From 00880e48db6ca686d5c0cd55241ec80ebb507e8c Mon Sep 17 00:00:00 2001 From: m2 <69128853+m2Giles@users.noreply.github.com> Date: Mon, 7 Jul 2025 20:09:34 -0400 Subject: [PATCH] refactor: implement local builds (#356) * refactor: implement local builds This has a long way to go. But at least want to get the branch published. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * disable all workflows while iterating Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * cleanup fetch-kernel.sh Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * enable local builds Still need to generate tags. Removal of most of the suffix Containerfiles. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add tags, images.yaml Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * use anchors more! Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * start on workflows No Testing and Pushing in yet. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * update workflows Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * more workflow modifications Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * don't cache during PRs Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix base64 decode Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix path name Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * name file Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * quotes? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * quote the env? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * tell base64 to read from stdin Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * update workflows Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try different way for getting json file Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix conditional Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try github.workspace Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * just hardcode it Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * typo Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * main doesn't have zfs.... Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * One button build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove common from centos builds Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * handle defaults Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix package naming? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * don't have ./ Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try using swap instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * path names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove dnf remove Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * missing decleration Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try allow-erasing instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try reinstalling instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Add testing via multistage build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add missing args Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * correct test tag name Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix VARS_KERNEL_VERSION now that the package is no longer messed up Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * always have json point to cache location Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * use a reusable cache workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * put generate workflow in justfile Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add startpoint for multiarch Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * change the names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * dynamic names for generating workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * start appeasing the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix kernel version detection Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * filter for arch Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * move system76 to common Appease the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * permissions Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * more permissions Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * move system76 back Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add arch to tags Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add push/sign/manifest Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * silly names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove secureboot just recipe, it's internal to fetch-kernel.sh Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add CI=1 to scripts for debug output * update warning for workflow within justfile * remove for now * Update dual-sign-check.sh * Update Containerfile.in * Update dual-sign-check.sh * Add cosign fix * Fix signing in push as well * fix: hardcode internel kcwd for fetch-kernel.sh * pass CI into fetch kernel, use cache version instead of get version for fetch kernel step * split out bazzite workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * rename name of reusable build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * additional adds to manifest Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * allow workflow dispatch for cache/akmods build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add comments to Justfile Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * split mega workflow by flavors Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Build Badges and README Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * appease the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * tiny AKMODS_VERSION string update * fix manifest recipe Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> --------- Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> Co-authored-by: Benjamin Sherman --- .devcontainer.json | 4 + .github/actions/get-kernel-version/action.yml | 167 ------ .github/workflows/build-41.yml | 28 - .github/workflows/build-42.yml | 29 - .github/workflows/build-akmods-bazzite.yml | 91 +++ .github/workflows/build-akmods-centos-hsk.yml | 71 +++ .github/workflows/build-akmods-centos.yml | 124 ++++ .../workflows/build-akmods-coreos-stable.yml | 152 +++++ .../workflows/build-akmods-coreos-testing.yml | 152 +++++ .../workflows/build-akmods-longterm-6.12.yml | 85 +++ .github/workflows/build-akmods-main.yml | 124 ++++ .github/workflows/build-bazzite.yml | 34 -- .github/workflows/build-centos.yml | 31 - .github/workflows/reusable-build.yml | 536 ++++-------------- .github/workflows/reusable-cache-kernel.yml | 115 ++++ .gitignore | 2 + Containerfile.common | 55 -- Containerfile.extra | 63 -- Containerfile.in | 211 +++++++ Containerfile.nvidia | 52 -- Containerfile.nvidia-open | 52 -- Containerfile.test | 36 -- Containerfile.zfs | 38 -- Justfile | 468 +++++++++++++++ README.md | 108 ++-- .../common/build-kmod-framework-laptop.sh | 8 +- build_files/common/build-kmod-kvmfr.sh | 4 +- build_files/common/build-kmod-openrazer.sh | 14 +- build_files/common/build-kmod-v4l2loopback.sh | 8 +- build_files/common/build-kmod-wl.sh | 8 +- build_files/common/build-kmod-xone.sh | 8 +- .../common/build-ublue-os-akmods-addons.sh | 4 +- .../common/build-ublue-os-ucore-addons.sh | 6 +- build_files/extra/build-kmod-VirtualBox.sh | 8 +- .../extra/build-kmod-ayaneo-platform.sh | 8 +- build_files/extra/build-kmod-ayn-platform.sh | 8 +- build_files/extra/build-kmod-bmi260.sh | 8 +- build_files/extra/build-kmod-evdi.sh | 2 +- build_files/extra/build-kmod-facetimehd.sh | 8 +- build_files/extra/build-kmod-gcadapter_oc.sh | 8 +- build_files/extra/build-kmod-gpd-fan.sh | 8 +- build_files/extra/build-kmod-nct6687d.sh | 8 +- build_files/extra/build-kmod-rtl8814au.sh | 13 +- build_files/extra/build-kmod-rtl88xxau.sh | 13 +- build_files/extra/build-kmod-ryzen-smu.sh | 8 +- build_files/extra/build-kmod-system76-io.sh | 4 +- build_files/extra/build-kmod-system76.sh | 4 +- build_files/extra/build-kmod-vhba.sh | 8 +- build_files/extra/build-kmod-zenergy.sh | 8 +- build_files/nvidia/build-kmod-nvidia.sh | 20 +- .../nvidia/build-ublue-os-nvidia-addons.sh | 4 +- .../nvidia/build-ublue-os-ucore-nvidia.sh | 4 +- build_files/{shared => post}/build-post.sh | 30 +- build_files/post/dual-sign.sh | 70 +++ build_files/{shared => prep}/build-prep.sh | 107 ++-- .../{shared => prep}/dual-sign-check.sh | 2 + build_files/shared/dual-sign.sh | 50 -- .../{shared => test}/check-signatures.sh | 3 + build_files/{shared => test}/test-prep.sh | 94 +-- build_files/zfs/build-kmod-zfs.sh | 54 +- build_files/zfs/dual-sign-zfs.sh | 97 ++-- fetch-kernel.sh | 171 ++---- images.yaml | 103 ++++ workflow-templates/cache_kernel.yaml.in | 11 + workflow-templates/job.yaml.in | 14 + workflow-templates/workflow.yaml.in | 11 + 66 files changed, 2348 insertions(+), 1509 deletions(-) create mode 100644 .devcontainer.json delete mode 100644 .github/actions/get-kernel-version/action.yml delete mode 100644 .github/workflows/build-41.yml delete mode 100644 .github/workflows/build-42.yml create mode 100644 .github/workflows/build-akmods-bazzite.yml create mode 100644 .github/workflows/build-akmods-centos-hsk.yml create mode 100644 .github/workflows/build-akmods-centos.yml create mode 100644 .github/workflows/build-akmods-coreos-stable.yml create mode 100644 .github/workflows/build-akmods-coreos-testing.yml create mode 100644 .github/workflows/build-akmods-longterm-6.12.yml create mode 100644 .github/workflows/build-akmods-main.yml delete mode 100644 .github/workflows/build-bazzite.yml delete mode 100644 .github/workflows/build-centos.yml create mode 100644 .github/workflows/reusable-cache-kernel.yml delete mode 100644 Containerfile.common delete mode 100644 Containerfile.extra create mode 100644 Containerfile.in delete mode 100644 Containerfile.nvidia delete mode 100644 Containerfile.nvidia-open delete mode 100644 Containerfile.test delete mode 100644 Containerfile.zfs create mode 100644 Justfile rename build_files/{shared => post}/build-post.sh (55%) create mode 100755 build_files/post/dual-sign.sh rename build_files/{shared => prep}/build-prep.sh (63%) rename build_files/{shared => prep}/dual-sign-check.sh (95%) delete mode 100755 build_files/shared/dual-sign.sh rename build_files/{shared => test}/check-signatures.sh (93%) rename build_files/{shared => test}/test-prep.sh (74%) create mode 100644 images.yaml create mode 100644 workflow-templates/cache_kernel.yaml.in create mode 100644 workflow-templates/job.yaml.in create mode 100644 workflow-templates/workflow.yaml.in diff --git a/.devcontainer.json b/.devcontainer.json new file mode 100644 index 0000000..e2b0f43 --- /dev/null +++ b/.devcontainer.json @@ -0,0 +1,4 @@ +{ + "image": "ghcr.io/ublue-os/devcontainer:latest", + "name": "akmods-devcontainer" +} diff --git a/.github/actions/get-kernel-version/action.yml b/.github/actions/get-kernel-version/action.yml deleted file mode 100644 index a12f7b3..0000000 --- a/.github/actions/get-kernel-version/action.yml +++ /dev/null @@ -1,167 +0,0 @@ ---- -name: Get Kernel Version -inputs: - fedora_version: - description: "The Fedora release version: 41, 42, etc" - required: true - type: string - kernel_flavor: - description: "The Kernel flavor: main, bazzite, coreos-stable, longterm-6.12, etc" - required: true - type: string - bazzite_tag: - description: "Optional (bazzite kernel) tag to use instead of latest" - required: false - type: string -outputs: - kernel_build_tag: - description: "Optional (bazzite specific) tag" - value: ${{ steps.kernel.outputs.build_tag }} - kernel_major_minor_patch: - description: "Simple version eg, 6.12.9" - value: ${{ steps.kernel.outputs.major_minor_patch }} - kernel_release: - description: "Full kernel release eg, 6.12.9-200.fc41.x86_64" - value: ${{ steps.kernel.outputs.release }} -runs: - using: "composite" - steps: - - name: Get Kernel Version - id: kernel - shell: bash - run: | - set -x - - if [[ ${{ inputs.kernel_flavor }} =~ asus|surface|centos|longterm ]]; then - if [[ ${{ inputs.kernel_flavor }} =~ centos ]]; then - build_image="quay.io/centos/centos:${{ inputs.fedora_version }}" - else - build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}" - fi - podman pull "$build_image" - - container_name="fq-$(uuidgen)" - dnf="podman exec $container_name dnf" - - podman run --entrypoint /bin/bash --name "$container_name" -dt "$build_image" - $dnf install -y --setopt=install_weak_deps=False dnf-plugins-core - fi - - coreos_kernel () { - coreos_version=${1} - image_linux=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:${coreos_version} | jq -r '.Labels["ostree.linux"]') - # Pin a kernel here, gross workaround TODO: Make this cleaner - #if [[ "${{ inputs.kernel_flavor }}" == "coreos-stable" ]]; then - # image_linux="6.13.8-200.fc41.x86_64" - #fi - major_minor_patch=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+') - kernel_rel_part=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+\-\K([123][0]{2})') - arch=$(echo $image_linux | grep -oP 'fc\d+\.\K.*$') - - kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}" - kernel_version="$major_minor_patch-$kernel_rel.$arch" - URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm" - echo "Querying koji for ${coreos_version} kernel: $kernel_version" - echo "$URL" - HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP) - linux="" - if grep -qv "200 OK" <<< "${HTTP_RESP}"; then - echo "Koji failed to find $coreos_version kernel: $kernel_version" - case "$kernel_rel_part" in - "300") - kernel_rel_part="200" - ;; - "200") - kernel_rel_part="100" - ;; - "100") - ;; - *) - echo "unexpected kernel_rel_part ${kernel_rel_part}" - ;; - esac - kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}" - kernel_version="$major_minor_patch-$kernel_rel.$arch" - URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm" - echo "Re-querying koji for ${coreos_version} kernel: $kernel_version" - echo "$URL" - HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP) - if grep -qv "200 OK" <<< "${HTTP_RESP}"; then - echo "Koji failed to find $coreos_version kernel: $kernel_version" - fi - fi - if grep -q "200 OK" <<< "${HTTP_RESP}"; then - linux=$kernel_version - fi - } - - case ${{ inputs.kernel_flavor }} in - "asus") - $dnf copr enable -y lukenukem/asus-kernel - linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:lukenukem:asus-kernel --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://') - ;; - "centos") - linux=$($dnf repoquery --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://') - ;; - "centos-hsk") - $dnf -y install centos-release-hyperscale-kernel - linux=$($dnf repoquery --enablerepo="centos-hyperscale" --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://') - ;; - "bazzite") - if [[ -n "${{ inputs.bazzite_tag }}" ]]; then - latest="$(curl "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/tags/${{ inputs.bazzite_tag }}" )" - else - latest="$(curl "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/latest" )" - fi - linux=$(echo -E "$latest" | jq -r '.assets[].name' | grep -E 'kernel-.*.rpm' | grep "fc${{ inputs.fedora_version }}.x86_64" | head -1 | sed "s/kernel-//g" | sed "s/.rpm//g" ) - build_tag=$(echo -E $latest | jq -r '.tag_name') - ;; - "longterm"*) - $dnf copr enable -y kwizart/kernel-${{ inputs.kernel_flavor }} - linux=$($dnf repoquery --enablerepo="copr:copr.fedorainfracloud.org:kwizart:kernel-${{ inputs.kernel_flavor }}" --whatprovides kernel-longterm | sort -V | tail -n1 | sed 's/.*://') - ;; - "surface") - if [[ "${{ inputs.fedora_version }}" < 41 ]]; then - $dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo - else - $dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo - fi - linux=$($dnf repoquery --repoid linux-surface --whatprovides kernel-surface | sort -V | tail -n1 | sed 's/.*://') - ;; - "main") - base_image_name="base" - if [[ ${{ inputs.fedora_version }} > 40 ]]; then - base_image_name+="-atomic" - fi - linux=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/$base_image_name:${{ inputs.fedora_version }} | jq -r '.Labels["ostree.linux"]' ) - ;; - "coreos-stable") - coreos_kernel stable - ;; - "coreos-testing") - coreos_kernel testing - ;; - *) - echo "unexpected kernel_flavor '${{ inputs.kernel_flavor }}' for query" - ;; - esac - if [ -z "$linux" ] || [ "null" = "$linux" ]; then - echo "inspected image linux version must not be empty or null" - exit 1 - fi - major=$(echo "$linux" | cut -d '.' -f 1) - minor=$(echo "$linux" | cut -d '.' -f 2) - patch=$(echo "$linux" | cut -d '.' -f 3) - kernel_major_minor_patch="${major}.${minor}.${patch}" - - # Debug Output - echo "kernel_build_tag: ${build_tag}" - echo "kernel_flavor: ${{ inputs.kernel_flavor }}" - echo "kernel_major_minor_patch: ${kernel_major_minor_patch}" - echo "kernel_release: ${linux}" - - # Action Output - echo "build_tag=${build_tag}" >> $GITHUB_OUTPUT - echo "major_minor_patch=${kernel_major_minor_patch}" >> $GITHUB_OUTPUT - echo "release=${linux}" >> $GITHUB_OUTPUT - diff --git a/.github/workflows/build-41.yml b/.github/workflows/build-41.yml deleted file mode 100644 index 62cd4c1..0000000 --- a/.github/workflows/build-41.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: ublue akmods 41 -on: - merge_group: - pull_request: - branches: - - main - paths-ignore: - - '**.md' - schedule: - - cron: '25 0 * * *' # 0025 UTC everyday (20 minutes after 42) - workflow_dispatch: - -jobs: - kernel-akmods: - uses: ./.github/workflows/reusable-build.yml - secrets: inherit - strategy: - fail-fast: false - matrix: - fedora_version: - - 41 - kernel_flavor: - - main - - coreos-stable - - coreos-testing - with: - fedora_version: ${{ matrix.fedora_version }} - kernel_flavor: ${{ matrix.kernel_flavor }} diff --git a/.github/workflows/build-42.yml b/.github/workflows/build-42.yml deleted file mode 100644 index ebd5fdb..0000000 --- a/.github/workflows/build-42.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: ublue akmods 42 -on: - merge_group: - pull_request: - branches: - - main - paths-ignore: - - '**.md' - schedule: - - cron: '5 0 * * *' # 0005 UTC everyday - workflow_dispatch: - -jobs: - kernel-akmods: - uses: ./.github/workflows/reusable-build.yml - secrets: inherit - strategy: - fail-fast: false - matrix: - fedora_version: - - 42 - kernel_flavor: - - main - - coreos-stable - - coreos-testing - - longterm-6.12 - with: - fedora_version: ${{ matrix.fedora_version }} - kernel_flavor: ${{ matrix.kernel_flavor }} diff --git a/.github/workflows/build-akmods-bazzite.yml b/.github/workflows/build-akmods-bazzite.yml new file mode 100644 index 0000000..243ba39 --- /dev/null +++ b/.github/workflows/build-akmods-bazzite.yml @@ -0,0 +1,91 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build BAZZITE akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '22 0 * * *' # 0022 UTC everyday + workflow_dispatch: + inputs: + bazzite_tag: + description: "The release tag for the bazzite kernel" + required: false + type: string +jobs: + cache_kernel_bazzite_42: + name: Cache bazzite (42) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: bazzite + version: 42 + bazzite_tag: ${{ inputs.bazzite_tag }} + build-bazzite_42_common: + name: Build common bazzite (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_bazzite_42 + with: + version: 42 + kernel_flavor: bazzite + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }} + build-bazzite_42_extra: + name: Build extra bazzite (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_bazzite_42 + with: + version: 42 + kernel_flavor: bazzite + akmods_target: extra + kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }} + build-bazzite_42_nvidia: + name: Build nvidia bazzite (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_bazzite_42 + with: + version: 42 + kernel_flavor: bazzite + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }} + build-bazzite_42_nvidia-open: + name: Build nvidia-open bazzite (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_bazzite_42 + with: + version: 42 + kernel_flavor: bazzite + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-centos-hsk.yml b/.github/workflows/build-akmods-centos-hsk.yml new file mode 100644 index 0000000..4b22431 --- /dev/null +++ b/.github/workflows/build-akmods-centos-hsk.yml @@ -0,0 +1,71 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build CENTOS-HSK akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '09 0 * * *' # 0009 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_centos-hsk_10: + name: Cache centos-hsk (10) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: centos-hsk + version: 10 + build-centos-hsk_10_nvidia: + name: Build nvidia centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} + build-centos-hsk_10_nvidia-open: + name: Build nvidia-open centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} + build-centos-hsk_10_zfs: + name: Build zfs centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-centos.yml b/.github/workflows/build-akmods-centos.yml new file mode 100644 index 0000000..e5bd416 --- /dev/null +++ b/.github/workflows/build-akmods-centos.yml @@ -0,0 +1,124 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build CENTOS akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '05 0 * * *' # 0005 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_centos-hsk_10: + name: Cache centos-hsk (10) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: centos-hsk + version: 10 + build-centos-hsk_10_nvidia: + name: Build nvidia centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} + build-centos-hsk_10_nvidia-open: + name: Build nvidia-open centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} + build-centos-hsk_10_zfs: + name: Build zfs centos-hsk (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos-hsk_10 + with: + version: 10 + kernel_flavor: centos-hsk + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }} + cache_kernel_centos_10: + name: Cache centos (10) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: centos + version: 10 + build-centos_10_nvidia: + name: Build nvidia centos (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos_10 + with: + version: 10 + kernel_flavor: centos + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }} + build-centos_10_nvidia-open: + name: Build nvidia-open centos (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos_10 + with: + version: 10 + kernel_flavor: centos + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }} + build-centos_10_zfs: + name: Build zfs centos (10) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_centos_10 + with: + version: 10 + kernel_flavor: centos + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-coreos-stable.yml b/.github/workflows/build-akmods-coreos-stable.yml new file mode 100644 index 0000000..3453999 --- /dev/null +++ b/.github/workflows/build-akmods-coreos-stable.yml @@ -0,0 +1,152 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build COREOS-STABLE akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '27 0 * * *' # 0027 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_coreos-stable_42: + name: Cache coreos-stable (42) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: coreos-stable + version: 42 + build-coreos-stable_42_common: + name: Build common coreos-stable (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_42 + with: + version: 42 + kernel_flavor: coreos-stable + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }} + build-coreos-stable_42_nvidia: + name: Build nvidia coreos-stable (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_42 + with: + version: 42 + kernel_flavor: coreos-stable + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }} + build-coreos-stable_42_nvidia-open: + name: Build nvidia-open coreos-stable (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_42 + with: + version: 42 + kernel_flavor: coreos-stable + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }} + build-coreos-stable_42_zfs: + name: Build zfs coreos-stable (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_42 + with: + version: 42 + kernel_flavor: coreos-stable + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }} + cache_kernel_coreos-stable_41: + name: Cache coreos-stable (41) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: coreos-stable + version: 41 + build-coreos-stable_41_common: + name: Build common coreos-stable (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_41 + with: + version: 41 + kernel_flavor: coreos-stable + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }} + build-coreos-stable_41_nvidia: + name: Build nvidia coreos-stable (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_41 + with: + version: 41 + kernel_flavor: coreos-stable + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }} + build-coreos-stable_41_nvidia-open: + name: Build nvidia-open coreos-stable (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_41 + with: + version: 41 + kernel_flavor: coreos-stable + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }} + build-coreos-stable_41_zfs: + name: Build zfs coreos-stable (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-stable_41 + with: + version: 41 + kernel_flavor: coreos-stable + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-coreos-testing.yml b/.github/workflows/build-akmods-coreos-testing.yml new file mode 100644 index 0000000..634109b --- /dev/null +++ b/.github/workflows/build-akmods-coreos-testing.yml @@ -0,0 +1,152 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build COREOS-TESTING akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '17 0 * * *' # 0017 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_coreos-testing_41: + name: Cache coreos-testing (41) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: coreos-testing + version: 41 + build-coreos-testing_41_common: + name: Build common coreos-testing (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_41 + with: + version: 41 + kernel_flavor: coreos-testing + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }} + build-coreos-testing_41_nvidia: + name: Build nvidia coreos-testing (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_41 + with: + version: 41 + kernel_flavor: coreos-testing + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }} + build-coreos-testing_41_nvidia-open: + name: Build nvidia-open coreos-testing (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_41 + with: + version: 41 + kernel_flavor: coreos-testing + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }} + build-coreos-testing_41_zfs: + name: Build zfs coreos-testing (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_41 + with: + version: 41 + kernel_flavor: coreos-testing + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }} + cache_kernel_coreos-testing_42: + name: Cache coreos-testing (42) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: coreos-testing + version: 42 + build-coreos-testing_42_common: + name: Build common coreos-testing (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_42 + with: + version: 42 + kernel_flavor: coreos-testing + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }} + build-coreos-testing_42_nvidia: + name: Build nvidia coreos-testing (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_42 + with: + version: 42 + kernel_flavor: coreos-testing + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }} + build-coreos-testing_42_nvidia-open: + name: Build nvidia-open coreos-testing (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_42 + with: + version: 42 + kernel_flavor: coreos-testing + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }} + build-coreos-testing_42_zfs: + name: Build zfs coreos-testing (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_coreos-testing_42 + with: + version: 42 + kernel_flavor: coreos-testing + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-longterm-6.12.yml b/.github/workflows/build-akmods-longterm-6.12.yml new file mode 100644 index 0000000..8198228 --- /dev/null +++ b/.github/workflows/build-akmods-longterm-6.12.yml @@ -0,0 +1,85 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build LONGTERM-6.12 akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '15 0 * * *' # 0015 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_longterm-6-12_42: + name: Cache longterm-6.12 (42) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: longterm-6.12 + version: 42 + build-longterm-6-12_42_common: + name: Build common longterm-6.12 (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_longterm-6-12_42 + with: + version: 42 + kernel_flavor: longterm-6.12 + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }} + build-longterm-6-12_42_nvidia: + name: Build nvidia longterm-6.12 (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_longterm-6-12_42 + with: + version: 42 + kernel_flavor: longterm-6.12 + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }} + build-longterm-6-12_42_nvidia-open: + name: Build nvidia-open longterm-6.12 (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_longterm-6-12_42 + with: + version: 42 + kernel_flavor: longterm-6.12 + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }} + build-longterm-6-12_42_zfs: + name: Build zfs longterm-6.12 (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_longterm-6-12_42 + with: + version: 42 + kernel_flavor: longterm-6.12 + akmods_target: zfs + kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }} diff --git a/.github/workflows/build-akmods-main.yml b/.github/workflows/build-akmods-main.yml new file mode 100644 index 0000000..524f4c0 --- /dev/null +++ b/.github/workflows/build-akmods-main.yml @@ -0,0 +1,124 @@ +--- +# +# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! +# +# Generate the workflow by running `just generate-workflows` at git root +# Modify the inputs in workflow-templates +name: Build MAIN akmods +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '07 0 * * *' # 0007 UTC everyday + workflow_dispatch: +jobs: + cache_kernel_main_41: + name: Cache main (41) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: main + version: 41 + build-main_41_common: + name: Build common main (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_41 + with: + version: 41 + kernel_flavor: main + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }} + build-main_41_nvidia: + name: Build nvidia main (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_41 + with: + version: 41 + kernel_flavor: main + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }} + build-main_41_nvidia-open: + name: Build nvidia-open main (41) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_41 + with: + version: 41 + kernel_flavor: main + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }} + cache_kernel_main_42: + name: Cache main (42) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: main + version: 42 + build-main_42_common: + name: Build common main (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_42 + with: + version: 42 + kernel_flavor: main + akmods_target: common + kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }} + build-main_42_nvidia: + name: Build nvidia main (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_42 + with: + version: 42 + kernel_flavor: main + akmods_target: nvidia + kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }} + build-main_42_nvidia-open: + name: Build nvidia-open main (42) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_main_42 + with: + version: 42 + kernel_flavor: main + akmods_target: nvidia-open + kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }} diff --git a/.github/workflows/build-bazzite.yml b/.github/workflows/build-bazzite.yml deleted file mode 100644 index b8b3df2..0000000 --- a/.github/workflows/build-bazzite.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: bazzite akmods -on: - merge_group: - pull_request: - branches: - - main - paths-ignore: - - '**.md' - schedule: - - cron: '5 0 * * *' # 0005 UTC everyday - repository_dispatch: - types: [bazzite-kernel-build] - workflow_dispatch: - inputs: - release_tag: - description: 'Release tag (leave empty for latest)' - required: false - default: '' - -jobs: - kernel-akmods: - uses: ./.github/workflows/reusable-build.yml - secrets: inherit - strategy: - fail-fast: false - matrix: - fedora_version: - - 42 - kernel_flavor: - - bazzite - with: - fedora_version: ${{ matrix.fedora_version }} - kernel_flavor: ${{ matrix.kernel_flavor }} - bazzite_tag: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.release_tag || github.event.inputs.release_tag }} diff --git a/.github/workflows/build-centos.yml b/.github/workflows/build-centos.yml deleted file mode 100644 index b56d1b2..0000000 --- a/.github/workflows/build-centos.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: ublue akmods centos -on: - merge_group: - pull_request: - branches: - - main - paths-ignore: - - '**.md' - schedule: - - cron: '5 0 * * *' # 0005 UTC everyday - workflow_dispatch: - -jobs: - kernel-akmods: - uses: ./.github/workflows/reusable-build.yml - secrets: inherit - strategy: - fail-fast: false - matrix: - kernel_flavor: - - centos - - centos-hsk - fedora_version: - - stream10 - - stream9 - exclude: - - kernel_flavor: centos-hsk - fedora_version: stream9 - with: - kernel_flavor: ${{ matrix.kernel_flavor }} - fedora_version: ${{ matrix.fedora_version }} diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 7c0c8d4..ac3a101 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -1,447 +1,161 @@ -name: build-ublue +name: build-akmod +run-name: "Build ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }}" on: workflow_call: inputs: - fedora_version: - description: "The Fedora release version: 41, 42, etc" - required: true - type: string - kernel_flavor: - description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc" + akmods_target: + description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open" required: true type: string bazzite_tag: description: "The release tag for the bazzite kernel" required: false type: string + kernel_flavor: + description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc" + required: true + type: string + version: + description: "Release Version: 10, 41, 42, etc" + required: true + type: string + kernel_cache_key: + description: "The Key for the Kernel Cache" + required: true + type: string + workflow_dispatch: + inputs: + akmods_target: + description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open" + required: true + type: string + bazzite_tag: + description: "The release tag for the bazzite kernel" + required: false + type: string + kernel_flavor: + description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc" + required: true + type: string + version: + description: "Release Version: 10, 41, 42, etc" + required: true + type: string + kernel_cache_key: + description: "The Key for the Kernel Cache" + required: true + type: string env: - IMAGE_BASE_NAME: akmods - IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }} + AKMODS_KERNEL: ${{ inputs.kernel_flavor }} + AKMODS_TARGET: ${{ inputs.akmods_target }} + AKMODS_VERSION: ${{ inputs.version }} + KCKEY: ${{ inputs.kernel_cache_key }} concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }} + group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }}-${{ inputs.akmods_target }} cancel-in-progress: true jobs: - cache-kernel: - name: Kernel ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }} - runs-on: ubuntu-24.04 - env: - KCWD: /tmp/kernel-cache - KCPATH: kernel_cache - outputs: - KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }} - KCWD: ${{ env.KCWD }} - KCPATH: ${{ env.KCPATH }} - kernel_build_tag: ${{ steps.kernel-version.outputs.kernel_build_tag }} - kernel_major_minor_patch: ${{ steps.kernel-version.outputs.kernel_major_minor_patch }} - KERNEL_VERSION: ${{ steps.kernel-version.outputs.kernel_release }} - - steps: - - name: Checkout Repo - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - - name: Get Kernel Version - id: kernel-version - uses: ./.github/actions/get-kernel-version - with: - fedora_version: ${{ inputs.fedora_version }} - kernel_flavor: ${{ inputs.kernel_flavor }} - bazzite_tag: ${{ inputs.bazzite_tag }} - - - name: Cache Kernel RPMs - id: cache-kernel - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ env.KCPATH }} - key: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }} # job outputs KCKEY - - - name: Retrieve Signing Key - if: steps.cache-kernel.outputs.cache-hit != 'true' && github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' - shell: bash - run: | - mkdir -p certs - if [[ "${{ github.event_name }}" == 'pull_request' ]]; then - echo "This should not have run... exiting..." - exit 1 - else - echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv - echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv - # DEBUG: get character count of key - wc -c certs/private_key.priv - wc -c certs/private_key_2.priv - fi - - - name: Fetch and Sign Kernel Packages - if: steps.cache-kernel.outputs.cache-hit != 'true' - shell: bash - run: | - if [[ ${{ inputs.kernel_flavor }} =~ centos ]]; then - build_image="quay.io/centos/centos:${{ inputs.fedora_version }}" - else - build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}" - fi - podman pull "$build_image" - - mkdir -p ${{ env.KCWD }} - cp -a fetch-kernel.sh certs ${{ env.KCWD }} - - echo "${{toJSON(steps.kernel-version.outputs)}}" - - container_name="fq-$(uuidgen)" - podman run \ - --entrypoint /bin/bash \ - --env FEDORA_VERSION=${{ inputs.fedora_version }} \ - --env KERNEL_BUILD_TAG=${{ steps.kernel-version.outputs.kernel_build_tag }} \ - --env KERNEL_VERSION=${{ steps.kernel-version.outputs.kernel_release }} \ - --env KERNEL_FLAVOR=${{ inputs.kernel_flavor }} \ - --env DUAL_SIGN=true \ - --name "$container_name" \ - -v ${{ env.KCWD }}:${{ env.KCWD }}:rw \ - -dt "$build_image" - - podman exec "$container_name" bash -x ${{ env.KCWD }}/fetch-kernel.sh ${{ env.KCWD }} - - find ${{ env.KCWD }} - - - name: Check Secureboot Signatures - if: steps.cache-kernel.outputs.cache-hit != 'true' - shell: bash - run: | - set -x - if [[ ! $(command -v sbverify) || ! $(command -v curl) || ! $(command -v openssl) || ! $(command -v rpm2cpio) ]]; then - sudo apt update - sudo apt install sbsigntool curl openssl rpm2cpio - fi - KERNEL_NAME=kernel - if [[ "${{ inputs.kernel_flavor }}" =~ "longterm" ]]; then - KERNEL_NAME=kernel-longterm - fi - cd ${{ env.KCWD }}/rpms - rpm2cpio ${KERNEL_NAME}-core-"${{ steps.kernel-version.outputs.kernel_release }}".rpm | cpio -idmv - cd ./lib/modules/"${{ steps.kernel-version.outputs.kernel_release }}"/ - sbverify --list vmlinuz - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der.test - curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der.test - else - curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der - curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der - fi - openssl x509 -in kernel-sign.der -out kernel-sign.crt - openssl x509 -in akmods.der -out akmods.crt - sbverify --cert kernel-sign.crt vmlinuz || exit 1 - sbverify --cert akmods.crt vmlinuz || exit 1 - - - name: Finalize Cache Files - if: steps.cache-kernel.outputs.cache-hit != 'true' - shell: bash - run: | - # this should be in runner user's home dir - mkdir -p ${{ env.KCPATH }} - cp -a ${{ env.KCWD }}/rpms/*.rpm ${{ env.KCPATH }}/ - echo "$(date '+%Y%m%d.0')" > ${{ env.KCPATH }}/kernel-cache-date - - - name: List Cached Kernel RPMs - shell: bash - run: | - find ${{ env.KCPATH }} - build-akmods: - name: Akmods ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}-${{ matrix.cfile_suffix }} - runs-on: ubuntu-24.04 # Work Around Tar Bug - needs: [cache-kernel] + name: Build ${{ matrix.platform }} + runs-on: ${{ matrix.platform == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} permissions: + actions: read contents: read packages: write - id-token: write + container: + image: "ghcr.io/ublue-os/devcontainer:latest" + options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0" strategy: fail-fast: false matrix: - kernel_flavor: # this must be in matrix for excludes, but reference inputs.kernel_flavor in workflow - - ${{ inputs.kernel_flavor }} - cfile_suffix: - - common - - extra - - nvidia - - nvidia-open - - zfs - exclude: - # extra - - kernel_flavor: main - cfile_suffix: extra - - kernel_flavor: coreos-stable - cfile_suffix: extra - - kernel_flavor: coreos-testing - cfile_suffix: extra - - kernel_flavor: longterm-6.12 - cfile_suffix: extra - # zfs - - kernel_flavor: main - cfile_suffix: zfs - - kernel_flavor: bazzite - cfile_suffix: zfs - # centos - - kernel_flavor: centos - cfile_suffix: common - - kernel_flavor: centos-hsk - cfile_suffix: common - - kernel_flavor: centos - cfile_suffix: extra - - kernel_flavor: centos-hsk - cfile_suffix: extra - - kernel_flavor: centos-hsk - cfile_suffix: nvidia - - kernel_flavor: centos-hsk - cfile_suffix: nvidia-open - env: - KCWD: ${{ needs.cache-kernel.outputs.KCWD }} - KCPATH: ${{ needs.cache-kernel.outputs.KCPATH }} - kernel_build_tag: ${{ needs.cache-kernel.outputs.kernel_build_tag }} - KERNEL_VERSION: ${{ needs.cache-kernel.outputs.KERNEL_VERSION }} - + platform: + - x86_64 + # - aarch64 steps: - name: Checkout Repo uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - name: Create cache parent dir + - name: Mark Directory as Safe + run: git config --system --ad safe.directory "$GITHUB_WORKSPACE" + + - name: Export GITHUB_WORKSPACE + id: gh-workspace + run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT" + + - name: Cache Kernel RPMs + id: cache-kernel + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms + key: ${{ env.KCKEY }}-${{ matrix.platform }} + + - name: Fail Absent Kernel Cache + if: steps.cache-kernel.outputs.cache-hit != 'true' + run: "echo 'Kernel Cache not found for key: ${{ env.KCKEY }}'; exit 1" + + - name: Retrieve Signing Key + if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) shell: bash run: | - mkdir -p ${{ env.KCWD }} + mkdir -p certs + echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv + echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv + # DEBUG: get character count of key + wc -c certs/private_key.priv + wc -c certs/private_key_2.priv + + - name: Build Image + id: build + run: just build + + - name: Test Image + run: just test + + - name: Push and Sign Image + if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) + run: + just login-to-ghcr + just push + env: + COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + REGISTRY_ACTOR: ${{ github.actor }} + REGISTRY_TOKEN: ${{ github.token }} + + manifest: + name: "Generate ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }} Manifest" + runs-on: ubuntu-latest + needs: [build-akmods] + container: + image: "ghcr.io/ublue-os/devcontainer:latest" + options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0" + permissions: + actions: read + contents: read + packages: write + steps: + - name: Exit on failure + if: ${{ needs.build-akmods.result == 'failure' }} + run: exit 1 + + - name: Export GITHUB_WORKSPACE + id: gh-workspace + run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT" - name: Cache Kernel RPMs id: cache-kernel uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: - path: ${{ env.KCPATH }} - key: ${{ needs.cache-kernel.outputs.KCKEY }} + path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms + key: ${{ env.KCKEY }}-x86_64 - - name: Fail Absent Kernel Cache - if: steps.cache-kernel.outputs.cache-hit != 'true' - run: | - echo "Kernel Cache not found for key: ${{ needs.cache-kernel.outputs.KCKEY }}" - exit 1 - - - name: Get Cached Kernel Date/Version - shell: bash - run: | - set -exo pipefail - - find ${{ env.KCPATH }} - KCDATE=$(cat ${{ env.KCPATH }}/kernel-cache-date) - if [ -z "${KCDATE}" ]; then - echo "kernel-cache-date must not be empty" - fi - if [ -z "${{ env.KERNEL_VERSION }}" ]; then - echo "KERNEL_VERSION must not be empty" - fi - KERNEL_IMAGE_VERSION=${{ env.KERNEL_VERSION }}-${KCDATE} - echo "KERNEL_IMAGE_VERSION=$KERNEL_IMAGE_VERSION" >> $GITHUB_ENV - - - name: Matrix Variables - shell: bash - run: | - if [ "common" == "${{ matrix.cfile_suffix }}" ]; then - echo "IMAGE_NAME=${{ env.IMAGE_BASE_NAME }}" >> $GITHUB_ENV - else - echo "IMAGE_NAME=${{ env.IMAGE_BASE_NAME }}-${{ matrix.cfile_suffix }}" >> $GITHUB_ENV - fi - if [[ ${{ inputs.kernel_flavor }} =~ "centos" ]]; then - build_image="quay.io/centos/centos" - else - build_image="quay.io/fedora/fedora" - fi - export BUILDER_IMAGE=${build_image} - echo "BUILDER_IMAGE=${BUILDER_IMAGE}" >> $GITHUB_ENV - - - name: Pull build image - shell: bash - run: podman pull ${{ env.BUILDER_IMAGE }}:${{ inputs.fedora_version }} - - - name: AppArmor Disable - run: | - set -x - systemctl status apparmor - sudo systemctl stop apparmor - systemctl status apparmor || true - - - name: Generate tags - id: generate-tags - shell: bash - run: | - # Generate a timestamp for creating an image version history - TIMESTAMP="$(date +%Y%m%d)" - VARIANT="${{ inputs.kernel_flavor }}-${{ inputs.fedora_version }}" - - COMMIT_TAGS=() - BUILD_TAGS=() - - # Have tags for tracking builds during pull request - SHA_SHORT="${GITHUB_SHA::7}" - COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}") - COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}") - - BUILD_TAGS=("${VARIANT}" "${VARIANT}-${TIMESTAMP}" "${VARIANT}-${KERNEL_VERSION}") - - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "Generated the following commit tags: " - for TAG in "${COMMIT_TAGS[@]}"; do - echo "${TAG}" - done - default_tag=${COMMIT_TAGS[0]} - alias_tags=("${COMMIT_TAGS[@]}") - else - default_tag=${BUILD_TAGS[0]} - alias_tags=("${BUILD_TAGS[@]}") - fi - - echo "Generated the following build tags: " - for TAG in "${BUILD_TAGS[@]}"; do - echo "${TAG}" - done - - echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT - echo "default_tag=$default_tag" >> $GITHUB_ENV - - # Build metadata - - name: Image Metadata - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 - id: meta - with: - images: | - ${{ env.IMAGE_NAME }} - labels: | - org.opencontainers.image.title=${{ env.IMAGE_BASE_NAME }} - org.opencontainers.image.description=A caching layer for pre-built akmod RPMs - org.opencontainers.image.version=${{ env.KERNEL_IMAGE_VERSION }} - ostree.linux=${{ env.KERNEL_VERSION }} - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md - io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4 - - - name: Retrieve Signing Key - if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' - shell: bash - run: | - mkdir -p certs - if [[ "${{ github.event_name }}" == 'pull_request' ]]; then - echo "This should not have run... exiting..." - exit 1 - else - echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv - echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv - # DEBUG: get character count of key - wc -c certs/private_key.priv - wc -c certs/private_key_2.priv - fi - - # Build image using Buildah action - - name: Build Image - id: build_image - uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 - with: - containerfiles: | - ./Containerfile.${{ matrix.cfile_suffix }} - image: ${{ env.IMAGE_NAME }} - tags: | - ${{ steps.generate-tags.outputs.alias_tags }} - build-args: | - BUILDER_IMAGE=${{ env.BUILDER_IMAGE }} - KERNEL_FLAVOR=${{ inputs.kernel_flavor }} - FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }} - RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }} - DUAL_SIGN=true - labels: ${{ steps.meta.outputs.labels }} - oci: false - - - name: Build Test Image - uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 - with: - containerfiles: | - ./Containerfile.test - image: akmods-test - tags: latest - build-args: | - BUILDER_IMAGE=${{ env.BUILDER_IMAGE }} - KERNEL_FLAVOR=${{ inputs.kernel_flavor }} - FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }} - RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }} - INPUT_AKMODS=${{ env.IMAGE_NAME }} - INPUT_TAG=${{ env.default_tag }} - DUAL_SIGN=true - oci: false - - - name: Test Akmods Signature - id: test_akmods - shell: bash - run: | - if ! podman run akmods-test:latest; then - echo "Signatures Failed" - exit 1 - fi - - # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. - # https://github.com/macbre/push-to-ghcr/issues/12 - - name: Lowercase Registry - id: registry_case - uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 - with: - string: ${{ env.IMAGE_REGISTRY }} - - - name: Push To GHCR - uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 - id: push - if: github.event_name != 'pull_request' + - name: Generate Manifest + if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) + run: + just login-to-ghcr + just manifest env: - REGISTRY_USER: ${{ github.actor }} - REGISTRY_PASSWORD: ${{ github.token }} - with: - action: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 - attempt_limit: 3 - attempt_delay: 15000 - with: | - image: ${{ steps.build_image.outputs.image }} - tags: ${{ steps.build_image.outputs.tags }} - registry: ${{ steps.registry_case.outputs.lowercase }} - username: ${{ env.REGISTRY_USER }} - password: ${{ env.REGISTRY_PASSWORD }} - extra-args: | - --disable-content-trust - - - name: Login to GitHub Container Registry - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 - if: github.event_name != 'pull_request' - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - # Sign container - - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 - if: github.event_name != 'pull_request' - - - name: Sign container image - if: github.event_name != 'pull_request' - run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} - env: - TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} - COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - - - name: Echo outputs - if: github.event_name != 'pull_request' - run: | - echo "${{ toJSON(steps.push.outputs) }}" - - check: - name: Check all ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor}} builds successful - runs-on: ubuntu-latest - needs: [build-akmods] - steps: - - name: Exit on failure - if: ${{ needs.build-akmods.result == 'failure' }} - shell: bash - run: exit 1 - - name: Exit - shell: bash - run: exit 0 + REGISTRY_ACTOR: ${{ github.actor }} + REGISTRY_TOKEN: ${{ github.token }} diff --git a/.github/workflows/reusable-cache-kernel.yml b/.github/workflows/reusable-cache-kernel.yml new file mode 100644 index 0000000..a92ccc8 --- /dev/null +++ b/.github/workflows/reusable-cache-kernel.yml @@ -0,0 +1,115 @@ +name: cache-kernel +run-name: Cache ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} Kernel +on: + workflow_call: + inputs: + bazzite_tag: + description: "The release tag for the bazzite kernel" + required: false + type: string + kernel_flavor: + description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc" + required: true + type: string + version: + description: "Release Version: 10, 41, 42, etc" + required: true + type: string + outputs: + KCKEY: + description: Cache Key + value: ${{ jobs.cache-kernel.outputs.KCKEY }} + workflow_dispatch: + inputs: + bazzite_tag: + description: "The release tag for the bazzite kernel" + required: false + type: string + kernel_flavor: + description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc" + required: true + type: string + version: + description: "Release Version: 10, 41, 42, etc" + required: true + type: string +env: + AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }} + AKMODS_KERNEL: ${{ inputs.kernel_flavor }} + AKMODS_VERSION: ${{ inputs.version }} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }} + cancel-in-progress: true + +jobs: + cache-kernel: + name: Cache ${{ matrix.platform }} + runs-on: ${{ matrix.platform == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} + outputs: + KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }} + container: + image: "ghcr.io/ublue-os/devcontainer:latest" + options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0" + permissions: + actions: read + contents: read + packages: write + strategy: + fail-fast: false + matrix: + platform: + - x86_64 + # - aarch64 + env: + AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }} + AKMODS_KERNEL: ${{ inputs.kernel_flavor }} + AKMODS_VERSION: ${{ inputs.version }} + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Mark Directory as Safe + run: git config --system --ad safe.directory "$GITHUB_WORKSPACE" + + - name: Get Kernel Version + id: kernel-version + run: just cache-kernel-version + + - name: Cache Kernel RPMs + id: cache-kernel + uses: actions/cache@v4 + with: + path: ${{ steps.kernel-version.outputs.KCPATH }} + key: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }}-${{ matrix.platform }} # job outputs KCKEY + + - name: Retrieve Signing Key + if: contains(fromJSON('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) && steps.cache-kernel.outputs.cache-hit != 'true' + shell: bash + run: | + mkdir -p certs + echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv + echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv + # DEBUG: get character count of key + wc -c certs/private_key.priv + wc -c certs/private_key_2.priv + + - name: Fetch Kernel + if: steps.cache-kernel.outputs.cache-hit != 'true' + run: just fetch-kernel + + - name: List Cached Kernel RPMs + run: find ${{ steps.kernel-version.outputs.KCPATH }} + check: + name: Check all ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} cache successful + runs-on: ubuntu-latest + needs: [cache-kernel] + permissions: + actions: read + steps: + - name: Exit on failure + if: ${{ needs.cache-kernel.result == 'failure' }} + run: exit 1 + - name: Exit + run: exit 0 diff --git a/.gitignore b/.gitignore index f94e98f..6f48964 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ certs/private_key.priv.prod certs/public_key.der.prod +.env +build diff --git a/Containerfile.common b/Containerfile.common deleted file mode 100644 index 83a7e4d..0000000 --- a/Containerfile.common +++ /dev/null @@ -1,55 +0,0 @@ -### -### Containerfile.common - used to build ONLY NON-nvidia kmods -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -FROM ${BUILDER_BASE} AS builder - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" -ARG RPMFUSION_MIRROR="" -ARG DUAL_SIGN="true" - -COPY build_files/common build_files/shared /tmp/ -COPY certs /tmp/certs - -# files for akmods -ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \ - /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo -ADD https://negativo17.org/repos/fedora-multimedia.repo \ - /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo - -RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \ - --mount=type=cache,dst=/var/cache/dnf \ - ls -sh /tmp/kernel_cache; \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/build-prep.sh && \ - if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \ - /tmp/build-ublue-os-ucore-addons.sh && \ - cp /tmp/ublue-os-ucore-addons/rpmbuild/RPMS/noarch/ublue-os-ucore-addons*.rpm \ - /var/cache/rpms/ucore/ \ - ; fi && \ - /tmp/build-ublue-os-akmods-addons.sh && \ - cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm \ - /var/cache/rpms/ublue-os/ && \ - /tmp/build-kmod-framework-laptop.sh && \ - /tmp/build-kmod-kvmfr.sh && \ - /tmp/build-kmod-openrazer.sh && \ - /tmp/build-kmod-v4l2loopback.sh && \ - /tmp/build-kmod-wl.sh && \ - /tmp/build-kmod-xone.sh && \ - /tmp/dual-sign.sh && \ - /tmp/build-post.sh - -FROM scratch - -COPY --from=builder /var/cache/kernel-rpms /kernel-rpms -COPY --from=builder /var/cache/rpms /rpms diff --git a/Containerfile.extra b/Containerfile.extra deleted file mode 100644 index f0ce6c1..0000000 --- a/Containerfile.extra +++ /dev/null @@ -1,63 +0,0 @@ -### -### Containerfile.extra - used to build extra kmods -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -FROM ${BUILDER_BASE} AS builder - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" -ARG RPMFUSION_MIRROR="" -ARG DUAL_SIGN="true" - -COPY build_files/extra build_files/shared /tmp/ -COPY certs /tmp/certs - -# files for akmods -ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \ - /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo -ADD https://negativo17.org/repos/fedora-multimedia.repo \ - /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo - -RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \ - --mount=type=cache,dst=/var/cache/dnf \ - ls -sh /tmp/kernel_cache; \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/build-prep.sh && \ - if grep -qv "asus" <<< "${KERNEL_FLAVOR}"; then \ - /tmp/build-kmod-zenergy.sh && \ - /tmp/build-kmod-evdi.sh \ - ; fi && \ - if [[ "${FEDORA_MAJOR_VERSION}" -ge 41 ]]; then \ - /tmp/build-kmod-gpd-fan.sh \ - ; fi && \ - /tmp/build-kmod-ayaneo-platform.sh && \ - /tmp/build-kmod-ayn-platform.sh && \ - /tmp/build-kmod-bmi260.sh && \ - if grep -qv "bazzite" <<< "${KERNEL_FLAVOR}"; then \ - /tmp/build-kmod-facetimehd.sh && \ - /tmp/build-kmod-rtl8814au.sh && \ - /tmp/build-kmod-rtl88xxau.sh && \ - /tmp/build-kmod-VirtualBox.sh \ - ; fi && \ - /tmp/build-kmod-gcadapter_oc.sh && \ - /tmp/build-kmod-nct6687d.sh && \ - /tmp/build-kmod-system76.sh && \ - /tmp/build-kmod-system76-io.sh && \ - /tmp/build-kmod-ryzen-smu.sh && \ - /tmp/build-kmod-vhba.sh && \ - /tmp/dual-sign.sh && \ - /tmp/build-post.sh - -FROM scratch - -COPY --from=builder /var/cache/kernel-rpms /kernel-rpms -COPY --from=builder /var/cache/rpms /rpms diff --git a/Containerfile.in b/Containerfile.in new file mode 100644 index 0000000..7ecac30 --- /dev/null +++ b/Containerfile.in @@ -0,0 +1,211 @@ +FROM BUILDER AS build_prep + +ARG DUAL_SIGN="true" +ARG KERNEL_FLAVOR_ARG +ARG KERNEL_NAME_ARG +ARG RPMFUSION_MIRROR_ARG +ARG VERSION_ARG + +#ifdef CI_SETX +ARG CI=1 +#endif /* CI_SETX */ + +#ifdef NVIDIA +ARG KMOD_MODULE_ARG +#endif /* NVIDIA */ + +#ifdef ZFS +ARG ZFS_MINOR_VERSION="2.3" +#endif /* ZFS */ + +# /* +# common copy/add +# */ + +COPY certs /tmp/certs + +COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment +COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service +COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service +COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset +COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset +COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules + +#ifndef CENTOS +ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${VERSION}/ublue-os-akmods-fedora-${VERSION}.repo \ + /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo +ADD https://negativo17.org/repos/fedora-multimedia.repo \ + /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo +#endif + +# /* +# Preperation +# */ +COPY build_files/prep /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +set "${CI+-x}" -euo pipefail +ls -sh /tmp/kernel_cache +/tmp/build-prep.sh +RUNEOF + +FROM build_prep AS builder + +ARG DUAL_SIGN="true" +ARG KERNEL_FLAVOR_ARG +ARG KERNEL_NAME_ARG +ARG RPMFUSION_MIRROR_ARG +ARG VERSION_ARG + +#ifdef CI_SETX +ARG CI=1 +#endif /* CI_SETX */ + +#ifdef NVIDIA +ARG KMOD_MODULE_ARG +#endif /* NVIDIA */ + +#if defined COMMON +# /* +# common akmods +# */ +COPY build_files/common /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +set "${CI+-x}" -euo pipefail +if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then + /tmp/build-ublue-os-ucore-addons.sh + cp /tmp/ublue-os-ucore-addons/rpmbuild/RPMS/noarch/ublue-os-ucore-addons*.rpm /var/cache/rpms/ucore/ +fi +/tmp/build-ublue-os-akmods-addons.sh +cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm /var/cache/rpms/ublue-os/ +RUNEOF +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +/tmp/build-kmod-framework-laptop.sh +/tmp/build-kmod-kvmfr.sh +/tmp/build-kmod-openrazer.sh +/tmp/build-kmod-v4l2loopback.sh +/tmp/build-kmod-wl.sh +/tmp/build-kmod-xone.sh +RUNEOF + +#elif defined EXTRA +# /* +# extra akmods +# */ + +COPY build_files/extra /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +if [[ "${VERSION}" -ge 41 ]]; then + /tmp/build-kmod-gpd-fan.sh +fi +/tmp/build-kmod-ayaneo-platform.sh +/tmp/build-kmod-ayn-platform.sh +/tmp/build-kmod-bmi260.sh +if grep -qv "bazzite" <<< "${KERNEL_FLAVOR}"; then + /tmp/build-kmod-VirtualBox.sh + /tmp/build-kmod-facetimehd.sh + /tmp/build-kmod-rtl8814au.sh + /tmp/build-kmod-rtl88xxau.sh +fi +/tmp/build-kmod-gcadapter_oc.sh +/tmp/build-kmod-nct6687d.sh +/tmp/build-kmod-ryzen-smu.sh +/tmp/build-kmod-system76-io.sh +/tmp/build-kmod-system76.sh +/tmp/build-kmod-vhba.sh +RUNEOF + +#elif defined NVIDIA +# /* +# nvidia kmods +# */ + +COPY build_files/nvidia /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then + /tmp/build-ublue-os-ucore-nvidia.sh + cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm /var/cache/rpms/ucore/ +fi +RUNEOF +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +/tmp/build-ublue-os-nvidia-addons.sh +cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm /var/cache/rpms/ublue-os/ +RUNEOF +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +/tmp/build-kmod-nvidia.sh "$KMOD_MODULE" +RUNEOF + +#elif defined ZFS +# /* +# zfs akmods +# */ +COPY build_files/zfs /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +set "${CI+-x}" -euo pipefail +/tmp/build-kmod-zfs.sh +RUNEOF +#endif + +# /* +# Signing +# */ +COPY build_files/post /tmp/ +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +set "${CI+-x}" -euo pipefail +#ifdef ZFS +/tmp/dual-sign-zfs.sh +#else +/tmp/dual-sign.sh +#endif /* ZFS */ +/tmp/build-post.sh +RUNEOF + +FROM scratch AS RPMS + +COPY --from=builder /var/cache/kernel-rpms /kernel-rpms +COPY --from=builder /var/cache/rpms /rpms + +FROM build_prep AS test + +ARG DUAL_SIGN="true" +ARG KERNEL_FLAVOR_ARG +ARG KERNEL_NAME_ARG +ARG RPMFUSION_MIRROR_ARG +ARG VERSION_ARG + +#ifdef CI_SETX +ENV CI=1 +#endif + +COPY --from=RPMS /kernel-rpms /tmp/kernel_cache +COPY --from=RPMS /rpms /tmp/akmods-rpms + +COPY build_files/test/test-prep.sh /tmp/ +COPY certs /tmp/certs + +RUN --mount=type=cache,dst=/var/cache/dnf \ + --mount=type=cache,dst=/var/cache/libdnf5 \ + bash <<'RUNEOF' +set "${CI+-x}" -euo pipefail +/tmp/test-prep.sh +RUNEOF + +COPY build_files/test/check-signatures.sh /tmp/ +CMD ["/tmp/check-signatures.sh"] diff --git a/Containerfile.nvidia b/Containerfile.nvidia deleted file mode 100644 index 5372a9a..0000000 --- a/Containerfile.nvidia +++ /dev/null @@ -1,52 +0,0 @@ -### -### Containerfile.nvidia - used to build ONLY NVIDIA kmods -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -FROM ${BUILDER_BASE} AS builder - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" -ARG RPMFUSION_MIRROR="" -ARG DUAL_SIGN="true" - -COPY build_files/nvidia build_files/shared /tmp/ -COPY certs /tmp/certs - -# files for nvidia -COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment -COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service -COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service -COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset -COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset -COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules - -RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \ - --mount=type=cache,dst=/var/cache/dnf \ - ls -sh /tmp/kernel_cache; \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/build-prep.sh && \ - if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \ - /tmp/build-ublue-os-ucore-nvidia.sh && \ - cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm \ - /var/cache/rpms/ucore/ \ - ; fi && \ - /tmp/build-ublue-os-nvidia-addons.sh && \ - cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \ - /var/cache/rpms/ublue-os/ && \ - /tmp/build-kmod-nvidia.sh kernel && \ - /tmp/dual-sign.sh && \ - /tmp/build-post.sh - -FROM scratch - -COPY --from=builder /var/cache/kernel-rpms /kernel-rpms -COPY --from=builder /var/cache/rpms /rpms diff --git a/Containerfile.nvidia-open b/Containerfile.nvidia-open deleted file mode 100644 index 808efa9..0000000 --- a/Containerfile.nvidia-open +++ /dev/null @@ -1,52 +0,0 @@ -### -### Containerfile.nvidia - used to build ONLY NVIDIA kmods -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -FROM ${BUILDER_BASE} AS builder - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" -ARG RPMFUSION_MIRROR="" -ARG DUAL_SIGN="true" - -COPY build_files/nvidia build_files/shared /tmp/ -COPY certs /tmp/certs - -# files for nvidia -COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment -COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service -COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service -COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset -COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset -COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules - -RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \ - --mount=type=cache,dst=/var/cache/dnf \ - ls -sh /tmp/kernel_cache; \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/build-prep.sh && \ - if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \ - /tmp/build-ublue-os-ucore-nvidia.sh && \ - cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm \ - /var/cache/rpms/ucore/ \ - ; fi && \ - /tmp/build-ublue-os-nvidia-addons.sh && \ - cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \ - /var/cache/rpms/ublue-os/ && \ - /tmp/build-kmod-nvidia.sh kernel-open && \ - /tmp/dual-sign.sh && \ - /tmp/build-post.sh - -FROM scratch - -COPY --from=builder /var/cache/kernel-rpms /kernel-rpms -COPY --from=builder /var/cache/rpms /rpms diff --git a/Containerfile.test b/Containerfile.test deleted file mode 100644 index 0123e25..0000000 --- a/Containerfile.test +++ /dev/null @@ -1,36 +0,0 @@ -### -### Containerfile.test - used to test akmods -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -ARG INPUT_AKMODS="${INPUT_AKMODS:-akmods}" -ARG INPUT_TAG="${INPUT_TAG:-${KERNEL_FLAVOR}-${FEDORA_MAJOR_VERSION}}" -ARG INPUT_BASE="${INPUT_AKMODS}:${INPUT_TAG}" -FROM ${INPUT_BASE} AS akmods_cache -FROM ${BUILDER_BASE} AS tester - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" -ARG RPMFUSION_MIRROR="" -ARG DUAL_SIGN="true" - -COPY build_files/shared /tmp/ -COPY certs /tmp/certs - -# cached kernel rpms -COPY --from=akmods_cache /kernel-rpms /tmp/kernel_cache -COPY --from=akmods_cache /rpms /tmp/akmods-rpms - -RUN --mount=type=cache,dst=/var/cache/dnf \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/test-prep.sh - -CMD ["/tmp/check-signatures.sh"] diff --git a/Containerfile.zfs b/Containerfile.zfs deleted file mode 100644 index f431e74..0000000 --- a/Containerfile.zfs +++ /dev/null @@ -1,38 +0,0 @@ -### -### Containerfile.zfs - used to build ONLY ZFS kmod -### - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}" -ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}" -FROM ${BUILDER_BASE} AS builder - -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}" -ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}" -ARG DUAL_SIGN="true" -ARG RPMFUSION_MIRROR="" -ARG ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-2.3}" - -COPY build_files/zfs build_files/shared /tmp/ -COPY certs /tmp/certs - -# Set kernel name -RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \ - --mount=type=cache,dst=/var/cache/dnf \ - ls -sh /tmp/kernel_cache; \ - if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \ - export KERNEL_NAME="kernel-surface" \ - ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \ - export KERNEL_NAME="kernel-longterm" \ - ; else \ - export KERNEL_NAME="kernel" \ - ; fi && \ - /tmp/build-prep.sh && \ - /tmp/build-kmod-zfs.sh && \ - /tmp/dual-sign-zfs.sh && \ - /tmp/build-post.sh - -FROM scratch - -COPY --from=builder /var/cache/kernel-rpms /kernel-rpms -COPY --from=builder /var/cache/rpms /rpms diff --git a/Justfile b/Justfile new file mode 100644 index 0000000..0e08e0e --- /dev/null +++ b/Justfile @@ -0,0 +1,468 @@ +set unstable := true +set dotenv-load := true + +podman := which('podman') || require('podman-remote') +just := just_executable() +BUILDDIR := shell('mkdir -p $1 && echo $1', env('AKMODS_BUILDDIR', absolute_path('build'))) +version_cache := shell('mkdir -p $1 && echo $1', BUILDDIR / kernel_flavor + '-' + version) +KCWD := shell('mkdir -p $1 && echo $1', version_cache / 'KCWD') +KCPATH := shell('mkdir -p $1 && echo $1', env('KCPATH', KCWD / 'rpms')) +version_json := KCPATH / 'cache.json' +builder := if kernel_flavor =~ 'centos' { 'quay.io/centos/centos:' + version } else { 'quay.io/fedora/fedora:' + version } + + +# Inputs + +kernel_flavor := env('AKMODS_KERNEL', shell('yq ".defaults.kernel_flavor" images.yaml')) +version := env('AKMODS_VERSION', if kernel_flavor =~ 'centos' { '10' } else { shell('yq ".defaults.version" images.yaml') }) +akmods_target := env('AKMODS_TARGET', if kernel_flavor =~ 'centos' { 'zfs' } else { shell('yq ".defaults.akmods_target" images.yaml') }) +bazzite_tag := env('AKMODS_BAZZITE_TAG', '') + +# Check if valid + +check_valid := if shell('yq ".images.$1[\"$2\"].$3" images.yaml', version, kernel_flavor, akmods_target) != 'null' { 'true' } else { error('Invalid Image Combination') } +_description := shell('yq ".images.$1[\"$2\"].$3.description" images.yaml', version, kernel_flavor, akmods_target) +_org := shell('yq ".images.$1[\"$2\"].$3.org" images.yaml', version, kernel_flavor, akmods_target) +_repo := shell('yq ".images.$1[\"$2\"].$3.repo" images.yaml', version, kernel_flavor, akmods_target) +registry := env('AKMODS_REGISTRY', shell('yq ".images.$1[\"$2\"].$3.registry" images.yaml', version, kernel_flavor, akmods_target)) +transport := env('AKMODS_TRANSPORT', shell('yq ".images.$1[\"$2\"].$3.transport" images.yaml', version, kernel_flavor, akmods_target)) +akmods_name := 'akmods' + if akmods_target != 'common' { '-' +akmods_target } else { '' } + +# Functions +[private] +logsum := ''' +log_sum() { echo "$1" >> ${GITHUB_STEP_SUMMARY:-/dev/stdout}; } +log_sum "# Push to GHCR result" +log_sum "\`\`\`" +''' + +[private] +default: + {{ just }} --list + +# Remove Build Directory +[group('Utility')] +clean: + rm -rf {{ BUILDDIR }} + +# Get the Kernel Version +[private] +get-kernel-version: + #!/usr/bin/bash + set "${CI:+-x}" -euo pipefail + if [[ {{ kernel_flavor }} =~ centos|longterm ]]; then + {{ podman }} pull --retry 3 "{{ builder }}" >&2 + container_name="fq-$(uuidgen)" + builder=$({{ podman }} run --entrypoint /bin/bash -dt "{{ builder }}") + dnf="{{ podman }} exec -t $builder dnf" + $dnf install -y --setopt=install_weak_deps=False dnf-plugins-core >&2 + trap '{{ podman }} rm -f -t 0 $builder &>/dev/null' EXIT SIGTERM + fi + + coreos_kernel() { + coreos_version=${1} + image_linux="$(skopeo inspect docker://quay.io/fedora/fedora-coreos:$coreos_version --format '{{{{ index .Labels "ostree.linux" }}')" + # Kernel Pin Location + # if [[ "{{ kernel_flavor }}" =~ coreos-stable ]]; then + # image_linux="" + # fi + + # Get Variables + major_minor_patch="$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+')" + kernel_rel_part=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+\-\K([123][0]{2})') + arch="$(echo $image_linux | grep -oP 'fc\d+\.\K.*$')" + kernel_rel="$kernel_rel_part.fc{{ version }}" + kernel_version="$major_minor_patch-$kernel_rel.$arch" + URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm" + + echo "Querying koji for ${coreos_version} kernel: $kernel_version" >&2 + echo "$URL" >&2 + HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP) + linux="" + if grep -qv "200 OK" <<< "${HTTP_RESP}"; then + echo "Koji failed to find $coreos_version kernel: $kernel_version" >&2 + case "$kernel_rel_part" in + "300") kernel_rel_part="200" ;; + "200") kernel_rel_part="100" ;; + "100") ;; + *) echo "unexpected kernel_rel_part ${kernel_rel_part}" >&2 ;; + esac + kernel_rel="$kernel_rel_part.fc{{ version }}" + kernel_version="$major_minor_patch-$kernel_rel.$arch" + URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm" + echo "Re-querying koji for ${coreos_version} kernel: $kernel_version" >&2 + echo "$URL" >&2 + HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP) + if grep -qv "200 OK" <<< "${HTTP_RESP}"; then + echo "Koji failed to find $coreos_version kernel: $kernel_version" >&2 + fi + fi + if grep -q "200 OK" <<< "${HTTP_RESP}"; then + linux=$kernel_version + fi + } + + kernel_name=kernel + case {{ kernel_flavor }} in + "bazzite") + if [[ -n "{{ bazzite_tag }}" ]]; then + latest="$(curl -s "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/tags/{{ bazzite_tag }}" )" + else + latest="$(curl -s "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/latest")" + fi + linux=$(echo "$latest" | jq -r '.assets[].name | match("kernel-.*fc{{ version }}.{{ arch() }}.rpm").string' | head -1 | sed "s/kernel-//g;s/.rpm//g") + build_tag=$(echo -E $latest | jq -r '.tag_name') + ;; + "centos") + $dnf makecache >&2 + linux=$($dnf repoquery --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://') + ;; + "centos-hsk") + $dnf -y install centos-release-hyperscale-kernel >&2 + $dnf makecache >&2 + linux=$($dnf repoquery --enablerepo="centos-hyperscale" --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://') + ;; + "coreos-stable") + coreos_kernel stable + ;; + "coreos-testing") + coreos_kernel testing + ;; + "longterm"*) + $dnf copr enable -y kwizart/kernel-{{ kernel_flavor }} >&2 + $dnf makecache >&2 + linux=$($dnf repoquery --whatprovides kernel-longterm | sort -V | tail -n1 | sed 's/.*://') + kernel_name=kernel-longterm + ;; + "main") + base_image_name="base" + if [[ {{ version }} > 40 ]]; then + base_image_name+="-atomic" + fi + linux=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/$base_image_name:{{ version }} --format '{{{{ index .Labels "ostree.linux" }}') + ;; + *) + echo "unexpected kernel_flavor '{{ kernel_flavor }}' for query" >&2 + exit 1 + ;; + esac + if [ -z "$linux" ] || [ "null" = "$linux" ]; then + echo "inspected image linux version must not be empty or null" >&2 + exit 1 + fi + major=$(echo "$linux" | cut -d '.' -f 1) + minor=$(echo "$linux" | cut -d '.' -f 2) + patch=$(echo "$linux" | cut -d '.' -f 3) + kernel_major_minor_patch="${major}.${minor}.${patch}" + linux="$(echo $linux | tr -d '[:cntrl:]')" + + # Debug Output + {{ if bazzite_tag != '' { 'echo "kernel_build_tag: ${build_tag}" >&2' } else { '' } }} + echo "kernel_flavor: {{ kernel_flavor }}" >&2 + echo "kernel_major_minor_patch: ${kernel_major_minor_patch}" >&2 + echo "kernel_release: ${linux}" >&2 + echo "kernel_name: ${kernel_name}" >&2 + + # Return + output=$(jq -nM \ + --arg build_tag "${build_tag:-}" \ + --arg kernel_flavor "{{ kernel_flavor}}" \ + --arg kernel_major_minor_patch "$kernel_major_minor_patch" \ + --arg kernel_release "$linux" \ + --arg kernel_name "$kernel_name" \ + --arg KCWD "{{ KCWD }}" \ + --arg KCPATH "{{ KCPATH }}" \ + '{ + "kernel_build_tag": $build_tag, + "kernel_flavor": $kernel_flavor, + "kernel_major_minor_patch": $kernel_major_minor_patch, + "kernel_release": $kernel_release, + "kernel_name": $kernel_name, + "KCWD": $KCWD, + "KCPATH": $KCPATH + }') + + echo $output + +# Cache Version Json +[group('Build')] +@cache-kernel-version: && populate-github-output + [ ! -f {{ version_json }} ] && {{ just }} get-kernel-version > {{ version_json }} || : + +# Populate Github Output +[private] +@populate-github-output: + {{ if env('GITHUB_OUTPUT', '') != '' { 'jq -r "to_entries[] | \"\(.key)=\(.value)\"" < ' + version_json + ' | xargs -I "{}" echo "{}" >> ' + env('GITHUB_OUTPUT') } else { '' } }} + +# Fetch and Sign Kernel RPMs +[group('Build')] +fetch-kernel: (cache-kernel-version) + #!/usr/bin/bash + {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }} + {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) == 'true' { 'exit 0' } else { '' } }} + set "${CI:+-x}" -euo pipefail + + # Pull Build Image + {{ podman }} pull --retry 3 "{{ builder }}" >&2 + + # Prep Environment + cp -a fetch-kernel.sh certs {{ KCWD }} >&2 + + # Fetch Kernels + builder=$(podman run \ + --security-opt label=disable \ + {{ if env('CI', '') != '' { '--env CI=1' } else { '' } }} \ + --env DUAL_SIGN=true \ + --env KERNEL_BUILD_TAG="{{ shell('jq -r .kernel_build_tag < $1', version_json) }}" \ + --env KERNEL_FLAVOR="{{ kernel_flavor }}" \ + --env KERNEL_NAME="{{ shell('jq -r .kernel_name < $1', version_json) }}" \ + --env KERNEL_VERSION="{{ shell('jq -r .kernel_release < $1' , version_json) }}" \ + --volume "{{ KCWD }}":/tmp/kernel-cache \ + --entrypoint /bin/bash \ + -dt "{{ builder }}") + trap '{{ podman }} rm -f -t 0 $builder &>/dev/null' EXIT SIGINT + podman exec $builder bash /tmp/kernel-cache/fetch-kernel.sh >&2 + echo "{{ datetime_utc('%Y%m%d') }}" > "{{ KCPATH / 'kernel-cache-date' }}" + find "{{ KCPATH }}" + +# Build Akmod Image +[group('Build')] +build: (cache-kernel-version) (fetch-kernel) + #!/usr/bin/bash + set "${CI:+-x}" -euo pipefail + {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }} + {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) != 'true' { error('No Cached RPMs') } else { '' } }} + CPP_FLAGS=( + {{ if env('CI', '') != '' { "--cpp-flag=-DCI_SETX" } else { '' } }} + "--cpp-flag=-DBUILDER={{ builder }}" + "--cpp-flag=-DKERNEL_FLAVOR_ARG=KERNEL_FLAVOR={{ kernel_flavor }}" + "--cpp-flag=-DKERNEL_NAME_ARG=KERNEL_NAME={{ shell("jq -r '.kernel_name' < $1", version_json) }}" + "--cpp-flag=-DRPMFUSION_MIRROR_ARG=RPMFUSION_MIRROR={{ env('RPMFUSION_MIRROR', '') }}" + "--cpp-flag=-DVERSION_ARG=VERSION={{ version }}" + "--cpp-flag=-D{{ replace_regex(uppercase(akmods_target), '-.*', '') }}" + "--cpp-flag=-D{{ replace_regex(uppercase(kernel_flavor), '-.*', '') }}" + ) + if [[ "{{ akmods_target }}" =~ nvidia ]]; then + CPP_FLAGS+=( + "--cpp-flag=-DKMOD_MODULE_ARG=KMOD_MODULE={{ if akmods_target =~ 'open' { "kernel-open" } else { 'kernel' } }}" + ) + fi + LABELS=( + "--label" "io.artifacthub.package.deprecated=false" + "--label" "io.artifacthub.package.keywords=bootc,fedora,bluefin,bazzite,centos,cayo,aurora,ublue,universal-blue" + "--label" "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4" + "--label" "io.artifacthub.package.maintainers=[{\"name\": \"castrojo\", \"email\": \"jorge.castro@gmail.com\"}]" + "--label" "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/README.md" + "--label" "org.opencontainers.image.created={{ datetime_utc('%Y-%m-%dT%H:%M:%SZ') }}" + "--label" "org.opencontainers.image.description='{{ _description }}'" + "--label" "org.opencontainers.image.license=Apache-2.0" + "--label" "org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/Containerfile.in" + "--label" "org.opencontainers.image.title={{ akmods_name }}" + "--label" "org.opencontainers.image.url=https://github.com/{{ _org / _repo }}" + "--label" "org.opencontainers.image.vendor='{{ _org }}'" + "--label" "org.opencontainers.image.version={{ shell("jq -r '.major_minor_patch' < $1", version_json) + '-' + trim(read(KCPATH / 'kernel-cache-date')) }}" + "--label" "ostree.linux={{ shell("jq -r '.kernel_release' < $1", version_json) }}" + ) + TAGS=( + "--tag" "{{ akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }}" + "--tag" "{{ akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_release' < $1", version_json) }}" + ) + + {{ podman }} build -f Containerfile.in --volume {{ KCPATH }}:/tmp/kernel_cache:ro "${CPP_FLAGS[@]}" "${LABELS[@]}" "${TAGS[@]}" --target RPMS {{ justfile_dir () }} + +# Test Cached Akmod RPMs +[group('Build')] +test: (cache-kernel-version) (fetch-kernel) + #!/usr/bin/bash + set "${CI:+-x}" -euo pipefail + {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }} + {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) != 'true' { error('No Cached RPMs') } else { '' } }} + CPP_FLAGS=( + {{ if env('CI', '') != '' { "--cpp-flag=-DCI_SETX" } else { '' } }} + "--cpp-flag=-DBUILDER={{ builder }}" + "--cpp-flag=-DKERNEL_FLAVOR_ARG=KERNEL_FLAVOR={{ kernel_flavor }}" + "--cpp-flag=-DKERNEL_NAME_ARG=KERNEL_NAME={{ shell("jq -r '.kernel_name' < $1", version_json) }}" + "--cpp-flag=-DRPMFUSION_MIRROR_ARG=RPMFUSION_MIRROR={{ env('RPMFUSION_MIRROR', '') }}" + "--cpp-flag=-DVERSION_ARG=VERSION={{ version }}" + "--cpp-flag=-D{{ replace_regex(uppercase(akmods_target), '-.*', '') }}" + "--cpp-flag=-D{{ replace_regex(uppercase(kernel_flavor), '-.*', '') }}" + ) + if [[ "{{ akmods_target }}" =~ nvidia ]]; then + CPP_FLAGS+=( + "--cpp-flag=-DKMOD_MODULE_ARG=KMOD_MODULE={{ if akmods_target =~ 'open' { "kernel-open" } else { 'kernel' } }}" + ) + fi + + {{ podman }} build -f Containerfile.in --volume {{ KCPATH }}:/tmp/kernel_cache:ro "${CPP_FLAGS[@]}" --target test --tag akmods-test:latest {{ justfile_dir () }} + if ! podman run --rm akmods-test:latest; then + echo "Signatures Failed" >&2 + exit 1 + fi + +# Login to Registry +[group('Registry')] +@login: + {{ podman }} login {{ registry }} -u "$REGISTRY_ACTOR" -p "$REGISTRY_TOKEN" + +# Push Images to Registry +[group('Registry')] +push: + #!/usr/bin/bash + {{ if env('COSIGN_PRIVATE_KEY', '') != '' { 'printf "%s" "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key' } else { '' } }} + {{ if env('CI', '') != '' { logsum } else { '' } }} + + set ${CI:+-x} -eou pipefail + + declare -a TAGS=($({{ podman }} image list {{ 'localhost' / akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }} --noheading --format 'table {{{{ .Tag }}')) + for tag in "${TAGS[@]}"; do + for i in {1..5}; do + {{ podman }} push {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} "{{ 'localhost' / akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }}" "{{ transport + registry / _org / akmods_name }}:$tag" && break || sleep $((5 * i)); + if [[ $i -eq '5' ]]; then + exit 1 + fi + done + {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':$tag"' } else { '' } }} + done + {{ if env('CI', '') != '' { 'log_sum "\`\`\`"' } else { '' } }} + +# Generate Manifest and Push to Registry +[group('Registry')] +manifest: + #!/usr/bin/bash + {{ if env('COSIGN_PRIVATE_KEY', '') != '' { 'printf "%s" "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key' } else { '' } }} + {{ if env('CI', '') != '' { logsum } else { '' } }} + + set ${CI:+-x} -eou pipefail + + LABELS=( + "io.artifacthub.package.deprecated=false" + "io.artifacthub.package.keywords=bootc,fedora,bluefin,bazzite,centos,cayo,aurora,ublue,universal-blue" + "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4" + "io.artifacthub.package.maintainers=[{\"name\": \"castrojo\", \"email\": \"jorge.castro@gmail.com\"}]" + "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/README.md" + "org.opencontainers.image.created={{ datetime_utc('%Y-%m-%dT%H:%M:%SZ') }}" + "org.opencontainers.image.description={{ _description }}" + "org.opencontainers.image.license=Apache-2.0" + "org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/Containerfile.in" + "org.opencontainers.image.title={{ akmods_name }}" + "org.opencontainers.image.url=https://github.com/{{ _org / _repo }}" + "org.opencontainers.image.vendor={{ _org }}" + "org.opencontainers.image.version={{ kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }}" + ) + # Create Manifest + MANIFEST=$({{ podman }} manifest create {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }}) + + for label in "${LABELS[@]}"; do + echo "Applying label "${label}" to manifest" + podman manifest annotate --index --annotation "$label" "${MANIFEST}" + done + + MANIFEST=$({{ podman }} manifest create {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }}) + + for label in "${LABELS[@]}"; do + echo "Applying label "${label}" to manifest" + podman manifest annotate --index --annotation "$label" "${MANIFEST}" + done + + # Add to Manifest + {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-x86_64' }} + # {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-aarch64' }} + {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_release' < $1", version_json) }} + # {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + replace(shell("jq -r '.kernel_release' < $1", version_json), 'x86_64', 'aarch64') }} + + # Push Manifest + for i in {1..5}; do + {{ podman }} manifest push --all {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} && break || sleep $((5 * i)); + if [[ $i -eq '5' ]]; then + exit 1 + fi + done + {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':' + kernel_flavor + '-' + version + '"' } else { '' } }} + + for i in {1..5}; do + {{ podman }} manifest push --all {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} && break || sleep $((5 * i)); + if [[ $i -eq '5' ]]; then + exit 1 + fi + done + {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) + '"' } else { '' } }} + + {{ if env('CI', '') != '' { 'log_sum "\`\`\`"' } else { '' } }} + +# Generate GHA Workflows +[group('Utility')] +generate-workflows: + #!/usr/bin/bash + set -euo pipefail + + main() { + if [[ ! -d .github || ! -d .git ]]; then + echo "This script must be run at the root of the repo" >&2 + exit 1 + fi + + rm -f "./.github/workflows/build"*".yml" + + declare -A images=() + declare -A workflows=() + versions=($(yq '.images | keys | .[]' images.yaml | sort | uniq)) + flavors=($(yq '.images.* | keys | .[]' images.yaml | sort | uniq)) + targets=($(yq 'explode(.) | .images.*.* | keys | .[]' images.yaml | sort | uniq)) + + for i in "${versions[@]}"; do + for j in "${flavors[@]}"; do + for k in "${targets[@]}"; do + #shellcheck disable=SC1087 + if [[ "$(yq ".images.$i[\"$j\"].$k" images.yaml)" != "null" ]]; then + images+=(["$i-$j-$k"]="$i,$j,$k") + workflows+=(["$i-$j"]="$i,$j") + fi + done + done + done + for i in "${flavors[@]}"; do + { + cat <<'EOF' + --- + # + # WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND! + # + # Generate the workflow by running `just generate-workflows` at git root + # Modify the inputs in workflow-templates + EOF + sed "s/AKMODs/${i^^} akmods/;s/05/$(printf '%02d' $(( RANDOM % 30)))/g" ./workflow-templates/workflow.yaml.in + if [[ "$i" =~ bazzite ]]; then + cat <<'EOF' + inputs: + bazzite_tag: + description: "The release tag for the bazzite kernel" + required: false + type: string + EOF + fi + echo "jobs:" + for j in "${!workflows[@]}"; do + if [[ ! "$j" =~ $i ]]; then + continue + fi + version=$(echo "${workflows[$j]}" | cut -d "," -f 1) + kernel_flavor=$(echo "${workflows[$j]}" | cut -d "," -f 2) + kernel_flavor_clean=$(echo $kernel_flavor | tr '.' '-') + sed -e "s/%%KERNEL_FLAVOR%%/$kernel_flavor/;s/%%KERNEL_FLAVOR_CLEAN%%/$kernel_flavor_clean/;s/%%VERSION%%/$version/" ./workflow-templates/cache_kernel.yaml.in + if [[ "$i" =~ bazzite ]]; then + printf ' %s\n' 'bazzite_tag: ${{{{ inputs.bazzite_tag }}' + fi + for k in common extra nvidia nvidia-open zfs; do + value="${images[$j-$k]:-}" + if [ -z "$value" ]; then + continue + fi + akmods_target="$(echo "$value" | cut -d "," -f 3)" + sed "s/%%VERSION%%/$version/;s/%%KERNEL_FLAVOR%%/$kernel_flavor/;s/%%AKMODS_TARGET%%/$akmods_target/;s/%%KERNEL_FLAVOR_CLEAN%%/$kernel_flavor_clean/" "./workflow-templates/job.yaml.in" + done + done + } > "./.github/workflows/build-akmods-$i.yml" + done + } + + main diff --git a/README.md b/README.md index b405475..9127a83 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,12 @@ # ublue-os akmods -[![build-bazzite](https://github.com/ublue-os/akmods/actions/workflows/build-bazzite.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-bazzite.yml) [![build-41](https://github.com/ublue-os/akmods/actions/workflows/build-41.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-41.yml) [![build-42](https://github.com/ublue-os/akmods/actions/workflows/build-42.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-42.yml) +[![Build BAZZITE akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-bazzite.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-bazzite.yml)[![Build CENTOS akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-centos.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-centos.yml)[![Build COREOS-STABLE akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-stable.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-stable.yml)[![Build COREOS-TESTING akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-testing.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-testing.yml)[![Build LONGTERM-6.12 akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-longterm-6.12.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-longterm-6.12.yml)[![Build MAIN akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-main.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-main.yml) OCI images providing a set of cached kernel RPMs and extra kernel modules to Universal Blue images. Used for better hardware support and consistent build process. ## How it's organized -The [`akmods` image](https://github.com/orgs/ublue-os/packages/container/package/akmods) is built and published daily. However, there's not a single image but several, given various kernels we now support. +The [`akmods` images](https://github.com/orgs/ublue-os/packages?repo_name=akmods) are built and published daily. However, there's not a single image but several, given various kernels we now support. The akmods packages are divided up for building in a few different "groups": @@ -21,37 +21,13 @@ Each of these images contains a cached copy of the respective kernel RPMs compat Builds also run for different kernels: - `bazzite` - Bazzite [builds a kernel with gaming specific patches](https://github.com/bazzite-org/kernel-bazzite) for the current release of Fedora -- `ublue 41` - Fedora 41 kernel builds: - - `main` - current default kernel version - - `coreos-stable` - current Fedora CoreOS stable kernel version - - `coreos-testing` - current Fedora CoreOS testing kernel version -- `ublue 42` - Fedora 42 kernel builds: - - `main` - current default kernel version - - `coreos-stable` - current Fedora CoreOS stable kernel version - - `coreos-testing` - current Fedora CoreOS testing kernel version +- `main` - Mainline Fedora Kernel +- `coreos-stable` - Current Fedora CoreOS stable kernel version +- `coreos-testing` - Current Fedora CoreOS testing kernel version +- `Centos` - Mainline Centos Kernel +- `Longterm-6.12` - Fedora Kernel on Kernel 6.12 LTS -This table shows what groups build for which kernel and Fedora release: - -| Build | Kernel | akmods group | -|-------|--------|--------------| -| bazzite | bazzite | common | -| bazzite | bazzite | extra | -| bazzite | bazzite | nvidia | -| bazzite | bazzite | nvidia-open | -| 41 | main | common | -| 41 | main | nvidia | -| 41 | main | nvidia-open | -| 41 | coreos-stable | common | -| 41 | coreos-stable | nvidia | -| 41 | coreos-stable | nvidia-open | -| 41 | coreos-stable | zfs | -| 42 | main | common | -| 42 | main | nvidia | -| 42 | main | nvidia-open | -| 42 | coreos-stable | common | -| 42 | coreos-stable | nvidia | -| 42 | coreos-stable | nvidia-open | -| 42 | coreos-stable | zfs | +See `images.yaml` for which akmods packages are built for each Kernel ## Features @@ -66,7 +42,7 @@ The `nvidia` and `nvidia-open` images contains - `ublue-os-nvidia-addons` - installs extra repos enabling our nvidia support - [nvidia container selinux policy](https://github.com/NVIDIA/dgx-selinux/tree/master/src/nvidia-container-selinux) - uses RHEL9 policy as the closest match - - [nvidia-container-tookkit repo](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html#installing-with-yum-or-dnf) - version 1.14 (and newer) provide CDI for podman use of nvidia gpus + - [nvidia-container-toolkit repo](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html#installing-with-yum-or-dnf) - version 1.14 (and newer) provide CDI for podman use of nvidia gpus - `ublue-os-ucore-nvidia` - a slightly lighter `ublue-os-nvidia-addons` for CoreOS/uCore systems ### Kmod Packages @@ -92,7 +68,7 @@ The `nvidia` and `nvidia-open` images contains | extra | [zenergy](https://github.com/BoukeHaarsma23/zenergy) | Based on AMD_ENERGY driver, but with some jiffies added so non-root users can read it safely | [![badge](https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/package/zenergy-kmod/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/package/zenergy-kmod) | | nvidia | [nvidia](https://negativo17.org/nvidia-driver/) | nvidia GPU drivers | [negativo17 - fedora-nvidia](https://negativo17.org/) | | nvidia-open | [nvidia](https://negativo17.org/nvidia-driver/) | nvidia-open GPU drivers | [negativo17 - fedora-nvidia](https://negativo17.org/) | -| zfs | [zfs](https://github.com/openzfs/zfs) | OpenZFS advanced file system and volume manager (From Ucore, CoreOS Only) | +| zfs | [zfs](https://github.com/openzfs/zfs) | OpenZFS advanced file system and volume manager | [zfs](https://github.com/openzfs/zfs) | ## Notes @@ -115,7 +91,6 @@ We build both the open and closed drivers from NVIDIA. The open driver is the on - NVIDIA Pascal: Quadro: P2000, P4000, P5000, P6000, GP100; Tesla: P100, P40, P4 - NVIDIA Maxwell: Quadro: K2200, M2000, M4000, M5000, M6000, M6000 24GB; - - Tesla: M60, M40, M6, M4 - ## Usage To install one of these kmods, you'll need to install any of their specific dependencies (checkout the `build-prep.sh` and the specific `build-FOO.sh` script for details), and ensure you are on a compatible kernel. @@ -137,14 +112,69 @@ For NVIDIA images, add something like this to your Containerfile, replacing `TAG ## optionally install remove old and install new kernel # dnf -y remove --no-autoremove kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra ## install ublue support package and desired kmod(s) - RUN rpm-ostree install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm - RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm + RUN dnf install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm + RUN dnf install /tmp/rpms/kmods/kmod-nvidia*.rpm + +*Note* There is an nvidia-install script that most universal-blue images use located with the *main* repo that works for desktop Fedora installs. ## Verification -These images are signed with sisgstore's [cosign](https://docs.sigstore.dev/about/overview/). You can verify the signature by downloading the `cosign.pub` key from this repo and running the following command, replacing `RELEASE` with either `40`, `41` or `42`: +These images are signed with sisgstore's [cosign](https://docs.sigstore.dev/about/overview/). You can verify the signature by downloading the `cosign.pub` key from this repo and running the following command, replacing `KERNEL_FLAVOR` with whichever kernel you are using and `RELEASE` with either `40`, `41` or `42`: - cosign verify --key cosign.pub ghcr.io/ublue-os/akmods:RELEASE + cosign verify --key cosign.pub ghcr.io/ublue-os/akmods:KERNEL_FLAVOR-RELEASE + +## Local Building/Testing + +You can build these akmods locally with our test keys using the included `Justfile`. We strongly recommend using the provided devcontainer which contains all dependencies for building this project. + +### How to Use the Justfile + +To build an akmods package, run the following: + +```bash +just build +``` +Since nothing additional was set. The following will occur. The build scripts will determine the current fedora kernel version, download the RPMs, and sign the kernel with the test key. It will then build the common set of akmods. To modify what gets built, modify the following environment variables: + +- AKMODS_KERNEL - The kernel flavor you are building +- AKMODS_VERSION - The release version +- AKMODS_TARGET - The akmods package to build + +```bash +AKMODS_KERNEL=centos AKMODS_VERSION=10 AKMODS_TARGET=zfs just build +``` + +Will determine the current centos kernel version, download the rpms and sign them, and will then build the zfs package. + +You can also populate a `.env` file to store your current settings. + +You can see your current settings with `just --evaluate` + +Additionally you can pass values as key/value pairs. + +```bash +just kernel_flavor=bazzite version=42 akmods_target=extra build +``` + +Which will build the extra package for Bazzite. + +Note, the `Justfile` will compare your inputs to the `images.yaml` file to ensure you have a valid combination. + +### How to Use images.yaml + +All build targets are defined in the `images.yaml` file. This is where the top level targets are defined. You can view the targets using: + +```bash +yq 'explode(.).images' images.yaml +``` + +### Adding Kernels and KMODs + +Generally speaking, Kernels are only added if they will be used internally to Universal Blue. + +KMODs as well will likely only be included if there is a need/desire to include them within the Universal Blue Project. Generally, KMODs for hardware enablement will be considered for inclusion or ones that fix/resolve a known feature gap. + +Don't hesitate to file an issue asking about inclusion. ## Metrics diff --git a/build_files/common/build-kmod-framework-laptop.sh b/build_files/common/build-kmod-framework-laptop.sh index 9511111..7503c1c 100755 --- a/build_files/common/build-kmod-framework-laptop.sh +++ b/build_files/common/build-kmod-framework-laptop.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD framework-laptop (succeed or fail-fast with debug output) dnf install -y \ - akmod-framework-laptop-*.fc${RELEASE}.${ARCH} + akmod-framework-laptop-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod framework-laptop -modinfo /usr/lib/modules/${KERNEL}/extra/framework-laptop/framework_laptop.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/framework-laptop/framework_laptop.ko.xz > /dev/null \ || (find /var/cache/akmods/framework-laptop/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/common/build-kmod-kvmfr.sh b/build_files/common/build-kmod-kvmfr.sh index c9b6ca1..fdfaa8c 100755 --- a/build_files/common/build-kmod-kvmfr.sh +++ b/build_files/common/build-kmod-kvmfr.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" diff --git a/build_files/common/build-kmod-openrazer.sh b/build_files/common/build-kmod-openrazer.sh index ac29378..ed0083b 100755 --- a/build_files/common/build-kmod-openrazer.sh +++ b/build_files/common/build-kmod-openrazer.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,15 +10,15 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD openrazer (succeed or fail-fast with debug output) dnf install -y \ - akmod-openrazer-*.fc${RELEASE}.${ARCH} + akmod-openrazer-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod openrazer -modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razerkbd.ko.xz >/dev/null || +modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razerkbd.ko.xz >/dev/null || (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1) -modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razermouse.ko.xz >/dev/null || +modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razermouse.ko.xz >/dev/null || (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1) -modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razerkraken.ko.xz >/dev/null || +modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razerkraken.ko.xz >/dev/null || (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1) -modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razeraccessory.ko.xz >/dev/null || +modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razeraccessory.ko.xz >/dev/null || (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/common/build-kmod-v4l2loopback.sh b/build_files/common/build-kmod-v4l2loopback.sh index 023f247..51d28d9 100755 --- a/build_files/common/build-kmod-v4l2loopback.sh +++ b/build_files/common/build-kmod-v4l2loopback.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" @@ -9,7 +9,7 @@ RELEASE="$(rpm -E '%fedora')" ### BUILD v4l2loopbak (succeed or fail-fast with debug output) dnf install -y \ - akmod-v4l2loopback-*.fc${RELEASE}.${ARCH} + akmod-v4l2loopback-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod v4l2loopback -modinfo /usr/lib/modules/${KERNEL}/extra/v4l2loopback/v4l2loopback.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/v4l2loopback/v4l2loopback.ko.xz > /dev/null \ || (find /var/cache/akmods/v4l2loopback/ -name \*.log -print -exec cat {} \; && exit 1) diff --git a/build_files/common/build-kmod-wl.sh b/build_files/common/build-kmod-wl.sh index 4027fcc..6b88303 100755 --- a/build_files/common/build-kmod-wl.sh +++ b/build_files/common/build-kmod-wl.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" @@ -10,7 +10,7 @@ RELEASE="$(rpm -E '%fedora')" ### BUILD wl (succeed or fail-fast with debug output) dnf install -y \ - akmod-wl-*.fc${RELEASE}.${ARCH} + akmod-wl-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod wl -modinfo /usr/lib/modules/${KERNEL}/extra/wl/wl.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/wl/wl.ko.xz > /dev/null \ || (find /var/cache/akmods/wl/ -name \*.log -print -exec cat {} \; && exit 1) diff --git a/build_files/common/build-kmod-xone.sh b/build_files/common/build-kmod-xone.sh index 705d753..c72b52b 100755 --- a/build_files/common/build-kmod-xone.sh +++ b/build_files/common/build-kmod-xone.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD xone (succeed or fail-fast with debug output) dnf install -y \ - akmod-xone-*.fc${RELEASE}.${ARCH} + akmod-xone-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod xone -modinfo /usr/lib/modules/${KERNEL}/extra/xone/xone-{dongle,gip,gip-gamepad,gip-headset,gip-chatpad,gip-madcatz-strat,gip-madcatz-glam,gip-pdp-jaguar}.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/xone/xone-{dongle,gip,gip-gamepad,gip-headset,gip-chatpad,gip-madcatz-strat,gip-madcatz-glam,gip-pdp-jaguar}.ko.xz > /dev/null \ || (find /var/cache/akmods/xone/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/common/build-ublue-os-akmods-addons.sh b/build_files/common/build-ublue-os-akmods-addons.sh index 0e81fcb..57244b0 100755 --- a/build_files/common/build-ublue-os-akmods-addons.sh +++ b/build_files/common/build-ublue-os-akmods-addons.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ### BUILD UBLUE AKMODS-ADDONS RPM diff --git a/build_files/common/build-ublue-os-ucore-addons.sh b/build_files/common/build-ublue-os-ucore-addons.sh index 6352b55..f2653bb 100755 --- a/build_files/common/build-ublue-os-ucore-addons.sh +++ b/build_files/common/build-ublue-os-ucore-addons.sh @@ -1,10 +1,10 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ### BUILD UCORE-ADDONS RPM install -D /etc/pki/akmods/certs/public_key.der /tmp/ublue-os-ucore-addons/rpmbuild/SOURCES/public_key.der rpmbuild -ba \ --define '_topdir /tmp/ublue-os-ucore-addons/rpmbuild' \ --define '%_tmppath %{_topdir}/tmp' \ - /tmp/ublue-os-ucore-addons/ublue-os-ucore-addons.spec \ No newline at end of file + /tmp/ublue-os-ucore-addons/ublue-os-ucore-addons.spec diff --git a/build_files/extra/build-kmod-VirtualBox.sh b/build_files/extra/build-kmod-VirtualBox.sh index fb39454..3daede5 100755 --- a/build_files/extra/build-kmod-VirtualBox.sh +++ b/build_files/extra/build-kmod-VirtualBox.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,7 +9,7 @@ RELEASE="$(rpm -E '%fedora')" ### BUILD VirtualBox (succeed or fail-fast with debug output) dnf install -y \ - akmod-VirtualBox-*.fc${RELEASE}.${ARCH} + akmod-VirtualBox-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod VirtualBox -modinfo /usr/lib/modules/${KERNEL}/extra/VirtualBox/{vboxdrv,vboxnetadp,vboxnetflt}.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/VirtualBox/{vboxdrv,vboxnetadp,vboxnetflt}.ko.xz > /dev/null \ || (find /var/cache/akmods/VirtualBox/ -name \*.log -print -exec cat {} \; && exit 1) diff --git a/build_files/extra/build-kmod-ayaneo-platform.sh b/build_files/extra/build-kmod-ayaneo-platform.sh index 1845375..4c34e95 100755 --- a/build_files/extra/build-kmod-ayaneo-platform.sh +++ b/build_files/extra/build-kmod-ayaneo-platform.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')" cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-ayaneo-platform-*.fc${RELEASE}.${ARCH} + akmod-ayaneo-platform-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod ayaneo-platform -modinfo /usr/lib/modules/${KERNEL}/extra/ayaneo-platform/ayaneo-platform.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/ayaneo-platform/ayaneo-platform.ko.xz > /dev/null \ || (find /var/cache/akmods/ayaneo-platform/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-ayn-platform.sh b/build_files/extra/build-kmod-ayn-platform.sh index e739005..bf4fd0f 100755 --- a/build_files/extra/build-kmod-ayn-platform.sh +++ b/build_files/extra/build-kmod-ayn-platform.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')" cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-ayn-platform-*.fc${RELEASE}.${ARCH} + akmod-ayn-platform-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod ayn-platform -modinfo /usr/lib/modules/${KERNEL}/extra/ayn-platform/ayn-platform.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/ayn-platform/ayn-platform.ko.xz > /dev/null \ || (find /var/cache/akmods/ayn-platform/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-bmi260.sh b/build_files/extra/build-kmod-bmi260.sh index 5e6f3ef..8e4ba9f 100755 --- a/build_files/extra/build-kmod-bmi260.sh +++ b/build_files/extra/build-kmod-bmi260.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')" cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-bmi260-*.fc${RELEASE}.${ARCH} + akmod-bmi260-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod bmi260 -modinfo /usr/lib/modules/${KERNEL}/extra/bmi260/bmi260_{core,i2c}.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/bmi260/bmi260_{core,i2c}.ko.xz > /dev/null \ || (find /var/cache/akmods/bmi260/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-evdi.sh b/build_files/extra/build-kmod-evdi.sh index 00e3370..f2df736 100755 --- a/build_files/extra/build-kmod-evdi.sh +++ b/build_files/extra/build-kmod-evdi.sh @@ -1,6 +1,6 @@ #!/bin/bash -set -eoux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" diff --git a/build_files/extra/build-kmod-facetimehd.sh b/build_files/extra/build-kmod-facetimehd.sh index d42e099..4b80c8f 100755 --- a/build_files/extra/build-kmod-facetimehd.sh +++ b/build_files/extra/build-kmod-facetimehd.sh @@ -1,12 +1,12 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" RELEASE="$(rpm -E '%fedora')" -if [[ "${RELEASE}" -ge 41 ]]; then +if [[ "${RELEASE}" -ge 43 ]]; then COPR_RELEASE="rawhide" else COPR_RELEASE="${RELEASE}" @@ -17,7 +17,7 @@ curl -LsSf -o /etc/yum.repos.d/_copr_mulderje-facetimehd-kmod.repo \ ### BUILD facetimehd (succeed or fail-fast with debug output) dnf install -y \ - akmod-facetimehd-*.fc${RELEASE}.${ARCH} + akmod-facetimehd-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod facetimehd modinfo "/usr/lib/modules/${KERNEL}/extra/facetimehd/facetimehd.ko.xz" > /dev/null \ || (find /var/cache/akmods/facetimehd/ -name \*.log -print -exec cat {} \; && exit 1) diff --git a/build_files/extra/build-kmod-gcadapter_oc.sh b/build_files/extra/build-kmod-gcadapter_oc.sh index 6a51af2..765fb26 100755 --- a/build_files/extra/build-kmod-gcadapter_oc.sh +++ b/build_files/extra/build-kmod-gcadapter_oc.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')" cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-gcadapter_oc-*.fc${RELEASE}.${ARCH} + akmod-gcadapter_oc-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod gcadapter_oc -modinfo /usr/lib/modules/${KERNEL}/extra/gcadapter_oc/gcadapter_oc.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/gcadapter_oc/gcadapter_oc.ko.xz > /dev/null \ || (find /var/cache/akmods/gcadapter_oc/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-gpd-fan.sh b/build_files/extra/build-kmod-gpd-fan.sh index 906b690..3d3582c 100755 --- a/build_files/extra/build-kmod-gpd-fan.sh +++ b/build_files/extra/build-kmod-gpd-fan.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD gpd-fan (succeed or fail-fast with debug output) dnf install -y \ - akmod-gpd-fan-*.fc${RELEASE}.${ARCH} + akmod-gpd-fan-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod gpd-fan -modinfo /usr/lib/modules/${KERNEL}/extra/gpd-fan/gpd-fan.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/gpd-fan/gpd-fan.ko.xz > /dev/null \ || (find /var/cache/akmods/gpd-fan/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-nct6687d.sh b/build_files/extra/build-kmod-nct6687d.sh index 717cf92..a74f24c 100755 --- a/build_files/extra/build-kmod-nct6687d.sh +++ b/build_files/extra/build-kmod-nct6687d.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD nct6687d (succeed or fail-fast with debug output) dnf install -y \ - akmod-nct6687d-*.fc${RELEASE}.${ARCH} + akmod-nct6687d-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod nct6687d -modinfo /usr/lib/modules/${KERNEL}/extra/nct6687d/nct6687.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/nct6687d/nct6687.ko.xz > /dev/null \ || (find /var/cache/akmods/nct6687d/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-rtl8814au.sh b/build_files/extra/build-kmod-rtl8814au.sh index ca02b96..2eb6891 100755 --- a/build_files/extra/build-kmod-rtl8814au.sh +++ b/build_files/extra/build-kmod-rtl8814au.sh @@ -1,22 +1,17 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" RELEASE="$(rpm -E '%fedora')" -if [[ "${KERNEL}" =~ "6.8" ]]; then - echo "SKIPPED BUILD of rtl8814au: compile failure on kernel 6.8 as of 2024-03-17" - exit 0 -fi - cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-rtl8814au-*.fc${RELEASE}.${ARCH} + akmod-rtl8814au-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod rtl8814au -modinfo /usr/lib/modules/${KERNEL}/extra/rtl8814au/rtl8814au.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/rtl8814au/rtl8814au.ko.xz > /dev/null \ || (find /var/cache/akmods/rtl8814au/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-rtl88xxau.sh b/build_files/extra/build-kmod-rtl88xxau.sh index c508a0e..ce2cd55 100755 --- a/build_files/extra/build-kmod-rtl88xxau.sh +++ b/build_files/extra/build-kmod-rtl88xxau.sh @@ -1,22 +1,17 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" RELEASE="$(rpm -E '%fedora')" -if [[ "${KERNEL}" =~ "6.8" ]]; then - echo "SKIPPED BUILD of rtl88xxau: compile failure on kernel 6.8 as of 2024-03-17" - exit 0 -fi - cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-rtl88xxau-*.fc${RELEASE}.${ARCH} + akmod-rtl88xxau-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod rtl88xxau -modinfo /usr/lib/modules/${KERNEL}/extra/rtl88xxau/88XXau.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/rtl88xxau/88XXau.ko.xz > /dev/null \ || (find /var/cache/akmods/rtl88xxau/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-ryzen-smu.sh b/build_files/extra/build-kmod-ryzen-smu.sh index 53f08d7..a2d7be9 100755 --- a/build_files/extra/build-kmod-ryzen-smu.sh +++ b/build_files/extra/build-kmod-ryzen-smu.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/ ### BUILD ryzen-smu (succeed or fail-fast with debug output) dnf install -y \ - akmod-ryzen-smu-*.fc${RELEASE}.${ARCH} + akmod-ryzen-smu-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod ryzen-smu -modinfo /usr/lib/modules/${KERNEL}/extra/ryzen-smu/ryzen_smu.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/ryzen-smu/ryzen_smu.ko.xz > /dev/null \ || (find /var/cache/akmods/ryzen-smu/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/extra/build-kmod-system76-io.sh b/build_files/extra/build-kmod-system76-io.sh index 20350d2..2847aec 100755 --- a/build_files/extra/build-kmod-system76-io.sh +++ b/build_files/extra/build-kmod-system76-io.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" diff --git a/build_files/extra/build-kmod-system76.sh b/build_files/extra/build-kmod-system76.sh index 0e45756..5b60f1e 100755 --- a/build_files/extra/build-kmod-system76.sh +++ b/build_files/extra/build-kmod-system76.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" diff --git a/build_files/extra/build-kmod-vhba.sh b/build_files/extra/build-kmod-vhba.sh index 3e0cc59..9db9839 100755 --- a/build_files/extra/build-kmod-vhba.sh +++ b/build_files/extra/build-kmod-vhba.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" @@ -17,9 +17,9 @@ curl -LsSf -o /etc/yum.repos.d/_copr_rok-cdemu.repo "https://copr.fedorainfraclo ### BUILD vhba (succeed or fail-fast with debug output) dnf install -y \ - akmod-vhba-*.fc${RELEASE}.${ARCH} + akmod-vhba-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod vhba -modinfo /usr/lib/modules/${KERNEL}/extra/vhba/vhba.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/vhba/vhba.ko.xz > /dev/null \ || (find /var/cache/akmods/vhba/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_rok-cdemu.repo diff --git a/build_files/extra/build-kmod-zenergy.sh b/build_files/extra/build-kmod-zenergy.sh index 0dd7d46..5b68a95 100755 --- a/build_files/extra/build-kmod-zenergy.sh +++ b/build_files/extra/build-kmod-zenergy.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" @@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')" cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/ dnf install -y \ - akmod-zenergy-*.fc${RELEASE}.${ARCH} + akmod-zenergy-*.fc"${RELEASE}"."${ARCH}" akmods --force --kernels "${KERNEL}" --kmod zenergy -modinfo /usr/lib/modules/${KERNEL}/extra/zenergy/zenergy.ko.xz > /dev/null \ +modinfo /usr/lib/modules/"${KERNEL}"/extra/zenergy/zenergy.ko.xz > /dev/null \ || (find /var/cache/akmods/zenergy/ -name \*.log -print -exec cat {} \; && exit 1) rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo diff --git a/build_files/nvidia/build-kmod-nvidia.sh b/build_files/nvidia/build-kmod-nvidia.sh index 25970bd..420c50f 100755 --- a/build_files/nvidia/build-kmod-nvidia.sh +++ b/build_files/nvidia/build-kmod-nvidia.sh @@ -1,20 +1,17 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ARCH="$(rpm -E '%_arch')" KERNEL_MODULE_TYPE="${1:-kernel}" +DIST="$(rpm -E '%dist')" +DIST="${DIST#.}" +VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then - DIST="el$(rpm -E '%centos')" - # on CentOS, akmods uses full kernel version and release but no arch - VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}')" # enable negativo17 cp /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-epel-nvidia.repo /etc/yum.repos.d/ else - DIST="fc$(rpm -E '%fedora')" - # on Fedora, akmods uses full kernel version, release and arch - VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" # disable rpmfusion and enable negativo17 sed -i 's/enabled=1/enabled=0/' /etc/yum.repos.d/rpmfusion-*.repo cp /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-fedora-nvidia.repo /etc/yum.repos.d/ @@ -25,7 +22,6 @@ cd /tmp ### BUILD nvidia - dnf install -y \ "akmod-nvidia*.${DIST}.${ARCH}" @@ -38,11 +34,11 @@ sed -i "s/^MODULE_VARIANT=.*/MODULE_VARIANT=$KERNEL_MODULE_TYPE/" /etc/nvidia/ke akmods --force --kernels "${KERNEL_VERSION}" --kmod "nvidia" -modinfo /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz > /dev/null || \ -(cat /var/cache/akmods/nvidia/${NVIDIA_AKMOD_VERSION}-for-${KERNEL_VERSION}.failed.log && exit 1) +modinfo /usr/lib/modules/"${KERNEL_VERSION}"/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz > /dev/null || \ +(cat /var/cache/akmods/nvidia/"${NVIDIA_AKMOD_VERSION}"-for-"${KERNEL_VERSION}".failed.log && exit 1) # View license information -modinfo -l /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz +modinfo -l /usr/lib/modules/"${KERNEL_VERSION}"/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz # create a directory for later copying of resulting nvidia specific artifacts mkdir -p /var/cache/rpms/kmods/nvidia diff --git a/build_files/nvidia/build-ublue-os-nvidia-addons.sh b/build_files/nvidia/build-ublue-os-nvidia-addons.sh index 15ee370..61d8df2 100755 --- a/build_files/nvidia/build-ublue-os-nvidia-addons.sh +++ b/build_files/nvidia/build-ublue-os-nvidia-addons.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail curl -L https://negativo17.org/repos/epel-nvidia.repo \ -o /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-epel-nvidia.repo diff --git a/build_files/nvidia/build-ublue-os-ucore-nvidia.sh b/build_files/nvidia/build-ublue-os-ucore-nvidia.sh index be7687b..76f6662 100755 --- a/build_files/nvidia/build-ublue-os-ucore-nvidia.sh +++ b/build_files/nvidia/build-ublue-os-ucore-nvidia.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ### SETUP nvidia container stuffs diff --git a/build_files/shared/build-post.sh b/build_files/post/build-post.sh similarity index 55% rename from build_files/shared/build-post.sh rename to build_files/post/build-post.sh index bd50e73..f7aa31d 100755 --- a/build_files/shared/build-post.sh +++ b/build_files/post/build-post.sh @@ -1,29 +1,25 @@ -#!/bin/sh +#!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail # Ensure packages get copied to /var/cache/rpms -if [ -d /var/cache/akmods ]; then - for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do - cp "${RPM}" /var/cache/rpms/kmods/ - done -fi - -if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then - for RPM in $(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm); do - cp "${RPM}" /var/cache/rpms/kmods/ - done -fi +pushd /root/rpmbuild/RPMS/"$(uname -m)" +mapfile -t RPMS < <(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm) +for RPM in "${RPMS[@]}"; do + cp "${RPM}" /var/cache/rpms/kmods/ +done +popd # Remove kernel version from kmod package names # FIXME: The sed is a gross hack, maybe PR upstream? sed -i -e 's/args = \["rpmbuild", "-bb"\]/args = \["rpmbuild", "-bb", "--buildroot", "#{build_path}\/BUILD"\]/g' /usr/local/share/gems/gems/fpm-*/lib/fpm/package/rpm.rb kernel_version=$(rpm -q --qf "%{VERSION}-%{RELEASE}.%{ARCH}\n" "${KERNEL_NAME}" | head -n 1) -for rpm in $(find /var/cache/rpms/kmods -type f -name \*.rpm); do - basename=$(basename ${rpm}) - name=${basename%%-${kernel_version}*} +mapfile -t RPMS < <(find /var/cache/rpms/kmods -type f -name \*.rpm) +for rpm in "${RPM[@]}"; do + basename=$(basename "${rpm}") + name=${basename%%-"${kernel_version}"*} if [[ "$basename" == *"$kernel_version"* ]]; then - fpm --verbose -s rpm -t rpm -p ${rpm} -f --name ${name} ${rpm} + fpm --verbose -s rpm -t rpm -p "${rpm}" -f --name "${name}" "${rpm}" else echo "Skipping $basename rebuild as its name does not contain $kernel_version" fi diff --git a/build_files/post/dual-sign.sh b/build_files/post/dual-sign.sh new file mode 100755 index 0000000..84ecf1e --- /dev/null +++ b/build_files/post/dual-sign.sh @@ -0,0 +1,70 @@ +#!/usr/bin/bash + +set "${CI:+-x}" -euo pipefail + +if [[ "${DUAL_SIGN}" != "true" ]]; then + echo "Not Dual Signing..." + exit 0 +fi + +KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" +SIGNING_KEY_1="/tmp/certs/signing_key_1.pem" +SIGNING_KEY_2="/tmp/certs/signing_key_2.pem" +PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem" + +for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do + module_basename=${module:0:-3} + module_suffix=${module: -3} + if [[ "$module_suffix" == ".xz" ]]; then + xz --decompress "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" + xz -C crc32 -f "${module_basename}" + elif [[ "$module_suffix" == ".gz" ]]; then + gzip -d "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" + gzip -9f "${module_basename}" + else + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}" + fi +done +find /var/cache/akmods -type f -name "\kmod-*.rpm" +pushd /var/cache/akmods +mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm") +for RPMPATH in "${RPMPATHS[@]}"; do + RPM=$(basename "${RPMPATH/\.rpm/}") + mkdir -p /tmp/buildroot + cp -r /{usr,lib} /tmp/buildroot + rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "$RPM" + rm -rf /tmp/buildroot +done +popd +rm -rf /usr/lib/modules/"${KERNEL}"/extra + +# on CentOS, akmods/rpmbuild seems to mangle kernel version in the kmod package name +pushd /root/rpmbuild/RPMS/"$(uname -m)"/ +mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm") +for RPMPATH in "${RPMPATHS[@]}"; do + RPM=$(basename "${RPMPATH/\.rpm/}") + if [[ ! "$RPM" =~ ${KERNEL} ]]; then + RENAME=${RPM%"$(rpm -q --queryformat="%{VERSION}" kernel)"*} + RENAME+=$KERNEL + RENAME+=${RPM#*"$(rpm -E %dist)"} + RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm" + mv "$RPMPATH" "$RPM_RENAME" + fi +done +# Reinstall KMODs for initial check that they were signed +mapfile -t kmods < <(ls -1 ./kmod-*.rpm) +dnf reinstall -y --allowerasing "${kmods[@]}" +popd +for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do + if ! modinfo "${module}" >/dev/null; then + exit 1 + fi +done diff --git a/build_files/shared/build-prep.sh b/build_files/prep/build-prep.sh similarity index 63% rename from build_files/shared/build-prep.sh rename to build_files/prep/build-prep.sh index 981b74e..013000a 100755 --- a/build_files/shared/build-prep.sh +++ b/build_files/prep/build-prep.sh @@ -1,20 +1,21 @@ #!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail ### PREPARE REPOS # enable RPMs with alternatives to create them in this image build mkdir -p /var/lib/alternatives -# ARCH="$(rpm -E '%_arch')" +pushd /tmp/kernel_cache +KERNEL_VERSION=$(find "$KERNEL_NAME"-*.rpm | grep "$(uname -m)" | grep -P "$KERNEL_NAME-\d+\.\d+\.\d+-\d+.*$(rpm -E '%{dist}')" | sed -E "s/$KERNEL_NAME-//;s/\.rpm//") +popd + if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then echo "Building for CentOS" RELEASE="$(rpm -E '%centos')" mkdir -p /var/roothome - - dnf remove -y subscription-manager - dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm" + PREP_RPMS+=("https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm") dnf config-manager --set-enabled crb else echo "Building for Fedora" @@ -26,41 +27,42 @@ else if [ -n "${RPMFUSION_MIRROR}" ]; then RPMFUSION_MIRROR_RPMS=${RPMFUSION_MIRROR} fi - dnf install -y \ + PREP_RPMS+=( "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm \ "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm \ fedora-repos-archive + ) - # after F43 launches, bump to 44 - if [[ "${FEDORA_MAJOR_VERSION}" -ge 43 ]]; then - # pre-release rpmfusion is in a different location - sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo - # pre-release rpmfusion needs to enable testing - sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo - fi - - if [ -n "${RPMFUSION_MIRROR}" ]; then - # force use of single rpmfusion mirror - echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}" - sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo - sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo - fi fi # install kernel_cache provided kernel echo "Installing ${KERNEL_FLAVOR} kernel-cache RPMs..." # build image has no kernel so this needs nothing fancy, just install, but not UKIs -dnf install -y `find /tmp/kernel_cache/*.rpm -type f | grep -v uki | xargs` -KERNEL_VERSION=$(rpm -q "${KERNEL_NAME}" | cut -d '-' -f2-) +#shellcheck disable=SC2046 #we want word splitting +dnf install -y --allowerasing "${PREP_RPMS[@]}" $(find /tmp/kernel_cache/*.rpm -type f | grep "$(uname -m)" | grep -v uki | xargs) + +# after F43 launches, bump to 44 +if [[ "${VERSION}" -ge 43 && -f /etc/fedora-release ]]; then + # pre-release rpmfusion is in a different location + sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo + # pre-release rpmfusion needs to enable testing + sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo +fi + +if [[ -n "${RPMFUSION_MIRROR}" && -f /etc/fedora-release ]]; then + # force use of single rpmfusion mirror + echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}" + sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo + sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo +fi ### PREPARE BUILD ENV -dnf install -y \ - akmods \ - mock \ +RPMS_TO_INSTALL+=( + akmods + mock ruby-devel - -gem install fpm +) if [[ ! -s "/tmp/certs/private_key.priv" ]]; then echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds." @@ -72,7 +74,35 @@ install -Dm644 /tmp/certs/public_key.der /etc/pki/akmods/certs/public_key.der install -Dm644 /tmp/certs/private_key.priv /etc/pki/akmods/private/private_key.priv if [[ "${DUAL_SIGN}" == "true" ]]; then - dnf install -y rpmrebuild + RPMS_TO_INSTALL+=(rpmrebuild) +fi + +# This is for ZFS more than CentOS|CoreOS +if [[ "${KERNEL_FLAVOR}" =~ "centos" ]] || [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then + mkdir -p "$(dirname /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509)" + install -Dm644 /tmp/certs/public_key.der /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509 + install -Dm644 /tmp/certs/private_key.priv /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.pem + RPMS_TO_INSTALL+=( + autoconf + automake + dkms + git + jq + libtool + ncompress + python-cffi + ) +fi +if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then + # this seems to be needed on longterm builds but is already present on CoreOS, too + RPMS_TO_INSTALL+=(libatomic) +fi + +# Install RPMs +dnf install -y --allowerasing "${RPMS_TO_INSTALL[@]}" + +# Configure Dual Signing +if [[ "${DUAL_SIGN}" == 'true' ]]; then if [[ ! -s "/tmp/certs/private_key_2.priv" ]]; then echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds." cp /tmp/certs/private_key_2.priv{.test,} @@ -85,25 +115,8 @@ if [[ "${DUAL_SIGN}" == "true" ]]; then cat /tmp/certs/public_key.crt <(echo) /tmp/certs/public_key_2.crt >> /tmp/certs/public_key_chain.pem fi -# This is for ZFS more than CentOS|CoreOS -if [[ "${KERNEL_FLAVOR}" =~ "centos" ]] || [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then - install -Dm644 /tmp/certs/public_key.der /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509 - install -Dm644 /tmp/certs/private_key.priv /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.pem - dnf install -y \ - autoconf \ - automake \ - dkms \ - git \ - jq \ - libtool \ - ncompress \ - python-cffi -fi -if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then - # this seems to be needed on longterm builds but is already present on CoreOS, too - dnf install -y \ - libatomic -fi +# Install FPM +gem install fpm # protect against incorrect permissions in tmp dirs which can break akmods builds chmod 1777 /tmp /var/tmp diff --git a/build_files/shared/dual-sign-check.sh b/build_files/prep/dual-sign-check.sh similarity index 95% rename from build_files/shared/dual-sign-check.sh rename to build_files/prep/dual-sign-check.sh index 109aeb1..47286e8 100755 --- a/build_files/shared/dual-sign-check.sh +++ b/build_files/prep/dual-sign-check.sh @@ -1,5 +1,7 @@ #!/usr/bin/bash +set "${CI:+-x}" -euo pipefail + KERNEL="$1" module="$2" PUBLIC_CERT="$3" diff --git a/build_files/shared/dual-sign.sh b/build_files/shared/dual-sign.sh deleted file mode 100755 index 2921198..0000000 --- a/build_files/shared/dual-sign.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/usr/bin/bash - -set -eoux pipefail - -KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" -SIGNING_KEY_1="/tmp/certs/signing_key_1.pem" -SIGNING_KEY_2="/tmp/certs/signing_key_2.pem" -PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem" - -if [[ "${DUAL_SIGN}" == "true" ]]; then - for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do - module_basename=${module:0:-3} - module_suffix=${module: -3} - if [[ "$module_suffix" == ".xz" ]]; then - xz --decompress "$module" - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" - xz -C crc32 -f "${module_basename}" - elif [[ "$module_suffix" == ".gz" ]]; then - gzip -d "$module" - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" - gzip -9f "${module_basename}" - else - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}" - fi - done - find /var/cache/akmods -type f -name "\kmod-*.rpm" - for RPMPATH in $(find /var/cache/akmods/ -type f -name \kmod-*.rpm); do - RPM=$(basename $(echo "${RPMPATH}" | sed 's/\.rpm//')) - mkdir -p /tmp/buildroot - cp -r /{usr,lib} /tmp/buildroot - rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "$RPM" - rm -rf /tmp/buildroot - done - rm -rf /usr/lib/modules/"${KERNEL}"/extra - - # on CentOS, akmods seems to drop the arch from the kernel version in the kmod package name - KERNEL_NOARCH="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}')" - dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL_NOARCH}"*.rpm - for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do - if ! modinfo "${module}" >/dev/null; then - exit 1 - fi - done -fi diff --git a/build_files/shared/check-signatures.sh b/build_files/test/check-signatures.sh similarity index 93% rename from build_files/shared/check-signatures.sh rename to build_files/test/check-signatures.sh index 9129f7b..10d9495 100755 --- a/build_files/shared/check-signatures.sh +++ b/build_files/test/check-signatures.sh @@ -1,5 +1,8 @@ #!/usr/bin/bash +set "${CI:+-x}" -euo pipefail + +#shellcheck disable=SC1091 source /tmp/info.sh KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" diff --git a/build_files/shared/test-prep.sh b/build_files/test/test-prep.sh similarity index 74% rename from build_files/shared/test-prep.sh rename to build_files/test/test-prep.sh index 196945c..e2e0e63 100755 --- a/build_files/shared/test-prep.sh +++ b/build_files/test/test-prep.sh @@ -1,7 +1,11 @@ #!/usr/bin/bash -#shellcheck disable=SC2086 +#shellcheck disable=SC2206 -set -oeux pipefail +set "${CI:+-x}" -euo pipefail + +pushd /tmp/kernel_cache +KERNEL_VERSION=$(find "$KERNEL_NAME"-*.rpm | grep "$(uname -m)" | grep -P "$KERNEL_NAME-\d+\.\d+\.\d+-\d+.*$(rpm -E '%{dist}')" | sed -E "s/$KERNEL_NAME-//;s/\.rpm//") +popd ### PREPARE REPOS if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then @@ -11,9 +15,7 @@ if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then NVIDIA_EXTRA_PKGS="" mkdir -p /var/roothome - - dnf remove -y subscription-manager - dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm" + RPM_PREP+=("https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm") dnf config-manager --set-enabled crb else echo "Building for Fedora" @@ -28,16 +30,14 @@ fi mkdir -p /var/lib/alternatives if [[ -f $(find /tmp/akmods-rpms/ublue-os/ublue-os-*.rpm 2> /dev/null) ]]; then - dnf install -y /tmp/akmods-rpms/ublue-os/ublue-os-*.rpm + RPM_PREP+=(/tmp/akmods-rpms/ublue-os/ublue-os-*.rpm) fi - # install kernel_cache provided kernel echo "Installing ${KERNEL_FLAVOR} kernel-cache RPMs..." # fedora image has no kernel so this needs nothing fancy, just install -dnf install -y /tmp/kernel_cache/*.rpm - -KERNEL_VERSION=$(rpm -q ${KERNEL_NAME}|cut -d '-' -f2-) +#shellcheck disable=SC2046 # We want word splitting +dnf install -y "${RPM_PREP[@]}" $(find /tmp/kernel_cache/*.rpm -type f | grep "$(uname -m)" | grep -v uki) if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then echo "Building for CentOS does not require more repos" @@ -48,25 +48,11 @@ else if [ -n "${RPMFUSION_MIRROR}" ]; then RPMFUSION_MIRROR_RPMS=${RPMFUSION_MIRROR} fi - dnf install -y \ - "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm \ - "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm \ + RPM_PREP+=( + "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm + "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm fedora-repos-archive - - # after F43 launches, bump to 44 - if [[ "${FEDORA_MAJOR_VERSION}" -ge 43 ]]; then - # pre-release rpmfusion is in a different location - sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo - # pre-release rpmfusion needs to enable testing - sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo - fi - - if [ -n "${RPMFUSION_MIRROR}" ]; then - # force use of single rpmfusion mirror - echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}" - sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo - sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo - fi + ) # after F43 launches, bump to 44 if [[ "${RELEASE}" -ge 43 ]]; then @@ -88,6 +74,21 @@ else "https://negativo17.org/repos/fedora-multimedia.repo" fi +# after F43 launches, bump to 44 +if [[ "${RELEASE}" -ge 43 && -f /etc/fedora-release ]]; then + # pre-release rpmfusion is in a different location + sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo + # pre-release rpmfusion needs to enable testing + sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo +fi + +if [[ -n "${RPMFUSION_MIRROR}" && -f /etc/fedora-release ]]; then + # force use of single rpmfusion mirror + echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}" + sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo + sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo +fi + if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-vhba-*.rpm) ]]; then curl -LsSf -o /etc/yum.repos.d/_copr_rok-cdemu.repo \ "https://copr.fedorainfracloud.org/coprs/rok/cdemu/repo/fedora-${COPR_RELEASE}/rok-cdemu-fedora-${COPR_RELEASE}.repo" @@ -122,7 +123,8 @@ if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-nvidia-*.rpm) ]]; then fi dnf install -y \ - openssl + openssl \ + "${RPM_PREP[@]}" if [[ ! -s "/tmp/certs/private_key.priv" ]]; then echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds." @@ -148,27 +150,31 @@ rm -f /tmp/certs/private_key_2.priv if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-nvidia-*.rpm 2> /dev/null) ]]; then sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/negativo17-${NVIDIA_REPO_NAME} sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo + #shellcheck disable=SC1091 source /tmp/akmods-rpms/kmods/nvidia-vars - dnf install -y \ - libnvidia-fbc \ - libva-nvidia-driver \ - nvidia-driver \ - nvidia-driver-cuda \ - nvidia-modprobe \ - nvidia-persistenced \ - nvidia-settings \ - nvidia-container-toolkit \ - ${NVIDIA_EXTRA_PKGS} \ + KMODS_TO_INSTALL+=( + libnvidia-fbc + libva-nvidia-driver + nvidia-driver + nvidia-driver-cuda + nvidia-modprobe + nvidia-persistenced + nvidia-settings + nvidia-container-toolkit + ${NVIDIA_EXTRA_PKGS} /tmp/akmods-rpms/kmods/kmod-nvidia-"${KERNEL_VERSION}"-"${NVIDIA_AKMOD_VERSION}"."${DIST_ARCH}".rpm + ) # Codacy complains about the lack of quotes on ${NVIDIA_EXTRA_PKGS}, but we don't want quotes here - # we want word splitting behavior, thus 'shellcheck disable=SC2086' added to the top of this file + # we want word splitting behavior, thus '#shellcheck disable=SC2206' added to the top of this file elif [[ -f $(find /tmp/akmods-rpms/kmods/zfs/kmod-*.rpm 2> /dev/null) ]]; then - dnf install -y \ - pv \ + KMODS_TO_INSTALL+=( + pv /tmp/akmods-rpms/kmods/zfs/*.rpm + ) else - dnf install -y \ - /tmp/akmods-rpms/kmods/*.rpm + KMODS_TO_INSTALL+=(/tmp/akmods-rpms/kmods/*.rpm) fi +dnf install -y "${KMODS_TO_INSTALL[@]}" + printf "KERNEL_NAME=%s" "$KERNEL_NAME" >> /tmp/info.sh diff --git a/build_files/zfs/build-kmod-zfs.sh b/build_files/zfs/build-kmod-zfs.sh index 0855ee0..5b53d9e 100755 --- a/build_files/zfs/build-kmod-zfs.sh +++ b/build_files/zfs/build-kmod-zfs.sh @@ -1,15 +1,8 @@ #!/usr/bin/bash -set -oeux pipefail +set "${CI:+-x}" -euo pipefail - -ARCH="$(rpm -E '%_arch')" -KERNEL="$(rpm -q ${KERNEL_NAME} --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" -if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then - RELEASE="$(rpm -E '%centos')" -else - RELEASE="$(rpm -E '%fedora')" -fi +KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" # allow pinning to a specific release series (eg, 2.0.x or 2.1.x) ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-}" @@ -38,49 +31,42 @@ gpg --yes --keyserver keyserver.ubuntu.com --recv C77B9667 gpg --yes --keyserver keyserver.ubuntu.com --recv C6AF658B echo "Verifying tar.gz signature" -gpg --verify "zfs-${ZFS_VERSION}.tar.gz.asc" "zfs-${ZFS_VERSION}.tar.gz" -if [ $? -ne 0 ]; then +if ! gpg --verify "zfs-${ZFS_VERSION}.tar.gz.asc" "zfs-${ZFS_VERSION}.tar.gz"; then echo "ZFS tarball signature verification FAILED! Exiting..." exit 1 fi echo "Verifying checksum signature" -gpg --verify "zfs-${ZFS_VERSION}.sha256.asc" -if [ $? -ne 0 ]; then +if ! gpg --verify "zfs-${ZFS_VERSION}.sha256.asc"; then echo "Checksum signature verification FAILED! Exiting..." exit 1 fi echo "Verifying encrypted checksum" -gpg --decrypt "zfs-${ZFS_VERSION}.sha256.asc" | sha256sum -c -if [ $? -ne 0 ]; then +if ! gpg --decrypt "zfs-${ZFS_VERSION}.sha256.asc" | sha256sum -c; then echo "Checksum verification FAILED! Exiting..." exit 1 fi # no-same-owner/no-same-permissions required for F40 based images building on podman 3.4.4 (ubuntu 22.04) -tar -z -x --no-same-owner --no-same-permissions -f zfs-${ZFS_VERSION}.tar.gz +tar -z -x --no-same-owner --no-same-permissions -f "zfs-${ZFS_VERSION}.tar.gz" -# patch the zfs-kmod.spec.in file for older zfs versions -ZFS_MAJ=$(echo $ZFS_VERSION | cut -f1 -d.) -ZFS_MIN=$(echo $ZFS_VERSION | cut -f2 -d.) -ZFS_PATCH=$(echo $ZFS_VERSION | cut -f3 -d.) - -cd /tmp/zfs-${ZFS_VERSION} +cd "/tmp/zfs-${ZFS_VERSION}" # ensure rpm spec depends on correct kernel-devel package, else build fails on kernel-longterm kernels sed -i "s|kernel-devel|${KERNEL_NAME}-devel|" rpm/*/*spec.in -./configure \ - -with-linux=/usr/src/kernels/${KERNEL}/ \ - -with-linux-obj=/usr/src/kernels/${KERNEL}/ \ - && make -j $(nproc) rpm-utils rpm-kmod \ - || (cat config.log && exit 1) +if ! ./configure \ + -with-linux="/usr/src/kernels/${KERNEL}/" \ + -with-linux-obj="/usr/src/kernels/${KERNEL}/" \ + || ! make -j "$(nproc)" rpm-utils rpm-kmod; then + cat config.log && exit 1 +fi # create a directory for later copying of resulting zfs specific artifacts -mkdir -p /var/cache/rpms/kmods/zfs/{debug,devel,other,src} \ - && mv *src.rpm /var/cache/rpms/kmods/zfs/src/ \ - && mv *devel*.rpm /var/cache/rpms/kmods/zfs/devel/ \ - && mv *debug*.rpm /var/cache/rpms/kmods/zfs/debug/ \ - && mv zfs-dracut*.rpm /var/cache/rpms/kmods/zfs/other/ \ - && mv zfs-test*.rpm /var/cache/rpms/kmods/zfs/other/ \ - && mv *.rpm /var/cache/rpms/kmods/zfs/ +mkdir -p /var/cache/rpms/kmods/zfs/{debug,devel,other,src} +mv ./*src.rpm /var/cache/rpms/kmods/zfs/src/ +mv ./*devel*.rpm /var/cache/rpms/kmods/zfs/devel/ +mv ./*debug*.rpm /var/cache/rpms/kmods/zfs/debug/ +mv zfs-dracut*.rpm /var/cache/rpms/kmods/zfs/other/ +mv zfs-test*.rpm /var/cache/rpms/kmods/zfs/other/ +mv ./*.rpm /var/cache/rpms/kmods/zfs/ diff --git a/build_files/zfs/dual-sign-zfs.sh b/build_files/zfs/dual-sign-zfs.sh index fd406ce..3a959d5 100755 --- a/build_files/zfs/dual-sign-zfs.sh +++ b/build_files/zfs/dual-sign-zfs.sh @@ -1,47 +1,66 @@ #!/usr/bin/bash -set -eoux pipefail +set "${CI:+-x}" -euo pipefail + +if [[ "${DUAL_SIGN}" != "true" ]]; then + echo "Not Dual Signing..." + exit 0 +fi KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" SIGNING_KEY_1="/tmp/certs/signing_key_1.pem" SIGNING_KEY_2="/tmp/certs/signing_key_2.pem" PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem" -if [[ "${DUAL_SIGN}" == "true" ]]; then - ln -s / /tmp/buildroot - dnf install -y /var/cache/rpms/kmods/zfs/*.rpm pv - modinfo /usr/lib/modules/"${KERNEL}"/extra/zfs/spl.ko - for module in /usr/lib/modules/"${KERNEL}"/extra/zfs/*.ko*; do - module_basename=${module:0:-3} - module_suffix=${module: -3} - if [[ "$module_suffix" == ".xz" ]]; then - xz --decompress "$module" - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" - xz -C crc32 -f "${module_basename}" - elif [[ "$module_suffix" == ".gz" ]]; then - gzip -d "$module" - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" - gzip -9f "${module_basename}" - else - openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap - /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" - /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}" - fi - done - find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel - RPMPATH=$(find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel) - RPM=$(basename $(echo "${RPMPATH}" | sed 's/\.rpm//')) - rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${RPM}" - rm -rf /usr/lib/modules/"${KERNEL}"/extra - dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL}"-*.rpm - for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do - if ! modinfo "${module}"; then - exit 1 - fi - done - mv -f /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*.rpm /var/cache/rpms/kmods/zfs/ -fi +ln -s / /tmp/buildroot +dnf install -y /var/cache/rpms/kmods/zfs/*.rpm pv +modinfo /usr/lib/modules/"${KERNEL}"/extra/zfs/spl.ko +for module in /usr/lib/modules/"${KERNEL}"/extra/zfs/*.ko*; do + module_basename=${module:0:-3} + module_suffix=${module: -3} + if [[ "$module_suffix" == ".xz" ]]; then + xz --decompress "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" + xz -C crc32 -f "${module_basename}" + elif [[ "$module_suffix" == ".gz" ]]; then + gzip -d "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}" + gzip -9f "${module_basename}" + else + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" + /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}" + fi +done +find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel +RPMPATH=$(find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel) +RPM=$(basename "${RPMPATH/\.rpm/}") +rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${RPM}" +rm -rf /usr/lib/modules/"${KERNEL}"/extra +pushd /root/rpmbuild/RPMS/"$(uname -m)"/ +mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm") +for RPMPATH in "${RPMPATHS[@]}"; do + RPM=$(basename "${RPMPATH/\.rpm/}") + if [[ ! "$RPM" =~ ${KERNEL} ]]; then + RENAME=${RPM%"$(rpm -q --queryformat="%{VERSION}" kernel)"*} + RENAME+=$KERNEL + RENAME+=${RPM#*"$(rpm -E %dist)"} + RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm" + RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm" + mv "$RPMPATH" "$RPM_RENAME" + fi +done +# Reinstall KMODs for initial check that they were signed +mapfile -t kmods < <(ls -1 ./kmod-*.rpm) +dnf reinstall -y --allowerasing "${kmods[@]}" +popd +for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do + if ! modinfo "${module}"; then + exit 1 + fi +done +mv -f /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*.rpm /var/cache/rpms/kmods/zfs/ diff --git a/fetch-kernel.sh b/fetch-kernel.sh index 5986820..e8bdea8 100755 --- a/fetch-kernel.sh +++ b/fetch-kernel.sh @@ -1,12 +1,16 @@ #!/usr/bin/bash -set -eoux pipefail +set "${CI:+-x}" -euo pipefail # ensures we pass a known dir for volume mount of output rpm files -KCWD=${1} +KCWD=/tmp/kernel-cache find "${KCWD}" +#shellcheck disable=SC2153 +kernel_name="${KERNEL_NAME}" +#shellcheck disable=SC2153 kernel_version="${KERNEL_VERSION}" +#shellcheck disable=SC2153 kernel_flavor="${KERNEL_FLAVOR}" build_tag="${KERNEL_BUILD_TAG:-latest}" @@ -16,64 +20,23 @@ dnf install -y --setopt=install_weak_deps=False dnf-plugins-core openssl if [[ "$kernel_flavor" =~ "centos" ]]; then CENTOS_VER=$(rpm -E %centos) dnf config-manager --set-enabled crb - dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm + dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm" fi dnf -y install --setopt=install_weak_deps=False rpmrebuild sbsigntools case "$kernel_flavor" in - "asus") - dnf copr enable -y lukenukem/asus-kernel - ;; - "surface") - if [[ "$(rpm -E %fedora)" -lt 41 ]]; then - dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo - else - dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo - fi - ;; - "coreos-stable") - ;; - "coreos-testing") - ;; - "bazzite") - ;; - "centos") - ;; - "centos-hsk") + "bazzite"|"centos"*|"coreos"*|"main") ;; "longterm"*) - dnf -y copr enable kwizart/kernel-${kernel_flavor} - ;; - "main") + dnf -y copr enable kwizart/kernel-"${kernel_flavor}" ;; *) - echo "unexpected kernel_flavor ${kernel_flavor} for query" + echo "unexpected kernel_flavor ${kernel_flavor} for query" >&2 + exit 1 ;; esac -if [[ "${kernel_flavor}" =~ asus ]]; then - dnf download -y \ - kernel-"${kernel_version}" \ - kernel-modules-"${kernel_version}" \ - kernel-modules-core-"${kernel_version}" \ - kernel-modules-extra-"${kernel_version}" \ - kernel-devel-"${kernel_version}" \ - kernel-devel-matched-"${kernel_version}" \ - kernel-uki-virt-"${kernel_version}" - -elif [[ "${kernel_flavor}" == "surface" ]]; then - dnf download -y \ - kernel-surface-"${kernel_version}" \ - kernel-surface-modules-"${kernel_version}" \ - kernel-surface-modules-core-"${kernel_version}" \ - kernel-surface-modules-extra-"${kernel_version}" \ - kernel-surface-devel-"${kernel_version}" \ - kernel-surface-devel-matched-"${kernel_version}" \ - kernel-surface-default-watchdog-"${kernel_version}" \ - iptsd \ - libwacom-surface \ - libwacom-surface-data -elif [[ "${kernel_flavor}" == "bazzite" ]]; then +if [[ "${kernel_flavor}" == "bazzite" ]]; then # Using curl for bazzite release curl -#fLO https://github.com/bazzite-org/kernel-bazzite/releases/download/"$build_tag"/kernel-"$kernel_version".rpm curl -#fLO https://github.com/bazzite-org/kernel-bazzite/releases/download/"$build_tag"/kernel-core-"$kernel_version".rpm @@ -120,6 +83,7 @@ else # Using curl instead of dnf download for https links curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-"$kernel_version".rpm + curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-core-"$kernel_version".rpm curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-"$kernel_version".rpm curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-core-"$kernel_version".rpm curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-extra-"$kernel_version".rpm @@ -134,6 +98,8 @@ if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then cp "${KCWD}"/certs/public_key.der{.test,} fi +trap 'rm -rf "${KCWD}/certs" /etc/pki/kernel/private/private_key*.priv /etc/pki/kernel/public/public_key*.crt' EXIT SIGINT + PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt" PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv" @@ -143,49 +109,12 @@ install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH" install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH" ls -la / -if [[ "${kernel_flavor}" =~ asus ]]; then - dnf install -y \ - /kernel-"$kernel_version".rpm \ - /kernel-modules-"$kernel_version".rpm \ - /kernel-modules-core-"$kernel_version".rpm \ - /kernel-modules-extra-"$kernel_version".rpm \ - kernel-core-"${kernel_version}" -elif [[ "${kernel_flavor}" =~ surface ]]; then - dnf install -y \ - /kernel-surface-"$kernel_version".rpm \ - /kernel-surface-modules-"$kernel_version".rpm \ - /kernel-surface-modules-core-"$kernel_version".rpm \ - /kernel-surface-modules-extra-"$kernel_version".rpm \ - kernel-surface-core-"${kernel_version}" -elif [[ "${kernel_flavor}" == "bazzite" ]]; then - dnf install -y \ - /kernel-"$kernel_version".rpm \ - /kernel-core-"$kernel_version".rpm \ - /kernel-modules-"$kernel_version".rpm \ - /kernel-modules-core-"$kernel_version".rpm \ - /kernel-modules-extra-"$kernel_version".rpm -elif [[ "${kernel_flavor}" =~ "centos" ]]; then - dnf install -y \ - /kernel-"$kernel_version".rpm \ - /kernel-core-"$kernel_version".rpm \ - /kernel-modules-"$kernel_version".rpm \ - /kernel-modules-core-"$kernel_version".rpm \ - /kernel-modules-extra-"$kernel_version".rpm -elif [[ "${kernel_flavor}" =~ "longterm" ]]; then - dnf install -y \ - /kernel-longterm-"$kernel_version".rpm \ - /kernel-longterm-core-"$kernel_version".rpm \ - /kernel-longterm-modules-"$kernel_version".rpm \ - /kernel-longterm-modules-core-"$kernel_version".rpm \ - /kernel-longterm-modules-extra-"$kernel_version".rpm -else - dnf install -y \ - /kernel-"$kernel_version".rpm \ - /kernel-modules-"$kernel_version".rpm \ - /kernel-modules-core-"$kernel_version".rpm \ - /kernel-modules-extra-"$kernel_version".rpm \ - https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-core-"$kernel_version".rpm -fi +dnf install -y \ + /"${kernel_name}-$kernel_version.rpm" \ + /"${kernel_name}-core-$kernel_version.rpm" \ + /"${kernel_name}-modules-$kernel_version.rpm" \ + /"${kernel_name}-modules-core-$kernel_version.rpm" \ + /"${kernel_name}-modules-extra-$kernel_version.rpm" # Strip Signatures from non-fedora Kernels if [[ ${kernel_flavor} =~ main|coreos|centos ]]; then @@ -205,8 +134,11 @@ sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${k # Verify Signatures sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz +if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then + exit 1 +fi -rm -f "$PRIVATE_KEY_PATH" "$PUBLIC_KEY_PATH" +rm -f "$PRIVATE_KEY_PATH" if [[ ${DUAL_SIGN:-} == "true" ]]; then SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt" @@ -222,46 +154,29 @@ if [[ ${DUAL_SIGN:-} == "true" ]]; then install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH" sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz - rm -f "$SECOND_PRIVATE_KEY_PATH" "$SECOND_PUBLIC_KEY_PATH" + if ! sbverify --cert "$SECOND_PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then + exit 1 + fi + rm -f "$SECOND_PRIVATE_KEY_PATH" fi ln -s / /tmp/buildroot # Rebuild RPMs and Verify -if [[ "${kernel_flavor}" =~ surface ]]; then - rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-surface-core-"${kernel_version}" - rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz - dnf reinstall -y \ - /kernel-surface-"$kernel_version".rpm \ - /kernel-surface-modules-"$kernel_version".rpm \ - /kernel-surface-modules-core-"$kernel_version".rpm \ - /kernel-surface-modules-extra-"$kernel_version".rpm \ - /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm -elif [[ "${kernel_flavor}" =~ longterm ]]; then - rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-longterm-core-"${kernel_version}" - rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz - find /tmp - find /root - dnf reinstall -y \ - /kernel-longterm-"$kernel_version".rpm \ - /kernel-longterm-modules-"$kernel_version".rpm \ - /kernel-longterm-modules-core-"$kernel_version".rpm \ - /kernel-longterm-modules-extra-"$kernel_version".rpm \ - /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm -else - rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-core-"${kernel_version}" - rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz - find /tmp - find /root - dnf reinstall -y \ - /kernel-"$kernel_version".rpm \ - /kernel-modules-"$kernel_version".rpm \ - /kernel-modules-core-"$kernel_version".rpm \ - /kernel-modules-extra-"$kernel_version".rpm \ - /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm -fi +rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${kernel_name}-core-${kernel_version}" +rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz +find /tmp +find /root +dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm +# Verify Again sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz +if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then + exit 1 +fi +if [[ "${DUAL_SIGN:-}" == "true" ]] && ! sbverify --cert "${SECOND_PUBLIC_KEY_PATH:-}" /usr/lib/modules/"${kernel_version}"/vmlinuz; then + exit 1 +fi # Make Temp Dir mkdir -p "${KCWD}"/rpms @@ -272,9 +187,5 @@ if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms fi -if [[ "${kernel_flavor}" =~ surface ]]; then - cp iptsd-*.rpm libwacom-*.rpm "${KCWD}"/rpms -fi - # Delete keys in /tmp if we decide to publish this later rm -rf "${KCWD}"/certs diff --git a/images.yaml b/images.yaml new file mode 100644 index 0000000..0d0d940 --- /dev/null +++ b/images.yaml @@ -0,0 +1,103 @@ +--- +defaults: + kernel_flavor: main + version: 42 + akmods_target: common + +akmods-base: &akmods-base + org: ublue-os + registry: ghcr.io + repo: akmods + transport: docker:// + +akmods-common: &akmods-common + name: akmods + description: "A caching layer for pre-built akmod RPMs" + +akmods-extra: &akmods-extra + name: akmods-extra + description: "A caching layer for extra pre-built akmod RPMs" + +akmods-nvidia: &akmods-nvidia + name: akmods-nvidia + description: "A caching layer for the pre-built nvidia akmod RPMs" + +akmods-nvidia-open: &akmods-nvidia-open + name: akmods-nvidia-open + description: "A caching layer for the pre-built nvidia-open akmod RPMs" + +akmods-zfs: &akmods-zfs + name: akmods-zfs + description: "A caching layer for the pre-built zfs akmod RPMs" + +desktop-build-group: &desktop-build-group + common: + !!merge <<: + - *akmods-base + - *akmods-common + nvidia: + !!merge <<: + - *akmods-base + - *akmods-nvidia + nvidia-open: + !!merge <<: + - *akmods-base + - *akmods-nvidia + +server-build-group: &server-build-group + nvidia: + !!merge <<: + - *akmods-base + - *akmods-nvidia + nvidia-open: + !!merge <<: + - *akmods-base + - *akmods-nvidia + zfs: + !!merge <<: + - *akmods-base + - *akmods-zfs + +images: + 10: + centos: + !!merge <<: + - *server-build-group + centos-hsk: + !!merge <<: + - *server-build-group + 41: + main: + !!merge <<: + - *desktop-build-group + coreos-stable: + !!merge <<: + - *desktop-build-group + - *server-build-group + coreos-testing: + !!merge <<: + - *desktop-build-group + - *server-build-group + 42: + bazzite: + !!merge <<: + - *desktop-build-group + extra: + !!merge <<: + - *akmods-base + - *akmods-extra + main: + !!merge <<: + - *desktop-build-group + coreos-stable: + !!merge <<: + - *desktop-build-group + - *server-build-group + coreos-testing: + !!merge <<: + - *desktop-build-group + - *server-build-group + "longterm-6.12": + !!merge <<: + - *desktop-build-group + - *server-build-group diff --git a/workflow-templates/cache_kernel.yaml.in b/workflow-templates/cache_kernel.yaml.in new file mode 100644 index 0000000..0864cb4 --- /dev/null +++ b/workflow-templates/cache_kernel.yaml.in @@ -0,0 +1,11 @@ + cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%: + name: Cache %%KERNEL_FLAVOR%% (%%VERSION%%) + uses: ./.github/workflows/reusable-cache-kernel.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + with: + kernel_flavor: %%KERNEL_FLAVOR%% + version: %%VERSION%% diff --git a/workflow-templates/job.yaml.in b/workflow-templates/job.yaml.in new file mode 100644 index 0000000..41109c4 --- /dev/null +++ b/workflow-templates/job.yaml.in @@ -0,0 +1,14 @@ + build-%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%_%%AKMODS_TARGET%%: + name: Build %%AKMODS_TARGET%% %%KERNEL_FLAVOR%% (%%VERSION%%) + uses: ./.github/workflows/reusable-build.yml + secrets: inherit + permissions: + actions: read + contents: read + packages: write + needs: cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%% + with: + version: %%VERSION%% + kernel_flavor: %%KERNEL_FLAVOR%% + akmods_target: %%AKMODS_TARGET%% + kernel_cache_key: ${{ needs.cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%.outputs.KCKEY }} diff --git a/workflow-templates/workflow.yaml.in b/workflow-templates/workflow.yaml.in new file mode 100644 index 0000000..cb8cdbb --- /dev/null +++ b/workflow-templates/workflow.yaml.in @@ -0,0 +1,11 @@ +name: Build AKMODs +on: + merge_group: + pull_request: + branches: + - main + paths-ignore: + - '**.md' + schedule: + - cron: '05 0 * * *' # 0005 UTC everyday + workflow_dispatch: