meta-security: subtree update:e8c9e69c80..d2ceb5e438

Armin Kuster (2):
      samhain: update to 4.4.2
      kas-security-base: Don't create local SSTATE mirror

Yi Zhao (3):
      suricata: unify volatiles file name
      clamav: unify volatiles file name
      scap-security-guide: fix build with Python 3.9

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33

4 files changed, 161 insertions, 0 deletions

diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch
new file mode 100644
index 000000000..01e3dd687
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch
@@ -0,0 +1,43 @@
+From e435bf2dc59d652710104a1c59332e410b12bb64 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 12:33:48 +0200
+Subject: [PATCH] fix deprecated instance of element.getchildren
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/e435bf2dc59d652710104a1c59332e410b12bb64]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ ssg/build_remediations.py | 2 +-
+ ssg/build_stig.py         | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index fdde0f268..c18d6bd54 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -735,7 +735,7 @@ def expand_xccdf_subs(fix, remediation_type, remediation_functions):
+         # First concat output form of modified fix text (including text appended
+         # to all children of the fix)
+         modfix = [fix.text]
+-        for child in fix.getchildren():
++        for child in list(fix):
+             if child is not None and child.text is not None:
+                 modfix.append(child.text)
+         modfixtext = "".join(modfix)
+diff --git a/ssg/build_stig.py b/ssg/build_stig.py
+index 528285f3d..6122981fc 100644
+--- a/ssg/build_stig.py
++++ b/ssg/build_stig.py
+@@ -38,7 +38,7 @@ def add_references(reference, destination):
+         for ref in refs:
+             if (ref.get('href').startswith(stig_refs) and
+                     ref.text in dictionary):
+-                index = rule.getchildren().index(ref)
++                index = list(rule).index(ref)
+                 new_ref = ET.Element(
+                     '{%s}reference' % XCCDF11_NS, {'href': stig_ns})
+                 new_ref.text = dictionary[ref.text]
+-- 
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch
new file mode 100644
index 000000000..84271c4c9
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch
@@ -0,0 +1,58 @@
+From b0adc1d53780def4a95e310b6d26bb91ee97177e Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 13:27:41 +0200
+Subject: [PATCH] fix deprecated getiterator function
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/b0adc1d53780def4a95e310b6d26bb91ee97177e]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ ssg/build_cpe.py    | 6 +++---
+ ssg/id_translate.py | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/ssg/build_cpe.py b/ssg/build_cpe.py
+index 2e5d24a5d..8c046777a 100644
+--- a/ssg/build_cpe.py
++++ b/ssg/build_cpe.py
+@@ -17,7 +17,7 @@ def extract_subelement(objects, sub_elem_type):
+     """
+ 
+     for obj in objects:
+-        for subelement in obj.getiterator():
++        for subelement in obj.iter():
+             if subelement.get(sub_elem_type):
+                 sub_element = subelement.get(sub_elem_type)
+                 return sub_element
+@@ -44,12 +44,12 @@ def extract_referred_nodes(tree_with_refs, tree_with_ids, attrname):
+     reflist = []
+     elementlist = []
+ 
+-    for element in tree_with_refs.getiterator():
++    for element in tree_with_refs.iter():
+         value = element.get(attrname)
+         if value is not None:
+             reflist.append(value)
+ 
+-    for element in tree_with_ids.getiterator():
++    for element in tree_with_ids.iter():
+         if element.get("id") in reflist:
+             elementlist.append(element)
+ 
+diff --git a/ssg/id_translate.py b/ssg/id_translate.py
+index 72b07be18..ba9225904 100644
+--- a/ssg/id_translate.py
++++ b/ssg/id_translate.py
+@@ -64,7 +64,7 @@ class IDTranslator(object):
+         )
+ 
+     def translate(self, tree, store_defname=False):
+-        for element in tree.getiterator():
++        for element in tree.iter():
+             idname = element.get("id")
+             if idname:
+                 # store the old name if requested (for OVAL definitions)
+-- 
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch
new file mode 100644
index 000000000..8162292cd
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch
@@ -0,0 +1,57 @@
+From a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 14:01:55 +0200
+Subject: [PATCH] fix remaining getchildren and getiterator functions
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ build-scripts/sds_move_ocil_to_checks.py                  | 2 +-
+ build-scripts/verify_references.py                        | 2 +-
+ shared/transforms/pcidss/transform_benchmark_to_pcidss.py | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/build-scripts/sds_move_ocil_to_checks.py b/build-scripts/sds_move_ocil_to_checks.py
+index 5f5139659..64dc19084 100755
+--- a/build-scripts/sds_move_ocil_to_checks.py
++++ b/build-scripts/sds_move_ocil_to_checks.py
+@@ -106,7 +106,7 @@ def move_ocil_content_from_ds_extended_component_to_ds_component(datastreamtree,
+     timestamp = extendedcomp.get('timestamp')
+ 
+     # Get children elements of <ds:extended-component> containing OCIL content
+-    extchildren = extendedcomp.getchildren()
++    extchildren = list(extendedcomp)
+     # There should be just one OCIL subcomponent in <ds:extended-component>
+     if len(extchildren) != 1:
+         sys.stderr.write("ds:extended-component contains more than one element!"
+diff --git a/build-scripts/verify_references.py b/build-scripts/verify_references.py
+index 69b3e2d1f..95d387f46 100755
+--- a/build-scripts/verify_references.py
++++ b/build-scripts/verify_references.py
+@@ -179,7 +179,7 @@ def main():
+     check_content_refs = xccdftree.findall(".//{%s}check-content-ref"
+                                            % xccdf_ns)
+ 
+-    xccdf_parent_map = dict((c, p) for p in xccdftree.getiterator() for c in p)
++    xccdf_parent_map = dict((c, p) for p in xccdftree.iter() for c in p)
+     # now we can actually do the verification work here
+     if options.rules_with_invalid_checks or options.all_checks:
+         for check_content_ref in check_content_refs:
+diff --git a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
+index 0ceaf727d..c94b12c45 100755
+--- a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
++++ b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
+@@ -111,7 +111,7 @@ def main():
+             benchmark.findall(".//{%s}Value" % (XCCDF_NAMESPACE)):
+         values.append(value)
+ 
+-    parent_map = dict((c, p) for p in benchmark.getiterator() for c in p)
++    parent_map = dict((c, p) for p in benchmark.iter() for c in p)
+     for rule in \
+             benchmark.findall(".//{%s}Rule" % (XCCDF_NAMESPACE)):
+         parent_map[rule].remove(rule)
+-- 
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
index f35d7691b..6e7180f55 100644
--- a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
@@ -4,6 +4,9 @@ SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed"
 SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44; \
            file://0001-Fix-XML-parsing-of-the-remediation-functions-file.patch \
            file://0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch \
+           file://0001-fix-deprecated-instance-of-element.getchildren.patch \
+           file://0002-fix-deprecated-getiterator-function.patch \
+           file://0003-fix-remaining-getchildren-and-getiterator-functions.patch \
           "
 PV = "0.1.44+git${SRCPV}"