mirror of
https://github.com/ublue-os/akmods.git
synced 2026-11-03 14:59:42 -09:00
7bb06e0528
* feat: add CentOS/EPEL nvidia support * fix changelog * gotta copy the repo before it can be a source * need conditional logic in build-kmod-nvidia * use el dist tag (not fc) for CentOS builds * don't use wildcard * more variable cleanups for EPEL in nvidia * fixes for those release vars * careful with the dots * trying to match all these variables * fix an error in handing basename operation with DIST_RELEASE * fix for fedora * getting closer i think * so many small mistakes * seriously * ... * yeah * fix extra token * try simpler kernel string, temp disable a few builds * maybe * try to build test image on centos * only test i686 nvidia pkgs on fedora * limit extra pkgs tested in epel9 temp disable non centos builds * trying to fix epel9, no gui stuff for nivida * trying to fix epel9, no gui stuff for nivida, but fix typo * disable centos/epel9 builds, re-enable f41,f42,bazzite centos epel9 builds are failing on nvidia due to an issue with negativo17 nvidia repo for epel9 we don't have an active use of centos 9 now, so it's not important we have that building to move forward. * readd extra pkgs for centos/fedora nvidia test * fix: codacy concerns * don't always follow Codacy * disable codacy in this file * correct typo in comment * fix odd phrasing in comment
50 lines
2.7 KiB
Bash
Executable file
50 lines
2.7 KiB
Bash
Executable file
#!/usr/bin/bash
|
|
|
|
set -eoux pipefail
|
|
|
|
KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
|
|
SIGNING_KEY_1="/tmp/certs/signing_key_1.pem"
|
|
SIGNING_KEY_2="/tmp/certs/signing_key_2.pem"
|
|
PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem"
|
|
|
|
if [[ "${DUAL_SIGN}" == "true" ]]; then
|
|
for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
|
|
module_basename=${module:0:-3}
|
|
module_suffix=${module: -3}
|
|
if [[ "$module_suffix" == ".xz" ]]; then
|
|
xz --decompress "$module"
|
|
openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
|
|
/usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
|
|
/tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
|
|
xz -C crc32 -f "${module_basename}"
|
|
elif [[ "$module_suffix" == ".gz" ]]; then
|
|
gzip -d "$module"
|
|
openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
|
|
/usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
|
|
/tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
|
|
gzip -9f "${module_basename}"
|
|
else
|
|
openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap
|
|
/usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}"
|
|
/tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}"
|
|
fi
|
|
done
|
|
find /var/cache/akmods -type f -name "\kmod-*.rpm"
|
|
for RPMPATH in $(find /var/cache/akmods/ -type f -name \kmod-*.rpm); do
|
|
RPM=$(basename $(echo "${RPMPATH}" | sed 's/\.rpm//'))
|
|
mkdir -p /tmp/buildroot
|
|
cp -r /{usr,lib} /tmp/buildroot
|
|
rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "$RPM"
|
|
rm -rf /tmp/buildroot
|
|
done
|
|
rm -rf /usr/lib/modules/"${KERNEL}"/extra
|
|
|
|
# on CentOS, akmods seems to drop the arch from the kernel version in the kmod package name
|
|
KERNEL_NOARCH="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}')"
|
|
dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL_NOARCH}"*.rpm
|
|
for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
|
|
if ! modinfo "${module}" >/dev/null; then
|
|
exit 1
|
|
fi
|
|
done
|
|
fi
|