diff --git a/SPECS/90/Linux-PAM/Linux-PAM.spec b/SPECS/90/Linux-PAM/Linux-PAM.spec index cfda779da3..ebb8586e56 100644 --- a/SPECS/90/Linux-PAM/Linux-PAM.spec +++ b/SPECS/90/Linux-PAM/Linux-PAM.spec @@ -1,11 +1,14 @@ %global build_if %{photon_subrelease} <= 90 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} Summary: Linux Pluggable Authentication Modules Name: Linux-PAM Version: 1.5.3 -Release: 11.1.2%{?dist} +Release: 11.1.3%{?dist} URL: https://github.com/linux-pam/linux-pam Group: System Environment/Security Vendor: VMware, Inc. @@ -171,6 +174,8 @@ rm -rf %{buildroot}/* %{_libdir}/pkgconfig/*.pc %changelog +* Fri Oct 30 2026 Daniel Casota 1.5.3-11.1.3 +- Define STIG_HARDEN only if unset; default build unchanged * Mon Aug 31 2026 Shreenidhi Shedi 1.5.3-11.1.2 - pam_faillock: skip clearing user's failed attempt * Thu May 14 2026 Shreenidhi Shedi 1.5.3-11.1.1 diff --git a/SPECS/90/libpwquality/libpwquality.spec b/SPECS/90/libpwquality/libpwquality.spec index 6be802d4b8..313ac25a58 100644 --- a/SPECS/90/libpwquality/libpwquality.spec +++ b/SPECS/90/libpwquality/libpwquality.spec @@ -1,11 +1,14 @@ %global build_if %{photon_subrelease} <= 90 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} Summary: It provides common functions for password quality checking Name: libpwquality Version: 1.4.4 -Release: 7.1.1%{?dist} +Release: 7.1.2%{?dist} URL: https://github.com/libpwquality/libpwquality Group: System Environment/Libraries Vendor: VMware, Inc. @@ -101,6 +104,8 @@ find %{buildroot}%{python3_sitelib}/ -name '*.pyc' -delete -o \ %{python3_sitearch}/pwquality-*.egg/* %changelog +* Fri Oct 30 2026 Daniel Casota 1.4.4-7.1.2 +- Define STIG_HARDEN only if unset; default build unchanged * Fri May 15 2026 Vamsi Krishna Brahmajosyula 1.4.4-7.1.1 - Adjusted to build for subrelease 90 * Wed Mar 18 2026 Prashant S Chauhan 1.4.4-7.1 diff --git a/SPECS/90/openssh/openssh.spec b/SPECS/90/openssh/openssh.spec index 742f689740..54b2f6fc99 100644 --- a/SPECS/90/openssh/openssh.spec +++ b/SPECS/90/openssh/openssh.spec @@ -1,5 +1,8 @@ %global build_if %{photon_subrelease} <= 90 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} %define privsep_path %{_datadir}/empty.sshd %global sshd_services sshd.service sshd-keygen.service @@ -7,7 +10,7 @@ Summary: Free version of the SSH connectivity tools Name: openssh Version: 9.3p2 -Release: 21.2%{?dist} +Release: 21.3%{?dist} URL: https://www.openssh.com Group: System Environment/Security Vendor: VMware, Inc. @@ -252,6 +255,8 @@ rm -rf %{buildroot}/* %{_unitdir}/sshd@.service %changelog +* Fri Oct 30 2026 Daniel Casota 9.3p2-21.3 +- Define STIG_HARDEN only if unset; default build unchanged * Wed Jul 29 2026 Shreenidhi Shedi 9.3p2-21.2 - CVE fixes, CVE-2026-59995 through CVE-2026-60002 * Fri May 15 2026 Vamsi Krishna Brahmajosyula 9.3p2-21.1 diff --git a/SPECS/Linux-PAM/Linux-PAM.spec b/SPECS/Linux-PAM/Linux-PAM.spec index 2c79023df3..fbe44c8fd5 100644 --- a/SPECS/Linux-PAM/Linux-PAM.spec +++ b/SPECS/Linux-PAM/Linux-PAM.spec @@ -1,11 +1,14 @@ %global build_if %{photon_subrelease} >= 91 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} Summary: Linux Pluggable Authentication Modules Name: Linux-PAM Version: 1.7.2 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://github.com/linux-pam/linux-pam Group: System Environment/Security Vendor: VMware, Inc. @@ -150,6 +153,8 @@ rm -rf %{buildroot}/* %{_libdir}/pkgconfig/*.pc %changelog +* Fri Oct 30 2026 Daniel Casota 1.7.2-4 +- Define STIG_HARDEN only if unset; default build unchanged * Thu May 21 2026 Shivani Agarwal 1.7.2-3 - Remove libnsl depndency * Thu May 14 2026 Shreenidhi Shedi 1.7.2-2 diff --git a/SPECS/libpwquality/libpwquality.spec b/SPECS/libpwquality/libpwquality.spec index 08930565e4..3b96422cf4 100644 --- a/SPECS/libpwquality/libpwquality.spec +++ b/SPECS/libpwquality/libpwquality.spec @@ -1,11 +1,14 @@ %global build_if %{photon_subrelease} >= 91 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} Summary: It provides common functions for password quality checking Name: libpwquality Version: 1.4.4 -Release: 9%{?dist} +Release: 10%{?dist} URL: https://github.com/libpwquality/libpwquality Group: System Environment/Libraries Vendor: VMware, Inc. @@ -102,6 +105,8 @@ find %{buildroot}%{python3_sitelib}/ -name '*.pyc' -delete -o \ %{python3_sitearch}/*.so %changelog +* Fri Oct 30 2026 Daniel Casota 1.4.4-10 +- Define STIG_HARDEN only if unset; default build unchanged * Fri May 15 2026 Vamsi Krishna Brahmajosyula 1.4.4-9 - Extended to build for subrelease 91 and above * Tue Dec 09 2025 Prashant S Chauhan 1.4.4-8 diff --git a/SPECS/openssh/openssh.spec b/SPECS/openssh/openssh.spec index 740d0d7765..7ac06b4f76 100644 --- a/SPECS/openssh/openssh.spec +++ b/SPECS/openssh/openssh.spec @@ -1,5 +1,8 @@ %global build_if %{photon_subrelease} >= 92 -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} %define privsep_path %{_datadir}/empty.sshd %global sshd_services sshd.service sshd-keygen.service @@ -7,7 +10,7 @@ Summary: Free version of the SSH connectivity tools Name: openssh Version: 10.6p1 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://www.openssh.com Group: System Environment/Security Vendor: VMware, Inc. @@ -248,6 +251,8 @@ rm -rf %{buildroot}/* %{_unitdir}/sshd@.service %changelog +* Fri Oct 30 2026 Daniel Casota 10.6p1-3 +- Define STIG_HARDEN only if unset; default build unchanged * Tue Oct 27 2026 Shreenidhi Shedi 10.6p1-2 - Build for sr-92 and above * Fri Oct 09 2026 Shreenidhi Shedi 10.6p1-1 diff --git a/SPECS/shadow/shadow.spec b/SPECS/shadow/shadow.spec index 91e2cccf21..9bd3be1919 100644 --- a/SPECS/shadow/shadow.spec +++ b/SPECS/shadow/shadow.spec @@ -1,9 +1,12 @@ -%define STIG_HARDEN 0 +# Default off, but overridable from pkg_build_options.json / rpmbuild -D. +# A plain define of STIG_HARDEN here would win over -D and make every +# STIG conditional in this spec permanently unreachable, and untested. +%{!?STIG_HARDEN: %global STIG_HARDEN 0} Summary: Programs for handling passwords in a secure way Name: shadow Version: 4.13 -Release: 14%{?dist} +Release: 15%{?dist} URL: https://github.com/shadow-maint/shadow Group: Applications/System Vendor: VMware, Inc. @@ -221,6 +224,8 @@ rm -rf %{buildroot}/* %defattr(-,root,root) %changelog +* Fri Oct 30 2026 Daniel Casota 4.13-15 +- Define STIG_HARDEN only if unset; default build unchanged * Tue Dec 09 2025 Shreenidhi Shedi 4.13-14 - Add provides entries * Mon Nov 17 2025 Shreenidhi Shedi 4.13-13