Merge pull request #1262 from c-po/kernel-build-improvements

Kernel: T9181: modernize packaging and remove redundant work

16 files changed, 508 insertions, 475 deletions

diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
index aa1f8d12..6e62d879 100755
--- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
+++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
@@ -18,10 +18,16 @@ if [ ! -f ${KERNEL_VAR_FILE} ]; then
     exit 1
 fi
 
-# Build VPP as we need VPP libraries
-cd ../vpp/
-./build.py
-cd ${CWD}
+# Build VPP as we need VPP libraries. This is a full VPP build (make pkg-deb),
+# not just headers, since that's the only build target VPP exposes here - skip
+# it if a previous run already produced the libraries we link against. Remove
+# ${VPP_LIB_CHECK_PATH} (or the whole ../vpp/vpp checkout) to force a rebuild,
+# e.g. after bumping the VPP commit_id in ../vpp/package.toml.
+if [ ! -d ${VPP_LIB_CHECK_PATH} ]; then
+    cd ../vpp/
+    ./build.py
+    cd ${CWD}
+fi
 
 if [ ! -d ${VPP_LIB_CHECK_PATH} ]; then
     echo "VPP source libraries not found"
@@ -70,5 +76,7 @@ cpack -G DEB
 # rename resulting Debian package according git description
 mv accel-ppp*.deb ${CWD}/accel-ppp-ng_$(git describe --always --tags)_$(dpkg --print-architecture).deb
 
-# move VPP binaries to linux-kernel dir, CI will get VPP .deb here
-cp ${CWD}/../vpp/*.deb ${CWD}
+# move VPP binaries to linux-kernel dir, CI will get VPP .deb here.
+# If the VPP build was skipped above (libraries already present from a
+# prior run), there may be no fresh .deb here to copy - that's fine.
+cp ${CWD}/../vpp/*.deb ${CWD} 2>/dev/null || echo "I: No freshly built VPP .deb to copy"
diff --git a/scripts/package-build/linux-kernel/build-intel-nic.sh b/scripts/package-build/linux-kernel/build-intel-nic.sh
index bde7558a..540694a3 100755
--- a/scripts/package-build/linux-kernel/build-intel-nic.sh
+++ b/scripts/package-build/linux-kernel/build-intel-nic.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
-if ! dpkg-architecture -iamd64; then
-    echo "Intel drivers only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Intel drivers"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
@@ -26,14 +25,6 @@ if [ -d .git ]; then
     git reset --hard origin/main
 fi
 
-DRIVER_VERSION=$(git describe | sed s/^v//)
-
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}_${DEBIAN_ARCH}"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-intel-${DRIVER_NAME}.postinst"
-
 # See https://vyos.dev/T6155
 # See https://vyos.dev/T6162
 PATCH_DIR=${CWD}/patches/${DRIVER_NAME}
@@ -45,37 +36,52 @@ if [ -d $PATCH_DIR ]; then
     done
 fi
 
-echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver"
-make KSRC=${KERNEL_DIR} BUILD_KERNEL=${KERNEL_VERSION}${KERNEL_SUFFIX} INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} -j $(getconf _NPROCESSORS_ONLN) -C src install
+PACKAGE_NAME=vyos-intel-${DRIVER_NAME}
+PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)")
 
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
 
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Vendor based driver for Intel ${DRIVER_NAME}
+ Out-of-tree Intel ${DRIVER_NAME} network driver kernel module.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
 
-# build Debian package
-echo "I: Building Debian package vyos-intel-${DRIVER_NAME}"
-cd ${CWD}
+%:
+	dh \$@
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
 
-# delete non required files which are also present in the kernel package
-# und thus lead to duplicated files
-find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
 
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
+override_dh_auto_build:
+	@true
 
-fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \
-    --version ${DRIVER_VERSION} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Vendor based driver for Intel ${DRIVER_NAME}" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST}
+override_dh_auto_install:
+	make KSRC=\${KERNEL_DIR} BUILD_KERNEL=\${KVER} INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} -j \$(shell getconf _NPROCESSORS_ONLN) -C src install
+	find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
 
-# cleanup
-rm -rf -- "${DEBIAN_DIR}" "${DEBIAN_POSTINST}"
+debuild
diff --git a/scripts/package-build/linux-kernel/build-intel-qat.sh b/scripts/package-build/linux-kernel/build-intel-qat.sh
index ba4dcefb..8eb2c964 100755
--- a/scripts/package-build/linux-kernel/build-intel-qat.sh
+++ b/scripts/package-build/linux-kernel/build-intel-qat.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
-if ! dpkg-architecture -iamd64; then
-    echo "Intel-QAT is only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Intel-QAT"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
@@ -25,12 +24,6 @@ DRIVER_NAME_EXTRA="L."
 DRIVER_VERSION=$(echo ${DRIVER_DIR} | awk -F${DRIVER_NAME} '{print $2}' | awk -F${DRIVER_NAME_EXTRA} '{print $2}')
 DRIVER_VERSION_EXTRA="-0"
 
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}_${DEBIAN_ARCH}"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-intel-qat.postinst"
-
 # Fetch Intel driver source from SourceForge
 if [ -e ${DRIVER_FILE} ]; then
     rm -f ${DRIVER_FILE}
@@ -62,53 +55,70 @@ if [ -d "${CWD}/patches/intel-qat" ]; then
     done
 fi
 
-echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver"
-mkdir -p \
-    ${DEBIAN_DIR}/lib/firmware \
-    ${DEBIAN_DIR}/usr/sbin \
-    ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu \
-    ${DEBIAN_DIR}/etc/init.d
-KERNEL_SOURCE_ROOT=${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf
-make -j $(getconf _NPROCESSORS_ONLN) all
-make INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} \
-    qat-driver-install adf-ctl-all
-
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
-
-cp quickassist/qat/fw/*.bin ${DEBIAN_DIR}/lib/firmware
-cp build/*.so ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu
-cp build/adf_ctl ${DEBIAN_DIR}/usr/sbin
-cp quickassist/build_system/build_files/qat_service ${DEBIAN_DIR}/etc/init.d
-cp build/usdm_drv.ko ${DEBIAN_DIR}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/updates/drivers
-chmod 644 ${DEBIAN_DIR}/lib/firmware/*
-chmod 755 ${DEBIAN_DIR}/etc/init.d/* ${DEBIAN_DIR}/usr/local/bin/*
-
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
-
-# build Debian package
-echo "I: Building Debian package vyos-intel-${DRIVER_NAME}"
-cd ${CWD}
-
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
-
-# delete non required files which are also present in the kernel package
-# und thus lead to duplicated files
-find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f
-
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
-
-fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \
-    --version ${DRIVER_VERSION}${DRIVER_VERSION_EXTRA} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Vendor based driver for Intel ${DRIVER_NAME}" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST}
+PACKAGE_NAME=vyos-intel-$(echo ${DRIVER_NAME} | tr 'A-Z' 'a-z')
+PACKAGE_VERSION=$(debian_version "${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}")
+
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Vendor based driver for Intel ${DRIVER_NAME}
+ Intel QuickAssist Technology (QAT) kernel driver and userspace tools.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	@true
+
+override_dh_auto_configure:
+	@true
+
+override_dh_auto_build:
+	KERNEL_SOURCE_ROOT=\${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf
+	\$(MAKE) -j \$(shell getconf _NPROCESSORS_ONLN) all
+
+override_dh_auto_install:
+	mkdir -p \${PACKAGE_BUILD_DIR}/lib/firmware \${PACKAGE_BUILD_DIR}/usr/sbin \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu \${PACKAGE_BUILD_DIR}/etc/init.d
+	\$(MAKE) INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} qat-driver-install adf-ctl-all
+	cp quickassist/qat/fw/*.bin \${PACKAGE_BUILD_DIR}/lib/firmware
+	cp build/*.so \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu
+	cp build/adf_ctl \${PACKAGE_BUILD_DIR}/usr/sbin
+	cp quickassist/build_system/build_files/qat_service \${PACKAGE_BUILD_DIR}/etc/init.d
+	cp build/usdm_drv.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/updates/drivers
+	chmod 644 \${PACKAGE_BUILD_DIR}/lib/firmware/*
+	chmod 755 \${PACKAGE_BUILD_DIR}/etc/init.d/*
+	find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
 
 echo "I: Cleanup ${DRIVER_NAME} source"
 cd ${CWD}
@@ -118,9 +128,3 @@ fi
 if [ -d ${DRIVER_DIR} ]; then
     rm -rf ${DRIVER_DIR}
 fi
-if [ -d ${DEBIAN_DIR} ]; then
-    rm -rf ${DEBIAN_DIR}
-fi
-if [ -f ${DEBIAN_POSTINST} ]; then
-    rm -f ${DEBIAN_POSTINST}
-fi
diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
index 2c7554fa..a94e34f7 100755
--- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh
+++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 IPT_NETFLOW_SRC=${CWD}/ipt-netflow
 if [ ! -d ${IPT_NETFLOW_SRC} ]; then
@@ -29,49 +31,62 @@ done
 
 . ${KERNEL_VAR_FILE}
 
-DRIVER_VERSION=$(git describe | sed s/^v//)
-
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="tmp/"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst"
-
-./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR}
-make all
-
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
-
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
-
-if [ ! -d ${DEBIAN_DIR} ]; then
-    mkdir -p ${DEBIAN_DIR}
-fi
-
-# build Debian package
-echo "I: Building Debian package vyos-ipt-netflow"
-cp ipt_NETFLOW.ko ${DEBIAN_DIR}
-cp libipt_NETFLOW.so ${DEBIAN_DIR}
-cp libip6t_NETFLOW.so ${DEBIAN_DIR}
-
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
-
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
-
-cd ${CWD}
-
-fpm --input-type dir --output-type deb --name vyos-ipt-netflow \
-    --version ${DRIVER_VERSION} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "ipt_NETFLOW module" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \
-    ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \
-    libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \
-    libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so
+PACKAGE_NAME=vyos-ipt-netflow
+PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)")
+UNAME_ARCH=$(uname -m)
+
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: ipt_NETFLOW module
+ Netfilter target module exporting network flows via NetFlow to a
+ collector, plus xtables NETFLOW match libraries.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	@true
+
+override_dh_auto_configure:
+	@true
+
+override_dh_auto_build:
+	./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=\${KERNEL_DIR}
+	make all
+
+override_dh_auto_install:
+	install -D -m 644 ipt_NETFLOW.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/ipt_NETFLOW.ko
+	install -D -m 644 libipt_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libipt_NETFLOW.so
+	install -D -m 644 libip6t_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libip6t_NETFLOW.so
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
diff --git a/scripts/package-build/linux-kernel/build-jool.py b/scripts/package-build/linux-kernel/build-jool.py
deleted file mode 100755
index bfdcf93a..00000000
--- a/scripts/package-build/linux-kernel/build-jool.py
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env python3
-
-from tomllib import loads as toml_loads
-from requests import get
-from pathlib import Path
-from subprocess import run
-
-def find_arch() -> str:
-    tmp=run(['dpkg-architecture', '-q', 'DEB_HOST_ARCH'], capture_output=True)
-    return tmp.stdout.decode().strip()
-
-# dependency modifier
-def add_depends(package_dir: str, package_name: str,
-                depends: list[str]) -> None:
-    """Add dependencies to a package
-
-    Args:
-        package_dir (str): a directory where package sources are located
-        package_name (str): a name of package
-        depends (list[str]): a list of dependencies to add
-    """
-    depends_list: str = ', '.join(depends)
-    depends_line: str = f'misc:Depends={depends_list}\n'
-
-    substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars')
-    substvars_file.write_text(depends_line)
-
-
-# find kernel version and source path
-arch: str = find_arch()
-defaults_file: str = Path('../../../data/defaults.toml').read_text()
-KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version')
-KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor')
-KERNEL_SRC: str = Path.cwd().as_posix() + '/linux'
-
-# define variables
-PACKAGE_NAME: str = 'jool'
-PACKAGE_VERSION: str = '4.1.15'
-PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}'
-SOURCES_ARCHIVE: str = f'{PACKAGE_DIR}.tar.gz'
-SOURCES_URL: str = f'https://github.com/NICMx/Jool/archive/refs/tags/v{PACKAGE_VERSION}.tar.gz'
-
-# download sources
-sources_archive = Path(SOURCES_ARCHIVE)
-sources_archive.write_bytes(get(SOURCES_URL).content)
-
-# prepare sources
-debmake_cmd: list[str] = [
-    'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p',
-    PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE
-]
-run(debmake_cmd)
-
-# add kernel to dependencies
-add_depends(PACKAGE_DIR, PACKAGE_NAME,
-            [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}'])
-
-# configure build rules
-build_rules_text: str = f'''#!/usr/bin/make -f
-# config
-export KERNEL_DIR := {KERNEL_SRC}
-PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME}
-KVER := {KERNEL_VER}-{KERNEL_FLAVOR}
-MODULES_DIR := extra
-
-# main packaging script based on dh7 syntax
-%:
-	dh $@
-
-override_dh_clean:
-	dh_clean --exclude=debian/{PACKAGE_NAME}.substvars
-
-override_dh_prep:
-	dh_prep --exclude=debian/{PACKAGE_NAME}.substvars
-
-# override_dh_auto_clean:
-# 	make -C src/mod clean
-
-override_dh_auto_build:
-	dh_auto_build $@
-	make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/common modules
-	make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/nat64 modules
-	make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/siit modules
-
-override_dh_auto_install:
-	dh_auto_install $@
-	install -D -m 644 src/mod/common/jool_common.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool_common.ko
-	install -D -m 644 src/mod/nat64/jool.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool.ko
-	install -D -m 644 src/mod/siit/jool_siit.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool_siit.ko
-	${{KERNEL_DIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib
-'''
-bild_rules = Path(f'{PACKAGE_DIR}/debian/rules')
-bild_rules.write_text(build_rules_text)
-
-# build a package
-debuild_cmd: list[str] = ['debuild']
-run(debuild_cmd, cwd=PACKAGE_DIR)
diff --git a/scripts/package-build/linux-kernel/build-jool.sh b/scripts/package-build/linux-kernel/build-jool.sh
new file mode 100755
index 00000000..731ce11f
--- /dev/null
+++ b/scripts/package-build/linux-kernel/build-jool.sh
@@ -0,0 +1,61 @@
+#!/bin/sh
+set -e
+CWD=$(pwd)
+KERNEL_VAR_FILE=${CWD}/kernel-vars
+
+if [ ! -f ${KERNEL_VAR_FILE} ]; then
+    echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first"
+    exit 1
+fi
+
+. ${KERNEL_VAR_FILE}
+
+PACKAGE_NAME=jool
+PACKAGE_VERSION=4.1.15
+PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION}
+SOURCES_ARCHIVE=${PACKAGE_DIR}.tar.gz
+SOURCES_URL=https://github.com/NICMx/Jool/archive/refs/tags/v${PACKAGE_VERSION}.tar.gz
+
+if [ -e ${SOURCES_ARCHIVE} ]; then
+    rm -f ${SOURCES_ARCHIVE}
+fi
+curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL}
+
+debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE}
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > ${PACKAGE_DIR}/debian/rules
+#!/usr/bin/make -f
+# config
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+MODULES_DIR := extra
+
+# main packaging script based on dh7 syntax
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_build:
+	dh_auto_build \$@
+	make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/common modules
+	make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/nat64 modules
+	make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/siit modules
+
+override_dh_auto_install:
+	dh_auto_install \$@
+	install -D -m 644 src/mod/common/jool_common.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool_common.ko
+	install -D -m 644 src/mod/nat64/jool.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool.ko
+	install -D -m 644 src/mod/siit/jool_siit.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool_siit.ko
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+cd ${PACKAGE_DIR}
+debuild
diff --git a/scripts/package-build/linux-kernel/build-kernel.sh b/scripts/package-build/linux-kernel/build-kernel.sh
index a4a4fc3c..dea71aa9 100755
--- a/scripts/package-build/linux-kernel/build-kernel.sh
+++ b/scripts/package-build/linux-kernel/build-kernel.sh
@@ -22,8 +22,13 @@ if [ -d /usr/lib/ccache/ ]; then
     export PATH=/usr/lib/ccache:$PATH
 fi
 
+if [ -z "${KERNEL_FLAVOR}" ]; then
+    echo "E: KERNEL_FLAVOR is not set, run via ./build.py so it can be passed from data/defaults.toml"
+    exit 1
+fi
+
 KERNEL_VERSION=$(make kernelversion)
-KERNEL_SUFFIX=-$(awk -F "= " '/kernel_flavor/ {print $2}' ../../../../data/defaults.toml | tr -d \")
+KERNEL_SUFFIX=-${KERNEL_FLAVOR}
 
 echo "I: Generate Kernel config"
 ARCH=$(dpkg --print-architecture)
diff --git a/scripts/package-build/linux-kernel/build-linux-firmware.sh b/scripts/package-build/linux-kernel/build-linux-firmware.sh
index e018bce8..d542327d 100755
--- a/scripts/package-build/linux-kernel/build-linux-firmware.sh
+++ b/scripts/package-build/linux-kernel/build-linux-firmware.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e
 
 # All selected drivers are then precomfiled "make drivers/foo/bar.i" and we grep for
 # the magic word "UNIQUE_ID_firmware" which identifies firmware files.
@@ -6,6 +7,7 @@
 CWD=$(pwd)
 LINUX_FIRMWARE="linux-firmware"
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 . ${KERNEL_VAR_FILE}
 
@@ -87,10 +89,49 @@ done
 
 echo "I: Create linux-firmware package"
 rm -f ${VYOS_FIRMWARE_NAME}_*.deb
-fpm --input-type dir --output-type deb --name ${VYOS_FIRMWARE_NAME} \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Binary firmware for various drivers in the Linux kernel" \
-    --architecture all --version ${GIT_COMMIT} --deb-compression gz -C ${VYOS_FIRMWARE_DIR}
+
+PACKAGE_VERSION=$(debian_version "${GIT_COMMIT}")
+
+cd ${VYOS_FIRMWARE_DIR}
+
+debmake -n -y -p ${VYOS_FIRMWARE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+cat << EOF > debian/control
+Source: ${VYOS_FIRMWARE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${VYOS_FIRMWARE_NAME}
+Architecture: all
+Depends: \${misc:Depends}
+Description: Binary firmware for various drivers in the Linux kernel
+ Firmware blobs assembled from linux-firmware.git for the drivers built
+ into the VyOS kernel.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+PACKAGE_BUILD_DIR := debian/${VYOS_FIRMWARE_NAME}
+
+%:
+	dh \$@
+
+override_dh_auto_build:
+	@true
+
+override_dh_auto_install:
+	mkdir -p \${PACKAGE_BUILD_DIR}
+	cp -a lib \${PACKAGE_BUILD_DIR}/
+EOF
+
+debuild
+
+cd ${CWD}
 
 rm -rf "${LINUX_FIRMWARE_BUILD_DIR}"
 rm -rf ${VYOS_FIRMWARE_DIR}
diff --git a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
index a810d765..76c1bd03 100755
--- a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
+++ b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
@@ -3,16 +3,14 @@ DROP_DEV_DBG_DEBS=1
 DEB_DISTRO='debian12.1'
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 if [ $(id -u) -ne 0 ]; then
   echo "Mellanox OFED script needs to be run as root"
   exit
 fi
 
-if ! dpkg-architecture -iamd64; then
-    echo "Mellanox OFED is only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Mellanox OFED"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
diff --git a/scripts/package-build/linux-kernel/build-nat-rtsp.sh b/scripts/package-build/linux-kernel/build-nat-rtsp.sh
index 33f1311d..ea3352b2 100755
--- a/scripts/package-build/linux-kernel/build-nat-rtsp.sh
+++ b/scripts/package-build/linux-kernel/build-nat-rtsp.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 SRC=${CWD}/nat-rtsp
 if [ ! -d ${SRC} ]; then
@@ -18,31 +20,53 @@ fi
 cd ${SRC}
 git reset --hard HEAD
 git clean --force -d -x
-make KERNELDIR=$KERNEL_DIR
 
-# Copy binary to package directory
-DEBIAN_DIR=tmp/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra
-mkdir -p ${DEBIAN_DIR}
-cp nf_conntrack_rtsp.ko nf_nat_rtsp.ko ${DEBIAN_DIR}
+PACKAGE_NAME=nat-rtsp
+PACKAGE_VERSION=$(debian_version "$(git describe --tags --always)")
 
-DEBIAN_POSTINST="${CWD}/vyos-nat-rtsp.postinst"
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
 
-# Build Debian Package
-fpm --input-type dir --output-type deb --name nat-rtsp \
-    --version $(git describe --tags --always) --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Connection tracking and NAT support for RTSP" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --after-install ${DEBIAN_POSTINST} \
-    --license "GPL2" --chdir tmp
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
 
-mv *.deb ..
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Connection tracking and NAT support for RTSP
+ Netfilter conntrack and NAT helper kernel modules for the RTSP protocol.
+EOF
 
-if [ -f ${DEBIAN_POSTINST} ]; then
-    rm -f ${DEBIAN_POSTINST}
-fi
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_build:
+	make KERNELDIR=\${KERNEL_DIR}
+
+override_dh_auto_install:
+	install -D -m 644 nf_conntrack_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_conntrack_rtsp.ko
+	install -D -m 644 nf_nat_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_nat_rtsp.ko
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
diff --git a/scripts/package-build/linux-kernel/build-realtek-r8126.py b/scripts/package-build/linux-kernel/build-realtek-r8126.py
deleted file mode 100755
index 31bad0ce..00000000
--- a/scripts/package-build/linux-kernel/build-realtek-r8126.py
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/usr/bin/env python3
-
-import os
-from tomllib import loads as toml_loads
-from requests import get
-from pathlib import Path
-from subprocess import run
-
-CWD = os.getcwd()
-
-# dependency modifier
-def add_depends(package_dir: str, package_name: str,
-                depends: list[str]) -> None:
-    """Add dependencies to a package
-    Args:
-        package_dir (str): a directory where package sources are located
-        package_name (str): a name of package
-        depends (list[str]): a list of dependencies to add
-    """
-    depends_list: str = ', '.join(depends)
-    depends_line: str = f'misc:Depends={depends_list}\n'
-
-    substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars')
-    substvars_file.write_text(depends_line)
-
-
-# find kernel version and source path
-defaults_file: str = Path('../../../data/defaults.toml').read_text()
-KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version')
-KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor')
-KERNEL_SRC: str = Path.cwd().as_posix() + '/linux'
-# define variables
-PACKAGE_NAME: str = 'vyos-drivers-realtek-r8126'
-PACKAGE_VERSION: str = '10.016.00'
-PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}'
-SOURCES_ARCHIVE: str = f'r8126-{PACKAGE_VERSION}.tar.bz2'
-SOURCES_URL: str = f'https://packages.vyos.net/source-mirror/{SOURCES_ARCHIVE}'
-
-# download sources
-sources_archive = Path(SOURCES_ARCHIVE)
-sources_archive.write_bytes(get(SOURCES_URL).content)
-
-# prepare sources
-debmake_cmd: list[str] = [
-    'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p',
-    PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE
-]
-run(debmake_cmd)
-
-# add kernel to dependencies
-add_depends(PACKAGE_DIR, PACKAGE_NAME,
-            [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}'])
-
-# configure build rules
-build_rules_text: str = '''#!/usr/bin/make -f
-# config
-export KERNELDIR := {KERNEL_SRC}
-PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME}
-KVER := {KERNEL_VER}-{KERNEL_FLAVOR}
-MODULES_DIR := updates/drivers/net/ethernet
-# main packaging script based on dh7 syntax
-%:
-\tdh $@
-
-override_dh_clean:
-\tdh_clean --exclude=debian/{PACKAGE_NAME}.substvars
-
-override_dh_prep:
-\tdh_prep --exclude=debian/{PACKAGE_NAME}.substvars
-
-override_dh_auto_clean:
-\tmake clean
-
-override_dh_auto_build:
-\techo "KERNELDIR=${{KERNELDIR}}"
-\techo "CURDIR=${{CURDIR}}"
-\tmake -C ${{KERNELDIR}} M=${{CURDIR}}/src modules
-
-override_dh_auto_install:
-\tinstall -D -m 644 src/r8126.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/r8126.ko
-\t${{KERNELDIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib
-'''.format(KERNEL_SRC=KERNEL_SRC, PACKAGE_NAME=PACKAGE_NAME, KERNEL_VER=KERNEL_VER, KERNEL_FLAVOR=KERNEL_FLAVOR)
-
-build_rules_path = Path(f'{PACKAGE_DIR}/debian/rules')
-build_rules_path.write_text(build_rules_text, encoding='utf-8')
-
-# build a package
-debuild_cmd: list[str] = ['debuild']
-run(debuild_cmd, cwd=PACKAGE_DIR, check=True)
-
-# Sign generated Kernel modules
-clean_cmd: list[str] = ['rm', '-rf', PACKAGE_DIR]
-run(clean_cmd, cwd=CWD, check=True)
diff --git a/scripts/package-build/linux-kernel/build-realtek-r8126.sh b/scripts/package-build/linux-kernel/build-realtek-r8126.sh
new file mode 100755
index 00000000..1a4875e0
--- /dev/null
+++ b/scripts/package-build/linux-kernel/build-realtek-r8126.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+set -e
+CWD=$(pwd)
+KERNEL_VAR_FILE=${CWD}/kernel-vars
+
+if [ ! -f ${KERNEL_VAR_FILE} ]; then
+    echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first"
+    exit 1
+fi
+
+. ${KERNEL_VAR_FILE}
+
+PACKAGE_NAME=vyos-drivers-realtek-r8126
+PACKAGE_VERSION=10.016.00
+PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION}
+SOURCES_ARCHIVE=r8126-${PACKAGE_VERSION}.tar.bz2
+SOURCES_URL=https://packages.vyos.net/source-mirror/${SOURCES_ARCHIVE}
+
+if [ -e ${SOURCES_ARCHIVE} ]; then
+    rm -f ${SOURCES_ARCHIVE}
+fi
+curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL}
+
+debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE}
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > ${PACKAGE_DIR}/debian/rules
+#!/usr/bin/make -f
+# config
+export KERNELDIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+MODULES_DIR := updates/drivers/net/ethernet
+# main packaging script based on dh7 syntax
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	make clean
+
+override_dh_auto_build:
+	echo "KERNELDIR=\${KERNELDIR}"
+	echo "CURDIR=\${CURDIR}"
+	make -C \${KERNELDIR} M=\${CURDIR}/src modules
+
+override_dh_auto_install:
+	install -D -m 644 src/r8126.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/r8126.ko
+	\${KERNELDIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+cd ${PACKAGE_DIR}
+debuild
+cd ${CWD}
+
+rm -rf ${PACKAGE_DIR}
diff --git a/scripts/package-build/linux-kernel/build-realtek-r8152.py b/scripts/package-build/linux-kernel/build-realtek-r8152.py
deleted file mode 100755
index b8b3866d..00000000
--- a/scripts/package-build/linux-kernel/build-realtek-r8152.py
+++ /dev/null
@@ -1,95 +0,0 @@
-#!/usr/bin/env python3
-
-import os
-from tomllib import loads as toml_loads
-from requests import get
-from pathlib import Path
-from subprocess import run
-
-CWD = os.getcwd()
-
-# dependency modifier
-def add_depends(package_dir: str, package_name: str,
-                depends: list[str]) -> None:
-    """Add dependencies to a package
-    Args:
-        package_dir (str): a directory where package sources are located
-        package_name (str): a name of package
-        depends (list[str]): a list of dependencies to add
-    """
-    depends_list: str = ', '.join(depends)
-    depends_line: str = f'misc:Depends={depends_list}\n'
-
-    substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars')
-    substvars_file.write_text(depends_line)
-
-
-# find kernel version and source path
-defaults_file: str = Path('../../../data/defaults.toml').read_text()
-architecture_file: str = Path('../../../data/architectures/amd64.toml').read_text()
-KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version')
-KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor')
-KERNEL_SRC: str = Path.cwd().as_posix() + '/linux'
-# define variables
-PACKAGE_NAME: str = 'vyos-drivers-realtek-r8152'
-PACKAGE_VERSION: str = '2.21.4'
-PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}'
-SOURCES_ARCHIVE: str = f'r8152-{PACKAGE_VERSION}.tar.bz2'
-SOURCES_URL: str = f'https://packages.vyos.net/source-mirror/{SOURCES_ARCHIVE}'
-
-# download sources
-sources_archive = Path(SOURCES_ARCHIVE)
-sources_archive.write_bytes(get(SOURCES_URL).content)
-
-# prepare sources
-debmake_cmd: list[str] = [
-    'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p',
-    PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE
-]
-run(debmake_cmd)
-
-# add kernel to dependencies
-add_depends(PACKAGE_DIR, PACKAGE_NAME,
-            [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}'])
-
-# configure build rules
-build_rules_text: str = '''#!/usr/bin/make -f
-# config
-export KERNELDIR := {KERNEL_SRC}
-PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME}
-KVER := {KERNEL_VER}-{KERNEL_FLAVOR}
-MODULES_DIR := updates/drivers/net/usb
-# main packaging script based on dh7 syntax
-%:
-\tdh $@
-
-override_dh_clean:
-\tdh_clean --exclude=debian/{PACKAGE_NAME}.substvars
-
-override_dh_prep:
-\tdh_prep --exclude=debian/{PACKAGE_NAME}.substvars
-
-override_dh_auto_clean:
-\tmake clean
-
-override_dh_auto_build:
-\techo "KERNELDIR=${{KERNELDIR}}"
-\techo "CURDIR=${{CURDIR}}"
-\tmake -C ${{KERNELDIR}} M=${{CURDIR}} modules
-
-override_dh_auto_install:
-\tinstall -D -m 644 r8152.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/r8152.ko
-\t${{KERNELDIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib
-\tinstall -D -m 644 50-usb-realtek-net.rules ${{PACKAGE_BUILD_DIR}}/etc/udev/rules.d/50-usb-realtek-net.rules
-'''.format(KERNEL_SRC=KERNEL_SRC, PACKAGE_NAME=PACKAGE_NAME, KERNEL_VER=KERNEL_VER, KERNEL_FLAVOR=KERNEL_FLAVOR)
-
-build_rules_path = Path(f'{PACKAGE_DIR}/debian/rules')
-build_rules_path.write_text(build_rules_text, encoding='utf-8')
-
-# build a package
-debuild_cmd: list[str] = ['debuild']
-run(debuild_cmd, cwd=PACKAGE_DIR, check=True)
-
-# Sign generated Kernel modules
-clean_cmd: list[str] = ['rm', '-rf', PACKAGE_DIR]
-run(clean_cmd, cwd=CWD, check=True)
diff --git a/scripts/package-build/linux-kernel/build-realtek-r8152.sh b/scripts/package-build/linux-kernel/build-realtek-r8152.sh
new file mode 100755
index 00000000..959c7dad
--- /dev/null
+++ b/scripts/package-build/linux-kernel/build-realtek-r8152.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+set -e
+CWD=$(pwd)
+KERNEL_VAR_FILE=${CWD}/kernel-vars
+
+if [ ! -f ${KERNEL_VAR_FILE} ]; then
+    echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first"
+    exit 1
+fi
+
+. ${KERNEL_VAR_FILE}
+
+PACKAGE_NAME=vyos-drivers-realtek-r8152
+PACKAGE_VERSION=2.21.4
+PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION}
+SOURCES_ARCHIVE=r8152-${PACKAGE_VERSION}.tar.bz2
+SOURCES_URL=https://packages.vyos.net/source-mirror/${SOURCES_ARCHIVE}
+
+if [ -e ${SOURCES_ARCHIVE} ]; then
+    rm -f ${SOURCES_ARCHIVE}
+fi
+curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL}
+
+debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE}
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > ${PACKAGE_DIR}/debian/rules
+#!/usr/bin/make -f
+# config
+export KERNELDIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+MODULES_DIR := updates/drivers/net/usb
+# main packaging script based on dh7 syntax
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	make clean
+
+override_dh_auto_build:
+	echo "KERNELDIR=\${KERNELDIR}"
+	echo "CURDIR=\${CURDIR}"
+	make -C \${KERNELDIR} M=\${CURDIR} modules
+
+override_dh_auto_install:
+	install -D -m 644 r8152.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/r8152.ko
+	\${KERNELDIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+	install -D -m 644 50-usb-realtek-net.rules \${PACKAGE_BUILD_DIR}/etc/udev/rules.d/50-usb-realtek-net.rules
+EOF
+
+cd ${PACKAGE_DIR}
+debuild
+cd ${CWD}
+
+rm -rf ${PACKAGE_DIR}
diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py
index a5094914..46a6a2ba 100755
--- a/scripts/package-build/linux-kernel/build.py
+++ b/scripts/package-build/linux-kernel/build.py
@@ -137,7 +137,7 @@ def build_package(package: dict, dependencies: list,
 
         # Execute the build command
         if package['build_cmd'] == 'build_kernel':
-            source_dir = build_kernel(package['kernel_version'])
+            source_dir = build_kernel(package['kernel_version'], package['kernel_flavor'])
             if linux_kernel_tarball is not None:
                 linux_kernel_tarball.clear()
                 linux_kernel_tarball['package_name'] = package['name']
@@ -191,7 +191,7 @@ def merge_dicts(defaults, package):
     return {**defaults, **package}
 
 
-def build_kernel(kernel_version) -> str:
+def build_kernel(kernel_version, kernel_flavor) -> str:
     """Build the Linux kernel"""
     source_dir = 'linux' # Git source repo name - preferred over TAR
     if not os.path.exists(source_dir):
@@ -205,7 +205,9 @@ def build_kernel(kernel_version) -> str:
         source_dir = f'linux-{kernel_version}'
         os.symlink(source_dir, 'linux')
 
-    run(['./build-kernel.sh'], check=True)
+    # kernel_flavor is only known here (merged from data/defaults.toml); pass it down
+    # via the environment so build-kernel.sh doesn't need to re-read defaults.toml itself.
+    run(['./build-kernel.sh'], check=True, env={**os.environ, 'KERNEL_FLAVOR': kernel_flavor})
     return(source_dir)
 
 
@@ -242,17 +244,17 @@ def build_mellanox_ofed():
 
 def build_realtek_r8126():
     """Build Realtek r8126"""
-    run(['./build-realtek-r8126.py'], check=True)
+    run(['./build-realtek-r8126.sh'], check=True)
 
 
 def build_realtek_r8152():
     """Build Realtek r8152"""
-    run(['./build-realtek-r8152.py'], check=True)
+    run(['./build-realtek-r8152.sh'], check=True)
 
 
 def build_jool():
     """Build Jool"""
-    run(['echo y | ./build-jool.py'], check=True, shell=True)
+    run(['echo y | ./build-jool.sh'], check=True, shell=True)
 
 def build_ipt_netflow(commit_id, scm_url):
     """Build ipt_NETFLOW"""
diff --git a/scripts/package-build/linux-kernel/common.sh b/scripts/package-build/linux-kernel/common.sh
new file mode 100644
index 00000000..ad9689fa
--- /dev/null
+++ b/scripts/package-build/linux-kernel/common.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+# Shared helpers for scripts/package-build/linux-kernel/build-*.sh.
+# Source this file (". ${CWD}/common.sh"); it defines functions only.
+
+# require_amd64 <component-name>
+# Soft-exits (status 0) if not running on amd64.
+require_amd64() {
+    if ! dpkg-architecture -iamd64; then
+        echo "${1} is only buildable on amd64 platforms"
+        exit 0
+    fi
+}
+
+# debian_version <raw-version-string>
+# Sanitizes a git-describe-style string (e.g. "5.3-5-g5aeee02") into a
+# version safe for a "3.0 (native)" Debian source package:
+#  - hyphens are replaced with "+", since debuild/dpkg-source treat any
+#    hyphen as "this needs a separate orig tarball" even for native
+#    packages, and reject the build asking for one that doesn't exist.
+#  - the result is prefixed with "0~" if it doesn't start with a digit,
+#    since Debian versions must start with a digit (a bare abbreviated
+#    git hash can start with a letter).
+debian_version() {
+    v=$(echo "$1" | tr -- '-' '+')
+    case "$v" in
+        [0-9]*) echo "$v" ;;
+        *) echo "0~$v" ;;
+    esac
+}