Added CCE-XXXXX-X to rules
Updated checks for software update rules
Updated links in discussions
merged icloud_enterprisebook_sync with icloud_enterprisebook_metadata_sync_disable
merged os_airplay_password_require with os_airplay_outgoing_password_require
removed os_auto_dim_allow - not on any baselines or benchmarks
merged os_background_security_improvement_removal_disable with system_settings_background_security_improvement_removal_disable
merged os_config_profile_ui_install_disable with os_install_configuration_profile_disable
merged os_disallow_enterprise_app_trust with os_allow_enterprise_trust_disabled
merged os_erase_content_and_settings_disable with os_allow_enterprise_trust_disabled
merged os_exchange_prevent_move_enforce with os_mail_move_messages_disable
merged os_external_intelligence_integration_disable with system_settings_external_intelligence_sign_in_disable
merged os_external_intelligence_integration_sign_in_disable with system_settings_external_intelligence_sign_in_disable
merged os_image_generation_disable with os_image_playground_disable
removed os_safari_popups_disabled.yaml - not on any baseline or benchmark
merged os_siri_allow_dictation_disable with os_dictation_disable
removed os_time_offset_limit_configure - not on any baseline or benchmark
merged os_usb_accessories_when_locked_disable with system_settings_usb_restricted_mode
merged os_software_update_download_enforce and system_settings_download_software_update_enforce with system_settings_software_update_download_enforce
merged os_software_update_install_enforce and system_settings_macos_updates_install_enforce with system_settings_install_macos_updates_enforce
merged system_settings_security_update_install with system_settings_critical_update_install_enforce
Corrects an issue where if a rule has an ODV for a benchmark, but the benchmark value is missing, it would include the literal $ODV string, making it incorrect an invalid.
Fixed the rules missing the benchmark tags for ODV.
Added verification to ensure that ODVs and Benchmarks match up.
Issue #735
docker/metadata-action sets this label from github.sha, which for
workflow_run events is always the default branch's tip, not the
branch that actually triggered the build. entrypoint.sh's update
check reads this label, so dev_27 images always looked stale
against themselves. Override it with the resolved head_sha.
entrypoint.sh always checked ghcr's :latest manifest for a newer
build, so non-main images (e.g. dev_27) incorrectly reported an
update available since their SHA never matches main's latest. Bake
the image's tag in at build time and check against that tag instead.
entrypoint.sh always checked ghcr's :latest manifest for a newer
build, so non-main images (e.g. dev_27) incorrectly reported an
update available since their SHA never matches main's latest. Bake
the image's tag in at build time and check against that tag instead.
Push-triggered workflows use the branch's own copy, not main's, so
this was needed on dev_27 itself for the container-publish lint gate
to find a matching run.
- Updated rules for macOS 27.0, iOS 27.0, and visionOS 27.0 support
- Regenerated baseline files for Apple OSes 27.0
- Updated mscp_data to support 27.
* fix: spinner text info for baseline migration
* fix: update CURRENT_USER discovery
change method to use the loginwindow.plist instead of console
* refactor: release string and format
* chore: correct reference to changelog
Issue #718
* refactor: configure logging to catch early CLI issues
* refactor: clarification and inclusion of custom rules
* refactor: correct platform overrides and adjust adoc/md output
* refactor: alias mobileconfig attribute to match yaml
* refactor: admin functions for release and new rule
* chore: lint cleanup and remove markdownlint
* chore(rule): correct validation issues
* chore: adjust spellcheck to main
* chore: correct spelling issues
* chore: update container build process
* chore: trigger container build on push to main
* chore: gate container build on lint and smoke tests
* chore: pin GitHub Actions to commit SHAs and update Node.js to 22 LTS
Pin all unpinned action references to immutable commit SHAs to prevent
supply chain attacks. Upgrade checkout/setup-node from v3 to v4 in
spellcheck workflow and bump Node.js from 20 (deprecated) to 22 LTS
in build_documentation workflow.
* chore: improve GitHub Actions workflow hygiene
- Pin cspell to 10.0.1 instead of @latest
- Add permissions: contents: read to spellcheck, cli-tests, and generate_baselines workflows
- Add concurrency group to generate_baselines to prevent race conditions on rapid pushes
- Add workflow_dispatch to generate_baselines and spellcheck
- Remove dead push-to-main trigger from labeler (labels PRs only)
- Add paths filter to label-sync pull_request_target trigger
- Remove redundant ref from generate_baselines checkout step
- Pin Python to 3.12.1 in cli-tests for consistency
- Remove unnecessary --user flag from pip install in lint workflow
* chore[deps]: update pillow dependency
* chore[rule]: sync enforcement info
issue #592
* chore[rule]: correct CIS ODV
issue #621
* chore[rule]: correct CIS ODV
issue #621
* refactor: filter out incomplete baselines
* feat: add tag mutation API to RuleLibrary
Stores source_file on Macsecurityrule (excluded from serialization) so
RuleLibrary.add_tag/remove_tag can write back to disk after filtering.
Each unique source file is written at most once to avoid redundant I/O
when the library spans multiple platform/version entries for the same rule.
* feat: add add_benchmark/remove_benchmark to RuleLibrary
Unlike tag mutations, benchmark entries are stored per OS version inside
the platforms dict, so both methods group rules by source file and apply
all version mutations to a single canonical object before writing to avoid
clobbering version entries not covered by the first object encountered.
* fix: switch RuleLibrary mutation write path to text-level patching
rule.to_yaml() was designed for custom/derived output and is lossy when
applied to source files — it flattens per-version CCE/STIG dicts and
renames canonical YAML keys (800-53r5 → nist_800_53r5). Replaced all
mutation method write calls with targeted text-level patching helpers
that modify only the specific lines that change, leaving the rest of
each source file untouched.
* chore: update workflow actions
* fix: include multiple mobileconfig payloads if defined in rule
using suggestion from @adrian-ib, changed the mobileconfig info build-out in the manifest to include multiple payloads if they exist
Issue #723
* chore: fix linting and spellcheck findings
* chore: update build action to recent releases
* fix: correct issue with granular profiles and add date
profiles are now generated with a create date in the description
Issue #678
* chore: updates to container build
add entrypoint that will check if latest container and alert the user if a new one is available
move container support files from project root
* chore: adjust to check for container SHA match
* chore: update container update message
* chore: cleanup progress bar messaging
* refactor: custom logo processing in guidance
when a custom logo file is defined at the CLI, it will be copied to the custom/images/ folder for reference in guidance generation.
* Add BSI indigo 1.6 chnages and fixes.
- include `os_safari_clear_history_disable`,
`os_safari_private_browsing_disable`, as a defaults deny measure,
along the new rules
`os_safari_disable` and `os_siri_service_disable`that disallow use of
Safari browser on device based on `indigo ANNEX N` App denylist.
* Delete src/mscp/data/rules/os/os_siri_service_disable.yaml
---------
Co-authored-by: Bob Gendler <robert.gendler@nist.gov>
