Is your feature request related to a problem? Please describe.
Hi Photon OS team,
I trust you all are doing well. Greetings to the offices around the globe.
In the recent couple of weeks there were a lot of PRs published. As a wish, could you please review them faster? This helps a lot not carrying all testing permutations until the team decides e.g. to bump a version of the same package, to implement a fix differently, not implementing a fix, and much more constellations.
Other contributors published some PRs. Below you find a short description of my PRs - each with a short explanation.
Thank you for helping us.
Best wishes,
Daniel
High attention
#1675 — Fixes linux.spec / linux-esx.spec so canister_build=1 produces a bootable FIPS canister again: the 1004/1010 patch context broke after upstream dropped the WARN_ON() around !digest_size in pkcs1pad_verify(), and .bss was consuming an ondx that made fips_integrity_init() HMAC-fail with a kernel panic; that became an issue on the current kernel once those two hunks stopped applying and section layout no longer hid the relocation bug.
#1673 — Pulls the duplicated FIPS canister .config logic out of linux.spec and linux-esx.spec into shared canister_config.inc, because the two copies had already diverged (linux.spec had no fips=0 branch) and aarch64 fips=0 builds started failing %prep when olddefconfig dropped canister-only Kconfig symbols.
If someone is already in linux.spec / linux-esx.spec, review #1675 and #1673 as a pair — #1673 introduces canister_config.inc, #1675 keeps using it and is the one that actually unblocks a FIPS canister boot. Then #1676, #1668, #1661 and #1669 are still the ones that stop hosts from coming up wrong.
#1676 — Restores cloud-init on Photon 5.0 subrelease 92, where the systemd generator looks for ds-identify on the pre-meson %{_libdir} path and exits 3, so SSH keys, hostname, user-data and network never apply; the break showed up around 9 September 2026 on sr92 cloud-init 26.2 and is not present on sr90/sr91.
#1669 — Fixes STIG first boot: the installer kernel has SELinux compiled in but no policy, so playbook files land as unlabeled_t, systemd-sysctl cannot read zz-stig-hardening.conf, and FIPS PAM / ima_hash=sha256 stay incomplete; that has been the STIG-media first-boot failure for as long as that installer kernel has been built that way.
#1668 — Makes the Kea package that now replaces dhcp-server startable by shipping kea-dhcp4/6/ddns units and stopping keactrl from looking at /usr//etc/kea/keactrl.conf; the user-facing break was filed as #1667 on 31 August 2026 after tdnf update on 5.0 sr91+.
#1661 — Makes docker run --init (and Compose init: true) work on musl/Alpine images again by pointing docker-init at statically linked tini instead of a glibc PIE the container cannot exec; it regressed when commit b3da2fa replaced the old static docker-init with a symlink to dynamic /usr/bin/tini.
Medium attention
#1674 — Puts photon-os-installer v2.9 on the ISO media so a 5.0 image is no longer stuck shipping 2.8 while the builder container already clones master; that split became an issue when upstream released 2.9 on 9 June 2026 and 5.0 stayed pinned.
#1658 — Backports installer 2.8 fixes for the interactive NoneType crash, missing btrfs-progs, uncaptured tdnf output, STIG packages absent from the media (Error(1011)), and dracut i18n_vars not set; those showed up on live minimal-ISO installs and the PR has been open since 5 June 2026.
#1671 — Cleans systemd 257 so every boot stops warning about unknown group render and the initrd stops failing to resolve systemd-journal; render is leftover from the 253→257 rebase, and the journal snippet went empty after the dracut 109 initrd/sysusers change.
#1672 — Makes STIG_HARDEN=1 actually reachable: eight specs pin it with a body %define that overrides the builder’s -D, so that variant has never been parsed or built and defects in it never showed up in CI.
#1670 — Gives aide a real Requires: libgcrypt >= 1.10.4 on subrelease 91+ instead of an unversioned dep that forced the installer to stuff libgcrypt into KS_STIG_PACKAGES as a workaround.
Housekeepings
#1662 — Same static docker-init fix as #1661, but for the 6.0 branch; same regression, same commit, other tree.
#1637 — Backports upstream killproc v2.23 into distrib-compat so killproc/checkproc match 15-character /proc/*/stat names and tighten startup races; Photon’s fork has been missing those fixes for a long time, and this PR has sat open since 21 February 2026.
#1631 — Bulk documentation pass after the packages.broadcom.com URL switch (deprecated links, leftover Bintray, hardcoded paths); opened 15 December 2025 and is not a runtime defect.
Describe the solution you'd like
Team decision on open PRs
Describe alternatives you've considered
No response
Additional context
No response
Is your feature request related to a problem? Please describe.
Hi Photon OS team,
I trust you all are doing well. Greetings to the offices around the globe.
In the recent couple of weeks there were a lot of PRs published. As a wish, could you please review them faster? This helps a lot not carrying all testing permutations until the team decides e.g. to bump a version of the same package, to implement a fix differently, not implementing a fix, and much more constellations.
Other contributors published some PRs. Below you find a short description of my PRs - each with a short explanation.
Thank you for helping us.
Best wishes,
Daniel
High attention
#1675 — Fixes linux.spec / linux-esx.spec so canister_build=1 produces a bootable FIPS canister again: the 1004/1010 patch context broke after upstream dropped the WARN_ON() around !digest_size in pkcs1pad_verify(), and .bss was consuming an ondx that made fips_integrity_init() HMAC-fail with a kernel panic; that became an issue on the current kernel once those two hunks stopped applying and section layout no longer hid the relocation bug.
#1673 — Pulls the duplicated FIPS canister .config logic out of linux.spec and linux-esx.spec into shared canister_config.inc, because the two copies had already diverged (linux.spec had no fips=0 branch) and aarch64 fips=0 builds started failing %prep when olddefconfig dropped canister-only Kconfig symbols.
If someone is already in linux.spec / linux-esx.spec, review #1675 and #1673 as a pair — #1673 introduces canister_config.inc, #1675 keeps using it and is the one that actually unblocks a FIPS canister boot. Then #1676, #1668, #1661 and #1669 are still the ones that stop hosts from coming up wrong.
#1676 — Restores cloud-init on Photon 5.0 subrelease 92, where the systemd generator looks for ds-identify on the pre-meson %{_libdir} path and exits 3, so SSH keys, hostname, user-data and network never apply; the break showed up around 9 September 2026 on sr92 cloud-init 26.2 and is not present on sr90/sr91.
#1669 — Fixes STIG first boot: the installer kernel has SELinux compiled in but no policy, so playbook files land as unlabeled_t, systemd-sysctl cannot read zz-stig-hardening.conf, and FIPS PAM / ima_hash=sha256 stay incomplete; that has been the STIG-media first-boot failure for as long as that installer kernel has been built that way.
#1668 — Makes the Kea package that now replaces dhcp-server startable by shipping kea-dhcp4/6/ddns units and stopping keactrl from looking at /usr//etc/kea/keactrl.conf; the user-facing break was filed as #1667 on 31 August 2026 after tdnf update on 5.0 sr91+.
#1661 — Makes docker run --init (and Compose init: true) work on musl/Alpine images again by pointing docker-init at statically linked tini instead of a glibc PIE the container cannot exec; it regressed when commit b3da2fa replaced the old static docker-init with a symlink to dynamic /usr/bin/tini.
Medium attention
#1674 — Puts photon-os-installer v2.9 on the ISO media so a 5.0 image is no longer stuck shipping 2.8 while the builder container already clones master; that split became an issue when upstream released 2.9 on 9 June 2026 and 5.0 stayed pinned.
#1658 — Backports installer 2.8 fixes for the interactive NoneType crash, missing btrfs-progs, uncaptured tdnf output, STIG packages absent from the media (Error(1011)), and dracut i18n_vars not set; those showed up on live minimal-ISO installs and the PR has been open since 5 June 2026.
#1671 — Cleans systemd 257 so every boot stops warning about unknown group render and the initrd stops failing to resolve systemd-journal; render is leftover from the 253→257 rebase, and the journal snippet went empty after the dracut 109 initrd/sysusers change.
#1672 — Makes STIG_HARDEN=1 actually reachable: eight specs pin it with a body %define that overrides the builder’s -D, so that variant has never been parsed or built and defects in it never showed up in CI.
#1670 — Gives aide a real Requires: libgcrypt >= 1.10.4 on subrelease 91+ instead of an unversioned dep that forced the installer to stuff libgcrypt into KS_STIG_PACKAGES as a workaround.
Housekeepings
#1662 — Same static docker-init fix as #1661, but for the 6.0 branch; same regression, same commit, other tree.
#1637 — Backports upstream killproc v2.23 into distrib-compat so killproc/checkproc match 15-character /proc/*/stat names and tighten startup races; Photon’s fork has been missing those fixes for a long time, and this PR has sat open since 21 February 2026.
#1631 — Bulk documentation pass after the packages.broadcom.com URL switch (deprecated links, leftover Bintray, hardcoded paths); opened 15 December 2025 and is not a runtime defect.
Describe the solution you'd like
Team decision on open PRs
Describe alternatives you've considered
No response
Additional context
No response