more CI fixes

.github/workflows/build.yml

@@ -5,10 +5,11 @@ name: Gating
 # Controls when the action will run. Triggers the workflow on push or pull request
 # events but only for the main branch
 on:
+  workflow_dispatch:
   push:
-    branches: [ maint-1.3 ]
+    branches: [ main, maint-1.3 ]
   pull_request:
-    branches: [ maint-1.3 ]
+    branches: [ "*" ]
 
 permissions:
   contents: read
@@ -23,7 +24,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-22.04]
+        os: [ubuntu-22.04, ubuntu-24.04]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -36,7 +37,7 @@ jobs:
     - name: Install Deps
       run: |
         sudo apt-get update
-        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
+        sudo apt-get -y install lcov swig procps xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest libpopt-dev libopendbx1-dev libbz2-dev libglib2.0-dev
         sudo apt-get -y remove rpm
 
     # Runs a set of commands using the runners shell
@@ -59,7 +60,7 @@ jobs:
       image: fedora:40
     steps:
     - name: Install Deps
-      run: dnf install -y cmake git dbus-devel GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre2-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace python3-pytest
+      run: dnf install -y cmake git dbus-devel procps-ng GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre2-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace python3-pytest
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
@@ -75,53 +76,40 @@ jobs:
         export $(dbus-launch)
         ctest --output-on-failure
 
-  build-windows:
-    name: Build on Windows
-    runs-on: windows-latest
-    env:
-      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-    steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+  build-macos:
+    # The type of runner that the job will run on
+    name: Build, Test on macOS Latest
+    runs-on: macos-latest
 
-    - name: Checkout vcpkg
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
-        path: ${{ github.workspace }}/vcpkg
-        repository: microsoft/vcpkg
-        fetch-depth: 1
-
-    - name: Bootstrap vcpkg
-      shell: pwsh
-      run: |
-        & "$env:GITHUB_WORKSPACE\vcpkg\scripts\bootstrap.ps1" -disableMetrics
+        submodules: recursive
 
-    - name: Export GitHub Actions cache environment variables
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-      with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
     - name: Install Deps
       run: |
-        & "$env:GITHUB_WORKSPACE\vcpkg\vcpkg.exe" install curl libxml2 libxslt bzip2 pcre pthreads zlib getopt-win32 xmlsec --triplet x64-windows
-
-    - name: Configure
+        # Unlink and re-link to prevent errors when GitHub Mac runner images
+        # install Python outside of Brew:
+        brew list -1 | grep python | while read formula; do brew unlink $formula; brew link --overwrite $formula; done
+        brew update
+        brew install doxygen
+        brew install opendbx
+        brew install pkg-config
+        brew install popt
+        brew install swig
+        brew install libxmlsec1
+        brew install openssl
+        brew install pcre
+
+    - name: Build OpenSCAP
       working-directory: ./build
-      run: cmake -DCMAKE_BUILD_TYPE=Release -DENABLE_PYTHON3=FALSE "-DCMAKE_TOOLCHAIN_FILE=$env:GITHUB_WORKSPACE/vcpkg/scripts/buildsystems/vcpkg.cmake" ..
+      run: |
+        cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DENABLE_PROBES=False -DWITH_PCRE2=True ../
+        make all
 
-    - name: Build
-      run: cmake --build . --config Release
+    - name: Test
       working-directory: ./build
-
-    - name: Package
-      run: cpack
-      working-directory: build
-
-    - name: Upload Artifacts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-      with:
-        name: openscap-win64
-        path: |-
-          build\OpenSCAP*.msi
-          build\OpenSCAP*.msi.sha512
+      run: |
+        echo "Tests are so broken for macOS :("

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ jobs:
     - name: Install Deps
       run: |
         sudo apt-get update
-        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
+        sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libpcre2-dev libyaml-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock python3-pytest
         sudo apt-get -y remove rpm
 
     # Initializes the CodeQL tools for scanning.

.gitignore

@@ -3,6 +3,7 @@
 .dirstamp
 .gdb_history
 .libs/
+.tox/
 .*.swp
 *.pyc
 tags

.packit.yaml

@@ -14,15 +14,17 @@ jobs:
   trigger: pull_request
   metadata:
     targets:
-    - centos-stream-8-x86_64
+    - fedora-all-x86_64
     - centos-stream-9-x86_64
+    - centos-stream-10-x86_64
 
 - job: tests
   trigger: pull_request
   metadata:
     targets:
-    - centos-stream-8-x86_64
+    - fedora-all-x86_64
     - centos-stream-9-x86_64
+    - centos-stream-10-x86_64
 
 - job: copr_build
   trigger: commit

CMakeLists.txt

@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 2.8...3.19)
+cmake_minimum_required(VERSION 3.18)
 
 # Inspired and referenced from https://blog.kitware.com/cmake-and-the-default-build-type
 if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
@@ -88,8 +88,6 @@ if(ACL_FOUND)
 	check_include_file(sys/acl.h HAVE_SYS_ACL_H)
 endif()
 
-find_package(AptPkg)
-
 find_package(Blkid)
 if(BLKID_FOUND)
 	check_library_exists("${BLKID_LIBRARY}" blkid_get_tag_value "" HAVE_BLKID_GET_TAG_VALUE)
@@ -609,6 +607,8 @@ if(OPENSCAP_PROBE_INDEPENDENT_YAMLFILECONTENT)
 	set_oscap_generic_properties(yamlfilter_object)
 endif()
 
+include(SetRPATH)  # mainly for development workflows and non-system install paths
+
 add_subdirectory("compat")
 add_subdirectory("src")
 add_subdirectory("utils")

cmake/SetRPATH.cmake

@@ -0,0 +1,32 @@
+# https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+
+if(LOCAL_INSTALL_WITH_RPATH)
+    # use, i.e. don't skip the full RPATH for the build tree
+    set(CMAKE_SKIP_BUILD_RPATH FALSE)
+
+    # when building, don't use the install RPATH already (but later on when
+    # installing)
+    set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
+
+    set(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
+
+    # add the automatically determined parts of the RPATH which point to
+    # directories outside the build tree to the install RPATH
+    set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+
+    # the RPATH to be used when installing, but only if it's not a system
+    # directory
+    list(FIND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
+         "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}" isSystemDir
+    )
+    if("${isSystemDir}" STREQUAL "-1")
+        set(CMAKE_INSTALL_RPATH
+            "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}"
+        )
+    endif("${isSystemDir}" STREQUAL "-1")
+
+    message(
+        STATUS
+            "Non-system install RPATH set using ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}"
+    )
+endif()

openscap.spec

@@ -14,12 +14,8 @@ BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
 BuildRequires:  rpm-devel
-BuildRequires:  libgcrypt-devel
-%if 0%{?fedora}
+BuildRequires:  nss-devel
 BuildRequires:  pcre2-devel
-%else
-BuildRequires:  pcre-devel
-%endif
 BuildRequires:  libacl-devel
 BuildRequires:  libselinux-devel
 BuildRequires:  libcap-devel
@@ -131,16 +127,13 @@ Tool for scanning Atomic containers.
 
 %build
 %undefine __cmake_in_source_build
-# gconf is a legacy system not used any more, and it blocks testing of oscap-anaconda-addon
-# as gconf is no longer part of the installation medium
 %cmake \
 %if 0%{?fedora}
     -DWITH_PCRE2=ON \
 %endif
     -DENABLE_PERL=OFF \
-    -DENABLE_DOCS=ON \
-    -DOPENSCAP_PROBE_UNIX_GCONF=OFF \
-    -DGCONF_LIBRARY=
+    -DWITH_CRYPTO=nss \
+    -DENABLE_DOCS=ON
 %cmake_build
 make docs
 
@@ -155,7 +148,7 @@ ctest -V %{?_smp_mflags}
 find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 # fix python shebangs
-%if 0%{?fedora}
+%if 0%{?rhel} >= 10 || 0%{?fedora}
 %{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
 %else
 pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm

src/common/util.c

@@ -325,7 +325,7 @@ char *oscap_strerror_r(int errnum, char *buf, size_t buflen)
 #ifdef OS_WINDOWS
 	strerror_s(buf, buflen, errnum);
 	return buf;
-#elif defined(OS_FREEBSD)
+#elif defined(OS_APPLE) || defined(OS_FREEBSD)
 	strerror_r(errnum, buf, buflen);
 	return buf;
 #else

tests/API/XCCDF/unittests/test_xccdf_results_arf_asset.sh

@@ -7,7 +7,7 @@ set -o pipefail
 
 function test_xccdf_results_arf_asset {
     local DS="${srcdir}/test_xccdf_results_arf_no_oval.xccdf.xml"
-    local result="results.xml"
+    local result="$(mktemp results.XXXXXXX.xml)"
     local stderr="error.log"
 
     [ -f $result ] && rm -f $result

tests/curl/test_curl_encoding.sh

@@ -9,7 +9,7 @@ function curl_accept_encoding {
 	require_internet || return 255
 
 	local DF="${srcdir}/ds.xml"
-	local RF="results.xml"
+	local RF="$(mktemp results.XXXXXXX.xml)"
 	local LOG="verbose.log"
 
 	$OSCAP xccdf --verbose=DEVEL eval --fetch-remote-resources --results $RF $DF 2>$LOG || echo "OK"

tests/probes/family/test_probes_family.sh

@@ -22,7 +22,7 @@ function test_probes_family {
 
     local ret_val=0;
     local DF="${srcdir}/test_probes_family.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 

tests/probes/file/test_probes_file.sh

@@ -22,7 +22,7 @@ function test_probes_file {
 
     local ret_val=0;
     local DF="$srcdir/test_probes_file.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
@@ -50,7 +50,7 @@ function test_probes_file_filenames {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_filename.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 	files_dir=$(mktemp -d)
 	DF_INJECTED=$(mktemp)
 
@@ -95,7 +95,7 @@ function test_probes_file_invalid_utf8 {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_filename.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 	files_dir=$(mktemp -d)
 	DF_INJECTED=$(mktemp)
 

tests/probes/file/test_probes_file_behaviour.sh

@@ -40,7 +40,7 @@ function test_probes_file_behaviour {
 
 	local ret_val=0
 	local DF="$srcdir/test_probes_file_behaviour.xml"
-	result="results.xml"
+	result="$(mktemp results.XXXXXXX.xml)"
 
 	test_probes_behaviour_setup
 

tests/probes/fileextendedattribute/test_probes_fileextendedattribute.sh

@@ -12,7 +12,7 @@ function test_probes_fileextendedattribute {
 
     local ret_val=0;
     local DEFFILE="$srcdir/test_probes_fileextendedattribute.xml"
-    local RESFILE="results.xml"
+    local RESFILE="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RESFILE ] && rm -f $RESFILE
 

tests/probes/filehash/test_probes_filehash.sh

@@ -24,7 +24,7 @@ function test_probes_filehash {
 
     local ret_val=0;
     local DF="test_probes_filehash.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 

tests/probes/filehash58/test_probes_filehash58.sh

@@ -24,7 +24,7 @@ function test_probes_filehash58_old_algos {
 
     local ret_val=0;
     local DF="test_probes_filehash58_old_algos.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 
@@ -52,7 +52,7 @@ function test_probes_filehash58_new_algos {
 
     local ret_val=0
     local DF="test_probes_filehash58_new_algos.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 

tests/probes/filemd5/test_probes_filemd5.sh

@@ -23,7 +23,7 @@ function test_probes_filemd5 {
 
     local ret_val=0;
     local DEFFILE="test_probes_filemd5.xml"
-    local RESFILE="results.xml"
+    local RESFILE="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RESFILE ] && rm -f $RESFILE
 

tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh

@@ -16,7 +16,7 @@ function test_probes_fwupdsecattr {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_fwupdsecattr.xml"
-    local RF="results.xml"
+    local RF="$(mktemp results.XXXXXXX.xml)"
 
     [ -f $RF ] && rm -f $RF
 

tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh

@@ -10,9 +10,9 @@ function test_probes_fwupdsecattr {
 
     local ret_val=0
     local DF="${srcdir}/test_probes_fwupdsecattr_mock.xml"
-    local RF="results.xml"
+    local RF="$(make_temp_file /tmp results.xml)"
     local DBUS_MOCK_NAME="org.freedesktop.fwupd"
-    local stderr=$(mktemp test_probes_fwupdsecattr_mock.err.XXXXXX)
+    local stderr=$(make_temp_file /tmp test_probes_fwupdsecattr_mock.err)
     echo "stderr file: $stderr"
 
     [ -f $RF ] && rm -f $RF