import openscap-1.3.6-3.el8

.gitignore

@@ -1 +1 @@
-SOURCES/openscap-1.3.5.tar.gz
+SOURCES/openscap-1.3.6.tar.gz

.openscap.metadata

@@ -1 +1 @@
-77494383980082f8bc625a6e196a6760d30a5107 SOURCES/openscap-1.3.5.tar.gz
+8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz

SOURCES/openscap-1.3.6-PR-1745-waive-hugepages.patch

@@ -1,43 +0,0 @@
-From 192f908562779fe4c9b7e5cc7605840976a06c85 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 26 Apr 2021 13:13:26 +0200
-Subject: [PATCH] Waive the known issue with hugepages on ppc64/ppc64le
-
-The known issue has been reported in
-https://bugzilla.redhat.com/show_bug.cgi?id=1642995
-
-This modification is currently applied as a patch applied during setup
-phase of Sanity/smoke-test in Fedora CI gating.
-https://src.fedoraproject.org/tests/openscap/blob/main/f/Sanity/smoke-test
-The patched file got changed recetly so the patch doesn't apply anymore
-which causes the Rawhide gating to fail.
-We have decided to propose the change to upstream to avoid the need
-for modifying the patch in the tests and to prevent similar problems
-in the future.
----
- tests/probes/sysctl/test_sysctl_probe_all.sh | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/tests/probes/sysctl/test_sysctl_probe_all.sh b/tests/probes/sysctl/test_sysctl_probe_all.sh
-index 2280ff7ae..c79d7ed18 100755
---- a/tests/probes/sysctl/test_sysctl_probe_all.sh
-+++ b/tests/probes/sysctl/test_sysctl_probe_all.sh
-@@ -73,6 +73,10 @@ if [ "$procps_ver" != "$lowest_ver" ]; then
- 	sed -i '/.*vm.stat_refresh/d' "$sysctlNames"
- fi
- 
-+if ! grep -q "hugepages" "$ourNames"; then
-+	sed -i "/^.*hugepages.*$/d" "$sysctlNames"
-+fi
-+
- echo "Diff (sysctlNames / ourNames): ------"
- diff "$sysctlNames" "$ourNames"
- echo "-------------------------------------"
-@@ -84,6 +88,7 @@ sed -i -E "/^E: oscap: +Can't read sysctl value from /d" "$stderr"
- # that can't fit into 8K buffer and result in errno 14
- # (for example /proc/sys/kernel/spl/hostid could be the case)
- sed -i -E "/^E: oscap: +An error.*14, Bad address/d" "$stderr"
-+sed -i "/^.*hugepages.*$/d" "$stderr"
- 
- echo "Errors (without messages related to permissions):"
- cat "$stderr"

SOURCES/openscap-1.3.6-PR-1748-covscan.patch

@@ -1,52 +0,0 @@
-From 378ef5e438a2f5af7a50374d2bd23bdd3403201f Mon Sep 17 00:00:00 2001
-From: Evgeny Kolesnikov <ekolesni@redhat.com>
-Date: Tue, 4 May 2021 08:41:06 +0200
-Subject: [PATCH] Fix covscan-reported issues in yamlfilecontent probe and
- schematron
-
-Error: FORWARD_NULL (CWE-476): [#def1]
-/OVAL/probes/independent/yamlfilecontent_probe.c:392: var_compare_op: Comparing "yaml_file" to null implies that "yaml_file" might be null.
-/OVAL/probes/independent/yamlfilecontent_probe.c:417: var_deref_model: Passing null pointer "yaml_file" to "fclose", which dereferences it.
-#  416|   cleanup:
-#  417|-> 	fclose(yaml_file);
-#  418|   	yaml_parser_delete(&parser);
-
-Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
-/source/schematron.c:549: alloc_fn: Storage is returned from allocation function "xmlXPathNodeEval".
-/source/schematron.c:549: var_assign: Assigning: "component_refs" = storage returned from "xmlXPathNodeEval(data_stream_node, (xmlChar *)"ds:checklists/ds:component-ref", context)".
-/source/schematron.c:551: leaked_storage: Variable "component_refs" going out of scope leaks the storage it points to.
-#  550|   	if (component_refs == NULL || component_refs->nodesetval == NULL) {
-#  551|-> 		return res;
-#  552|   	}
----
- src/OVAL/probes/independent/yamlfilecontent_probe.c | 3 ++-
- src/source/schematron.c                             | 2 ++
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
-index ed5ce0d68..62a8f4ff2 100644
---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
-+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
-@@ -414,7 +414,8 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f
- 	}
- 
- cleanup:
--	fclose(yaml_file);
-+	if (yaml_file != NULL)
-+		fclose(yaml_file);
- 	yaml_parser_delete(&parser);
- 	free(filepath_with_prefix);
- 	free(filepath);
-diff --git a/src/source/schematron.c b/src/source/schematron.c
-index 6cb22658b..c32d5aed6 100644
---- a/src/source/schematron.c
-+++ b/src/source/schematron.c
-@@ -548,6 +548,8 @@ static bool _req_src_346_1_sub1(xmlNodePtr data_stream_node, xmlXPathContextPtr
- 	/* every $m in ds:checklists/ds:component-ref satisfies ... */
- 	xmlXPathObjectPtr component_refs = xmlXPathNodeEval(data_stream_node, BAD_CAST "ds:checklists/ds:component-ref", context);
- 	if (component_refs == NULL || component_refs->nodesetval == NULL) {
-+		if (component_refs != NULL)
-+			xmlXPathFreeObject(component_refs);
- 		return res;
- 	}
- 	for (int i = 0; i < component_refs->nodesetval->nodeNr; i++) {

SOURCES/openscap-1.3.6-PR-1749-blueprint-fix.patch

@@ -1,64 +0,0 @@
-From 5f0a9033b466d929613a2a55a1524ec75c09b5b0 Mon Sep 17 00:00:00 2001
-From: Evgeny Kolesnikov <ekolesni@redhat.com>
-Date: Thu, 6 May 2021 08:14:12 +0200
-Subject: [PATCH] Introduce OSBuild Blueprint fix type
-
----
- utils/oscap-xccdf.c | 7 +++++--
- utils/oscap.8       | 2 +-
- xsl/xccdf-share.xsl | 1 +
- 3 files changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c
-index 95c1c7658d..801e54fa35 100644
---- a/utils/oscap-xccdf.c
-+++ b/utils/oscap-xccdf.c
-@@ -275,7 +275,8 @@ static struct oscap_module XCCDF_GEN_FIX = {
-     .usage = "[options] xccdf-file.xml",
-     .help = GEN_OPTS
-         "\nFix Options:\n"
--		"   --fix-type <type>             - Fix type. Should be one of: bash, ansible, puppet, anaconda (default: bash).\n"
-+		"   --fix-type <type>             - Fix type. Should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes,\n"
-+		"                                   blueprint (default: bash).\n"
- 		"   --output <file>               - Write the script into file.\n"
- 		"   --result-id <id>              - Fixes will be generated for failed rule-results of the specified TestResult.\n"
- 		"   --template <id|filename>      - Fix template. (default: bash)\n"
-@@ -887,10 +888,12 @@ int app_generate_fix(const struct oscap_action *action)
- 			template = "urn:xccdf:fix:script:ignition";
- 		} else if (strcmp(action->fix_type, "kubernetes") == 0) {
- 			template = "urn:xccdf:fix:script:kubernetes";
-+		} else if (strcmp(action->fix_type, "blueprint") == 0) {
-+			template = "urn:redhat:osbuild:blueprint";
- 		} else {
- 			fprintf(stderr,
- 					"Unknown fix type '%s'.\n"
--					"Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes.\n"
-+					"Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint.\n"
- 					"Or provide a custom template using '--template' instead.\n",
- 					action->fix_type);
- 			return OSCAP_ERROR;
-diff --git a/utils/oscap.8 b/utils/oscap.8
-index 240b829d7b..6cae0ffe8a 100644
---- a/utils/oscap.8
-+++ b/utils/oscap.8
-@@ -395,7 +395,7 @@ Result-oriented fixes are generated using result-id provided to select only the
- Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes.
- .TP
- \fB\-\-fix-type TYPE\fR
--Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
-+Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
- .TP
- \fB\-\-output FILE\fR
- Write the report to this file instead of standard output.
-diff --git a/xsl/xccdf-share.xsl b/xsl/xccdf-share.xsl
-index 9f8e587676..d7a9f3b7e2 100644
---- a/xsl/xccdf-share.xsl
-+++ b/xsl/xccdf-share.xsl
-@@ -295,6 +295,7 @@ Authors:
-             <xsl:when test="$fix/@system = 'urn:xccdf:fix:script:puppet'">Puppet snippet</xsl:when>
-             <xsl:when test="$fix/@system = 'urn:redhat:anaconda:pre'">Anaconda snippet</xsl:when>
-             <xsl:when test="$fix/@system = 'urn:xccdf:fix:script:kubernetes'">Kubernetes snippet</xsl:when>
-+            <xsl:when test="$fix/@system = 'urn:redhat:osbuild:blueprint'">OSBuild Blueprint snippet</xsl:when>
-             <xsl:otherwise>script</xsl:otherwise>
-         </xsl:choose>
-     </xsl:variable>

SOURCES/openscap-1.3.6-PR-1753-getlogin.patch

@@ -1,36 +0,0 @@
-From b31cff1bc3a298cfa36a10476f2d633c290b6741 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Tue, 11 May 2021 13:20:18 +0200
-Subject: [PATCH] Replace getlogin by cuserid
-
-The getlogin() is used here to fill in the xccdf:identity element which
-shall contain information about the system identity or user employed
-during application of the benchmark. But, the getlogin() can return NULL
-when there is no controlling terminal. This happened when testing oscap
-on a test system with no pty.  As an alternative, the system provides
-also cuserid() function which gets the effective user ID of the process.
-However, these 2 values differ when the program is executed under sudo.
-From the user experience point of view, it would be better to have
-displayed there the user logged in on the controlling terminal. As a
-compromise, we will first attempt to obtain the name using getlogin()
-and if that fails we will run cuserid().
----
- src/XCCDF/result.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c
-index cd03e6bd8f..cbe016c44a 100644
---- a/src/XCCDF/result.c
-+++ b/src/XCCDF/result.c
-@@ -217,7 +217,10 @@ static inline void _xccdf_result_fill_identity(struct xccdf_result *result)
- 	xccdf_identity_set_authenticated(id, 0);
- 	xccdf_identity_set_privileged(id, 0);
- #ifdef OSCAP_UNIX
--	xccdf_identity_set_name(id, getlogin());
-+	char *name = getlogin();
-+	if (name == NULL)
-+		name = cuserid(NULL);
-+	xccdf_identity_set_name(id, name);
- #elif defined(OS_WINDOWS)
- 	GetUserName((TCHAR *) w32_username, &w32_usernamesize); /* XXX: Check the return value? */
- 	xccdf_identity_set_name(id, w32_username);

SOURCES/openscap-1.3.6-PR-1756-yaml-nulls.patch

@@ -1,150 +0,0 @@
-From 89f99834ba183284a7d75835932a0c0ea4eb9007 Mon Sep 17 00:00:00 2001
-From: Evgeny Kolesnikov <ekolesni@redhat.com>
-Date: Mon, 17 May 2021 08:40:17 +0200
-Subject: [PATCH] oval/yamlfilecontent: Add 'null' values handling
-
-For now null values would be represented as string '(null)' as
-record's field could not be attributed as nil="true" yet.
----
- .../independent/yamlfilecontent_probe.c       |  9 ++++
- .../test_probes_yamlfilecontent_types.sh      |  5 ++
- .../test_probes_yamlfilecontent_types.xml     | 52 +++++++++++++++++++
- tests/probes/yamlfilecontent/types.yaml       |  4 ++
- 4 files changed, 70 insertions(+)
-
-diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
-index 62a8f4ff29..2d0cac6991 100644
---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
-+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
-@@ -41,6 +41,7 @@
- #define OSCAP_YAML_BOOL_TAG "tag:yaml.org,2002:bool"
- #define OSCAP_YAML_FLOAT_TAG "tag:yaml.org,2002:float"
- #define OSCAP_YAML_INT_TAG "tag:yaml.org,2002:int"
-+#define OSCAP_YAML_NULL_TAG "tag:yaml.org,2002:null"
- 
- #define OVECCOUNT 30 /* should be a multiple of 3 */
- 
-@@ -135,6 +136,14 @@ static SEXP_t *yaml_scalar_event_to_sexp(yaml_event_t *event)
- 			return NULL;
- 		}
- 	}
-+	if (question || !strcmp(tag, OSCAP_YAML_NULL_TAG)) {
-+		if (match_regex("^(null|Null|NULL|~|)$", value)) {
-+			// TODO: Return real NULL when record's field will support nil="true"
-+			return SEXP_string_new("(null)", strlen("(null)"));
-+		} else if (!question) {
-+			return NULL;
-+		}
-+	}
- 
- 	return SEXP_string_new(value, strlen(value));
- }
-diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
-index 4f110f6eb7..e445771d03 100755
---- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
-+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
-@@ -60,6 +60,11 @@ function test_probes_yamlfilecontent_types {
-     assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="boolean" and text()="true"]'
-     # string_number
-     assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="int" and text()="81"]'
-+    # string_null
-+    assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="null"]'
-+
-+    # null_1_2_3
-+    assert_exists 3 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="(null)"]'
- 
-     # bool_error_cast, int_error_cast, float_error_cast
-     co='/oval_results/results/system/oval_system_characteristics/collected_objects'
-diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
-index adf96571b8..503ec2d4a4 100644
---- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
-+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
-@@ -262,6 +262,19 @@
-       </criteria>
-     </definition>
- 
-+    <definition class="compliance" version="1" id="oval:0:def:26">
-+      <metadata>
-+        <title></title>
-+        <description></description>
-+      </metadata>
-+      <criteria operator="AND">
-+        <criterion comment="comment" test_ref="oval:0:tst:26"/>
-+        <criterion comment="comment" test_ref="oval:0:tst:27"/>
-+        <criterion comment="comment" test_ref="oval:0:tst:28"/>
-+        <criterion comment="comment" test_ref="oval:0:tst:29"/>
-+      </criteria>
-+    </definition>
-+
-   </definitions>
- 
-   <tests>
-@@ -364,6 +377,21 @@
-       <ind-def:object object_ref="oval:0:obj:25"/>
-     </ind-def:yamlfilecontent_test>
- 
-+    <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:26" check="all" comment="true">
-+      <ind-def:object object_ref="oval:0:obj:26"/>
-+    </ind-def:yamlfilecontent_test>
-+
-+    <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:27" check="all" comment="true">
-+      <ind-def:object object_ref="oval:0:obj:27"/>
-+    </ind-def:yamlfilecontent_test>
-+
-+    <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:28" check="all" comment="true">
-+      <ind-def:object object_ref="oval:0:obj:28"/>
-+    </ind-def:yamlfilecontent_test>
-+
-+    <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:29" check="all" comment="true">
-+      <ind-def:object object_ref="oval:0:obj:29"/>
-+    </ind-def:yamlfilecontent_test>
-   </tests>
- 
-   <objects>
-@@ -517,6 +545,30 @@
-       <ind-def:filename>types.yaml</ind-def:filename>
-       <ind-def:yamlpath>.float_error_cast</ind-def:yamlpath>
-     </ind-def:yamlfilecontent_object>
-+
-+    <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:26">
-+      <ind-def:path>/tmp</ind-def:path>
-+      <ind-def:filename>types.yaml</ind-def:filename>
-+      <ind-def:yamlpath>.null_1</ind-def:yamlpath>
-+    </ind-def:yamlfilecontent_object>
-+
-+    <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:27">
-+      <ind-def:path>/tmp</ind-def:path>
-+      <ind-def:filename>types.yaml</ind-def:filename>
-+      <ind-def:yamlpath>.null_2</ind-def:yamlpath>
-+    </ind-def:yamlfilecontent_object>
-+
-+    <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:28">
-+      <ind-def:path>/tmp</ind-def:path>
-+      <ind-def:filename>types.yaml</ind-def:filename>
-+      <ind-def:yamlpath>.null_3</ind-def:yamlpath>
-+    </ind-def:yamlfilecontent_object>
-+
-+    <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:29">
-+      <ind-def:path>/tmp</ind-def:path>
-+      <ind-def:filename>types.yaml</ind-def:filename>
-+      <ind-def:yamlpath>.string_null</ind-def:yamlpath>
-+    </ind-def:yamlfilecontent_object>
-   </objects>
- 
- </oval_definitions>
-diff --git a/tests/probes/yamlfilecontent/types.yaml b/tests/probes/yamlfilecontent/types.yaml
-index f05fa3a967..fb26eab5f0 100644
---- a/tests/probes/yamlfilecontent/types.yaml
-+++ b/tests/probes/yamlfilecontent/types.yaml
-@@ -19,7 +19,11 @@ bool_false_cast: !!bool "false"
- int_cast: !!int "369"
- float_cast: !!float "978.65"
- string_true: "true"
-+string_null: "null"
- string_number: "81"
- bool_error_cast: !!bool "falsee"
- int_error_cast: !!int "50%"
- float_error_cast: !!float "58.41$"
-+null_1: null
-+null_2:
-+null_3: !!null "null"

SOURCES/openscap-1.3.6-PR-1779-initialize-crapi-once.patch

@@ -1,136 +0,0 @@
-From 5c422226df442855a7dc9834eb4ff74865394a92 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 8 Jul 2021 14:28:16 +0200
-Subject: [PATCH 1/3] Initialize crypto API only once
-
-The function `crapi_init` calls `gcry_check_version` which must be
-called before any other function from the Libgcrypt library. That might
-be violated when multiple threads executing multiple probes are running.
-The mitigation proposed in this PR is to call `crapi_init` only once
-when the session is initialized which means before any threads are
-spawned.
-
-See also: https://www.gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading
-
-Resolves: RHBZ#1959570
----
- src/OVAL/oval_probe_session.c                  | 5 +++++
- src/OVAL/probes/independent/filehash58_probe.c | 6 ------
- src/OVAL/probes/independent/filehash_probe.c   | 6 ------
- src/OVAL/probes/independent/filemd5_probe.c    | 6 ------
- 4 files changed, 5 insertions(+), 18 deletions(-)
-
-diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
-index 435ca148fd..6f6d7ad426 100644
---- a/src/OVAL/oval_probe_session.c
-+++ b/src/OVAL/oval_probe_session.c
-@@ -93,6 +93,11 @@ static void oval_probe_session_libinit(void)
- 	SEXP_free((SEXP_t *)exp);
- 
-         ncache_libinit();
-+	/*
-+	 * Initialize crypto API
-+	 */
-+	if (crapi_init (NULL) != 0)
-+		return (NULL);
- }
- 
- /**
-diff --git a/src/OVAL/probes/independent/filehash58_probe.c b/src/OVAL/probes/independent/filehash58_probe.c
-index ff1e065746..32a38562bd 100644
---- a/src/OVAL/probes/independent/filehash58_probe.c
-+++ b/src/OVAL/probes/independent/filehash58_probe.c
-@@ -210,12 +210,6 @@ int filehash58_probe_offline_mode_supported()
- 
- void *filehash58_probe_init(void)
- {
--	/*
--	 * Initialize crypto API
--	 */
--	if (crapi_init (NULL) != 0)
--		return (NULL);
--
- 	/*
- 	 * Initialize mutex.
- 	 */
-diff --git a/src/OVAL/probes/independent/filehash_probe.c b/src/OVAL/probes/independent/filehash_probe.c
-index 522d976512..6d8780dc95 100644
---- a/src/OVAL/probes/independent/filehash_probe.c
-+++ b/src/OVAL/probes/independent/filehash_probe.c
-@@ -190,12 +190,6 @@ int filehash_probe_offline_mode_supported()
- 
- void *filehash_probe_init(void)
- {
--        /*
--         * Initialize crypto API
--         */
--        if (crapi_init (NULL) != 0)
--                return (NULL);
--
-         /*
-          * Initialize mutex.
-          */
-diff --git a/src/OVAL/probes/independent/filemd5_probe.c b/src/OVAL/probes/independent/filemd5_probe.c
-index d0de402d8b..99913581f0 100644
---- a/src/OVAL/probes/independent/filemd5_probe.c
-+++ b/src/OVAL/probes/independent/filemd5_probe.c
-@@ -163,12 +163,6 @@ int probe_offline_mode_supported()
- 
- void *probe_init (void)
- {
--        /*
--         * Initialize crypto API
--         */
--        if (crapi_init (NULL) != 0)
--                return (NULL);
--
-         /*
-          * Initialize mutex.
-          */
-
-From c4c26d99a59205d744befe52be4e81bcf5f55d9c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Tue, 13 Jul 2021 13:03:21 +0200
-Subject: [PATCH 2/3] Add a missing include
-
----
- src/OVAL/oval_probe_session.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
-index 6f6d7ad426..295782b536 100644
---- a/src/OVAL/oval_probe_session.c
-+++ b/src/OVAL/oval_probe_session.c
-@@ -48,6 +48,7 @@
- #include "oval_probe_ext.h"
- #include "probe-table.h"
- #include "oval_types.h"
-+#include "crapi/crapi.h"
- 
- #if defined(OSCAP_THREAD_SAFE)
- #include <pthread.h>
-
-From 6241a8835574429a787e0dd48d2c0ac2a71499b8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 15 Jul 2021 14:21:00 +0200
-Subject: [PATCH 3/3] Don't initialize crypto on Windows
-
----
- src/OVAL/oval_probe_session.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
-index 295782b536..b443cbcc80 100644
---- a/src/OVAL/oval_probe_session.c
-+++ b/src/OVAL/oval_probe_session.c
-@@ -97,8 +97,10 @@ static void oval_probe_session_libinit(void)
- 	/*
- 	 * Initialize crypto API
- 	 */
-+#ifndef OS_WINDOWS
- 	if (crapi_init (NULL) != 0)
- 		return (NULL);
-+#endif
- }
- 
- /**

SOURCES/openscap-1.3.6-PR-1788-test-rhbz1959570.patch

@@ -1,97 +0,0 @@
-From 05faede8f6602b7b71d71fd965276225a986fb1f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Wed, 28 Jul 2021 13:06:25 +0200
-Subject: [PATCH] Add a regression test for rhbz#1959570
-
-The bug was a segmentation fault in filehash58 probe which happened
-in openscap-1.3.3-6.el8_3.
-
-The bug was fixed by https://github.com/OpenSCAP/openscap/pull/1779
-and this patch adds a very small test.
----
- tests/probes/filehash58/CMakeLists.txt        |  1 +
- .../probes/filehash58/rhbz1959570_segfault.sh | 19 +++++++++
- .../rhbz1959570_segfault_reproducer.xml       | 39 +++++++++++++++++++
- 3 files changed, 59 insertions(+)
- create mode 100755 tests/probes/filehash58/rhbz1959570_segfault.sh
- create mode 100644 tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
-
-diff --git a/tests/probes/filehash58/CMakeLists.txt b/tests/probes/filehash58/CMakeLists.txt
-index b26d8171fb..cdec0792eb 100644
---- a/tests/probes/filehash58/CMakeLists.txt
-+++ b/tests/probes/filehash58/CMakeLists.txt
-@@ -1,3 +1,4 @@
- if(ENABLE_PROBES_INDEPENDENT)
- 	add_oscap_test("test_probes_filehash58.sh")
-+	add_oscap_test("rhbz1959570_segfault.sh")
- endif()
-diff --git a/tests/probes/filehash58/rhbz1959570_segfault.sh b/tests/probes/filehash58/rhbz1959570_segfault.sh
-new file mode 100755
-index 0000000000..0c32cc79f1
---- /dev/null
-+++ b/tests/probes/filehash58/rhbz1959570_segfault.sh
-@@ -0,0 +1,19 @@
-+#!/usr/bin/env bash
-+
-+# Copyright 2021 Red Hat Inc., Durham, North Carolina.
-+# All Rights Reserved.
-+#
-+# OpenSCAP Probes Test Suite.
-+#
-+# Authors:
-+#      Jan Černý, <jcerny@redhat.com>
-+
-+set -e -o pipefail
-+. $builddir/tests/test_common.sh
-+
-+# Test Cases
-+
-+stderr="$(mktemp)"
-+$OSCAP oval eval --id oval:x:def:1 "$srcdir/rhbz1959570_segfault_reproducer.xml" 2> "$stderr"
-+[ ! -s "$stderr" ]
-+rm "$stderr"
-diff --git a/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
-new file mode 100644
-index 0000000000..4b3fc4863a
---- /dev/null
-+++ b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
-@@ -0,0 +1,39 @@
-+<?xml version="1.0"?>
-+<oval-def:oval_definitions xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
-+  <oval-def:generator>
-+    <oval:product_name>jcerny</oval:product_name>
-+    <oval:product_version>1</oval:product_version>
-+    <oval:schema_version>5.11</oval:schema_version>
-+    <oval:timestamp>2021-07-28T07:40:55</oval:timestamp>
-+  </oval-def:generator>
-+  <oval-def:definitions>
-+    <oval-def:definition class="compliance" id="oval:x:def:1" version="1">
-+      <oval-def:metadata>
-+        <oval-def:title>title</oval-def:title>
-+        <oval-def:description>description</oval-def:description>
-+      </oval-def:metadata>
-+      <oval-def:criteria>
-+        <oval-def:criterion comment="comment" test_ref="oval:x:tst:1"/>
-+      </oval-def:criteria>
-+    </oval-def:definition>
-+  </oval-def:definitions>
-+  <oval-def:tests>
-+    <ind:filehash58_test check="all" check_existence="all_exist" comment="comment" id="oval:x:tst:1" version="1">
-+      <ind:object object_ref="oval:x:obj:1"/>
-+      <ind:state state_ref="oval:x:ste:1"/>
-+    </ind:filehash58_test>
-+  </oval-def:tests>
-+  <oval-def:objects>
-+    <ind:filehash58_object id="oval:x:obj:1" version="1">
-+      <ind:filepath>/etc/os-release</ind:filepath>
-+      <ind:hash_type>SHA-256</ind:hash_type>
-+    </ind:filehash58_object>
-+  </oval-def:objects>
-+  <oval-def:states>
-+    <ind:filehash58_state id="oval:x:ste:1" version="1">
-+      <ind:filepath>/etc/os-release</ind:filepath>
-+      <ind:hash_type>SHA-256</ind:hash_type>
-+      <ind:hash>6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af</ind:hash>
-+    </ind:filehash58_state>
-+  </oval-def:states>
-+</oval-def:oval_definitions>

SOURCES/openscap-1.3.7-PR-1841-coverity.patch

@@ -0,0 +1,104 @@
+From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Thu, 27 Jan 2022 15:00:33 +0100
+Subject: [PATCH 1/3] Fix shellcheck warning
+
+Addressing:
+
+Error: SHELLCHECK_WARNING (CWE-138): [#def1]
+/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
+  108|   args+=( "--remediate" )
+  109|   args+=( "${OSCAP_REMEDIATE_DS}" )
+  110|-> log "Args: ${args[@]}"
+  111|
+  112|   # Now we are good to go
+---
+ utils/oscap-remediate | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/utils/oscap-remediate b/utils/oscap-remediate
+index fc0b7715f..52e29aa66 100755
+--- a/utils/oscap-remediate
++++ b/utils/oscap-remediate
+@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
+ args+=( "--progress-full" )
+ args+=( "--remediate" )
+ args+=( "${OSCAP_REMEDIATE_DS}" )
+-log "Args: ${args[@]}"
++log "Args: ${args[*]}"
+ 
+ # Now we are good to go
+ header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
+
+From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Thu, 27 Jan 2022 15:09:02 +0100
+Subject: [PATCH 2/3] Remove superfluous strdup
+
+We can do this because xccdf_session_set_rule calls strdup on the rule
+parameter internally.
+
+Addressing:
+
+Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
+openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
+openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
+openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
+openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
+ 4148|       char *n_rule = strdup(rule);
+ 4149|       xccdf_session_set_rule(sess, n_rule);
+ 4150|-> }
+ 4151|
+ 4152|   void xccdf_session_free_py(struct xccdf_session *sess){
+---
+ swig/openscap.i | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/swig/openscap.i b/swig/openscap.i
+index 2fe1cce99..158a22675 100644
+--- a/swig/openscap.i
++++ b/swig/openscap.i
+@@ -559,8 +559,7 @@ struct xccdf_session {
+ };
+ 
+ void xccdf_session_set_rule_py(struct xccdf_session  *sess, char *rule) {
+-    char *n_rule = strdup(rule);
+-    xccdf_session_set_rule(sess, n_rule);
++    xccdf_session_set_rule(sess, rule);
+ }
+ 
+ void xccdf_session_free_py(struct xccdf_session *sess){
+
+From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Thu, 27 Jan 2022 15:16:02 +0100
+Subject: [PATCH 3/3] Add a missing free
+
+Addressing:
+Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
+openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
+openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
+openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
+openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
+openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
+ 2148|   			oscap_seterr(OSCAP_EFAMILY_XCCDF,
+ 2149|   				"Rule '%s' not found in selected profile.", rule_id);
+ 2150|-> 			return NULL;
+ 2151|   		}
+ 2152|   	}
+---
+ src/XCCDF_POLICY/xccdf_policy.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
+index b63853a38..4d4b7ad0a 100644
+--- a/src/XCCDF_POLICY/xccdf_policy.c
++++ b/src/XCCDF_POLICY/xccdf_policy.c
+@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
+ 		if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
+ 			oscap_seterr(OSCAP_EFAMILY_XCCDF,
+ 				"Rule '%s' not found in selected profile.", rule_id);
++			oscap_htable_iterator_free(rit);
+ 			return NULL;
+ 		}
+ 	}

SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch

@@ -0,0 +1,32 @@
+From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Mon, 31 Jan 2022 13:45:15 +0100
+Subject: [PATCH] Prevent fails of test_ds_misc.sh
+
+The SOURCE_DATE_EPOCH environment variable is effective only when it's
+set to a value that's older than mtime of the processed file.  See the
+implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
+However, the file in our test suite has originally been created before
+(in 2019) and this mtime can be used when a tarball is produced. To
+avoid the test failing, we can modify the mtime using the touch command
+just before we run the tests.
+---
+ tests/DS/test_ds_misc.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
+index 159007518..cffbef303 100755
+--- a/tests/DS/test_ds_misc.sh
++++ b/tests/DS/test_ds_misc.sh
+@@ -269,6 +269,8 @@ function test_source_date_epoch() {
+ 	local timestamp="2020-03-05T12:09:37"
+ 	export SOURCE_DATE_EPOCH="1583410177"
+ 	export TZ=UTC
++	# ensure the file mtime is always newer than the $timestamp
++	touch -c "$xccdf"
+ 	$OSCAP ds sds-compose "$xccdf" "$result"
+ 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
+ 	rm -f "$result"
+-- 
+2.34.1
+

SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch

@@ -0,0 +1,27 @@
+From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Tue, 1 Feb 2022 15:06:33 +0100
+Subject: [PATCH] Prevent fails of test_ds_misc.sh
+
+Other files from which the datastream is composed might also
+affect the timestamp attributes in result document depending
+on their mtime.
+---
+ tests/DS/test_ds_misc.sh | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
+index cffbef303..1777c44f4 100755
+--- a/tests/DS/test_ds_misc.sh
++++ b/tests/DS/test_ds_misc.sh
+@@ -270,7 +270,9 @@ function test_source_date_epoch() {
+ 	export SOURCE_DATE_EPOCH="1583410177"
+ 	export TZ=UTC
+ 	# ensure the file mtime is always newer than the $timestamp
+-	touch -c "$xccdf"
++	touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
++	touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
++	touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
+ 	$OSCAP ds sds-compose "$xccdf" "$result"
+ 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
+ 	rm -f "$result"

SPECS/openscap.spec

@@ -1,18 +1,14 @@
 Name:           openscap
-Version:        1.3.5
+Version:        1.3.6
-Release:        6%{?dist}
+Release:        3%{?dist}
 Summary:        Set of open source libraries enabling integration of the SCAP line of standards
 Group:          System Environment/Libraries
 License:        LGPLv2+
 URL:            http://www.open-scap.org/
 Source0:        https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
-Patch1:         openscap-1.3.6-PR-1745-waive-hugepages.patch
+Patch1:         openscap-1.3.7-PR-1841-coverity.patch
-Patch2:         openscap-1.3.6-PR-1748-covscan.patch
+Patch2:         openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
-Patch3:         openscap-1.3.6-PR-1749-blueprint-fix.patch
+Patch3:         openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
-Patch4:         openscap-1.3.6-PR-1753-getlogin.patch
-Patch5:         openscap-1.3.6-PR-1756-yaml-nulls.patch
-Patch6:         openscap-1.3.6-PR-1779-initialize-crapi-once.patch
-Patch7:         openscap-1.3.6-PR-1788-test-rhbz1959570.patch
 BuildRequires:  cmake >= 2.6
 BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
 BuildRequires:  rpm-devel
@@ -162,6 +158,12 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 # fix python shebangs
 pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
 
+# enable oscap-remediate.service here for now
+# https://github.com/hughsie/PackageKit/issues/401
+# https://bugzilla.redhat.com/show_bug.cgi?id=1833176
+mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/
+ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service
+
 %clean
 rm -rf $RPM_BUILD_ROOT
 
@@ -201,7 +203,12 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/oscap
 %{_mandir}/man8/oscap-chroot.8.gz
 %{_bindir}/oscap-chroot
+%{_mandir}/man8/oscap-remediate-offline.8.gz
+%{_bindir}/oscap-remediate-offline
 %{_sysconfdir}/bash_completion.d
+%{_libexecdir}/oscap-remediate
+%{_unitdir}/oscap-remediate.service
+%{_unitdir}/system-update.target.wants/
 
 %files utils
 %doc docs/oscap-scan.cron
@@ -221,6 +228,34 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/oscap-run-sce-script
 
 %changelog
+* Wed Feb 02 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-3
+- Prevent fails of test_ds_misc.sh
+
+* Mon Jan 31 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-2
+- Fix coverity issues
+- Prevent fails of test_ds_misc.sh
+
+* Thu Jan 20 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-1
+- Upgrade to the latest upstream release (rhbz#2041781)
+- Select and exclude groups of rules on the command line
+- The boot-time remediation service for systemd's Offline Update mode
+
+* Fri Nov 19 2021 Jan Černý <jcerny@redhat.com> - 1.3.5-10
+- Print warning for local files
+
+* Wed Nov 10 2021 Jan Černý <jcerny@redhat.com> - 1.3.5-9
+- Lower memory limits and improve their checking (rhbz#2021851)
+- Remove timestamp from the user manual (rhbz#2022364)
+
+* Tue Nov 09 2021 Jan Černý <jcerny@redhat.com> - 1.3.5-8
+- Allow local DS components (rhbz#1970529)
+- Fix hostname detection in offline scan of UBI 9 images (rhbz#1893888)
+- Add an alternative source of hostname (rhbz#1977668)
+- Fix oscap-chroot errors in process58_probe caused by empty /proc (rhbz#2008922)
+
+* Thu Nov 04 2021 Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.5-7
+- Introduce support for Image Builder's Blueprint remediation type (rhbz#2020050)
+
 * Wed Jul 28 2021 Jan Černý <jcerny@redhat.com> - 1.3.5-6
 - Initialize crypto API only once (rhbz#1959570)