Repository navigation
Conversation
Collaborator
|
I guess these can then also be removed from |
Three of the eight entries are removed. Each is either already satisfied
transitively or is dead weight:
libselinux-utils already a dependency of selinux-policy, and the
stig-hardening role never invokes any of its binaries
ntp installed but never configured - no task in the role
notifies the time-sync handlers, and 0 of the 107
PHTN-50-xxxxxx controls cover time sync
libgcrypt a workaround for aide declaring only an unversioned
Requires: libgcrypt; that belongs in aide.spec
The same three are dropped from examples/ova/packages_stig.json, so the OVA
package list and the installer's own list say the same thing. Keeping the two
in step matters: a list restated in two places is how the media and the
installer drifted apart in the first place.
Verified on four real STIG installs - two on photon-os-installer 2.8, two on
latest - whose manifests carry the reduced additional_packages list
[audit, rsyslog, openssl-fips-provider, selinux-policy, aide]:
libselinux-utils installed, transitively
libgcrypt installed, transitively
ntp / ntpsec absent, and time sync works via
systemd-timesyncd
aide's dependency is now a versioned Requires: libgcrypt >= 1.10.4, confirmed
in aide-0.19-3.ph5, so nothing rests on the unversioned form any more.
Signed-off-by: Daniel Casota <dcasota@gmail.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JW73JTCUGRcaNTUEQcAMtf
dcasota
force-pushed
the
upstream/stig-drop-redundant-packages
branch
from
September 2, 2026 06:07
d3ac861 to
964162b
Compare
Contributor
Author
|
The PR has been modified and tested with minimal ISO, kickstart, x86_64, without/with STIG, prebuilt canister. The ongoing tests with a full iso x86_64 should be fine, too. aarch64 hasn't been tested. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes three of the eight entries in
KS_STIG_PACKAGES, and the same three fromexamples/ova/packages_stig.jsonso the OVA list and the installer's own list say the same thing. Each entry is either already satisfied transitively or is dead weight.libselinux-utilsselinux-policy; the stig-hardening role never invokes any of its binariesntplibgcryptaidedeclaring only an unversionedRequires: libgcrypt; that belongs in aide.specKeeping the two lists in step matters for its own sake: a package list restated in two places is exactly how the media and the installer drifted apart before.
On
ntpspecificallyThe role's README documents
var_ntp_servers,var_syslog_server_nameandvar_syslog_server_port, but nothing in the role consumes them. Installingntptherefore satisfies no control — it just adds a package.Verified on real installs, on both installer versions
Four STIG installs whose manifests already carry the reduced list — two on photon-os-installer 2.8, two on latest — with
additional_packagesexactly[audit, rsyslog, openssl-fips-provider, selinux-policy, aide]:libselinux-utils-3.10-4.ph5libgcrypt-1.10.4-2.ph5ntp/ntpsecDropping the three from the explicit list changed nothing about what lands on the system. Time sync works via
systemd-timesyncd(System clock synchronized: yes). STIG ansible run: 0 failed tasks; SELinuxEnforcing; FIPS canister verification passes.aide's dependency is now a versionedRequires: libgcrypt >= 1.10.4, confirmed inaide-0.19-3.ph5, so nothing rests on the unversioned form any more.Lint and tests
isort --check-only --diff .andflake8 .exit 0.What is not covered
The evidence above comes from the ISO installer path.
examples/ova/packages_stig.jsonis consumed by the OVA image build, which resolves the same tdnf closure but is a separate invocation and has not been rebuilt here. The two lists are asserted equal programmatically, and the transitive dependencies are the same ones proven above, but an OVA build itself has not been run.Related
The aide side of this is a versioned
Requires: libgcrypt >= 1.10.4guarded byphoton_subrelease >= 91, filed separately against the photon repo (vmware/photon#1670).🤖 Generated with Claude Code