CACHE_DIR "${CMAKE_BINARY_DIR}/jinja2_cache" CACHE PATH "Where the jinja2 cached bytecode should be stored. This speeds up builds at the expense of disk space. You can use one location for multiple SSG builds for performance improvements.") +@@ -240,6 +242,8 @@ message(STATUS "OVAL schematron validation: ${SSG_OVAL_SCHEMATRON_VALIDATION_ENA + message(STATUS "shellcheck bash fixes validation: ${SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED}") + message(STATUS "SVG logo in XCCDFs: ${SSG_SVG_IN_XCCDF_ENABLED}") + message(STATUS "Separate SCAP files: ${SSG_SEPARATE_SCAP_FILES_ENABLED}") ++message(STATUS "Ansible Playbooks: ${SSG_ANSIBLE_PLAYBOOKS_ENABLED}") ++message(STATUS "Bash scripts: ${SSG_BASH_SCRIPTS_ENABLED}") + if (SSG_JINJA2_CACHE_ENABLED) + message(STATUS "jinja2 cache: enabled") + message(STATUS "jinja2 cache dir: ${SSG_JINJA2_CACHE_DIR}") +diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake +index 889c0cf1d3c..9b109f86b9f 100644 +--- a/cmake/SSGCommon.cmake ++++ b/cmake/SSGCommon.cmake +@@ -789,7 +789,7 @@ macro(ssg_build_product PRODUCT) + + add_dependencies(zipfile "generate-ssg-${PRODUCT}-ds.xml") + +- if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}") ++ if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}" AND SSG_ANSIBLE_PLAYBOOKS_ENABLED) + add_dependencies( + ${PRODUCT}-content + generate-${PRODUCT}-ansible-playbooks +@@ -803,7 +803,7 @@ macro(ssg_build_product PRODUCT) + add_dependencies(zipfile ${PRODUCT}-profile-playbooks) + endif() + +- if ("${PRODUCT_BASH_REMEDIATION_ENABLED}") ++ if ("${PRODUCT_BASH_REMEDIATION_ENABLED}" AND SSG_BASH_SCRIPTS_ENABLED) + ssg_build_profile_bash_scripts(${PRODUCT}) + add_custom_target( + ${PRODUCT}-profile-bash-scripts +@@ -873,30 +873,34 @@ macro(ssg_build_product PRODUCT) + endif() + " + ) +- install( +- CODE " +- file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/ansible/${PRODUCT}-playbook-*.yml\") \n +- if(NOT IS_ABSOLUTE ${SSG_ANSIBLE_ROLE_INSTALL_DIR}) +- file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" +- TYPE FILE FILES \${ROLE_FILES}) +- else() +- file(INSTALL DESTINATION \"${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" +- TYPE FILE FILES \${ROLE_FILES}) +- endif() +- " +- ) +- install( +- CODE " +- file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/bash/${PRODUCT}-script-*.sh\") \n +- if(NOT IS_ABSOLUTE ${SSG_BASH_ROLE_INSTALL_DIR}) +- file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_BASH_ROLE_INSTALL_DIR}\" +- TYPE FILE FILES \${ROLE_FILES}) +- else() +- file(INSTALL DESTINATION \"${SSG_BASH_ROLE_INSTALL_DIR}\" +- TYPE FILE FILES \${ROLE_FILES}) +- endif() +- " +- ) ++ if(SSG_ANSIBLE_PLAYBOOKS_ENABLED) ++ install( ++ CODE " ++ file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/ansible/${PRODUCT}-playbook-*.yml\") \n ++ if(NOT IS_ABSOLUTE ${SSG_ANSIBLE_ROLE_INSTALL_DIR}) ++ file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" ++ TYPE FILE FILES \${ROLE_FILES}) ++ else() ++ file(INSTALL DESTINATION \"${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" ++ TYPE FILE FILES \${ROLE_FILES}) ++ endif() ++ " ++ ) ++ endif() ++ if(SSG_BASH_SCRIPTS_ENABLED) ++ install( ++ CODE " ++ file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/bash/${PRODUCT}-script-*.sh\") \n ++ if(NOT IS_ABSOLUTE ${SSG_BASH_ROLE_INSTALL_DIR}) ++ file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_BASH_ROLE_INSTALL_DIR}\" ++ TYPE FILE FILES \${ROLE_FILES}) ++ else() ++ file(INSTALL DESTINATION \"${SSG_BASH_ROLE_INSTALL_DIR}\" ++ TYPE FILE FILES \${ROLE_FILES}) ++ endif() ++ " ++ ) ++ endif() + + # grab all the kickstarts (if any) and install them + file(GLOB KICKSTART_FILES "${CMAKE_CURRENT_SOURCE_DIR}/kickstart/ssg-${PRODUCT}-*-ks.cfg") +@@ -968,7 +972,7 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + + ssg_build_html_guides(${DERIVATIVE}) + +- if ("${PRODUCT_BASH_REMEDIATION_ENABLED}") ++ if ("${PRODUCT_BASH_REMEDIATION_ENABLED}" AND SSG_BASH_SCRIPTS_ENABLED) + ssg_build_profile_bash_scripts(${DERIVATIVE}) + add_custom_target( + ${DERIVATIVE}-profile-bash-scripts +@@ -977,7 +981,7 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + add_dependencies(${DERIVATIVE} ${DERIVATIVE}-profile-bash-scripts) + endif() + +- if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}") ++ if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}" AND SSG_ANSIBLE_PLAYBOOKS_ENABLED) + ssg_build_profile_playbooks(${DERIVATIVE}) + add_custom_target( + ${DERIVATIVE}-profile-playbooks + +From c7c7baa84ce722304224373c556a2d03edb0f76c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 20 May 2021 09:14:21 +0200 +Subject: [PATCH 2/4] Do not build HTML guide for the virtual default profile + +The virtual '(default)' profile is a profile that doesn't contain +any rules, so the built HTML guide also doesn't contain any rules +which means it contains only group descriptions. This HTML guide +has no use for the users and it only increases the built size. +--- + ssg/build_guides.py | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/ssg/build_guides.py b/ssg/build_guides.py +index 3b2a9469240..2e37d80eef3 100644 +--- a/ssg/build_guides.py ++++ b/ssg/build_guides.py +@@ -105,10 +105,6 @@ def get_benchmark_profile_pairs(input_tree, benchmarks): + for benchmark_id in benchmarks.keys(): + profiles = get_profile_choices_for_input(input_tree, benchmark_id, + None) +- +- # add the default profile +- profiles[""] = "(default)" +- + for profile_id in profiles: + pair = (benchmark_id, profile_id, profiles[profile_id]) + benchmark_profile_pairs.append(pair) + +From f2c265013dd5fe75fd47c8ce7afe9e2ecc7cf16f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 20 May 2021 09:49:51 +0200 +Subject: [PATCH 3/4] Add option to disable SCAP 1.2 data streams + +This commit adds a new option that enables to turn on building +the SCAP 1.2 source data streams (ssg-*-ds-1.2.xml). This option +will help people who don't want to build and ship this file. +The default setting is TRUE which means the default behavior +shouldn't change. +--- + CMakeLists.txt | 2 + + cmake/SSGCommon.cmake | 100 +++++++++++++++++++++++++++--------------- + 2 files changed, 67 insertions(+), 35 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index c309efde9bd..55b991cedfa 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -41,6 +41,7 @@ set(SSG_TARGET_OVAL_MINOR_VERSION "11" CACHE STRING "Which minor version of OVAL + + set(SSG_TARGET_OVAL_VERSION "${SSG_TARGET_OVAL_MAJOR_VERSION}.${SSG_TARGET_OVAL_MINOR_VERSION}") + ++option(SSG_BUILD_SCAP_12_DS "If enabled, ssg-*-ds-1.2.xml will be built along with ssg-*-ds.xml" TRUE) + option(SSG_OVAL_SCHEMATRON_VALIDATION_ENABLED "If enabled, schematron validation will be performed as part of the ctest tests. Schematron takes a lot of time to complete but can find more issues than just plain XSD validation." TRUE) + option(SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED "If enabled, shellcheck validation of bash fixes will be performed as part of the ctest tests. Shellcheck tests don't pass right now, this option is discouraged until that's fixed." FALSE) + option(SSG_LINKCHECKER_VALIDATION_ENABLED "If enabled, linkchecker will be used to validate URLs in all the HTML guides and tables." TRUE) +@@ -238,6 +239,7 @@ message(STATUS " ") + message(STATUS "Build options:") + message(STATUS "SSG vendor string: ${SSG_VENDOR}") + message(STATUS "Target OVAL version: ${SSG_TARGET_OVAL_VERSION}") ++message(STATUS "Build SCAP 1.2 source data streams: ${SSG_BUILD_SCAP_12_DS}") + message(STATUS "OVAL schematron validation: ${SSG_OVAL_SCHEMATRON_VALIDATION_ENABLED}") + message(STATUS "shellcheck bash fixes validation: ${SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED}") + message(STATUS "SVG logo in XCCDFs: ${SSG_SVG_IN_XCCDF_ENABLED}") +diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake +index 9b109f86b9f..412db46c687 100644 +--- a/cmake/SSGCommon.cmake ++++ b/cmake/SSGCommon.cmake +@@ -555,7 +555,6 @@ macro(ssg_build_sds PRODUCT) + if("${PRODUCT}" MATCHES "rhel(6|7)") + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +@@ -563,10 +562,8 @@ macro(ssg_build_sds PRODUCT) + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -578,22 +575,19 @@ macro(ssg_build_sds PRODUCT) + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" + DEPENDS generate-ssg-${PRODUCT}-pcidss-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" +- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml and ssg-${PRODUCT}-ds-1.2.xml" ++ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" + ) + else() + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -603,14 +597,30 @@ macro(ssg_build_sds PRODUCT) + DEPENDS generate-ssg-${PRODUCT}-cpe-dictionary.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-dictionary.xml" + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" +- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml and ssg-${PRODUCT}-ds-1.2.xml" ++ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" ++ ) ++ endif() ++ ++ if(SSG_BUILD_SCAP_12_DS) ++ add_custom_command( ++ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" ++ ) ++ add_custom_target( ++ generate-ssg-${PRODUCT}-ds.xml ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ ) ++ else() ++ add_custom_target( ++ generate-ssg-${PRODUCT}-ds.xml ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + ) + endif() +- add_custom_target( +- generate-ssg-${PRODUCT}-ds.xml +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" +- ) + + if("${PRODUCT}" MATCHES "rhel(6|7|8|9)") + add_test( +@@ -626,10 +636,12 @@ macro(ssg_build_sds PRODUCT) + NAME "validate-ssg-${PRODUCT}-ds.xml" + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + ) +- add_test( +- NAME "validate-ssg-${PRODUCT}-ds-1.2.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" +- ) ++ if(SSG_BUILD_SCAP_12_DS) ++ add_test( ++ NAME "validate-ssg-${PRODUCT}-ds-1.2.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ ) ++ endif() + endif() + endmacro() + +@@ -640,7 +652,6 @@ macro(ssg_build_html_guides PRODUCT) + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/build_all_guides.py" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/guides" build + DEPENDS generate-ssg-${PRODUCT}-ds.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + COMMENT "[${PRODUCT}-guides] generating HTML guides for all profiles in ssg-${PRODUCT}-ds.xml" + ) + add_custom_target( +@@ -854,8 +865,10 @@ macro(ssg_build_product PRODUCT) + install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + DESTINATION "${SSG_CONTENT_INSTALL_DIR}") + +- install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" +- DESTINATION "${SSG_CONTENT_INSTALL_DIR}") ++ if(SSG_BUILD_SCAP_12_DS) ++ install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ DESTINATION "${SSG_CONTENT_INSTALL_DIR}") ++ endif() + + # This is a common cmake trick, we need the globbing to happen at build time + # and not configure time. +@@ -927,21 +940,34 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" +- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" + DEPENDS generate-ssg-${ORIGINAL}-ds.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" + DEPENDS "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" +- COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds.xml and ssg-${DERIVATIVE}-ds-1.2.xml" +- ) +- add_custom_target( +- generate-ssg-${DERIVATIVE}-ds.xml +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds.xml" + ) ++ if (SSG_BUILD_SCAP_12_DS) ++ add_custom_command( ++ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg ++ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" ++ DEPENDS "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" ++ COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds-1.2.xml" ++ ) ++ add_custom_target( ++ generate-ssg-${DERIVATIVE}-ds.xml ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ ) ++ else() ++ add_custom_target( ++ generate-ssg-${DERIVATIVE}-ds.xml ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" ++ ) ++ endif() ++ + define_validate_product("${PRODUCT}") + if ("${VALIDATE_PRODUCT}" OR "${FORCE_VALIDATE_EVERYTHING}") + add_test( +@@ -952,10 +978,12 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + NAME "validate-ssg-${DERIVATIVE}-ds.xml" + COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" + ) +- add_test( +- NAME "validate-ssg-${DERIVATIVE}-ds-1.2.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" +- ) ++ if (SSG_BUILD_SCAP_12_DS) ++ add_test( ++ NAME "validate-ssg-${DERIVATIVE}-ds-1.2.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ ) ++ endif() + endif() + + add_custom_target(${DERIVATIVE} ALL) +@@ -1004,8 +1032,10 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" + DESTINATION "${SSG_CONTENT_INSTALL_DIR}") + +- install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" +- DESTINATION "${SSG_CONTENT_INSTALL_DIR}") ++ if(SSG_BUILD_SCAP_12_DS) ++ install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" ++ DESTINATION "${SSG_CONTENT_INSTALL_DIR}") ++ endif() + + # This is a common cmake trick, we need the globbing to happen at build time + # and not configure time. + +From 466d3cb4dac4688e234a0fd0eff7fb6e6ae4c578 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Fri, 21 May 2021 09:50:25 +0200 +Subject: [PATCH 4/4] Add options for Bash and Ansible to build_product + +This will allow people to build easily without Bash scripts +or without Ansible Playbooks. +--- + build_product | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/build_product b/build_product +index cf84199e22e..8a186fbae0e 100755 +--- a/build_product ++++ b/build_product +@@ -7,6 +7,8 @@ + # ARG_OPTIONAL_SINGLE([jobs],[j],[Count of simultaneous jobs],[auto]) + # ARG_OPTIONAL_BOOLEAN([debug],[],[Make a debug build with draft profiles],[off]) + # ARG_OPTIONAL_BOOLEAN([derivatives],[],[Also build derivatives of products if applicable],[off]) ++# ARG_OPTIONAL_BOOLEAN([ansible-playbooks],[],[Build Ansible Playbooks for every profile],[on]) ++# ARG_OPTIONAL_BOOLEAN([bash-scripts],[],[Build Bash remediation scripts for every profile],[on]) + # ARG_OPTIONAL_BOOLEAN([datastream-only],[],[Build the datastream only. Do not build any of the guides, tables, etc],[off]) + # ARG_USE_ENV([ADDITIONAL_CMAKE_OPTIONS],[],[Whitespace-separated string of arguments to pass to CMake]) + # ARG_POSITIONAL_INF([product],[Products to build, ALL means all products],[0],[ALL]) +@@ -71,19 +73,23 @@ _arg_builder="auto" + _arg_jobs="auto" + _arg_debug="off" + _arg_derivatives="off" ++_arg_ansible_playbooks="on" ++_arg_bash_scripts="on" + _arg_datastream_only="off" + + + print_help() + { + printf '%s\n' "Wipes out contents of the 'build' directory and builds only and only the given products." +- printf 'Usage: %s [-o|--oval ] [-b|--builder ] [-j|--jobs ] [--(no-)debug] [--(no-)derivatives] [--(no-)datastream-only] [-h|--help] [] ... [] ...\n' "$0" ++ printf 'Usage: %s [-o|--oval ] [-b|--builder ] [-j|--jobs ] [--(no-)debug] [--(no-)derivatives] [--(no-)ansible-playbooks] [--(no-)bash-scripts] [--(no-)datastream-only] [-h|--help] [] ... [] ...\n' "$0" + printf '\t%s\n' ": Products to build, ALL means all products (defaults for : 'ALL')" + printf '\t%s\n' "-o, --oval: OVAL version. Can be one of: '5.10', '5.11' and 'auto' (default: 'auto')" + printf '\t%s\n' "-b, --builder: Builder engine. Can be one of: 'make', 'ninja' and 'auto' (default: 'auto')" + printf '\t%s\n' "-j, --jobs: Count of simultaneous jobs (default: 'auto')" + printf '\t%s\n' "--debug, --no-debug: Make a debug build with draft profiles (off by default)" + printf '\t%s\n' "--derivatives, --no-derivatives: Also build derivatives of products if applicable (off by default)" ++ printf '\t%s\n' "--ansible-playbooks, --no-ansible-playbooks: Build Ansible Playbooks for every profile (on by default)" ++ printf '\t%s\n' "--bash-scripts, --no-bash-scripts: Build Bash remediation scripts for every profile (on by default)" + printf '\t%s\n' "--datastream-only, --no-datastream-only: Build the datastream only. Do not build any of the guides, tables, etc (off by default)" + printf '\t%s\n' "-h, --help: Prints help" + printf '\nEnvironment variables that are supported:\n' +@@ -140,6 +146,14 @@ parse_commandline() + _arg_derivatives="on" + test "${1:0:5}" = "--no-" && _arg_derivatives="off" + ;; ++ --no-ansible-playbooks|--ansible-playbooks) ++ _arg_ansible_playbooks="on" ++ test "${1:0:5}" = "--no-" && _arg_ansible_playbooks="off" ++ ;; ++ --no-bash-scripts|--bash-scripts) ++ _arg_bash_scripts="on" ++ test "${1:0:5}" = "--no-" && _arg_bash_scripts="off" ++ ;; + --no-datastream-only|--datastream-only) + _arg_datastream_only="on" + test "${1:0:5}" = "--no-" && _arg_datastream_only="off" +@@ -339,6 +353,12 @@ done + + CMAKE_OPTIONS=(${ADDITIONAL_CMAKE_OPTIONS} "${build_type_option}" "${oval_major_version_option}" "${oval_minor_version_option}" '-DSSG_PRODUCT_DEFAULT=OFF' "${cmake_enable_args[@]}" -G "$cmake_generator") + set_no_derivatives_options ++if [ "$_arg_ansible_playbooks" = off ] ; then ++ CMAKE_OPTIONS+=("-DSSG_ANSIBLE_PLAYBOOKS_ENABLED:BOOL=OFF") ++fi ++if [ "$_arg_bash_scripts" = off ] ; then ++ CMAKE_OPTIONS+=("-DSSG_BASH_SCRIPTS_ENABLED:BOOL=OFF") ++fi + EXPLICIT_BUILD_TARGETS=() + set_explict_build_targets + diff --git a/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch b/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch new file mode 100644 index 0000000..595f26a --- /dev/null +++ b/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch @@ -0,0 +1,202 @@ +From 35c61f74925f99536595824b0e787254ed89c64f Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Wed, 26 May 2021 11:36:58 +0200 +Subject: [PATCH 1/3] Fix output declararation of command generating ds + +The custom command declares that it outputs the derivative 1.2 ds and +this causes the actual command that generates the derivative 1.2 not to +be run. +--- + cmake/SSGCommon.cmake | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake +index 412db46c68..272b40ccf3 100644 +--- a/cmake/SSGCommon.cmake ++++ b/cmake/SSGCommon.cmake +@@ -939,7 +939,6 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) + + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" + DEPENDS generate-ssg-${ORIGINAL}-ds.xml + +From 551c225accec34e55ac1f011fbd5db7755b5f9ed Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Wed, 26 May 2021 14:46:26 +0200 +Subject: [PATCH 2/3] Fix order in which SCAP 1.2 and 1.3 are generated + +The data stream can be upgraded to 1.3, but not downgrated to 1.2. +Instead of chaining generation of DS version on each other, let's +generate a base ds from which SCAP 1.2 and 1.3 are generated. +--- + cmake/SSGCommon.cmake | 43 ++++++++++++++++++++++++------------------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake +index 272b40ccf3..977c3957d1 100644 +--- a/cmake/SSGCommon.cmake ++++ b/cmake/SSGCommon.cmake +@@ -554,16 +554,14 @@ endmacro() + macro(ssg_build_sds PRODUCT) + if("${PRODUCT}" MATCHES "rhel(6|7)") + add_custom_command( +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -575,19 +573,17 @@ macro(ssg_build_sds PRODUCT) + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" + DEPENDS generate-ssg-${PRODUCT}-pcidss-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" +- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" ++ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-base.xml" + ) + else() + add_custom_command( +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -597,17 +593,26 @@ macro(ssg_build_sds PRODUCT) + DEPENDS generate-ssg-${PRODUCT}-cpe-dictionary.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-dictionary.xml" + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" +- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" ++ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-base.xml" + ) + endif() + ++ add_custom_command( ++ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMENT "[${PRODUCT}-content] Updating data stream ssg-${PRODUCT}-ds.xml to 1.3" ++ ) ++ + if(SSG_BUILD_SCAP_12_DS) + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" + COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" + ) + add_custom_target( + +From 97b1df0349c9c685cc07a0d3e3fd88385e0cd15d Mon Sep 17 00:00:00 2001 +From: Watson Sato +Date: Wed, 26 May 2021 14:51:32 +0200 +Subject: [PATCH 3/3] Move product base ds to product dir + +The base ds is used to facilitate generation of SCAP 1.2 and SCAP 1.3 +data streams. +The base ds is an intermediary product and can be stored in the product +specific dir. +--- + cmake/SSGCommon.cmake | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake +index 977c3957d1..111b2b32ed 100644 +--- a/cmake/SSGCommon.cmake ++++ b/cmake/SSGCommon.cmake +@@ -554,14 +554,14 @@ endmacro() + macro(ssg_build_sds PRODUCT) + if("${PRODUCT}" MATCHES "rhel(6|7)") + add_custom_command( +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ OUTPUT "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -577,13 +577,13 @@ macro(ssg_build_sds PRODUCT) + ) + else() + add_custom_command( +- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ OUTPUT "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" + # use --skip-valid here to avoid repeatedly validating everything +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml + DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" + DEPENDS generate-ssg-${PRODUCT}-oval.xml +@@ -600,9 +600,9 @@ macro(ssg_build_sds PRODUCT) + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + COMMENT "[${PRODUCT}-content] Updating data stream ssg-${PRODUCT}-ds.xml to 1.3" + ) + +@@ -610,9 +610,9 @@ macro(ssg_build_sds PRODUCT) + add_custom_command( + OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" +- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" ++ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" + COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" +- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" ++ DEPENDS "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" + COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" + ) + add_custom_target( diff --git a/scap-security-guide.spec b/scap-security-guide.spec index fac3148..42cff97 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,16 +5,16 @@ Name: scap-security-guide Version: 0.1.56 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats -%if 0%{?rhel} -Group: Applications/System -%endif License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch +Patch0: scap-security-guide-0.1.57-build-system-pr-7025.patch +Patch1: scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch + BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 @@ -24,10 +24,7 @@ BuildRequires: /usr/bin/python3 BuildRequires: python%{python3_pkgversion} BuildRequires: python%{python3_pkgversion}-jinja2 BuildRequires: python%{python3_pkgversion}-PyYAML -BuildRequires: python%{python3_pkgversion}-lxml Requires: xml-common, openscap-scanner >= 1.2.5 -Obsoletes: openscap-content < 0:0.9.13 -Provides: openscap-content %description The scap-security-guide project provides a guide for configuration of the @@ -43,9 +40,6 @@ further information. %package doc Summary: HTML formatted security guides generated from XCCDF benchmarks -%if 0%{?rhel} -Group: System Environment/Base -%endif Requires: %{name} = %{version}-%{release} %description doc @@ -54,36 +48,42 @@ hardening guidances that have been generated from XCCDF benchmarks present in %{name} package. %prep -%autosetup +%autosetup -p1 -%define cmake_defines %{nil} +%define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF +%define cmake_defines_specific %{nil} %if 0%{?rhel} -%define cmake_defines -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL7:BOOLEAN=TRUE -DSSG_PRODUCT_RHEL8:BOOLEAN=TRUE -DSSG_PRODUCT_FIREFOX:BOOLEAN=TRUE -DSSG_PRODUCT_JRE:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF +%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF %endif mkdir -p build %build -%cmake %{cmake_defines} +%cmake %{cmake_defines_common} %{cmake_defines_specific} %cmake_build %install %cmake_install +rm %{buildroot}/%{_docdir}/%{name}/README.md +rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %files %{_datadir}/xml/scap/ssg/content %{_datadir}/%{name}/kickstart -%{_datadir}/%{name}/ansible -%{_datadir}/%{name}/bash +%{_datadir}/%{name}/ansible/*.yml %lang(en) %{_mandir}/man8/scap-security-guide.8.* %doc %{_docdir}/%{name}/LICENSE -%doc %{_docdir}/%{name}/README.md -%doc %{_docdir}/%{name}/Contributors.md %files doc %doc %{_docdir}/%{name}/guides/*.html %doc %{_docdir}/%{name}/tables/*.html %changelog +* Tue Jun 08 2021 Matej Tyc - 0.1.56-2 +- Updated the packaging according to the RHEL development trends. +- Don't ship 1.2 datastreams and Bash remediations. +- Clean up dependencies and other package metadata. +- Change the RHEL target. + * Wed May 26 2021 Vojtech Polasek - 0.1.56-1 - Update to latest upstream SCAP-Security-Guide-0.1.56 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 From a4377deb598617be87c8faa7cd4194428cef51fd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 17:08:28 +0000 Subject: [PATCH 16/66] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 42cff97..38e9acb 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.56 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -78,6 +78,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 0.1.56-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Jun 08 2021 Matej Tyc - 0.1.56-2 - Updated the packaging according to the RHEL development trends. - Don't ship 1.2 datastreams and Bash remediations. From 1a4066dba6fff4f862d7c3a1c40704c9e719064b Mon Sep 17 00:00:00 2001 From: Matej Tyc Date: Thu, 29 Jul 2021 17:31:37 +0200 Subject: [PATCH 17/66] Rebase to a new upstream release --- .gitignore | 1 + ...ty-guide-0.1.57-build-system-pr-7025.patch | 477 ------------------ ...-0.1.57-fix-build-scap-12-ds-pr-7049.patch | 202 -------- ...-0.1.58-fix_service_disabled-PR_7296.patch | 55 ++ scap-security-guide.spec | 35 +- sources | 2 +- 6 files changed, 87 insertions(+), 685 deletions(-) delete mode 100644 scap-security-guide-0.1.57-build-system-pr-7025.patch delete mode 100644 scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch create mode 100644 scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch diff --git a/.gitignore b/.gitignore index 300dd31..08fa126 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ /scap-security-guide-0.1.54.tar.bz2 /scap-security-guide-0.1.55.tar.bz2 /scap-security-guide-0.1.56.tar.bz2 +/scap-security-guide-0.1.57.tar.bz2 diff --git a/scap-security-guide-0.1.57-build-system-pr-7025.patch b/scap-security-guide-0.1.57-build-system-pr-7025.patch deleted file mode 100644 index fd69a4b..0000000 --- a/scap-security-guide-0.1.57-build-system-pr-7025.patch +++ /dev/null @@ -1,477 +0,0 @@ -From aae5be64cdeb4a41caa3f3273342373cc4f4e9b2 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Wed, 19 May 2021 18:01:14 +0200 -Subject: [PATCH 1/4] Add options for building Ansible and Bash content - -This patch adds 2 new options SSG_ANSIBLE_PLAYBOOKS_ENABLED and -SSG_BASH_SCRIPTS_ENABLED which will allow user to turn on or off -building and installing profile Bash remediation scripts and profile -Ansible Playbooks. They are enabled by default, therefore the default -behavior doesn't change, but people can turn them off to speed up the -build. These options can be useful when calling cmake in downstream spec -files. ---- - CMakeLists.txt | 4 +++ - cmake/SSGCommon.cmake | 60 +++++++++++++++++++++++-------------------- - 2 files changed, 36 insertions(+), 28 deletions(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index 32a0ddd240a..c309efde9bd 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -46,6 +46,8 @@ option(SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED "If enabled, shellcheck vali - option(SSG_LINKCHECKER_VALIDATION_ENABLED "If enabled, linkchecker will be used to validate URLs in all the HTML guides and tables." TRUE) - option(SSG_SVG_IN_XCCDF_ENABLED "If enabled, the built XCCDFs will include the SVG SCAP Security Guide logo." TRUE) - option(SSG_SEPARATE_SCAP_FILES_ENABLED "If enabled, separate SCAP files (OVAL, XCCDF, CPE dict, ...) will be installed alongside the source data-streams" TRUE) -+option(SSG_ANSIBLE_PLAYBOOKS_ENABLED "If enabled, Ansible Playbooks for each profile will be built and installed." TRUE) -+option(SSG_BASH_SCRIPTS_ENABLED "If enabled, Bash remediation scripts for each profile will be built and installed." TRUE) - option(SSG_JINJA2_CACHE_ENABLED "If enabled, the jinja2 templating files will be cached into bytecode. Also see SSG_JINJA2_CACHE_DIR." TRUE) - option(SSG_BATS_TESTS_ENABLED "If enabled, bats will be used to run unit-tests of bash remediations." TRUE) - set(SSG_JINJA2_CACHE_DIR "${CMAKE_BINARY_DIR}/jinja2_cache" CACHE PATH "Where the jinja2 cached bytecode should be stored. This speeds up builds at the expense of disk space. You can use one location for multiple SSG builds for performance improvements.") -@@ -240,6 +242,8 @@ message(STATUS "OVAL schematron validation: ${SSG_OVAL_SCHEMATRON_VALIDATION_ENA - message(STATUS "shellcheck bash fixes validation: ${SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED}") - message(STATUS "SVG logo in XCCDFs: ${SSG_SVG_IN_XCCDF_ENABLED}") - message(STATUS "Separate SCAP files: ${SSG_SEPARATE_SCAP_FILES_ENABLED}") -+message(STATUS "Ansible Playbooks: ${SSG_ANSIBLE_PLAYBOOKS_ENABLED}") -+message(STATUS "Bash scripts: ${SSG_BASH_SCRIPTS_ENABLED}") - if (SSG_JINJA2_CACHE_ENABLED) - message(STATUS "jinja2 cache: enabled") - message(STATUS "jinja2 cache dir: ${SSG_JINJA2_CACHE_DIR}") -diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake -index 889c0cf1d3c..9b109f86b9f 100644 ---- a/cmake/SSGCommon.cmake -+++ b/cmake/SSGCommon.cmake -@@ -789,7 +789,7 @@ macro(ssg_build_product PRODUCT) - - add_dependencies(zipfile "generate-ssg-${PRODUCT}-ds.xml") - -- if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}") -+ if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}" AND SSG_ANSIBLE_PLAYBOOKS_ENABLED) - add_dependencies( - ${PRODUCT}-content - generate-${PRODUCT}-ansible-playbooks -@@ -803,7 +803,7 @@ macro(ssg_build_product PRODUCT) - add_dependencies(zipfile ${PRODUCT}-profile-playbooks) - endif() - -- if ("${PRODUCT_BASH_REMEDIATION_ENABLED}") -+ if ("${PRODUCT_BASH_REMEDIATION_ENABLED}" AND SSG_BASH_SCRIPTS_ENABLED) - ssg_build_profile_bash_scripts(${PRODUCT}) - add_custom_target( - ${PRODUCT}-profile-bash-scripts -@@ -873,30 +873,34 @@ macro(ssg_build_product PRODUCT) - endif() - " - ) -- install( -- CODE " -- file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/ansible/${PRODUCT}-playbook-*.yml\") \n -- if(NOT IS_ABSOLUTE ${SSG_ANSIBLE_ROLE_INSTALL_DIR}) -- file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" -- TYPE FILE FILES \${ROLE_FILES}) -- else() -- file(INSTALL DESTINATION \"${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" -- TYPE FILE FILES \${ROLE_FILES}) -- endif() -- " -- ) -- install( -- CODE " -- file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/bash/${PRODUCT}-script-*.sh\") \n -- if(NOT IS_ABSOLUTE ${SSG_BASH_ROLE_INSTALL_DIR}) -- file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_BASH_ROLE_INSTALL_DIR}\" -- TYPE FILE FILES \${ROLE_FILES}) -- else() -- file(INSTALL DESTINATION \"${SSG_BASH_ROLE_INSTALL_DIR}\" -- TYPE FILE FILES \${ROLE_FILES}) -- endif() -- " -- ) -+ if(SSG_ANSIBLE_PLAYBOOKS_ENABLED) -+ install( -+ CODE " -+ file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/ansible/${PRODUCT}-playbook-*.yml\") \n -+ if(NOT IS_ABSOLUTE ${SSG_ANSIBLE_ROLE_INSTALL_DIR}) -+ file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" -+ TYPE FILE FILES \${ROLE_FILES}) -+ else() -+ file(INSTALL DESTINATION \"${SSG_ANSIBLE_ROLE_INSTALL_DIR}\" -+ TYPE FILE FILES \${ROLE_FILES}) -+ endif() -+ " -+ ) -+ endif() -+ if(SSG_BASH_SCRIPTS_ENABLED) -+ install( -+ CODE " -+ file(GLOB ROLE_FILES \"${CMAKE_BINARY_DIR}/bash/${PRODUCT}-script-*.sh\") \n -+ if(NOT IS_ABSOLUTE ${SSG_BASH_ROLE_INSTALL_DIR}) -+ file(INSTALL DESTINATION \"\${CMAKE_INSTALL_PREFIX}/${SSG_BASH_ROLE_INSTALL_DIR}\" -+ TYPE FILE FILES \${ROLE_FILES}) -+ else() -+ file(INSTALL DESTINATION \"${SSG_BASH_ROLE_INSTALL_DIR}\" -+ TYPE FILE FILES \${ROLE_FILES}) -+ endif() -+ " -+ ) -+ endif() - - # grab all the kickstarts (if any) and install them - file(GLOB KICKSTART_FILES "${CMAKE_CURRENT_SOURCE_DIR}/kickstart/ssg-${PRODUCT}-*-ks.cfg") -@@ -968,7 +972,7 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - - ssg_build_html_guides(${DERIVATIVE}) - -- if ("${PRODUCT_BASH_REMEDIATION_ENABLED}") -+ if ("${PRODUCT_BASH_REMEDIATION_ENABLED}" AND SSG_BASH_SCRIPTS_ENABLED) - ssg_build_profile_bash_scripts(${DERIVATIVE}) - add_custom_target( - ${DERIVATIVE}-profile-bash-scripts -@@ -977,7 +981,7 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - add_dependencies(${DERIVATIVE} ${DERIVATIVE}-profile-bash-scripts) - endif() - -- if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}") -+ if ("${PRODUCT_ANSIBLE_REMEDIATION_ENABLED}" AND SSG_ANSIBLE_PLAYBOOKS_ENABLED) - ssg_build_profile_playbooks(${DERIVATIVE}) - add_custom_target( - ${DERIVATIVE}-profile-playbooks - -From c7c7baa84ce722304224373c556a2d03edb0f76c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 20 May 2021 09:14:21 +0200 -Subject: [PATCH 2/4] Do not build HTML guide for the virtual default profile - -The virtual '(default)' profile is a profile that doesn't contain -any rules, so the built HTML guide also doesn't contain any rules -which means it contains only group descriptions. This HTML guide -has no use for the users and it only increases the built size. ---- - ssg/build_guides.py | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/ssg/build_guides.py b/ssg/build_guides.py -index 3b2a9469240..2e37d80eef3 100644 ---- a/ssg/build_guides.py -+++ b/ssg/build_guides.py -@@ -105,10 +105,6 @@ def get_benchmark_profile_pairs(input_tree, benchmarks): - for benchmark_id in benchmarks.keys(): - profiles = get_profile_choices_for_input(input_tree, benchmark_id, - None) -- -- # add the default profile -- profiles[""] = "(default)" -- - for profile_id in profiles: - pair = (benchmark_id, profile_id, profiles[profile_id]) - benchmark_profile_pairs.append(pair) - -From f2c265013dd5fe75fd47c8ce7afe9e2ecc7cf16f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 20 May 2021 09:49:51 +0200 -Subject: [PATCH 3/4] Add option to disable SCAP 1.2 data streams - -This commit adds a new option that enables to turn on building -the SCAP 1.2 source data streams (ssg-*-ds-1.2.xml). This option -will help people who don't want to build and ship this file. -The default setting is TRUE which means the default behavior -shouldn't change. ---- - CMakeLists.txt | 2 + - cmake/SSGCommon.cmake | 100 +++++++++++++++++++++++++++--------------- - 2 files changed, 67 insertions(+), 35 deletions(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index c309efde9bd..55b991cedfa 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -41,6 +41,7 @@ set(SSG_TARGET_OVAL_MINOR_VERSION "11" CACHE STRING "Which minor version of OVAL - - set(SSG_TARGET_OVAL_VERSION "${SSG_TARGET_OVAL_MAJOR_VERSION}.${SSG_TARGET_OVAL_MINOR_VERSION}") - -+option(SSG_BUILD_SCAP_12_DS "If enabled, ssg-*-ds-1.2.xml will be built along with ssg-*-ds.xml" TRUE) - option(SSG_OVAL_SCHEMATRON_VALIDATION_ENABLED "If enabled, schematron validation will be performed as part of the ctest tests. Schematron takes a lot of time to complete but can find more issues than just plain XSD validation." TRUE) - option(SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED "If enabled, shellcheck validation of bash fixes will be performed as part of the ctest tests. Shellcheck tests don't pass right now, this option is discouraged until that's fixed." FALSE) - option(SSG_LINKCHECKER_VALIDATION_ENABLED "If enabled, linkchecker will be used to validate URLs in all the HTML guides and tables." TRUE) -@@ -238,6 +239,7 @@ message(STATUS " ") - message(STATUS "Build options:") - message(STATUS "SSG vendor string: ${SSG_VENDOR}") - message(STATUS "Target OVAL version: ${SSG_TARGET_OVAL_VERSION}") -+message(STATUS "Build SCAP 1.2 source data streams: ${SSG_BUILD_SCAP_12_DS}") - message(STATUS "OVAL schematron validation: ${SSG_OVAL_SCHEMATRON_VALIDATION_ENABLED}") - message(STATUS "shellcheck bash fixes validation: ${SSG_SHELLCHECK_BASH_FIXES_VALIDATION_ENABLED}") - message(STATUS "SVG logo in XCCDFs: ${SSG_SVG_IN_XCCDF_ENABLED}") -diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake -index 9b109f86b9f..412db46c687 100644 ---- a/cmake/SSGCommon.cmake -+++ b/cmake/SSGCommon.cmake -@@ -555,7 +555,6 @@ macro(ssg_build_sds PRODUCT) - if("${PRODUCT}" MATCHES "rhel(6|7)") - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -@@ -563,10 +562,8 @@ macro(ssg_build_sds PRODUCT) - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -578,22 +575,19 @@ macro(ssg_build_sds PRODUCT) - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" - DEPENDS generate-ssg-${PRODUCT}-pcidss-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" -- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml and ssg-${PRODUCT}-ds-1.2.xml" -+ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" - ) - else() - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -603,14 +597,30 @@ macro(ssg_build_sds PRODUCT) - DEPENDS generate-ssg-${PRODUCT}-cpe-dictionary.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-dictionary.xml" - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" -- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml and ssg-${PRODUCT}-ds-1.2.xml" -+ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" -+ ) -+ endif() -+ -+ if(SSG_BUILD_SCAP_12_DS) -+ add_custom_command( -+ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" -+ ) -+ add_custom_target( -+ generate-ssg-${PRODUCT}-ds.xml -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ ) -+ else() -+ add_custom_target( -+ generate-ssg-${PRODUCT}-ds.xml -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - ) - endif() -- add_custom_target( -- generate-ssg-${PRODUCT}-ds.xml -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -- ) - - if("${PRODUCT}" MATCHES "rhel(6|7|8|9)") - add_test( -@@ -626,10 +636,12 @@ macro(ssg_build_sds PRODUCT) - NAME "validate-ssg-${PRODUCT}-ds.xml" - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - ) -- add_test( -- NAME "validate-ssg-${PRODUCT}-ds-1.2.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -- ) -+ if(SSG_BUILD_SCAP_12_DS) -+ add_test( -+ NAME "validate-ssg-${PRODUCT}-ds-1.2.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ ) -+ endif() - endif() - endmacro() - -@@ -640,7 +652,6 @@ macro(ssg_build_html_guides PRODUCT) - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/build_all_guides.py" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/guides" build - DEPENDS generate-ssg-${PRODUCT}-ds.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - COMMENT "[${PRODUCT}-guides] generating HTML guides for all profiles in ssg-${PRODUCT}-ds.xml" - ) - add_custom_target( -@@ -854,8 +865,10 @@ macro(ssg_build_product PRODUCT) - install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - DESTINATION "${SSG_CONTENT_INSTALL_DIR}") - -- install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -- DESTINATION "${SSG_CONTENT_INSTALL_DIR}") -+ if(SSG_BUILD_SCAP_12_DS) -+ install(FILES "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ DESTINATION "${SSG_CONTENT_INSTALL_DIR}") -+ endif() - - # This is a common cmake trick, we need the globbing to happen at build time - # and not configure time. -@@ -927,21 +940,34 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" -- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" - DEPENDS generate-ssg-${ORIGINAL}-ds.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" - DEPENDS "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" -- COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds.xml and ssg-${DERIVATIVE}-ds-1.2.xml" -- ) -- add_custom_target( -- generate-ssg-${DERIVATIVE}-ds.xml -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds.xml" - ) -+ if (SSG_BUILD_SCAP_12_DS) -+ add_custom_command( -+ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg -+ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds-1.2.xml" -+ DEPENDS "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" -+ COMMENT "[${DERIVATIVE}-content] generating ssg-${DERIVATIVE}-ds-1.2.xml" -+ ) -+ add_custom_target( -+ generate-ssg-${DERIVATIVE}-ds.xml -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ ) -+ else() -+ add_custom_target( -+ generate-ssg-${DERIVATIVE}-ds.xml -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" -+ ) -+ endif() -+ - define_validate_product("${PRODUCT}") - if ("${VALIDATE_PRODUCT}" OR "${FORCE_VALIDATE_EVERYTHING}") - add_test( -@@ -952,10 +978,12 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - NAME "validate-ssg-${DERIVATIVE}-ds.xml" - COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" - ) -- add_test( -- NAME "validate-ssg-${DERIVATIVE}-ds-1.2.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -- ) -+ if (SSG_BUILD_SCAP_12_DS) -+ add_test( -+ NAME "validate-ssg-${DERIVATIVE}-ds-1.2.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-validate "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ ) -+ endif() - endif() - - add_custom_target(${DERIVATIVE} ALL) -@@ -1004,8 +1032,10 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" - DESTINATION "${SSG_CONTENT_INSTALL_DIR}") - -- install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -- DESTINATION "${SSG_CONTENT_INSTALL_DIR}") -+ if(SSG_BUILD_SCAP_12_DS) -+ install(FILES "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" -+ DESTINATION "${SSG_CONTENT_INSTALL_DIR}") -+ endif() - - # This is a common cmake trick, we need the globbing to happen at build time - # and not configure time. - -From 466d3cb4dac4688e234a0fd0eff7fb6e6ae4c578 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Fri, 21 May 2021 09:50:25 +0200 -Subject: [PATCH 4/4] Add options for Bash and Ansible to build_product - -This will allow people to build easily without Bash scripts -or without Ansible Playbooks. ---- - build_product | 22 +++++++++++++++++++++- - 1 file changed, 21 insertions(+), 1 deletion(-) - -diff --git a/build_product b/build_product -index cf84199e22e..8a186fbae0e 100755 ---- a/build_product -+++ b/build_product -@@ -7,6 +7,8 @@ - # ARG_OPTIONAL_SINGLE([jobs],[j],[Count of simultaneous jobs],[auto]) - # ARG_OPTIONAL_BOOLEAN([debug],[],[Make a debug build with draft profiles],[off]) - # ARG_OPTIONAL_BOOLEAN([derivatives],[],[Also build derivatives of products if applicable],[off]) -+# ARG_OPTIONAL_BOOLEAN([ansible-playbooks],[],[Build Ansible Playbooks for every profile],[on]) -+# ARG_OPTIONAL_BOOLEAN([bash-scripts],[],[Build Bash remediation scripts for every profile],[on]) - # ARG_OPTIONAL_BOOLEAN([datastream-only],[],[Build the datastream only. Do not build any of the guides, tables, etc],[off]) - # ARG_USE_ENV([ADDITIONAL_CMAKE_OPTIONS],[],[Whitespace-separated string of arguments to pass to CMake]) - # ARG_POSITIONAL_INF([product],[Products to build, ALL means all products],[0],[ALL]) -@@ -71,19 +73,23 @@ _arg_builder="auto" - _arg_jobs="auto" - _arg_debug="off" - _arg_derivatives="off" -+_arg_ansible_playbooks="on" -+_arg_bash_scripts="on" - _arg_datastream_only="off" - - - print_help() - { - printf '%s\n' "Wipes out contents of the 'build' directory and builds only and only the given products." -- printf 'Usage: %s [-o|--oval ] [-b|--builder ] [-j|--jobs ] [--(no-)debug] [--(no-)derivatives] [--(no-)datastream-only] [-h|--help] [] ... [] ...\n' "$0" -+ printf 'Usage: %s [-o|--oval ] [-b|--builder ] [-j|--jobs ] [--(no-)debug] [--(no-)derivatives] [--(no-)ansible-playbooks] [--(no-)bash-scripts] [--(no-)datastream-only] [-h|--help] [] ... [] ...\n' "$0" - printf '\t%s\n' ": Products to build, ALL means all products (defaults for : 'ALL')" - printf '\t%s\n' "-o, --oval: OVAL version. Can be one of: '5.10', '5.11' and 'auto' (default: 'auto')" - printf '\t%s\n' "-b, --builder: Builder engine. Can be one of: 'make', 'ninja' and 'auto' (default: 'auto')" - printf '\t%s\n' "-j, --jobs: Count of simultaneous jobs (default: 'auto')" - printf '\t%s\n' "--debug, --no-debug: Make a debug build with draft profiles (off by default)" - printf '\t%s\n' "--derivatives, --no-derivatives: Also build derivatives of products if applicable (off by default)" -+ printf '\t%s\n' "--ansible-playbooks, --no-ansible-playbooks: Build Ansible Playbooks for every profile (on by default)" -+ printf '\t%s\n' "--bash-scripts, --no-bash-scripts: Build Bash remediation scripts for every profile (on by default)" - printf '\t%s\n' "--datastream-only, --no-datastream-only: Build the datastream only. Do not build any of the guides, tables, etc (off by default)" - printf '\t%s\n' "-h, --help: Prints help" - printf '\nEnvironment variables that are supported:\n' -@@ -140,6 +146,14 @@ parse_commandline() - _arg_derivatives="on" - test "${1:0:5}" = "--no-" && _arg_derivatives="off" - ;; -+ --no-ansible-playbooks|--ansible-playbooks) -+ _arg_ansible_playbooks="on" -+ test "${1:0:5}" = "--no-" && _arg_ansible_playbooks="off" -+ ;; -+ --no-bash-scripts|--bash-scripts) -+ _arg_bash_scripts="on" -+ test "${1:0:5}" = "--no-" && _arg_bash_scripts="off" -+ ;; - --no-datastream-only|--datastream-only) - _arg_datastream_only="on" - test "${1:0:5}" = "--no-" && _arg_datastream_only="off" -@@ -339,6 +353,12 @@ done - - CMAKE_OPTIONS=(${ADDITIONAL_CMAKE_OPTIONS} "${build_type_option}" "${oval_major_version_option}" "${oval_minor_version_option}" '-DSSG_PRODUCT_DEFAULT=OFF' "${cmake_enable_args[@]}" -G "$cmake_generator") - set_no_derivatives_options -+if [ "$_arg_ansible_playbooks" = off ] ; then -+ CMAKE_OPTIONS+=("-DSSG_ANSIBLE_PLAYBOOKS_ENABLED:BOOL=OFF") -+fi -+if [ "$_arg_bash_scripts" = off ] ; then -+ CMAKE_OPTIONS+=("-DSSG_BASH_SCRIPTS_ENABLED:BOOL=OFF") -+fi - EXPLICIT_BUILD_TARGETS=() - set_explict_build_targets - diff --git a/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch b/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch deleted file mode 100644 index 595f26a..0000000 --- a/scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch +++ /dev/null @@ -1,202 +0,0 @@ -From 35c61f74925f99536595824b0e787254ed89c64f Mon Sep 17 00:00:00 2001 -From: Watson Sato -Date: Wed, 26 May 2021 11:36:58 +0200 -Subject: [PATCH 1/3] Fix output declararation of command generating ds - -The custom command declares that it outputs the derivative 1.2 ds and -this causes the actual command that generates the derivative 1.2 not to -be run. ---- - cmake/SSGCommon.cmake | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake -index 412db46c68..272b40ccf3 100644 ---- a/cmake/SSGCommon.cmake -+++ b/cmake/SSGCommon.cmake -@@ -939,7 +939,6 @@ macro(ssg_build_derivative_product ORIGINAL SHORTNAME DERIVATIVE) - - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds-1.2.xml" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/enable_derivatives.py" --enable-${SHORTNAME} -i "${CMAKE_BINARY_DIR}/ssg-${ORIGINAL}-ds.xml" -o "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_CURRENT_SOURCE_DIR}/product.yml" ${DERIVATIVE} --id-name ssg - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${DERIVATIVE}-ds.xml" - DEPENDS generate-ssg-${ORIGINAL}-ds.xml - -From 551c225accec34e55ac1f011fbd5db7755b5f9ed Mon Sep 17 00:00:00 2001 -From: Watson Sato -Date: Wed, 26 May 2021 14:46:26 +0200 -Subject: [PATCH 2/3] Fix order in which SCAP 1.2 and 1.3 are generated - -The data stream can be upgraded to 1.3, but not downgrated to 1.2. -Instead of chaining generation of DS version on each other, let's -generate a base ds from which SCAP 1.2 and 1.3 are generated. ---- - cmake/SSGCommon.cmake | 43 ++++++++++++++++++++++++------------------- - 1 file changed, 24 insertions(+), 19 deletions(-) - -diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake -index 272b40ccf3..977c3957d1 100644 ---- a/cmake/SSGCommon.cmake -+++ b/cmake/SSGCommon.cmake -@@ -554,16 +554,14 @@ endmacro() - macro(ssg_build_sds PRODUCT) - if("${PRODUCT}" MATCHES "rhel(6|7)") - add_custom_command( -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -575,19 +573,17 @@ macro(ssg_build_sds PRODUCT) - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" - DEPENDS generate-ssg-${PRODUCT}-pcidss-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" -- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" -+ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-base.xml" - ) - else() - add_custom_command( -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -597,17 +593,26 @@ macro(ssg_build_sds PRODUCT) - DEPENDS generate-ssg-${PRODUCT}-cpe-dictionary.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-dictionary.xml" - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-cpe-oval.xml" -- COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds.xml" -+ COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-base.xml" - ) - endif() - -+ add_custom_command( -+ OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMENT "[${PRODUCT}-content] Updating data stream ssg-${PRODUCT}-ds.xml to 1.3" -+ ) -+ - if(SSG_BUILD_SCAP_12_DS) - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" - COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" - ) - add_custom_target( - -From 97b1df0349c9c685cc07a0d3e3fd88385e0cd15d Mon Sep 17 00:00:00 2001 -From: Watson Sato -Date: Wed, 26 May 2021 14:51:32 +0200 -Subject: [PATCH 3/3] Move product base ds to product dir - -The base ds is used to facilitate generation of SCAP 1.2 and SCAP 1.3 -data streams. -The base ds is an intermediary product and can be stored in the product -specific dir. ---- - cmake/SSGCommon.cmake | 30 +++++++++++++++--------------- - 1 file changed, 15 insertions(+), 15 deletions(-) - -diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake -index 977c3957d1..111b2b32ed 100644 ---- a/cmake/SSGCommon.cmake -+++ b/cmake/SSGCommon.cmake -@@ -554,14 +554,14 @@ endmacro() - macro(ssg_build_sds PRODUCT) - if("${PRODUCT}" MATCHES "rhel(6|7)") - add_custom_command( -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ OUTPUT "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-pcidss-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -577,13 +577,13 @@ macro(ssg_build_sds PRODUCT) - ) - else() - add_custom_command( -- OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ OUTPUT "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" - # use --skip-valid here to avoid repeatedly validating everything -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-compose --skip-valid "ssg-${PRODUCT}-xccdf-1.2.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${SED_EXECUTABLE}" -i 's/schematron-version="[0-9].[0-9]"/schematron-version="1.2"/' "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" ds sds-add --skip-valid "ssg-${PRODUCT}-cpe-dictionary.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/sds_move_ocil_to_checks.py" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - DEPENDS generate-ssg-${PRODUCT}-xccdf-1.2.xml - DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-xccdf-1.2.xml" - DEPENDS generate-ssg-${PRODUCT}-oval.xml -@@ -600,9 +600,9 @@ macro(ssg_build_sds PRODUCT) - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.3" --input "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - COMMENT "[${PRODUCT}-content] Updating data stream ssg-${PRODUCT}-ds.xml to 1.3" - ) - -@@ -610,9 +610,9 @@ macro(ssg_build_sds PRODUCT) - add_custom_command( - OUTPUT "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - WORKING_DIRECTORY "${CMAKE_BINARY_DIR}" -- COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -+ COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${SSG_BUILD_SCRIPTS}/update_sds_version.py" --version "1.2" --input "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" - COMMAND "${XMLLINT_EXECUTABLE}" --nsclean --format --output "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-1.2.xml" -- DEPENDS "${CMAKE_BINARY_DIR}/ssg-${PRODUCT}-ds-base.xml" -+ DEPENDS "${CMAKE_BINARY_DIR}/${PRODUCT}/ssg-${PRODUCT}-ds-base.xml" - COMMENT "[${PRODUCT}-content] generating ssg-${PRODUCT}-ds-1.2.xml" - ) - add_custom_target( diff --git a/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch b/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch new file mode 100644 index 0000000..79a2711 --- /dev/null +++ b/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch @@ -0,0 +1,55 @@ +From 460922d3b258ba5b437afc99b5b02d2690788db9 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 27 Jul 2021 15:20:08 -0400 +Subject: [PATCH] Remove FragmentPath check from service_disabled + +In https://github.com/systemd/systemd/issues/582 it is documented that +systemd could eventually replace FragmentPath=/dev/null (on masked +services) with the actual service path -- not the fully (symlink) +resolved path as is currently the case. + +This matches the behavior currently seen in Ubuntu (all versions) and +RHEL 9/Fedora 34. + +Per discussion with Gabriel, Matej, Richard, and Matt, it is best to +remove this check, especially since ActiveState=Masked suffices. + +Resolves: #7280 +Resolves: #7248 + +Signed-off-by: Alexander Scheel +--- + shared/templates/service_disabled/oval.template | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/shared/templates/service_disabled/oval.template b/shared/templates/service_disabled/oval.template +index 33b52518307..e4ccb0566e7 100644 +--- a/shared/templates/service_disabled/oval.template ++++ b/shared/templates/service_disabled/oval.template +@@ -13,7 +13,6 @@ + + + +- + + + +@@ -41,18 +40,6 @@ + masked + + +- +- +- +- +- +- ^{{{ SERVICENAME }}}\.(service|socket)$ +- FragmentPath +- +- +- /dev/null +- +- + {{% else %}} + + {{% if init_system != "systemd" %}} diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 38e9acb..ceea514 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,16 +4,15 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.56 -Release: 3%{?dist} +Version: 0.1.57 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch -Patch0: scap-security-guide-0.1.57-build-system-pr-7025.patch -Patch1: scap-security-guide-0.1.57-fix-build-scap-12-ds-pr-7049.patch +Patch0: scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch BuildRequires: libxslt BuildRequires: expat @@ -47,13 +46,26 @@ The %{name}-doc package contains HTML formatted documents containing hardening guidances that have been generated from XCCDF benchmarks present in %{name} package. +%if ( %{defined rhel} && (! %{defined centos}) ) +%package rule-playbooks +Summary: Ansible playbooks per each rule. +Group: System Environment/Base +Requires: %{name} = %{version}-%{release} + +%description rule-playbooks +The %{name}-rule-playbooks package contains individual ansible playbooks per rule. +%endif + %prep %autosetup -p1 %define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF %define cmake_defines_specific %{nil} %if 0%{?rhel} -%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF +%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON +%endif +%if 0%{?centos} +%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON %endif mkdir -p build @@ -72,12 +84,25 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %{_datadir}/%{name}/ansible/*.yml %lang(en) %{_mandir}/man8/scap-security-guide.8.* %doc %{_docdir}/%{name}/LICENSE +%if ( %{defined rhel} && (! %{defined centos}) ) +%exclude %{_datadir}/%{name}/ansible/rule_playbooks +%endif %files doc %doc %{_docdir}/%{name}/guides/*.html %doc %{_docdir}/%{name}/tables/*.html +%if ( %{defined rhel} && (! %{defined centos}) ) +%files rule-playbooks +%defattr(-,root,root,-) +%{_datadir}/%{name}/ansible/rule_playbooks +%endif + %changelog +* Thu Jul 29 2021 Matej Tyc - 0.1.57-1 +- Update to latest upstream SCAP-Security-Guide-0.1.57 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.57 + * Fri Jul 23 2021 Fedora Release Engineering - 0.1.56-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index cad4a93..cbe33b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.56.tar.bz2) = 1c876f1a8e03f3f68de8fd5a8fd020567f0eecb1fb8b9c9f754453c2f22278944f50d06c0f4e771020e2e25facf6cecb1044d3ddb12e531428ca5aacfec3c86c +SHA512 (scap-security-guide-0.1.57.tar.bz2) = e0f030445cc8c629f94be156581a3732abb104e2e5a57a92c64e7fa168b2107e60ee8edfcf8d715c339180317f09378317d031d575673b5384f16208528d66a2 From 64a2d8e60f26901b52075b82bf1d1d9a8f21d9a1 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 30 Sep 2021 14:07:25 +0200 Subject: [PATCH 18/66] Rebase to release 0.1.58 --- ...-0.1.58-fix_service_disabled-PR_7296.patch | 55 ------------------- scap-security-guide.spec | 11 ++-- 2 files changed, 7 insertions(+), 59 deletions(-) delete mode 100644 scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch diff --git a/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch b/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch deleted file mode 100644 index 79a2711..0000000 --- a/scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 460922d3b258ba5b437afc99b5b02d2690788db9 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 27 Jul 2021 15:20:08 -0400 -Subject: [PATCH] Remove FragmentPath check from service_disabled - -In https://github.com/systemd/systemd/issues/582 it is documented that -systemd could eventually replace FragmentPath=/dev/null (on masked -services) with the actual service path -- not the fully (symlink) -resolved path as is currently the case. - -This matches the behavior currently seen in Ubuntu (all versions) and -RHEL 9/Fedora 34. - -Per discussion with Gabriel, Matej, Richard, and Matt, it is best to -remove this check, especially since ActiveState=Masked suffices. - -Resolves: #7280 -Resolves: #7248 - -Signed-off-by: Alexander Scheel ---- - shared/templates/service_disabled/oval.template | 13 ------------- - 1 file changed, 13 deletions(-) - -diff --git a/shared/templates/service_disabled/oval.template b/shared/templates/service_disabled/oval.template -index 33b52518307..e4ccb0566e7 100644 ---- a/shared/templates/service_disabled/oval.template -+++ b/shared/templates/service_disabled/oval.template -@@ -13,7 +13,6 @@ - - - -- - - - -@@ -41,18 +40,6 @@ - masked - - -- -- -- -- -- -- ^{{{ SERVICENAME }}}\.(service|socket)$ -- FragmentPath -- -- -- /dev/null -- -- - {{% else %}} - - {{% if init_system != "systemd" %}} diff --git a/scap-security-guide.spec b/scap-security-guide.spec index ceea514..7462db0 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,16 +4,14 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.57 +Version: 0.1.58 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats -License: BSD-3-Clause +License: BSD URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch -Patch0: scap-security-guide-0.1.58-fix_service_disabled-PR_7296.patch - BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 @@ -99,6 +97,11 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Sep 30 2021 Watson Sato - 0.1.58-1 +- Update to latest upstream SCAP-Security-Guide-0.1.58 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.58 +- Fix license warning. + * Thu Jul 29 2021 Matej Tyc - 0.1.57-1 - Update to latest upstream SCAP-Security-Guide-0.1.57 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.57 From 2bc9c2e6dbdc502c84f2e6bc280face91f2b9ece Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 30 Sep 2021 14:15:54 +0200 Subject: [PATCH 19/66] Add v0.1.58 sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 08fa126..a7676ad 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ /scap-security-guide-0.1.55.tar.bz2 /scap-security-guide-0.1.56.tar.bz2 /scap-security-guide-0.1.57.tar.bz2 +/scap-security-guide-0.1.58.tar.bz2 diff --git a/sources b/sources index cbe33b4..c3573e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.57.tar.bz2) = e0f030445cc8c629f94be156581a3732abb104e2e5a57a92c64e7fa168b2107e60ee8edfcf8d715c339180317f09378317d031d575673b5384f16208528d66a2 +SHA512 (scap-security-guide-0.1.58.tar.bz2) = 656d959d9e92f1b857afdd25fdb3eb2918630a0ffe34b90ffe3939124410c6d0e655d71b10c99f6ff35090a086ac7bd57acdc1d55822e472f09f160704f1a7d7 From 9bf956787654e2dc183f1af1e974b8b6579b75bb Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 30 Sep 2021 14:07:25 +0200 Subject: [PATCH 20/66] Rebase to release 0.1.58 --- .gitignore | 1 + scap-security-guide.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 300dd31..377e8ba 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ /scap-security-guide-0.1.54.tar.bz2 /scap-security-guide-0.1.55.tar.bz2 /scap-security-guide-0.1.56.tar.bz2 +/scap-security-guide-0.1.58.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 1b1f13a..8b3b52c 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,10 +4,10 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.56 +Version: 0.1.58 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats -License: BSD-3-Clause +License: BSD URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch @@ -69,6 +69,11 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Thu Sep 30 2021 Watson Sato - 0.1.58-1 +- Update to latest upstream SCAP-Security-Guide-0.1.58 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.58 +- Fix license warning. + * Wed May 26 2021 Vojtech Polasek - 0.1.56-1 - Update to latest upstream SCAP-Security-Guide-0.1.56 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 diff --git a/sources b/sources index cad4a93..c3573e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.56.tar.bz2) = 1c876f1a8e03f3f68de8fd5a8fd020567f0eecb1fb8b9c9f754453c2f22278944f50d06c0f4e771020e2e25facf6cecb1044d3ddb12e531428ca5aacfec3c86c +SHA512 (scap-security-guide-0.1.58.tar.bz2) = 656d959d9e92f1b857afdd25fdb3eb2918630a0ffe34b90ffe3939124410c6d0e655d71b10c99f6ff35090a086ac7bd57acdc1d55822e472f09f160704f1a7d7 From ea7124c25e65cf81e4d1176c7574de4f2ab43587 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 1 Dec 2021 17:46:24 +0100 Subject: [PATCH 21/66] Rebase to release 0.1.59 --- .gitignore | 1 + scap-security-guide.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 377e8ba..d318e12 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ /scap-security-guide-0.1.55.tar.bz2 /scap-security-guide-0.1.56.tar.bz2 /scap-security-guide-0.1.58.tar.bz2 +/scap-security-guide-0.1.59.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 8b3b52c..73c5f68 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.58 +Version: 0.1.59 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -59,6 +59,7 @@ present in %{name} package. %{_datadir}/%{name}/kickstart %{_datadir}/%{name}/ansible %{_datadir}/%{name}/bash +%{_datadir}/%{name}/tailoring %lang(en) %{_mandir}/man8/scap-security-guide.8.* %doc %{_docdir}/%{name}/LICENSE %doc %{_docdir}/%{name}/README.md @@ -69,6 +70,10 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Wed Dec 01 2021 Watson Sato - 0.1.59-1 +- Update to latest upstream SCAP-Security-Guide-0.1.59 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 + * Thu Sep 30 2021 Watson Sato - 0.1.58-1 - Update to latest upstream SCAP-Security-Guide-0.1.58 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.58 diff --git a/sources b/sources index c3573e8..8cdca32 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.58.tar.bz2) = 656d959d9e92f1b857afdd25fdb3eb2918630a0ffe34b90ffe3939124410c6d0e655d71b10c99f6ff35090a086ac7bd57acdc1d55822e472f09f160704f1a7d7 +SHA512 (scap-security-guide-0.1.59.tar.bz2) = 2a92e6835749137c1080f08d2120949dbfea01eedf5f29728beb84dae62f90fd81b8869337cffa738de90641e0f5efc58115d914dceb691b12b805af2ad2de04 From 500fdac8317fad2ec807a3f64dd5588918b1abb8 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 1 Dec 2021 17:46:24 +0100 Subject: [PATCH 22/66] Rebase to release 0.1.59 --- .gitignore | 1 + scap-security-guide.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a7676ad..18ed2f7 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ /scap-security-guide-0.1.56.tar.bz2 /scap-security-guide-0.1.57.tar.bz2 /scap-security-guide-0.1.58.tar.bz2 +/scap-security-guide-0.1.59.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 7462db0..119733b 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.58 +Version: 0.1.59 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -80,6 +80,7 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %{_datadir}/xml/scap/ssg/content %{_datadir}/%{name}/kickstart %{_datadir}/%{name}/ansible/*.yml +%{_datadir}/%{name}/tailoring %lang(en) %{_mandir}/man8/scap-security-guide.8.* %doc %{_docdir}/%{name}/LICENSE %if ( %{defined rhel} && (! %{defined centos}) ) @@ -97,6 +98,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Wed Dec 01 2021 Watson Sato - 0.1.59-1 +- Update to latest upstream SCAP-Security-Guide-0.1.59 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 + * Thu Sep 30 2021 Watson Sato - 0.1.58-1 - Update to latest upstream SCAP-Security-Guide-0.1.58 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.58 diff --git a/sources b/sources index c3573e8..8cdca32 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.58.tar.bz2) = 656d959d9e92f1b857afdd25fdb3eb2918630a0ffe34b90ffe3939124410c6d0e655d71b10c99f6ff35090a086ac7bd57acdc1d55822e472f09f160704f1a7d7 +SHA512 (scap-security-guide-0.1.59.tar.bz2) = 2a92e6835749137c1080f08d2120949dbfea01eedf5f29728beb84dae62f90fd81b8869337cffa738de90641e0f5efc58115d914dceb691b12b805af2ad2de04 From 93213958495a60ac641dc4eb0049d64cdad7269b Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 1 Dec 2021 18:51:18 +0100 Subject: [PATCH 23/66] Fix loading of files with jinja --- ...ide-0.1.60-fix-jinja-loading-PR_7944.patch | 85 +++++++++++++++++++ scap-security-guide.spec | 3 + 2 files changed, 88 insertions(+) create mode 100644 scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch diff --git a/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch b/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch new file mode 100644 index 0000000..72a07c4 --- /dev/null +++ b/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch @@ -0,0 +1,85 @@ +From 396fb9029e74b38ea09236c6cd1a7cb38f545afe Mon Sep 17 00:00:00 2001 +From: Gabriel Becker +Date: Wed, 1 Dec 2021 13:20:47 +0100 +Subject: [PATCH] Fix jinja issue on fedora rawhide. + +--- + tests/unit/ssg-module/test_playbook_builder.py | 4 ++-- + utils/duplicated_prodtypes.py | 4 ++-- + utils/fix_file_ocilclause.py | 4 ++-- + utils/move_rules.py | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/tests/unit/ssg-module/test_playbook_builder.py b/tests/unit/ssg-module/test_playbook_builder.py +index 6692c54dfab..38b6f1f52e2 100644 +--- a/tests/unit/ssg-module/test_playbook_builder.py ++++ b/tests/unit/ssg-module/test_playbook_builder.py +@@ -34,9 +34,9 @@ def test_build_rule_playbook(): + assert os.path.exists(real_output_filepath) + + with open(real_output_filepath, "r") as real_output: +- real_output_yaml = yaml.load(real_output) ++ real_output_yaml = yaml.load(real_output, Loader=yaml.Loader) + with open(expected_output_filepath, "r") as expected_output: +- expected_output_yaml = yaml.load(expected_output) ++ expected_output_yaml = yaml.load(expected_output, Loader=yaml.Loader) + + real_play = real_output_yaml.pop() + expected_play = expected_output_yaml.pop() +diff --git a/utils/duplicated_prodtypes.py b/utils/duplicated_prodtypes.py +index 4cb2c16fef8..25c36c58d81 100755 +--- a/utils/duplicated_prodtypes.py ++++ b/utils/duplicated_prodtypes.py +@@ -23,7 +23,7 @@ def _create_profile_cache(ssg_root): + files.sort() + for filename in files: + profile_path = os.path.join(prod_profiles_dir, filename) +- parsed_profile = yaml.load(open(profile_path, 'r')) ++ parsed_profile = yaml.load(open(profile_path, 'r'), Loader=yaml.Loader) + for _obj in parsed_profile['selections']: + obj = _obj + if '=' in obj: +@@ -210,7 +210,7 @@ def find_profiles(ssg_root, path, obj_name): + def parse_from_yaml(file_contents, lines): + new_file_arr = file_contents[lines[0]:lines[1] + 1] + new_file = "\n".join(new_file_arr) +- return yaml.load(new_file) ++ return yaml.load(new_file, Loader=yaml.Loader) + + + def print_file(file_contents): +diff --git a/utils/fix_file_ocilclause.py b/utils/fix_file_ocilclause.py +index 462d2b37c15..d79bb8c51e0 100755 +--- a/utils/fix_file_ocilclause.py ++++ b/utils/fix_file_ocilclause.py +@@ -23,7 +23,7 @@ def _create_profile_cache(ssg_root): + files.sort() + for filename in files: + profile_path = os.path.join(prod_profiles_dir, filename) +- parsed_profile = yaml.load(open(profile_path, 'r')) ++ parsed_profile = yaml.load(open(profile_path, 'r'), Loader=yaml.Loader) + for _obj in parsed_profile['selections']: + obj = _obj + if '=' in obj: +@@ -205,7 +205,7 @@ def fix_ocil_clause(ssg_root, path, obj_name): + def parse_from_yaml(file_contents, lines): + new_file_arr = file_contents[lines[0]:lines[1] + 1] + new_file = "\n".join(new_file_arr) +- return yaml.load(new_file) ++ return yaml.load(new_file, Loader=yaml.Loader) + + + def print_file(file_contents): +diff --git a/utils/move_rules.py b/utils/move_rules.py +index 2deb62b488a..e91a661be85 100755 +--- a/utils/move_rules.py ++++ b/utils/move_rules.py +@@ -340,7 +340,7 @@ def fix_ocil_clause(ssg_root, path, obj_name): + def parse_from_yaml(file_contents, lines): + new_file_arr = file_contents[lines[0]:lines[1] + 1] + new_file = "\n".join(new_file_arr) +- return yaml.load(new_file) ++ return yaml.load(new_file, Loader=yaml.Loader) + + + def print_file(file_contents): diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 119733b..38f0412 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -12,6 +12,8 @@ URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch +Patch0: scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch + BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 @@ -101,6 +103,7 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md * Wed Dec 01 2021 Watson Sato - 0.1.59-1 - Update to latest upstream SCAP-Security-Guide-0.1.59 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 +- Fix loading of jinja files * Thu Sep 30 2021 Watson Sato - 0.1.58-1 - Update to latest upstream SCAP-Security-Guide-0.1.58 release: From cd4c51aa14869ead064464a3c70ddf0717395fc2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 00:26:34 +0000 Subject: [PATCH 24/66] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 38f0412..27fa723 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.59 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -100,6 +100,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 0.1.59-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Wed Dec 01 2021 Watson Sato - 0.1.59-1 - Update to latest upstream SCAP-Security-Guide-0.1.59 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 From 538e9e4af3c9958e4bf7470433eb7eb24509a87a Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Fri, 28 Jan 2022 11:44:16 +0100 Subject: [PATCH 25/66] Rebase to release 0.1.60 --- .gitignore | 1 + scap-security-guide.spec | 10 ++++++---- sources | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 18ed2f7..10fb6cd 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ /scap-security-guide-0.1.57.tar.bz2 /scap-security-guide-0.1.58.tar.bz2 /scap-security-guide-0.1.59.tar.bz2 +/scap-security-guide-0.1.60.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 27fa723..dcb9a18 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,16 +4,14 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.59 -Release: 2%{?dist} +Version: 0.1.60 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch -Patch0: scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch - BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 @@ -100,6 +98,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Jan 28 2022 Watson Sato - 0.1.60-1 +- Update to latest upstream SCAP-Security-Guide-0.1.60 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.60 + * Sat Jan 22 2022 Fedora Release Engineering - 0.1.59-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild diff --git a/sources b/sources index 8cdca32..f97e8d2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.59.tar.bz2) = 2a92e6835749137c1080f08d2120949dbfea01eedf5f29728beb84dae62f90fd81b8869337cffa738de90641e0f5efc58115d914dceb691b12b805af2ad2de04 +SHA512 (scap-security-guide-0.1.60.tar.bz2) = 41899c1209b64eb13e76368da141db25fe7e2ab280e67dafc750d470049062f0f16c70ee79f4b3a2131f30c9fb8e23e3c22fb354577239698f2b7f30544d969a From 32d3f3a7eaebfef607b89e1e4ccbb2abaa452db5 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Fri, 28 Jan 2022 11:44:16 +0100 Subject: [PATCH 26/66] Rebase to release 0.1.60 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d318e12..b297ccc 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ /scap-security-guide-0.1.56.tar.bz2 /scap-security-guide-0.1.58.tar.bz2 /scap-security-guide-0.1.59.tar.bz2 +/scap-security-guide-0.1.60.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 73c5f68..c50eaf0 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.59 +Version: 0.1.60 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -70,6 +70,10 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Fri Jan 28 2022 Watson Sato - 0.1.60-1 +- Update to latest upstream SCAP-Security-Guide-0.1.60 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.60 + * Wed Dec 01 2021 Watson Sato - 0.1.59-1 - Update to latest upstream SCAP-Security-Guide-0.1.59 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.59 diff --git a/sources b/sources index 8cdca32..f97e8d2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.59.tar.bz2) = 2a92e6835749137c1080f08d2120949dbfea01eedf5f29728beb84dae62f90fd81b8869337cffa738de90641e0f5efc58115d914dceb691b12b805af2ad2de04 +SHA512 (scap-security-guide-0.1.60.tar.bz2) = 41899c1209b64eb13e76368da141db25fe7e2ab280e67dafc750d470049062f0f16c70ee79f4b3a2131f30c9fb8e23e3c22fb354577239698f2b7f30544d969a From adbc78f7e59ec026a75d9a64e3d8913f40aa76df Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Mon, 11 Apr 2022 17:38:09 +0200 Subject: [PATCH 27/66] Fedora CI: replace STI with tmt --- .fmf/version | 1 + gating.yaml | 8 ++++---- plans/main.fmf | 6 ++++++ tests/tests.yml | 9 --------- 4 files changed, 11 insertions(+), 13 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml index b16b396..4b3cff0 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,17 +1,17 @@ --- !Policy product_versions: - - fedora-* + - fedora-* decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} --- !Policy product_versions: - - fedora-* + - fedora-* decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} --- !Policy product_versions: - rhel-* diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..63d6437 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run tests from scap-security-guide tests repository +discover: + how: fmf + url: https://src.fedoraproject.org/tests/scap-security-guide +execute: + how: tmt diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 1546340..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,9 +0,0 @@ -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/scap-security-guide.git" - dest: "scap-security-guide" - fmf_filter: "tier: 1, 2" From 7448413b484517c85ed4acda905d9f05d875edeb Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 4 May 2022 22:36:40 +0200 Subject: [PATCH 28/66] Rebase to 0.1.61 --- .gitignore | 1 + scap-security-guide.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 10fb6cd..dd34057 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ /scap-security-guide-0.1.58.tar.bz2 /scap-security-guide-0.1.59.tar.bz2 /scap-security-guide-0.1.60.tar.bz2 +/scap-security-guide-0.1.61.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index dcb9a18..2c386d0 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.60 +Version: 0.1.61 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -21,6 +21,7 @@ BuildRequires: /usr/bin/python3 BuildRequires: python%{python3_pkgversion} BuildRequires: python%{python3_pkgversion}-jinja2 BuildRequires: python%{python3_pkgversion}-PyYAML +BuildRequires: python%{python3_pkgversion}-setuptools Requires: xml-common, openscap-scanner >= 1.2.5 %description @@ -98,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Wed May 04 2022 Watson Sato - 0.1.61-1 +- Update to latest upstream SCAP-Security-Guide-0.1.61 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.61 + * Fri Jan 28 2022 Watson Sato - 0.1.60-1 - Update to latest upstream SCAP-Security-Guide-0.1.60 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.60 diff --git a/sources b/sources index f97e8d2..a61dd0d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.60.tar.bz2) = 41899c1209b64eb13e76368da141db25fe7e2ab280e67dafc750d470049062f0f16c70ee79f4b3a2131f30c9fb8e23e3c22fb354577239698f2b7f30544d969a +SHA512 (scap-security-guide-0.1.61.tar.bz2) = 95be5fc1b9734335199db54bff0958ba00f2c5f1873595d8c68b353540988f213d7bdf4139f4e338ac6d45ca9bd27cd97c81956651a5e6e78197ecc7b88e5eff From ccba6a391c830fcae2d47891942d01073cf871bb Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 4 May 2022 22:36:40 +0200 Subject: [PATCH 29/66] Rebase to 0.1.61 --- .gitignore | 1 + scap-security-guide.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b297ccc..34a1fdb 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ /scap-security-guide-0.1.58.tar.bz2 /scap-security-guide-0.1.59.tar.bz2 /scap-security-guide-0.1.60.tar.bz2 +/scap-security-guide-0.1.61.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index c50eaf0..a6c3a81 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.60 +Version: 0.1.61 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -19,6 +19,7 @@ BuildRequires: cmake >= 2.8 BuildRequires: python%{python3_pkgversion} BuildRequires: python%{python3_pkgversion}-jinja2 BuildRequires: python%{python3_pkgversion}-PyYAML +BuildRequires: python%{python3_pkgversion}-setuptools Requires: xml-common, openscap-scanner >= 1.2.5 Obsoletes: openscap-content < 0:0.9.13 Provides: openscap-content @@ -70,6 +71,10 @@ present in %{name} package. %doc %{_docdir}/%{name}/tables/*.html %changelog +* Wed May 04 2022 Watson Sato - 0.1.61-1 +- Update to latest upstream SCAP-Security-Guide-0.1.61 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.61 + * Fri Jan 28 2022 Watson Sato - 0.1.60-1 - Update to latest upstream SCAP-Security-Guide-0.1.60 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.60 diff --git a/sources b/sources index f97e8d2..a61dd0d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.60.tar.bz2) = 41899c1209b64eb13e76368da141db25fe7e2ab280e67dafc750d470049062f0f16c70ee79f4b3a2131f30c9fb8e23e3c22fb354577239698f2b7f30544d969a +SHA512 (scap-security-guide-0.1.61.tar.bz2) = 95be5fc1b9734335199db54bff0958ba00f2c5f1873595d8c68b353540988f213d7bdf4139f4e338ac6d45ca9bd27cd97c81956651a5e6e78197ecc7b88e5eff From 3cfe62d42de81813e04736e28a986afe6d1b4547 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Mon, 11 Apr 2022 17:38:09 +0200 Subject: [PATCH 30/66] Fedora CI: replace STI with tmt --- .fmf/version | 1 + gating.yaml | 16 ++++++++++++---- plans/main.fmf | 6 ++++++ tests/tests.yml | 9 --------- 4 files changed, 19 insertions(+), 13 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml index 1f13530..4b3cff0 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,14 +1,22 @@ --- !Policy product_versions: - - fedora-* + - fedora-* decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} --- !Policy product_versions: - - fedora-* + - fedora-* decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.ci-beaker.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..63d6437 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,6 @@ +summary: Run tests from scap-security-guide tests repository +discover: + how: fmf + url: https://src.fedoraproject.org/tests/scap-security-guide +execute: + how: tmt diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 1546340..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,9 +0,0 @@ -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/scap-security-guide.git" - dest: "scap-security-guide" - fmf_filter: "tier: 1, 2" From 2500d553b08d30721ed54d2ca3945d20ddf3607d Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Mon, 30 May 2022 12:33:14 +0200 Subject: [PATCH 31/66] rebase to release 0.1.62 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index dd34057..9d43ed2 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,4 @@ /scap-security-guide-0.1.59.tar.bz2 /scap-security-guide-0.1.60.tar.bz2 /scap-security-guide-0.1.61.tar.bz2 +/scap-security-guide-0.1.62.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 2c386d0..9f983c7 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.61 +Version: 0.1.62 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon May 30 2022 Vojtech Polasek - 0.1.62-1 +- Update to latest upstream SCAP-Security-Guide-0.1.62 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.62 + * Wed May 04 2022 Watson Sato - 0.1.61-1 - Update to latest upstream SCAP-Security-Guide-0.1.61 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.61 diff --git a/sources b/sources index a61dd0d..7ce9265 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.61.tar.bz2) = 95be5fc1b9734335199db54bff0958ba00f2c5f1873595d8c68b353540988f213d7bdf4139f4e338ac6d45ca9bd27cd97c81956651a5e6e78197ecc7b88e5eff +SHA512 (scap-security-guide-0.1.62.tar.bz2) = b8cdd76ad0c09c9257121283df6e5a8f2acd6c9734ff9b577673ce8ff04af8a1b9ceb37621cb8bd0873391f771844e0479954850ae77b442c780206b957a0e09 From da6d8c90b09ef11e1db0f4ade120736bdaf6b90a Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Tue, 31 May 2022 10:13:10 +0200 Subject: [PATCH 32/66] Add ci.fmf file which is needed for proper CI results reporting --- ci.fmf | 1 + 1 file changed, 1 insertion(+) create mode 100644 ci.fmf diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate From ae3860f028f9564b0fc2aefbf74b0339851ffbb1 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Tue, 31 May 2022 10:13:10 +0200 Subject: [PATCH 33/66] Add ci.fmf file which is needed for proper CI results reporting --- ci.fmf | 1 + 1 file changed, 1 insertion(+) create mode 100644 ci.fmf diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate From b09d34fb9fa4b7349d2b679bdda962b46f27d621 Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Wed, 1 Jun 2022 17:22:45 +0200 Subject: [PATCH 34/66] main is reserved keyword by tmt and cannot be used as a plan name --- gating.yaml | 4 ++-- plans/{main.fmf => fedora_tests.fmf} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename plans/{main.fmf => fedora_tests.fmf} (100%) diff --git a/gating.yaml b/gating.yaml index 4b3cff0..1d65cc1 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,14 +4,14 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/fedora_tests.functional} --- !Policy product_versions: - fedora-* decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/fedora_tests.functional} --- !Policy product_versions: - rhel-* diff --git a/plans/main.fmf b/plans/fedora_tests.fmf similarity index 100% rename from plans/main.fmf rename to plans/fedora_tests.fmf From 9e43a57baaa5af1e33badf44f1a01624d5f8b3ad Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Wed, 1 Jun 2022 17:22:45 +0200 Subject: [PATCH 35/66] main is reserved keyword by tmt and cannot be used as a plan name --- gating.yaml | 4 ++-- plans/{main.fmf => fedora_tests.fmf} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename plans/{main.fmf => fedora_tests.fmf} (100%) diff --git a/gating.yaml b/gating.yaml index 4b3cff0..1d65cc1 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,14 +4,14 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/fedora_tests.functional} --- !Policy product_versions: - fedora-* decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/main.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/fedora_tests.functional} --- !Policy product_versions: - rhel-* diff --git a/plans/main.fmf b/plans/fedora_tests.fmf similarity index 100% rename from plans/main.fmf rename to plans/fedora_tests.fmf From c64d08d2c617996cdd9f0c20a7b2f90a096b0be4 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Thu, 9 Jun 2022 16:06:25 +0200 Subject: [PATCH 36/66] do a rebuild, build did not propagate into rawhide --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 9f983c7..61ce4a9 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.62 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Jun 09 2022 Vojtech Polasek - 0.1.62-2 +- rebuild, the release did not get propagated into rawhide + * Mon May 30 2022 Vojtech Polasek - 0.1.62-1 - Update to latest upstream SCAP-Security-Guide-0.1.62 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.62 From 192107cf596b2d347be24c5d27cf18606a9b941d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:07:13 +0000 Subject: [PATCH 37/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 61ce4a9..73d3486 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.62 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 0.1.62-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Jun 09 2022 Vojtech Polasek - 0.1.62-2 - rebuild, the release did not get propagated into rawhide From 13c5eb800178a57bce5ca2734eda5d3b8614d473 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Mon, 1 Aug 2022 15:07:33 +0200 Subject: [PATCH 38/66] Rebase to 0.1.63 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9d43ed2..6268d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -46,3 +46,4 @@ /scap-security-guide-0.1.60.tar.bz2 /scap-security-guide-0.1.61.tar.bz2 /scap-security-guide-0.1.62.tar.bz2 +/scap-security-guide-0.1.63.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 73d3486..63b6e11 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.62 -Release: 3%{?dist} +Version: 0.1.63 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon Aug 01 2022 Watson Sato - 0.1.63-1 +- Update to latest upstream SCAP-Security-Guide-0.1.63 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.63 + * Sat Jul 23 2022 Fedora Release Engineering - 0.1.62-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 7ce9265..553cad7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.62.tar.bz2) = b8cdd76ad0c09c9257121283df6e5a8f2acd6c9734ff9b577673ce8ff04af8a1b9ceb37621cb8bd0873391f771844e0479954850ae77b442c780206b957a0e09 +SHA512 (scap-security-guide-0.1.63.tar.bz2) = ad2f7f873af22b0bc2916d8487f6d5621c65495c4c84a0a4e8c98969d5edd2a0833e956b32c19c893e1852b15adc65af24bb4fea7db71b3042c5e1b512a3957b From e588252f32aad97c65defae9047f8d65cc9aaf36 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 4 Oct 2022 15:17:11 +0200 Subject: [PATCH 39/66] Rebase to 0.1.64 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 6268d6c..ea6ab63 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ /scap-security-guide-0.1.61.tar.bz2 /scap-security-guide-0.1.62.tar.bz2 /scap-security-guide-0.1.63.tar.bz2 +/scap-security-guide-0.1.64.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 63b6e11..8f29321 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.63 +Version: 0.1.64 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Tue Oct 04 2022 Watson Sato - 0.1.64-1 +- Update to latest upstream SCAP-Security-Guide-0.1.64 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.64 + * Mon Aug 01 2022 Watson Sato - 0.1.63-1 - Update to latest upstream SCAP-Security-Guide-0.1.63 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.63 diff --git a/sources b/sources index 553cad7..c7ad9b3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.63.tar.bz2) = ad2f7f873af22b0bc2916d8487f6d5621c65495c4c84a0a4e8c98969d5edd2a0833e956b32c19c893e1852b15adc65af24bb4fea7db71b3042c5e1b512a3957b +SHA512 (scap-security-guide-0.1.64.tar.bz2) = fc295bafdac8a3fafbcd1bff50b7043a11de23e1a363883a7fac11d3734e9d381dad2e180cc14c259e34fa4eea8b0c27720a8df455d509be3c97913f51294850 From 5d3f57ca9207608ce775803ecf585838457ec12e Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 24 Nov 2022 12:52:04 -0500 Subject: [PATCH 40/66] Fix ELN build On RHEL, only the product-specific data for RHEL is built and shipped, but ELN is defined as the precursor to the next major version of RHEL, for which data has not yet been created upstream. Therefore, for ELN, follow Fedora which builds and ships data for all distributions. --- scap-security-guide.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 8f29321..40c3370 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -45,7 +45,7 @@ The %{name}-doc package contains HTML formatted documents containing hardening guidances that have been generated from XCCDF benchmarks present in %{name} package. -%if ( %{defined rhel} && (! %{defined centos}) ) +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) %package rule-playbooks Summary: Ansible playbooks per each rule. Group: System Environment/Base @@ -60,7 +60,7 @@ The %{name}-rule-playbooks package contains individual ansible playbooks per rul %define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF %define cmake_defines_specific %{nil} -%if 0%{?rhel} +%if 0%{?rhel} && ! %{defined eln} %define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON %endif %if 0%{?centos} @@ -84,7 +84,7 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %{_datadir}/%{name}/tailoring %lang(en) %{_mandir}/man8/scap-security-guide.8.* %doc %{_docdir}/%{name}/LICENSE -%if ( %{defined rhel} && (! %{defined centos}) ) +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) %exclude %{_datadir}/%{name}/ansible/rule_playbooks %endif @@ -92,7 +92,7 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %doc %{_docdir}/%{name}/guides/*.html %doc %{_docdir}/%{name}/tables/*.html -%if ( %{defined rhel} && (! %{defined centos}) ) +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) %files rule-playbooks %defattr(-,root,root,-) %{_datadir}/%{name}/ansible/rule_playbooks From 317dec4c14f49bdbf425ea54f491c480223582e9 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Tue, 6 Dec 2022 16:07:34 +0100 Subject: [PATCH 41/66] Rebase to 0.1.65 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ea6ab63..2c5004b 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ /scap-security-guide-0.1.62.tar.bz2 /scap-security-guide-0.1.63.tar.bz2 /scap-security-guide-0.1.64.tar.bz2 +/scap-security-guide-0.1.65.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 8f29321..9cd961b 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.64 +Version: 0.1.65 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Tue Dec 06 2022 Marcus Burghardt - 0.1.65-1 +- Update to latest upstream SCAP-Security-Guide-0.1.65 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.65 + * Tue Oct 04 2022 Watson Sato - 0.1.64-1 - Update to latest upstream SCAP-Security-Guide-0.1.64 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.64 diff --git a/sources b/sources index c7ad9b3..ece9ecf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.64.tar.bz2) = fc295bafdac8a3fafbcd1bff50b7043a11de23e1a363883a7fac11d3734e9d381dad2e180cc14c259e34fa4eea8b0c27720a8df455d509be3c97913f51294850 +SHA512 (scap-security-guide-0.1.65.tar.bz2) = 8c0f7431da33d80878d37cecff6afd55cfc3cc4085e987a5b0d5cecc8969373afa24c409d25bbe6de5ce1b6a718ed0d8c685a029ec7fec0c0de7d66f5040ad16 From e9550519bf2387cef673382b89b2604027edce4d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:45:23 +0000 Subject: [PATCH 42/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index ef667e6..34364b3 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.65 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 0.1.65-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Dec 06 2022 Marcus Burghardt - 0.1.65-1 - Update to latest upstream SCAP-Security-Guide-0.1.65 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.65 From 8a305566a31c1040bdb0d0f94bea163100ad46d7 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 3 Feb 2023 15:33:57 +0100 Subject: [PATCH 43/66] rebase to scap-security-guide 0.1.66 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2c5004b..c336565 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ /scap-security-guide-0.1.63.tar.bz2 /scap-security-guide-0.1.64.tar.bz2 /scap-security-guide-0.1.65.tar.bz2 +/scap-security-guide-0.1.66.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 34364b3..a0245ff 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.65 -Release: 2%{?dist} +Version: 0.1.66 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Feb 03 2023 Vojtech Polasek - 0.1.66-1 +- Update to latest upstream SCAP-Security-Guide-0.1.66 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.66 + * Sat Jan 21 2023 Fedora Release Engineering - 0.1.65-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index ece9ecf..90a355e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.65.tar.bz2) = 8c0f7431da33d80878d37cecff6afd55cfc3cc4085e987a5b0d5cecc8969373afa24c409d25bbe6de5ce1b6a718ed0d8c685a029ec7fec0c0de7d66f5040ad16 +SHA512 (scap-security-guide-0.1.66.tar.bz2) = 1eee044d7d160c6f271db9a2d5262de2a577e03e103fe697e341000c34bf5208037fc88e9f4d7bfdb0b04a46660c4244a7cba214a4fe949f94e3358b12f15cc3 From 36de3a55f5ceb23009f07ab4b99710f8bf3619d8 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Mon, 6 Feb 2023 14:47:01 +0100 Subject: [PATCH 44/66] remove no longer used patch --- ...ide-0.1.60-fix-jinja-loading-PR_7944.patch | 85 ------------------- 1 file changed, 85 deletions(-) delete mode 100644 scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch diff --git a/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch b/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch deleted file mode 100644 index 72a07c4..0000000 --- a/scap-security-guide-0.1.60-fix-jinja-loading-PR_7944.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 396fb9029e74b38ea09236c6cd1a7cb38f545afe Mon Sep 17 00:00:00 2001 -From: Gabriel Becker -Date: Wed, 1 Dec 2021 13:20:47 +0100 -Subject: [PATCH] Fix jinja issue on fedora rawhide. - ---- - tests/unit/ssg-module/test_playbook_builder.py | 4 ++-- - utils/duplicated_prodtypes.py | 4 ++-- - utils/fix_file_ocilclause.py | 4 ++-- - utils/move_rules.py | 2 +- - 4 files changed, 7 insertions(+), 7 deletions(-) - -diff --git a/tests/unit/ssg-module/test_playbook_builder.py b/tests/unit/ssg-module/test_playbook_builder.py -index 6692c54dfab..38b6f1f52e2 100644 ---- a/tests/unit/ssg-module/test_playbook_builder.py -+++ b/tests/unit/ssg-module/test_playbook_builder.py -@@ -34,9 +34,9 @@ def test_build_rule_playbook(): - assert os.path.exists(real_output_filepath) - - with open(real_output_filepath, "r") as real_output: -- real_output_yaml = yaml.load(real_output) -+ real_output_yaml = yaml.load(real_output, Loader=yaml.Loader) - with open(expected_output_filepath, "r") as expected_output: -- expected_output_yaml = yaml.load(expected_output) -+ expected_output_yaml = yaml.load(expected_output, Loader=yaml.Loader) - - real_play = real_output_yaml.pop() - expected_play = expected_output_yaml.pop() -diff --git a/utils/duplicated_prodtypes.py b/utils/duplicated_prodtypes.py -index 4cb2c16fef8..25c36c58d81 100755 ---- a/utils/duplicated_prodtypes.py -+++ b/utils/duplicated_prodtypes.py -@@ -23,7 +23,7 @@ def _create_profile_cache(ssg_root): - files.sort() - for filename in files: - profile_path = os.path.join(prod_profiles_dir, filename) -- parsed_profile = yaml.load(open(profile_path, 'r')) -+ parsed_profile = yaml.load(open(profile_path, 'r'), Loader=yaml.Loader) - for _obj in parsed_profile['selections']: - obj = _obj - if '=' in obj: -@@ -210,7 +210,7 @@ def find_profiles(ssg_root, path, obj_name): - def parse_from_yaml(file_contents, lines): - new_file_arr = file_contents[lines[0]:lines[1] + 1] - new_file = "\n".join(new_file_arr) -- return yaml.load(new_file) -+ return yaml.load(new_file, Loader=yaml.Loader) - - - def print_file(file_contents): -diff --git a/utils/fix_file_ocilclause.py b/utils/fix_file_ocilclause.py -index 462d2b37c15..d79bb8c51e0 100755 ---- a/utils/fix_file_ocilclause.py -+++ b/utils/fix_file_ocilclause.py -@@ -23,7 +23,7 @@ def _create_profile_cache(ssg_root): - files.sort() - for filename in files: - profile_path = os.path.join(prod_profiles_dir, filename) -- parsed_profile = yaml.load(open(profile_path, 'r')) -+ parsed_profile = yaml.load(open(profile_path, 'r'), Loader=yaml.Loader) - for _obj in parsed_profile['selections']: - obj = _obj - if '=' in obj: -@@ -205,7 +205,7 @@ def fix_ocil_clause(ssg_root, path, obj_name): - def parse_from_yaml(file_contents, lines): - new_file_arr = file_contents[lines[0]:lines[1] + 1] - new_file = "\n".join(new_file_arr) -- return yaml.load(new_file) -+ return yaml.load(new_file, Loader=yaml.Loader) - - - def print_file(file_contents): -diff --git a/utils/move_rules.py b/utils/move_rules.py -index 2deb62b488a..e91a661be85 100755 ---- a/utils/move_rules.py -+++ b/utils/move_rules.py -@@ -340,7 +340,7 @@ def fix_ocil_clause(ssg_root, path, obj_name): - def parse_from_yaml(file_contents, lines): - new_file_arr = file_contents[lines[0]:lines[1] + 1] - new_file = "\n".join(new_file_arr) -- return yaml.load(new_file) -+ return yaml.load(new_file, Loader=yaml.Loader) - - - def print_file(file_contents): From 1ec1d5000db91335ec785f61676aa891049bd2bf Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Wed, 12 Apr 2023 16:31:10 -0500 Subject: [PATCH 45/66] Rebase to 0.1.67 --- .gitignore | 1 + scap-security-guide.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index c336565..dea9052 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,4 @@ /scap-security-guide-0.1.64.tar.bz2 /scap-security-guide-0.1.65.tar.bz2 /scap-security-guide-0.1.66.tar.bz2 +/scap-security-guide-0.1.67.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index a0245ff..8be6e9e 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.66 +Version: 0.1.67 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD @@ -99,6 +99,11 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Wed Apr 12 2023 Matthew Burket - 0.1.67-1 +- Update to latest upstream SCAP-Security-Guide-0.1.67 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.67 + + * Fri Feb 03 2023 Vojtech Polasek - 0.1.66-1 - Update to latest upstream SCAP-Security-Guide-0.1.66 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.66 diff --git a/sources b/sources index 90a355e..412097c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.66.tar.bz2) = 1eee044d7d160c6f271db9a2d5262de2a577e03e103fe697e341000c34bf5208037fc88e9f4d7bfdb0b04a46660c4244a7cba214a4fe949f94e3358b12f15cc3 +SHA512 (scap-security-guide-0.1.67.tar.bz2) = 31bc39f2ac04409962908ff4c0dacebfff397322f413012029c6c1bc9f7ad1f2b86d81fb22b005df5430f31983cdf4f5c304202be650aed740de868b05c19056 From a8f8ac69c4a6132a26f55fdc78571ebeec7ed31f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Wed, 31 May 2023 09:35:55 +0200 Subject: [PATCH 46/66] Use SPDX license identifier See https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- scap-security-guide.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 8be6e9e..68f958c 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -7,7 +7,7 @@ Name: scap-security-guide Version: 0.1.67 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats -License: BSD +License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2 BuildArch: noarch From 073e61aac54514282e81bfed04e16985f37d5e2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 15 Jun 2023 13:12:31 +0200 Subject: [PATCH 47/66] Update to the latest upstream release scap-security-guide-0.1.68 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index dea9052..34d0a8f 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ /scap-security-guide-0.1.65.tar.bz2 /scap-security-guide-0.1.66.tar.bz2 /scap-security-guide-0.1.67.tar.bz2 +/scap-security-guide-0.1.68.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 68f958c..3a774a2 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.67 +Version: 0.1.68 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Jun 15 2023 Jan Černý - 0.1.68-1 +- Update to latest upstream SCAP-Security-Guide-0.1.68 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.68 + * Wed Apr 12 2023 Matthew Burket - 0.1.67-1 - Update to latest upstream SCAP-Security-Guide-0.1.67 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.67 diff --git a/sources b/sources index 412097c..ffe864c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.67.tar.bz2) = 31bc39f2ac04409962908ff4c0dacebfff397322f413012029c6c1bc9f7ad1f2b86d81fb22b005df5430f31983cdf4f5c304202be650aed740de868b05c19056 +SHA512 (scap-security-guide-0.1.68.tar.bz2) = 9e12a467ffe080de952f86a2bdb33e55e567f9b87bb54bb6da7d3086a9e4408db97575ef7f0ad5f147eb1f1dacc53151d6116a838d247b1a3cf12be64e834655 From a5cb95db654a9b71260b678ca2b51896c6138304 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 01:08:42 +0000 Subject: [PATCH 48/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 3a774a2..b174da0 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.68 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 0.1.68-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Jun 15 2023 Jan Černý - 0.1.68-1 - Update to latest upstream SCAP-Security-Guide-0.1.68 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.68 From 3c3b3b80e50f7bdbfa130e460afc7dd312e35d04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 3 Aug 2023 13:31:39 +0200 Subject: [PATCH 49/66] Update to the latest upstream release scap-security-guide-0.1.69 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 34d0a8f..8574401 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,4 @@ /scap-security-guide-0.1.66.tar.bz2 /scap-security-guide-0.1.67.tar.bz2 /scap-security-guide-0.1.68.tar.bz2 +/scap-security-guide-0.1.69.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index b174da0..d45547b 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.68 -Release: 2%{?dist} +Version: 0.1.69 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Aug 03 2023 Jan Černý - 0.1.69-1 +- Update to latest upstream SCAP-Security-Guide-0.1.69 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.69 + * Sat Jul 22 2023 Fedora Release Engineering - 0.1.68-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild diff --git a/sources b/sources index ffe864c..b00e054 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.68.tar.bz2) = 9e12a467ffe080de952f86a2bdb33e55e567f9b87bb54bb6da7d3086a9e4408db97575ef7f0ad5f147eb1f1dacc53151d6116a838d247b1a3cf12be64e834655 +SHA512 (scap-security-guide-0.1.69.tar.bz2) = 224d308608c1254a74290f2967f39ba0cef2df199399d70cb1b90386836bb1da313bf699e488d15a308c0a6ea70c30a8f5cc4a6c0b58a863f2f8154f022dd7bb From 571bdd076ed983d92b360548a0ebf0c86f378c6b Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 12 Oct 2023 14:28:53 -0500 Subject: [PATCH 50/66] Update to the latest upstream release scap-security-guide-0.1.70 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8574401..8a33624 100644 --- a/.gitignore +++ b/.gitignore @@ -53,3 +53,4 @@ /scap-security-guide-0.1.67.tar.bz2 /scap-security-guide-0.1.68.tar.bz2 /scap-security-guide-0.1.69.tar.bz2 +/scap-security-guide-0.1.70.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index d45547b..37499ef 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.69 +Version: 0.1.70 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Oct 12 2023 Matthew Burket - 0.1.70-1 +- Update to latest upstream SCAP-Security-Guide-0.1.70 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.70 + * Thu Aug 03 2023 Jan Černý - 0.1.69-1 - Update to latest upstream SCAP-Security-Guide-0.1.69 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.69 diff --git a/sources b/sources index b00e054..ef57e6e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.69.tar.bz2) = 224d308608c1254a74290f2967f39ba0cef2df199399d70cb1b90386836bb1da313bf699e488d15a308c0a6ea70c30a8f5cc4a6c0b58a863f2f8154f022dd7bb +SHA512 (scap-security-guide-0.1.70.tar.bz2) = fe4d9721b7f1e982306f48922348dbbfbb4a0380f7dc423e6bc167f809d51337b39508dcd5ac62be512644434c275da85972df41da53a9b52c1f5fcabf2f2afc From fa439a6850fc256d0240af4af58f5297c8875d57 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Tue, 19 Dec 2023 16:25:20 +0100 Subject: [PATCH 51/66] Update to the latest upstream release scap-security-guide-0.1.71 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8a33624..55c2059 100644 --- a/.gitignore +++ b/.gitignore @@ -54,3 +54,4 @@ /scap-security-guide-0.1.68.tar.bz2 /scap-security-guide-0.1.69.tar.bz2 /scap-security-guide-0.1.70.tar.bz2 +/scap-security-guide-0.1.71.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 37499ef..3ea673a 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.70 +Version: 0.1.71 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Tue Dec 19 2023 Vojtech Polasek - 0.1.71-1 +- Update to latest upstream SCAP-Security-Guide-0.1.71 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.71 + * Thu Oct 12 2023 Matthew Burket - 0.1.70-1 - Update to latest upstream SCAP-Security-Guide-0.1.70 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.70 diff --git a/sources b/sources index ef57e6e..677fd16 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.70.tar.bz2) = fe4d9721b7f1e982306f48922348dbbfbb4a0380f7dc423e6bc167f809d51337b39508dcd5ac62be512644434c275da85972df41da53a9b52c1f5fcabf2f2afc +SHA512 (scap-security-guide-0.1.71.tar.bz2) = ff64266925e8f280283665b3f99dd14f9dc67a12d759224d787731c371946bfd579eef6dc7b6da4b5edc9d0bae7520b8dd4cfb1edf1d779e6a8ca30e26e4d02b From ad8e38c1ce58fbc2c33f6f0d502e6c87f3968528 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:13:01 +0000 Subject: [PATCH 52/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 3ea673a..eab4777 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.71 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 0.1.71-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Dec 19 2023 Vojtech Polasek - 0.1.71-1 - Update to latest upstream SCAP-Security-Guide-0.1.71 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.71 From 0e2a008939fac63fd2db74e17c01fc0ffff41652 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 9 Feb 2024 16:30:53 +0100 Subject: [PATCH 53/66] update to scap-security-guide 0.1.72 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 55c2059..9b442ec 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,4 @@ /scap-security-guide-0.1.69.tar.bz2 /scap-security-guide-0.1.70.tar.bz2 /scap-security-guide-0.1.71.tar.bz2 +/scap-security-guide-0.1.72.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index eab4777..ff6409e 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.71 -Release: 2%{?dist} +Version: 0.1.72 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Feb 09 2024 Vojtech Polasek - 0.1.72-1 +- Update to latest upstream SCAP-Security-Guide-0.1.72 release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72 + * Sat Jan 27 2024 Fedora Release Engineering - 0.1.71-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 677fd16..5ef0e99 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.71.tar.bz2) = ff64266925e8f280283665b3f99dd14f9dc67a12d759224d787731c371946bfd579eef6dc7b6da4b5edc9d0bae7520b8dd4cfb1edf1d779e6a8ca30e26e4d02b +SHA512 (scap-security-guide-0.1.72.tar.bz2) = 2b3fb7ff4d7f69796968afc61049753bce9f2cd5bc57ecc41f9ea17dbd2bb8c278a6e02ef98e34b1561dd38e55498ba2ba92079dbdc4ef5848186964cefbd92a From d4ba75887d2dd2a1acf9316f6ba9f6581d1c13ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Wed, 22 May 2024 09:18:49 +0200 Subject: [PATCH 54/66] scap-security-guide-0.1.73 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9b442ec..3105ff4 100644 --- a/.gitignore +++ b/.gitignore @@ -56,3 +56,4 @@ /scap-security-guide-0.1.70.tar.bz2 /scap-security-guide-0.1.71.tar.bz2 /scap-security-guide-0.1.72.tar.bz2 +/scap-security-guide-0.1.73.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index ff6409e..7f855f6 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.72 +Version: 0.1.73 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Wed May 22 2024 Jan Černý - 0.1.73-1 +- Update to latest upstream release + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73 + * Fri Feb 09 2024 Vojtech Polasek - 0.1.72-1 - Update to latest upstream SCAP-Security-Guide-0.1.72 release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72 diff --git a/sources b/sources index 5ef0e99..ce6f37a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.72.tar.bz2) = 2b3fb7ff4d7f69796968afc61049753bce9f2cd5bc57ecc41f9ea17dbd2bb8c278a6e02ef98e34b1561dd38e55498ba2ba92079dbdc4ef5848186964cefbd92a +SHA512 (scap-security-guide-0.1.73.tar.bz2) = 8750aeb61378d7729e00e4bcfb17d1463d97192801ef6707593ec639dfef2abba6669b9d1b8f71958f7d24f6c66f308f1587d731dd4e63878f91266232883ad7 From afd5aedc48dc5a99300e75a92d9a0c2dc8ece3eb Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Tue, 9 Jul 2024 09:06:18 +0200 Subject: [PATCH 55/66] Move smoke-test from tests/scap-security-guide repo and with that update also test plans and gating configurations. --- gating.yaml | 4 +- plans/fedora_tests.fmf | 3 +- tests/smoke-test/main.fmf | 27 +++++++++++++ tests/smoke-test/runtest.sh | 80 +++++++++++++++++++++++++++++++++++++ 4 files changed, 109 insertions(+), 5 deletions(-) create mode 100644 tests/smoke-test/main.fmf create mode 100755 tests/smoke-test/runtest.sh diff --git a/gating.yaml b/gating.yaml index 1d65cc1..46eab8d 100644 --- a/gating.yaml +++ b/gating.yaml @@ -17,6 +17,4 @@ product_versions: - rhel-* decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.ci-beaker.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/tier1.functional} diff --git a/plans/fedora_tests.fmf b/plans/fedora_tests.fmf index 63d6437..3f21692 100644 --- a/plans/fedora_tests.fmf +++ b/plans/fedora_tests.fmf @@ -1,6 +1,5 @@ -summary: Run tests from scap-security-guide tests repository +summary: Run all tests in this repository discover: how: fmf - url: https://src.fedoraproject.org/tests/scap-security-guide execute: how: tmt diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..6e01198 --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,27 @@ +summary: Test calls upstream test suite. +description: | + Runs upstream test suite against content built from the source RPM - testing + the content from the installed scap-security-guide is not feasible as the + upstream test suite is hardcoded to test the content from the CMAKE_BINARY_DIR + directory with hardcoded paths which are not the same as paths where content is + installed from the scap-security-guide RPM. Test suite is also built from the + scap-security-guide source RPM by running %prep and %build stages from the spec + file. +contact: Matus Marhefka +test: ./runtest.sh +framework: beakerlib +require: + - library(ControlFlow/Cleanup) + - library(rpm/snapshot) + - scap-security-guide +recommend: + - yum-utils + - rpm-build + - dnf-plugins-core + - gcc + - python3-pytest + - python3-pip + - python3-devel + - ansible +duration: 90m +enabled: true diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh new file mode 100755 index 0000000..b356a60 --- /dev/null +++ b/tests/smoke-test/runtest.sh @@ -0,0 +1,80 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/scap-security-guide/Sanity/smoke-test +# Description: Test calls upstream test suite. +# Author: Marek Haicman +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2018 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="scap-security-guide" + +rlJournalStart + + rlPhaseStartSetup + rlImport ControlFlow/Cleanup rpm/snapshot || rlDie "Failed to import libraries" + rlAssertRpm "$PACKAGE" + + RpmSnapshotCreate + CleanupRegister "RpmSnapshotRevert" + rlRun "TmpDir=\$(mktemp -d)" 0 + CleanupRegister "rlRun 'rm -r $TmpDir' 0 'Removing tmp directory'" + rlRun "pushd $TmpDir" + CleanupRegister "rlRun 'popd'" + + rlFetchSrcForInstalled $PACKAGE + rlRun "dnf builddep -y $PACKAGE*" + SITE_PACKAGES=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])') + rlRun "pip3 install --target=$SITE_PACKAGES ruamel.yaml yamlpath prometheus-client" + CleanupRegister "rlRun 'pip3 uninstall -y ruamel.yaml yamlpath prometheus-client'" + TOPDIR=`rpm --eval %_topdir` + rlRun "rm -rf ${TOPDIR}/BUILD/${PACKAGE}*" 0-255 + rlRun "rpm -ihv `ls *.rpm`" 0 "Install $PACKAGE source RPM" + rlPhaseEnd + + rlPhaseStartSetup "Prepare upstream test suite (%prep and %build stages from the spec file)" + rlRun "rpmbuild -v -bc ${TOPDIR}/SPECS/${PACKAGE}.spec" + CleanupRegister "rlRun 'rm -rf ${TOPDIR}/BUILD/${PACKAGE}*'" + CleanupRegister "rlRun 'rm -rf ${TOPDIR}/SPECS/${PACKAGE}*'" + CleanupRegister "rlRun 'rm -rf ${TOPDIR}/SOURCES/*'" + rlPhaseEnd + + rlPhaseStartTest "Run upstream test suite" + BUILD_DIR_PATH="$(find $TOPDIR -name build | grep scap-security-guide)" + rlRun -s "cmake --build $BUILD_DIR_PATH --target test -- ARGS='--output-on-failure'" + rv=$? + + # if we got error, submit file with result of particular test for easier debugging + if [ $rv -ne 0 ]; then + FILE="${BUILD_DIR_PATH}/Testing/Temporary/LastTest.log" + rlBundleLogs test_outputs $(readlink -f $FILE) + fi + rlPhaseEnd + + rlPhaseStartCleanup + CleanupDo + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd From fbf76d834e7f4125c1eb25c34290c81e65116b8a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 04:55:21 +0000 Subject: [PATCH 56/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 7f855f6..70008af 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.73 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 0.1.73-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed May 22 2024 Jan Černý - 0.1.73-1 - Update to latest upstream release https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73 From 499e36d274bf87bc5a95eee0988a619952d8267b Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Mon, 12 Aug 2024 12:29:02 -0500 Subject: [PATCH 57/66] Update to version 0.1.74 --- .gitignore | 1 + scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3105ff4..329f996 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,4 @@ /scap-security-guide-0.1.71.tar.bz2 /scap-security-guide-0.1.72.tar.bz2 /scap-security-guide-0.1.73.tar.bz2 +/scap-security-guide-0.1.74.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 70008af..ff7cbbe 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.73 -Release: 2%{?dist} +Version: 0.1.74 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -99,6 +99,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon Aug 12 2024 Matthew Burket - 0.1.74-1 +- Update to latest upstream release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 + * Sat Jul 20 2024 Fedora Release Engineering - 0.1.73-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index ce6f37a..0ced6da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.73.tar.bz2) = 8750aeb61378d7729e00e4bcfb17d1463d97192801ef6707593ec639dfef2abba6669b9d1b8f71958f7d24f6c66f308f1587d731dd4e63878f91266232883ad7 +SHA512 (scap-security-guide-0.1.74.tar.bz2) = 773cc7fb72e8d24fe9b12bf58815e051db21ee474cd0c3aebd07c2026712a89e6174c00840b1fd56195c900a541ff9e656240ee6b5a1cf3f3fe9b119cbedc30f From b80e2207d82f9c3b9e14d06bdab1c1374bbfcb8d Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Mon, 12 Aug 2024 12:30:33 -0500 Subject: [PATCH 58/66] Remove /usr/bin/python3 from BuildRequires --- scap-security-guide.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index ff7cbbe..cebd293 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -16,8 +16,6 @@ BuildRequires: libxslt BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 BuildRequires: cmake >= 2.8 -# To get python3 inside the buildroot require its path explicitly in BuildRequires -BuildRequires: /usr/bin/python3 BuildRequires: python%{python3_pkgversion} BuildRequires: python%{python3_pkgversion}-jinja2 BuildRequires: python%{python3_pkgversion}-PyYAML @@ -102,6 +100,7 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md * Mon Aug 12 2024 Matthew Burket - 0.1.74-1 - Update to latest upstream release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 +- Remove /usr/bin/python3 from BuildRequires * Sat Jul 20 2024 Fedora Release Engineering - 0.1.73-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From e311191a527db1cbaaab7af59d3c312f61c67ce7 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 14 Nov 2024 15:10:44 -0600 Subject: [PATCH 59/66] Update to 0.1.75 --- .gitignore | 1 + scap-security-guide.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 329f996..d1fdb0d 100644 --- a/.gitignore +++ b/.gitignore @@ -58,3 +58,4 @@ /scap-security-guide-0.1.72.tar.bz2 /scap-security-guide-0.1.73.tar.bz2 /scap-security-guide-0.1.74.tar.bz2 +/scap-security-guide-0.1.75.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index cebd293..76ffc11 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.74 +Version: 0.1.75 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -97,6 +97,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Thu Nov 14 2024 Matthew Burket - 0.1.75-1 +- Update to latest upstream release + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 + * Mon Aug 12 2024 Matthew Burket - 0.1.74-1 - Update to latest upstream release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 diff --git a/sources b/sources index 0ced6da..0f120bc 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.74.tar.bz2) = 773cc7fb72e8d24fe9b12bf58815e051db21ee474cd0c3aebd07c2026712a89e6174c00840b1fd56195c900a541ff9e656240ee6b5a1cf3f3fe9b119cbedc30f +SHA512 (scap-security-guide-0.1.75.tar.bz2) = ecab31c731612316b40d9e26ba81b7a44396bd6ef3cc616de27789cb75dec6f90cec69f1fd3186f20a03d46896e0d1231c79a31ced1c25dd6786c79c5baac416 From 02bb14b4e0855c2887a4fe8bfb704566e22b64fc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 10:06:12 +0000 Subject: [PATCH 60/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 76ffc11..8536a6a 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.75 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -97,6 +97,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 0.1.75-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Thu Nov 14 2024 Matthew Burket - 0.1.75-1 - Update to latest upstream release https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 From af3b67787cb8d42c7eb70fe64af2ec487a8932c7 Mon Sep 17 00:00:00 2001 From: Evgeny Kolesnikov Date: Tue, 25 Feb 2025 12:18:18 +0100 Subject: [PATCH 61/66] Update to 0.1.76 --- .gitignore | 62 +--------------------------------------- scap-security-guide.spec | 8 ++++-- sources | 2 +- 3 files changed, 8 insertions(+), 64 deletions(-) diff --git a/.gitignore b/.gitignore index d1fdb0d..14244dd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,61 +1 @@ -/scap-security-guide-0.1-3.tar.gz -/scap-security-guide-0.1.4.tar.gz -/scap-security-guide-0.1-16.tar.gz -/scap-security-guide-0.1.5.tar.gz -/scap-security-guide-0.1.18.tar.gz -/scap-security-guide-0.1.19.tar.gz -/scap-security-guide-0.1.21.tar.gz -/v0.1.22.tar.gz -/v0.1.23.tar.gz -/v0.1.24.tar.gz -/v0.1.25.tar.gz -/v0.1.26.tar.gz -/v0.1.27.tar.gz -/v0.1.28.tar.gz -/scap-security-guide-0.1.29.tar.gz -/0.1.29.tar.gz -/v0.1.29.tar.gz -/v0.1.30.tar.gz -/scap-security-guide-0.1.31.tar.gz -/scap-security-guide-0.1.32.tar.gz -/scap-security-guide-0.1.33.tar.bz2 -/scap-security-guide-0.1.34.tar.bz2 -/scap-security-guide-0.1.35.tar.bz2 -/scap-security-guide-0.1.36.tar.bz2 -/scap-security-guide-0.1.37.tar.bz2 -/scap-security-guide-0.1.38.tar.bz2 -/scap-security-guide-0.1.39.tar.bz2 -/scap-security-guide-0.1.40.tar.bz2 -/scap-security-guide-0.1.41.tar.bz2 -/scap-security-guide-0.1.42.tar.bz2 -/scap-security-guide-0.1.43.tar.bz2 -/scap-security-guide-0.1.44.tar.bz2 -/scap-security-guide-0.1.45.tar.bz2 -/scap-security-guide-0.1.47.tar.bz2 -/scap-security-guide-0.1.48.tar.bz2 -/scap-security-guide-0.1.49.tar.bz2 -/scap-security-guide-0.1.51.tar.bz2 -/scap-security-guide-0.1.52.tar.bz2 -/scap-security-guide-0.1.53.tar.bz2 -/scap-security-guide-0.1.54.tar.bz2 -/scap-security-guide-0.1.55.tar.bz2 -/scap-security-guide-0.1.56.tar.bz2 -/scap-security-guide-0.1.57.tar.bz2 -/scap-security-guide-0.1.58.tar.bz2 -/scap-security-guide-0.1.59.tar.bz2 -/scap-security-guide-0.1.60.tar.bz2 -/scap-security-guide-0.1.61.tar.bz2 -/scap-security-guide-0.1.62.tar.bz2 -/scap-security-guide-0.1.63.tar.bz2 -/scap-security-guide-0.1.64.tar.bz2 -/scap-security-guide-0.1.65.tar.bz2 -/scap-security-guide-0.1.66.tar.bz2 -/scap-security-guide-0.1.67.tar.bz2 -/scap-security-guide-0.1.68.tar.bz2 -/scap-security-guide-0.1.69.tar.bz2 -/scap-security-guide-0.1.70.tar.bz2 -/scap-security-guide-0.1.71.tar.bz2 -/scap-security-guide-0.1.72.tar.bz2 -/scap-security-guide-0.1.73.tar.bz2 -/scap-security-guide-0.1.74.tar.bz2 -/scap-security-guide-0.1.75.tar.bz2 +/scap-security-guide-0.1.76.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 8536a6a..d54f97b 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.75 -Release: 2%{?dist} +Version: 0.1.76 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -97,6 +97,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Tue Feb 25 2025 Evgenii Kolesnikov - 0.1.76-1 +- Update to latest upstream release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76 + * Sun Jan 19 2025 Fedora Release Engineering - 0.1.75-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 0f120bc..6b6e0c4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.75.tar.bz2) = ecab31c731612316b40d9e26ba81b7a44396bd6ef3cc616de27789cb75dec6f90cec69f1fd3186f20a03d46896e0d1231c79a31ced1c25dd6786c79c5baac416 +SHA512 (scap-security-guide-0.1.76.tar.bz2) = 27cb260eb0b2fbfd11afe2affb91624e4e2ff332e7ffe43a0c0ec2e08b5e2aa707f00e77c97fa1cbdace5549ef25cf42b34756777a568809da7d1222bd05950c From cbff1763072aa44792c251fcd0e6c25f46938fd0 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Fri, 7 Mar 2025 14:59:14 -0600 Subject: [PATCH 62/66] Remove expat as BuildRequires as it no longer needed --- scap-security-guide.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index d54f97b..b268c7d 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.76 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -13,7 +13,6 @@ Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{versio BuildArch: noarch BuildRequires: libxslt -BuildRequires: expat BuildRequires: openscap-scanner >= 1.2.5 BuildRequires: cmake >= 2.8 BuildRequires: python%{python3_pkgversion} @@ -97,6 +96,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Mar 07 2025 Matthew Burket - 0.1.76-2 +- Remove expat as a BuildRequires as it is no longer needed + * Tue Feb 25 2025 Evgenii Kolesnikov - 0.1.76-1 - Update to latest upstream release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76 From bd79f797ab6b6f912c6ccc3e1b624043037b7608 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Mon, 2 Jun 2025 15:03:51 -0500 Subject: [PATCH 63/66] Update to 0.1.77 --- .gitignore | 2 +- scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 14244dd..3542a0a 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -/scap-security-guide-0.1.76.tar.bz2 +/scap-security-guide-0.1.77.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index b268c7d..0891148 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.76 -Release: 2%{?dist} +Version: 0.1.77 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -96,6 +96,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon Jun 02 2025 Matthew Burket - 0.1.77-1 +- Update to latest upstream release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.77 + * Fri Mar 07 2025 Matthew Burket - 0.1.76-2 - Remove expat as a BuildRequires as it is no longer needed diff --git a/sources b/sources index 6b6e0c4..513cdd0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.76.tar.bz2) = 27cb260eb0b2fbfd11afe2affb91624e4e2ff332e7ffe43a0c0ec2e08b5e2aa707f00e77c97fa1cbdace5549ef25cf42b34756777a568809da7d1222bd05950c +SHA512 (scap-security-guide-0.1.77.tar.bz2) = cc3bda1c7e3e40f58407b59d2c7222da7b1d3979f5411a2c12e5f12b73cfff4a71d04b3a51dcc84ca797486aca77ed6091977cb3f067ef3f63dc3d855b059b11 From bb5959df535f23283948ac55864879dc915c9c95 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:59:15 +0000 Subject: [PATCH 64/66] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- scap-security-guide.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 0891148..fd07335 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -5,7 +5,7 @@ Name: scap-security-guide Version: 0.1.77 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -96,6 +96,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 0.1.77-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Jun 02 2025 Matthew Burket - 0.1.77-1 - Update to latest upstream release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.77 From 1637063e419174e2b8588dc4f856a2a19cf58a24 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Mon, 8 Sep 2025 10:46:30 -0500 Subject: [PATCH 65/66] Update to 0.1.78 --- .gitignore | 2 +- scap-security-guide.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3542a0a..074f9f7 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -/scap-security-guide-0.1.77.tar.bz2 +/scap-security-guide-0.1.78.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index fd07335..80172e4 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,8 +4,8 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.77 -Release: 2%{?dist} +Version: 0.1.78 +Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -96,6 +96,10 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon Sep 08 2025 Matthew Burket - 0.1.78-1 +- Update to latest upstream release: + https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78 + * Fri Jul 25 2025 Fedora Release Engineering - 0.1.77-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 513cdd0..ebcceed 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.77.tar.bz2) = cc3bda1c7e3e40f58407b59d2c7222da7b1d3979f5411a2c12e5f12b73cfff4a71d04b3a51dcc84ca797486aca77ed6091977cb3f067ef3f63dc3d855b059b11 +SHA512 (scap-security-guide-0.1.78.tar.bz2) = b84c549fe42799a6daffecf5720c5208f9946974f74193b9f6beb3fba04c35d9f073953c94b83c5ddf36855d59be1c66dafb011dde4427ab040dd1ec5048c063 From 8df1e2a9ea951cba8a30cb33975fa01f943aabd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Fri, 28 Nov 2025 15:34:00 +0100 Subject: [PATCH 66/66] scap-security-guide-0.1.79 --- .gitignore | 1 + scap-security-guide.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 074f9f7..c74915f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /scap-security-guide-0.1.78.tar.bz2 +/scap-security-guide-0.1.79.tar.bz2 diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 80172e4..b9b927b 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -4,7 +4,7 @@ %global _vpath_builddir build Name: scap-security-guide -Version: 0.1.78 +Version: 0.1.79 Release: 1%{?dist} Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause @@ -96,6 +96,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Fri Nov 28 2025 Jan Černý - 0.1.79-1 +- Upgrade to the latest upstream release + * Mon Sep 08 2025 Matthew Burket - 0.1.78-1 - Update to latest upstream release: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78 diff --git a/sources b/sources index ebcceed..f88b2e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (scap-security-guide-0.1.78.tar.bz2) = b84c549fe42799a6daffecf5720c5208f9946974f74193b9f6beb3fba04c35d9f073953c94b83c5ddf36855d59be1c66dafb011dde4427ab040dd1ec5048c063 +SHA512 (scap-security-guide-0.1.79.tar.bz2) = 57963e896aef6089523bb7165ece32dafeedc2caf0baac594c4d0d083ff00bd37c4fdc1c98357db1c70523bb67543c07b6a41b7d989ba1a8e97907218d954311