From 44c5def542e39468c91c0bf6101d191eb01fceee Mon Sep 17 00:00:00 2001
From: Sam Wouters <231222691+swoutersup@users.noreply.github.com>
Date: Wed, 15 Jul 2026 18:19:26 +0200
Subject: [PATCH 1/2] Extend product-in sed to cover shared/, not-in, and
 single quotes

Same gap as a10: the sed only searched linux_os/ and only matched
double-quoted product names in 'if product in' blocks, missing rules
in shared/, exclusion lists using 'if product not in', and
single-quoted product names in either form.

Extend the find path to linux_os/ and shared/, and add the three
missing -e expressions to cover all four combinations.
---
 files/add-almalinux9-support.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/files/add-almalinux9-support.sh b/files/add-almalinux9-support.sh
index 834e1e9..3b91605 100644
--- a/files/add-almalinux9-support.sh
+++ b/files/add-almalinux9-support.sh
@@ -37,8 +37,11 @@ find ./shared -type f -exec sed -i \
 #    silently falls through to the generic `else` branch of those rules (e.g.
 #    configure_custom_crypto_policy_cis drops NO-SSHWEAKCIPHERS/NO-SSHWEAKMACS/
 #    NO-WEAKMAC/NO-RPMSHA1, weakening the CIS crypto remediation vs the rhel9 base).
-find ./linux_os -type d -name ensure_redhat_gpgkey_installed -prune -o -type f -exec sed -i \
-    -e '/if product in/ s/"rhel9"/"rhel9", "almalinux9"/g' {} \;
+find ./linux_os ./shared -type d -name ensure_redhat_gpgkey_installed -prune -o -type f -exec sed -i \
+    -e '/if product in/ s/"rhel9"/"rhel9", "almalinux9"/g' \
+    -e "/if product in/ s/'rhel9'/'rhel9', 'almalinux9'/g" \
+    -e '/if product not in/ s/"rhel9"/"rhel9", "almalinux9"/g' \
+    -e "/if product not in/ s/'rhel9'/'rhel9', 'almalinux9'/g" {} \;
 
 find ./linux_os ./shared -type d -name ensure_redhat_gpgkey_installed -prune -o -type f -exec sed -i -E \
     -e 's/product == (["'\''])rhel9\1/(product == \1rhel9\1 or product == \1almalinux9\1)/g' {} \;

From 715f134d907f8c12f9950e6dce3bd49f682c2b1b Mon Sep 17 00:00:00 2001
From: Sam Wouters <231222691+swoutersup@users.noreply.github.com>
Date: Fri, 17 Jul 2026 17:07:10 +0200
Subject: [PATCH 2/2] Remove product-level controls copy to avoid overriding
 upstream CIS file

Upstream CaC ships a maintained controls/cis_almalinux9.yml with
AlmaLinux-specific adjustments (correct source URL, SSH crypto policy
marked not applicable, almalinux NTP variable, etc.). The product-level
copy mechanically renamed from rhel9 is loaded after the top-level file
and silently overrides it, losing all those adjustments.

Drop products/almalinux9/controls/ entirely so the correct top-level
file is used.
---
 files/add-almalinux9-support.sh | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/files/add-almalinux9-support.sh b/files/add-almalinux9-support.sh
index 3b91605..7d3fb6e 100644
--- a/files/add-almalinux9-support.sh
+++ b/files/add-almalinux9-support.sh
@@ -84,18 +84,10 @@ if [ -d products/almalinux9/overlays ]; then
         products/almalinux9/overlays/*
 fi
 
-if [ -d products/almalinux9/controls ]; then
-    for ctl in $(find products/almalinux9/controls/ -type f -name '*rhel9*'); do
-        mv "$ctl" "$(echo "$ctl" | sed 's/rhel9/almalinux9/g')"
-    done
-    find products/almalinux9/controls -type f -exec sed -i \
-        -e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
-        -e 's/RHEL9/ALMALINUX9/g' \
-        -e 's/RHEL-9/ALMALINUX-9/g' \
-        -e '/^id:/s/rhel9/almalinux9/g' \
-        -e '/^product:/s/rhel9/almalinux9/g' \
-        -e 's/ensure_redhat_gpgkey_installed/ensure_almalinux_gpgkey_installed/g' {} \;
-fi
+# Upstream CaC ships a maintained controls/cis_almalinux9.yml at the top level.
+# The product-level copy (mechanically renamed from rhel9) would override it and
+# lose AlmaLinux-specific adjustments, so remove it.
+rm -fr products/almalinux9/controls
 
 sed -i \
     -e 's/rhel9/almalinux9/' \