sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

disable stig for now

Browse Source
This commit is contained in:
Audiobuzz
2026-06-19 02:45:39 +00:00
parent 72e57174c6
commit 51d2385b21
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/gitea-main-ci.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ env:
# DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only # DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only
# in CI: the scan + deviations report are published as artifacts; the build is # in CI: the scan + deviations report are published as artifacts; the build is
# never failed on score. Set "false" to skip hardening (boot/secure-path bench). # never failed on score. Set "false" to skip hardening (boot/secure-path bench).
ENABLE_STIG: "true" ENABLE_STIG: "false"
# =========================================================================== # ===========================================================================
# TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the
# UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port. # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port.
diskless.pkr.hcl
+1 -1
View File
@@ -133,7 +133,7 @@ variable "boot_splash" {
variable "enable_stig" { variable "enable_stig" {
type = bool type = bool
description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)." description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)."
default = false default = true
} }
variable "debug_shell" { variable "debug_shell" {