.gitignore

@@ -1 +1 @@
-SOURCES/openscap-1.3.6.tar.gz
+SOURCES/openscap-1.3.12.tar.gz

.openscap.metadata

@@ -1 +1 @@
-8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz
+0de19fd72129fd9d0e2a541918e199c321b08a34 SOURCES/openscap-1.3.12.tar.gz

SOURCES/2218.patch

@@ -0,0 +1,30 @@
+From a65dff2815eb10c3e420c61c81f1793a683630dc Mon Sep 17 00:00:00 2001
+From: Flos Lonicerae <lonicerae@gmail.com>
+Date: Sat, 19 Oct 2024 18:58:30 +0800
+Subject: [PATCH] Make a copy before spliting.
+
+---
+ src/OVAL/probes/probe/worker.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/OVAL/probes/probe/worker.c b/src/OVAL/probes/probe/worker.c
+index d667127d63..e0a07c31ec 100644
+--- a/src/OVAL/probes/probe/worker.c
++++ b/src/OVAL/probes/probe/worker.c
+@@ -985,7 +985,7 @@ static SEXP_t *probe_set_eval(probe_t *probe, SEXP_t *set, size_t depth)
+ 
+ static void _add_blocked_paths(struct oscap_list *bpaths)
+ {
+-	char *envar = getenv("OSCAP_PROBE_IGNORE_PATHS");
++	char *envar = oscap_strdup(getenv("OSCAP_PROBE_IGNORE_PATHS"));
+ 	if (envar == NULL) {
+ 		return;
+ 	}
+@@ -996,6 +996,7 @@ static void _add_blocked_paths(struct oscap_list *bpaths)
+ 	for (int i = 0; paths[i]; ++i) {
+ 		oscap_list_add(bpaths, strdup(paths[i]));
+ 	}
++	free(envar);
+ 	free(paths);
+ #endif
+ }

SOURCES/2224.patch

@@ -0,0 +1,47 @@
+From d38914a4d62b2ad9d011a530bf39b4acf76e5b1b Mon Sep 17 00:00:00 2001
+From: Evgeny Kolesnikov <ekolesni@redhat.com>
+Date: Tue, 15 Apr 2025 15:05:07 +0200
+Subject: [PATCH] tests: OVAL/API/skip_paths
+
+Modify the test so it could catch the regression
+with environment variable modified during execution.
+See #2168.
+---
+ tests/API/OVAL/skip_paths/test_skip_paths.sh  | 4 ++--
+ tests/API/OVAL/skip_paths/test_skip_paths.xml | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tests/API/OVAL/skip_paths/test_skip_paths.sh b/tests/API/OVAL/skip_paths/test_skip_paths.sh
+index 4b69c9aa33..26dc5b395a 100755
+--- a/tests/API/OVAL/skip_paths/test_skip_paths.sh
++++ b/tests/API/OVAL/skip_paths/test_skip_paths.sh
+@@ -15,8 +15,8 @@ cp "$srcdir/test.xml" "$root/b/"
+ mkdir -p "$root/c"
+ touch "$root/c/z"
+ cp "$srcdir/test.xml" "$root/c/"
+-# oscap probes will skip directories "b" and "c"
+-export OSCAP_PROBE_IGNORE_PATHS="$root/b:$root/c"
++# oscap probes will skip directories "$root/n", "$root/b" and "$root/c"
++export OSCAP_PROBE_IGNORE_PATHS="$root/n:$root/c:$root/b"
+ $OSCAP oval eval --results $result "$srcdir/test_skip_paths.xml"
+ assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:1" and @result="true"]'
+ assert_exists 1 '/oval_results/results/system/oval_system_characteristics/collected_objects/object[@id="oval:x:obj:1" and @flag="complete"]'
+diff --git a/tests/API/OVAL/skip_paths/test_skip_paths.xml b/tests/API/OVAL/skip_paths/test_skip_paths.xml
+index a03196153b..57048f3ef7 100644
+--- a/tests/API/OVAL/skip_paths/test_skip_paths.xml
++++ b/tests/API/OVAL/skip_paths/test_skip_paths.xml
+@@ -90,12 +90,12 @@
+     <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="1" id="oval:x:obj:3">
+       <filepath>/tmp/oscap_test_skip_paths/a/x</filepath>
+       <pattern>^.*$</pattern>
+-      <instance datatype="int" operation="greater than or equal">1</instance>
++      <instance datatype="int">1</instance>
+     </textfilecontent54_object>
+     <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="1" id="oval:x:obj:4">
+       <filepath>/tmp/oscap_test_skip_paths/b/y</filepath>
+       <pattern>^.*$</pattern>
+-      <instance datatype="int" operation="greater than or equal">1</instance>
++      <instance datatype="int">1</instance>
+     </textfilecontent54_object>
+     <filehash58_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="1" id="oval:x:obj:5">
+       <filepath>/tmp/oscap_test_skip_paths/a/x</filepath>

SOURCES/2233.patch

@@ -0,0 +1,97 @@
+From 94934207b34978f92ab2f7b7cc0e8a73508c8266 Mon Sep 17 00:00:00 2001
+From: Evgeny Kolesnikov <ekolesni@redhat.com>
+Date: Thu, 17 Apr 2025 14:02:55 +0200
+Subject: [PATCH] Inherit opscap environment when executing Bash remediations
+ with --remediate
+
+Make the Bash remediation environment consistent with other
+types of remediation.
+---
+ src/XCCDF_POLICY/xccdf_policy_remediate.c     |  8 ++-----
+ tests/API/XCCDF/unittests/CMakeLists.txt      |  1 +
+ .../unittests/test_remediation_environment.sh | 21 +++++++++++++++++++
+ .../test_remediation_environment.xccdf.xml    | 16 ++++++++++++++
+ 4 files changed, 40 insertions(+), 6 deletions(-)
+ create mode 100755 tests/API/XCCDF/unittests/test_remediation_environment.sh
+ create mode 100644 tests/API/XCCDF/unittests/test_remediation_environment.xccdf.xml
+
+diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c
+index d99f6d49de..842ef2df9d 100644
+--- a/src/XCCDF_POLICY/xccdf_policy_remediate.c
++++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c
+@@ -464,12 +464,8 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_
+ 				NULL
+ 			};
+ 
+-			char *const envp[2] = {
+-				"PATH=/bin:/sbin:/usr/bin:/usr/sbin",
+-				NULL
+-			};
+-
+-			execve(interpret, argvp, envp);
++			// We are inheriting openscap environment
++			execve(interpret, argvp, environ);
+ 			/* Wow, execve returned. In this special case, we failed to execute the fix
+ 			 * and we return 0 from function. At least the following error message will
+ 			 * indicate the problem in xccdf:message. */
+diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
+index 164b795e0e..ef835e3506 100644
+--- a/tests/API/XCCDF/unittests/CMakeLists.txt
++++ b/tests/API/XCCDF/unittests/CMakeLists.txt
+@@ -92,6 +92,7 @@ add_oscap_test("test_remediation_cdata.sh")
+ add_oscap_test("test_remediation_subs_unresolved.sh")
+ add_oscap_test("test_remediation_fix_without_system.sh")
+ add_oscap_test("test_remediation_invalid_characters.sh")
++add_oscap_test("test_remediation_environment.sh")
+ add_oscap_test("test_remediate_simple.sh")
+ add_oscap_test("test_remediate_perl.sh")
+ add_oscap_test("test_report_check_with_empty_selector.sh")
+diff --git a/tests/API/XCCDF/unittests/test_remediation_environment.sh b/tests/API/XCCDF/unittests/test_remediation_environment.sh
+new file mode 100755
+index 0000000000..1f5fd0afbf
+--- /dev/null
++++ b/tests/API/XCCDF/unittests/test_remediation_environment.sh
+@@ -0,0 +1,21 @@
++#!/usr/bin/env bash
++. $builddir/tests/test_common.sh
++
++set -e
++set -o pipefail
++
++name=$(basename $0 .sh)
++result=$(mktemp -t ${name}.out.XXXXXX)
++
++rm -f remediation.env
++
++CANARY_EXPORTED="CANARY_EXPORTED_VALUE"
++export CANARY_EXPORTED
++CANARY_PROCESS="CANARY_PROCESS_VALUE" $OSCAP xccdf eval --remediate $srcdir/${name}.xccdf.xml || true
++
++grep -q "${PATH}" remediation.env || die "PATH not found"
++grep -q "CANARY_EXPORTED_VALUE" remediation.env || die "CANARY_EXPORTED_VALUE not found"
++grep -q "CANARY_PROCESS_VALUE" remediation.env || die "CANARY_PROCESS_VALUE not found"
++
++rm -f remediation.env
++rm $result
+diff --git a/tests/API/XCCDF/unittests/test_remediation_environment.xccdf.xml b/tests/API/XCCDF/unittests/test_remediation_environment.xccdf.xml
+new file mode 100644
+index 0000000000..0875b6c241
+--- /dev/null
++++ b/tests/API/XCCDF/unittests/test_remediation_environment.xccdf.xml
+@@ -0,0 +1,16 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_test">
++  <status>accepted</status>
++  <version>1.0</version>
++  <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_1">
++    <title>Write some environment variables</title>
++    <fix system="urn:xccdf:fix:script:sh">
++        echo "PATH=${PATH}" > remediation.env
++        echo "CANARY_EXPORTED=${CANARY_EXPORTED}" >> remediation.env
++        echo "CANARY_PROCESS=${CANARY_PROCESS}" >> remediation.env
++    </fix>
++    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
++      <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
++    </check>
++  </Rule>
++</Benchmark>

SOURCES/openscap-1.3.7-PR-1841-coverity.patch

@@ -1,104 +0,0 @@
-From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 27 Jan 2022 15:00:33 +0100
-Subject: [PATCH 1/3] Fix shellcheck warning
-
-Addressing:
-
-Error: SHELLCHECK_WARNING (CWE-138): [#def1]
-/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
-  108|   args+=( "--remediate" )
-  109|   args+=( "${OSCAP_REMEDIATE_DS}" )
-  110|-> log "Args: ${args[@]}"
-  111|
-  112|   # Now we are good to go
----
- utils/oscap-remediate | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/utils/oscap-remediate b/utils/oscap-remediate
-index fc0b7715f..52e29aa66 100755
---- a/utils/oscap-remediate
-+++ b/utils/oscap-remediate
-@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
- args+=( "--progress-full" )
- args+=( "--remediate" )
- args+=( "${OSCAP_REMEDIATE_DS}" )
--log "Args: ${args[@]}"
-+log "Args: ${args[*]}"
- 
- # Now we are good to go
- header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
-
-From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 27 Jan 2022 15:09:02 +0100
-Subject: [PATCH 2/3] Remove superfluous strdup
-
-We can do this because xccdf_session_set_rule calls strdup on the rule
-parameter internally.
-
-Addressing:
-
-Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
-openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
-openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
-openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
-openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
- 4148|       char *n_rule = strdup(rule);
- 4149|       xccdf_session_set_rule(sess, n_rule);
- 4150|-> }
- 4151|
- 4152|   void xccdf_session_free_py(struct xccdf_session *sess){
----
- swig/openscap.i | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/swig/openscap.i b/swig/openscap.i
-index 2fe1cce99..158a22675 100644
---- a/swig/openscap.i
-+++ b/swig/openscap.i
-@@ -559,8 +559,7 @@ struct xccdf_session {
- };
- 
- void xccdf_session_set_rule_py(struct xccdf_session  *sess, char *rule) {
--    char *n_rule = strdup(rule);
--    xccdf_session_set_rule(sess, n_rule);
-+    xccdf_session_set_rule(sess, rule);
- }
- 
- void xccdf_session_free_py(struct xccdf_session *sess){
-
-From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Thu, 27 Jan 2022 15:16:02 +0100
-Subject: [PATCH 3/3] Add a missing free
-
-Addressing:
-Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
-openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
-openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
-openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
-openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
-openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
- 2148|   			oscap_seterr(OSCAP_EFAMILY_XCCDF,
- 2149|   				"Rule '%s' not found in selected profile.", rule_id);
- 2150|-> 			return NULL;
- 2151|   		}
- 2152|   	}
----
- src/XCCDF_POLICY/xccdf_policy.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
-index b63853a38..4d4b7ad0a 100644
---- a/src/XCCDF_POLICY/xccdf_policy.c
-+++ b/src/XCCDF_POLICY/xccdf_policy.c
-@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
- 		if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
- 			oscap_seterr(OSCAP_EFAMILY_XCCDF,
- 				"Rule '%s' not found in selected profile.", rule_id);
-+			oscap_htable_iterator_free(rit);
- 			return NULL;
- 		}
- 	}

SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch

@@ -1,32 +0,0 @@
-From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 31 Jan 2022 13:45:15 +0100
-Subject: [PATCH] Prevent fails of test_ds_misc.sh
-
-The SOURCE_DATE_EPOCH environment variable is effective only when it's
-set to a value that's older than mtime of the processed file.  See the
-implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
-However, the file in our test suite has originally been created before
-(in 2019) and this mtime can be used when a tarball is produced. To
-avoid the test failing, we can modify the mtime using the touch command
-just before we run the tests.
----
- tests/DS/test_ds_misc.sh | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
-index 159007518..cffbef303 100755
---- a/tests/DS/test_ds_misc.sh
-+++ b/tests/DS/test_ds_misc.sh
-@@ -269,6 +269,8 @@ function test_source_date_epoch() {
- 	local timestamp="2020-03-05T12:09:37"
- 	export SOURCE_DATE_EPOCH="1583410177"
- 	export TZ=UTC
-+	# ensure the file mtime is always newer than the $timestamp
-+	touch -c "$xccdf"
- 	$OSCAP ds sds-compose "$xccdf" "$result"
- 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
- 	rm -f "$result"
--- 
-2.34.1
-

SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch

@@ -1,27 +0,0 @@
-From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Tue, 1 Feb 2022 15:06:33 +0100
-Subject: [PATCH] Prevent fails of test_ds_misc.sh
-
-Other files from which the datastream is composed might also
-affect the timestamp attributes in result document depending
-on their mtime.
----
- tests/DS/test_ds_misc.sh | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
-index cffbef303..1777c44f4 100755
---- a/tests/DS/test_ds_misc.sh
-+++ b/tests/DS/test_ds_misc.sh
-@@ -270,7 +270,9 @@ function test_source_date_epoch() {
- 	export SOURCE_DATE_EPOCH="1583410177"
- 	export TZ=UTC
- 	# ensure the file mtime is always newer than the $timestamp
--	touch -c "$xccdf"
-+	touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
-+	touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
-+	touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
- 	$OSCAP ds sds-compose "$xccdf" "$result"
- 	assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
- 	rm -f "$result"

SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch

@@ -1,22 +0,0 @@
-From 12f9c02a612bb1687676b74a4739126b1913b1fe Mon Sep 17 00:00:00 2001
-From: Ajay Nair <ajaynair59@gmail.com>
-Date: Mon, 9 May 2022 13:31:47 -0400
-Subject: [PATCH] Reset errno before call to strtoll
-
----
- src/common/memusage.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/common/memusage.c b/src/common/memusage.c
-index c6755f21f1..ffa70b662b 100644
---- a/src/common/memusage.c
-+++ b/src/common/memusage.c
-@@ -71,6 +71,8 @@ static int read_common_sizet(void *szp, char *strval)
- 		return (-1);
- 
- 	*end = '\0';
-+
-+	errno = 0;
- 	*(size_t *)szp = strtoll(strval, NULL, 10);
- 
- 	if (errno == EINVAL ||

SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch

@@ -1,233 +0,0 @@
-From 07486e9033d8cc1fd03962994b3359cb611a9ac9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Fri, 22 Jul 2022 16:50:01 +0200
-Subject: [PATCH 1/3] Add unit test for read_common_sizet function
-
-The unit test will cover the missing set errno
-to 0 which was the root cause of:
-https://github.com/OpenSCAP/openscap/issues/1867
-
-Therefore, this test can be used during verification of:
-https://bugzilla.redhat.com/show_bug.cgi?id=2109485
----
- tests/API/probes/CMakeLists.txt   |  9 +++++
- tests/API/probes/test_memusage.c  | 67 +++++++++++++++++++++++++++++++
- tests/API/probes/test_memusage.sh |  9 +++++
- 3 files changed, 85 insertions(+)
- create mode 100644 tests/API/probes/test_memusage.c
- create mode 100755 tests/API/probes/test_memusage.sh
-
-diff --git a/tests/API/probes/CMakeLists.txt b/tests/API/probes/CMakeLists.txt
-index ae3c7212a0..2ac4081ac2 100644
---- a/tests/API/probes/CMakeLists.txt
-+++ b/tests/API/probes/CMakeLists.txt
-@@ -38,3 +38,12 @@ target_include_directories(oval_fts_list PUBLIC
- )
- target_link_libraries(oval_fts_list openscap)
- add_oscap_test("fts.sh")
-+
-+add_oscap_test_executable(test_memusage
-+	"test_memusage.c"
-+	"${CMAKE_SOURCE_DIR}/src/common/bfind.c"
-+)
-+target_include_directories(test_memusage PUBLIC
-+	"${CMAKE_SOURCE_DIR}/src/common"
-+)
-+add_oscap_test("test_memusage.sh")
-diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
-new file mode 100644
-index 0000000000..5dced98f03
---- /dev/null
-+++ b/tests/API/probes/test_memusage.c
-@@ -0,0 +1,67 @@
-+/*
-+ * Copyright 2022 Red Hat Inc., Durham, North Carolina.
-+ * All Rights Reserved.
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-+ *
-+ * Authors:
-+ *      "Jan Černý" <jcerny@redhat.com>
-+ */
-+
-+#ifdef HAVE_CONFIG_H
-+#include <config.h>
-+#endif
-+
-+#include <stdio.h>
-+#include "memusage.h"
-+#include "memusage.c"
-+#define OS_LINUX
-+
-+static int test_basic()
-+{
-+	size_t size;
-+	char *strval = strdup("17 MB");
-+	read_common_sizet(&size, strval);
-+	free(strval);
-+	return (size == 17);
-+}
-+
-+static int test_errno()
-+{
-+	size_t size;
-+	char *strval = strdup("17 MB");
-+
-+	/* Test that setting errno outside of the read_common_sizet function
-+	 * doesn't influence the function and doesn't make the function fail.
-+	 */
-+	errno = EINVAL;
-+
-+	int ret = read_common_sizet(&size, strval);
-+	free(strval);
-+	return (ret != -1);
-+}
-+
-+int main(int argc, char *argv[])
-+{
-+	if (!test_basic()) {
-+		fprintf(stderr, "test_basic has failed\n");
-+		return 1;
-+	}
-+	if (!test_errno()) {
-+		fprintf(stderr, "test_errno has failed\n");
-+		return 1;
-+	}
-+	return 0;
-+}
-diff --git a/tests/API/probes/test_memusage.sh b/tests/API/probes/test_memusage.sh
-new file mode 100755
-index 0000000000..4c76bdc0ac
---- /dev/null
-+++ b/tests/API/probes/test_memusage.sh
-@@ -0,0 +1,9 @@
-+#!/usr/bin/env bash
-+
-+. $builddir/tests/test_common.sh
-+
-+if [ -n "${CUSTOM_OSCAP+x}" ] ; then
-+    exit 255
-+fi
-+
-+./test_memusage
-
-From 2cc649d5e9fbf337bbfca69c21313657a5b8a7cf Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 25 Jul 2022 09:00:36 +0200
-Subject: [PATCH 2/3] Replace license by SPDX ID
-
----
- tests/API/probes/test_memusage.c | 22 +---------------------
- 1 file changed, 1 insertion(+), 21 deletions(-)
-
-diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
-index 5dced98f03..db2915f6d5 100644
---- a/tests/API/probes/test_memusage.c
-+++ b/tests/API/probes/test_memusage.c
-@@ -1,24 +1,4 @@
--/*
-- * Copyright 2022 Red Hat Inc., Durham, North Carolina.
-- * All Rights Reserved.
-- *
-- * This library is free software; you can redistribute it and/or
-- * modify it under the terms of the GNU Lesser General Public
-- * License as published by the Free Software Foundation; either
-- * version 2.1 of the License, or (at your option) any later version.
-- *
-- * This library is distributed in the hope that it will be useful,
-- * but WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-- * Lesser General Public License for more details.
-- *
-- * You should have received a copy of the GNU Lesser General Public
-- * License along with this library; if not, write to the Free Software
-- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-- *
-- * Authors:
-- *      "Jan Černý" <jcerny@redhat.com>
-- */
-+// SPDX-License-Identifier: LGPL-2.1-or-later
- 
- #ifdef HAVE_CONFIG_H
- #include <config.h>
-
-From caadd89e61f5d70e251180055686a3b52c763c66 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 25 Jul 2022 09:00:45 +0200
-Subject: [PATCH 3/3] Improve unit test for read_common_sizet
-
-Check for multiple different situations.
----
- tests/API/probes/test_memusage.c | 34 ++++++++++++++++++++++++++++----
- 1 file changed, 30 insertions(+), 4 deletions(-)
-
-diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
-index db2915f6d5..b9db865d45 100644
---- a/tests/API/probes/test_memusage.c
-+++ b/tests/API/probes/test_memusage.c
-@@ -12,16 +12,34 @@
- static int test_basic()
- {
- 	size_t size;
--	char *strval = strdup("17 MB");
--	read_common_sizet(&size, strval);
-+	char *strval = strdup("17 kB\n");
-+	int ret = read_common_sizet(&size, strval);
- 	free(strval);
--	return (size == 17);
-+	return (size == 17 && ret == 0);
-+}
-+
-+static int test_no_unit()
-+{
-+	size_t size;
-+	char *strval = strdup("42");
-+	int ret = read_common_sizet(&size, strval);
-+	free(strval);
-+	return (ret == -1);
-+}
-+
-+static int test_invalid_number()
-+{
-+	size_t size;
-+	char *strval = strdup("www kB\n");
-+	int ret = read_common_sizet(&size, strval);
-+	free(strval);
-+	return (size == 0 && ret == 0);
- }
- 
- static int test_errno()
- {
- 	size_t size;
--	char *strval = strdup("17 MB");
-+	char *strval = strdup("17 kB\n");
- 
- 	/* Test that setting errno outside of the read_common_sizet function
- 	 * doesn't influence the function and doesn't make the function fail.
-@@ -39,6 +57,14 @@ int main(int argc, char *argv[])
- 		fprintf(stderr, "test_basic has failed\n");
- 		return 1;
- 	}
-+	if (!test_no_unit()) {
-+		fprintf(stderr, "test_no_unit has failed\n");
-+		return 1;
-+	}
-+	if (!test_invalid_number()) {
-+		fprintf(stderr, "test_invalid_number has failed\n");
-+		return 1;
-+	}
- 	if (!test_errno()) {
- 		fprintf(stderr, "test_errno has failed\n");
- 		return 1;

SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch

@@ -1,71 +0,0 @@
-From 55b09ba184c1803a5e1454c44e9e9a5c578dd741 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Mon, 25 Jul 2022 17:10:17 +0200
-Subject: [PATCH] Reset errno before strtol
-
-This sets errno to 0 before strotol calls after which the errno
-is being checked.
-
-Per man 3 strtol:
-Since  strtol()  can  legitimately  return 0, LONG_MAX, or
-LONG_MIN (LLONG_MAX or LLONG_MIN for strtoll()) on both success and
-failure, the calling program should set errno to 0 before the call, and
-then determine if an error occurred by checking whether errno has a
-nonzero value after the call.
-
-This is inspired by https://github.com/OpenSCAP/openscap/pull/1861.
----
- src/OVAL/probes/independent/sql57_probe.c | 1 +
- src/OVAL/probes/independent/sql_probe.c   | 1 +
- src/OVAL/probes/oval_fts.c                | 1 +
- src/OVAL/probes/unix/xinetd_probe.c       | 1 +
- 4 files changed, 4 insertions(+)
-
-diff --git a/src/OVAL/probes/independent/sql57_probe.c b/src/OVAL/probes/independent/sql57_probe.c
-index ce1466635c..2b35750ee2 100644
---- a/src/OVAL/probes/independent/sql57_probe.c
-+++ b/src/OVAL/probes/independent/sql57_probe.c
-@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
- 			matchitem1(tok, 'c',
- 				   "onnecttimeout", tmp);
- 			if (tmp != NULL) {
-+				errno = 0;
- 				info->conn_timeout = strtol(tmp, NULL, 10);
- 
- 				if (errno == ERANGE || errno == EINVAL)
-diff --git a/src/OVAL/probes/independent/sql_probe.c b/src/OVAL/probes/independent/sql_probe.c
-index 2ede89d031..71ba3c08c3 100644
---- a/src/OVAL/probes/independent/sql_probe.c
-+++ b/src/OVAL/probes/independent/sql_probe.c
-@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
- 			matchitem1(tok, 'c',
- 				   "onnecttimeout", tmp);
- 			if (tmp != NULL) {
-+				errno = 0;
- 				info->conn_timeout = strtol(tmp, NULL, 10);
- 
- 				if (errno == ERANGE || errno == EINVAL)
-diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c
-index 1364159c90..f9d0a0c1fd 100644
---- a/src/OVAL/probes/oval_fts.c
-+++ b/src/OVAL/probes/oval_fts.c
-@@ -729,6 +729,7 @@ OVAL_FTS *oval_fts_open_prefixed(const char *prefix, SEXP_t *path, SEXP_t *filen
- 	/* max_depth */
- 	PROBE_ENT_AREF(behaviors, r0, "max_depth", return NULL;);
- 	SEXP_string_cstr_r(r0, cstr_buff, sizeof cstr_buff - 1);
-+	errno = 0;
- 	max_depth = strtol(cstr_buff, NULL, 10);
- 	if (errno == EINVAL || errno == ERANGE) {
- 		dE("Invalid value of the `%s' attribute: %s", "recurse_direction", cstr_buff);
-diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c
-index b3375500db..703a07f513 100644
---- a/src/OVAL/probes/unix/xinetd_probe.c
-+++ b/src/OVAL/probes/unix/xinetd_probe.c
-@@ -1280,6 +1280,7 @@ int op_assign_bool(void *var, char *val)
- 		*((bool *)(var)) = false;
- 	} else {
- 		char *endptr = NULL;
-+		errno = 0;
- 		*((bool *)(var)) = (bool) strtol (val, &endptr, 2);
- 		if (errno == EINVAL || errno == ERANGE) {
- 			return -1;

SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch

@@ -1,82 +0,0 @@
-From 140d60bc751e6c0e4138ab3a2e8e9b130264f905 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
-Date: Wed, 27 Jul 2022 09:40:29 +0200
-Subject: [PATCH] Add CMake option to disable oscap-remediate service
-
-This patch introduces a new CMake build option
-ENABLE_OSCAP_REMEDIATE_SERVICE which can be used to disable the
-installation of the files related to the oscap-remediate systemd
-service. Downstream packagers can use this option to disable shipping
-the oscap-remediate service in their RPM spec files.
-
-Resolves: rhbz#2111358
-Resolves: rhbz#2111360
----
- CMakeLists.txt       | 15 +++++++++------
- utils/CMakeLists.txt | 20 +++++++++++---------
- 2 files changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 61c57d7a3e..48e19e5203 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -327,6 +327,7 @@ cmake_dependent_option(ENABLE_OSCAP_UTIL_VM "enables the oscap-vm utility, this
- cmake_dependent_option(ENABLE_OSCAP_UTIL_PODMAN "enables the oscap-podman utility, this lets you scan Podman containers and container images" ON "NOT WIN32" OFF)
- cmake_dependent_option(ENABLE_OSCAP_UTIL_CHROOT "enables the oscap-chroot utility, this lets you scan entire chroots using offline scanning" ON "NOT WIN32" OFF)
- option(ENABLE_OSCAP_UTIL_AUTOTAILOR "enables the autotailor utility that is able to perform command-line tailoring" TRUE)
-+option(ENABLE_OSCAP_REMEDIATE_SERVICE "enables the oscap-remediate service" TRUE)
- 
- # ---------- TEST-SUITE SWITCHES
- 
-@@ -609,12 +610,14 @@ if(NOT WIN32)
- 		DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
- 	)
- 	if(WITH_SYSTEMD)
--		# systemd service for offline (boot-time) remediation
--		configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
--		install(FILES
--			${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
--			DESTINATION ${SYSTEMD_UNITDIR}
--		)
-+		if(ENABLE_OSCAP_REMEDIATE_SERVICE)
-+			# systemd service for offline (boot-time) remediation
-+			configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
-+			install(FILES
-+				${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
-+				DESTINATION ${SYSTEMD_UNITDIR}
-+			)
-+		endif()
- 	endif()
- endif()
- 
-diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt
-index 3f199eaabc..93ce1f2a9d 100644
---- a/utils/CMakeLists.txt
-+++ b/utils/CMakeLists.txt
-@@ -59,15 +59,17 @@ if(ENABLE_OSCAP_UTIL)
- 		)
- 
- 		if(WITH_SYSTEMD)
--			install(PROGRAMS "oscap-remediate"
--				DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
--			)
--			install(PROGRAMS "oscap-remediate-offline"
--				DESTINATION ${CMAKE_INSTALL_BINDIR}
--			)
--			install(FILES "oscap-remediate-offline.8"
--				DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
--			)
-+			if (ENABLE_OSCAP_REMEDIATE_SERVICE)
-+				install(PROGRAMS "oscap-remediate"
-+					DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
-+				)
-+				install(PROGRAMS "oscap-remediate-offline"
-+					DESTINATION ${CMAKE_INSTALL_BINDIR}
-+				)
-+				install(FILES "oscap-remediate-offline.8"
-+					DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
-+				)
-+			endif()
- 		endif()
- 	endif()
- endif()

SPECS/openscap.spec

@@ -1,18 +1,14 @@
 Name:           openscap
-Version:        1.3.6
-Release:        4%{?dist}
+Version:        1.3.12
+Release:        2%{?dist}
 Summary:        Set of open source libraries enabling integration of the SCAP line of standards
 Group:          System Environment/Libraries
 License:        LGPLv2+
 URL:            http://www.open-scap.org/
 Source0:        https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
-Patch1:         openscap-1.3.7-PR-1841-coverity.patch
-Patch2:         openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
-Patch3:         openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
-Patch4:         openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
-Patch5:         openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
-Patch6:         openscap-1.3.7-PR-1875-reset-errno-strtol.patch
-Patch7:         openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
+Patch0:         2218.patch
+Patch1:         2224.patch
+Patch2:         2233.patch
 BuildRequires:  cmake >= 2.6
 BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
 BuildRequires:  rpm-devel
@@ -141,10 +137,12 @@ cd build
 %cmake -DENABLE_PERL=OFF \
         -DENABLE_DOCS=ON \
         -DENABLE_OSCAP_UTIL_DOCKER=OFF \
+        -DENABLE_OSCAP_UTIL_IM=OFF \
         -DENABLE_OSCAP_UTIL_CHROOT=ON \
         -DENABLE_OSCAP_UTIL_PODMAN=ON \
         -DENABLE_OSCAP_UTIL_VM=ON \
         -DENABLE_OSCAP_REMEDIATE_SERVICE=OFF \
+        -DOPENSCAP_PROBE_LINUX_DPKGINFO=OFF \
         ..
 make %{?_smp_mflags}
 make docs
@@ -222,6 +220,35 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/oscap-run-sce-script
 
 %changelog
+* Mon May 05 2025 Evgenii Kolesnikov <ekolesni@redhat.com> - 1:1.3.12-2
+- Initialize tmt (RHEL-43240)
+
+* Fri Apr 25 2025 Evgenii Kolesnikov <ekolesni@redhat.com> - 1:1.3.12-1
+- Upgrade to the latest upstream release (RHEL-88842)
+- Fix error when tailoring DISA content (RHEL-34104)
+- Fix OSCAP_PROBE_IGNORE_PATHS handling (RHEL-67297)
+
+* Wed Aug 07 2024 Milan Lysonek <mlysonek@redhat.com> - 1.3.10-3
+- Switch gating to tmt plan (RHEL-43240)
+
+* Mon Apr 08 2024 Jan Černý <jcerny@redhat.com> - 1.3.10-2
+- Explicitely disable dpkginfo probe
+
+* Tue Apr 02 2024 Jan Černý <jcerny@redhat.com> - 1.3.10-1
+- Rebase to the latest upstream version (RHEL-31221)
+- Add ability to define a limit of collected items (RHEL-11925)
+- Add option --references that can select rules based on their reference (RHEL-1479)
+
+* Fri Jul 14 2023 Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.8-1
+- Upgrade to the latest upstream release (rhbz#2217441)
+- Add offline support for sysctl probe (rhbz#2185791)
+- Fix systemd* probes unit enumeration (rhbz#2219533)
+
+* Fri Jan 27 2023 Jan Černý <jcerny@redhat.com> - 1.3.7-1
+- Upgrade to the latest upstream release (rhbz#2159290)
+- Fix error when processing OVAL filters (rhbz#2126882)
+- Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2139060)
+
 * Thu Jul 21 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-4
 - Fix potential invalid scan results in OpenSCAP (rhbz#2111040)
 - Remove oscap-remediate service (rhbz#2111360)