From: Emanuele Giuseppe Esposito on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2917
We want to enable kernel.spec to optionally ship UKI addons defined in a
common config file in redhat folder.
The folder redhat/uki_addons will contain all addons configs specifying the
UKI kernel cmdline addons to be created in the next build. An addon
config is simply a .addon plain text file, where any line
is taken as kernel cmdline, except for the ones starting with '#',
which will be automatically ignored.
redhat/scripts/uki_addons.py will take care of parsing all configs and
folders in redhat/uki_addons and call 'ukify' to create the actual addons.
The output addon filename will be a concatenation of all folders in
redhat/uki_addons that are part of the addon config path.
The folder hierarchy inside of redhat/uki_addons is similar to
redhat/configs: $distro/$UKI_NAME/%arch.
It is also possible to add .sbat to all the generated addons, by
populating redhat/addons/$distro/$UKI_NAME/%arch/sbat/sbat.conf.
Syntax is same as the addons config.
At build time, Makefile will create a tar.gz archive (uki_addons.tar.gz)
containing all the files in redhat/uki_addons. It will then passed to the
kernel specfile that will extract the addons from it and generate the
UKI kernel cmdline addons.
As an example of this feature, add the fips addon to optionally enable fips
(https://issues.redhat.com/browse/RHEL-23049).
---
redhat/scripts/uki_addons.py | 162 +++++++++++++++++++++++++++++++
redhat/uki_addons/virt/common/fips.addon | 1 +
redhat/Makefile | 3 +
redhat/kernel.spec.template | 44 ++++++++
4 files changed, 210 insertions(+), 0 deletions(-)
From: Jan Stancek <jstancek(a)redhat.com>
redhat/kernel.spec.template: avoid process substitution
Wang Yugui reports that the process substitution construct doesn't work
in old environments (e.g. rhel7 + devtoolsets-8):
/var/tmp/rpm-tmp.mVZU4h: line 696: syntax error near unexpected token `<'
while read -r kmod; do
local target_file="$RPM_BUILD_ROOT/lib/modules/$KernelVer/$subdir_name/$kmod"
local target_dir="${target_file%/*}"
mkdir -p "$target_dir"
mv "$RPM_BUILD_ROOT/lib/modules/$KernelVer/kernel/$kmod" "$target_dir"
L696: done < <(sed -e 's|^kernel/||' "$module_list")
set -x
Simplify it using a temp file.
Fixes: ad0b8a853077 ("spec: rework filter-mods and mod-denylist")
Reported-by: Wang Yugui <wangyugui(a)e16-tech.com>
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2581,16 +2581,19 @@ BuildKernel() {
{
local module_list="$1"
local subdir_name="$2"
+ local tmpfile=$(mktemp)
mkdir -p "$RPM_BUILD_ROOT/lib/modules/$KernelVer/$subdirname"
+ sed -e 's|^kernel/||' "$module_list" > $tmpfile
set +x
while read -r kmod; do
local target_file="$RPM_BUILD_ROOT/lib/modules/$KernelVer/$subdir_name/$kmod"
local target_dir="${target_file%/*}"
mkdir -p "$target_dir"
mv "$RPM_BUILD_ROOT/lib/modules/$KernelVer/kernel/$kmod" "$target_dir"
- done < <(sed -e 's|^kernel/||' "$module_list")
+ done < $tmpfile
+ rm -f $tmpfile
set -x
}
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3087
From: Jan Stancek on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3068
NOTE: Truncated patchset since committer email 'joe.lawrence(a)redhat.com'
does not match the submitter's GitLab public email address
'jstancek(a)redhat.com'.
Update Red Hat building and packaging to support livepatching kernel selftests
moving from lib/ to tools/testing/selftests/.
Signed-off-by: Joe Lawrence joe.lawrence(a)redhat.com
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
---
redhat/configs/fedora/generic/CONFIG_TEST_LIVEPATCH | 1 -
redhat/configs/rhel/generic/arm/aarch64/CONFIG_TEST_LIVEPATCH | 1 -
redhat/configs/rhel/generic/CONFIG_TEST_LIVEPATCH | 1 -
redhat/kernel.spec.template | 17 ++++++++++-
4 files changed, 16 insertions(+), 4 deletions(-)
From: Ming Lei on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3071
We plan to support both two in cs10.
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
redhat/configs/fedora/generic/CONFIG_BLKDEV_UBLK_LEGACY_OPCODES => redhat/configs/common/generic/CONFIG_BLKDEV_UBLK_LEGACY_OPCODES | 0
redhat/configs/fedora/generic/CONFIG_BLK_DEV_UBLK => redhat/configs/common/generic/CONFIG_BLK_DEV_UBLK | 0
redhat/configs/fedora/generic/CONFIG_BLK_SED_OPAL => redhat/configs/common/generic/CONFIG_BLK_SED_OPAL | 0
redhat/configs/rhel/generic/CONFIG_BLK_DEV_UBLK | 1 -
redhat/configs/rhel/generic/CONFIG_BLK_SED_OPAL | 1 -
5 files changed, 0 insertions(+), 2 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 116956887
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:koji-116956887
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Jan Stancek on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2849
Forward port secure boot signing changes from c9s to ARK.
eln scratch: https://koji.fedoraproject.org/koji/taskinfo?taskID=115784066
rawhide scratch: https://koji.fedoraproject.org/koji/taskinfo?taskID=115787119
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
---
redhat/keys/redhatsecureboot003.cer | Bin
redhat/keys/redhatsecureboot301.cer | Bin
redhat/keys/redhatsecureboot401.cer | Bin
redhat/keys/redhatsecurebootca1.cer | Bin
redhat/keys/redhatsecurebootca2.cer | Bin
redhat/keys/redhatsecurebootca4.cer | Bin
redhat/keys/secureboot_ppc.cer | Bin
redhat/keys/secureboot_s390.cer | Bin
redhat/Makefile | 7 +-
redhat/kernel.spec.template | 110 +++++++++++++++--------------------
10 files changed, 49 insertions(+), 68 deletions(-)