controls/cis_debian13: map 1.2.1.2 to apt_disable_weak_dependencies

[israel-villar]

Description:

• Update CIS Debian 13 control 1.2.1.2 ("Ensure weak dependencies are configured") to map to apt_disable_weak_dependencies instead of apt_conf_disable_recommends + apt_conf_disable_suggests.

Rationale:

• apt_conf_disable_recommends and apt_conf_disable_suggests only have SCE checks, which are known to fail silently on systems with a noexec /tmp (the exact condition CIS control 1.1.2.4 in this same benchmark recommends configuring). apt_disable_weak_dependencies covers the same requirement with a real OVAL check in addition to bash remediation, so it isn't exposed to that failure mode.

Review Hints:

• Single-line change in controls/cis_debian13.yml, section 1.2 (Configure Software Updates).
• Build: ./build_product --datastream-only debian13
• Related to controls/cis_debian13: Complete and correct section 1 controls #14806 (CIS Debian 13 section 1 completion): that PR intentionally left 1.2.1.2 out at reviewer request, to let a maintainer decide this mapping independently. This PR is that follow-up; it doesn't touch any control also modified by controls/cis_debian13: Complete and correct section 1 controls #14806.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.