:idprefix:
:idseparator: -
ifndef::env-github[:icons: font]
ifdef::env-github[]
:status:
//:outfilesuffix: .adoc
:caution-caption: :fire:
:important-caption: :exclamation:
:note-caption: :paperclip:
:tip-caption: :bulb:
:warning-caption: :warning:
endif::[]
:uri-org: https://github.com/usnistgov
:uri-repo: {uri-org}/macos_security

= Changelog

This document provides a high-level view of the changes to the macOS Security Compliance Project.

== [Unreleased]

=== Scripts
* Add `--markdown-tree` flag to `mscp guidance` - generates a paginated Markdown directory tree (one page per rule, `NN-` ordered filenames, `index.md` per section) ready to use with Docusaurus, Starlight, MkDocs, VitePress, or any CommonMark-based static site generator. Drop the output directory into a docs folder - no post-processing required. Also included in `--all`.

=== Bug Fixes
* Fix crash in `adoc/rule.adoc.jinja` when `rule.references.hhs` is absent - rules predating the HICP framework do not carry this key.

== [mSCP 2.x] - 2025-02-28
IMPORTANT: This release is a major update and includes breaking changes. Please review the documentation before upgrading.

=== Scripts
* All scripts have been moved from individual files to a single API
* All Apple Operating Systems have been consolidated into a single API
* All document creation has been moved to a Jinja template
* Add debug and version switch to CLI
* Add markdown switch to guidance CLI
* Add generate_documents function for handleing markdown and asciidoc guidance generation
* Add render_template function for rendering Jinja templates for document generation

=== Rules
* All rules updated to support the new API
* All ios_stig rules have been modified to be just disa_stig with baseline logic to support the correct OS

=== Baselines
* All baselines updated to support the new API

=== Templates
* Created shell script Jinja templates for compliance checking
* Created markdown and asciidoc Jinja templates for guidance generation
* Created checklist Jinja templates for compliance checking
* Created local report Jinja templates for compliance checking

=== Miscellaneous
* Refactored mscp-data to support better baseline generation
* Created a mscp_data variable to store throughout the codebase

== [Sequoia, Revision 1.1] - 2024-12-16
* Rules
** Added Rules
*** os_iphone_mirroring_disable
*** os_mail_summary_disable
*** os_photos_enhanced_search_disable
*** system_settings_external_intelligence_disable
*** system_settings_external_intelligence_sign_in_disable
** Modified Rules
*** os_sleep_and_display_sleep_apple_silicon_enable
*** os_sudo_log_enforce
*** os_world_writable_library_folder_configure
*** os_password_autofill_disable
*** pwpolicy_alpha_numeric_enforce
*** pwpolicy_custom_regex_enforce
*** pwpolicy_lower_case_character_enforce.yaml
*** pwpolicy_max_lifetime_enforce
*** pwpolicy_minimum_lifetime_enforce
*** pwpolicy_history_enforce
*** pwpolicy_account_lockout_timeout_enforce
*** pwpolicy_account_lockout_enforce
*** pwpolicy_prevent_dictionary_words
*** pwpolicy_simple_sequence_disable
*** pwpolicy_special_character_enforce
*** pwpolicy_upper_case_character_enforce.yaml
*** system_settings_improve_assistive_voice_disable
** Removed Rules
*** system_settings_cd_dvd_sharing_disable
** Bug Fixes
* Baselines
** Added DISA STIG v1r1
** Added CIS Level (Draft -> Final)
** Updated CNSSI-1253

== [Sequoia, Revision 1.0] - 2024-09-12

* Rules
** Added Rules
*** os_genmoji_disable
*** os_image_generation_disable
*** os_iphone_mirroring_disable
*** os_sudo_log_enforce
*** os_writing_tools_disable
** Modified Rules
*** os_anti_virus_installed
*** os_gatekeeper_enable
*** os_ssh_fips_compliant
*** system_settings_firewall_enable
*** system_settings_firewall_stealth_mode_enable
*** system_settings_gatekeeper_identified_developers_allowed
*** system_settings_media_sharing_disabled
*** DDM Support
**** auth_pam_login_smartcard_enforce
**** auth_pam_su_smartcard_enforce
**** auth_pam_sudo_smartcard_enforce
**** auth_ssh_password_authentication_disable
**** os_external_storage_restriction
**** os_network_storage_restriction
**** os_policy_banner_ssh_enforce
**** os_sshd_channel_timeout_configure
**** os_sshd_client_alive_count_max_configure
**** os_sshd_client_alive_interval_configure
**** os_sshd_fips_compliant
**** os_sshd_login_grace_time_configure
**** os_sshd_permit_root_login_configure
**** os_sshd_unused_connection_timeout_configure
**** os_sudo_timeout_configure
**** pwpolicy_account_lockout_enforce
**** pwpolicy_account_lockout_timeout_enforce
**** pwpolicy_alpha_numeric_enforce
**** pwpolicy_custom_regex_enforce
**** pwpolicy_history_enforce
**** pwpolicy_max_lifetime_enforce
**** pwpolicy_minimum_length_enforce
**** pwpolicy_simple_sequence_disable
**** pwpolicy_special_character_enforce
** Removed Rules
*** os_firewall_log_enable
*** os_gatekeeper_rearm
*** os_safari_popups_disabled
** Bug Fixes
* Baselines
** Modified existing baselines
** Updated 800-171 to Revision 3
* Scripts
** generate_guidance
*** Support for Declarative Device Management (DDM)
*** Added support for severity
** generate_baseline
** generate_mappings
** generate_scap
*** Added support for severity