<div dir="ltr"><div>Hi Jan,</div><div><br></div><div>Thanks for the bugzilla link that mentions "0.1.44 SCAP Security Guide produces SCAP 1.3 conformant datastreams" which I believe is cause of the problem I am seeing, as my last complete scans were with SSG 0.1.43.</div><div><br></div><div>As to what is broken, the HTML report has empty lines for "Rule results" and "Severity of failed rules", and nothing between the "Title | Severity | Result" heading and the "Show all results details" at the bottom.</div><div><br></div>I expect I'll be using OpenSCAP 1.2. 17 for a while, as building on production servers is unlikely. With an improved pipeline (in the works) this may change, but not immediately.<br><br>This is the failingOpenSCAP invocation:<br>===<br><div> oscap xccdf eval<br> --fetch-remote-resources<br> --results-arf /opt/compliance/openscap/reports/{{ SCAP_TARGET }}-report.xml<br> --report /opt/compliance/openscap/reports/{{ SCAP_TARGET }}-report.html<br> --profile xccdf_org.globalnet_profile_stig-rhel7-disa_tailored<br> --tailoring-file /opt/compliance/openscap/config/ssg-rhel7-ds-tailoring.xml<br> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml<br>===<br><br>I believe adding a "-1.2" to the xccdf:benchmark in 'ssg-rhel7-ds-tailoring.xml' may be the bandaid I need (as described in [1])?<br>===<br><xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml"/><br>===</div><div><br></div><div>Unsure. Will test. Is there a preferred mechanism that I am missing?<br></div><div><br></div><div>[1] <a href="https://github.com/ComplianceAsCode/content/releases/tag/v0.1.46">https://github.com/ComplianceAsCode/content/releases/tag/v0.1.46</a></div><div><br></div><div>=Fen</div><div><br></div><div><br></div><div>On Mon, May 4, 2020 at 4:55 AMJan Cerny <<a href="mailto:jcerny@redhat.com">jcerny@redhat.com</a>> wrote:</div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Fen,<br>
<br>
On RHEL7 you can build OpenSCAP 1.3.3 from source code. Check [1] for<br>
instructions. Unfortunately, RHEL 7 won't ship OpenSCAP 1.3.x as a<br>
RPM package, because OpenSCAP 1.3.x isn't API compatible with the<br>
1.2.x versions.<br>
<br>
But, OpenSCAP and SSG in RHEL7 should work together. There was a fix<br>
[2] in RHEL7 for OpenSCAP to work with SCAP 1.3 data streams. Can you<br>
tell us how your scans are broken?<br>
<br>
Regards<br>
<br>
[1] <a href="https://github.com/OpenSCAP/openscap/blob/maint-1.3/docs/developer/developer.adoc#building-openscap-on-linux" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/openscap/blob/maint-1.3/docs/developer/developer.adoc#building-openscap-on-linux</a><br>
[2] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1709423" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1709423</a><br>
<br>
<br>
<br>
On Mon, May 4, 2020 at 5:06 AM Fen Labalme <<a href="mailto:fen.labalme@civicactions.com" target="_blank">fen.labalme@civicactions.com</a>> wrote:<br>
><br>
> Awesome - great work - thank you!<br>
><br>
> Is there an easy way to have 1.3.x installed on RHEL/7 instances? Yum is installing 1.2.17 and since (the default) SSG 0.1.46 is now defaulting to 1.3 data streams, my scans are broken.<br>
><br>
> Thanks again!<br>
> =Fen<br>
><br>
> CivicActions Inc. | Making Compliance Secure<br>
> +1.412.996.4113 | <a href="http://civicactions.com" rel="noreferrer" target="_blank">civicactions.com</a><br>
><br>
><br>
> On Sun, May 3, 2020 at 3:38 PM Evgeny Kolesnikov <<a href="mailto:ekolesni@redhat.com" target="_blank">ekolesni@redhat.com</a>> wrote:<br>
>><br>
>> Hello!<br>
>><br>
>> We are proud to announce the OpenSCAP release 1.3.3. This release is<br>
>> based on the main-1.3 branch, and it is backward-compatible<br>
>> with 1.3.x releases.<br>
>><br>
>> Notable improvements in this release:<br>
>> - a Python script that can be used for CLI tailoring (autotailor)<br>
>> (thank you, Matěj Týč);<br>
>> - timezone for XCCDF TestResult start and end time (thank you, Jan Černý);<br>
>> - new yamlfilecontent independent probe (draft implementation),<br>
>> see the proposal <a href="https://github.com/OVAL-Community/OVAL/issues/91" rel="noreferrer" target="_blank">https://github.com/OVAL-Community/OVAL/issues/91</a><br>
>> for additional information.<br>
>><br>
>> There are other changes as well, here is the list:<br>
>> - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF;<br>
>> - Added ability to generate `machineconfig` fix;<br>
>> - Detect ambiguous scan target (utils/oscap-podman);<br>
>> - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory;<br>
>> - The data system_info probe return for offline and online modes is<br>
>> consistent and actual;<br>
>> - Prevent crashes when complicated regexes are executed in<br>
>> textfilecontent58 probe;<br>
>> - Fixed #1512: Severity refinement lost in generated guide;<br>
>> - Fixed #1453: Pointer lost in Swig API;<br>
>> - Evaluation Characteristics of the XCCDF report are now consistent<br>
>> with OVAL entities;<br>
>> from system_info probe;<br>
>> - Fixed filepath pattern matching in offline mode in textfilecontent58 probe;<br>
>> - Fixed infinite recursion in systemdunitdependency probe;<br>
>> - Fixed the case when CMake couldn't find libacl or xattr.h.<br>
>><br>
>> Also thanks to all our contributors, who helped to make this release.<br>
>><br>
>> Download:<br>
>> <a href="https://github.com/OpenSCAP/openscap/archive/1.3.3.tar.gz" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/openscap/archive/1.3.3.tar.gz</a><br>
>><br>
>> SHA512:<br>
>> e230668cdf900a2f31ccabc20787dce6c4174740aa7d2cc7b91c1c095e2a5b73d81bb614aa767d2e51383b5472def360c4204e9a6c4c85110c58b9999566613e<br>
>><br>
>> Enjoy!<br>
>><br>
>> On behalf of OpenSCAP contributors<br>
>><br>
>> Evgenii Kolesnikov,<br>
>> Red Hat, Inc.<br>
>><br>
>><br>
>> _______________________________________________<br>
>> Open-scap-list mailing list<br>
>> <a href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br>
>> <a href="https://www.redhat.com/mailman/listinfo/open-scap-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a><br>
><br>
> _______________________________________________<br>
> Open-scap-list mailing list<br>
> <a href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br>
> <a href="https://www.redhat.com/mailman/listinfo/open-scap-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a><br>
<br>
<br>
<br>
--<br>
Jan Černý<br>
Security Technologies | Red Hat, Inc.<br>
<br>
</blockquote></div></div>