[dcasota]

The problem

The installer's STIG menu offers "Apply STIG hardening", which makes the installer request KS_STIG_PACKAGES at install time. Those names were never added to the ISO's own RPMS/.

On a minimal ISO that is fatal, because downloadPkgs() resolves a dependency closure rather than copying every rpm — so the packages are simply not on the media, and the install dies with:

Error(1011) : No matching packages

A second, related gap: packages named via --initrd-pkgs never reached the download list either. Only the list file was parsed, so a package requested on the command line could not be installed into the initrd from the ISO's own RPMS/.

The change

isoBuilder.py extends self.pkg_list with:

1. stigenable.KS_STIG_PACKAGES — the installer's own declaration of what the STIG option installs.
2. the packages named by --initrd-pkgs.

Both extend self.pkg_list only, so they land in the ISO's RPMS/ and the initrd does not grow.

The first point is deliberately a reference to the installer's own list rather than a restatement of those names in a package-list file. Restating them is exactly how the media and the installer drifted apart in the first place: the menu kept offering an option the media could not honour.

Verification

A minimal ISO built with this change carries 290 rpms instead of 254, including selinux-policy, libselinux-utils, rsyslog, aide, openssl-fips-provider and ntpsec.

Installed from that media:

• the UI wizard's STIG option completes — no Error(1011)
• the installed system comes up SELinux Enforcing
• 0 failed ansible tasks

Lint, matching what lint-checks.sh runs in CI:

python3 -m py_compile photon_installer/isoBuilder.py   → OK
python3 -m isort --check-only --diff .                 → exit 0, no diff
python3 -m flake8 .                                    → exit 0

stigenable is imported at module level, so isoBuilder now depends on it at import time. That transitively pulls in curses via menu.py/window.py, which matters because the ISO builder runs headless in a container — so it is checked rather than assumed. Importing isoBuilder with no TERM and no tty succeeds, and the resulting package selection is unchanged:

module-level import of isoBuilder succeeded (no tty, no TERM)
isoBuilder.stigenable present: True
KS_STIG_PACKAGES: ['audit', 'rsyslog', 'openssl-fips-provider', 'selinux-policy',
                   'libselinux-utils', 'ntp', 'aide', 'libgcrypt']
MISSING from pkg_list: none
RESULT: PASS

(curses only touches the terminal at initscr(), not at import.)

The RPM ships the whole package — photon-os-installer.spec installs %{python3_sitelib}/*, which includes stigenable.py — and docker/Dockerfile installs that RPM into the final image, so the new import resolves wherever isoBuilder actually runs. There is no import cycle: stigenable imports only actionresult, menu and window, none of which reach back to isoBuilder.

The 290-rpm count above includes ntp, libselinux-utils and libgcrypt, which #47 drops from the STIG set.

🤖 Generated with Claude Code

[oliverkurth]

Can you please move this to the top of the file, with import stigenable, and refer to it as stigenable.KS_STIG_PACKAGES?

[dcasota]

git apply --check (strict, no fuzz) returns 0 on v2.8, v2.9 and origin/master; after applying, isoBuilder.py compiles, import stigenable works headless, isoBuilder.stigenable.KS_STIG_PACKAGES is stigenable.KS_STIG_PACKAGES holds, and on all three the hunk lands in downloadPkgs() with the import at module level.
Tested on minimal-iso x86_64. Ongoing full-iso build should be the same. aarch64 not tested.