How do I run stigsentry on an air-gapped enclave?

[cognis-digital]

stigsentry is built to run on disconnected / air-gapped enclaves, so the NIST 800-53 rev5 OSCAL catalog never needs the network at scan time.

Connected enclave — pull and snapshot the catalog cache once:

stigsentry feeds update oscal-800-53-rev5-catalog
python -m stigsentry.datafeeds snapshot-export feeds.tar.gz

Air-gapped enclave — sneakernet feeds.tar.gz across, import, then everything resolves offline:

python -m stigsentry.datafeeds snapshot-import feeds.tar.gz
stigsentry feeds get oscal-800-53-rev5-catalog --offline   # works, no network
COGNIS_FEEDS_CACHE=./feed-cache stigsentry ./scap-results --format oscal

The demos exercise exactly this path against a bundled snapshot:

PYTHONUTF8=1 python demos/05_airgap_pipeline.py

Questions about edge deployment, the cache layout (COGNIS_FEEDS_CACHE), or trimming the catalog for a specific control set are welcome here.