Upgrade to the latest upstream release

openscap-1.3.7 Resolves: rhbz#2159286 Resolves: rhbz#2126883 Resolves: rhbz#2138884
2023-01-27 10:13:25 +01:00 · 2023-01-27 10:13:25 +01:00 · c50f5ac4c0
commit c50f5ac4c0
parent 77b5330e9f
10 changed files with 8 additions and 975 deletions
--- a/openscap-1.3.7-PR-1841-coverity.patch
+++ b/openscap-1.3.7-PR-1841-coverity.patch
@ -1,104 +0,0 @@
 From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 27 Jan 2022 15:00:33 +0100
 Subject: [PATCH 1/3] Fix shellcheck warning
 Addressing:
 Error: SHELLCHECK_WARNING (CWE-138): [#def1]
 /usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
  108|   args+=( "--remediate" )
  109|   args+=( "${OSCAP_REMEDIATE_DS}" )
  110|-> log "Args: ${args[@]}"
  111|
  112|   # Now we are good to go
 ---
 utils/oscap-remediate | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/utils/oscap-remediate b/utils/oscap-remediate
 index fc0b7715f..52e29aa66 100755
 --- a/utils/oscap-remediate
 +++ b/utils/oscap-remediate
@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
 args+=( "--progress-full" )
 args+=( "--remediate" )
 args+=( "${OSCAP_REMEDIATE_DS}" )
 -log "Args: ${args[@]}"
 +log "Args: ${args[*]}"
 # Now we are good to go
 header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
 From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 27 Jan 2022 15:09:02 +0100
 Subject: [PATCH 2/3] Remove superfluous strdup
 We can do this because xccdf_session_set_rule calls strdup on the rule
 parameter internally.
 Addressing:
 Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
 openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
 openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
 openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
 openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
 4148|       char *n_rule = strdup(rule);
 4149|       xccdf_session_set_rule(sess, n_rule);
 4150|-> }
 4151|
 4152|   void xccdf_session_free_py(struct xccdf_session *sess){
 ---
 swig/openscap.i | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/swig/openscap.i b/swig/openscap.i
 index 2fe1cce99..158a22675 100644
 --- a/swig/openscap.i
 +++ b/swig/openscap.i
@@ -559,8 +559,7 @@ struct xccdf_session {
 };
 void xccdf_session_set_rule_py(struct xccdf_session  *sess, char *rule) {
 -    char *n_rule = strdup(rule);
 -    xccdf_session_set_rule(sess, n_rule);
 +    xccdf_session_set_rule(sess, rule);
 }
 void xccdf_session_free_py(struct xccdf_session *sess){
 From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 27 Jan 2022 15:16:02 +0100
 Subject: [PATCH 3/3] Add a missing free
 Addressing:
 Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
 openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
 openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
 openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
 openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
 openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
 2148|   			oscap_seterr(OSCAP_EFAMILY_XCCDF,
 2149|   				"Rule '%s' not found in selected profile.", rule_id);
 2150|-> 			return NULL;
 2151|   		}
 2152|   	}
 ---
 src/XCCDF_POLICY/xccdf_policy.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
 index b63853a38..4d4b7ad0a 100644
 --- a/src/XCCDF_POLICY/xccdf_policy.c
 +++ b/src/XCCDF_POLICY/xccdf_policy.c
@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
 		if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
 			oscap_seterr(OSCAP_EFAMILY_XCCDF,
 				"Rule '%s' not found in selected profile.", rule_id);
 +			oscap_htable_iterator_free(rit);
 			return NULL;
 		}
 	}
--- a/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
+++ b/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
@ -1,32 +0,0 @@
 From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Mon, 31 Jan 2022 13:45:15 +0100
 Subject: [PATCH] Prevent fails of test_ds_misc.sh
 The SOURCE_DATE_EPOCH environment variable is effective only when it's
 set to a value that's older than mtime of the processed file.  See the
 implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
 However, the file in our test suite has originally been created before
 (in 2019) and this mtime can be used when a tarball is produced. To
 avoid the test failing, we can modify the mtime using the touch command
 just before we run the tests.
 ---
 tests/DS/test_ds_misc.sh | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
 index 159007518..cffbef303 100755
 --- a/tests/DS/test_ds_misc.sh
 +++ b/tests/DS/test_ds_misc.sh
@@ -269,6 +269,8 @@ function test_source_date_epoch() {
 	local timestamp="2020-03-05T12:09:37"
 	export SOURCE_DATE_EPOCH="1583410177"
 	export TZ=UTC
 +	# ensure the file mtime is always newer than the $timestamp
 +	touch -c "$xccdf"
 	$OSCAP ds sds-compose "$xccdf" "$result"
 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
 	rm -f "$result"
 -- 
 2.34.1
--- a/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
+++ b/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
@ -1,27 +0,0 @@
 From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Tue, 1 Feb 2022 15:06:33 +0100
 Subject: [PATCH] Prevent fails of test_ds_misc.sh
 Other files from which the datastream is composed might also
 affect the timestamp attributes in result document depending
 on their mtime.
 ---
 tests/DS/test_ds_misc.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
 index cffbef303..1777c44f4 100755
 --- a/tests/DS/test_ds_misc.sh
 +++ b/tests/DS/test_ds_misc.sh
@@ -270,7 +270,9 @@ function test_source_date_epoch() {
 	export SOURCE_DATE_EPOCH="1583410177"
 	export TZ=UTC
 	# ensure the file mtime is always newer than the $timestamp
 -	touch -c "$xccdf"
 +	touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
 +	touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
 +	touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
 	$OSCAP ds sds-compose "$xccdf" "$result"
 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
 	rm -f "$result"
--- a/openscap-1.3.7-PR-1846-file-permissions.patch
+++ b/openscap-1.3.7-PR-1846-file-permissions.patch
@ -1,393 +0,0 @@
 From d000375944e8ec965486cf019c3f75f4c06a4e10 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 3 Feb 2022 14:14:21 +0100
 Subject: [PATCH 1/5] Prevent file permissions errors
 The sysctl setting `fs.protected_regular` doesn't allow `O_CREAT` open
 on regular files that we don't own in world writable sticky directories
 (think `/tmp`). This causes permission denied error when writing HTML
 report to a temporary files created by the `mktemp` command executed as
 a normal user and then executing `sudo oscap`.
 See https://bugzilla.redhat.com/show_bug.cgi?id=2048571
 If OpenSCAP fails to open the file because of permissions, it will retry
 to open the file without O_CREAT flag.
 This fixes only creation of the HTML report using the `--report` option,
 We will have to create a similar patch also for other output options
 such as `--results` or `--results-arf`.
 ---
 src/source/xslt.c | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)
 diff --git a/src/source/xslt.c b/src/source/xslt.c
 index 24c4c46e9..7a3a3f328 100644
 --- a/src/source/xslt.c
 +++ b/src/source/xslt.c
@@ -22,6 +22,7 @@
 #include <config.h>
 #endif
 +#include <fcntl.h>
 #include <libxml/parser.h>
 #include <libxslt/xslt.h>
 #include <libxslt/xsltInternals.h>
@@ -82,23 +83,38 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
 static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
 {
 -	FILE *f = NULL;
 -	if (outfile)
 -		f = fopen(outfile, "w");
 -	else
 -		f = stdout;
 -
 -	if (f == NULL) {
 -		oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not open output file '%s'", outfile ? outfile : "stdout");
 -		return -1;
 +	int fd = STDOUT_FILENO;
 +	if (outfile) {
 +#ifdef OS_WINDOWS
 +		fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
 +#else
 +		fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 +#endif
 +		if (fd == -1) {
 +			if (errno == EACCES) {
 +				/* File already exists and we aren't allowed to create a new one
 +				with the same name */
 +#ifdef OS_WINDOWS
 +				fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
 +#else
 +				fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 +#endif
 +			}
 +			if (fd == -1) {
 +				oscap_seterr(OSCAP_EFAMILY_OSCAP,
 +					"Could not open output file '%s': %s",
 +					outfile, strerror(errno));
 +				return -1;
 +			}
 +		}
 	}
 -	int ret = xsltSaveResultToFile(f, resulting_doc, stylesheet);
 +	int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
 	if (ret < 0) {
 		oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
 	}
 -	if (outfile && f)
 -		fclose(f);
 +	if (fd != STDOUT_FILENO)
 +		close(fd);
 	return ret;
 }
 From ad3c89a72c0aeb6c6ceab0873c51b07deba45701 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 3 Feb 2022 15:08:52 +0100
 Subject: [PATCH 2/5] Prevent permission access issues
 Very similar to the previous commit, but this time for saving XML
 documents.
 ---
 src/common/elements.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)
 diff --git a/src/common/elements.c b/src/common/elements.c
 index e512f5e3d..d0d9170f1 100644
 --- a/src/common/elements.c
 +++ b/src/common/elements.c
@@ -233,9 +233,22 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
 		int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
 				S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 #endif
 -		if (fd < 0) {
 -			oscap_seterr(OSCAP_EFAMILY_GLIBC, "%s '%s'", strerror(errno), filename);
 -			return -1;
 +		if (fd == -1) {
 +			if (errno == EACCES) {
 +				/* File already exists and we aren't allowed to create a new one
 +				with the same name */
 +#ifdef OS_WINDOWS
 +				fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
 +#else
 +				fd = open(filename, O_WRONLY|O_TRUNC,
 +						S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 +#endif
 +			}
 +			if (fd == -1) {
 +				oscap_seterr(OSCAP_EFAMILY_GLIBC,
 +						"%s '%s'", strerror(errno), filename);
 +				return -1;
 +			}
 		}
 		buff = xmlOutputBufferCreateFd(fd, NULL);
 From b2dc90fb80419e30d05676660a2069050693078d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 3 Feb 2022 15:37:31 +0100
 Subject: [PATCH 3/5] Add a missing include
 ---
 src/source/xslt.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/src/source/xslt.c b/src/source/xslt.c
 index 7a3a3f328..a763d6b59 100644
 --- a/src/source/xslt.c
 +++ b/src/source/xslt.c
@@ -30,6 +30,8 @@
 #include <libxslt/xsltutils.h>
 #include <libexslt/exslt.h>
 #include <string.h>
 +#include <sys/stat.h>
 +
 #ifdef OS_WINDOWS
 #include <io.h>
 #else
 From 13ff98bd744ea542bc782e388fdedb5b7f66e54b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Thu, 3 Feb 2022 16:22:56 +0100
 Subject: [PATCH 4/5] Fix missing STDOUT_FILENO on Windows
 ---
 src/source/xslt.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/src/source/xslt.c b/src/source/xslt.c
 index a763d6b59..799d5170d 100644
 --- a/src/source/xslt.c
 +++ b/src/source/xslt.c
@@ -85,7 +85,11 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
 static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
 {
 +#ifdef OS_WINDOWS
 +	int fd = _fileno(stdout);
 +#else
 	int fd = STDOUT_FILENO;
 +#endif
 	if (outfile) {
 #ifdef OS_WINDOWS
 		fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
@@ -115,7 +119,11 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
 	if (ret < 0) {
 		oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
 	}
 +#ifdef OS_WINDOWS
 +	if (fd != _fileno(stdout))
 +#else
 	if (fd != STDOUT_FILENO)
 +#endif
 		close(fd);
 	return ret;
 }
 From f00831513ec2cdde13c12820ff6cc0eef8105c65 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Fri, 4 Feb 2022 12:19:50 +0100
 Subject: [PATCH 5/5] Refactor: extract function oscap_open_writable
 ---
 src/common/elements.c                         | 26 ++--------------
 src/common/util.c                             | 31 +++++++++++++++++++
 src/common/util.h                             | 14 ++++++++-
 src/source/xslt.c                             | 27 ++--------------
 tests/API/XCCDF/unittests/CMakeLists.txt      |  2 ++
 tests/API/XCCDF/unittests/test_oscap_common.c |  1 +
 6 files changed, 53 insertions(+), 48 deletions(-)
 diff --git a/src/common/elements.c b/src/common/elements.c
 index d0d9170f1..de4be88f1 100644
 --- a/src/common/elements.c
 +++ b/src/common/elements.c
@@ -227,29 +227,9 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
 		xmlCode = xmlSaveFormatFileEnc(filename, doc, "UTF-8", 1);
 	}
 	else {
 -#ifdef OS_WINDOWS
 -		int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, S_IREAD|S_IWRITE);
 -#else
 -		int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
 -				S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 -#endif
 -		if (fd == -1) {
 -			if (errno == EACCES) {
 -				/* File already exists and we aren't allowed to create a new one
 -				with the same name */
 -#ifdef OS_WINDOWS
 -				fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
 -#else
 -				fd = open(filename, O_WRONLY|O_TRUNC,
 -						S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 -#endif
 -			}
 -			if (fd == -1) {
 -				oscap_seterr(OSCAP_EFAMILY_GLIBC,
 -						"%s '%s'", strerror(errno), filename);
 -				return -1;
 -			}
 -		}
 +		int fd = oscap_open_writable(filename);
 +		if (fd == -1)
 +			return -1;
 		buff = xmlOutputBufferCreateFd(fd, NULL);
 		if (buff == NULL) {
 diff --git a/src/common/util.c b/src/common/util.c
 index 8f9f751e2..8ca2ad130 100644
 --- a/src/common/util.c
 +++ b/src/common/util.c
@@ -25,12 +25,14 @@
 #include <config.h>
 #endif
 +#include <fcntl.h>
 #include <string.h>
 #include <ctype.h>
 #include <limits.h>
 #include <stdarg.h>
 #include <math.h>
 #include <pcre.h>
 +#include <sys/stat.h>
 #include "util.h"
 #include "_error.h"
@@ -482,3 +484,32 @@ char *oscap_windows_error_message(unsigned long error_code)
 	return error_message;
 }
 #endif
 +
 +int oscap_open_writable(const char *filename)
 +{
 +#ifdef OS_WINDOWS
 +	int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
 +#else
 +	int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC,
 +			S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 +#endif
 +	if (fd == -1) {
 +		if (errno == EACCES) {
 +			/* File already exists and we aren't allowed to create a new one
 +			with the same name */
 +#ifdef OS_WINDOWS
 +			fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
 +#else
 +			fd = open(filename, O_WRONLY|O_TRUNC,
 +					S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 +#endif
 +		}
 +		if (fd == -1) {
 +			oscap_seterr(OSCAP_EFAMILY_OSCAP,
 +					"Could not open output file '%s': %s",
 +					filename, strerror(errno));
 +			return -1;
 +		}
 +	}
 +	return fd;
 +}
 diff --git a/src/common/util.h b/src/common/util.h
 index c48d92a52..5712f2f0b 100644
 --- a/src/common/util.h
 +++ b/src/common/util.h
@@ -524,4 +524,16 @@ wchar_t *oscap_windows_str_to_wstr(const char *str);
 char *oscap_windows_error_message(unsigned long error_code);
 #endif
 -#endif				/* OSCAP_UTIL_H_ */
 +/**
 + * Open a file for writing.
 + * The main difference from fopen() is that if the file exists but its opening
 + * for writing fails as permission denied, it will attempt to open it again
 + * without the O_CREAT flag. This is useful when writing to world-writeable
 + * directories with sticky bit such as /tmp on systems with fs.protected_regular
 + * turned on.
 + * @param filename name of the file to be opened
 + * @return file descriptor or -1 on error
 + */
 +int oscap_open_writable(const char *filename);
 +
 +#endif              /* OSCAP_UTIL_H_ */
 diff --git a/src/source/xslt.c b/src/source/xslt.c
 index 799d5170d..906bfabdb 100644
 --- a/src/source/xslt.c
 +++ b/src/source/xslt.c
@@ -22,7 +22,6 @@
 #include <config.h>
 #endif
 -#include <fcntl.h>
 #include <libxml/parser.h>
 #include <libxslt/xslt.h>
 #include <libxslt/xsltInternals.h>
@@ -30,7 +29,6 @@
 #include <libxslt/xsltutils.h>
 #include <libexslt/exslt.h>
 #include <string.h>
 -#include <sys/stat.h>
 #ifdef OS_WINDOWS
 #include <io.h>
@@ -91,29 +89,10 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
 	int fd = STDOUT_FILENO;
 #endif
 	if (outfile) {
 -#ifdef OS_WINDOWS
 -		fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
 -#else
 -		fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 -#endif
 -		if (fd == -1) {
 -			if (errno == EACCES) {
 -				/* File already exists and we aren't allowed to create a new one
 -				with the same name */
 -#ifdef OS_WINDOWS
 -				fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
 -#else
 -				fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
 -#endif
 -			}
 -			if (fd == -1) {
 -				oscap_seterr(OSCAP_EFAMILY_OSCAP,
 -					"Could not open output file '%s': %s",
 -					outfile, strerror(errno));
 -				return -1;
 -			}
 -		}
 +		fd = oscap_open_writable(outfile);
 	}
 +	if (fd == -1)
 +		return -1;
 	int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
 	if (ret < 0) {
 diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
 index 97e1ab09f..a1c7da67f 100644
 --- a/tests/API/XCCDF/unittests/CMakeLists.txt
 +++ b/tests/API/XCCDF/unittests/CMakeLists.txt
@@ -2,6 +2,8 @@ add_oscap_test_executable(test_oscap_common
 	"test_oscap_common.c"
 	${CMAKE_SOURCE_DIR}/src/common/util.c
 	${CMAKE_SOURCE_DIR}/src/common/list.c
 +	${CMAKE_SOURCE_DIR}/src/common/error.c
 +	${CMAKE_SOURCE_DIR}/src/common/err_queue.c
 )
 add_oscap_test_executable(test_xccdf_overrides
 diff --git a/tests/API/XCCDF/unittests/test_oscap_common.c b/tests/API/XCCDF/unittests/test_oscap_common.c
 index 26ff51d48..939ba8750 100644
 --- a/tests/API/XCCDF/unittests/test_oscap_common.c
 +++ b/tests/API/XCCDF/unittests/test_oscap_common.c
@@ -28,6 +28,7 @@
 #include <string.h>
 #include "common/list.h"
 #include "common/util.h"
 +#include "common/_error.h"
 #include "oscap_assert.h"
 #define SEEN_LEN 9
--- a/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
+++ b/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
@ -1,22 +0,0 @@
 From 12f9c02a612bb1687676b74a4739126b1913b1fe Mon Sep 17 00:00:00 2001
 From: Ajay Nair <ajaynair59@gmail.com>
 Date: Mon, 9 May 2022 13:31:47 -0400
 Subject: [PATCH] Reset errno before call to strtoll
 ---
 src/common/memusage.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/src/common/memusage.c b/src/common/memusage.c
 index c6755f21f1..ffa70b662b 100644
 --- a/src/common/memusage.c
 +++ b/src/common/memusage.c
@@ -71,6 +71,8 @@ static int read_common_sizet(void *szp, char *strval)
 		return (-1);
 	*end = '\0';
 +
 +	errno = 0;
 	*(size_t *)szp = strtoll(strval, NULL, 10);
 	if (errno == EINVAL ||
--- a/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
+++ b/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
@ -1,233 +0,0 @@
 From 07486e9033d8cc1fd03962994b3359cb611a9ac9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Fri, 22 Jul 2022 16:50:01 +0200
 Subject: [PATCH 1/3] Add unit test for read_common_sizet function
 The unit test will cover the missing set errno
 to 0 which was the root cause of:
 https://github.com/OpenSCAP/openscap/issues/1867
 Therefore, this test can be used during verification of:
 https://bugzilla.redhat.com/show_bug.cgi?id=2109485
 ---
 tests/API/probes/CMakeLists.txt   |  9 +++++
 tests/API/probes/test_memusage.c  | 67 +++++++++++++++++++++++++++++++
 tests/API/probes/test_memusage.sh |  9 +++++
 3 files changed, 85 insertions(+)
 create mode 100644 tests/API/probes/test_memusage.c
 create mode 100755 tests/API/probes/test_memusage.sh
 diff --git a/tests/API/probes/CMakeLists.txt b/tests/API/probes/CMakeLists.txt
 index ae3c7212a0..2ac4081ac2 100644
 --- a/tests/API/probes/CMakeLists.txt
 +++ b/tests/API/probes/CMakeLists.txt
@@ -38,3 +38,12 @@ target_include_directories(oval_fts_list PUBLIC
 )
 target_link_libraries(oval_fts_list openscap)
 add_oscap_test("fts.sh")
 +
 +add_oscap_test_executable(test_memusage
 +	"test_memusage.c"
 +	"${CMAKE_SOURCE_DIR}/src/common/bfind.c"
 +)
 +target_include_directories(test_memusage PUBLIC
 +	"${CMAKE_SOURCE_DIR}/src/common"
 +)
 +add_oscap_test("test_memusage.sh")
 diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
 new file mode 100644
 index 0000000000..5dced98f03
 --- /dev/null
 +++ b/tests/API/probes/test_memusage.c
@@ -0,0 +1,67 @@
 +/*
 + * Copyright 2022 Red Hat Inc., Durham, North Carolina.
 + * All Rights Reserved.
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, write to the Free Software
 + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 + *
 + * Authors:
 + *      "Jan Černý" <jcerny@redhat.com>
 + */
 +
 +#ifdef HAVE_CONFIG_H
 +#include <config.h>
 +#endif
 +
 +#include <stdio.h>
 +#include "memusage.h"
 +#include "memusage.c"
 +#define OS_LINUX
 +
 +static int test_basic()
 +{
 +	size_t size;
 +	char *strval = strdup("17 MB");
 +	read_common_sizet(&size, strval);
 +	free(strval);
 +	return (size == 17);
 +}
 +
 +static int test_errno()
 +{
 +	size_t size;
 +	char *strval = strdup("17 MB");
 +
 +	/* Test that setting errno outside of the read_common_sizet function
 +	 * doesn't influence the function and doesn't make the function fail.
 +	 */
 +	errno = EINVAL;
 +
 +	int ret = read_common_sizet(&size, strval);
 +	free(strval);
 +	return (ret != -1);
 +}
 +
 +int main(int argc, char *argv[])
 +{
 +	if (!test_basic()) {
 +		fprintf(stderr, "test_basic has failed\n");
 +		return 1;
 +	}
 +	if (!test_errno()) {
 +		fprintf(stderr, "test_errno has failed\n");
 +		return 1;
 +	}
 +	return 0;
 +}
 diff --git a/tests/API/probes/test_memusage.sh b/tests/API/probes/test_memusage.sh
 new file mode 100755
 index 0000000000..4c76bdc0ac
 --- /dev/null
 +++ b/tests/API/probes/test_memusage.sh
@@ -0,0 +1,9 @@
 +#!/usr/bin/env bash
 +
 +. $builddir/tests/test_common.sh
 +
 +if [ -n "${CUSTOM_OSCAP+x}" ] ; then
 +    exit 255
 +fi
 +
 +./test_memusage
 From 2cc649d5e9fbf337bbfca69c21313657a5b8a7cf Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Mon, 25 Jul 2022 09:00:36 +0200
 Subject: [PATCH 2/3] Replace license by SPDX ID
 ---
 tests/API/probes/test_memusage.c | 22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)
 diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
 index 5dced98f03..db2915f6d5 100644
 --- a/tests/API/probes/test_memusage.c
 +++ b/tests/API/probes/test_memusage.c
@@ -1,24 +1,4 @@
 -/*
 - * Copyright 2022 Red Hat Inc., Durham, North Carolina.
 - * All Rights Reserved.
 - *
 - * This library is free software; you can redistribute it and/or
 - * modify it under the terms of the GNU Lesser General Public
 - * License as published by the Free Software Foundation; either
 - * version 2.1 of the License, or (at your option) any later version.
 - *
 - * This library is distributed in the hope that it will be useful,
 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 - * Lesser General Public License for more details.
 - *
 - * You should have received a copy of the GNU Lesser General Public
 - * License along with this library; if not, write to the Free Software
 - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 - *
 - * Authors:
 - *      "Jan Černý" <jcerny@redhat.com>
 - */
 +// SPDX-License-Identifier: LGPL-2.1-or-later
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 From caadd89e61f5d70e251180055686a3b52c763c66 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Mon, 25 Jul 2022 09:00:45 +0200
 Subject: [PATCH 3/3] Improve unit test for read_common_sizet
 Check for multiple different situations.
 ---
 tests/API/probes/test_memusage.c | 34 ++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)
 diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
 index db2915f6d5..b9db865d45 100644
 --- a/tests/API/probes/test_memusage.c
 +++ b/tests/API/probes/test_memusage.c
@@ -12,16 +12,34 @@
 static int test_basic()
 {
 	size_t size;
 -	char *strval = strdup("17 MB");
 -	read_common_sizet(&size, strval);
 +	char *strval = strdup("17 kB\n");
 +	int ret = read_common_sizet(&size, strval);
 	free(strval);
 -	return (size == 17);
 +	return (size == 17 && ret == 0);
 +}
 +
 +static int test_no_unit()
 +{
 +	size_t size;
 +	char *strval = strdup("42");
 +	int ret = read_common_sizet(&size, strval);
 +	free(strval);
 +	return (ret == -1);
 +}
 +
 +static int test_invalid_number()
 +{
 +	size_t size;
 +	char *strval = strdup("www kB\n");
 +	int ret = read_common_sizet(&size, strval);
 +	free(strval);
 +	return (size == 0 && ret == 0);
 }
 static int test_errno()
 {
 	size_t size;
 -	char *strval = strdup("17 MB");
 +	char *strval = strdup("17 kB\n");
 	/* Test that setting errno outside of the read_common_sizet function
 	 * doesn't influence the function and doesn't make the function fail.
@@ -39,6 +57,14 @@ int main(int argc, char *argv[])
 		fprintf(stderr, "test_basic has failed\n");
 		return 1;
 	}
 +	if (!test_no_unit()) {
 +		fprintf(stderr, "test_no_unit has failed\n");
 +		return 1;
 +	}
 +	if (!test_invalid_number()) {
 +		fprintf(stderr, "test_invalid_number has failed\n");
 +		return 1;
 +	}
 	if (!test_errno()) {
 		fprintf(stderr, "test_errno has failed\n");
 		return 1;
--- a/openscap-1.3.7-PR-1875-reset-errno-strtol.patch
+++ b/openscap-1.3.7-PR-1875-reset-errno-strtol.patch
@ -1,71 +0,0 @@
 From 55b09ba184c1803a5e1454c44e9e9a5c578dd741 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Mon, 25 Jul 2022 17:10:17 +0200
 Subject: [PATCH] Reset errno before strtol
 This sets errno to 0 before strotol calls after which the errno
 is being checked.
 Per man 3 strtol:
 Since  strtol()  can  legitimately  return 0, LONG_MAX, or
 LONG_MIN (LLONG_MAX or LLONG_MIN for strtoll()) on both success and
 failure, the calling program should set errno to 0 before the call, and
 then determine if an error occurred by checking whether errno has a
 nonzero value after the call.
 This is inspired by https://github.com/OpenSCAP/openscap/pull/1861.
 ---
 src/OVAL/probes/independent/sql57_probe.c | 1 +
 src/OVAL/probes/independent/sql_probe.c   | 1 +
 src/OVAL/probes/oval_fts.c                | 1 +
 src/OVAL/probes/unix/xinetd_probe.c       | 1 +
 4 files changed, 4 insertions(+)
 diff --git a/src/OVAL/probes/independent/sql57_probe.c b/src/OVAL/probes/independent/sql57_probe.c
 index ce1466635c..2b35750ee2 100644
 --- a/src/OVAL/probes/independent/sql57_probe.c
 +++ b/src/OVAL/probes/independent/sql57_probe.c
@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
 			matchitem1(tok, 'c',
 				   "onnecttimeout", tmp);
 			if (tmp != NULL) {
 +				errno = 0;
 				info->conn_timeout = strtol(tmp, NULL, 10);
 				if (errno == ERANGE || errno == EINVAL)
 diff --git a/src/OVAL/probes/independent/sql_probe.c b/src/OVAL/probes/independent/sql_probe.c
 index 2ede89d031..71ba3c08c3 100644
 --- a/src/OVAL/probes/independent/sql_probe.c
 +++ b/src/OVAL/probes/independent/sql_probe.c
@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
 			matchitem1(tok, 'c',
 				   "onnecttimeout", tmp);
 			if (tmp != NULL) {
 +				errno = 0;
 				info->conn_timeout = strtol(tmp, NULL, 10);
 				if (errno == ERANGE || errno == EINVAL)
 diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c
 index 1364159c90..f9d0a0c1fd 100644
 --- a/src/OVAL/probes/oval_fts.c
 +++ b/src/OVAL/probes/oval_fts.c
@@ -729,6 +729,7 @@ OVAL_FTS *oval_fts_open_prefixed(const char *prefix, SEXP_t *path, SEXP_t *filen
 	/* max_depth */
 	PROBE_ENT_AREF(behaviors, r0, "max_depth", return NULL;);
 	SEXP_string_cstr_r(r0, cstr_buff, sizeof cstr_buff - 1);
 +	errno = 0;
 	max_depth = strtol(cstr_buff, NULL, 10);
 	if (errno == EINVAL || errno == ERANGE) {
 		dE("Invalid value of the `%s' attribute: %s", "recurse_direction", cstr_buff);
 diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c
 index b3375500db..703a07f513 100644
 --- a/src/OVAL/probes/unix/xinetd_probe.c
 +++ b/src/OVAL/probes/unix/xinetd_probe.c
@@ -1280,6 +1280,7 @@ int op_assign_bool(void *var, char *val)
 		*((bool *)(var)) = false;
 	} else {
 		char *endptr = NULL;
 +		errno = 0;
 		*((bool *)(var)) = (bool) strtol (val, &endptr, 2);
 		if (errno == EINVAL || errno == ERANGE) {
 			return -1;
--- a/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
+++ b/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
@ -1,82 +0,0 @@
 From 140d60bc751e6c0e4138ab3a2e8e9b130264f905 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
 Date: Wed, 27 Jul 2022 09:40:29 +0200
 Subject: [PATCH] Add CMake option to disable oscap-remediate service
 This patch introduces a new CMake build option
 ENABLE_OSCAP_REMEDIATE_SERVICE which can be used to disable the
 installation of the files related to the oscap-remediate systemd
 service. Downstream packagers can use this option to disable shipping
 the oscap-remediate service in their RPM spec files.
 Resolves: rhbz#2111358
 Resolves: rhbz#2111360
 ---
 CMakeLists.txt       | 15 +++++++++------
 utils/CMakeLists.txt | 20 +++++++++++---------
 2 files changed, 20 insertions(+), 15 deletions(-)
 diff --git a/CMakeLists.txt b/CMakeLists.txt
 index 61c57d7a3e..48e19e5203 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -327,6 +327,7 @@ cmake_dependent_option(ENABLE_OSCAP_UTIL_VM "enables the oscap-vm utility, this
 cmake_dependent_option(ENABLE_OSCAP_UTIL_PODMAN "enables the oscap-podman utility, this lets you scan Podman containers and container images" ON "NOT WIN32" OFF)
 cmake_dependent_option(ENABLE_OSCAP_UTIL_CHROOT "enables the oscap-chroot utility, this lets you scan entire chroots using offline scanning" ON "NOT WIN32" OFF)
 option(ENABLE_OSCAP_UTIL_AUTOTAILOR "enables the autotailor utility that is able to perform command-line tailoring" TRUE)
 +option(ENABLE_OSCAP_REMEDIATE_SERVICE "enables the oscap-remediate service" TRUE)
 # ---------- TEST-SUITE SWITCHES
@@ -609,12 +610,14 @@ if(NOT WIN32)
 		DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
 	)
 	if(WITH_SYSTEMD)
 -		# systemd service for offline (boot-time) remediation
 -		configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
 -		install(FILES
 -			${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
 -			DESTINATION ${SYSTEMD_UNITDIR}
 -		)
 +		if(ENABLE_OSCAP_REMEDIATE_SERVICE)
 +			# systemd service for offline (boot-time) remediation
 +			configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
 +			install(FILES
 +				${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
 +				DESTINATION ${SYSTEMD_UNITDIR}
 +			)
 +		endif()
 	endif()
 endif()
 diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt
 index 3f199eaabc..93ce1f2a9d 100644
 --- a/utils/CMakeLists.txt
 +++ b/utils/CMakeLists.txt
@@ -59,15 +59,17 @@ if(ENABLE_OSCAP_UTIL)
 		)
 		if(WITH_SYSTEMD)
 -			install(PROGRAMS "oscap-remediate"
 -				DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
 -			)
 -			install(PROGRAMS "oscap-remediate-offline"
 -				DESTINATION ${CMAKE_INSTALL_BINDIR}
 -			)
 -			install(FILES "oscap-remediate-offline.8"
 -				DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
 -			)
 +			if (ENABLE_OSCAP_REMEDIATE_SERVICE)
 +				install(PROGRAMS "oscap-remediate"
 +					DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
 +				)
 +				install(PROGRAMS "oscap-remediate-offline"
 +					DESTINATION ${CMAKE_INSTALL_BINDIR}
 +				)
 +				install(FILES "oscap-remediate-offline.8"
 +					DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
 +				)
 +			endif()
 		endif()
 	endif()
 endif()
--- a/openscap.spec
+++ b/openscap.spec
@ -1,19 +1,11 @@
 Name:           openscap
-Version:        1.3.6
+Version:        1.3.7
-Release:        4%{?dist}
+Release:        1%{?dist}
 Epoch:          1
 Summary:        Set of open source libraries enabling integration of the SCAP line of standards
 License:        LGPLv2+
 URL:            http://www.open-scap.org/
 Source0:        https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
 Patch1:         openscap-1.3.7-PR-1841-coverity.patch
 Patch2:         openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
 Patch3:         openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
 Patch4:         openscap-1.3.7-PR-1846-file-permissions.patch
 Patch5:         openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
 Patch6:         openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
 Patch7:         openscap-1.3.7-PR-1875-reset-errno-strtol.patch
 Patch8:         openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
 BuildRequires:  make
 BuildRequires:  cmake >= 2.6
 BuildRequires:  gcc
@ -205,6 +197,11 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
 %{_bindir}/oscap-run-sce-script
 %changelog
 * Fri Jan 27 2023 Jan Černý <jcerny@redhat.com> - 1:1.3.7-1
 - Upgrade to the latest upstream release (rhbz#2159286)
 - Fix error when processing OVAL filters (rhbz#2126883)
 - Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2138884)
 * Thu Jul 21 2022 Jan Černý <jcerny@redhat.com> - 1:1.3.6-4
 - Fix potential invalid scan results in OpenSCAP (rhbz#2109485)
 - Remove oscap-remediate service (rhbz#2111358)
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (openscap-1.3.6.tar.gz) = 5e4d6c4addc15b2a0245b5caef80fda3020f1cac83ed4aa436ef3f1703d1d761060c931c2536fa68de7ad5bab002b79c8b2d1e5f7695d46249f4562f5a1569a0
+SHA512 (openscap-1.3.7.tar.gz) = 64dcceadbbb5b6045d2ebaca89287c80c26e05d7247fc0dd31cd9bff98398c7a26d6ed0e9191dcd2fd01f0711181f15d34fe9784bd043ccd0854baa17397cd88
`@ -1 +1 @@`
	`SHA512 (openscap-1.3.6.tar.gz) = 5e4d6c4addc15b2a0245b5caef80fda3020f1cac83ed4aa436ef3f1703d1d761060c931c2536fa68de7ad5bab002b79c8b2d1e5f7695d46249f4562f5a1569a0`	`SHA512 (openscap-1.3.7.tar.gz) = 64dcceadbbb5b6045d2ebaca89287c80c26e05d7247fc0dd31cd9bff98398c7a26d6ed0e9191dcd2fd01f0711181f15d34fe9784bd043ccd0854baa17397cd88`