From 51d2385b213bf2130ff231595c99c70592afa8f5 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Fri, 19 Jun 2026 02:45:39 +0000 Subject: [PATCH] disable stig for now --- .gitea/workflows/gitea-main-ci.yaml | 2 +- diskless.pkr.hcl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml index f521a62..aeb92c0 100644 --- a/.gitea/workflows/gitea-main-ci.yaml +++ b/.gitea/workflows/gitea-main-ci.yaml @@ -63,7 +63,7 @@ env: # DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only # in CI: the scan + deviations report are published as artifacts; the build is # never failed on score. Set "false" to skip hardening (boot/secure-path bench). - ENABLE_STIG: "true" + ENABLE_STIG: "false" # =========================================================================== # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port. diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl index cb01190..ac8cde7 100644 --- a/diskless.pkr.hcl +++ b/diskless.pkr.hcl @@ -133,7 +133,7 @@ variable "boot_splash" { variable "enable_stig" { type = bool description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)." - default = false + default = true } variable "debug_shell" {