diff --git a/.github/workflows/dependabot.yml b/.github/dependabot.yml
similarity index 100%
rename from .github/workflows/dependabot.yml
rename to .github/dependabot.yml
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6841a38162..675fafed89 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,10 +5,11 @@ name: Gating
 # Controls when the action will run. Triggers the workflow on push or pull request
 # events but only for the main branch
 on:
+  workflow_dispatch:
   push:
-    branches: [ maint-1.3 ]
+    branches: [ main, maint-1.3 ]
   pull_request:
-    branches: [ maint-1.3 ]
+    branches: [ "*" ]
 
 permissions:
   contents: read
@@ -23,7 +24,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-22.04]
+        os: [ubuntu-22.04, ubuntu-24.04]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -36,7 +37,7 @@ jobs:
     - name: Install Deps
       run: |
         sudo apt-get update
-        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
+        sudo apt-get -y install lcov swig procps xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest libpopt-dev libopendbx1-dev libbz2-dev libglib2.0-dev
         sudo apt-get -y remove rpm
 
     # Runs a set of commands using the runners shell
@@ -59,7 +60,7 @@ jobs:
       image: fedora:40
     steps:
     - name: Install Deps
-      run: dnf install -y cmake git dbus-devel GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre2-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace python3-pytest
+      run: dnf install -y cmake git dbus-devel procps-ng GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre2-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace python3-pytest
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
@@ -75,53 +76,40 @@ jobs:
         export $(dbus-launch)
         ctest --output-on-failure
 
-  build-windows:
-    name: Build on Windows
-    runs-on: windows-latest
-    env:
-      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-    steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+  build-macos:
+    # The type of runner that the job will run on
+    name: Build, Test on macOS Latest
+    runs-on: macos-latest
 
-    - name: Checkout vcpkg
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
-        path: ${{ github.workspace }}/vcpkg
-        repository: microsoft/vcpkg
-        fetch-depth: 1
-
-    - name: Bootstrap vcpkg
-      shell: pwsh
-      run: |
-        & "$env:GITHUB_WORKSPACE\vcpkg\scripts\bootstrap.ps1" -disableMetrics
+        submodules: recursive
 
-    - name: Export GitHub Actions cache environment variables
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-      with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
     - name: Install Deps
       run: |
-        & "$env:GITHUB_WORKSPACE\vcpkg\vcpkg.exe" install curl libxml2 libxslt bzip2 pcre pthreads zlib getopt-win32 xmlsec --triplet x64-windows
-
-    - name: Configure
+        # Unlink and re-link to prevent errors when GitHub Mac runner images
+        # install Python outside of Brew:
+        brew list -1 | grep python | while read formula; do brew unlink $formula; brew link --overwrite $formula; done
+        brew update
+        brew install doxygen
+        brew install opendbx
+        brew install pkg-config
+        brew install popt
+        brew install swig
+        brew install libxmlsec1
+        brew install openssl
+        brew install pcre
+
+    - name: Build OpenSCAP
       working-directory: ./build
-      run: cmake -DCMAKE_BUILD_TYPE=Release -DENABLE_PYTHON3=FALSE "-DCMAKE_TOOLCHAIN_FILE=$env:GITHUB_WORKSPACE/vcpkg/scripts/buildsystems/vcpkg.cmake" ..
+      run: |
+        cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DENABLE_PROBES=False -DWITH_PCRE2=True ../
+        make all
 
-    - name: Build
-      run: cmake --build . --config Release
+    - name: Test
       working-directory: ./build
-
-    - name: Package
-      run: cpack
-      working-directory: build
-
-    - name: Upload Artifacts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-      with:
-        name: openscap-win64
-        path: |-
-          build\OpenSCAP*.msi
-          build\OpenSCAP*.msi.sha512
+      run: |
+        echo "Tests are so broken for macOS :("
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9ce2a46c3d..b045804f08 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
     - name: Install Deps
       run: |
         sudo apt-get update
-        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
+        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
         sudo apt-get -y remove rpm
 
     # Initializes the CodeQL tools for scanning.
diff --git a/.gitignore b/.gitignore
index 4a399446ce..97a0dcbc3d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 .dirstamp
 .gdb_history
 .libs/
+.tox/
 .*.swp
 *.pyc
 tags
diff --git a/.packit.yaml b/.packit.yaml
index 689930b6b5..f3cf3a35e3 100644
--- a/.packit.yaml
+++ b/.packit.yaml
@@ -14,15 +14,17 @@ jobs:
   trigger: pull_request
   metadata:
     targets:
-    - centos-stream-8-x86_64
+    - fedora-all-x86_64
     - centos-stream-9-x86_64
+    - centos-stream-10-x86_64
 
 - job: tests
   trigger: pull_request
   metadata:
     targets:
-    - centos-stream-8-x86_64
+    - fedora-all-x86_64
     - centos-stream-9-x86_64
+    - centos-stream-10-x86_64
 
 - job: copr_build
   trigger: commit
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7276e15d95..d84d935515 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 2.8...3.19)
+cmake_minimum_required(VERSION 3.18)
 
 # Inspired and referenced from https://blog.kitware.com/cmake-and-the-default-build-type
 if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
@@ -88,8 +88,6 @@ if(ACL_FOUND)
 	check_include_file(sys/acl.h HAVE_SYS_ACL_H)
 endif()
 
-find_package(AptPkg)
-
 find_package(Blkid)
 if(BLKID_FOUND)
 	check_library_exists("${BLKID_LIBRARY}" blkid_get_tag_value "" HAVE_BLKID_GET_TAG_VALUE)
@@ -609,6 +607,8 @@ if(OPENSCAP_PROBE_INDEPENDENT_YAMLFILECONTENT)
 	set_oscap_generic_properties(yamlfilter_object)
 endif()
 
+include(SetRPATH)  # mainly for development workflows and non-system install paths
+
 add_subdirectory("compat")
 add_subdirectory("src")
 add_subdirectory("utils")
diff --git a/cmake/SetRPATH.cmake b/cmake/SetRPATH.cmake
new file mode 100644
index 0000000000..8ed36d6205
--- /dev/null
+++ b/cmake/SetRPATH.cmake
@@ -0,0 +1,32 @@
+# https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+
+if(LOCAL_INSTALL_WITH_RPATH)
+    # use, i.e. don't skip the full RPATH for the build tree
+    set(CMAKE_SKIP_BUILD_RPATH FALSE)
+
+    # when building, don't use the install RPATH already (but later on when
+    # installing)
+    set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
+
+    set(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
+
+    # add the automatically determined parts of the RPATH which point to
+    # directories outside the build tree to the install RPATH
+    set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+
+    # the RPATH to be used when installing, but only if it's not a system
+    # directory
+    list(FIND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
+         "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}" isSystemDir
+    )
+    if("${isSystemDir}" STREQUAL "-1")
+        set(CMAKE_INSTALL_RPATH
+            "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}"
+        )
+    endif("${isSystemDir}" STREQUAL "-1")
+
+    message(
+        STATUS
+            "Non-system install RPATH set using ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}"
+    )
+endif()
diff --git a/openscap.spec b/openscap.spec
index fbc844192f..811926d54c 100644
--- a/openscap.spec
+++ b/openscap.spec
@@ -14,12 +14,8 @@ BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
 BuildRequires:  rpm-devel
-BuildRequires:  libgcrypt-devel
-%if 0%{?fedora}
+BuildRequires:  nss-devel
 BuildRequires:  pcre2-devel
-%else
-BuildRequires:  pcre-devel
-%endif
 BuildRequires:  libacl-devel
 BuildRequires:  libselinux-devel
 BuildRequires:  libcap-devel
@@ -131,16 +127,13 @@ Tool for scanning Atomic containers.
 
 %build
 %undefine __cmake_in_source_build
-# gconf is a legacy system not used any more, and it blocks testing of oscap-anaconda-addon
-# as gconf is no longer part of the installation medium
 %cmake \
 %if 0%{?fedora}
     -DWITH_PCRE2=ON \
 %endif
     -DENABLE_PERL=OFF \
-    -DENABLE_DOCS=ON \
-    -DOPENSCAP_PROBE_UNIX_GCONF=OFF \
-    -DGCONF_LIBRARY=
+    -DWITH_CRYPTO=nss \
+    -DENABLE_DOCS=ON
 %cmake_build
 make docs
 
@@ -155,7 +148,7 @@ ctest -V %{?_smp_mflags}
 find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 # fix python shebangs
-%if 0%{?fedora}
+%if 0%{?rhel} >= 10 || 0%{?fedora}
 %{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
 %else
 pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
diff --git a/src/common/util.c b/src/common/util.c
index a8b4a34dda..fb376a834a 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -325,7 +325,7 @@ char *oscap_strerror_r(int errnum, char *buf, size_t buflen)
 #ifdef OS_WINDOWS
 	strerror_s(buf, buflen, errnum);
 	return buf;
-#elif defined(OS_FREEBSD)
+#elif defined(OS_APPLE) || defined(OS_FREEBSD)
 	strerror_r(errnum, buf, buflen);
 	return buf;
 #else
diff --git a/tests/API/XCCDF/unittests/test_xccdf_results_arf_asset.sh b/tests/API/XCCDF/unittests/test_xccdf_results_arf_asset.sh
index 169ed7a8a4..1fd25e44f4 100755
--- a/tests/API/XCCDF/unittests/test_xccdf_results_arf_asset.sh
+++ b/tests/API/XCCDF/unittests/test_xccdf_results_arf_asset.sh
@@ -7,7 +7,7 @@ set -o pipefail
 
 function test_xccdf_results_arf_asset {
     local DS="${srcdir}/test_xccdf_results_arf_no_oval.xccdf.xml"
-    local result="results.xml"
+    local result="$(mktemp results.XXXXXXX.xml)"
     local stderr="error.log"
 
     [ -f $result ] && rm -f $result
diff --git a/tests/curl/test_curl_encoding.sh b/tests/curl/test_curl_encoding.sh
index 1c55d496b0..491aff5f68 100755
--- a/tests/curl/test_curl_encoding.sh
+++ b/tests/curl/test_curl_encoding.sh
@@ -9,7 +9,7 @@ function curl_accept_encoding {
 	require_internet || return 255
 
 	local DF="${srcdir}/ds.xml"
-	local RF="results.xml"
+	local RF="$(mktemp results.XXXXXXX.xml)"
 	local LOG="verbose.log"
 
 	$OSCAP xccdf --verbose=DEVEL eval --fetch-remote-resources --results $RF $DF 2>$LOG || echo "OK"
diff --git a/tests/probes/family/test_probes_family.sh b/tests/probes/family/test_probes_family.sh
index b480639d1a..8d03e35f70 100755
--- a/tests/probes/family/test_probes_family.sh
+++ b/tests/probes/family/test_probes_family.sh
@@ -22,7 +22,7 @@ function test_probes_family {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_family.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/file/test_probes_file.sh b/tests/probes/file/test_probes_file.sh
index 3595a4580d..49af1dc01d 100755
--- a/tests/probes/file/test_probes_file.sh
+++ b/tests/probes/file/test_probes_file.sh
@@ -22,7 +22,7 @@ function test_probes_file {
 
     local ret_val=0;
     local DF="$srcdir/test_probes_file.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
@@ -50,7 +50,7 @@ function test_probes_file_filenames {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_filename.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 	files_dir=$(mktemp -d)
 	DF_INJECTED=$(mktemp)
 
@@ -95,7 +95,7 @@ function test_probes_file_invalid_utf8 {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_filename.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 	files_dir=$(mktemp -d)
 	DF_INJECTED=$(mktemp)
 
diff --git a/tests/probes/file/test_probes_file_behaviour.sh b/tests/probes/file/test_probes_file_behaviour.sh
index b6ca6c6d4b..e4347633e1 100755
--- a/tests/probes/file/test_probes_file_behaviour.sh
+++ b/tests/probes/file/test_probes_file_behaviour.sh
@@ -40,7 +40,7 @@ function test_probes_file_behaviour {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_behaviour.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 
 	test_probes_behaviour_setup
 
diff --git a/tests/probes/fileextendedattribute/test_probes_fileextendedattribute.sh b/tests/probes/fileextendedattribute/test_probes_fileextendedattribute.sh
index 7149b52c0f..54a3e761c0 100755
--- a/tests/probes/fileextendedattribute/test_probes_fileextendedattribute.sh
+++ b/tests/probes/fileextendedattribute/test_probes_fileextendedattribute.sh
@@ -12,7 +12,7 @@ function test_probes_fileextendedattribute {
 
     local ret_val=0;
     local DEFFILE="$srcdir/test_probes_fileextendedattribute.xml"
-    local RESFILE="results.xml"
+    local RESFILE="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RESFILE ] && rm -f $RESFILE
 
diff --git a/tests/probes/filehash/test_probes_filehash.sh b/tests/probes/filehash/test_probes_filehash.sh
index 2765f4dae6..2e23c1ad6a 100755
--- a/tests/probes/filehash/test_probes_filehash.sh
+++ b/tests/probes/filehash/test_probes_filehash.sh
@@ -24,7 +24,7 @@ function test_probes_filehash {
 
     local ret_val=0;
     local DF="test_probes_filehash.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/filehash58/test_probes_filehash58.sh b/tests/probes/filehash58/test_probes_filehash58.sh
index 459654546a..0e4c61cbc3 100755
--- a/tests/probes/filehash58/test_probes_filehash58.sh
+++ b/tests/probes/filehash58/test_probes_filehash58.sh
@@ -24,7 +24,7 @@ function test_probes_filehash58_old_algos {
 
     local ret_val=0;
     local DF="test_probes_filehash58_old_algos.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
@@ -52,7 +52,7 @@ function test_probes_filehash58_new_algos {
 
     local ret_val=0
     local DF="test_probes_filehash58_new_algos.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/filemd5/test_probes_filemd5.sh b/tests/probes/filemd5/test_probes_filemd5.sh
index 90c5ff7220..cb83283c1c 100755
--- a/tests/probes/filemd5/test_probes_filemd5.sh
+++ b/tests/probes/filemd5/test_probes_filemd5.sh
@@ -23,7 +23,7 @@ function test_probes_filemd5 {
 
     local ret_val=0;
     local DEFFILE="test_probes_filemd5.xml"
-    local RESFILE="results.xml"
+    local RESFILE="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RESFILE ] && rm -f $RESFILE
 
diff --git a/tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh b/tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh
index 98e0a884d0..ff4ec602e3 100755
--- a/tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh
+++ b/tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh
@@ -16,7 +16,7 @@ function test_probes_fwupdsecattr {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_fwupdsecattr.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh b/tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh
index b824fe420b..30ef6abdd5 100755
--- a/tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh
+++ b/tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh
@@ -10,9 +10,9 @@ function test_probes_fwupdsecattr {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_fwupdsecattr_mock.xml"
-    local RF="results.xml"
+    local RF="$(make_temp_file /tmp results.xml)"
     local DBUS_MOCK_NAME="org.freedesktop.fwupd"
-    local stderr=$(mktemp test_probes_fwupdsecattr_mock.err.XXXXXX)
+    local stderr=$(make_temp_file /tmp test_probes_fwupdsecattr_mock.err)
     echo "stderr file: $stderr"
 
     [ -f $RF ] && rm -f $RF
diff --git a/tests/probes/interface/test_probes_interface.sh b/tests/probes/interface/test_probes_interface.sh
index f2b9ad6809..16d1823028 100755
--- a/tests/probes/interface/test_probes_interface.sh
+++ b/tests/probes/interface/test_probes_interface.sh
@@ -21,7 +21,7 @@ function test_probes_interface {
 
     local ret_val=0;
     local DF="test_probes_interface.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/isainfo/test_probes_isainfo.sh b/tests/probes/isainfo/test_probes_isainfo.sh
index 2f331f0821..8dd5e64420 100755
--- a/tests/probes/isainfo/test_probes_isainfo.sh
+++ b/tests/probes/isainfo/test_probes_isainfo.sh
@@ -22,7 +22,7 @@ function test_probes_isainfo {
 
     local ret_val=0;
     local DF="test_probes_isainfo.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
    
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/password/test_probes_password.sh b/tests/probes/password/test_probes_password.sh
index 4abc97a23c..f950f4fd6d 100755
--- a/tests/probes/password/test_probes_password.sh
+++ b/tests/probes/password/test_probes_password.sh
@@ -22,7 +22,7 @@ function test_probes_password {
 
     local ret_val=0;
     local DF="test_probes_password.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
    
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/password/test_probes_password_offline.sh b/tests/probes/password/test_probes_password_offline.sh
index 0e4743448e..047c62f812 100755
--- a/tests/probes/password/test_probes_password_offline.sh
+++ b/tests/probes/password/test_probes_password_offline.sh
@@ -25,7 +25,7 @@ function test_probes_password {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_password_offline.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/rpm/rpminfo/rpminfo_common.sh b/tests/probes/rpm/rpminfo/rpminfo_common.sh
index 95afc8fde9..38e3e44a21 100755
--- a/tests/probes/rpm/rpminfo/rpminfo_common.sh
+++ b/tests/probes/rpm/rpminfo/rpminfo_common.sh
@@ -24,7 +24,7 @@ function test_probes_rpminfo {
 
     local ret_val=0;
     local DF="test_probes_rpminfo.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation.sh b/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation.sh
index a46009ac17..cb10553866 100755
--- a/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation.sh
+++ b/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation.sh
@@ -11,7 +11,7 @@ function perform_test {
     rpm -qf /root || return 255
 
     DF="$srcdir/test_probes_rpmverify_not_equals_operation.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation_offline.sh b/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation_offline.sh
index 2cb2ec54d1..8e7df8d9d3 100755
--- a/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation_offline.sh
+++ b/tests/probes/rpm/rpmverify/test_probes_rpmverify_not_equals_operation_offline.sh
@@ -10,7 +10,7 @@ function perform_test {
     probecheck "rpmverify" || return 255
 
     DF="$srcdir/test_probes_rpmverify_not_equals_operation_offline.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile.sh b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile.sh
index e913a56c45..de345aec00 100755
--- a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile.sh
+++ b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile.sh
@@ -14,7 +14,7 @@ function test_probes_rpmverifyfile {
     require "rpm" || return 255
 
     DF="$srcdir/test_probes_rpmverifyfile.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_offline.sh b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_offline.sh
index 25d2c33dc0..af8bce4e0a 100755
--- a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_offline.sh
+++ b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_offline.sh
@@ -14,7 +14,7 @@ function test_probes_rpmverifyfile {
     probecheck "rpmverifyfile" || return 255
 
     DF="$srcdir/test_probes_rpmverifyfile_offline.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_older.sh b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_older.sh
index da74e46712..0a9bbf84cf 100755
--- a/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_older.sh
+++ b/tests/probes/rpm/rpmverifyfile/test_probes_rpmverifyfile_older.sh
@@ -14,7 +14,7 @@ function test_probes_rpmverifyfile {
     require "rpm" || return 255
 
     DF="$srcdir/test_probes_rpmverifyfile_older.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/shadow/test_probes_shadow.sh b/tests/probes/shadow/test_probes_shadow.sh
index 13c4746fb4..0be229cafe 100755
--- a/tests/probes/shadow/test_probes_shadow.sh
+++ b/tests/probes/shadow/test_probes_shadow.sh
@@ -22,7 +22,7 @@ function test_probes_shadow {
 
     local ret_val=0;
     local DF="test_probes_shadow.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/shadow/test_probes_shadow_offline.sh b/tests/probes/shadow/test_probes_shadow_offline.sh
index 23e91e1d78..6dc3613c89 100755
--- a/tests/probes/shadow/test_probes_shadow_offline.sh
+++ b/tests/probes/shadow/test_probes_shadow_offline.sh
@@ -24,7 +24,7 @@ function test_probes_shadow {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_shadow_offline.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/symlink/test_probes_symlink.sh b/tests/probes/symlink/test_probes_symlink.sh
index e966026c38..b5141ea370 100755
--- a/tests/probes/symlink/test_probes_symlink.sh
+++ b/tests/probes/symlink/test_probes_symlink.sh
@@ -13,7 +13,7 @@ function test_probes_symlink {
     probecheck "symlink" || return 255
 
     DF="test_probes_symlink.xml"
-    RF="results.xml"
+    RF="$(mktemp results.XXXXXXX.xml)"
 
     rm -f $RF
 
diff --git a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty.sh b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty.sh
index d1e9114bb5..826d96eb3c 100755
--- a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty.sh
+++ b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty.sh
@@ -16,7 +16,7 @@ function test_probes_systemdunitproperty {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_systemdunitproperty.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
     local stderr=$(mktemp $1.err.XXXXXX)
     echo "stderr file: $stderr"
 
diff --git a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_mount_wants.sh b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_mount_wants.sh
index 3e9bdce843..9c5edc3382 100755
--- a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_mount_wants.sh
+++ b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_mount_wants.sh
@@ -15,7 +15,7 @@ function test_probes_systemdunitproperty_mount_wants {
     systemctl show -- -.mount | grep -Eq "Wants=\S+" || return 255
 
     local DF="${srcdir}/test_probes_systemdunitproperty_mount_wants.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_offline_mode.sh b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_offline_mode.sh
index 58d0bd2c9a..3a03fb53f8 100755
--- a/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_offline_mode.sh
+++ b/tests/probes/systemdunitproperty/test_probes_systemdunitproperty_offline_mode.sh
@@ -17,7 +17,7 @@ function test_probes_systemdunitproperty_offline_mode {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_systemdunitproperty_offline_mode.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
     local stderr=$(mktemp $1.err.XXXXXX)
     echo "stderr file: $stderr"
 
diff --git a/tests/probes/textfilecontent54/test_negative_instance.sh b/tests/probes/textfilecontent54/test_negative_instance.sh
index 960664fb15..207a251507 100755
--- a/tests/probes/textfilecontent54/test_negative_instance.sh
+++ b/tests/probes/textfilecontent54/test_negative_instance.sh
@@ -8,7 +8,7 @@ function test_negative_instance {
 	
     local ret_val=0;
     local DF="${srcdir}/test_negative_instance.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
     
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/textfilecontent54/test_probes_textfilecontent54.sh b/tests/probes/textfilecontent54/test_probes_textfilecontent54.sh
index 7d9301831f..6b30cf51aa 100755
--- a/tests/probes/textfilecontent54/test_probes_textfilecontent54.sh
+++ b/tests/probes/textfilecontent54/test_probes_textfilecontent54.sh
@@ -20,7 +20,7 @@ function test_probes_textfilecontent54 {
 	
     local ret_val=0;
     local DF="${srcdir}/test_probes_textfilecontent54.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
     
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/uname/test_probes_uname.sh b/tests/probes/uname/test_probes_uname.sh
index 461dcd98ee..9c055d45dc 100755
--- a/tests/probes/uname/test_probes_uname.sh
+++ b/tests/probes/uname/test_probes_uname.sh
@@ -23,7 +23,7 @@ function test_probes_uname {
 
     local ret_val=0;
     local DF="test_probes_uname.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
     
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh
index 695a247b3f..57ec538fa2 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh
@@ -8,7 +8,7 @@ function test_probes_yamlfilecontent_array {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_yamlfilecontent_array.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_content.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_content.sh
index f836ea3a91..271235dc30 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_content.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_content.sh
@@ -7,7 +7,7 @@ set -e -o pipefail
 probecheck "yamlfilecontent" || exit 255
 
 oval_file="${srcdir}/test_probes_yamlfilecontent_content.xml"
-result="results.xml"
+result="$(mktemp results.XXXXXXX.xml)"
 
 [ -f $result ] && rm -f $result
 
@@ -21,4 +21,4 @@ assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="foo
 assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype="boolean" and text()="true"]'
 assert_exists 2 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="<value>"]'
 
-rm -f "$result"
\ No newline at end of file
+rm -f "$result"
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh
index a942552e9c..ad44885752 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh
@@ -8,7 +8,7 @@ function test_probes_yamlfilecontent_key {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_yamlfilecontent_key.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_offline_mode.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_offline_mode.sh
index 6155b05125..280964c745 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_offline_mode.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_offline_mode.sh
@@ -10,7 +10,7 @@ function test_probes_yamlfilecontent_offline_mode {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_yamlfilecontent_offline_mode.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
     local YAML_FILE="openshift-logging.yaml"
 
     [ -f $RF ] && rm -f $RF
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
index e445771d03..9c9f864191 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
@@ -10,7 +10,7 @@ function test_probes_yamlfilecontent_types {
 
     local ret_val=0
     local oval_file="${srcdir}/test_probes_yamlfilecontent_types.xml"
-    local result="results.xml"
+    local result="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $result ] && rm -f $result
 
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000000..85dce32196
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,92 @@
+[tox]
+envlist = tests,tools,clean
+skip_missing_interpreters = true
+skipsdist = true
+
+[testenv]
+skip_install = true
+install_command = pip install {opts} {packages}
+#basepython= python3.9
+
+[testenv:tests]
+description =
+    Run the full openscap unit/integration test suite with ctest
+
+setenv =
+    CC = {env:CC:gcc}
+    CXX = {env:CXX:g++}
+    CPUS = {env:CPUS:4}
+    BUILD_TYPE = {env:BUILD_TYPE:RelWithDebInfo}
+    PREFIX = {env:PREFIX:{envdir}}
+    ENABLE_TESTS = {env:ENABLE_TESTS:ON}
+
+passenv =
+    CFLAGS
+    CXXFLAGS
+    LDFLAGS
+    AR
+    NM
+    RANLIB
+    PYTHON
+    DISPLAY
+    XAUTHORITY
+    HOME
+    USERNAME
+    USER
+    CI
+    XDG_*
+    GITHUB*
+    PIP_DOWNLOAD_CACHE
+
+deps =
+    pip>=22.1
+    cmake
+    ninja
+
+commands =
+    cmake -G {posargs:"Unix Makefiles"} -S . -B build -DCMAKE_BUILD_TYPE={env:BUILD_TYPE} -DENABLE_TESTS={env:ENABLE_TESTS}
+    cmake --build build -j{env:CPUS}
+    ctest -V -j{env:CPUS} --rerun-failed --output-on-failure --test-dir build/
+
+[testenv:tools]
+skip_install = true
+envdir = {toxworkdir}/tools
+
+description =
+    Build and install openscap into the {env:PREFIX} path (default: tools)
+
+allowlist_externals =
+    bash
+
+deps =
+    {[testenv:tests]deps}
+
+setenv =
+    CC = {env:CC:gcc}
+    CXX = {env:CXX:g++}
+    CPUS = {env:CPUS:4}
+    BUILD_TYPE = {env:BUILD_TYPE:Release}
+    PREFIX = {env:PREFIX:{envdir}}
+    WITH_RPATH = {env:LOCAL_INSTALL_WITH_RPATH:ON}
+
+passenv =
+    {[testenv:tests]passenv}
+
+commands =
+    cmake -G {posargs:"Unix Makefiles"} -S . -B build -DCMAKE_BUILD_TYPE={env:BUILD_TYPE} -DCMAKE_INSTALL_PREFIX={env:PREFIX} -DENABLE_TESTS=OFF -DBUILD_SHARED_LIBS=OFF -DLOCAL_INSTALL_WITH_RPATH={env:WITH_RPATH}
+    cmake --build build -j{env:CPUS} --target install
+    bash -c 'find $PREFIX/ -maxdepth 3 -type d'
+
+[testenv:clean]
+skip_install = true
+description =
+    Clean the cmake build tree
+
+allowlist_externals =
+    {[testenv:tools]allowlist_externals}
+
+deps =
+    pip>=21.1
+
+commands =
+    bash -c 'rm -rf build/*'