# ISO FIPS package input

The ISO recipe installs a FIPS Debian package before Archipelago provisions its
host firewall. The reviewed package also ships `/etc/fips/fips.nft`. That file
differs from the policy generated by `image-recipe/host-policy/firewall.py`, so
the provisioner correctly refuses to overwrite it.

`scripts/build-iso-fips-package.py` creates a distinct, pinned ISO input package.
It removes only the packaged default `fips.nft`, removes the matching Debian
`conffiles` declaration, and gives the derivative a distinct package version.
The script verifies the input SHA-256 and the remaining member bytes and
metadata. It refuses unreviewed package shapes, including an `md5sums` control
member that would need its own coordinated update. Keep the original package
and the immutable application payload unchanged. The ISO input manifest must
bind the derivative's new hash; a prior manifest must not be rewritten.

This is an ISO input correction, not a new application release. A disposable
package install followed by the unchanged offline provisioner checks the
collision resolution. Full ISO assembly, boot and device acceptance remain
separate gates. The package's existing purge script removes `/etc/fips/`, so
future package removal or upgrade needs a separate lifecycle review to preserve
the generated policy.