disable stig for now

2026-06-19 02:45:39 +00:00
parent 72e57174c6
commit 51d2385b21
2 changed files with 2 additions and 2 deletions
@@ -133,7 +133,7 @@ variable "boot_splash" {
 variable "enable_stig" {
  type        = bool
  description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)."
-  default     = false
+  default     = true
 }

 variable "debug_shell" {