NEWS

openscap-1.2.6                                                  05-10-2015
  - New features
    - introduced OpenSCAP user manual
    - improved OVAL 5.11.1 support
      - added OVAL 5.11.1 XSD schemas and schematrons
      - support for core/platform schema versions
      - support for check_existence attribute in state entities
      - support for CIM datetime format
      - amended behavior of mask attribute
    - added support for remote .xml.bz2 files (use with
--fetch-remote-resources)
    - rewrote oscap-docker to python, deeper integration with Atomic Host
    - introduced CPE name for Fedora 24 to the internal dictionary
  - HTML report & guide
    - results can be grouped by according to various aspects
    - printing supported (interactive elements are now hidden when printing)
    - table of content now shows only selected items (rule & groups)
    - references to RHSA are presented as links to website (rhbz#1243808)
  - Maintenance
    - scap-as-rpm can now build source rpm packages (srpms) (trac#469)
    - scap-as-rpm now supports python3
    - refactored oval processing into oval_session structure
    - many smaller bugfixes and new tests

openscap-1.2.5                                                  06-07-2015
 - maintenance
   - smaller bugfixes
   - plugged memory leaks
   - fixed fresh static analysis (coverity) findings
   - fixed shellcheck warnings
   - fixes for Solaris platform

openscap-1.2.4                                                  21-06-2015
 - new features
   - OVAL 5.11 support 99.8% completed!
     - new symlink probe introduced
     - new process58 test capabilities
     - added possible_value support for external variables
     - added possible_restriction support for external variables
     - improved IP address comparisons
   - Added Scientific Linux CPEs
   - Added oscap-docker tool
   - Created man-page for oscap-ssh
 - HTML changes
   - improved visibility of selected XCCDF profile in guides and reports
   - render rule-result/message contents in reports
 - maintenance
   - Tests now pass on ppc64 little endian arch (rhbz#1215220)
   - partition probe now supports remount, bind and move mount options
   - Patched NIST OVAL-5.11 schemas to be backward compatible with
     OVAL-5.10 (rhbz#1220262)
   - fixed scap-as-rpm to work with vintage python (2.6)
   - better error reporting when a probe dies (i.e. due to OOM killer)
   - dropped selinux policy from upstream (rhbz#1209969)
   - fix segfault on invalid selectors (rhbz#1220944)
   - solaris support patches: file-system zones, systeminfo improvements
   - many smaller fixes and new tests

openscap-1.2.3                                                  01-05-2015
 - new features
   - oscap-ssh -- handy utility to run remote scan over ssh
   - glob_to_regexp OVAL function added
 - HTML changes
   - show rationale elements
   - show fixtext elements
   - show Benchmark's front-matter, description and notices
   - show warnings for Groups and Rules
   - improved handling of multiple fixes within a single Rule
   - scroll evaluation characteristic if they overflow
 - maintenance
   - OVAL 5.11 schema fixes
   - coverity and mem leak fixes
   - skip transient files when traversing /proc (trac#457)

openscap-1.2.2                                                  02-04-2015
 - new features
   - OVAL 5.11 support turned on by default
   - included OVAL 5.11 schematron rules
   - DataStream can now contain OVAL 5.11
   - `oscap ds sds-compose` now supports --skip-valid parameter
 - HTML report changes
   - Notably increased level of OVAL details
   - Table of contents is now generated for HTML guides
 - maintenance
   - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting
   - solaris build fixes
   - xccdf:fix/instance processing fixes
   - improved (none) epoch processing in rpm probe
   - environmentvariable58 now emits warning messages when appropriate
   - offline mode improvements
   - other bugfixes

openscap-1.2.1                                                  01-10-2015
 - API changes
   - 5.11 schemas updated (from RC1 to gold)
   - oscap_source_new_from_memory can take bzip2ed content
 - HTML report changes
   - severity bar is now reversed (left-to-right)
 - maintenance
   - rhbz#1165139 - fix probe cancelation
   - dozen of bugfixes

openscap-1.2.0                                                  02-12-2014
 - new features
   - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2')
   - improved performance on huge XML documents, especially DataStreams
   - minimized use of temp files to absolute minimum
   - added OVAL-5.11 release candidate schemas
 - API changes
   - overall 50 new symbols added to public API
   - introduced oscap_source abstraction for input files
     - all the parsers converted to use oscap_source abstraction
   - introduced ds_sds_session, high level API for playing with Source DataStreams
   - introduced cpe_session, abstraction to approach multiple CPE resources
   - introduced ds_rds_session, high level API for playing with Result DataStreams
     (ARF files)
   - deprecated dozens of API calls dependent on filepath
   - introduced API for waivers (xccdf:override) and modification of ARF
     - initial support for waivers in HTML Report
   - dozens of small improvements
 - maintenance
   - dozens of small fixes
   - dozens of memory leaks (whole test suite is now leak free)
   - updated gnulib

openscap-1.1.1                                                  26-09-2014
 - Hint towards `oscap info` when profile is not found in oscap tool
 - HTML report changes:
   - Source OVAL results from ARF if available
   - Highlight notchecked rules, treat them as rules that need attention
 - HTML guide changes:
   - Variable Substitution improvements
   - Show benchmark title
   - Show info about selected profile
   - Avoid cdf12:notice, show only its contents
 - bugfixes:
   - improved handling of fqdn in XCCDF
   - memory leaks
   - static analysis fixes

openscap-1.1.0                                                  03-09-2014
 - HTML report and guide redesign
 - dropped support for docbook
 - Introduced new probes (that are to be part of OVAL 5.11)
   - probe_systemdunitproperty
   - probe_systemdunitdependency
 - introduced raw bindings for python3
 - dozens of small bug fixes

openscap-1.0.9                                                  25-06-2014
 - xccdf_session_export_arf must not return 0 if the export failed
 - expose xccdf_policy_get_value_of_item as public API
 - skip "Signature" when parsing sds_index without spewing out an error
 - return non-zero when cannot resolve XCCDF
 - consider the last set-value as the effective set-value and export only one
 - test suite fixes
 - do not destroy SVG data in XCCDFs when generating guide or report

openscap-1.0.8                                                  26-03-2014
 - fixes related to Asset Reporting Format
   - Inject arf:report/@id into nested rule-result/check/check-content-ref/@href
   - Add hostname for each fqdn when generating ARF asset identification data
   - Add all MAC addresses from target-facts to ARF as asset identification data

openscap-1.0.7                                                  20-03-2014
 - fix namespaces for attributes in ARF relationship element
 - Avoid ".00" as the score in HTML report when score is 0.

openscap-1.0.6                                                  19-03-2014
 - fix process58 loginuid integer handling on 32bit

openscap-1.0.5                                                  14-03-2014
 - XCCDF titles and description support xccdf:sub resolution
 - HTML Report lists only applicable cpe platforms
 - TestResult element contains applicable cpe platforms
 - Introduced XCCDF 1.2 schematron validation
 - XCCDF bug fixes
    - tailoring profiles shall regards inherited refine-values (trac#373)
    - rule-result now always includes at least one check
 - Other bug fixes:
    - Dpkginfo probe collects epoch in evr
    - Updated examplary openscap-content based on the latest facts from
      Red Hat Enterprise Linux 6
    - Minor changes

openscap-1.0.4                                                  13-02-2014
 - Introduced xccdf_tailoring_remove_profile to API
 - OVAL bug fixes

openscap-1.0.3                                                  14-01-2014
 - bug fixes
    - a few coverity issues
    - a few memory leak plugs
    - broken comparison of huge intin OVAL (rhbz#1052142)

openscap-1.0.2                                                  10-01-2014
 - XCCDF generate fix now supports tailoring file
 - XCCDF bug fixes
    - Generate guide points to RHSA pages (rhbz#1018291)
    - Generate report ommits remediation when assesment passed (rhbz#1029879)
    - $PATH variable is available for SCE checks (rhbz#1026833)
    - Tailoring of top-level Group elements via API fixed
    - Fix-filtering should not drop fixes (affected SSG)
    - Generated fix file is created with sane permissions (trac#362)
    - Inherit parent's namespace when exporting oscap_text with HTML trait
 - OVAL bug Fixes:
    - Handful of xinetd probe fixes
    - Handful of process and process58 fixes
    - Obsoleted textfilecontent now supports text ent comparisons
    - rpm*_item/epoch is reported as '(none)' when needed
    - Fixed dozen of flaws in ipv4 and ipv6_address comparison (CIDR handling)
    - Made integer and floating type number parsing much stricter
    - Fixed floating point numbers comparisons (trac#366)
    - Fixed case-insensitive comparisons
    - Item filtering fixes in probes
    - Consolidated some of comparisons in results model and probes (trac#367)
 - Other bug fixes:
    - Workaround libxml2 bug handling x509 xmldsig (gnomebz#350248)
    - Fixed static build (--disable-shared)
    - Format assertions (-Werror=format-security) turned on by default
    - SCE scripts are notified when parent (oscap) is killed
    - oscap info now recognizes all the document types (adeded: tailoring & CVE)
    - Documentation improvements
    - Handful of other minor fixes

openscap-1.0.1                                                  28-11-2013
 - versioned interface is used to handle internal SCE plug-in
 - build-in gnulib package was updated to current version
 - bugfixes
    - selinux_domain_label and posix_capability properties
      were reintroduced to OVAL system characteristics model
    - selinux_domain_label now collects the domain/type (not the context)
    - oscap oval collect reports progress on stdout (not on the stderr)
    - typo in the manual page (rhbz#1032537), and another small clarification

openscap-1.0.0							19-11-2013
 - Improved heuristic to distinguish 'local' and 'remote' file systems
 - Improved comparison of EntityStateEVRStringType (trac#355)
 - Link against librpm (if available) to include rpmvercmp
   (on other platforms we fall back to the build-in rpmvercmp)
 - Bug fixes

openscap-0.9.13							08-11-2013
 - Moved SCE to separate shared library (libopenscap_sce.so)
 - Introduction of scap-as-rpm tool
 - Improvements of sql and sql57 probes
 - Improvements of SELinux policy
 - Amendments based on SCAP 1.2 Errata (sp800-126r2-errata-20120409.pdf)
 - Minor improvements in state_entity processing
 - Introduction of CPE name for Fedora 21 to the internal dictionary
 - Added support for ind-def:pid/@xsi:nil (rhbz#1013011)
 - Improved error reporting
 - Bug fixes
   - Changed CPE name regex to be more permissive
   - avoided reports from the library to the stdout and stderr
   - plugged several memory leaks
   - improved xccdf:check-content-refs processing
   - misspelling in syslog message (rhbz#1021695)
   - fixed OVAL's <field> element processing
   - fixes based on static analysers
   - test suite is locale independent

openscap-0.9.12							12-09-2013
 - tailoring improvements (@id, version, and benchmark ref attributes)
 - XCCDF 1.1 tailoring extension
 - improved robustness of CPE dictionary parser and exporter
   - and added misc CPE 2.3 elements
 - added Fedora 20 to internal CPE dictionary
 - updated OVAL's results_to_html stylesheet from Mitre Corporation.
 - profiles with duplicate selects (same @idref) now export correctly
 - test improvements
 - bug fixes
   - fixed IPv6 export in TestResult/target-address
   - consistently inject target-id-ref into TestResult in ARFs
   - improved rpmdb manipulation (rhbz#999903)
   - solaris build fixes
   - spelling of name of default language fixed (oscap_text related)
   - fixed CPE names matching (generalization vs. specialization)

openscap-0.9.11							17-07-2013
 - bug fixes

openscap-0.9.10							12-07-2013
 - bug fixes

openscap-0.9.9							10-07-2013
 - --oval-results also exports CPE OVAL results
 - added --benchmark-id to select a component-ref by ID of Benchmark it's pointing to
 - OVAL variable_instance processing (or so called value multiset) and the processing
   of @variable_instance attribute to OVAL Result Definition, OVAL Result Test and
   Collected Objects.
 - improved test coverage of OVAL variable processing
 - introduced new internal data type: oval_smc
 - added support for evaluating OVAL definitions against an RPM database, a.k.a. rpm
   database offline mode
 - bug fixes and dead code removal

openscap-0.9.8							17-06-2013
 - added experimental support for offline mode scanning to the OVAL
   check engine (i.e. scanning of virtual host disk images)
 - improved OVAL variables processing
 - bug fixes and dead code removal

openscap-0.9.7							26-04-2013
 - bug fixes

openscap-0.9.6							23-04-2013
 - new command-line module added as preview: "oscap ds sds-add"
 - improved xccdf:fix processing (support of DataStreams and CPE)
 - internal selinux policy preview
 - added Fedora 19 to default CPE dictionary
 - bug fixes

openscap-0.9.5							19-03-2013
 - oscap xccdf remediate (new oscap module which introduces offline
   remediation; the remediation based on existing xccdf:TestResult file)
 - added support for SCE into DataStream (SCE scripts can now be
   embedded into the DataStream file similarly as OVAL can)
 - improved bash completion and documentation
 - bug fixes

openscap-0.9.4							26-02-2013
 - high Level API
 - improved Text Substitution Processing
 - technical Preview of Online Remediation Execution
   (the oscap xccdf eval --remediate)
 - improved Library Internal Error Reporting.
 - the oscap xccd export-oval-variables now support DataStreams.
 - improved documentation
 - improved schema files.
 - tailoring file support
 - profile shadowing support
 - bug Fixes

openscap-0.9.3							17-12-2012
- Embedded CPE dictionary (allows users to ommit --cpe argument)
- improvements of DataStream and CPE processing on RHEL5
- changed API of various functions in cpe_dict, benchmark and xccdf_policy to use string timestamp instead of time_t
- fixed several issues found by Coverity and cppcheck static code analysis
- bug fixes

openscap-0.9.2							19-11-2012
- rewritten the heuristic for pattern matching on path and filepath
- CPE 2.3 language applicability testing
- new ds_sds_index API providing a datastream overview
- CPEs in source datastreams are automatically registered and used
  for XCCDF evaluation
- --cpe option autodetects CPE dictionary and language
- CVE support (validate feed, print CVEs)
- introduced info module
- made "$oscap xccdf generate custom" work again -> man page update
- bug fixes

openscap-0.9.1							22-10-2012
- the http in the check-content-ref/@hrefhref support
- the cpedict support
- obsoleted the oscap_reporter
- send start and finish messages to the syslog
- the XCCDF multi-check evaluation support
- "oscap oval validate-xml" autodetect a document type
- bug fixes

openscap-0.9.0							25-09-2012
- consolidate public headers naming
- do not build untested modules
- improved support of SCAP datastreams
- various fixes in OVAL and XCCDF

openscap-0.8.5							27-08-2012
- added rpmverifypackage probe
- added initial support for source and target datastreams
- added xccdf 1.2 dc-status support
- several probes updated to conform to OVAL 5.10.1
- bug fixes

openscap-0.8.4							07-08-2012
- added OVAL schemas 5.9, 5.10.1
- alloc.h is no more public api
- bug fixes

openscap-0.8.3 							30-07-2012
- added XCCDF 1.2 schemas
- changed XCCDF report format
- updated schemas for OVAL 5.10
- added additional OVAL schemas - 5.3, 5.4, 5.5, 5.6, 5.7
- multi version support for XCCDF and OVAL
- a schema version of an imported and exported content is same
- added rpmverifyfile probe
- results are validated only if an OSCAP_FULL_VALIDATION variable is set
- bug fixes

openscap-0.8.2							28-03-2012
- XCCDF check-import support
- XSLT transformation for XCCDF 1.1 to 1.2 migration
- SCE reports now optionally use the new check-import functionality
  and don't need separate SCE result files
- bug fixes

openscap-0.8.1							15-02-2012
- introduce Script Check Engine

openscap-0.8.0							11-10-2011
- Added an OVAL Directives schema to allow for a tool
  to supply a set of directives to more easily specify
  desired results content.
- Enhanced OVAL Results directives to allow for more flexibility
  in allowed results content
- added new OVAL objects(all OVAL 5.8 objects are covered now)
- update dpkgprobe
- all issues reported by coverity are fixed
- add capability to export OVAL Variables from XCCDF
- added cvss score calculator from vector

openscap-0.7.4							25-07-2011
- support set operations on Set Objects
- add support for an unbounded filter element in all objects
- fix various datatype changes in object items
- SOLARIS integration(get existing probes working, dist files)
- support new OVAL objects: environmentvariable58, filehash58, selinuxboolean
- extend oscap tool(validate all imports and exports)
- bug fixes (make check in test/mitre)

openscap-0.7.3							24-06-2011
- start migration to OVAL 5.8
- new probes and schemas from OVAL 5.8
- RHEL6 SCAP content is in good shape
- SOLARIS integration(make and make check work)
- use gnulib (better portability)
- add "analyse" mode to oscap tool
- fixes

openscap-0.7.2							13-04-2011
- OVAL 5.7 is supported
- "--skip-valid" option in oscap tool
- bugfixes

openscap-0.7.1							08-03-2011
- improve library selfcheck mechanism
- substitution support in XCCDF
- mostly bug-fixes and cleanups

openscap-0.7.0							10-02-2011
- OVAL 5.6 is supported
- async stop of evaluation by signal
- bugfixes

openscap-0.6.8							31-01-2011
- support more than one state inside OVAL tests
- initial implementation of filepath element
- add 'mask' attribute support
- support PCRE in object-state comparison
- support unstructured 'metadata' elements in OVAL definitions
- interface probe support 'type' entity
- support for new 'behaviors' attributes
- add OVAL schemas version 5.6
- improved XCCDF reporting (include OVAL result items)
- bugfixes and clean ups

openscap-0.6.7							14-01-2011
- new CPE dict. match functionality in oscap
- bugxifes

openscap-0.6.6							09-12-2010
- better atomic functions support check

openscap-0.6.5							01-12-2010
- propagate probe communication errors upwards
- functions for handling OVAL "generator"
- implement oval_probe_session_abort
- RHEL5 related fixes
- libtool versioning

openscap-0.6.4                                                  20-10-2010
- perl regular expression is on by default
- OVAL float type support
- fix non-compliant handling of empty variables in OVAL
- directory traversal algorithm made-over, avoid loops
- add RHEL5 spec file and related fixes
- XSL transformation improvements + Dublin Core support
- fixing XCCDF export functionality

openscap-0.6.3                                                  14-09-2010
- support filters inside objects
- optimizing memory consumption
- proper result for unsupported OVAL objects
- many improvements in XSLT transformations
- supporting  OVAL incomplete objects 
- fixes in directories traversal (findfiles)
- python API improvements
- Fedora SCAP content improvements

openscap-0.6.2                                                  25-08-2010
- provide draft of fedora14 XCCDF and OVAL content
- XSL transformations for generating report and guidance
- memory optimalizations for  file probe
- add probes: sql and xinetd
- new modular design of oscap tool
- OVAL API refactor and clean up
- debug mechanism clean up
- improved python bindings
- many many fixes

openscap-0.6.0							14-07-2010
- finished OVAL variables support
- fixed swig version requirement
- xccdf_policy API tuned up
- simplified reporting mechanism
- provided OVAL and XCCDF schemas in tarball
- improved interface for validation
- added validation and cvss support to oscap tool
- oscap tool fixes

openscap-0.5.12                                                 30-06-2010
- OVAL high level API
- OVAL split system querying and evaluation
- OVAL variables rebind functionality 
- XCCDF_POLICY - OVAL integration
- XCCDF_POLICY - scanner implementation
- XCCDF - implementation resolve(),
- XCCDF - fixes in clone()
- XCCDF - fixes and test for export()
- XCCDF - value handling
- probes - documentation
- probes - reset()
- probes - leaks
- bindings  - callback interface
- transform oscap-scan to oscap toolkit

openscap-0.5.11							26-05-2010
* leak fixes on side of probes
* variables support almost in all probes
* new probes: environment variable, variable
* semantic validation of variable model
* library selftests for new probes
* xccdf export and clone functions
* xccdf_policy python/perl wrappers
* bugfixes

openscap-0.5.10							07-05-2010
- fixing many many leaks
- variables support in: findfiles and process, password probes
- new probes: textfilecontent
- semantic validation available for: syschar model, result model
- library selftests: two new tests, skiping missing probes
- documentation: better coverege of  "common" part
- xccdf_policy: new variables support

openscap-0.5.9							16-04-2010
- built on windows (without probe support)
- better support on RHEL5
- OVAL model validation functionality
- OVAL, XCCDF xml file validation functionality
- update XCDDF model manipulation functions
- introduction of XCCDF_POLICY tailoring interface
- new probes: filemd5, filehash
- removed libnl dependency
- extended and improved library selfcheck
- alternative solution to atomic functions based on mutex
- many many fixes

openscap-0.5.8							24-03-2010
- new s-expr parser
- new probes from unix schema
- file probe optimization
- xccdf test_results implementation
- extended OVAL API
- documentaion update for OVAL + probes
- tuned fedora content
- initscript, cron job, oscap-scan (improved)
- XCCDF_POLICY API specification
- fixes(make distcheck pass)

openscap-0.5.7							21-02-2010
- Debian dpkginfo probe is available now
- RHEL5 support
- new command line tool - OVAL scanner 
- Fedora 12 OVAL content available
- documentation is heavy updated (with class diagrams)
- new tests in make check
- minor API changes
- C++ reserved names cleanup

openscap-0.5.6							04-01-2010
- OVAL API has been extended
- OVAL doxygen documentation is available
- migration to new checking mechanism is completed
- new logging and error propagating mechanism
- many many bugfixes + defensive code 

openscap-0.5.5							12-11-2009
- many fixes in OVAL
- new system_info probe in OVAL
- CVE is re-implemented
- migration to improved testing mechanism has begun (see CPE)
- bindings are merged into single module called openscap

openscap-0.5.4							23-10-2009
- new CPE model
- evaluation of set objects and system characteristic output
- bindings clean up
- probes tune up, memory leaks fixes 

openscap-0.5.3							29-09-2009
- OVAL results part is code complete
- improved memory management of definition and system characteristic model (OVAL)
- improved memory management of S-expressions
- new probe API
- refactoring 

openscap-0.5.2							19-08-2009
- new family probe
- simple objects in OVAL content can be processed
- initial implementation of conversion of S-Expressions to System Characteristic
- bugfixes 

openscap-0.5.1							03-08-2009
- all code except oval is after refactoring
- populating of system-characteristics model from xml is available
- implementation of probes: rpminfo, runlevel, textfilecontent54,xmlfilecontent is done
- perl and python bindings are up2date 

openscap-0.3.2							24-04-2009
- perl bindings are available

openscap-0.3.1							09-04-2009
- python bindings for CPE, CCE, CVE and CVSS
- OVAL can load definitions


openscap-0.1.4							29-03-2009
- first official release
- CPE, CCE, CVE and CVSS are implmented