Repository navigation
Conversation
dcasota
force-pushed
the
fix/stig-harden-reachable
branch
from
September 9, 2026 11:17
10113ad to
b955874
Compare
dcasota
force-pushed
the
fix/stig-harden-reachable
branch
from
September 17, 2026 06:02
b955874 to
406ebd7
Compare
dcasota
force-pushed
the
fix/stig-harden-reachable
branch
from
September 30, 2026 11:49
406ebd7 to
4885673
Compare
dcasota
force-pushed
the
fix/stig-harden-reachable
branch
2 times, most recently
from
October 11, 2026 12:00
acaebf3 to
d17c42e
Compare
Seven specs gate a STIG build variant on STIG_HARDEN, and every one of them pins it with a plain define in the spec body: 90/libpwquality 90/Linux-PAM 90/openssh libpwquality Linux-PAM openssh shadow A define in the spec body is evaluated during parse and overwrites anything passed with --define, so the flag cannot be set from pkg_build_options.json, from the Makefile, or from the rpmbuild command line. Photon's builder feeds every per-package macro as -D (PackageUtils.py:345), so that is the only channel there is. The consequence is not that the variant builds wrongly - it is that the variant has never been built at all. None of these conditionals has ever been parsed, and defects accumulated in them unseen. In SPECS/systemd that amounted to a duplicate patch index and a patch file missing from the directory, either of which aborts the build outright. Replace the plain define with a define-if-unset in all seven. Same default, but now overridable, so the STIG constellation can actually be selected and tested. No change to any build Photon performs today: with STIG_HARDEN unset the value is still 0 and the expanded spec is identical. openssh is split by subrelease: SPECS/openssh builds 93 and later and still pins the flag, so it is changed here; SPECS/91/openssh (91) and SPECS/92/openssh (92) carry no STIG variant, so there is nothing to make reachable in them. SPECS/90/systemd no longer carries one either. Change-Id: I493ced005deb825e078dd9ddf56552444b47874c Signed-off-by: Daniel Casota <dcasota@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dcasota
force-pushed
the
fix/stig-harden-reachable
branch
from
October 24, 2026 16:16
d17c42e to
447621c
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Seven specs gate a STIG build variant on
STIG_HARDEN, and each pins it with a plain%define STIG_HARDEN 0in the spec body. A body%defineis evaluated during parse and overwrites anything passed with--define. Photon's builder passes every per-package macro frompkg_build_options.jsonas-D(PackageUtils.py:345-346:for macro in macros: rpmBuildcmd += ["-D", macro]), and that is the only channel there is. SoSTIG_HARDEN=1is unreachable on every arch, subrelease and ISO type: the variant is never parsed or built, and defects accumulate in it unseen (inSPECS/systemda duplicate patch index and a missing patch file, handled in #1671).Change
%define STIG_HARDEN 0->%{!?STIG_HARDEN: %global STIG_HARDEN 0}, with a comment explaining why, in:SPECS/90/libpwqualitySPECS/90/Linux-PAMSPECS/90/opensshSPECS/libpwqualitySPECS/Linux-PAMSPECS/opensshSPECS/shadowSame default, now overridable. One
%changelogentry per spec.SPECS/91/openssh(subrelease 91) andSPECS/92/openssh(92) have no STIG variant and are not touched, nor isSPECS/90/systemd, which no longer has one;SPECS/systemdis changed in #1671.shadowdeclaresSource12:twice, but in mutually exclusive%ifbranches (useradd/pam.d/useradd); both resolve toSOURCES/useraddbecause the builder stages sources flat and rpm resolves local sources by basename. That is correct and is left as is.Testing
Each spec at its own subrelease (90 for
SPECS/90, 92 forlibpwquality,Linux-PAM,shadow, 93 foropenssh):STIG_HARDENunset,rpmspec -Poutput is identical to the base branch apart from Release strings and blank lines, in all seven.-D "STIG_HARDEN 1", the preprocessed spec changes in all seven; on the base branch it changes in none.Source:/Patch:reachable withSTIG_HARDEN0 and 1 exists in the spec directory or as the source tarball (with theshadowbasename case above).check_spec.py --mainline 93exits 0 on all seven.🤖 Generated with Claude Code