1.3 KiB
ISO FIPS package input
The ISO recipe installs a FIPS Debian package before Archipelago provisions its
host firewall. The reviewed package also ships /etc/fips/fips.nft. That file
differs from the policy generated by image-recipe/host-policy/firewall.py, so
the provisioner correctly refuses to overwrite it.
scripts/build-iso-fips-package.py creates a distinct, pinned ISO input package.
It removes only the packaged default fips.nft, removes the matching Debian
conffiles declaration, and gives the derivative a distinct package version.
The script verifies the input SHA-256 and the remaining member bytes and
metadata. It refuses unreviewed package shapes, including an md5sums control
member that would need its own coordinated update. Keep the original package
and the immutable application payload unchanged. The ISO input manifest must
bind the derivative's new hash; a prior manifest must not be rewritten.
This is an ISO input correction, not a new application release. A disposable
package install followed by the unchanged offline provisioner checks the
collision resolution. Full ISO assembly, boot and device acceptance remain
separate gates. The package's existing purge script removes /etc/fips/, so
future package removal or upgrade needs a separate lifecycle review to preserve
the generated policy.