photon-os-installer 2.8-5: interactive install, STIG package set, initrd locale

[dcasota]

Extended from 2.8-3 to 2.8-6, adding three patches beyond the original three. All are verified end-to-end on a real minimal-ISO install.

Patch	Fix
0003-isoInstaller-fix-interactive-NoneType-crash	isoInstaller crashed with a NoneType error on interactive installs
0004-installer-add-btrfs-progs	btrfs-progs missing from the package set for btrfs root filesystems
0005-tdnf-capture-install-output	tdnf output uncaptured — package failures invisible in the log, overlaying the UI
0006-stig-drop-redundant-packages	new — drop libselinux-utils, ntp, libgcrypt from KS_STIG_PACKAGES
0007-installer-seed-locale.conf-before-package-install	new — fixes dracut[E]: i18n_vars not set! on the installer console
0008-isoBuilder-put-installer-requestable-packages-on-media	new — the STIG package set was not on the media, so the installer's own STIG option aborted with Error(1011)

0006 — redundant STIG packages

• libselinux-utils is already a selinux-policy dependency and is never invoked by the role.
• ntp is installed but never configured: no task notifies the time-sync handlers, so all three are dead code, and 0 of the 117 controls cover time sync.
• libgcrypt was a workaround for an aide packaging gap, fixed properly in Updated cloud-init.md with Markdown syntax #21.

Verified on a live install: additional_packages is exactly [audit, rsyslog, openssl-fips-provider, selinux-policy, aide]; libselinux-utils and libgcrypt still arrive as ordinary transitive dependencies; time sync is handled by systemd-timesyncd (System clock synchronized: yes).

0007 — initrd locale ordering

The initramfs rpm's %transfiletriggerin runs mkinitrd at the end of the transaction started by _install_packages(). dracut's 20i18n module needs /etc/locale.conf, but m_locale only creates it in POST_INSTALL — twelve steps later, so the file is guaranteed absent. dracut then reports

dracut[E]: i18n_vars not set!  Please set up i18n_vars in  configuration file.

and falls back to install_all_kbd(), embedding every keymap instead of the target's.

Reproduced on the installed system by removing /etc/locale.conf and re-running dracut: present → silent, absent → the error, independent of -H. Confirmed by mtimes on a real install: initrd.img 08:21:14, /etc/locale.conf 08:22:09.

Seeded in _initialize_system() instead, right after the filesystem rpm provides /etc. m_locale is deliberately untouched — it rewrites the same content, runs localedef, and still covers the ostree path where _initialize_system() is not called.

0008 — installer-requestable packages on the media

Selecting "Apply STIG hardening" asks for the STIG package set at install time. If those RPMs are not in the ISO's own RPMS/, the install aborts with Error(1011) : No matching packages — the menu offers an option the media cannot honour.

KS_STIG_PACKAGES in stigenable.py is the installer's own declaration of what that option installs, so it is imported rather than restated in a package list file; restating those names is how the media and the installer drifted apart. The import is local because stigenable pulls in the curses UI modules, which need not become a module-level dependency of the ISO builder.

Packages named via --initrd-pkgs were also never added to the download list (only the list file was parsed), so they could not be installed into the initrd from the ISO's own RPMS/ either. Both additions go to RPMS/ only, not into self.initrd_pkgs, so the initrd does not grow.

This carries dcasota/photon-os-installer#11 into the photon spec. Until now that change existed only on the installer branch and never reached an ISO, so the permutation-matrix checks tagged POI#11 were passing without exercising it.

Verification

• All eight patches apply cleanly to pristine 2.8 in spec order, as %autosetup applies them
• py_compile OK; rpmspec parses at subrelease 90 and 92
• support/spec-checker/check_spec.py exits 0

Mirrors upstream #1658, which carries only 0003-0005.