Anchore STIG Profiles Release Notes - 2026-11-02
STIG evaluation requires an additional license entitlement. Contact Anchore Customer Success for access and more information.
Anchore STIG Profiles - 2026-11-02
The Chainguard profile is updated to version 1.1.0. The update was published through the Anchore Data Service on 2026-11-02. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.
Updated Profiles
| Profile | Version | Implements |
|---|---|---|
chainguard | 1.1.0 (was 0.0.4) | DISA General Purpose Operating System SRG V3R2, profile authored by Chainguard |
Changes
- The CA bundle check (
oval:org.CABundleHash:def:1) also checks the Java truststore (/etc/ssl/certs/java/cacerts) in images that have one. The truststore must match the digest recorded beside it when the Chainguard image was built, so a Java image that runsupdate-ca-certificatesin a layer added on top of a Chainguard image now fails this check. A truststore with no recorded digest beside it also fails. - The
expected_cacert_hashinput applies to the system CA bundle only. Setting it does not change the result of the Java truststore check. - The profile still has 9 controls.
Update and Rescan
- After your deployment has synced the update, run
anchorectl stig write-profilesagain, then rescan Chainguard images. - To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.