specs: make STIG_HARDEN reachable instead of permanently pinned off

[dcasota]

Eight specs gate a STIG build variant on STIG_HARDEN, and every one pins it with a plain %define in the spec body.

The constellation this breaks

Which constellation is affected: STIG_HARDEN=1 — on every arch, every subrelease, every ISO type. It is currently unreachable, which means it has never been built.

A %define in the spec body is evaluated during parse and overwrites anything passed with --define. Photon's builder feeds every per-package macro from pkg_build_options.json as -D (PackageUtils.py:345: for macro in macros: rpmBuildcmd += ["-D", macro]), so that is the only channel that exists. Verified two ways:

minimal probe    rpmspec -D "X 1" on a spec with a plain define of STIG_HARDEN 0
                 -> "STIG_HARDEN is 0"
90/systemd.spec  rpmspec -D "STIG_HARDEN 1"
                 -> harden-tmpfs applied in %prep: 0   (same with and without -D)

The consequence isn't that the variant builds wrongly — it's that the variant has never been parsed at all, so defects accumulate in it unseen. In SPECS/systemd that had reached a duplicate patch index and a patch file missing from the directory, either of which aborts the build outright (fixed separately in #1671).

The change

%define STIG_HARDEN 0 → %{!?STIG_HARDEN: %global STIG_HARDEN 0} in all eight:

90/libpwquality · 90/Linux-PAM · 90/openssh · 90/systemd · libpwquality · Linux-PAM · openssh · shadow

Same default, now overridable.

Testing — both constellations, all eight specs

Parse matrix, at each spec's own subrelease (90 for the SPECS/90 tree, 91 where build_if requires it):

spec	STIG=0	STIG=1	checker
90/libpwquality	OK	OK	OK
90/Linux-PAM	OK	OK	OK
90/openssh	OK	OK	OK
90/systemd	OK	OK	OK
libpwquality	OK	OK	OK
Linux-PAM	OK	OK	OK
openssh	OK	OK	OK
shadow	OK	OK	OK

Parsing alone isn't proof of buildability — the systemd defect was a missing file that parsing never caught — so every Source:/Patch: reachable in each cell was also resolved against the builder's staging model (rpm resolves local sources by basename; PackageUtils.py:70-75 stages a package's sources into a flat SOURCES/):

spec	STIG=0 refs	STIG=1 refs	result
90/libpwquality	1	2	all resolvable
90/Linux-PAM	12	13	all resolvable
90/openssh	30	30	all resolvable
90/systemd	27	28	all resolvable
libpwquality	1	2	all resolvable
Linux-PAM	5	6	all resolvable
openssh	11	11	all resolvable
shadow	18	20	all resolvable

support/spec-checker/check_spec.py exits 0 on all eight.

Why the default build is unaffected

With STIG_HARDEN unset the macro still evaluates to 0, so every conditional takes the same branch as before and the expanded spec is unchanged. Release bumps and changelog entries only.

Note on shadow: it declares Source12: twice, but in mutually exclusive %if branches — that is the correct pattern and needs no change. (rpm resolves both to SOURCES/useradd, since local sources resolve by basename.)

Rebased and re-verified 2026-09-09

Rebased onto 5.0 294c3ce28. The conflict was in openssh.spec, where upstream
upgraded 10.4p1 → 10.5p1 (CVE-2026-73281/73282/73283). Upstream's version
and its changelog entry are kept; this PR's entry is re-versioned to
10.5p1-2. Bookkeeping only — the %{!?STIG_HARDEN: ...} change itself merged
unchanged, and still lands in all eight specs.

The premise still holds against current 5.0: all four spot-checked specs
(openssh, shadow, Linux-PAM, libpwquality) still carry the plain
%define STIG_HARDEN 0, so every STIG conditional in them remains unreachable
from -D or pkg_build_options.json.

check_spec.py exits 0 on all eight specs.

Scope note

This PR makes a build mode reachable; it does not change any shipped default.
STIG_HARDEN is still 0 unless explicitly set, so the permutation matrix's
results are unaffected by it either way — no row currently builds with
STIG_HARDEN=1. That is precisely the gap it exists to close.