mirror of
https://github.com/ublue-os/akmods.git
synced 2026-11-03 23:09:54 -09:00
9d0f6b0af6
* fix: remove bazzite and all of its modules * fix: remove extra image by merging it into common * fix: update codeowners * fix: remove spurious cat * fix: remove fedora 41 * fix: only build previous extra modules for x86 * fix: remove extra modules from common * chore: update readme by removing removed modules * fix: remove kvmfr completely
196 lines
8.2 KiB
Bash
Executable file
196 lines
8.2 KiB
Bash
Executable file
#!/usr/bin/bash
|
|
|
|
set "${CI:+-x}" -euo pipefail
|
|
|
|
# ensures we pass a known dir for volume mount of output rpm files
|
|
KCWD=/tmp/kernel-cache
|
|
find "${KCWD}"
|
|
|
|
#shellcheck disable=SC2153
|
|
kernel_name="${KERNEL_NAME}"
|
|
#shellcheck disable=SC2153
|
|
kernel_version="${KERNEL_VERSION}"
|
|
#shellcheck disable=SC2153
|
|
kernel_flavor="${KERNEL_FLAVOR}"
|
|
build_tag="${KERNEL_BUILD_TAG:-latest}"
|
|
|
|
ARCH=$(uname -m)
|
|
|
|
dnf install -y --setopt=install_weak_deps=False dnf-plugins-core openssl
|
|
if [[ "$kernel_flavor" =~ "centos" ]]; then
|
|
CENTOS_VER=$(rpm -E %centos)
|
|
dnf config-manager --set-enabled crb
|
|
dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm"
|
|
fi
|
|
dnf -y install --setopt=install_weak_deps=False dracut rpmrebuild sbsigntools
|
|
|
|
case "$kernel_flavor" in
|
|
"centos"|"coreos"*|"main")
|
|
;;
|
|
"centos-kmodsig")
|
|
dnf -y install centos-release-kmods-kernel
|
|
;;
|
|
"longterm"*)
|
|
dnf -y copr enable kwizart/kernel-"${kernel_flavor}"
|
|
;;
|
|
*)
|
|
echo "unexpected kernel_flavor ${kernel_flavor} for query" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if [[ "${kernel_flavor}" == "centos" ]]; then
|
|
# Using curl instead of dnf download for https links
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-core-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-core-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-extra-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-uki-virt-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/AppStream/"$ARCH"/os/Packages/kernel-devel-"$kernel_version".rpm
|
|
curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/AppStream/"$ARCH"/os/Packages/kernel-devel-matched-"$kernel_version".rpm
|
|
elif [[ "${kernel_flavor}" == "centos-kmodsig" ]]; then
|
|
KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
|
|
KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | rev | cut -d . -f 2- | rev)"
|
|
# https://cbs.centos.org/kojifiles/packages/kernel/6.15.10/1.el10/x86_64/kernel-6.15.10-1.el10.x86_64.rpm
|
|
BASE_URL="https://cbs.centos.org/kojifiles/packages/kernel/${KERNEL_MAJOR_MINOR_PATCH}/${KERNEL_RELEASE}/${ARCH}"
|
|
for pkg in \
|
|
kernel \
|
|
kernel-core \
|
|
kernel-devel \
|
|
kernel-devel-matched \
|
|
kernel-modules \
|
|
kernel-headers; do
|
|
curl -#fLO "${BASE_URL}/${pkg}-${kernel_version}.rpm"
|
|
done
|
|
elif [[ "${kernel_flavor}" =~ "longterm" ]]; then
|
|
dnf download -y --enablerepo="copr:copr.fedorainfracloud.org:kwizart:kernel-${kernel_flavor}" \
|
|
kernel-longterm-"${kernel_version}" \
|
|
kernel-longterm-core-"${kernel_version}" \
|
|
kernel-longterm-modules-"${kernel_version}" \
|
|
kernel-longterm-modules-core-"${kernel_version}" \
|
|
kernel-longterm-modules-extra-"${kernel_version}" \
|
|
kernel-longterm-devel-"${kernel_version}" \
|
|
kernel-longterm-devel-matched-"${kernel_version}"
|
|
else
|
|
KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
|
|
KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | rev | cut -d . -f 2- | rev)"
|
|
BASE_URL="https://kojipkgs.fedoraproject.org//packages/kernel/${KERNEL_MAJOR_MINOR_PATCH}/${KERNEL_RELEASE}/${ARCH}"
|
|
# Using curl instead of dnf download for https links
|
|
for pkg in \
|
|
kernel \
|
|
kernel-core \
|
|
kernel-modules \
|
|
kernel-modules-core \
|
|
kernel-modules-extra \
|
|
kernel-devel \
|
|
kernel-devel-matched \
|
|
kernel-uki-virt; do
|
|
curl -#fLO "${BASE_URL}/${pkg}-${kernel_version}.rpm"
|
|
done
|
|
fi
|
|
|
|
if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then
|
|
echo "WARNING: Using test signing key."
|
|
cp "${KCWD}"/certs/private_key.priv{.test,}
|
|
cp "${KCWD}"/certs/public_key.der{.test,}
|
|
fi
|
|
|
|
trap 'rm -rf "${KCWD}/certs" /etc/pki/kernel/private/private_key*.priv /etc/pki/kernel/public/public_key*.crt' EXIT SIGINT
|
|
|
|
PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt"
|
|
PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv"
|
|
|
|
openssl x509 -in "${KCWD}"/certs/public_key.der -out "${KCWD}"/certs/public_key.crt
|
|
|
|
install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH"
|
|
install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH"
|
|
|
|
ls -la /
|
|
if [[ "${kernel_flavor}" == "centos-kmodsig" ]]; then
|
|
dnf install -y \
|
|
/"${kernel_name}-$kernel_version.rpm" \
|
|
/"${kernel_name}-core-$kernel_version.rpm" \
|
|
/"${kernel_name}-modules-$kernel_version.rpm"
|
|
else
|
|
dnf install -y \
|
|
/"${kernel_name}-$kernel_version.rpm" \
|
|
/"${kernel_name}-core-$kernel_version.rpm" \
|
|
/"${kernel_name}-modules-$kernel_version.rpm" \
|
|
/"${kernel_name}-modules-core-$kernel_version.rpm" \
|
|
/"${kernel_name}-modules-extra-$kernel_version.rpm"
|
|
fi
|
|
|
|
# Strip Signatures from non-fedora Kernels
|
|
if [[ ${kernel_flavor} =~ main|coreos|centos ]]; then
|
|
echo "Will not strip Fedora/CentOS signature(s) from ${kernel_flavor} kernel."
|
|
else
|
|
EXISTING_SIGNATURES="$(sbverify --list /usr/lib/modules/"$kernel_version"/vmlinuz | grep '^signature \([0-9]\+\)$' | sed 's/^signature \([0-9]\+\)$/\1/')" || true
|
|
if [[ -n "$EXISTING_SIGNATURES" ]]; then
|
|
for SIGNUM in $EXISTING_SIGNATURES; do
|
|
echo "Found existing signature at signum $SIGNUM, removing..."
|
|
sbattach --remove /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
done
|
|
fi
|
|
fi
|
|
|
|
# Sign Kernel with Key
|
|
sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
|
|
# Verify Signatures
|
|
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
|
|
exit 1
|
|
fi
|
|
|
|
rm -f "$PRIVATE_KEY_PATH"
|
|
|
|
if [[ ${DUAL_SIGN:-} == "true" ]]; then
|
|
SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt"
|
|
SECOND_PRIVATE_KEY_PATH="/etc/pki/kernel/private/public_key_2.priv"
|
|
if [[ ! -s "${KCWD}"/certs/private_key_2.priv ]]; then
|
|
echo "WARNING: Using test signing key."
|
|
cp "${KCWD}"/certs/private_key_2.priv{.test,}
|
|
cp "${KCWD}"/certs/public_key_2.der{.test,}
|
|
find "${KCWD}"/certs/
|
|
fi
|
|
openssl x509 -in "${KCWD}"/certs/public_key_2.der -out "${KCWD}"/certs/public_key_2.crt
|
|
install -Dm644 "${KCWD}"/certs/public_key_2.crt "$SECOND_PUBLIC_KEY_PATH"
|
|
install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH"
|
|
sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
if ! sbverify --cert "$SECOND_PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
|
|
exit 1
|
|
fi
|
|
rm -f "$SECOND_PRIVATE_KEY_PATH"
|
|
fi
|
|
|
|
ln -s / /tmp/buildroot
|
|
|
|
# Rebuild RPMs and Verify
|
|
rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${kernel_name}-core-${kernel_version}"
|
|
rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
find /tmp
|
|
find /root
|
|
dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
|
|
|
|
# Verify Again
|
|
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
|
|
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
|
|
exit 1
|
|
fi
|
|
if [[ "${DUAL_SIGN:-}" == "true" ]] && ! sbverify --cert "${SECOND_PUBLIC_KEY_PATH:-}" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
|
|
exit 1
|
|
fi
|
|
|
|
# Make Temp Dir
|
|
mkdir -p "${KCWD}"/rpms
|
|
|
|
# Move RPMs over
|
|
mv /kernel-*.rpm "${KCWD}"/rpms
|
|
if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then
|
|
mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms
|
|
fi
|
|
|
|
# Delete keys in /tmp if we decide to publish this later
|
|
rm -rf "${KCWD}"/certs
|