mirror of
https://github.com/ublue-os/akmods.git
synced 2026-11-03 23:09:54 -09:00
chore(ci): combining kernel-cache and akmods (#295)
This commit is contained in:
Benjamin Sherman
GitHub
parent
433eddb031
commit
12f399bec7
13 changed files with 599 additions and 160 deletions
151
.github/actions/get-kernel-version/action.yml
vendored
Normal file
151
.github/actions/get-kernel-version/action.yml
vendored
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
---
|
||||
name: Get Kernel Version
|
||||
inputs:
|
||||
fedora_version:
|
||||
description: "The Fedora release version: 40, 41, etc"
|
||||
required: true
|
||||
type: string
|
||||
kernel_flavor:
|
||||
description: "The Kernel flavor: main, bazzite, coreos-stable, etc"
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
kernel_build_tag:
|
||||
description: "Optional (bazzite specific) tag"
|
||||
value: ${{ steps.kernel.outputs.build_tag }}
|
||||
kernel_major_minor_patch:
|
||||
description: "Simple version eg, 6.12.9"
|
||||
value: ${{ steps.kernel.outputs.major_minor_patch }}
|
||||
kernel_release:
|
||||
description: "Full kernel release eg, 6.12.9-200.fc41.x86_64"
|
||||
value: ${{ steps.kernel.outputs.release }}
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: Get Kernel Version
|
||||
id: kernel
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ ${{ inputs.kernel_flavor }} =~ asus|surface ]]; then
|
||||
build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}"
|
||||
podman pull "$build_image"
|
||||
|
||||
container_name="fq-$(uuidgen)"
|
||||
dnf="podman exec $container_name dnf"
|
||||
|
||||
podman run --entrypoint /bin/bash --name "$container_name" -dt "$build_image"
|
||||
$dnf install -y --setopt=install_weak_deps=False dnf-plugins-core
|
||||
fi
|
||||
|
||||
coreos_kernel () {
|
||||
coreos_version=${1}
|
||||
image_linux=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:${coreos_version} | jq -r '.Labels["ostree.linux"]')
|
||||
# Pin a kernel here, gross workaround TODO: Make this cleaner
|
||||
# if [[ "${{ inputs.kernel_flavor }}" == "coreos-stable" ]]; then
|
||||
# image_linux="6.11.3-300.fc41.x86_64"
|
||||
# fi
|
||||
major_minor_patch=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+')
|
||||
kernel_rel_part=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+\-\K([123][0]{2})')
|
||||
arch=$(echo $image_linux | grep -oP 'fc\d+\.\K.*$')
|
||||
|
||||
kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}"
|
||||
kernel_version="$major_minor_patch-$kernel_rel.$arch"
|
||||
URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
|
||||
echo "Querying koji for ${coreos_version} kernel: $kernel_version"
|
||||
echo "$URL"
|
||||
HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
|
||||
linux=""
|
||||
if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
|
||||
echo "Koji failed to find $coreos_version kernel: $kernel_version"
|
||||
case "$kernel_rel_part" in
|
||||
"300")
|
||||
kernel_rel_part="200"
|
||||
;;
|
||||
"200")
|
||||
kernel_rel_part="100"
|
||||
;;
|
||||
"100")
|
||||
;;
|
||||
*)
|
||||
echo "unexpected kernel_rel_part ${kernel_rel_part}"
|
||||
;;
|
||||
esac
|
||||
kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}"
|
||||
kernel_version="$major_minor_patch-$kernel_rel.$arch"
|
||||
URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
|
||||
echo "Re-querying koji for ${coreos_version} kernel: $kernel_version"
|
||||
echo "$URL"
|
||||
HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
|
||||
if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
|
||||
echo "Koji failed to find $coreos_version kernel: $kernel_version"
|
||||
fi
|
||||
fi
|
||||
if grep -q "200 OK" <<< "${HTTP_RESP}"; then
|
||||
linux=$kernel_version
|
||||
fi
|
||||
}
|
||||
|
||||
case ${{ inputs.kernel_flavor }} in
|
||||
"asus")
|
||||
$dnf copr enable -y lukenukem/asus-kernel
|
||||
linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:lukenukem:asus-kernel --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
|
||||
;;
|
||||
"fsync")
|
||||
$dnf copr enable -y sentry/kernel-fsync
|
||||
linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:sentry:kernel-fsync --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
|
||||
;;
|
||||
"fsync-ba")
|
||||
$dnf copr enable -y sentry/kernel-ba
|
||||
linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:sentry:kernel-ba --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
|
||||
;;
|
||||
"bazzite")
|
||||
latest="$(curl "https://api.github.com/repos/hhd-dev/kernel-bazzite/releases/latest" )"
|
||||
linux=$(echo -E "$latest" | jq -r '.assets[].name' | grep -E 'kernel-.*.rpm' | grep "fc${{ inputs.fedora_version }}.x86_64" | head -1 | sed "s/kernel-//g" | sed "s/.rpm//g" )
|
||||
build_tag=$(echo -E $latest | jq -r '.tag_name')
|
||||
;;
|
||||
"surface")
|
||||
if [[ "${{ inputs.fedora_version }}" < 41 ]]; then
|
||||
$dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo
|
||||
else
|
||||
$dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo
|
||||
fi
|
||||
linux=$($dnf repoquery --repoid linux-surface --whatprovides kernel-surface | sort -V | tail -n1 | sed 's/.*://')
|
||||
|
||||
;;
|
||||
"main")
|
||||
base_image_name="base"
|
||||
if [[ ${{ inputs.fedora_version }} > 40 ]]; then
|
||||
base_image_name+="-atomic"
|
||||
fi
|
||||
linux=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/$base_image_name:${{ inputs.fedora_version }} | jq -r '.Labels["ostree.linux"]' )
|
||||
;;
|
||||
"coreos-stable")
|
||||
coreos_kernel stable
|
||||
;;
|
||||
"coreos-testing")
|
||||
coreos_kernel testing
|
||||
;;
|
||||
*)
|
||||
echo "unexpected kernel_flavor '${{ inputs.kernel_flavor }}' for query"
|
||||
;;
|
||||
esac
|
||||
if [ -z "$linux" ] || [ "null" = "$linux" ]; then
|
||||
echo "inspected image linux version must not be empty or null"
|
||||
exit 1
|
||||
fi
|
||||
major=$(echo "$linux" | cut -d '.' -f 1)
|
||||
minor=$(echo "$linux" | cut -d '.' -f 2)
|
||||
patch=$(echo "$linux" | cut -d '.' -f 3)
|
||||
kernel_major_minor_patch="${major}.${minor}.${patch}"
|
||||
|
||||
# Debug Output
|
||||
echo "kernel_build_tag: ${build_tag}"
|
||||
echo "kernel_flavor: ${{ inputs.kernel_flavor }}"
|
||||
echo "kernel_major_minor_patch: ${kernel_major_minor_patch}"
|
||||
echo "kernel_release: ${linux}"
|
||||
|
||||
# Action Output
|
||||
echo "build_tag=${build_tag}" >> $GITHUB_OUTPUT
|
||||
echo "major_minor_patch=${kernel_major_minor_patch}" >> $GITHUB_OUTPUT
|
||||
echo "release=${linux}" >> $GITHUB_OUTPUT
|
||||
|
||||
19
.github/workflows/build-39.yml
vendored
19
.github/workflows/build-39.yml
vendored
|
|
@ -1,19 +0,0 @@
|
|||
name: ublue akmods 39
|
||||
on:
|
||||
merge_group:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths-ignore:
|
||||
- '**.md'
|
||||
schedule:
|
||||
- cron: '0 2 * * *' # 2am-ish UTC everyday (timed against official fedora container pushes, and after 'config')
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: build
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
fedora_version: 39
|
||||
19
.github/workflows/build-40.yml
vendored
19
.github/workflows/build-40.yml
vendored
|
|
@ -7,13 +7,24 @@ on:
|
|||
paths-ignore:
|
||||
- '**.md'
|
||||
schedule:
|
||||
- cron: '15 0 * * *' # 10 minutes after kernel-cache
|
||||
- cron: '25 0 * * *' # 0025 UTC everyday (20 minutes after 41)
|
||||
workflow_dispatch:
|
||||
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: build
|
||||
kernel-akmods:
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
secrets: inherit
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
fedora_version:
|
||||
- 40
|
||||
kernel_flavor:
|
||||
- surface
|
||||
- main
|
||||
- coreos-stable
|
||||
- coreos-testing
|
||||
with:
|
||||
fedora_version: 40
|
||||
fedora_version: ${{ matrix.fedora_version }}
|
||||
kernel_flavor: ${{ matrix.kernel_flavor }}
|
||||
20
.github/workflows/build-41.yml
vendored
20
.github/workflows/build-41.yml
vendored
|
|
@ -7,13 +7,25 @@ on:
|
|||
paths-ignore:
|
||||
- '**.md'
|
||||
schedule:
|
||||
- cron: '15 0 * * *' # 10 minutes after kernel-cache
|
||||
- cron: '5 0 * * *' # 0005 UTC everyday
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: build
|
||||
kernel-akmods:
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
secrets: inherit
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
fedora_version:
|
||||
- 41
|
||||
kernel_flavor:
|
||||
- asus
|
||||
- bazzite
|
||||
- surface
|
||||
- main
|
||||
- coreos-stable
|
||||
- coreos-testing
|
||||
with:
|
||||
fedora_version: 41
|
||||
fedora_version: ${{ matrix.fedora_version }}
|
||||
kernel_flavor: ${{ matrix.kernel_flavor }}
|
||||
|
|
|
|||
265
.github/workflows/reusable-build.yml
vendored
265
.github/workflows/reusable-build.yml
vendored
|
|
@ -3,7 +3,11 @@ on:
|
|||
workflow_call:
|
||||
inputs:
|
||||
fedora_version:
|
||||
description: "The Fedora release version: 39, 40, etc"
|
||||
description: "The Fedora release version: 40, 41, etc"
|
||||
required: true
|
||||
type: string
|
||||
kernel_flavor:
|
||||
description: "The Kernel flavor: main, bazzite, coreos-stable, etc"
|
||||
required: true
|
||||
type: string
|
||||
env:
|
||||
|
|
@ -11,13 +15,134 @@ env:
|
|||
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}
|
||||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build_ublue:
|
||||
name: akmods
|
||||
cache-kernel:
|
||||
name: Kernel ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}
|
||||
runs-on: ubuntu-24.04
|
||||
env:
|
||||
KCWD: /tmp/kernel-cache
|
||||
KCPATH: kernel_cache
|
||||
outputs:
|
||||
KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }}
|
||||
KCWD: ${{ env.KCWD }}
|
||||
KCPATH: ${{ env.KCPATH }}
|
||||
kernel_build_tag: ${{ steps.kernel-version.outputs.kernel_build_tag }}
|
||||
kernel_major_minor_patch: ${{ steps.kernel-version.outputs.kernel_major_minor_patch }}
|
||||
KERNEL_VERSION: ${{ steps.kernel-version.outputs.kernel_release }}
|
||||
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Get Kernel Version
|
||||
id: kernel-version
|
||||
uses: ./.github/actions/get-kernel-version
|
||||
with:
|
||||
fedora_version: ${{ inputs.fedora_version }}
|
||||
kernel_flavor: ${{ inputs.kernel_flavor }}
|
||||
|
||||
- name: Cache Kernel RPMs
|
||||
id: cache-kernel
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: ${{ env.KCPATH }}
|
||||
key: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }} # job outputs KCKEY
|
||||
|
||||
- name: Retrieve Signing Key
|
||||
if: steps.cache-kernel.outputs.cache-hit != 'true' && github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group'
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p certs
|
||||
if [[ "${{ github.event_name }}" == 'pull_request' ]]; then
|
||||
echo "This should not have run... exiting..."
|
||||
exit 1
|
||||
else
|
||||
echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
|
||||
echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
|
||||
# DEBUG: get character count of key
|
||||
wc -c certs/private_key.priv
|
||||
wc -c certs/private_key_2.priv
|
||||
fi
|
||||
|
||||
- name: Fetch and Sign Kernel Packages
|
||||
if: steps.cache-kernel.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}"
|
||||
podman pull "$build_image"
|
||||
|
||||
mkdir -p ${{ env.KCWD }}
|
||||
cp -a fetch-kernel.sh certs ${{ env.KCWD }}
|
||||
|
||||
echo "${{toJSON(steps.kernel-version.outputs)}}"
|
||||
|
||||
container_name="fq-$(uuidgen)"
|
||||
podman run \
|
||||
--entrypoint /bin/bash \
|
||||
--env FEDORA_VERSION=${{ inputs.fedora_version }} \
|
||||
--env KERNEL_BUILD_TAG=${{ steps.kernel-version.outputs.kernel_build_tag }} \
|
||||
--env KERNEL_VERSION=${{ steps.kernel-version.outputs.kernel_release }} \
|
||||
--env KERNEL_FLAVOR=${{ inputs.kernel_flavor }} \
|
||||
--env DUAL_SIGN=true \
|
||||
--name "$container_name" \
|
||||
-v ${{ env.KCWD }}:${{ env.KCWD }}:rw \
|
||||
-dt "$build_image"
|
||||
|
||||
podman exec "$container_name" bash -x ${{ env.KCWD }}/fetch-kernel.sh ${{ env.KCWD }}
|
||||
|
||||
find ${{ env.KCWD }}
|
||||
|
||||
- name: Check Secureboot Signatures
|
||||
if: steps.cache-kernel.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
set -x
|
||||
if [[ ! $(command -v sbverify) || ! $(command -v curl) || ! $(command -v openssl) || ! $(command -v rpm2cpio) ]]; then
|
||||
sudo apt update
|
||||
sudo apt install sbsigntool curl openssl rpm2cpio
|
||||
fi
|
||||
|
||||
cd ${{ env.KCWD }}/rpms
|
||||
if [[ "${{ inputs.kernel_flavor }}" == "surface" ]]; then
|
||||
rpm2cpio kernel-surface-core-"${{ steps.kernel-version.outputs.kernel_release }}".rpm | cpio -idmv
|
||||
else
|
||||
rpm2cpio kernel-core-"${{ steps.kernel-version.outputs.kernel_release }}".rpm | cpio -idmv
|
||||
fi
|
||||
cd ./lib/modules/"${{ steps.kernel-version.outputs.kernel_release }}"/
|
||||
sbverify --list vmlinuz
|
||||
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
||||
curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der.test
|
||||
curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der.test
|
||||
else
|
||||
curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der
|
||||
curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der
|
||||
fi
|
||||
openssl x509 -in kernel-sign.der -out kernel-sign.crt
|
||||
openssl x509 -in akmods.der -out akmods.crt
|
||||
sbverify --cert kernel-sign.crt vmlinuz || exit 1
|
||||
sbverify --cert akmods.crt vmlinuz || exit 1
|
||||
|
||||
- name: Finalize Cache Files
|
||||
if: steps.cache-kernel.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
# this should be in runner user's home dir
|
||||
mkdir -p ${{ env.KCPATH }}
|
||||
cp -a ${{ env.KCWD }}/rpms/*.rpm ${{ env.KCPATH }}/
|
||||
echo "$(date '+%Y%m%d.0')" > ${{ env.KCPATH }}/kernel-cache-date
|
||||
|
||||
- name: List Cached Kernel RPMs
|
||||
shell: bash
|
||||
run: |
|
||||
find ${{ env.KCPATH }}
|
||||
|
||||
build-akmods:
|
||||
name: Akmods ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}-${{ matrix.cfile_suffix }}
|
||||
runs-on: ubuntu-24.04 # Work Around Tar Bug
|
||||
needs: [cache-kernel]
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
|
@ -25,15 +150,8 @@ jobs:
|
|||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
fedora_version:
|
||||
- ${{ inputs.fedora_version }}
|
||||
kernel_flavor:
|
||||
- main
|
||||
- asus
|
||||
- bazzite
|
||||
- surface
|
||||
- coreos-stable
|
||||
- coreos-testing
|
||||
kernel_flavor: # this must be in matrix for excludes, but reference inputs.kernel_flavor in workflow
|
||||
- ${{ inputs.kernel_flavor }}
|
||||
cfile_suffix:
|
||||
- common
|
||||
- extra
|
||||
|
|
@ -41,22 +159,6 @@ jobs:
|
|||
- nvidia-open
|
||||
- zfs
|
||||
exclude:
|
||||
- fedora_version: 39
|
||||
kernel_flavor: coreos-stable
|
||||
- fedora_version: 40
|
||||
kernel_flavor: coreos-testing
|
||||
- fedora_version: 40
|
||||
kernel_flavor: asus
|
||||
- fedora_version: 40
|
||||
kernel_flavor: bazzite
|
||||
- fedora_version: 39
|
||||
kernel_flavor: fsync
|
||||
- fedora_version: 39
|
||||
kernel_flavor: bazzite
|
||||
- fedora_version: 39
|
||||
kernel_flavor: asus
|
||||
- fedora_version: 39
|
||||
kernel_flavor: coreos-testing
|
||||
- kernel_flavor: main
|
||||
cfile_suffix: zfs
|
||||
- kernel_flavor: asus
|
||||
|
|
@ -65,12 +167,50 @@ jobs:
|
|||
cfile_suffix: zfs
|
||||
- kernel_flavor: surface
|
||||
cfile_suffix: zfs
|
||||
env:
|
||||
KCWD: ${{ needs.cache-kernel.outputs.KCWD }}
|
||||
KCPATH: ${{ needs.cache-kernel.outputs.KCPATH }}
|
||||
kernel_build_tag: ${{ needs.cache-kernel.outputs.kernel_build_tag }}
|
||||
KERNEL_VERSION: ${{ needs.cache-kernel.outputs.KERNEL_VERSION }}
|
||||
|
||||
steps:
|
||||
# Checkout push-to-registry action GitHub repository
|
||||
- name: Checkout Push to Registry action
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Create cache parent dir
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p ${{ env.KCWD }}
|
||||
|
||||
- name: Cache Kernel RPMs
|
||||
id: cache-kernel
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: ${{ env.KCPATH }}
|
||||
key: ${{ needs.cache-kernel.outputs.KCKEY }}
|
||||
|
||||
- name: Fail Absent Kernel Cache
|
||||
if: steps.cache-kernel.outputs.cache-hit != 'true'
|
||||
run: |
|
||||
echo "Kernel Cache not found for key: ${{ needs.cache-kernel.outputs.KCKEY }}"
|
||||
exit 1
|
||||
|
||||
- name: Get Cached Kernel Date/Version
|
||||
shell: bash
|
||||
run: |
|
||||
set -exo pipefail
|
||||
|
||||
find ${{ env.KCPATH }}
|
||||
KCDATE=$(cat ${{ env.KCPATH }}/kernel-cache-date)
|
||||
if [ -z "${KCDATE}" ]; then
|
||||
echo "kernel-cache-date must not be empty"
|
||||
fi
|
||||
if [ -z "${{ env.KERNEL_VERSION }}" ]; then
|
||||
echo "KERNEL_VERSION must not be empty"
|
||||
fi
|
||||
KERNEL_IMAGE_VERSION=${{ env.KERNEL_VERSION }}-${KCDATE}
|
||||
echo "KERNEL_IMAGE_VERSION=$KERNEL_IMAGE_VERSION" >> $GITHUB_ENV
|
||||
|
||||
- name: Matrix Variables
|
||||
shell: bash
|
||||
run: |
|
||||
|
|
@ -81,10 +221,10 @@ jobs:
|
|||
fi
|
||||
export BUILDER_IMAGE=quay.io/fedora/fedora
|
||||
echo "BUILDER_IMAGE=${BUILDER_IMAGE}" >> $GITHUB_ENV
|
||||
echo "FQ_BUILDER_IMAGE=${BUILDER_IMAGE}:${{ matrix.fedora_version }}" >> $GITHUB_ENV
|
||||
export KERNEL_IMAGE=${{ matrix.kernel_flavor }}-kernel
|
||||
echo "KERNEL_IMAGE=${KERNEL_IMAGE}" >> $GITHUB_ENV
|
||||
echo "FQ_KERNEL_IMAGE=${{ env.IMAGE_REGISTRY }}/${KERNEL_IMAGE}:${{ matrix.fedora_version }}" >> $GITHUB_ENV
|
||||
|
||||
- name: Pull build image
|
||||
shell: bash
|
||||
run: podman pull ${{ env.BUILDER_IMAGE }}:${{ inputs.fedora_version }}
|
||||
|
||||
- name: AppArmor Disable
|
||||
run: |
|
||||
|
|
@ -93,50 +233,13 @@ jobs:
|
|||
sudo systemctl stop apparmor
|
||||
systemctl status apparmor || true
|
||||
|
||||
- name: Pull build images
|
||||
uses: Wandalen/wretry.action@v3.8.0
|
||||
with:
|
||||
attempt_limit: 3
|
||||
attempt_delay: 15000
|
||||
command: |
|
||||
# pull the base image used for FROM in containerfile so
|
||||
# we can retry on that unfortunately common failure case
|
||||
podman pull ${{ env.FQ_BUILDER_IMAGE }}
|
||||
podman pull ${{ env.FQ_KERNEL_IMAGE }}
|
||||
|
||||
- name: Get current version
|
||||
shell: bash
|
||||
run: |
|
||||
set -eo pipefail
|
||||
|
||||
#skopeo inspect containers-storage:${{ env.FQ_KERNEL_IMAGE }} > kernel.json
|
||||
# We SHOULD be able to use container-storage to inspect already pulled image here
|
||||
# BUT... ubuntu-24.04 builders prevent with this error:
|
||||
# Error during unshare(...): Operation not permitted
|
||||
# I intend to investigate/fix later, but need to move forward
|
||||
skopeo inspect docker://${{ env.FQ_KERNEL_IMAGE }} > kernel.json
|
||||
|
||||
linux=$(jq -r '.["Labels"]["ostree.linux"]' kernel.json)
|
||||
if [ -z "$linux" ] || [ "null" = "$linux" ]; then
|
||||
echo "inspected linux version must not be empty or null"
|
||||
exit 1
|
||||
fi
|
||||
echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV
|
||||
|
||||
img_version=$(jq -r '.["Labels"]["org.opencontainers.image.version"]' kernel.json)
|
||||
if [ -z "$img_version" ] || [ "null" = "$img_version" ]; then
|
||||
echo "inspected image version must not be empty or null"
|
||||
exit 1
|
||||
fi
|
||||
echo "KERNEL_IMAGE_VERSION=$img_version" >> $GITHUB_ENV
|
||||
|
||||
- name: Generate tags
|
||||
id: generate-tags
|
||||
shell: bash
|
||||
run: |
|
||||
# Generate a timestamp for creating an image version history
|
||||
TIMESTAMP="$(date +%Y%m%d)"
|
||||
VARIANT="${{ matrix.kernel_flavor }}-${{ matrix.fedora_version }}"
|
||||
VARIANT="${{ inputs.kernel_flavor }}-${{ inputs.fedora_version }}"
|
||||
|
||||
COMMIT_TAGS=()
|
||||
BUILD_TAGS=()
|
||||
|
|
@ -211,9 +314,8 @@ jobs:
|
|||
${{ steps.generate-tags.outputs.alias_tags }}
|
||||
build-args: |
|
||||
BUILDER_IMAGE=${{ env.BUILDER_IMAGE }}
|
||||
KERNEL_ORG=${{ github.repository_owner }}
|
||||
KERNEL_FLAVOR=${{ matrix.kernel_flavor }}
|
||||
FEDORA_MAJOR_VERSION=${{ matrix.fedora_version }}
|
||||
KERNEL_FLAVOR=${{ inputs.kernel_flavor }}
|
||||
FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }}
|
||||
RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }}
|
||||
DUAL_SIGN=true
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
|
|
@ -228,9 +330,8 @@ jobs:
|
|||
tags: latest
|
||||
build-args: |
|
||||
BUILDER_IMAGE=${{ env.BUILDER_IMAGE }}
|
||||
KERNEL_ORG=${{ github.repository_owner }}
|
||||
KERNEL_FLAVOR=${{ matrix.kernel_flavor }}
|
||||
FEDORA_MAJOR_VERSION=${{ matrix.fedora_version }}
|
||||
KERNEL_FLAVOR=${{ inputs.kernel_flavor }}
|
||||
FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }}
|
||||
INPUT_AKMODS=${{ env.IMAGE_NAME }}
|
||||
INPUT_TAG=${{ env.default_tag }}
|
||||
DUAL_SIGN=true
|
||||
|
|
@ -300,12 +401,12 @@ jobs:
|
|||
echo "${{ toJSON(steps.push.outputs) }}"
|
||||
|
||||
check:
|
||||
name: Check all ${{ inputs.fedora_version }} builds successful
|
||||
name: Check all ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor}} builds successful
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build_ublue]
|
||||
needs: [build-akmods]
|
||||
steps:
|
||||
- name: Exit on failure
|
||||
if: ${{ needs.build_ublue.result == 'failure' }}
|
||||
if: ${{ needs.build-akmods.result == 'failure' }}
|
||||
shell: bash
|
||||
run: exit 1
|
||||
- name: Exit
|
||||
|
|
|
|||
|
|
@ -3,13 +3,8 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${BUILDER_BASE} AS builder
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
|
|
@ -20,16 +15,15 @@ ARG DUAL_SIGN="true"
|
|||
COPY build_files/common build_files/shared /tmp/
|
||||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
|
||||
# files for akmods
|
||||
ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \
|
||||
/tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo
|
||||
ADD https://negativo17.org/repos/fedora-multimedia.repo \
|
||||
/tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo
|
||||
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
|
||||
--mount=type=cache,dst=/var/cache/dnf \
|
||||
ls -sh /tmp/kernel_cache; \
|
||||
if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \
|
||||
export KERNEL_NAME="kernel" \
|
||||
; else \
|
||||
|
|
@ -56,4 +50,5 @@ RUN --mount=type=cache,dst=/var/cache/dnf \
|
|||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
|
||||
COPY --from=builder /var/cache/rpms /rpms
|
||||
|
|
|
|||
|
|
@ -3,13 +3,8 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${BUILDER_BASE} AS builder
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
|
|
@ -20,16 +15,15 @@ ARG DUAL_SIGN="true"
|
|||
COPY build_files/extra build_files/shared /tmp/
|
||||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
|
||||
# files for akmods
|
||||
ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \
|
||||
/tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo
|
||||
ADD https://negativo17.org/repos/fedora-multimedia.repo \
|
||||
/tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo
|
||||
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
|
||||
--mount=type=cache,dst=/var/cache/dnf \
|
||||
ls -sh /tmp/kernel_cache; \
|
||||
if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \
|
||||
export KERNEL_NAME="kernel" \
|
||||
; else \
|
||||
|
|
@ -61,4 +55,5 @@ RUN --mount=type=cache,dst=/var/cache/dnf \
|
|||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
|
||||
COPY --from=builder /var/cache/rpms /rpms
|
||||
|
|
|
|||
|
|
@ -3,13 +3,8 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${BUILDER_BASE} AS builder
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
|
|
@ -20,9 +15,6 @@ ARG DUAL_SIGN="true"
|
|||
COPY build_files/nvidia build_files/shared /tmp/
|
||||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
|
||||
# files for nvidia
|
||||
COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment
|
||||
COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service
|
||||
|
|
@ -31,7 +23,9 @@ COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os
|
|||
COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
|
||||
COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules
|
||||
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
|
||||
--mount=type=cache,dst=/var/cache/dnf \
|
||||
ls -sh /tmp/kernel_cache; \
|
||||
if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \
|
||||
export KERNEL_NAME="kernel" \
|
||||
; else \
|
||||
|
|
@ -52,4 +46,5 @@ RUN --mount=type=cache,dst=/var/cache/dnf \
|
|||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
|
||||
COPY --from=builder /var/cache/rpms /rpms
|
||||
|
|
|
|||
|
|
@ -3,13 +3,8 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${BUILDER_BASE} AS builder
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
|
|
@ -20,9 +15,6 @@ ARG DUAL_SIGN="true"
|
|||
COPY build_files/nvidia build_files/shared /tmp/
|
||||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
|
||||
# files for nvidia
|
||||
COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment
|
||||
COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service
|
||||
|
|
@ -31,7 +23,9 @@ COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os
|
|||
COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
|
||||
COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules
|
||||
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
|
||||
--mount=type=cache,dst=/var/cache/dnf \
|
||||
ls -sh /tmp/kernel_cache; \
|
||||
if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \
|
||||
export KERNEL_NAME="kernel" \
|
||||
; else \
|
||||
|
|
@ -52,4 +46,5 @@ RUN --mount=type=cache,dst=/var/cache/dnf \
|
|||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
|
||||
COPY --from=builder /var/cache/rpms /rpms
|
||||
|
|
|
|||
|
|
@ -3,16 +3,11 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG INPUT_AKMODS="${INPUT_AKMODS:-akmods}"
|
||||
ARG INPUT_TAG="${INPUT_TAG:-${KERNEL_FLAVOR}-${FEDORA_MAJOR_VERSION}}"
|
||||
ARG INPUT_BASE="${INPUT_AKMODS}:${INPUT_TAG}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${INPUT_BASE} AS akmods_cache
|
||||
FROM ${BUILDER_BASE} AS tester
|
||||
|
||||
|
|
@ -25,7 +20,7 @@ COPY build_files/shared /tmp/
|
|||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
COPY --from=akmods_cache /kernel-rpms /tmp/kernel_cache
|
||||
COPY --from=akmods_cache /rpms /tmp/akmods-rpms
|
||||
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
|
|
|
|||
|
|
@ -3,13 +3,8 @@
|
|||
###
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}"
|
||||
ARG KERNEL_IMAGE="${KERNEL_IMAGE:-${KERNEL_FLAVOR}-kernel}"
|
||||
ARG KERNEL_ORG="${KERNEL_ORG:-ublue-os}"
|
||||
ARG KERNEL_BASE="ghcr.io/${KERNEL_ORG}/${KERNEL_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
|
||||
ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
|
||||
FROM ${KERNEL_BASE} AS kernel_cache
|
||||
FROM ${BUILDER_BASE} AS builder
|
||||
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}"
|
||||
|
|
@ -21,11 +16,10 @@ ARG ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-2.2}"
|
|||
COPY build_files/zfs build_files/shared /tmp/
|
||||
COPY certs /tmp/certs
|
||||
|
||||
# cached kernel rpms
|
||||
COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache
|
||||
|
||||
# Set kernel name
|
||||
RUN --mount=type=cache,dst=/var/cache/dnf \
|
||||
RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
|
||||
--mount=type=cache,dst=/var/cache/dnf \
|
||||
ls -sh /tmp/kernel_cache; \
|
||||
if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \
|
||||
export KERNEL_NAME="kernel" \
|
||||
; else \
|
||||
|
|
@ -38,4 +32,5 @@ RUN --mount=type=cache,dst=/var/cache/dnf \
|
|||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
|
||||
COPY --from=builder /var/cache/rpms /rpms
|
||||
|
|
|
|||
|
|
@ -29,4 +29,8 @@ for rpm in $(find /var/cache/rpms/kmods -type f -name \*.rpm); do
|
|||
fi
|
||||
done
|
||||
|
||||
# ensure kernel cache RPMS are copied
|
||||
mkdir -p /var/cache/kernel-rpms
|
||||
cp -a /tmp/kernel_cache/*.rpm /var/cache/kernel-rpms
|
||||
|
||||
find /var/cache/rpms
|
||||
|
|
|
|||
209
fetch-kernel.sh
Executable file
209
fetch-kernel.sh
Executable file
|
|
@ -0,0 +1,209 @@
|
|||
#!/usr/bin/bash
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
# ensures we pass a known dir for volume mount of output rpm files
|
||||
KCWD=${1}
|
||||
find "${KCWD}"
|
||||
|
||||
kernel_version="${KERNEL_VERSION}"
|
||||
kernel_flavor="${KERNEL_FLAVOR}"
|
||||
build_tag="${KERNEL_BUILD_TAG:-latest}"
|
||||
|
||||
dnf install -y --setopt=install_weak_deps=False dnf-plugins-core rpmrebuild sbsigntools openssl
|
||||
|
||||
case "$kernel_flavor" in
|
||||
"asus")
|
||||
dnf copr enable -y lukenukem/asus-kernel
|
||||
;;
|
||||
"surface")
|
||||
if [[ "$(rpm -E %fedora)" -lt 41 ]]; then
|
||||
dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo
|
||||
else
|
||||
dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo
|
||||
fi
|
||||
;;
|
||||
"coreos-stable")
|
||||
;;
|
||||
"coreos-testing")
|
||||
;;
|
||||
"bazzite")
|
||||
;;
|
||||
"main")
|
||||
;;
|
||||
*)
|
||||
echo "unexpected kernel_flavor ${kernel_flavor} for query"
|
||||
;;
|
||||
esac
|
||||
|
||||
if [[ "${kernel_flavor}" =~ asus ]]; then
|
||||
dnf download -y \
|
||||
kernel-"${kernel_version}" \
|
||||
kernel-modules-"${kernel_version}" \
|
||||
kernel-modules-core-"${kernel_version}" \
|
||||
kernel-modules-extra-"${kernel_version}" \
|
||||
kernel-devel-"${kernel_version}" \
|
||||
kernel-devel-matched-"${kernel_version}" \
|
||||
kernel-uki-virt-"${kernel_version}"
|
||||
|
||||
elif [[ "${kernel_flavor}" == "surface" ]]; then
|
||||
dnf download -y \
|
||||
kernel-surface-"${kernel_version}" \
|
||||
kernel-surface-modules-"${kernel_version}" \
|
||||
kernel-surface-modules-core-"${kernel_version}" \
|
||||
kernel-surface-modules-extra-"${kernel_version}" \
|
||||
kernel-surface-devel-"${kernel_version}" \
|
||||
kernel-surface-devel-matched-"${kernel_version}" \
|
||||
kernel-surface-default-watchdog-"${kernel_version}" \
|
||||
iptsd \
|
||||
libwacom-surface \
|
||||
libwacom-surface-data
|
||||
elif [[ "${kernel_flavor}" == "bazzite" ]]; then
|
||||
# Using curl for bazzite release
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-core-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-modules-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-modules-core-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-modules-extra-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-devel-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-devel-matched-"$kernel_version".rpm
|
||||
curl -#fLO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-uki-virt-"$kernel_version".rpm
|
||||
# curl -LO https://github.com/hhd-dev/kernel-bazzite/releases/download/"$build_tag"/kernel-uki-virt-addons-"$kernel_version".rpm
|
||||
else
|
||||
KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
|
||||
KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | cut -d . -f 1).$(echo "$kernel_version" | cut -d - -f 2 | cut -d . -f 2)"
|
||||
ARCH=$(uname -m)
|
||||
|
||||
# Using curl instead of dnf download for https links
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-core-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-extra-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-devel-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-devel-matched-"$kernel_version".rpm
|
||||
curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-uki-virt-"$kernel_version".rpm
|
||||
fi
|
||||
|
||||
if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then
|
||||
echo "WARNING: Using test signing key."
|
||||
cp "${KCWD}"/certs/private_key.priv{.test,}
|
||||
cp "${KCWD}"/certs/public_key.der{.test,}
|
||||
fi
|
||||
|
||||
PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt"
|
||||
PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv"
|
||||
|
||||
openssl x509 -in "${KCWD}"/certs/public_key.der -out "${KCWD}"/certs/public_key.crt
|
||||
|
||||
install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH"
|
||||
install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH"
|
||||
|
||||
ls -la /
|
||||
if [[ "${kernel_flavor}" =~ asus ]]; then
|
||||
dnf install -y \
|
||||
/kernel-"$kernel_version".rpm \
|
||||
/kernel-modules-"$kernel_version".rpm \
|
||||
/kernel-modules-core-"$kernel_version".rpm \
|
||||
/kernel-modules-extra-"$kernel_version".rpm \
|
||||
kernel-core-"${kernel_version}"
|
||||
elif [[ "${kernel_flavor}" =~ surface ]]; then
|
||||
dnf install -y \
|
||||
/kernel-surface-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-core-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-extra-"$kernel_version".rpm \
|
||||
kernel-surface-core-"${kernel_version}"
|
||||
elif [[ "${kernel_flavor}" == "bazzite" ]]; then
|
||||
dnf install -y \
|
||||
/kernel-"$kernel_version".rpm \
|
||||
/kernel-core-"$kernel_version".rpm \
|
||||
/kernel-modules-"$kernel_version".rpm \
|
||||
/kernel-modules-core-"$kernel_version".rpm \
|
||||
/kernel-modules-extra-"$kernel_version".rpm
|
||||
else
|
||||
dnf install -y \
|
||||
/kernel-"$kernel_version".rpm \
|
||||
/kernel-modules-"$kernel_version".rpm \
|
||||
/kernel-modules-core-"$kernel_version".rpm \
|
||||
/kernel-modules-extra-"$kernel_version".rpm \
|
||||
https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-core-"$kernel_version".rpm
|
||||
fi
|
||||
|
||||
# Strip Signatures from non-fedora Kernels
|
||||
if [[ ${kernel_flavor} =~ main|coreos ]]; then
|
||||
echo "Will not strip Fedora signature(s) from ${kernel_flavor} kernel."
|
||||
else
|
||||
EXISTING_SIGNATURES="$(sbverify --list /usr/lib/modules/"$kernel_version"/vmlinuz | grep '^signature \([0-9]\+\)$' | sed 's/^signature \([0-9]\+\)$/\1/')" || true
|
||||
if [[ -n "$EXISTING_SIGNATURES" ]]; then
|
||||
for SIGNUM in $EXISTING_SIGNATURES; do
|
||||
echo "Found existing signature at signum $SIGNUM, removing..."
|
||||
sbattach --remove /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
# Sign Kernel with Key
|
||||
sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
|
||||
# Verify Signatures
|
||||
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
|
||||
rm -f "$PRIVATE_KEY_PATH" "$PUBLIC_KEY_PATH"
|
||||
|
||||
if [[ ${DUAL_SIGN:-} == "true" ]]; then
|
||||
SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt"
|
||||
SECOND_PRIVATE_KEY_PATH="/etc/pki/kernel/private/public_key_2.priv"
|
||||
if [[ ! -s "${KCWD}"/certs/private_key_2.priv ]]; then
|
||||
echo "WARNING: Using test signing key."
|
||||
cp "${KCWD}"/certs/private_key_2.priv{.test,}
|
||||
cp "${KCWD}"/certs/public_key_2.der{.test,}
|
||||
find "${KCWD}"/certs/
|
||||
fi
|
||||
openssl x509 -in "${KCWD}"/certs/public_key_2.der -out "${KCWD}"/certs/public_key_2.crt
|
||||
install -Dm644 "${KCWD}"/certs/public_key_2.crt "$SECOND_PUBLIC_KEY_PATH"
|
||||
install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH"
|
||||
sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
rm -f "$SECOND_PRIVATE_KEY_PATH" "$SECOND_PUBLIC_KEY_PATH"
|
||||
fi
|
||||
|
||||
ln -s / /tmp/buildroot
|
||||
|
||||
# Rebuild RPMs and Verify
|
||||
if [[ "${kernel_flavor}" =~ surface ]]; then
|
||||
rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-surface-core-"${kernel_version}"
|
||||
rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
dnf reinstall -y \
|
||||
/kernel-surface-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-core-"$kernel_version".rpm \
|
||||
/kernel-surface-modules-extra-"$kernel_version".rpm \
|
||||
/root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
|
||||
else
|
||||
rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-core-"${kernel_version}"
|
||||
rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
find /tmp
|
||||
find /root
|
||||
dnf reinstall -y \
|
||||
/kernel-"$kernel_version".rpm \
|
||||
/kernel-modules-"$kernel_version".rpm \
|
||||
/kernel-modules-core-"$kernel_version".rpm \
|
||||
/kernel-modules-extra-"$kernel_version".rpm \
|
||||
/root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
|
||||
fi
|
||||
|
||||
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
||||
|
||||
# Make Temp Dir
|
||||
mkdir -p "${KCWD}"/rpms
|
||||
|
||||
# Move RPMs over
|
||||
mv /kernel-*.rpm "${KCWD}"/rpms
|
||||
mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms
|
||||
|
||||
if [[ "${kernel_flavor}" =~ surface ]]; then
|
||||
cp iptsd-*.rpm libwacom-*.rpm "${KCWD}"/rpms
|
||||
fi
|
||||
|
||||
# Delete keys in /tmp if we decide to publish this later
|
||||
rm -rf "${KCWD}"/certs
|
||||
Loading…
Reference in a new issue