dcasota · Aug 31, 2026
diff --git a/SPECS/90/Linux-PAM/Linux-PAM.spec b/SPECS/90/Linux-PAM/Linux-PAM.spec
@@ -1,11 +1,14 @@
 %global build_if %{photon_subrelease} <= 90
 
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 Summary:        Linux Pluggable Authentication Modules
 Name:           Linux-PAM
 Version:        1.5.3
-Release:        11.1.2%{?dist}
+Release:        11.1.3%{?dist}
 URL:            https://github.com/linux-pam/linux-pam
 Group:          System Environment/Security
 Vendor:         VMware, Inc.
@@ -171,6 +174,8 @@ rm -rf %{buildroot}/*
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 1.5.3-11.1.3
+- Define STIG_HARDEN only if unset; default build unchanged
 * Mon Aug 31 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 1.5.3-11.1.2
 - pam_faillock: skip clearing user's failed attempt
 * Thu May 14 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 1.5.3-11.1.1

diff --git a/SPECS/90/libpwquality/libpwquality.spec b/SPECS/90/libpwquality/libpwquality.spec
@@ -1,11 +1,14 @@
 %global build_if %{photon_subrelease} <= 90
 
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 Summary:        It provides common functions for password quality checking
 Name:           libpwquality
 Version:        1.4.4
-Release:        7.1.1%{?dist}
+Release:        7.1.2%{?dist}
 URL:            https://github.com/libpwquality/libpwquality
 Group:          System Environment/Libraries
 Vendor:         VMware, Inc.
@@ -101,6 +104,8 @@ find %{buildroot}%{python3_sitelib}/ -name '*.pyc' -delete -o \
 %{python3_sitearch}/pwquality-*.egg/*
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 1.4.4-7.1.2
+- Define STIG_HARDEN only if unset; default build unchanged
 * Fri May 15 2026 Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com> 1.4.4-7.1.1
 - Adjusted to build for subrelease 90
 * Wed Mar 18 2026 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 1.4.4-7.1

diff --git a/SPECS/90/openssh/openssh.spec b/SPECS/90/openssh/openssh.spec
@@ -1,13 +1,16 @@
 %global build_if %{photon_subrelease} <= 90
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 %define privsep_path %{_datadir}/empty.sshd
 %global sshd_services sshd.service sshd-keygen.service
 
 Summary:        Free version of the SSH connectivity tools
 Name:           openssh
 Version:        9.3p2
-Release:        21.2%{?dist}
+Release:        21.3%{?dist}
 URL:            https://www.openssh.com
 Group:          System Environment/Security
 Vendor:         VMware, Inc.
@@ -252,6 +255,8 @@ rm -rf %{buildroot}/*
 %{_unitdir}/sshd@.service
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 9.3p2-21.3
+- Define STIG_HARDEN only if unset; default build unchanged
 * Wed Jul 29 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 9.3p2-21.2
 - CVE fixes, CVE-2026-59995 through CVE-2026-60002
 * Fri May 15 2026 Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com> 9.3p2-21.1

diff --git a/SPECS/Linux-PAM/Linux-PAM.spec b/SPECS/Linux-PAM/Linux-PAM.spec
@@ -1,11 +1,14 @@
 %global build_if %{photon_subrelease} >= 91
 
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 Summary:        Linux Pluggable Authentication Modules
 Name:           Linux-PAM
 Version:        1.7.2
-Release:        3%{?dist}
+Release:        4%{?dist}
 URL:            https://github.com/linux-pam/linux-pam
 Group:          System Environment/Security
 Vendor:         VMware, Inc.
@@ -150,6 +153,8 @@ rm -rf %{buildroot}/*
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 1.7.2-4
+- Define STIG_HARDEN only if unset; default build unchanged
 * Thu May 21 2026 Shivani Agarwal <shivani.agarwal@broadcom.com> 1.7.2-3
 - Remove libnsl depndency
 * Thu May 14 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 1.7.2-2

diff --git a/SPECS/libpwquality/libpwquality.spec b/SPECS/libpwquality/libpwquality.spec
@@ -1,11 +1,14 @@
 %global build_if %{photon_subrelease} >= 91
 
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 Summary:        It provides common functions for password quality checking
 Name:           libpwquality
 Version:        1.4.4
-Release:        9%{?dist}
+Release:        10%{?dist}
 URL:            https://github.com/libpwquality/libpwquality
 Group:          System Environment/Libraries
 Vendor:         VMware, Inc.
@@ -102,6 +105,8 @@ find %{buildroot}%{python3_sitelib}/ -name '*.pyc' -delete -o \
 %{python3_sitearch}/*.so
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 1.4.4-10
+- Define STIG_HARDEN only if unset; default build unchanged
 * Fri May 15 2026 Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com> 1.4.4-9
 - Extended to build for subrelease 91 and above
 * Tue Dec 09 2025 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 1.4.4-8

diff --git a/SPECS/openssh/openssh.spec b/SPECS/openssh/openssh.spec
@@ -1,13 +1,16 @@
 %global build_if %{photon_subrelease} >= 93
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 %define privsep_path %{_datadir}/empty.sshd
 %global sshd_services sshd.service sshd-keygen.service
 
 Summary:        Free version of the SSH connectivity tools
 Name:           openssh
 Version:        10.6p1
-Release:        1%{?dist}
+Release:        2%{?dist}
 URL:            https://www.openssh.com
 Group:          System Environment/Security
 Vendor:         VMware, Inc.
@@ -248,6 +251,8 @@ rm -rf %{buildroot}/*
 %{_unitdir}/sshd@.service
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 10.6p1-2
+- Define STIG_HARDEN only if unset; default build unchanged
 * Fri Oct 09 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 10.6p1-1
 - Upgrade to v10.6p1
 * Tue Sep 29 2026 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 10.5p1-2

diff --git a/SPECS/shadow/shadow.spec b/SPECS/shadow/shadow.spec
@@ -1,9 +1,12 @@
-%define STIG_HARDEN 0
+# Default off, but overridable from pkg_build_options.json / rpmbuild -D.
+# A plain define of STIG_HARDEN here would win over -D and make every
+# STIG conditional in this spec permanently unreachable, and untested.
+%{!?STIG_HARDEN: %global STIG_HARDEN 0}
 
 Summary:        Programs for handling passwords in a secure way
 Name:           shadow
 Version:        4.13
-Release:        14%{?dist}
+Release:        15%{?dist}
 URL:            https://github.com/shadow-maint/shadow
 Group:          Applications/System
 Vendor:         VMware, Inc.
@@ -221,6 +224,8 @@ rm -rf %{buildroot}/*
 %defattr(-,root,root)
 
 %changelog
+* Fri Oct 23 2026 Daniel Casota <dcasota@gmail.com> 4.13-15
+- Define STIG_HARDEN only if unset; default build unchanged
 * Tue Dec 09 2025 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 4.13-14
 - Add provides entries
 * Mon Nov 17 2025 Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> 4.13-13