Skip to content

Fix sshd_enable_warning_banner_net crash on Debian products#14770

Open
israel-villar wants to merge 1 commit into
ComplianceAsCode:masterfrom
israel-villar:fix/debian-sshd-warning-banner-crash
Open

Fix sshd_enable_warning_banner_net crash on Debian products#14770
israel-villar wants to merge 1 commit into
ComplianceAsCode:masterfrom
israel-villar:fix/debian-sshd-warning-banner-crash

Conversation

@israel-villar
Copy link
Copy Markdown

The rule had conflicts: sshd_enable_warning_banner active for Debian. Since sshd_enable_warning_banner is not included in Debian data streams, OpenSCAP asserts: xccdf_policy_is_item_selected: Assertion 'false' failed.

Extend the exclusion condition from Ubuntu-only to cover all Debian products.

Description:

  • Extend the conflicts: sshd_enable_warning_banner exclusion condition
    from Ubuntu-only to all Debian products in sshd_enable_warning_banner_net/rule.yml.

Rationale:

  • The rule had conflicts: sshd_enable_warning_banner active for Debian.
    Since sshd_enable_warning_banner is not included in Debian data streams,
    OpenSCAP asserts: xccdf_policy_is_item_selected: Assertion 'false' failed.

Review Hints:

  • One-line change: 'ubuntu' not in product
    'ubuntu' not in product and 'debian' not in product
  • Build and scan to verify: ./build_product debian13 --datastream-only

The rule had `conflicts: sshd_enable_warning_banner` active for Debian.
Since sshd_enable_warning_banner is not included in Debian data streams,
OpenSCAP asserts: `xccdf_policy_is_item_selected: Assertion 'false' failed`.

Extend the exclusion condition from Ubuntu-only to cover all Debian products.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@openshift-ci openshift-ci Bot added the needs-ok-to-test Used by openshift-ci bot. label Jun 5, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Jun 5, 2026

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ok-to-test Used by openshift-ci bot.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant