import openscap-1.3.3-5.el8

2020-11-03 06:56:57 -05:00 · 2020-11-03 06:56:57 -05:00 · f5190d61d5
commit f5190d61d5
parent f4c4039c0e
16 changed files with 804 additions and 625 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/openscap-1.3.2.tar.gz
+SOURCES/openscap-1.3.3.tar.gz
--- a/.openscap.metadata
+++ b/.openscap.metadata
@ -1 +1 @@
-5fe71454faff8cdcbd0e13e7c7343daf04069ca9 SOURCES/openscap-1.3.2.tar.gz
+6988d1ea7b86669d410ab5defc1be394cba5b017 SOURCES/openscap-1.3.3.tar.gz
--- a/SOURCES/01-add-test-fix-type-anaconda.patch
+++ b/SOURCES/01-add-test-fix-type-anaconda.patch
@ -1,36 +0,0 @@
-From 712000a675103393045fde191856ce1dd306f1ca Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 13 Jan 2020 17:28:09 +0100
-Subject: [PATCH] Add a test to check --fix-type Anaconda
-
-There should be 2 equal ways of generating Anaconda remediations:
-"oscap xccdf generate fix --fix-type anaconda" and
-"oscap xccdf generate fix --template urn:redhat:anaconda:pre"
-Both commands should give the same output.
-This tests a fix for https://bugzilla.redhat.com/show_bug.cgi?id=1736850
-introduced by b1448ec95a957a76eb8be6d439531c532d97ff3c
---
- .../API/XCCDF/unittests/test_report_anaconda_fixes.sh  | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sh b/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sh
-index d4e86e657..650f3d75b 100755
--- a/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sh
-+++ b/tests/API/XCCDF/unittests/test_report_anaconda_fixes.sh
-@@ -23,6 +23,16 @@ grep -v "$line1" $result | grep -v "$line2" | grep -v "$line3"
- [ "`grep -v "$line1" $result | grep -v "$line2" | sed 's/\W//g'`"x == x ]
- :> $result
- 
-+# use --fix-type instead of URN template to generate the same fix
-+$OSCAP xccdf generate fix --fix-type anaconda \
-+	--output $result $srcdir/${name}.xccdf.xml 2>&1 > $stderr
-+[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
-+grep "$line1" $result
-+grep "$line2" $result
-+grep -v "$line1" $result | grep -v "$line2" | grep -v "$line3"
-+[ "`grep -v "$line1" $result | grep -v "$line2" | sed 's/\W//g'`"x == x ]
-+:> $result
-+
- $OSCAP xccdf generate fix --template urn:redhat:anaconda:pre \
- 	--profile xccdf_moc.elpmaxe.www_profile_1 \
- 	--output $result $srcdir/${name}.xccdf.xml 2>&1 > $stderr
--- a/SOURCES/02-do-not-use-keyword-operator-as-a-function-parameter.patch
+++ b/SOURCES/02-do-not-use-keyword-operator-as-a-function-parameter.patch
@ -1,38 +0,0 @@
-From 0ba7c9423f64a88ceef50318f1a382059484f737 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Wed, 15 Jan 2020 13:54:45 +0100
-Subject: [PATCH] Do not use C++ keyword operator as a function parameter name
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This fixes SCAP Workbench build.
-
-Addressing:
-[ 37%] Building CXX object CMakeFiles/scap-workbench.dir/scap-workbench_autogen/mocs_compilation.cpp.o
-In file included from /usr/local/include/openscap/xccdf_policy.h:39,
-                 from /home/jcerny/work/git/scap-workbench/include/TailoringDockWidgets.h:31,
-                 from /home/jcerny/work/git/scap-workbench/build/scap-workbench_autogen/6YEA5652QU/moc_TailoringDockWidgets.cpp:10,
-                 from /home/jcerny/work/git/scap-workbench/build/scap-workbench_autogen/mocs_compilation.cpp:18:
-/usr/local/include/openscap/oval_definitions.h:1676:117: error: declaration of ‘operator,’ as parameter
- 1676 | restriction *oval_variable_possible_restriction_new(oval_operator_t operator, const char *hint);
-      |                                                                             ^
-
-Fixes: #1462
---
- src/OVAL/public/oval_definitions.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/OVAL/public/oval_definitions.h b/src/OVAL/public/oval_definitions.h
-index ea9d3aaf8..b5fe77154 100644
--- a/src/OVAL/public/oval_definitions.h
-+++ b/src/OVAL/public/oval_definitions.h
-@@ -1669,7 +1669,7 @@ OSCAP_API void oval_variable_possible_value_iterator_free(struct oval_variable_p
-  * @param hint A short description of what the value means or represents.
-  * @memberof oval_variable_possible_restriction
-  */
-OSCAP_API struct oval_variable_possible_restriction *oval_variable_possible_restriction_new(oval_operator_t operator, const char *hint);
-+OSCAP_API struct oval_variable_possible_restriction *oval_variable_possible_restriction_new(oval_operator_t, const char *);
- 
- 
- /**
--- a/SOURCES/03-fix-cmake-test-for-libcap-xattr-h.patch
+++ b/SOURCES/03-fix-cmake-test-for-libcap-xattr-h.patch
@ -1,48 +0,0 @@
-From 3fbf36004eec55b9a88916559029332d7f356bae Mon Sep 17 00:00:00 2001
-From: Gabe <redhatrises@gmail.com>
-Date: Wed, 15 Jan 2020 15:02:32 -0700
-Subject: [PATCH] Fix case where CMake couldn't find libacl or xattr.h
-
---
- CMakeLists.txt      | 2 +-
- cmake/FindACL.cmake | 6 +++---
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 720d8d8eb..fe20992a5 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -238,7 +238,7 @@ cmake_dependent_option(OPENSCAP_PROBE_INDEPENDENT_XMLFILECONTENT "Independent xm
- # UNIX PROBES
- cmake_dependent_option(OPENSCAP_PROBE_UNIX_DNSCACHE "Unix dnscache probe" ON "ENABLE_PROBES_UNIX" OFF)
- cmake_dependent_option(OPENSCAP_PROBE_UNIX_FILE "Unix file probe" ON "ENABLE_PROBES_UNIX" OFF)
-cmake_dependent_option(OPENSCAP_PROBE_UNIX_FILEEXTENDEDATTRIBUTE "Unix fileextendedattribute probe" ON "ENABLE_PROBES_UNIX; (HAVE_SYS_XATTR_H OR HAVE_ATTR_XATTR_H)" OFF)
-+cmake_dependent_option(OPENSCAP_PROBE_UNIX_FILEEXTENDEDATTRIBUTE "Unix fileextendedattribute probe" ON "ENABLE_PROBES_UNIX; HAVE_SYS_XATTR_H OR HAVE_ATTR_XATTR_H" OFF)
- cmake_dependent_option(OPENSCAP_PROBE_UNIX_GCONF "Unix gconf probe" ON "ENABLE_PROBES_UNIX; GCONF_FOUND" OFF)
- cmake_dependent_option(OPENSCAP_PROBE_UNIX_INTERFACE "Unix interface probe" ON "ENABLE_PROBES_UNIX" OFF)
- cmake_dependent_option(OPENSCAP_PROBE_UNIX_PASSWORD "Unix password probe" ON "ENABLE_PROBES_UNIX" OFF)
-diff --git a/cmake/FindACL.cmake b/cmake/FindACL.cmake
-index 1753b0dd3..2d4a3027c 100644
--- a/cmake/FindACL.cmake
-+++ b/cmake/FindACL.cmake
-@@ -8,17 +8,17 @@
- include(LibFindMacros)
- 
- # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(ACL_PKGCONF acl)
-+libfind_pkg_check_modules(ACL_PKGCONF libacl)
- 
- # Include dir
- find_path(ACL_INCLUDE_DIR
-	NAMES acl/libacl.h
-+	NAMES "acl/libacl.h sys/libacl.h"
- 	PATHS ${ACL_PKGCONF_INCLUDE_DIRS}
- )
- 
- # Finally the library itself
- find_library(ACL_LIBRARY
-	NAMES acl
-+	NAMES libacl
- 	PATHS ${ACL_PKGCONF_LIBRARY_DIRS}
- )
- 
--- a/SOURCES/04-oscap-podman-detect-ambiguous-targets.patch
+++ b/SOURCES/04-oscap-podman-detect-ambiguous-targets.patch
@ -1,56 +0,0 @@
-From 532a6c77f388d2e06ec12338df9ea97d955f5edc Mon Sep 17 00:00:00 2001
-From: Matus Marhefka <mmarhefk@redhat.com>
-Date: Thu, 16 Jan 2020 15:39:37 +0100
-Subject: [PATCH] utils/oscap-podman: Detect ambiguous scan target
-
-In case that a container image and a running container have the same
-name, `oscap-podman` scans container image and a running container is
-skipped. This might be unexpected and might cause a confusion for user.
-Therefore, this commit adds a code which detects such situation and
-rather informs user about ambiguous scan target and terminates.
-In such cases the unique container image/container ID should be used
-for specifying the target of the scan.
---
- utils/oscap-podman | 23 ++++++++++++++++++-----
- 1 file changed, 18 insertions(+), 5 deletions(-)
-
-diff --git a/utils/oscap-podman b/utils/oscap-podman
-index 272afd988..32ec0cfcb 100755
--- a/utils/oscap-podman
-+++ b/utils/oscap-podman
-@@ -65,17 +65,30 @@ if grep -q "\-\-remediate" <<< "$@"; then
-     die
- fi
- 
-+IMAGE_NAME=$(podman image exists "$1" \
-+    && podman image inspect --format "{{.Id}} {{.RepoTags}}" "$1")
-+CONTAINER_NAME=$(podman container exists "$1" \
-+    && podman container inspect --format "{{.Id}} {{.Name}}" "$1")
-+
-+if [ -n "$IMAGE_NAME" ] && [ -n "$CONTAINER_NAME" ]; then
-+    echo "Ambiguous target, container image and container with the same name detected: '$1'." >&2
-+    echo "Please rather use an unique ID to specify the target of the scan." >&2
-+    die
-+fi
-+
- # Check if the target of scan is image or container.
- CLEANUP=0
-if podman images | grep -q $1; then
-+if [ -n "$IMAGE_NAME" ]; then
-     ID=$(podman create $1) || die
-    IMG_NAME=$(podman images --format "{{.ID}} ({{.Repository}}:{{.Tag}})" | grep -m1 $1)
-    TARGET="podman-image://$IMG_NAME"
-+    TARGET="podman-image://$IMAGE_NAME"
-     CLEANUP=1
-else
-+elif [ -n "$CONTAINER_NAME" ]; then
-     # If the target was not found in images we suppose it is a container.
-     ID=$1
-    TARGET="podman-container://$1"
-+    TARGET="podman-container://$CONTAINER_NAME"
-+else
-+    echo "Target of the scan not found: '$1'." >&2
-+    die
- fi
- 
- # podman init creates required files such as: /run/.containerenv - we don't care about output and exit code
--- a/SOURCES/openscap-1.3.2-covscan_ux_fix.patch
+++ b/SOURCES/openscap-1.3.2-covscan_ux_fix.patch
@ -1,389 +0,0 @@
-From 47a2662bccb8e6f2f192acf46c26d862fe3bbcfb Mon Sep 17 00:00:00 2001
-From: Evgeny Kolesnikov <ekolesni@redhat.com>
-Date: Fri, 17 Jan 2020 10:24:07 +0100
-Subject: [PATCH 1/2] Covscan fixes
-
-Error: FORWARD_NULL (CWE-476): [#def17]
-xccdf_policy_remediate.c:383: var_compare_op: Comparing "rr" to null implies that "rr" might be null.
-xccdf_policy_remediate.c:384: var_deref_model: Passing null pointer "rr" to "_rule_add_info_message", which dereferences it.
-
-Error: FORWARD_NULL (CWE-476): [#def18]
-test_fsdev_is_local_fs.c:35: assign_zero: Assigning: "ment.mnt_fsname" = "NULL".
-test_fsdev_is_local_fs.c:37: var_deref_model: Passing "&ment" to "is_local_fs", which dereferences null "ment.mnt_fsname".
---
- src/OVAL/probes/fsdev.c                   |  4 ++++
- src/XCCDF_POLICY/xccdf_policy_remediate.c | 12 ++++++++++--
- 2 files changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/src/OVAL/probes/fsdev.c b/src/OVAL/probes/fsdev.c
-index bd8e52fbf..a6b36f5e0 100644
--- a/src/OVAL/probes/fsdev.c
-+++ b/src/OVAL/probes/fsdev.c
-@@ -97,6 +97,10 @@ static int is_local_fs(struct mntent *ment)
- 		return 0;
- 	}
- 
-+	if (ment->mnt_fsname == NULL) {
-+		return 0;
-+	}
-+
- 	s = ment->mnt_fsname;
- 	/* If the fsname begins with "//", it is probably CIFS. */
- 	if (s[0] == '/' && s[1] == '/')
-diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c
-index 389a7d1bd..f59737727 100644
--- a/src/XCCDF_POLICY/xccdf_policy_remediate.c
-+++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c
-@@ -380,7 +380,11 @@ static inline int _xccdf_fix_decode_xml(struct xccdf_fix *fix, char **result)
- #if defined(unix) || defined(__unix__) || defined(__unix)
- static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_fix *fix)
- {
-	if (fix == NULL || rr == NULL || oscap_streq(xccdf_fix_get_content(fix), NULL)) {
-+	if (rr == NULL) {
-+		return 1;
-+	}
-+
-+	if (fix == NULL || oscap_streq(xccdf_fix_get_content(fix), NULL)) {
- 		_rule_add_info_message(rr, "No fix available.");
- 		return 1;
- 	}
-@@ -481,7 +485,11 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_
- #else
- static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_fix *fix)
- {
-	if (fix == NULL || rr == NULL || oscap_streq(xccdf_fix_get_content(fix), NULL)) {
-+	if (rr == NULL) {
-+		return 1;
-+	}
-+
-+	if (fix == NULL || oscap_streq(xccdf_fix_get_content(fix), NULL)) {
- 		_rule_add_info_message(rr, "No fix available.");
- 		return 1;
- 	} else {
-
-From 7bccc09eabd30e0581cf0fdf4f20fa481db12e91 Mon Sep 17 00:00:00 2001
-From: Evgeny Kolesnikov <ekolesni@redhat.com>
-Date: Fri, 17 Jan 2020 11:04:13 +0100
-Subject: [PATCH 2/2] Covscan fixes (SHELLCHECK), small refactoring in Shell
- wrappers
-
-Error: SHELLCHECK_WARNING:
-warning: die references arguments, but none are ever passed. [SC2120]
-
-Error: SHELLCHECK_WARNING:
-warning: Use 'cd ... || exit' or 'cd ... || return' in case cd fails. [SC2164]
-
-Error: SHELLCHECK_WARNING:
-warning: Declare and assign separately to avoid masking return values. [SC2155]
---
- utils/oscap-chroot | 20 ++++++++++++--------
- utils/oscap-podman | 42 +++++++++++++++++++++---------------------
- utils/oscap-ssh    | 39 ++++++++++++++++++++++-----------------
- utils/oscap-vm     | 19 +++++++++++--------
- 4 files changed, 66 insertions(+), 54 deletions(-)
-
-diff --git a/utils/oscap-chroot b/utils/oscap-chroot
-index 6518d7a2c..318f55a91 100755
--- a/utils/oscap-chroot
-+++ b/utils/oscap-chroot
-@@ -25,6 +25,13 @@ function die()
-     exit 1
- }
- 
-+function invalid()
-+{
-+    echo -e "$*\n" >&2
-+    usage
-+    exit 1
-+}
-+
- function usage()
- {
-     echo "oscap-chroot -- Tool for offline SCAP evaluation of filesystems mounted in arbitrary paths."
-@@ -74,26 +81,23 @@ function usage()
- }
- 
- if [ $# -lt 1 ]; then
-    echo "No arguments provided."
-    usage
-    die
-+    invalid "No arguments provided."
- elif [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
-     usage
-    die
-+    exit 0
- elif [ "$#" -gt 1 ]; then
-     true
- else
-    echo "Invalid arguments provided."
-    usage
-    die
-+    invalid "Invalid arguments provided."
- fi
- 
- # Learn more at https://www.redhat.com/archives/open-scap-list/2013-July/msg00000.html
- export OSCAP_PROBE_ROOT
-OSCAP_PROBE_ROOT="$(cd "$1"; pwd)"
-+OSCAP_PROBE_ROOT="$(cd "$1" && pwd)" || die "Invalid CHROOT_PATH argument."
- export OSCAP_EVALUATION_TARGET="chroot://$OSCAP_PROBE_ROOT"
- shift 1
- 
- oscap "$@"
- EXIT_CODE=$?
-+
- exit $EXIT_CODE
-diff --git a/utils/oscap-podman b/utils/oscap-podman
-index 32ec0cfcb..6b9f4a3de 100755
--- a/utils/oscap-podman
-+++ b/utils/oscap-podman
-@@ -16,13 +16,19 @@
- # License along with this library; if not, write to the Free Software
- # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- 
-
- function die()
- {
-     echo "$*" >&2
-     exit 1
- }
- 
-+function invalid()
-+{
-+    echo -e "$*\n" >&2
-+    usage
-+    exit 1
-+}
-+
- function usage()
- {
-     echo "oscap-podman -- Tool for SCAP evaluation of Podman images and containers."
-@@ -39,30 +45,24 @@ function usage()
- OSCAP_BINARY=oscap
- 
- if [ $# -lt 1 ]; then
-    echo "No arguments provided."
-    usage
-    die
-+    invalid "No arguments provided."
- elif [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
-     usage
-    die
-+    exit 0
- elif [[ "$1" == --oscap=* ]] && [ $# -gt 2 ]; then
-     OSCAP_BINARY=${1#"--oscap="}
-     shift
- elif [ "$#" -gt 1 ]; then
-     true
- else
-    echo "Invalid arguments provided."
-    usage
-    die
-+    invalid "Invalid arguments provided."
- fi
- 
- if [ $(id -u) -ne 0 ]; then
-    echo "This script cannot run in rootless mode." >&2
-    die
-+    die "This script cannot run in rootless mode."
- fi
- if grep -q "\-\-remediate" <<< "$@"; then
-    echo "This script does not support '--remediate' option." >&2
-    die
-+    die "This script does not support '--remediate' option."
- fi
- 
- IMAGE_NAME=$(podman image exists "$1" \
-@@ -72,14 +72,13 @@ CONTAINER_NAME=$(podman container exists "$1" \
- 
- if [ -n "$IMAGE_NAME" ] && [ -n "$CONTAINER_NAME" ]; then
-     echo "Ambiguous target, container image and container with the same name detected: '$1'." >&2
-    echo "Please rather use an unique ID to specify the target of the scan." >&2
-    die
-+    die  "Please rather use an unique ID to specify the target of the scan."
- fi
- 
- # Check if the target of scan is image or container.
- CLEANUP=0
- if [ -n "$IMAGE_NAME" ]; then
-    ID=$(podman create $1) || die
-+    ID=$(podman create $1) || die "Unable to create a container."
-     TARGET="podman-image://$IMAGE_NAME"
-     CLEANUP=1
- elif [ -n "$CONTAINER_NAME" ]; then
-@@ -87,14 +86,13 @@ elif [ -n "$CONTAINER_NAME" ]; then
-     ID=$1
-     TARGET="podman-container://$CONTAINER_NAME"
- else
-    echo "Target of the scan not found: '$1'." >&2
-    die
-+    die "Target of the scan not found: '$1'."
- fi
- 
- # podman init creates required files such as: /run/.containerenv - we don't care about output and exit code
- podman init $ID &> /dev/null || true
- 
-DIR=$(podman mount $ID) || die
-+DIR=$(podman mount $ID) || die "Failed to mount."
- 
- if [ ! -f "$DIR/run/.containerenv" ]; then
-     # ubi8-init image does not create .containerenv when running podman init, but we need to make sure that the file is there
-@@ -105,14 +103,16 @@ for VAR in `podman inspect $ID --format '{{join .Config.Env " "}}'`; do
-     eval "export OSCAP_OFFLINE_$VAR"
- done
- 
-export OSCAP_PROBE_ROOT="$(cd "$DIR"; pwd)"
-+export OSCAP_PROBE_ROOT
-+OSCAP_PROBE_ROOT="$(cd "$DIR" && pwd)" || die "Unable to change current directory to OSCAP_PROBE_ROOT (DIR)."
- export OSCAP_EVALUATION_TARGET="$TARGET"
- shift 1
- 
- $OSCAP_BINARY "$@"
- EXIT_CODE=$?
-podman umount $ID > /dev/null || die
-+
-+podman umount $ID > /dev/null || die "Failed to unmount."
- if [ $CLEANUP -eq 1 ]; then
-    podman rm $ID > /dev/null || die
-+    podman rm $ID > /dev/null || die "Failed to clean up."
- fi
- exit $EXIT_CODE
-diff --git a/utils/oscap-ssh b/utils/oscap-ssh
-index 08c8bcd2b..cd3600180 100755
--- a/utils/oscap-ssh
-+++ b/utils/oscap-ssh
-@@ -22,9 +22,12 @@ function die()
-     exit 1
- }
- 
-hash ssh 2> /dev/null || die "Cannot find ssh, please install the OpenSSH client."
-hash scp 2> /dev/null || die "Cannot find scp, please install the OpenSSH client."
-hash mktemp 2> /dev/null || die "Cannot find mktemp, please install coreutils."
-+function invalid()
-+{
-+    echo -e "$*\n" >&2
-+    usage
-+    exit 1
-+}
- 
- function usage()
- {
-@@ -87,10 +90,6 @@ function usage()
-     echo "See \`man oscap\` to learn more about semantics of these options."
- }
- 
-OSCAP_SUDO=""
-# SSH_ADDITIONAL_OPTIONS may be defined in the calling shell
-SSH_TTY_ALLOCATION_OPTION=""
-
- # $1, $2, ... SSH options (pass them as separate arguments)
- function ssh_execute_with_options {
-     ssh -o ControlPath="$MASTER_SOCKET" $SSH_ADDITIONAL_OPTIONS "$@" -p "$SSH_PORT" "$SSH_HOST"
-@@ -118,22 +117,20 @@ function scp_retreive_from_temp_dir {
- # Returns: String, where individual command components are double-quoted, so they are not interpreted by the shell.
- #  For example, an array ('-p' '(all)') will be transformed to "\"-p\" \"(all)\"", so after the shell expansion, it will end up as "-p" "(all)".
- function command_array_to_string {
-	eval "printf '\"%s\" ' \"\${$1[@]}\""
-+    eval "printf '\"%s\" ' \"\${$1[@]}\""
- }
- 
- function first_argument_is_sudo {
-	[ "$1" == "sudo" ] || [ "$1" == "--sudo" ]
-	return $?
-+    [ "$1" == "sudo" ] || [ "$1" == "--sudo" ]
-+    return $?
- }
- 
- function sanity_check_arguments {
-     if [ $# -lt 1 ]; then
-        echo "No arguments provided."
-        usage
-        die
-+        invalid "No arguments provided."
-     elif [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
-         usage
-        die
-+        exit 0
-     elif first_argument_is_sudo "$@"; then
-         OSCAP_SUDO="sudo"
-         # force pseudo-tty allocation so that users can type their password if necessary
-@@ -141,9 +138,7 @@ function sanity_check_arguments {
-         shift
-     fi
-     if [ $# -lt 2 ]; then
-        echo "Missing ssh host and ssh port."
-        usage
-        die
-+        invalid "Missing ssh host and ssh port."
-     fi
- }
- 
-@@ -165,6 +160,16 @@ function check_oscap_arguments {
-     fi
- }
- 
-+
-+hash ssh 2> /dev/null || die "Cannot find ssh, please install the OpenSSH client."
-+hash scp 2> /dev/null || die "Cannot find scp, please install the OpenSSH client."
-+hash mktemp 2> /dev/null || die "Cannot find mktemp, please install coreutils."
-+
-+
-+OSCAP_SUDO=""
-+# SSH_ADDITIONAL_OPTIONS may be defined in the calling shell
-+SSH_TTY_ALLOCATION_OPTION=""
-+
- sanity_check_arguments "$@"
- first_argument_is_sudo "$@" && shift
- 
-diff --git a/utils/oscap-vm b/utils/oscap-vm
-index 02f8c6396..6557eb3a7 100755
--- a/utils/oscap-vm
-+++ b/utils/oscap-vm
-@@ -22,6 +22,13 @@ function die()
-     exit 1
- }
- 
-+function invalid()
-+{
-+    echo -e "$*\n" >&2
-+    usage
-+    exit 1
-+}
-+
- function usage()
- {
-     echo "oscap-vm -- Tool for offline SCAP evaluation of virtual machines."
-@@ -76,12 +83,10 @@ function usage()
- OSCAP_BINARY=oscap
- 
- if [ $# -lt 1 ]; then
-    echo "No arguments provided."
-    usage
-    die
-+    invalid "No arguments provided."
- elif [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
-     usage
-    die
-+    exit 0
- elif [[ "$1" == --oscap=* ]] && [ $# -gt 3 ]; then
-     OSCAP_BINARY=${1#"--oscap="}
-     shift
-@@ -90,9 +95,7 @@ elif [ "$1" == "image" ] && [ $# -gt 2 ]; then
- elif [ "$1" == "domain" ] && [ $# -gt 2 ]; then
-     true
- else
-    echo "Invalid arguments provided."
-    usage
-    die
-+    invalid "Invalid arguments provided."
- fi
- 
- hash guestmount 2> /dev/null || die "Cannot find guestmount, please install libguestfs utilities."
-@@ -128,7 +131,7 @@ fi
- 
- # Learn more at https://www.redhat.com/archives/open-scap-list/2013-July/msg00000.html
- export OSCAP_PROBE_ROOT
-OSCAP_PROBE_ROOT="$(cd "$MOUNTPOINT"; pwd)"
-+OSCAP_PROBE_ROOT="$(cd "$MOUNTPOINT" && pwd)" || die "Unable to change current directory to OSCAP_PROBE_ROOT (MOUNTPOINT)."
- export OSCAP_EVALUATION_TARGET="oscap-vm $1 $2"
- shift 2
- 
--- a/SOURCES/openscap-1.3.3-fix-cmake-findacl.patch
+++ b/SOURCES/openscap-1.3.3-fix-cmake-findacl.patch
@ -1,45 +0,0 @@
-From 4982aa3da7ae00cd3656db7f47ac3706e85ab7d4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 23 Jan 2020 16:24:37 +0100
-Subject: [PATCH] Fix FindACL.cmake
-
-find_path parameter `NAMES` values should be separated. According to
-https://cmake.org/cmake/help/latest/command/find_path.html it should be:
-`NAMES name1 [name2 ...]`
-
-find_library parameter `NAMES` either should not contain `lib` or should
-contain both `lib` and `.so.` The documentation at
-https://cmake.org/cmake/help/latest/command/find_library.html says: Each
-library name given to the `NAMES` option is first considered as a
-library file name and then considered with platform-specific prefixes
-(e.g. `lib`) and suffixes (e.g. `.so`).
-
-This bug caused that even if cmake reported that libacl was found, the
-library wasn't linked to the built `libopenscap.so`. Also,
-`HAVE_ACL_EXTENDED_FILE`, `HAVE_ACL_LIBACL_H` and `HAVE_SYS_ACL_H` were
-undefined in `config.h`, which caused some guarded pieces of code to not
-compile, which means features missing.
---
- cmake/FindACL.cmake | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/cmake/FindACL.cmake b/cmake/FindACL.cmake
-index 2d4a3027c..a41f2c13a 100644
--- a/cmake/FindACL.cmake
-+++ b/cmake/FindACL.cmake
-@@ -12,13 +12,13 @@ libfind_pkg_check_modules(ACL_PKGCONF libacl)
- 
- # Include dir
- find_path(ACL_INCLUDE_DIR
-	NAMES "acl/libacl.h sys/libacl.h"
-+	NAMES "acl/libacl.h" "sys/libacl.h"
- 	PATHS ${ACL_PKGCONF_INCLUDE_DIRS}
- )
- 
- # Finally the library itself
- find_library(ACL_LIBRARY
-	NAMES libacl
-+	NAMES acl
- 	PATHS ${ACL_PKGCONF_LIBRARY_DIRS}
- )
- 
--- a/SOURCES/openscap-1.3.4-add_compression_support-PR_1557.patch
+++ b/SOURCES/openscap-1.3.4-add_compression_support-PR_1557.patch
@ -0,0 +1,70 @@
+From d8518b70b912aa55fc47400173bf6229e40b71d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C5=A0imon=20Luka=C5=A1=C3=ADk?= <isimluk@fedoraproject.org>
+Date: Wed, 8 Jul 2020 15:17:31 +0200
+Subject: [PATCH] Make a use of HTTP header content-encoding: gzip if available
+
+When fetching remote resources, some servers/CDNs may be able to serve us
+compressed http response even in cases when the original file is not compressed
+XML. libcurl is able to process encoded html for us with no added maintenance
+costs.
+
+Attached please find a CURL log of fetching plain XML file from Red Hat CDN:
+
+Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml
+...
+*   Trying 104.90.105.254:443...
+* Connected to www.redhat.com (104.90.105.254) port 443 (#0)
+* ALPN, offering h2
+* ALPN, offering http/1.1
+* successfully set certificate verify locations:
+*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
+  CApath: none
+* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
+* ALPN, server accepted to use h2
+* Server certificate:
+*  subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=Delaware; serialNumber=2945436; C=US; ST=North Carolina; L=Raleigh; O=Red Hat, Inc.; CN=www.redhat.com
+*  start date: Feb 24 00:00:00 2020 GMT
+*  expire date: May 24 12:00:00 2022 GMT
+*  subjectAltName: host "www.redhat.com" matched cert's "www.redhat.com"
+*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
+*  SSL certificate verify ok.
+* Using HTTP2, server supports multi-use
+* Connection state changed (HTTP/2 confirmed)
+* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
+* Using Stream ID: 1 (easy handle 0x776c3b0)
+> GET /security/data/oval/com.redhat.rhsa-RHEL7.xml HTTP/2
+Host: www.redhat.com
+accept: */*
+accept-encoding: gzip
+
+* old SSL session ID is stale, removing
+* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
+< HTTP/2 200
+< server: Apache
+< last-modified: Wed, 08 Jul 2020 12:41:28 GMT
+< etag: "7f694279-fca5e0-5a9ed6d376a08"
+< accept-ranges: bytes
+< content-type: text/xml
+< content-encoding: gzip
+< content-length: 1766376
+< date: Wed, 08 Jul 2020 13:15:29 GMT
+< vary: Accept-Encoding
+< strict-transport-security: max-age=31536000
+<
+* Connection #0 to host www.redhat.com left intact
+---
+ src/common/oscap_acquire.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/common/oscap_acquire.c b/src/common/oscap_acquire.c
+index 60ab62c05..551da43f0 100644
+--- a/src/common/oscap_acquire.c
+++ b/src/common/oscap_acquire.c
+@@ -302,6 +302,7 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size)
+ 	curl_easy_setopt(curl, CURLOPT_URL, url);
+ 	curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory_callback);
+ 	curl_easy_setopt(curl, CURLOPT_WRITEDATA, buffer);
+	curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+ 	curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, true);
+ 
+ 	CURLcode res = curl_easy_perform(curl);
--- a/SOURCES/openscap-1.3.4-add_compression_test-PR_1564.patch
+++ b/SOURCES/openscap-1.3.4-add_compression_test-PR_1564.patch
@ -0,0 +1,168 @@
+From 12ccadd9f9cd30143b3af6feced58f8da636e9d2 Mon Sep 17 00:00:00 2001
+From: Evgeny Kolesnikov <ekolesni@redhat.com>
+Date: Mon, 20 Jul 2020 07:45:05 +0200
+Subject: [PATCH] Add test for cURL "Accept-Encoding" header
+
+---
+ tests/CMakeLists.txt             |  1 +
+ tests/curl/CMakeLists.txt        |  1 +
+ tests/curl/ds.xml                | 99 ++++++++++++++++++++++++++++++++
+ tests/curl/test_curl_encoding.sh | 23 ++++++++
+ 4 files changed, 124 insertions(+)
+ create mode 100644 tests/curl/CMakeLists.txt
+ create mode 100644 tests/curl/ds.xml
+ create mode 100755 tests/curl/test_curl_encoding.sh
+
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index b7ca6cd79..6948cd260 100644
+--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
+@@ -26,6 +26,7 @@ add_subdirectory("API")
+ add_subdirectory("bindings")
+ add_subdirectory("bz2")
+ add_subdirectory("codestyle")
+add_subdirectory("curl")
+ add_subdirectory("CPE")
+ add_subdirectory("DS")
+ add_subdirectory("mitre")
+diff --git a/tests/curl/CMakeLists.txt b/tests/curl/CMakeLists.txt
+new file mode 100644
+index 000000000..9c3d90d74
+--- /dev/null
+++ b/tests/curl/CMakeLists.txt
+@@ -0,0 +1 @@
+add_oscap_test("test_curl_encoding.sh")
+diff --git a/tests/curl/ds.xml b/tests/curl/ds.xml
+new file mode 100644
+index 000000000..f33cb475d
+--- /dev/null
+++ b/tests/curl/ds.xml
+@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_test_single_rule.xccdf.xml" schematron-version="1.3">
+<ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_test_single_rule.xccdf.xml" scap-version="1.3" use-case="OTHER">
+  <ds:checklists>
+    <ds:component-ref id="scap_org.open-scap_cref_test_single_rule.xccdf.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.xccdf.xml">
+      <cat:catalog>
+        <cat:uri name="test_single_rule.oval.xml" uri="#scap_org.open-scap_cref_test_single_rule.oval.xml"/>
+        <cat:uri name="security-data-oval.xml.bz2" uri="#scap_org.open-scap_cref_security-data-oval.xml.bz2"/>
+      </cat:catalog>
+    </ds:component-ref>
+  </ds:checklists>
+  <ds:checks>
+    <ds:component-ref id="scap_org.open-scap_cref_test_single_rule.oval.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.oval.xml"/>
+<!--
+    <ds:component-ref id="scap_org.open-scap_cref_security-data-oval.xml.bz2" xlink:href="https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml"/>
+-->
+    <ds:component-ref id="scap_org.open-scap_cref_security-data-oval.xml.bz2" xlink:href="https://github.com/"/>
+  </ds:checks>
+</ds:data-stream>
+
+<ds:component id="scap_org.open-scap_comp_test_single_rule.oval.xml" timestamp="2017-06-09T07:07:38">
+<oval_definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd    http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd">
+  <generator>
+    <oval:schema_version>5.11</oval:schema_version>
+    <oval:timestamp>2009-01-12T10:41:00-05:00</oval:timestamp>
+  </generator>
+
+  <definitions>
+    <definition class="compliance" id="oval:test-pass:def:1" version="1">
+      <metadata>
+        <title>PASS</title>
+        <description>pass</description>
+      </metadata>
+      <criteria>
+        <criterion comment="PASS test" test_ref="oval:x:tst:1"/>
+      </criteria>
+    </definition>
+  </definitions>
+
+    <tests>
+    <variable_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:tst:1" check="all" comment="always pass" version="1">
+      <object object_ref="oval:x:obj:1"/>
+    </variable_test>
+    </tests>
+
+    <objects>
+    <variable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:obj:1" version="1" comment="x">
+      <var_ref>oval:x:var:1</var_ref>
+    </variable_object>
+    </objects>
+
+    <variables>
+      <constant_variable id="oval:x:var:1" version="1" comment="x" datatype="int">
+        <value>100</value>
+      </constant_variable>
+    </variables>
+
+</oval_definitions>
+</ds:component>
+
+<ds:component id="scap_org.open-scap_comp_test_single_rule.xccdf.xml" timestamp="2017-06-09T09:15:45">
+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_com.example.www_benchmark_dummy" xml:lang="en-US">
+  <status>accepted</status>
+  <version>1.0</version>
+
+  <Profile id="xccdf_com.example.www_profile_test_remote_res">
+    <title>xccdf_test_profile</title>
+    <description>This profile is for testing.</description>
+    <select idref="xccdf_com.example.www_rule_test-pass" selected="true"/>
+    <select idref="xccdf_com.example.www_rule_test-remote_res" selected="true"/>
+  </Profile>
+
+  <Value id="xccdf_com.example.www_value_val1" type="number" operator="equals" interactive="0">
+    <title>test value</title>
+    <description>foo</description>
+    <value selector="bar_1">50</value>
+    <value selector="bar_2">100</value>
+  </Value>
+  <Rule selected="true" id="xccdf_com.example.www_rule_test-pass">
+    <title>This rule always pass</title>
+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+      <check-content-ref href="test_single_rule.oval.xml" name="oval:test-pass:def:1"/>
+    </check>
+  </Rule>
+  <Rule selected="true" id="xccdf_com.example.www_rule_test-remote_res">
+    <title>This rule checks remote resource</title>
+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" multi-check="true">
+      <check-content-ref href="security-data-oval.xml.bz2"/>
+    </check>
+  </Rule>
+  <Rule selected="true" id="xccdf_com.example.www_rule_test-pass2">
+    <title>This rule always pass</title>
+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+      <check-content-ref href="test_single_rule.oval.xml" name="oval:test-pass:def:1"/>
+    </check>
+  </Rule>
+</Benchmark>
+</ds:component>
+</ds:data-stream-collection>
+diff --git a/tests/curl/test_curl_encoding.sh b/tests/curl/test_curl_encoding.sh
+new file mode 100755
+index 000000000..6d82f9569
+--- /dev/null
+++ b/tests/curl/test_curl_encoding.sh
+@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -e -o pipefail
+
+. $builddir/tests/test_common.sh
+
+function curl_accept_encoding {
+	local DF="${srcdir}/ds.xml"
+	local RF="results.xml"
+	local LOG="verbose.log"
+
+	$OSCAP xccdf --verbose=DEVEL eval --fetch-remote-resources --results $RF $DF 2>$LOG || echo "OK"
+
+	grep -P "Accept-Encoding.*gzip" $LOG
+
+	return 0
+}
+
+test_init
+
+test_run "cURL: Accept-Encoding" curl_accept_encoding
+
+test_exit
--- a/SOURCES/openscap-1.3.4-add_compression_tracing-PR_1561.patch
+++ b/SOURCES/openscap-1.3.4-add_compression_tracing-PR_1561.patch
@ -0,0 +1,76 @@
+From aab536acdd4b08e2e8c3d4ac43981dfcaf1cc9f8 Mon Sep 17 00:00:00 2001
+From: Evgeny Kolesnikov <ekolesni@redhat.com>
+Date: Mon, 13 Jul 2020 14:09:52 +0200
+Subject: [PATCH] Add CURLOPT_TRANSFER_ENCODING, enable CURLOPT_VERBOSE with
+ CURLOPT_DEBUGFUNCTION
+
+Adds a request for compressed Transfer Encoding in the outgoing
+HTTP request. If the server supports this and so desires, it can
+respond with the HTTP response sent using a compressed
+Transfer-Encoding that will be automatically uncompressed by
+libcurl on reception.
+
+The CURLOPT_DEBUGFUNCTION callback is used for printing headers and
+connection information on VERBOSE level (dD).
+---
+ src/common/oscap_acquire.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/src/common/oscap_acquire.c b/src/common/oscap_acquire.c
+index 551da43f0..666f4f5c9 100644
+--- a/src/common/oscap_acquire.c
+++ b/src/common/oscap_acquire.c
+@@ -49,6 +49,7 @@
+ #include "common/_error.h"
+ #include "oscap_string.h"
+ #include "oscap_helpers.h"
+#include "debug_priv.h"
+ 
+ #ifndef OSCAP_TEMP_DIR
+ #define OSCAP_TEMP_DIR "/tmp"
+@@ -288,6 +289,34 @@ oscap_acquire_url_to_filename(const char *url)
+ 	return filename;
+ }
+ 
+static int _curl_trace(CURL *handle, curl_infotype type, char *data, size_t size, void *userp)
+{
+	const char *title;
+
+	switch (type) {
+	case CURLINFO_TEXT:
+		title = "== cURL info";
+		break;
+	case CURLINFO_HEADER_OUT:
+		title = "=> cURL header (out)";
+		break;
+	case CURLINFO_HEADER_IN:
+		title = "<= cURL header (in)";
+		break;
+	case CURLINFO_DATA_OUT:
+	case CURLINFO_SSL_DATA_OUT:
+	case CURLINFO_DATA_IN:
+	case CURLINFO_SSL_DATA_IN:
+	default:
+		return 0;
+		break;
+	}
+
+	dD("%s: %s", title, data);
+
+	return 0;
+}
+
+ char* oscap_acquire_url_download(const char *url, size_t* memory_size)
+ {
+ 	CURL *curl;
+@@ -303,7 +332,10 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size)
+ 	curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory_callback);
+ 	curl_easy_setopt(curl, CURLOPT_WRITEDATA, buffer);
+ 	curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+	curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, true);
+ 	curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, true);
+	curl_easy_setopt(curl, CURLOPT_VERBOSE, true);
+	curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, _curl_trace);
+ 
+ 	CURLcode res = curl_easy_perform(curl);
+ 	curl_easy_cleanup(curl);
--- a/SOURCES/openscap-1.3.4-detect_remote_file_systems-PR_1573.patch
+++ b/SOURCES/openscap-1.3.4-detect_remote_file_systems-PR_1573.patch
@ -0,0 +1,94 @@
+diff --git a/src/OVAL/probes/fsdev.c b/src/OVAL/probes/fsdev.c
+index 82356d5e0..983675098 100644
+--- a/src/OVAL/probes/fsdev.c
+++ b/src/OVAL/probes/fsdev.c
+@@ -62,6 +62,7 @@
+ #endif
+ 
+ #include "fsdev.h"
+#include "common/util.h"
+ 
+ /**
+  * Compare two dev_t variables.
+@@ -79,10 +80,6 @@ static int fsdev_cmp(const void *a, const void *b)
+ #if defined(OS_LINUX)
+ static int is_local_fs(struct mntent *ment)
+ {
+-// todo: would it be usefull to provide the choice during build-time?
+-#if 1
+-	char *s;
+-
+ 	/*
+ 	 * When type of the filesystem is autofs, it means the mtab entry
+ 	 * describes the autofs configuration, which means ment->mnt_fsname
+@@ -97,37 +94,42 @@ static int is_local_fs(struct mntent *ment)
+ 		return 0;
+ 	}
+ 
+-	if (ment->mnt_fsname == NULL) {
+-		return 0;
+-	}
+-
+-	s = ment->mnt_fsname;
+-	/* If the fsname begins with "//", it is probably CIFS. */
+-	if (s[0] == '/' && s[1] == '/')
+-		return 0;
+-
+-	/* If there's a ':' in the fsname and it occurs before any
+-	 * '/', then this is probably NFS and the file system is
+-	 * considered "remote".
+	/*
+	 * The following code is inspired by systemd, function fstype_is_network:
+	 * https://github.com/systemd/systemd/blob/21fd6bc263f49b57867d90d2e1f9f255e5509134/src/basic/mountpoint-util.c#L290
+ 	 */
+-	s = strpbrk(s, "/:");
+-	if (s && *s == ':')
+-		return 0;
+ 
+	const char *fstype = ment->mnt_type;
+	if (oscap_str_startswith(fstype, "fuse.")) {
+		fstype += strlen("fuse.");
+	}
+	const char *network_fs[] = {
+		"afs",
+		"ceph",
+		"cifs",
+		"smb3",
+		"smbfs",
+		"sshfs",
+		"ncpfs",
+		"ncp",
+		"nfs",
+		"nfs4",
+		"gfs",
+		"gfs2",
+		"glusterfs",
+		"gpfs",
+		"pvfs2", /* OrangeFS */
+		"ocfs2",
+		"lustre",
+		"davfs",
+		NULL
+	};
+	for (int i = 0; network_fs[i]; i++) {
+		if (!strcmp(network_fs[i], fstype)) {
+			return 0;
+		}
+	}
+ 	return 1;
+-#else
+-	struct stat st;
+-
+-	/* If the file system is not backed-up by a real file, it is
+-	   considered remote. A notable exception is "tmpfs" to allow
+-	   traversal of /tmp et al. */
+-	if (strcmp(ment->mnt_fsname, "tmpfs") != 0
+-	    && (stat(ment->mnt_fsname, &st) != 0
+-		|| !(S_ISBLK(st.st_mode))))
+-		return 0;
+-	else
+-		return 1;
+-#endif
+ }
+ 
+ #elif defined(OS_AIX)
--- a/SOURCES/openscap-1.3.4-fix-environmentvariable58-regression.patch
+++ b/SOURCES/openscap-1.3.4-fix-environmentvariable58-regression.patch
@ -0,0 +1,59 @@
+diff --git a/src/OVAL/probes/independent/environmentvariable58_probe.c b/src/OVAL/probes/independent/environmentvariable58_probe.c
+index 552ce6700..77233aeeb 100644
+--- a/src/OVAL/probes/independent/environmentvariable58_probe.c
+++ b/src/OVAL/probes/independent/environmentvariable58_probe.c
+@@ -96,32 +96,32 @@ static int read_environment(SEXP_t *pid_ent, SEXP_t *name_ent, probe_ctx *ctx)
+ 	ssize_t buffer_used;
+ 	size_t buffer_size;
+ 
+	const char *extra_vars = getenv("OSCAP_CONTAINER_VARS");
+	if (extra_vars && *extra_vars) {
+		char *vars = strdup(extra_vars);
+		char *tok, *eq_chr, *str, *strp;
+
+		for (str = vars; ; str = NULL) {
+			tok = strtok_r(str, "\n", &strp);
+			if (tok == NULL)
+				break;
+			eq_chr = strchr(tok, '=');
+			if (eq_chr == NULL)
+				continue;
+			PROBE_ENT_I32VAL(pid_ent, pid, pid = -1;, pid = 0;);
+			collect_variable(tok, eq_chr - tok, pid, name_ent, ctx);
+		}
+
+		free(vars);
+		return 0;
+	}
+
+ 	const char *prefix = getenv("OSCAP_PROBE_ROOT");
+ 	snprintf(path, PATH_MAX, "%s/proc", prefix ? prefix : "");
+ 	d = opendir(path);
+ 	if (d == NULL) {
+-		const char *extra_vars = getenv("OSCAP_CONTAINER_VARS");
+-		if (!extra_vars) {
+-			dE("Can't read %s/proc: errno=%d, %s.", prefix ? prefix : "", errno, strerror(errno));
+-			return PROBE_EACCESS;
+-		} else {
+-			char *vars = strdup(extra_vars);
+-			char *tok, *eq_chr, *str, *strp;
+-
+-			for (str = vars; ; str = NULL) {
+-				tok = strtok_r(str, "\n", &strp);
+-				if (tok == NULL)
+-					break;
+-				eq_chr = strchr(tok, '=');
+-				if (eq_chr == NULL)
+-					continue;
+-				PROBE_ENT_I32VAL(pid_ent, pid, pid = -1;, pid = 0;);
+-				collect_variable(tok, eq_chr - tok, pid, name_ent, ctx);
+-			}
+-
+-			free(vars);
+-			return 0;
+-		}
+		dE("Can't read %s/proc: errno=%d, %s.", prefix ? prefix : "", errno, strerror(errno));
+		return PROBE_EACCESS;
+ 	}
+ 
+ 	if ((buffer = realloc(NULL, BUFFER_SIZE)) == NULL) {
--- a/SOURCES/openscap-1.3.4-fix-no-more-recursion.patch
+++ b/SOURCES/openscap-1.3.4-fix-no-more-recursion.patch
@ -0,0 +1,177 @@
+From c8fc880a672afbfdbd384dc6afa4b7fbdd666b73 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Wed, 27 May 2020 10:38:56 +0200
+Subject: [PATCH 1/3] Add a regression test for RHBZ#1686370
+
+There is a non-optimal behavior of file probe. It happens when file path
+is specified using a variable with 2 values with `operation="equals"`
+and `var_check="all"`. The probe recurses into a file system tree even
+if it's obvious that it won't find any match. If one of values is a big
+tree (for example `/`) it eventually runs out of memory and crashes. The
+OVAL doesn't make sense because it's impossible that a single file would
+have 2 different paths. But despite that it's a valid OVAL document.
+The test is expected to fail because the bug hasn't been fixed.
+---
+ tests/probes/file/CMakeLists.txt              |  1 +
+ .../test_probes_file_multiple_file_paths.sh   | 39 +++++++++++++++++
+ .../test_probes_file_multiple_file_paths.xml  | 42 +++++++++++++++++++
+ 3 files changed, 82 insertions(+)
+ create mode 100755 tests/probes/file/test_probes_file_multiple_file_paths.sh
+ create mode 100644 tests/probes/file/test_probes_file_multiple_file_paths.xml
+
+diff --git a/tests/probes/file/CMakeLists.txt b/tests/probes/file/CMakeLists.txt
+index 12718603f..35b4c1169 100644
+--- a/tests/probes/file/CMakeLists.txt
+++ b/tests/probes/file/CMakeLists.txt
+@@ -1,3 +1,4 @@
+ if(ENABLE_PROBES_UNIX)
+ 	add_oscap_test("test_probes_file.sh")
+	add_oscap_test("test_probes_file_multiple_file_paths.sh")
+ endif()
+diff --git a/tests/probes/file/test_probes_file_multiple_file_paths.sh b/tests/probes/file/test_probes_file_multiple_file_paths.sh
+new file mode 100755
+index 000000000..1cececbb0
+--- /dev/null
+++ b/tests/probes/file/test_probes_file_multiple_file_paths.sh
+@@ -0,0 +1,39 @@
+#!/bin/bash
+
+set -e -o pipefail
+
+. $builddir/tests/test_common.sh
+
+probecheck "file" || exit 255
+which strace || exit 255
+
+function check_strace_output {
+	strace_log="$1"
+	grep -q "/tmp/numbers/1" $strace_log && return 1
+	grep -q "/tmp/numbers/1/2" $strace_log && return 1
+	grep -q "/tmp/numbers/1/2/3" $strace_log && return 1
+	grep -q "/tmp/numbers/1/2/3/4" $strace_log && return 1
+	grep -q "/tmp/numbers/1/2/3/4/5" $strace_log && return 1
+	grep -q "/tmp/numbers/1/2/3/4/5/6" $strace_log && return 1
+	grep -q "/tmp/letters/a" $strace_log && return 1
+	grep -q "/tmp/letters/a/b" $strace_log && return 1
+	grep -q "/tmp/letters/a/b/c" $strace_log && return 1
+	grep -q "/tmp/letters/a/b/c/d" $strace_log && return 1
+	grep -q "/tmp/letters/a/b/c/d/e" $strace_log && return 1
+	grep -q "/tmp/letters/a/b/c/d/e/f" $strace_log && return 1
+	return 0
+}
+
+rm -rf /tmp/numbers
+mkdir -p /tmp/numbers/1/2/3/4/5/6
+rm -rf /tmp/letters
+mkdir -p /tmp/letters/a/b/c/d/e/f
+strace_log=$(mktemp)
+strace -f -e openat -o $strace_log $OSCAP oval eval --results results.xml "$srcdir/test_probes_file_multiple_file_paths.xml"
+ret=0
+check_strace_output $strace_log || ret=$?
+rm -f $strace_log
+rm -f results.xml
+rm -rf /tmp/numbers
+rm -rf /tmp/letters
+exit $ret
+diff --git a/tests/probes/file/test_probes_file_multiple_file_paths.xml b/tests/probes/file/test_probes_file_multiple_file_paths.xml
+new file mode 100644
+index 000000000..893a3fe97
+--- /dev/null
+++ b/tests/probes/file/test_probes_file_multiple_file_paths.xml
+@@ -0,0 +1,42 @@
+<?xml version="1.0"?>
+<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
+  <generator>
+    <oval:schema_version>5.10</oval:schema_version>
+    <oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>
+  </generator>
+
+  <definitions>
+    <definition class="compliance" version="1" id="oval:x:def:1">
+      <metadata>
+        <title>Specify a file path using variable with two values</title>
+        <description>x</description>
+        <affected family="unix">
+          <platform>multi_platform_all</platform>
+        </affected>
+      </metadata>
+          <criteria operator="AND">
+            <criterion comment="Check multiple paths" test_ref="oval:x:tst:1"/>
+          </criteria>
+    </definition>
+  </definitions>
+
+  <tests>
+        <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:x:tst:1" version="1" comment="Verify all paths exist" check_existence="all_exist" check="all">
+          <object object_ref="oval:x:obj:1"/>
+        </file_test>
+  </tests>
+
+  <objects>
+        <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:x:obj:1" version="1" comment="uses var_check=all together with operation=equals">
+          <path datatype="string" var_ref="oval:x:var:1" var_check="all" operation="equals"/>
+          <filename xsi:nil="true" datatype="string"/>
+        </file_object>
+  </objects>
+
+  <variables>
+        <constant_variable datatype="string" comment="2 file paths" version="1" id="oval:x:var:1">
+            <value>/tmp/numbers</value>
+            <value>/tmp/letters</value>
+        </constant_variable>
+  </variables>
+</oval_definitions>
+
+From 569e0013ca83adef233ddecc78a052db9b3ccc5c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Tue, 2 Jun 2020 15:11:37 +0200
+Subject: [PATCH 2/3] Add strace to the list of test dependencies
+
+---
+ docs/developer/developer.adoc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/docs/developer/developer.adoc b/docs/developer/developer.adoc
+index 823a1504e..0f01ace74 100644
+--- a/docs/developer/developer.adoc
+++ b/docs/developer/developer.adoc
+@@ -152,7 +152,7 @@ After building the library you might want to run library self-checks. To do
+ that you need to have these additional packages installed:
+ 
+ ----
+-wget lua which procps-ng initscripts chkconfig sendmail bzip2 rpm-build
+wget lua which procps-ng initscripts chkconfig sendmail bzip2 rpm-build strace
+ ----
+ 
+ On Ubuntu 18.04, also install:
+
+From a47604bf30c6574e570abde4fd01488ba120f82d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Wed, 17 Jun 2020 11:00:02 +0200
+Subject: [PATCH 3/3] Terminate matching to prevent recursion
+
+Fixes: RHBZ#1686370
+---
+ src/OVAL/probes/oval_fts.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c
+index 696997942..2b7314c38 100644
+--- a/src/OVAL/probes/oval_fts.c
+++ b/src/OVAL/probes/oval_fts.c
+@@ -1029,6 +1029,15 @@ static FTSENT *oval_fts_read_match_path(OVAL_FTS *ofts)
+ 
+ 		if (ores == OVAL_RESULT_TRUE)
+ 			break;
+		if (ofts->ofts_path_op == OVAL_OPERATION_EQUALS) {
+			/* At this point the comparison result isn't OVAL_RESULT_TRUE. Since
+			we passed the exact path (from filepath or path elements) to
+			fts_open() we surely know that we can't find other items that would
+			be equal. Therefore we can terminate the matching. This can happen
+			if the filepath or path element references a variable that has
+			multiple different values. */
+			return NULL;
+		}
+ 	} /* for (;;) */
+ 
+ 	/*
--- a/SOURCES/openscap-1.3.4-rpmverifyfile_leak-PR_1565.patch
+++ b/SOURCES/openscap-1.3.4-rpmverifyfile_leak-PR_1565.patch
@ -0,0 +1,103 @@
+From 4ef60df7edfdd7a49a565494142f86d93f9268b3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
+Date: Fri, 31 Jul 2020 10:38:17 +0200
+Subject: [PATCH] Plug a memory leak
+
+==12029==    at 0x483A809: malloc (vg_replace_malloc.c:307)
+==12029==    by 0x51F1386: realpath@@GLIBC_2.3 (in /usr/lib64/libc-2.31.so)
+==12029==    by 0x489F8CA: oscap_realpath (util.c:251)
+==12029==    by 0x495E6EF: rpmverify_collect (rpmverifyfile_probe.c:248)
+==12029==    by 0x495F461: rpmverifyfile_probe_main (rpmverifyfile_probe.c:543)
+==12029==    by 0x4935598: probe_worker (worker.c:1090)
+==12029==    by 0x4932F10: probe_worker_runfn (worker.c:81)
+==12029==    by 0x4CDA431: start_thread (in /usr/lib64/libpthread-2.31.so)
+==12029==    by 0x52A8912: clone (in /usr/lib64/libc-2.31.so)
+
+==12029==    at 0x483CCE8: realloc (vg_replace_malloc.c:834)
+==12029==    by 0x4D9DCD8: rrealloc (in /usr/lib64/librpmio.so.9.0.1)
+==12029==    by 0x4D25B88: headerFormat (in /usr/lib64/librpm.so.9.0.1)
+==12029==    by 0x495E467: rpmverify_collect (rpmverifyfile_probe.c:230)
+==12029==    by 0x495F461: rpmverifyfile_probe_main
+(rpmverifyfile_probe.c:543)
+==12029==    by 0x4935598: probe_worker (worker.c:1090)
+==12029==    by 0x4932F10: probe_worker_runfn (worker.c:81)
+==12029==    by 0x4CDA431: start_thread (in
+/usr/lib64/libpthread-2.31.so)
+==12029==    by 0x52A8912: clone (in /usr/lib64/libc-2.31.so)
+
+Resolves: RHBZ#1861301
+---
+ .../probes/unix/linux/rpmverifyfile_probe.c   | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/src/OVAL/probes/unix/linux/rpmverifyfile_probe.c b/src/OVAL/probes/unix/linux/rpmverifyfile_probe.c
+index c86818e72..57d69f552 100644
+--- a/src/OVAL/probes/unix/linux/rpmverifyfile_probe.c
+++ b/src/OVAL/probes/unix/linux/rpmverifyfile_probe.c
+@@ -61,10 +61,10 @@
+ 
+ struct rpmverify_res {
+ 	char *name;  /**< package name */
+-	const char *epoch;
+-	const char *version;
+-	const char *release;
+-	const char *arch;
+	char *epoch;
+	char *version;
+	char *release;
+	char *arch;
+ 	char *file;  /**< filepath */
+ 	char extended_name[1024];
+ 	rpmVerifyAttrs vflags; /**< rpm verify flags */
+@@ -272,14 +272,14 @@ static int rpmverify_collect(probe_ctx *ctx,
+ 						free(current_file_realpath);
+ 						continue;
+ 					}
+-					res.file = current_file_realpath ? current_file_realpath : strdup(current_file);
+					res.file = current_file_realpath ? oscap_strdup(current_file_realpath) : oscap_strdup(current_file);
+ 		      break;
+ 		    case OVAL_OPERATION_PATTERN_MATCH:
+ 					ret = pcre_exec(re, NULL, current_file, strlen(current_file), 0, 0, NULL, 0);
+ 
+ 		      switch(ret) {
+ 		      case 0: /* match */
+-						res.file = strdup(current_file);
+						res.file = oscap_strdup(current_file);
+ 			break;
+ 		      case -1:
+ 			/* mismatch */
+@@ -299,12 +299,18 @@ static int rpmverify_collect(probe_ctx *ctx,
+ 						free(current_file_realpath);
+ 		      goto ret;
+ 		    }
+		    free(current_file_realpath);
+ 
+ 			if (rpmVerifyFile(g_rpm->rpmts, fi, &res.vflags, omit) != 0)
+ 		      res.vflags = RPMVERIFY_FAILURES;
+ 
+ 		    if (callback(ctx, &res) != 0) {
+ 			    ret = 0;
+					free(res.name);
+					free(res.epoch);
+					free(res.version);
+					free(res.release);
+					free(res.arch);
+ 					free(res.file);
+ 			    goto ret;
+ 		    }
+@@ -313,6 +319,12 @@ static int rpmverify_collect(probe_ctx *ctx,
+ 
+ 		  rpmfiFree(fi);
+ 		}
+
+		free(res.name);
+		free(res.epoch);
+		free(res.version);
+		free(res.release);
+		free(res.arch);
+ 	}
+ 
+ 	match = rpmdbFreeIterator (match);
+-- 
+2.26.2
+
--- a/SPECS/openscap.spec
+++ b/SPECS/openscap.spec
@ -1,19 +1,19 @@
 Name:           openscap
-Version:        1.3.2
-Release:        6%{?dist}
+Version:        1.3.3
+Release:        5%{?dist}
 Summary:        Set of open source libraries enabling integration of the SCAP line of standards
 Group:          System Environment/Libraries
 License:        LGPLv2+
 URL:            http://www.open-scap.org/
 Source0:        https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
-# PATCHES FOR 1.3.2
-Patch1:         01-add-test-fix-type-anaconda.patch
-Patch2:         02-do-not-use-keyword-operator-as-a-function-parameter.patch
-Patch3:         03-fix-cmake-test-for-libcap-xattr-h.patch
-Patch4:         04-oscap-podman-detect-ambiguous-targets.patch
-Patch5:         openscap-1.3.2-covscan_ux_fix.patch
-Patch6:         openscap-1.3.3-fix-cmake-findacl.patch
-# END PATCHES FOR 1.3.2
+Patch1:         openscap-1.3.4-fix-environmentvariable58-regression.patch
+Patch2:         openscap-1.3.4-fix-no-more-recursion.patch
+Patch3:	        openscap-1.3.4-add_compression_support-PR_1557.patch
+Patch4:	        openscap-1.3.4-add_compression_test-PR_1564.patch
+Patch5:	        openscap-1.3.4-add_compression_tracing-PR_1561.patch
+Patch6:         openscap-1.3.4-rpmverifyfile_leak-PR_1565.patch
+Patch7:         openscap-1.3.4-detect_remote_file_systems-PR_1573.patch
+
 BuildRequires:  cmake >= 2.6
 BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
 BuildRequires:  rpm-devel
@ -29,6 +29,7 @@ BuildRequires:  openldap-devel
 BuildRequires:  GConf2-devel
 BuildRequires:  glib2-devel
 BuildRequires:  dbus-devel
+BuildRequires:  libyaml-devel
 %if %{?_with_check:1}%{!?_with_check:0}
 BuildRequires:  perl-XML-XPath
 BuildRequires:  bzip2
@ -36,6 +37,7 @@ BuildRequires:  bzip2
 Requires:       bash
 Requires:       bzip2-libs
 Requires:       dbus
+Requires:       libyaml
 Requires:       GConf2
 Requires:       glib2
 Requires:       libacl
@ -137,6 +139,7 @@ for developing applications that use %{name}-engine-sce.
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch7 -p1
 mkdir build

 %build
@ -216,12 +219,54 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/oscap-vm
 %{_mandir}/man8/scap-as-rpm.8.gz
 %{_bindir}/scap-as-rpm
+%{_mandir}/man8/autotailor.8.gz
+%{_bindir}/autotailor

 %files engine-sce
 %{_libdir}/libopenscap_sce.so.*
 %{_bindir}/oscap-run-sce-script

 %changelog
+* Wed Aug 19 2020 Jan Černý <jcerny@redhat.com> - 1.3.3-5
+- Detect remote file systems correctly (RHBZ#1870087)
+
+* Mon Aug 03 2020 Jan Černý <jcerny@redhat.com> - 1.3.3-4
+- Fix memory leaks in rpmverifyfile probe (RHBZ#1861301)
+
+* Tue Jul 21 2020 Matěj Týč <matyc@redhat.com> - 1.3.3-3
+- Added support for fetching remote content with compression (RHBZ#1855708)
+
+* Thu Jun 25 2020 Matěj Týč <matyc@redhat.com> - 1.3.3-2
+- Prevent unwanted recursion that could crash the scanner (RHBZ#1686370)
+
+* Mon May 04 2020 Evgeny Kolesnikov <ekolesni@redhat.com> - 1.3.3-1
+- Upgrade to the latest upstream release (rhbz#1829761)
+- Added a Python script that can be used for CLI tailoring (autotailor)
+- Added timezone to XCCDF TestResult start/end time
+- Added yamlfilecontent independent probe (proposal/draft implementation)
+- Added ability to generate `machineconfig` fix
+- Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF
+- Fixed filepath pattern matching in offline mode in textfilecontent58 probe
+- Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory
+- Fixed #1512: Severity refinement lost in generated guide
+- Fixed #1453: Pointer lost in Swig API
+- The data system_info probe return for offline and online modes is consistent and actual
+- Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities
+  from system_info probe
+
+* Fri Mar 27 2020 Jan Černý <jcerny@redhat.com> - 1.3.2-9
+- Generate HTML guides from tailored profiles (RHBZ#1743835)
+
+* Wed Mar 18 2020 Jan Černý <jcerny@redhat.com> - 1.3.2-8
+- Fix tests for rpmverifyfileprobe (RHBZ#1814726)
+
+* Thu Mar 12 2020 Jan Černý <jcerny@redhat.com> - 1.3.2-7
+- Fix segmentation fault in systemdunitdependency_probe (RHBZ#1793050)
+- Fix crash in textfilecontent probe (RHBZ#1686467)
+- Do not drop empty lines from Ansible remediations (RHBZ#1795563)
+- Fix oscap-ssh --sudo (RHBZ#1803116)
+- Remove useless warnings (RHBZ#1764139)
+
 * Thu Jan 23 2020 Jan Černý <jcerny@redhat.com> - 1.3.2-6
 - Fix FindACL.cmake

@ -702,4 +747,3 @@ rm -rf $RPM_BUILD_ROOT

 * Thu Jan 15 2009 Tomas Heinrich <theinric@redhat.com> 0.1.1-1
 - Initial rpm
-