{"id":13405891,"url":"https://github.com/plus3it/spel","last_synced_at":"2025-09-12T02:43:26.949Z","repository":{"id":37561554,"uuid":"55595319","full_name":"plus3it/spel","owner":"plus3it","description":"STIG-Partitioned Enterprise Linux (spel)","archived":false,"fork":false,"pushed_at":"2025-09-05T17:22:25.000Z","size":2223,"stargazers_count":102,"open_issues_count":11,"forks_count":62,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-09-05T19:28:45.404Z","etag":null,"topics":["aws-ec2","azure","centos6","centos7","packer","rhel6","rhel7","vagrant-boxes","vhd","virtualbox","vmware-image"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plus3it.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"docs/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2016-04-06T10:01:22.000Z","updated_at":"2025-09-05T17:22:29.000Z","dependencies_parsed_at":"2022-07-14T00:50:28.801Z","dependency_job_id":"1e570214-b365-44a1-b6c4-800a407895c0","html_url":"https://github.com/plus3it/spel","commit_stats":null,"previous_names":[],"tags_count":108,"template":false,"template_full_name":null,"purl":"pkg:github/plus3it/spel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fspel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fspel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fspel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fspel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plus3it","download_url":"https://codeload.github.com/plus3it/spel/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fspel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274744062,"owners_count":25341136,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-12T02:00:09.324Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-ec2","azure","centos6","centos7","packer","rhel6","rhel7","vagrant-boxes","vhd","virtualbox","vmware-image"],"created_at":"2024-07-30T19:02:15.069Z","updated_at":"2025-09-12T02:43:26.937Z","avatar_url":"https://github.com/plus3it.png","language":"Shell","funding_links":[],"categories":["Shell","HCL"],"sub_categories":[],"readme":"[![pullreminders](https://pullreminders.com/badge.svg)](https://pullreminders.com?ref=badge)\n\n# spel\n\nSTIG-Partitioned Enterprise Linux (_spel_) is a project that helps create and\npublish Enterprise Linux images that are partitioned according to the\n[DISA STIG][0]. The resulting images also use LVM to simplify volume management.\nThe images are configured with help from the scripts and packages in the\n[`AMIgen7`][31], [`AMIgen8`][40], and  [`AMIgen9`][47] projects[^1].\n\nNotes on Lifecycle:\n\n1.  Images are released on a monthly cadence. This cadence ensures that, if a\n    user launches a brand new instance from the most-recently published AMI,\n    that there will be less than a month's worth of system-patches to apply as\n    part of the system-owner's system-provisioning processes.\n1.  \"Free\" Enterprise Linux distributions are configured to use the public\n    repositories offered by the distribution-owner. If running EC2s inside of a\n    VPC with no access to the internet at large, it will not be possible to\n    install additional RPMs or patch systems without the use of either a proxy\n    or standing up a private yum mirror\n1.  Red Hat images are configured to use a given cloud service provider's (CSP) \n    [Red Hat Update Infrastructure](https://access.redhat.com/products/red-hat-update-infrastructure)\n    (a.k.a., \"RHUI\") repositories. These repositories are managed by Red \n    Hat engineers and provide local RPM update-service within each \n    CSP-partner's networks. Unlike RPM-access via RHN or Satellite, RHUI access \n    is tied to and paid for via your CSP's billing-mechanisms. RHUI access also \n    entitles cloud-VMs' owners to limited operating system support through the \n    respective CSP's support channels.\n1.  AWS Specific notes:\n    * Access to the RHUI repositories is gated, in part, by an attribute\n      attached to EC2s. This attribute is inherited from their corresponding\n      AMIs. To view this attribute external to the EC2, execute:\n\n        ~~~\n        aws ec2 describe-instances --query 'Reservations[].Instances[].UsageOperation' --instance-ids\n        ~~~\n\n      This _should_ return a value of `RunInstances:0010`. If the value is just\n      `RunInstances` the necessary attribute is missing from the EC2.\n\n      The attribute may also be viewed internal to the EC2 by executing:\n\n        ~~~\n        curl http://169.254.169.254/latest/dynamic/instance-identity/document | \\\n        grep \"billingProducts\"\n        ~~~\n\n      This _should_ return a value of `\"billingProducts\" : [ \"bp-6fa54006\" ]`.\n      If not, the necessary attribute is missing from the EC2.\n\n      In either case, lack of the requisite attribute will mean that attempts to\n      install or update RPMs from RHUI will fail.\n    * If patch-updates should come from RHN, Satellite or other private\n      repository, do not use the AMIs published by the maintainers of this\n      project. Because the previously-mentioned EC2-attribute is attached to\n      such AMIs, you will be billed for the RHUI access even if you never use\n      it. Feel free to use this project's code to generate your own,\n      unencumbered AMIs.\n    * Further information about AWS polices for Red Hat EC2s may be found in\n      AWS's [RHEL FAQ](https://aws.amazon.com/partners/redhat/faqs/)\n\n## Why spel\n\nVMs' root filesystems are generally not live-repartitionable once launced from\ntheir images. As a result, if a STIG-scan is performed against most of the\ncommunity-published images for Red Hat and related distros (CentOS/CentOS\nStream, [Oracle Linux][41], [Rocky][42], [Alma][43] or [Liberty][44]), those\nscans will note failures for each of the various \"`${DIRECTORY}` is on its own\nfilesystem\" tests. The images produced through this project are designed to\nensure that these particular scan-failures do not occur.\n\nAside from addressing the previously-noted partitioning findings, spel applies\nonly those STIG-related hardenings that need to be in place \"from birth\" (i.e.,\nwhen a system is first created from KickStart, VM-template, Amazon Machine\nImage, etc.). This includes things like:\n\n- Activation of SELinux\n  - Application of SELinux user-confinement to the default-user[^2]\n  - Application of SELinux role-transition rules for the default-user\n- Activation of FIPS mode\n- Support for BIOS- and/or EFI-boot modes (the latter being a requisite for use\n  of [SecureBoot](https://access.redhat.com/articles/5254641))\n\nThe spel-produced images are expected to act as a better starting-point in a\nlarger hardening process.\n\nIf your organization does not already have an automated hardening process,\nplease see our tool, [Watchmaker](https://github.com/plus3it/watchmaker.git).\nThis tool is meant to help spel-users (and users of other Enterprise Linux\nimages) by performing launch-time hardening activities.\n\n## We have a FAQ now!\n\nWe've added an [FAQ](docs/FAQ.md) to the project. Hopefully, your questions are\nanswered there. If they aren't, please feel free to submit an issue requesting\nan appropriate FAQ entry.\n\n## Current Published Images\n\nSPEL AMIs are published monthly. The AMI table below contains links to the AWS\nConsole that search by AMI Name and sort the result by creation date. The most\nrecent AMI of each build will be at the top when viewed in the AWS Console.\n\nRPM Manifests for published images are available in the [manifests](manifests)\ndirectory.\n\n**Please note:** the RPM-manifests published to this directory are generated\nfor the AWS (CONUS) commercial regions. Due to potential deltas between the\nrepositories used for the commercial and govcloud regions, there _may_ also\nexist deltas between what is found in the manifests in this project and the\nversion-numbers found in the GovCloud region AMIs.\n\n| AWS Region    | Builder Name / Link                     |\n|---------------|-----------------------------------------|\n| us-east-1     | [spel-minimal-rhel-8-hvm][1027]         |\n|               | [spel-minimal-ol-8-hvm][1045]           |\n|               | [spel-minimal-rhel-9-hvm][1051]         |\n|               | [spel-minimal-ol-9-hvm][1063]           |\n|               | [spel-minimal-centos-9stream-hvm][1069] |\n|               | [spel-minimal-amzn-2023-hvm][1057]      |\n| us-east-2     | [spel-minimal-rhel-8-hvm][1029]         |\n|               | [spel-minimal-ol-8-hvm][1046]           |\n|               | [spel-minimal-rhel-9-hvm][1052]         |\n|               | [spel-minimal-ol-9-hvm][1064]           |\n|               | [spel-minimal-centos-9stream-hvm][1070] |\n|               | [spel-minimal-amzn-2023-hvm][1057]      |\n| us-west-1     | [spel-minimal-rhel-8-hvm][1031]         |\n|               | [spel-minimal-ol-8-hvm][1047]           |\n|               | [spel-minimal-rhel-9-hvm][1053]         |\n|               | [spel-minimal-ol-9-hvm][1065]           |\n|               | [spel-minimal-centos-9stream-hvm][1071] |\n|               | [spel-minimal-amzn-2023-hvm][1057]      |\n| us-west-2     | [spel-minimal-rhel-8-hvm][1033]         |\n|               | [spel-minimal-ol-8-hvm][1048]           |\n|               | [spel-minimal-rhel-9-hvm][1054]         |\n|               | [spel-minimal-ol-9-hvm][1066]           |\n|               | [spel-minimal-centos-9stream-hvm][1072] |\n|               | [spel-minimal-amzn-2023-hvm][1057]      |\n| us-gov-west-1 | [spel-minimal-rhel-8-hvm][1035]         |\n|               | [spel-minimal-ol-8-hvm][1049]           |\n|               | [spel-minimal-rhel-9-hvm][1055]         |\n|               | [spel-minimal-ol-9-hvm][1067]           |\n|               | [spel-minimal-centos-9stream-hvm][1073] |\n|               | [spel-minimal-amzn-2023-hvm][1057]      |\n| us-gov-east-1 | [spel-minimal-rhel-8-hvm][1037]         |\n|               | [spel-minimal-ol-8-hvm][1050]           |\n|               | [spel-minimal-rhel-9-hvm][1056]         |\n|               | [spel-minimal-ol-9-hvm][1068]           |\n|               | [spel-minimal-centos-9stream-hvm][1062] |\n|               | [spel-minimal-amzn-2023-hvm][1074]      |\n\n| Vagrant Cloud Name                          | Vagrant Provider |\n|---------------------------------------------|------------------|\n| [plus3it/spel-minimal-centos-9stream][2002] | virtualbox       |\n\n## Official AWS Owner Account IDs for Images\n\nThe following table lists the official owner accounts for the images.\n\n| AWS Partition | Account ID   | Effective Release     |\n|---------------|--------------|-----------------------|\n| aws           | 174003430611 | 2023.08.1 and later   |\n| aws-us-gov    | 216406534498 | 2023.08.1 and later   |\n\n## Deprecated AWS Owner Account IDs\n\nThe following table lists AWS account IDs previously used to host SPEL images.\nThese accounts are now closed, and the associated images are no longer available.\n\n| AWS Partition | Account ID   | Effective Release     |\n|---------------|--------------|-----------------------|\n| aws           | 701759196663 | 2023.07.1 and earlier |\n| aws-us-gov    | 039368651566 | 2023.07.1 and earlier |\n\n## Deprecated Images\n\nDeprecated Images have become end-of-life and no longer have available yum repos.\nThe images remain public until the image deprecation period expires, typically\n1 year after publishing.\n\n| AWS Region    | Builder Name / Link                     |\n|---------------|-----------------------------------------|\n| us-east-1     | [spel-minimal-rhel-7-hvm][1000]         |\n|               | [spel-minimal-centos-7-hvm][1002]       |\n|               | [spel-minimal-centos-8stream-hvm][1039] |\n| us-east-2     | [spel-minimal-rhel-7-hvm][1005]         |\n|               | [spel-minimal-centos-7-hvm][1007]       |\n|               | [spel-minimal-centos-8stream-hvm][1040] |\n| us-west-1     | [spel-minimal-rhel-7-hvm][1010]         |\n|               | [spel-minimal-centos-7-hvm][1012]       |\n|               | [spel-minimal-centos-8stream-hvm][1041] |\n| us-west-2     | [spel-minimal-rhel-7-hvm][1015]         |\n|               | [spel-minimal-centos-7-hvm][1017]       |\n|               | [spel-minimal-centos-8stream-hvm][1042] |\n| us-gov-west-1 | [spel-minimal-rhel-7-hvm][1020]         |\n|               | [spel-minimal-centos-7-hvm][1022]       |\n|               | [spel-minimal-centos-8stream-hvm][1043] |\n| us-gov-east-1 | [spel-minimal-rhel-7-hvm][1025]         |\n|               | [spel-minimal-centos-7-hvm][1026]       |\n|               | [spel-minimal-centos-8stream-hvm][1044] |\n\n| Vagrant Cloud Name                    | Vagrant Provider |\n|---------------------------------------|------------------|\n| [plus3it/spel-minimal-centos-7][2001] | virtualbox       |\n\n[1000]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1002]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n[1005]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1007]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n[1010]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1012]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n[1015]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1017]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n[1020]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1022]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n[1025]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-7-hvm-2024.07.1;v=3\u003e\n[1026]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-7-hvm-2024.07.1;v=3\u003e\n\n[1027]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n[1029]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n[1031]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n[1033]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n[1035]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n[1037]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-8-hvm-2025.08.1;v=3\u003e\n\n[1039]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n[1040]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n[1041]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n[1042]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n[1043]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n[1044]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-8stream-hvm;v=3\u003e\n\n[1045]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n[1046]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n[1047]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n[1048]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n[1049]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n[1050]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-ol-8-hvm-2025.08.1;v=3\u003e\n\n[1051]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n[1052]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n[1053]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n[1054]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n[1055]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n[1056]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-rhel-9-hvm-2025.08.1;v=3\u003e\n\n[1057]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n[1058]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n[1059]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n[1060]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n[1061]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n[1062]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-centos-9stream-hvm-2025.08.1;v=3\u003e\n\n[1063]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n[1064]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n[1065]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n[1066]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n[1067]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n[1068]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-ol-9-hvm-2025.08.1;v=3\u003e\n\n[1069]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n[1070]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n[1071]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n[1072]: \u003chttps://console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=public-images;owner=174003430611;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n[1073]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-west-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n[1074]: \u003chttps://console.amazonaws-us-gov.com/ec2/v2/home?region=us-gov-east-1#Images:visibility=public-images;owner=216406534498;imageName=:spel-minimal-amzn-2023-hvm-2025.08.1;v=3\u003e\n\n[2001]: \u003chttps://app.vagrantup.com/plus3it/boxes/spel-minimal-centos-7\u003e\n[2002]: \u003chttps://app.vagrantup.com/plus3it/boxes/spel-minimal-centos-9stream\u003e\n\n## Default Username\n\nThe default username for all spel images is `maintuser`.\n\nIf you wish to change the default username at launch, you can do so via\n`cloud-init` with userdata[^3] something like the following. Change `\u003cUSERNAME\u003e` to\nyour desired value.\n\n```yaml\n#cloud-config\nsystem_info:\n  default_user:\n    name: \u003cUSERNAME\u003e\n    gecos: spel default user\n    lock_passwd: true\n```\n\n\n## Default User Security-Constraints\n\nDue to updates to the STIGs \u0026ndash; currently just for EL7, but it is assumed\nthat similar changes for EL8 and later distros will be added to future\nSTIG-releases \u0026ndash; the default-user's account _may_ have additional SELinux\nrules applied to it. These rules will typically manifest in processes that\nstart as the default-user (i.e., processes run as the `root` user _after_\nprivilege-escalation via the `sudo` subsystem) receiving `permission denied`\nerrors when attempting to access \"sensitive\" files.  These \"sensitive\" files\nare any that have the `shadow_t` SELinux context-label applied to them. By\ndefault, these will only include:\n\n- /etc/security/opasswd\n- /etc/shadow\n- /etc/gshadow\n\nA definitive list may be gathered by executing the command:\n\n```\nfind / -context \"*shadow_t*\"`\n```\n\nIf your workflows absolutely _require_ the ability to access these files after\na role-transition from the default-user account to `root`, it will be necessary\nto update the userData payload's `cloud-config` content to include a block\nsimilar to:\n\n```yaml\n#cloud-config\nsystem_info:\n  default_user:\n    name: \u003cUSERNAME\u003e\n    gecos: spel default user\n    lock_passwd: true\n    selinux_user: unconfined_u\n    sudo: [\"ALL=(root) NOPASSWD:ALL\"]\n```\n\nHowever, doing so will result in security scan-failures when the scanning-tool\ntries to ensure that all locally-managed, interactive users are\nproperly-constrained users and, where appropriate, have SELinux\nprivilege-transition rules defined.\n\n## Prerequisites\n\n[`Packer`][2] by [Hashicorp][1] is used to manage the process of building\nimages.\n\n1.  [Download][3] and extract `packer` for your platform. Add it to your PATH,\n    if you like. On Linux, watch out for other `packer` executables with the\n    same name (if building from an Enterprise Linux distro, `/sbin/packer` may\n    be present due to the `cracklib-dicts` RPM).\n\n2.  If building AMIs for Amazon Web Services, ensure your [AWS credentials are\n    configured][4]. You do not really need the `aws` cli utility, but it is a\n    convenient way to configure the credential file. You can also export the\n    [environment variables][5]. Or, if running `packer` in an EC2 instance, an\n    [instance role][6] with the requisite permissions will also work. See the\n    [`packer` docs][7] for details on the necessary permissions.\n\n    _NOTE_: No packer templates in this project will contain variables for AWS\n    credentials; this is intentional, to avoid mistakes where credentials get\n    committed to the repository. Instead, `packer` knows to read the\n    credentials from the credential file or from the environment variables, or\n    to retrieve them from the instance role. See the [docs][7].\n\n3.  If building VirtualBox image(s), you will need to install [VirtualBox][12]\n    and [Vagrant][13].\n\n4.  If building VMware image(s), [depending on your platform][14], you will\n    need to install either [VMware Fusion][15], [VMware Workstation Pro][16], or\n    [VMware Player][17]. For all platforms, you will also need [Vagrant][13].\n\n5.  The template(s) push the Vagrant boxes for the VirtualBox and VMware images\nto [Hashicorp Vagrant Cloud][19], which requires a [Vagrant Cloud account][21].\n\n6.  If building a VHD or Image for Azure, ensure you have [authorized access\n    to ARM][23]. The creation of destination objects and a Service Principal\n    can either be done [manually][24] or via [script][25]. If not building in\n    Public region, use of device login is not possible and a Service Principal\n    is required.\n\n## Usage\n\n_NOTE_: In all steps below, the examples use syntax that works on Linux. If you\nare running `packer` from a Windows system, simply use the appropriate syntax\nfor the _relative path_ to the packer template. Most important, for Windows,\nuse `.\\` preceding the path to the template. E.g.\n`.\\spel\\minimal-linux.json`.\n\n1.  Clone the repository:\n\n    ```bash\n    git clone https://github.com/plus3it/spel \u0026\u0026 cd spel\n    ```\n\n2.  Validate the template (Optional):\n\n    ```bash\n    packer validate spel/minimal-linux.pkr.hcl\n    ```\n\n    The project-included Packer HCL files have been pre-validated. If you\n    encounter validation-errors with the included HCL files, it means that\n    you're using a newer Packer version than the project has been tested\n    against. Please open an [issue][46] to report the problem, ensuring to\n    include the Packer version you were using when you encountered the problem.\n\n3.  Begin the build. This requires at least two variables,\n    `spel_identifier` and `spel_version`. See the section [Packer Variables](#minimal-linux-packer-variables)\n    for more details.\n\n    ```bash\n    packer build \\\n        -var 'spel_identifier=unique-project-id' \\\n        -var 'spel_version=dev001' \\\n        -var 'virtualbox_vagrantcloud_username=myvagrantclouduser' \\\n        spel/minimal-linux.pkr.hcl\n    ```\n\n    _NOTE_: This will build images for _all_ the [builders defined in the\n    template](#minimal-linux-packer-builders). Use `packer build --help` to\n    see how to restrict the build to to a subset of the builders using the `-only`\n    or `-except` arguments.\n\n    If building the VirtualBox or VMware images for use with Vagrant, the\n    template is configured to host the resulting images with\n    [Hashicorp Vagrant Cloud][19]. This requires passing the variable\n    `virtualbox_vagrantcloud_username` and exporting the environment variable\n    [`VAGRANT_CLOUD_TOKEN`][20].\n\n## Minimal Linux Packer Template\n\nThe Minimal Linux template builds STIG-partitioned images with a set of\npackages that correspond to the \"Minimal\" install option in Anaconda. Further,\nthe AWS images include a handful of additional packages that are intended to\nincrease functionality in EC2 and make the images more comparable with Amazon\nLinux. Similarly, the Azure builder will attempt to install the `WALinuxAgent`\nRPM into the VM-template to make the template more integratable into\nAzure-based deployments.\n\n-   _Template Path_: `spel/minimal-linux.pkr.hcl`\n\nFor all inputs to the template, see [spel/README.md](spel/README.md)\n\n### Minimal Linux Packer Builders\n\nThe Minimal Linux `packer` template includes the following builders:\n\n| Builder Name                                     | Description                                                      |\n|--------------------------------------------------|------------------------------------------------------------------|\n| `amazon-ebssurrogate.minimal-centos-9stream-hvm` | amazon-ebs builder for a minimal CentOS Stream 9 HVM AMI         |\n| `amazon-ebssurrogate.minimal-ol-9-hvm`           | amazon-ebs builder for a minimal Oracle Linux 9 HVM AMI          |\n| `amazon-ebssurrogate.minimal-rhel-9-hvm`         | amazon-ebs builder for a minimal RHEL 9 HVM AMI                  |\n| `amazon-ebssurrogate.minimal-ol-8-hvm`           | amazon-ebs builder for a minimal Oracle Linux 8 HVM AMI          |\n| `amazon-ebssurrogate.minimal-rhel-8-hvm`         | amazon-ebs builder for a minimal RHEL 8 HVM AMI                  |\n| `virtualbox-iso.minimal-centos-9stream-image`    | virtualbox-iso builder for a minimal CentOS Stream 9 Vagrant Box |\n\n### Minimal Linux Packer Post-Provisioners\n\nThe Minimal Linux `packer` template includes the following post-provisioners:\n\n-   `vagrant`: The vagrant post-provisioner creates vagrant boxes from on the\n    `virtualbox` and `vmware` images.\n\n-   `vagrant-cloud`: The vagrant-cloud post-provisioners upload the vagrant\n    boxes to [Hashicorp Vagrant Cloud][19].\n\n## Building for the AWS US GovCloud Region\n\nTo build images for the AWS US GovCloud regions, `us-gov-west-1` or `us-gov-east-1`,\nit is necessary to pass several variables that are specific to the region. The\nAMI filters below have been tested and/or created in `us-gov-west-1` to work with the\n_spel_ template(s). Also, the builders should be restricted so as _not_ to build\nthe Vagrant images.\n\n```bash\npacker build \\\n    -var 'spel_identifier=unique-project-id' \\\n    -var 'spel_version=dev001' \\\n    -var 'aws_region=us-gov-west-1' \\\n    -exclude 'virtualbox-iso.*' \\\n    spel/minimal-linux.pkr.hcl\n```\n\n## Building for Microsoft Azure\n\nA source Marketplace Image Offer or Custom Image Name and Resource Group are required\nfrom which to start the SPEL Azure build.\n\nThe resultant SPEL Image will be configured to use the Azure Linux agent, [WALinuxAgent][27]\nper recommended [configurations][28]. Currently, the use of cloud-init exclusively\ndoes not enable execution/installation of [Azure VM Extensions][30]. The below\nvariables also disable FIPS mode in the resultant SPEL VHD or Image. Currently,\nthe Azure Linux agent [does not support FIPS mode][29] when utilizing Azure VM\nExtensions. If no plans exist to utilize Azure VM Extensions on VMs provisioned\nfrom SPEL VHDs or Images, FIPS mode can be enabled, but the `waagent` configuration\nmust also be modified accordingly.\n\nThe variables referenced in the packer builds below should be modified with\nappropriate parameters for your environment. Any content between and including\nthe \u003c and \u003e characters should be replaced.\n\nLogin to azure using the az cli. Packer will use the session setup by the az cli.\n\n```bash\npacker build \\\n    -var 'spel_identifier=unique-project-id' \\\n    -var 'spel_version=0.0.1' \\\n    -var 'amigen_extra_rpms=[\"WALinuxAgent\"]' \\\n    -var 'amigen_fips_disable=true' \\\n    -var 'amigen8_repo_names=[\"rhui-microsoft-azure-rhel8\"]' \\\n    -var 'azure_image_offer=rhel-raw' \\\n    -var 'azure_image_publisher=RedHat' \\\n    -var 'azure_image_sku=8_8' \\\n    -var 'azure_managed_image_resource_group_name=\u003cresource group short name\u003e' \\\n    -only 'azure-arm.minimal-rhel-8-image' \\\n    spel/minimal-linux.pkr.hcl\n```\n\n## Building for OpenStack\n\nTo build images for an OpenStack environment, it is necessary to pass several variables\nthat are specific to the environment. Also, the builders should be restricted so\nas _not_ to build the Vagrant images.\n\n```bash\nsource your_openstack_credentials_file.sh\npacker build \\\n    -var 'spel_identifier=spel' \\\n    -var 'spel_version=0.0.1' \\\n    -var 'openstack_insecure=false' \\\n    -var 'openstack_flavor=your_flavor_name_for_temporary_instance' \\\n    -var 'openstack_floating_ip_network=your_provider_network_name' \\\n    -var 'openstack_networks=your_network_id_for_temporary_instance,second_network_id,etc.' \\\n    -var 'openstack_security_groups=your_security_group_name_for_temporary_instance,second_sg_name,etc.' \\\n    -var 'openstack_source_image_name=your_source_image_name' \\\n    -only 'openstack.*' \\\n    spel/minimal-linux.pkr.hcl\n```\n\nFor expected values, see links below:\n* [openstack_allow_insecure][34] (true|false)\n* [openstack_flavor_name][35] (string)\n* [openstack_floating_ip_network_name][36] (string)\n* [openstack_network_ids][37] (comma-separated list of strings)\n* [openstack_security_group_names][38] (comma-separated list of strings)\n* [openstack_source_image_name][39] (string)\n\n## Testing With AMIgen\n\nThe spel automation leverages the AMIgen8 and AMIgen9 projects as a\nbuild-helpers for creation of EL8 and EL9 Amazon Machine Images (Azure\nVM-templates, etc.), respectively.  Due to the closely-coupled nature of the\ntwo projects, it's recommended that any changes made to AMIgen8 or AMIgen9 be\ntested with spel prior to merging changes to either project's master branch.\n\nTo facilitate this testing, the following runtime-variables were added to spel:\n\n- `amigen8_source_branch`\n- `amigen8_source_url`\n- `amigen9_source_branch`\n- `amigen9_source_url`\n\nUsing these runtime-variables allows one to point spel to\na fork/branch of AMIgen8 or AMIgen9 during a integration-test build. To test,\nupdate your `packer` invocation by adding elements like:\n\n```bash\npacker build \\\n    -var 'amigen8_source_url=https://github.com/\u003cFORK_USER\u003e/AMIgen8.git' \\\n    -var 'amigen8_source_branch=IssueNN' \\\n    ...\n    minimal-linux.pkr.hcl\n```\n\nSimilarly, these variables may be specified as environment variables by using [`PKR_VAR_\u003cvar_name\u003e`][45]\ndeclarations[^4] (e.g., `PKR_VAR_amigen8_source_branch`). To do so, change the\nabove example to:\n\n```bash\nexport PKR_VAR_amigen8_source_branch=\"=https://github.com/\u003cFORK_USER\u003e/AMIgen8.git\"\nexport PKR_VAR_amigen8_source_branch=\"IssueNN\"\n\npacker build \\\n    [...options elided...]\n    minimal-linux.pkr.hcl\n```\n\n\n\n[0]: http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.aspx\n[1]: https://www.hashicorp.com/\n[2]: https://www.packer.io/\n[3]: https://www.packer.io/downloads.html\n[4]: http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html\n[5]: http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-environment\n[6]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html\n[7]: https://www.packer.io/docs/builders/amazon.html\n[9]: https://github.com/ferricoxide/Lx-GetAMI-Utils\n[10]: https://fedoraproject.org/wiki/EPEL\n[11]: https://www.packer.io/docs/builders/amazon-ebs.html\n[12]: https://www.virtualbox.org/wiki/Downloads\n[13]: https://www.vagrantup.com/downloads.html\n[14]: https://www.packer.io/docs/builders/vmware-iso.html\n[15]: https://www.vmware.com/products/fusion/overview.html\n[16]: https://www.vmware.com/products/workstation/overview.html\n[17]: https://www.vmware.com/products/player/\n[18]: https://www.packer.io/docs/builders/virtualbox-iso.html\n[19]: https://vagrantcloud.com/help/\n[20]: https://vagrantcloud.com/help/user-accounts/authentication\n[21]: https://vagrantcloud.com/account/new\n[22]: https://www.packer.io/docs/builders/azure.html\n[23]: https://www.packer.io/docs/builders/azure-setup.html\n[24]: https://www.packer.io/docs/builders/azure-setup.html#manual-setup\n[25]: https://www.packer.io/docs/builders/azure-setup.html#guided-setup\n[26]: https://azure.microsoft.com/en-us/services/managed-disks/\n[27]: https://github.com/Azure/WALinuxAgent\n[28]: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-upload-centos#centos-70\n[29]: https://github.com/Azure/WALinuxAgent/issues/760\n[30]: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-features\n[31]: https://github.com/plus3it/AMIgen7\n[32]: https://github.com/plus3it/AMIgen7/blob/master/Docs/README_CustomPartitioning.md\n[33]: https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud.qcow2\n[34]: https://www.packer.io/docs/builders/openstack#insecure\n[35]: https://www.packer.io/docs/builders/openstack#flavor\n[36]: https://www.packer.io/docs/builders/openstack#floating_ip_network\n[37]: https://www.packer.io/docs/builders/openstack#networks\n[38]: https://www.packer.io/docs/builders/openstack#security_groups\n[39]: https://www.packer.io/docs/builders/openstack#source_image_name\n[40]: https://github.com/plus3it/amigen8\n[41]: https://www.oracle.com/linux/\n[42]: https://rockylinux.org/\n[43]: https://almalinux.org/\n[44]: https://www.suse.com/products/suse-liberty-linux/\n[45]: https://developer.hashicorp.com/packer/guides/hcl/variables#from-environment-variables\n[46]: https://github.com/plus3it/spel/issues/new\n[47]: https://github.com/plus3it/amigen9\n\n[^1]: Because spel is primarily an execution-wrapper for the AMIgenN projects, the \"read the source\" method for determining why things have changed from one spel-release to the next may require reviewing those projects' repositories\n[^2]: The default-user is a local user (i.e., managed in `/etc/passwd`/`/etc/shadow`/`/etc/group`) that is dynamically-created at initial system-boot \u0026ndash; using either the default-information in the `/etc/cloud/cloud.cfg` file or as overridden in a userData payload's `#cloud-config` content. Typically this user's `${HOME}/.ssh/authorized_keys` file is prepopulated with a provisioner's public SSH key.\n[^3]: Overriding attributes of the default-user _must_ be done within a `#cloud-config` directive-block. If your userData is currently bare BASH (etc.), it will be necessary to format your userData payload as mixed, multi-part MIME.\n[^4]: Use of the `PKR_VAR_` method is recommended for setting up CI/CD frameworks for producing AMIs and other supported VM-templates\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fspel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplus3it%2Fspel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fspel/lists"}