v1.2.0-beta.8

Main App Changes

• Added: A Compare Baselines button on the main menu opens the new Baseline Compare Hub.

Baseline Compare Hub (New)

• Added: A new hub for comparing two baselines side by side: different frameworks, OS versions, mSCP sources, or one of your own MACE projects. Summary counts and All / Left / Right / Differences filters show what only one side includes and what differs, with each rule's ODV, check, fix and references compared in a sidebar.
• Added: Compare a project against its framework to see only your real changes, with removed, exempt and edited rules marked as in the Compliance Editor. Search by STIG ID or CCE, ignore wording, check or fix changes that don't affect the requirement, and export the comparison as CSV, Markdown or HTML.

Compliance Editor Changes

• Fixed: Rules that change their check or fix for a specific OS version (e.g. audit_auditd_enabled on macOS 15) now use that version's check and fix in the Compliance Editor, compliance script, Tenable audit and documentation, instead of the default for every version.

Build Hub Changes

• Fixed: The Fleet Failed Rules report, which lists the failing rules on each Mac, was accidentally removed during the beta updates. It's back, uploading with the compliance policy in both Combined and Per Rule modes.
• Added: The Fleet GitOps files, in both the upload archive and Local Build output, now include the report in a reports: section.
• Fixed: Macs that had never run the compliance script showed as passing in Fleet, because there were no results to fail on. The compliance policies (Combined and Per Rule) now fail until the script has run, and the report shows a No data present row for those Macs. When a policy fails, Fleet shows text explaining that the Mac may just need the script run. Existing policies pick this up on your next export.
• Fixed: Re-exporting to Fleet failed with "A script with this name already exists" whenever the compliance policy was set to run the script on failing Macs. The script is now updated in place, so the policy stays linked to it.
• Fixed: Accounts with access to specific fleets only (for example, Admin on one fleet) got false "missing access" warnings for profiles and scripts, and a false OK for policies that then failed on upload. MACE now reads your roles when you test the connection and checks access for the fleet you pick, including flagging read-only Observer accounts. It re-checks right away when you switch fleets.
• Changed: Accounts with access to specific fleets only no longer see Unassigned in the fleet picker, since Fleet won't let them upload there. After a connection test, MACE selects the first fleet you can upload to.
• Changed: File Based Rules (DDM assets) is turned off for accounts with access to specific fleets only, because Fleet only lets global roles manage assets.
• Changed: The line under the fleet picker now shows your role, for example "you're Admin here", and stays on one line. Long fleet names are shortened, and the picker keeps the same size whatever the name.

Audit Builder Hub Changes

No changes this release.

Documentation Builder Hub Changes

No changes this release.

Rule Builder Hub Changes

No changes this release.

Feedback Needed

We'd love your help testing features to make sure everything works as expected.

If you run into any issues or have suggestions, please open an issue at github.com/mace-app/mace.

Known Issues

• mSCP Engines: I expect issues with the mSCP engines since they rely on the mSCP 2.0 Python scripts, which don't have everything fully mapped out yet.
• mSCP Engines: Custom rules are not currently supported.
• UI font sizing: May vary depending on your system's accessibility, display, or font settings. A fix requires reworking fonts across every screen, so this is on hold for now.
• (Sequoia & Below): Glass/blur effects don't look quite right on older macOS versions. Adjusting visuals to work well without these effects will take time.
• Console logging: May not capture all events. Logging is being improved incrementally as features are updated.