diff options
43 files changed, 986 insertions, 534 deletions
diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 6b27c5d4..f7cc930e 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -26,4 +26,5 @@ knowledge_base: # source where it is not. usage: auto project_keys: + - NOS - VD diff --git a/.github/mergify.yml b/.github/mergify.yml index 54a485dc..2d79068a 100644 --- a/.github/mergify.yml +++ b/.github/mergify.yml @@ -33,10 +33,12 @@ pull_request_rules: - name: Flag product T-ID format violation in PR title or commit messages description: > Product-repo convention: PR title and every commit's first line must - match `T<digits>: <text>` (optional `scope: ` prefix). Relocated from - the central config (T8966) so the T-ID convention is opt-in per product - repo. Name is intentionally distinct from any central rule name so this - stays additive (not an `extends:` override). + match a `T<digits>:`, `NOS-<digits>:` or legacy `VD-<digits>:` task key + followed by text (optional `scope: ` prefix). NOS is the renamed VD Jira + project (2026-07). Relocated from the central config (T8966) so the T-ID + convention is opt-in per product repo. Name is intentionally distinct + from any central rule name so this stays additive (not an `extends:` + override). conditions: - '-closed' - '-merged' @@ -44,10 +46,10 @@ pull_request_rules: - 'author!=copilot-swe-agent' - 'author!=vyosbot' - or: - - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*' + - '-title~=^(([a-zA-Z0-9\-_.]+:[ ])?)(T[0-9]+|NOS-[0-9]+|VD-[0-9]+):[ ]+[^\s]+.*' - and: - 'label!=legacy' - - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*' + - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:[ ])?)(T[0-9]+|NOS-[0-9]+|VD-[0-9]+):[ ]+[^\s]+).*' actions: label: toggle: diff --git a/.github/workflows/trigger_rebuild_packages.yml b/.github/workflows/trigger_rebuild_packages.yml index e5fa4c20..09c20fa5 100644 --- a/.github/workflows/trigger_rebuild_packages.yml +++ b/.github/workflows/trigger_rebuild_packages.yml @@ -47,6 +47,8 @@ jobs: - 'scripts/package-build/hostap/**' hsflowd: - 'scripts/package-build/hsflowd/**' + iproute2: + - 'scripts/package-build/iproute2/**' isc-dhcp: - 'scripts/package-build/isc-dhcp/**' isc-kea: @@ -86,6 +88,8 @@ jobs: - 'scripts/package-build/radvd/**' shim-signed: - 'scripts/package-build/shim-signed/**' + squid: + - 'scripts/package-build/squid/**' strongswan: - 'scripts/package-build/strongswan/**' tacacs: @@ -171,6 +175,10 @@ jobs: trigger_build "hsflowd" fi + if [ "${{ steps.changes.outputs.iproute2 }}" == "true" ]; then + trigger_build "iproute2" + fi + if [ "${{ steps.changes.outputs.isc-dhcp }}" == "true" ]; then trigger_build "isc-dhcp" fi @@ -247,6 +255,10 @@ jobs: trigger_build "shim-signed" fi + if [ "${{ steps.changes.outputs.squid }}" == "true" ]; then + trigger_build "squid" + fi + if [ "${{ steps.changes.outputs.strongswan }}" == "true" ]; then trigger_build "strongswan" fi @@ -4,6 +4,15 @@ build_dir := build ARCH := $(shell dpkg-architecture -qDEB_HOST_ARCH) ISO_PATH := $(build_dir)/live-image-$(ARCH).hybrid.iso +# Test targets forward extra CLI arguments (e.g. `make test -- --match foo`) +# to their scripts via $(MAKECMDGOALS). Those extra words are also goals as +# far as make is concerned, so without this they'd fall through to the `%:` +# flavor rule below and run build-vyos-image with garbage arguments. +TEST_TARGETS := test test-no-interfaces test-no-interfaces-no-vpp test-interfaces test-vpp testc testcvpp testraid testsb testtpm test-ci-qcow2 test-image-update qemu-live +ifneq ($(filter $(TEST_TARGETS),$(firstword $(MAKECMDGOALS))),) +$(eval $(filter-out $(firstword $(MAKECMDGOALS)),$(MAKECMDGOALS)):;@:) +endif + .PHONY: all all: @echo "Make what specifically?" diff --git a/data/defaults.toml b/data/defaults.toml index ef7f8766..9f2f25d4 100644 --- a/data/defaults.toml +++ b/data/defaults.toml @@ -14,7 +14,7 @@ vyos_mirror = "https://packages.vyos.net/repositories/rolling" vyos_branch = "rolling" release_train = "rolling" -kernel_version = "6.18.38" +kernel_version = "6.18.44" kernel_flavor = "vyos" bootloaders = "syslinux,grub-efi" diff --git a/data/live-build-config/archives/bookworm-backports.pref.chroot b/data/live-build-config/archives/bookworm-backports.pref.chroot index e0eba2c0..f48ff10f 100644 --- a/data/live-build-config/archives/bookworm-backports.pref.chroot +++ b/data/live-build-config/archives/bookworm-backports.pref.chroot @@ -1,7 +1,3 @@ -Package: iproute2 -Pin: release n=bookworm-backports -Pin-Priority: 600 - Package: suricata Pin: release n=bookworm-backports Pin-Priority: 600 diff --git a/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons b/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons index 58b6ed13..39c8b202 100755 --- a/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons +++ b/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons @@ -33,6 +33,10 @@ copy_exec /usr/sbin/fsck.ext2 copy_exec /usr/sbin/fsck.ext3 copy_exec /usr/sbin/fsck.ext4 +# Azure VF helper used by udev rule 63-hyperv-vf-net.rules. It must be +# present in initramfs so early VF add events can be renamed to vf_ethN. +copy_exec /lib/udev/vyos_vf_name + # copy other files ("other" here is a file type, so do not delete this keyword) copy_file other /etc/ssl/certs/ca-certificates.crt copy_file other /etc/ssl/openssl.cnf diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 0929ea02..62896266 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -599,11 +599,19 @@ def BOOTLOADERchooseSerialConsole(child, live: bool) -> None: time.sleep(BOOTLOADER_SLEEP) child.send(KEY_RETURN) time.sleep(BOOTLOADER_SLEEP) + # GRUB submenus never time out on their own, so confirm we actually + # landed on this submenu before navigating further - otherwise a + # dropped keypress leaves the VM stuck here until the login wait + # elsewhere expires + child.expect('Select console type', timeout=BOOTLOADER_TMO) + # Select console type child.send(KEY_DOWN) time.sleep(BOOTLOADER_SLEEP) child.send(KEY_RETURN) time.sleep(BOOTLOADER_SLEEP) + child.expect(r'ttyS \(serial\)', timeout=BOOTLOADER_TMO) + # *ttyS (serial) child.send(KEY_DOWN) time.sleep(BOOTLOADER_SLEEP) @@ -723,6 +731,7 @@ def _image_update_cli_sequence(c, log, new_image_name, server_bind_host='127.0.0 'Would you like to set the new image as the default one for boot', 'An active configuration was found. Would you like to copy it to the new image', 'Would you like to copy SSH host keys', + 'Would you like to copy Bash history', 'Would you like to save the SSH known hosts (fingerprints)', 'Signature is not available. Do you want to continue with installation', 'There are unsaved changes to the configuration', @@ -747,9 +756,11 @@ def _image_update_cli_sequence(c, log, new_image_name, server_bind_host='127.0.0 c.sendline('y') elif i == 7: c.sendline('y') - elif i == 8 or i == 9: + elif i == 8: + c.sendline('y') + elif i == 9 or i == 10: raise Exception('add system image reported an error') - elif i == 10: + elif i == 11: log.info('add system image completed') break @@ -1356,18 +1367,17 @@ try: log.info('Smoketests will be run using vyconfd/vyos-commitd') log.info('Executing VyOS smoketests') + c.sendline('ls /usr/bin/vyos-smoketest 2>/dev/null') + c.expect('/usr/bin/vyos-smoketest') + c.expect(op_mode_prompt) c.sendline('/usr/bin/vyos-smoketest') i = c.expect(['\n +Invalid command:', '\n +Set failed', - 'No such file or directory', r'\n\S+@\S+[$#]'], timeout=test_timeout) + r'\n\S+@\S+[$#]'], timeout=test_timeout) if i == 0: raise Exception('Invalid command detected') if i == 1: raise Exception('Set syntax failed :/') - if i == 2: - tmp = '(W)hy (T)he (F)ace? VyOS smoketest not found!' - log.error(tmp) - raise Exception(tmp) c.sendline('echo EXITCODE:$\x16?') i = c.expect(['EXITCODE:0', 'EXITCODE:\d+']) diff --git a/scripts/image-build/build-vyos-image b/scripts/image-build/build-vyos-image index b181a6e4..8b1655da 100755 --- a/scripts/image-build/build-vyos-image +++ b/scripts/image-build/build-vyos-image @@ -31,6 +31,7 @@ import datetime import functools import string import subprocess +import tempfile class ImageBuildError(Exception): pass @@ -156,6 +157,7 @@ def build(): 'qemu-utils', 'gdisk', 'kpartx', + 'squashfs-tools', 'dosfstools' ], 'binaries': [] @@ -492,6 +494,21 @@ DOCUMENTATION_URL="{build_config['documentation_url']}" with open(os.path.join(binary_includes_dir, 'version.json'), 'w') as f: json.dump(version_data, f) + # Generate the isolinux boot menu file + boot_menu_data = f''' +menu hshift 0 +menu width 82 + +menu title VyOS {build_config['version']} ({build_config['build_flavor']}) +include stdmenu.cfg +include live.cfg + +menu clear + ''' + + with open(os.path.join(defaults.LB_CONFIG_DIR, "includes.binary/isolinux/menu.cfg"), "w") as f: + f.write(boot_menu_data) + # For initialization of activation scripts, we need to know if we # are building with create_raw_image if build_config["image_format"] != ["iso"]: @@ -727,26 +744,37 @@ Pin-Priority: 600 manifest['artifacts'].append(iso_file) # Now create SBOM - syft_target_dir = 'chroot' - syft_base_path = os.getcwd() + f'/{syft_target_dir}' base_filename = iso_file.rstrip('.iso') - syft_cmd = [['syft', syft_target_dir, - '--source-name', 'VyOS', '--source-version', version, - '-o', f'cyclonedx-json={base_filename}.cdx.json', - '-o', f'spdx-json={base_filename}.spdx.json']] - - # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328 - syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json']) - syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json']) - - for c in syft_cmd: - with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, - text=True, bufsize=1) as p: - for line in p.stdout: - sys.stdout.write(line) - sys.stdout.flush() - p.wait() - print("I: Finished SBOM generation") + syft_target_dir = tempfile.mkdtemp(prefix='unsquashfs_rootfs-', dir=os.getcwd()) + syft_base_path = syft_target_dir + try: + # lb config builds the amd64 squashfs as xz with -Xbcj x86 (a BCJ pre-filter + # chained with LZMA2. Real unsquashfs/mksquashfs fully support multi-filter + # xz streams; syft's own Go-based squashfs/xz decoder apparently only handles + # plain single-filter. Extract squashfs first + print("I: Unpack squashfs for SBOM generation") + syft_cmd = [['unsquashfs', '-quiet', '-no-progress', '-force', '-dest', syft_target_dir, 'binary/live/filesystem.squashfs']] + # run syft on extracted content + syft_cmd.append(['syft', syft_target_dir, + '--source-name', 'VyOS', '--source-version', version, + '-o', f'cyclonedx-json={base_filename}.cdx.json', + '-o', f'spdx-json={base_filename}.spdx.json']) + + # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328 + syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json']) + syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json']) + + for c in syft_cmd: + with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, + text=True, bufsize=1) as p: + for line in p.stdout: + sys.stdout.write(line) + sys.stdout.flush() + p.wait() + print("I: Finished SBOM generation") + finally: + # remove temporary unpacked squashfs, even on failure/interruption + shutil.rmtree(syft_target_dir, ignore_errors=True) # If the flavor has `image_format = "iso"`, then the work is done. diff --git a/scripts/package-build/iproute2/.gitignore b/scripts/package-build/iproute2/.gitignore new file mode 100644 index 00000000..393b9da9 --- /dev/null +++ b/scripts/package-build/iproute2/.gitignore @@ -0,0 +1 @@ +/iproute2/ diff --git a/scripts/package-build/iproute2/build.py b/scripts/package-build/iproute2/build.py new file mode 120000 index 00000000..3c76af73 --- /dev/null +++ b/scripts/package-build/iproute2/build.py @@ -0,0 +1 @@ +../build.py
\ No newline at end of file diff --git a/scripts/package-build/iproute2/package.toml b/scripts/package-build/iproute2/package.toml new file mode 100644 index 00000000..363cbd31 --- /dev/null +++ b/scripts/package-build/iproute2/package.toml @@ -0,0 +1,5 @@ +[[packages]] +name = "iproute2" +commit_id = "debian/6.18.0-1" +scm_url = "https://salsa.debian.org/kernel-team/iproute2.git" +pre_build_hook = "sudo apt-get install -y -t bookworm-backports debhelper" diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh index 69e2cf30..6e62d879 100755 --- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh +++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh @@ -18,10 +18,16 @@ if [ ! -f ${KERNEL_VAR_FILE} ]; then exit 1 fi -# Build VPP as we need VPP libraries -cd ../vpp/ -./build.py -cd ${CWD} +# Build VPP as we need VPP libraries. This is a full VPP build (make pkg-deb), +# not just headers, since that's the only build target VPP exposes here - skip +# it if a previous run already produced the libraries we link against. Remove +# ${VPP_LIB_CHECK_PATH} (or the whole ../vpp/vpp checkout) to force a rebuild, +# e.g. after bumping the VPP commit_id in ../vpp/package.toml. +if [ ! -d ${VPP_LIB_CHECK_PATH} ]; then + cd ../vpp/ + ./build.py + cd ${CWD} +fi if [ ! -d ${VPP_LIB_CHECK_PATH} ]; then echo "VPP source libraries not found" @@ -58,13 +64,19 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \ -DCPACK_TYPE=Debian12 .. CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make -# Sign generated Kernel modules -${CWD}/sign-modules.sh . +# Sign generated Kernel modules. Keep the uncompressed .ko next to the +# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of +# its install step, and if the .ko CMake tracks as a build output were +# removed by compression, it would be silently rebuilt unsigned before +# being packaged. +${CWD}/sign-modules.sh . --keep cpack -G DEB # rename resulting Debian package according git description mv accel-ppp*.deb ${CWD}/accel-ppp-ng_$(git describe --always --tags)_$(dpkg --print-architecture).deb -# move VPP binaries to linux-kernel dir, CI will get VPP .deb here -cp ${CWD}/../vpp/*.deb ${CWD} +# move VPP binaries to linux-kernel dir, CI will get VPP .deb here. +# If the VPP build was skipped above (libraries already present from a +# prior run), there may be no fresh .deb here to copy - that's fine. +cp ${CWD}/../vpp/*.deb ${CWD} 2>/dev/null || echo "I: No freshly built VPP .deb to copy" diff --git a/scripts/package-build/linux-kernel/build-intel-nic.sh b/scripts/package-build/linux-kernel/build-intel-nic.sh index bde7558a..540694a3 100755 --- a/scripts/package-build/linux-kernel/build-intel-nic.sh +++ b/scripts/package-build/linux-kernel/build-intel-nic.sh @@ -1,11 +1,10 @@ #!/bin/sh +set -e CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh -if ! dpkg-architecture -iamd64; then - echo "Intel drivers only buildable on amd64 platforms" - exit 0 -fi +require_amd64 "Intel drivers" if [ ! -f ${KERNEL_VAR_FILE} ]; then echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first" @@ -26,14 +25,6 @@ if [ -d .git ]; then git reset --hard origin/main fi -DRIVER_VERSION=$(git describe | sed s/^v//) - -# Build up Debian related variables required for packaging -DEBIAN_ARCH=$(dpkg --print-architecture) -DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}_${DEBIAN_ARCH}" -DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control" -DEBIAN_POSTINST="${CWD}/vyos-intel-${DRIVER_NAME}.postinst" - # See https://vyos.dev/T6155 # See https://vyos.dev/T6162 PATCH_DIR=${CWD}/patches/${DRIVER_NAME} @@ -45,37 +36,52 @@ if [ -d $PATCH_DIR ]; then done fi -echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver" -make KSRC=${KERNEL_DIR} BUILD_KERNEL=${KERNEL_VERSION}${KERNEL_SUFFIX} INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} -j $(getconf _NPROCESSORS_ONLN) -C src install +PACKAGE_NAME=vyos-intel-${DRIVER_NAME} +PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)") -if [ "x$?" != "x0" ]; then - exit 1 -fi +debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \ + -e maintainers@vyos.net -f "VyOS Package Maintainers" -if [ -f ${DEBIAN_DIR}.deb ]; then - rm ${DEBIAN_DIR}.deb -fi +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars + +cat << EOF > debian/control +Source: ${PACKAGE_NAME} +Section: kernel +Priority: optional +Maintainer: VyOS Package Maintainers <maintainers@vyos.net> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.5.1 +Rules-Requires-Root: no + +Package: ${PACKAGE_NAME} +Architecture: any +Depends: \${misc:Depends} +Description: Vendor based driver for Intel ${DRIVER_NAME} + Out-of-tree Intel ${DRIVER_NAME} network driver kernel module. +EOF + +cat << EOF > debian/rules +#!/usr/bin/make -f +export KERNEL_DIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} -# build Debian package -echo "I: Building Debian package vyos-intel-${DRIVER_NAME}" -cd ${CWD} +%: + dh \$@ -# Sign generated Kernel modules -${CWD}/sign-modules.sh ${DEBIAN_DIR} +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars -# delete non required files which are also present in the kernel package -# und thus lead to duplicated files -find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars -echo "#!/bin/sh" > ${DEBIAN_POSTINST} -echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST} +override_dh_auto_build: + @true -fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \ - --version ${DRIVER_VERSION} --deb-compression gz \ - --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \ - --description "Vendor based driver for Intel ${DRIVER_NAME}" \ - --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ - --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST} +override_dh_auto_install: + make KSRC=\${KERNEL_DIR} BUILD_KERNEL=\${KVER} INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} -j \$(shell getconf _NPROCESSORS_ONLN) -C src install + find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete + \${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF -# cleanup -rm -rf -- "${DEBIAN_DIR}" "${DEBIAN_POSTINST}" +debuild diff --git a/scripts/package-build/linux-kernel/build-intel-qat.sh b/scripts/package-build/linux-kernel/build-intel-qat.sh index ba4dcefb..8eb2c964 100755 --- a/scripts/package-build/linux-kernel/build-intel-qat.sh +++ b/scripts/package-build/linux-kernel/build-intel-qat.sh @@ -1,11 +1,10 @@ #!/bin/sh +set -e CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh -if ! dpkg-architecture -iamd64; then - echo "Intel-QAT is only buildable on amd64 platforms" - exit 0 -fi +require_amd64 "Intel-QAT" if [ ! -f ${KERNEL_VAR_FILE} ]; then echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first" @@ -25,12 +24,6 @@ DRIVER_NAME_EXTRA="L." DRIVER_VERSION=$(echo ${DRIVER_DIR} | awk -F${DRIVER_NAME} '{print $2}' | awk -F${DRIVER_NAME_EXTRA} '{print $2}') DRIVER_VERSION_EXTRA="-0" -# Build up Debian related variables required for packaging -DEBIAN_ARCH=$(dpkg --print-architecture) -DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}_${DEBIAN_ARCH}" -DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control" -DEBIAN_POSTINST="${CWD}/vyos-intel-qat.postinst" - # Fetch Intel driver source from SourceForge if [ -e ${DRIVER_FILE} ]; then rm -f ${DRIVER_FILE} @@ -62,53 +55,70 @@ if [ -d "${CWD}/patches/intel-qat" ]; then done fi -echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver" -mkdir -p \ - ${DEBIAN_DIR}/lib/firmware \ - ${DEBIAN_DIR}/usr/sbin \ - ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu \ - ${DEBIAN_DIR}/etc/init.d -KERNEL_SOURCE_ROOT=${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf -make -j $(getconf _NPROCESSORS_ONLN) all -make INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} \ - qat-driver-install adf-ctl-all - -if [ "x$?" != "x0" ]; then - exit 1 -fi - -cp quickassist/qat/fw/*.bin ${DEBIAN_DIR}/lib/firmware -cp build/*.so ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu -cp build/adf_ctl ${DEBIAN_DIR}/usr/sbin -cp quickassist/build_system/build_files/qat_service ${DEBIAN_DIR}/etc/init.d -cp build/usdm_drv.ko ${DEBIAN_DIR}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/updates/drivers -chmod 644 ${DEBIAN_DIR}/lib/firmware/* -chmod 755 ${DEBIAN_DIR}/etc/init.d/* ${DEBIAN_DIR}/usr/local/bin/* - -if [ -f ${DEBIAN_DIR}.deb ]; then - rm ${DEBIAN_DIR}.deb -fi - -# build Debian package -echo "I: Building Debian package vyos-intel-${DRIVER_NAME}" -cd ${CWD} - -# Sign generated Kernel modules -${CWD}/sign-modules.sh ${DEBIAN_DIR} - -# delete non required files which are also present in the kernel package -# und thus lead to duplicated files -find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f - -echo "#!/bin/sh" > ${DEBIAN_POSTINST} -echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST} - -fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \ - --version ${DRIVER_VERSION}${DRIVER_VERSION_EXTRA} --deb-compression gz \ - --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \ - --description "Vendor based driver for Intel ${DRIVER_NAME}" \ - --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ - --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST} +PACKAGE_NAME=vyos-intel-$(echo ${DRIVER_NAME} | tr 'A-Z' 'a-z') +PACKAGE_VERSION=$(debian_version "${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}") + +debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \ + -e maintainers@vyos.net -f "VyOS Package Maintainers" + +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars + +cat << EOF > debian/control +Source: ${PACKAGE_NAME} +Section: kernel +Priority: optional +Maintainer: VyOS Package Maintainers <maintainers@vyos.net> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.5.1 +Rules-Requires-Root: no + +Package: ${PACKAGE_NAME} +Architecture: any +Depends: \${misc:Depends} +Description: Vendor based driver for Intel ${DRIVER_NAME} + Intel QuickAssist Technology (QAT) kernel driver and userspace tools. +EOF + +cat << EOF > debian/rules +#!/usr/bin/make -f +export KERNEL_DIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} + +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_clean: + @true + +override_dh_auto_configure: + @true + +override_dh_auto_build: + KERNEL_SOURCE_ROOT=\${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf + \$(MAKE) -j \$(shell getconf _NPROCESSORS_ONLN) all + +override_dh_auto_install: + mkdir -p \${PACKAGE_BUILD_DIR}/lib/firmware \${PACKAGE_BUILD_DIR}/usr/sbin \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu \${PACKAGE_BUILD_DIR}/etc/init.d + \$(MAKE) INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} qat-driver-install adf-ctl-all + cp quickassist/qat/fw/*.bin \${PACKAGE_BUILD_DIR}/lib/firmware + cp build/*.so \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu + cp build/adf_ctl \${PACKAGE_BUILD_DIR}/usr/sbin + cp quickassist/build_system/build_files/qat_service \${PACKAGE_BUILD_DIR}/etc/init.d + cp build/usdm_drv.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/updates/drivers + chmod 644 \${PACKAGE_BUILD_DIR}/lib/firmware/* + chmod 755 \${PACKAGE_BUILD_DIR}/etc/init.d/* + find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete + \${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF + +debuild echo "I: Cleanup ${DRIVER_NAME} source" cd ${CWD} @@ -118,9 +128,3 @@ fi if [ -d ${DRIVER_DIR} ]; then rm -rf ${DRIVER_DIR} fi -if [ -d ${DEBIAN_DIR} ]; then - rm -rf ${DEBIAN_DIR} -fi -if [ -f ${DEBIAN_POSTINST} ]; then - rm -f ${DEBIAN_POSTINST} -fi diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index bae4051b..a94e34f7 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -1,6 +1,8 @@ #!/bin/sh +set -e CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh IPT_NETFLOW_SRC=${CWD}/ipt-netflow if [ ! -d ${IPT_NETFLOW_SRC} ]; then @@ -29,49 +31,62 @@ done . ${KERNEL_VAR_FILE} -DRIVER_VERSION=$(git describe | sed s/^v//) - -# Build up Debian related variables required for packaging -DEBIAN_ARCH=$(dpkg --print-architecture) -DEBIAN_DIR="tmp/" -DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control" -DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst" - -./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR} -make all - -if [ "x$?" != "x0" ]; then - exit 1 -fi - -if [ -f ${DEBIAN_DIR}.deb ]; then - rm ${DEBIAN_DIR}.deb -fi - -if [ ! -d ${DEBIAN_DIR} ]; then - mkdir -p ${DEBIAN_DIR} -fi - -# build Debian package -echo "I: Building Debian package vyos-ipt-netflow" -cp ipt_NETFLOW.ko ${DEBIAN_DIR} -cp libipt_NETFLOW.so ${DEBIAN_DIR} -cp libip6t_NETFLOW.so ${DEBIAN_DIR} - -# Sign generated Kernel modules -${CWD}/sign-modules.sh ${DEBIAN_DIR} - -echo "#!/bin/sh" > ${DEBIAN_POSTINST} -echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST} - -cd ${CWD} - -fpm --input-type dir --output-type deb --name vyos-ipt-netflow \ - --version ${DRIVER_VERSION} --deb-compression gz \ - --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \ - --description "ipt_NETFLOW module" \ - --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ - --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \ - ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \ - libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \ - libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so +PACKAGE_NAME=vyos-ipt-netflow +PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)") +UNAME_ARCH=$(uname -m) + +debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \ + -e maintainers@vyos.net -f "VyOS Package Maintainers" + +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars + +cat << EOF > debian/control +Source: ${PACKAGE_NAME} +Section: kernel +Priority: optional +Maintainer: VyOS Package Maintainers <maintainers@vyos.net> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.5.1 +Rules-Requires-Root: no + +Package: ${PACKAGE_NAME} +Architecture: any +Depends: \${misc:Depends} +Description: ipt_NETFLOW module + Netfilter target module exporting network flows via NetFlow to a + collector, plus xtables NETFLOW match libraries. +EOF + +cat << EOF > debian/rules +#!/usr/bin/make -f +export KERNEL_DIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} + +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_clean: + @true + +override_dh_auto_configure: + @true + +override_dh_auto_build: + ./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=\${KERNEL_DIR} + make all + +override_dh_auto_install: + install -D -m 644 ipt_NETFLOW.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/ipt_NETFLOW.ko + install -D -m 644 libipt_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libipt_NETFLOW.so + install -D -m 644 libip6t_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libip6t_NETFLOW.so + \${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF + +debuild diff --git a/scripts/package-build/linux-kernel/build-jool.py b/scripts/package-build/linux-kernel/build-jool.py deleted file mode 100755 index bfdcf93a..00000000 --- a/scripts/package-build/linux-kernel/build-jool.py +++ /dev/null @@ -1,97 +0,0 @@ -#!/usr/bin/env python3 - -from tomllib import loads as toml_loads -from requests import get -from pathlib import Path -from subprocess import run - -def find_arch() -> str: - tmp=run(['dpkg-architecture', '-q', 'DEB_HOST_ARCH'], capture_output=True) - return tmp.stdout.decode().strip() - -# dependency modifier -def add_depends(package_dir: str, package_name: str, - depends: list[str]) -> None: - """Add dependencies to a package - - Args: - package_dir (str): a directory where package sources are located - package_name (str): a name of package - depends (list[str]): a list of dependencies to add - """ - depends_list: str = ', '.join(depends) - depends_line: str = f'misc:Depends={depends_list}\n' - - substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars') - substvars_file.write_text(depends_line) - - -# find kernel version and source path -arch: str = find_arch() -defaults_file: str = Path('../../../data/defaults.toml').read_text() -KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version') -KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor') -KERNEL_SRC: str = Path.cwd().as_posix() + '/linux' - -# define variables -PACKAGE_NAME: str = 'jool' -PACKAGE_VERSION: str = '4.1.15' -PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}' -SOURCES_ARCHIVE: str = f'{PACKAGE_DIR}.tar.gz' -SOURCES_URL: str = f'https://github.com/NICMx/Jool/archive/refs/tags/v{PACKAGE_VERSION}.tar.gz' - -# download sources -sources_archive = Path(SOURCES_ARCHIVE) -sources_archive.write_bytes(get(SOURCES_URL).content) - -# prepare sources -debmake_cmd: list[str] = [ - 'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p', - PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE -] -run(debmake_cmd) - -# add kernel to dependencies -add_depends(PACKAGE_DIR, PACKAGE_NAME, - [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}']) - -# configure build rules -build_rules_text: str = f'''#!/usr/bin/make -f -# config -export KERNEL_DIR := {KERNEL_SRC} -PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME} -KVER := {KERNEL_VER}-{KERNEL_FLAVOR} -MODULES_DIR := extra - -# main packaging script based on dh7 syntax -%: - dh $@ - -override_dh_clean: - dh_clean --exclude=debian/{PACKAGE_NAME}.substvars - -override_dh_prep: - dh_prep --exclude=debian/{PACKAGE_NAME}.substvars - -# override_dh_auto_clean: -# make -C src/mod clean - -override_dh_auto_build: - dh_auto_build $@ - make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/common modules - make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/nat64 modules - make -C ${{KERNEL_DIR}} M=$$PWD/src/mod/siit modules - -override_dh_auto_install: - dh_auto_install $@ - install -D -m 644 src/mod/common/jool_common.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool_common.ko - install -D -m 644 src/mod/nat64/jool.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool.ko - install -D -m 644 src/mod/siit/jool_siit.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/jool_siit.ko - ${{KERNEL_DIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib -''' -bild_rules = Path(f'{PACKAGE_DIR}/debian/rules') -bild_rules.write_text(build_rules_text) - -# build a package -debuild_cmd: list[str] = ['debuild'] -run(debuild_cmd, cwd=PACKAGE_DIR) diff --git a/scripts/package-build/linux-kernel/build-jool.sh b/scripts/package-build/linux-kernel/build-jool.sh new file mode 100755 index 00000000..731ce11f --- /dev/null +++ b/scripts/package-build/linux-kernel/build-jool.sh @@ -0,0 +1,61 @@ +#!/bin/sh +set -e +CWD=$(pwd) +KERNEL_VAR_FILE=${CWD}/kernel-vars + +if [ ! -f ${KERNEL_VAR_FILE} ]; then + echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first" + exit 1 +fi + +. ${KERNEL_VAR_FILE} + +PACKAGE_NAME=jool +PACKAGE_VERSION=4.1.15 +PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION} +SOURCES_ARCHIVE=${PACKAGE_DIR}.tar.gz +SOURCES_URL=https://github.com/NICMx/Jool/archive/refs/tags/v${PACKAGE_VERSION}.tar.gz + +if [ -e ${SOURCES_ARCHIVE} ]; then + rm -f ${SOURCES_ARCHIVE} +fi +curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL} + +debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE} + +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars + +cat << EOF > ${PACKAGE_DIR}/debian/rules +#!/usr/bin/make -f +# config +export KERNEL_DIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} +MODULES_DIR := extra + +# main packaging script based on dh7 syntax +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_build: + dh_auto_build \$@ + make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/common modules + make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/nat64 modules + make -C \${KERNEL_DIR} M=\$\$PWD/src/mod/siit modules + +override_dh_auto_install: + dh_auto_install \$@ + install -D -m 644 src/mod/common/jool_common.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool_common.ko + install -D -m 644 src/mod/nat64/jool.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool.ko + install -D -m 644 src/mod/siit/jool_siit.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/jool_siit.ko + \${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF + +cd ${PACKAGE_DIR} +debuild diff --git a/scripts/package-build/linux-kernel/build-kernel.sh b/scripts/package-build/linux-kernel/build-kernel.sh index a4a4fc3c..dea71aa9 100755 --- a/scripts/package-build/linux-kernel/build-kernel.sh +++ b/scripts/package-build/linux-kernel/build-kernel.sh @@ -22,8 +22,13 @@ if [ -d /usr/lib/ccache/ ]; then export PATH=/usr/lib/ccache:$PATH fi +if [ -z "${KERNEL_FLAVOR}" ]; then + echo "E: KERNEL_FLAVOR is not set, run via ./build.py so it can be passed from data/defaults.toml" + exit 1 +fi + KERNEL_VERSION=$(make kernelversion) -KERNEL_SUFFIX=-$(awk -F "= " '/kernel_flavor/ {print $2}' ../../../../data/defaults.toml | tr -d \") +KERNEL_SUFFIX=-${KERNEL_FLAVOR} echo "I: Generate Kernel config" ARCH=$(dpkg --print-architecture) diff --git a/scripts/package-build/linux-kernel/build-linux-firmware.sh b/scripts/package-build/linux-kernel/build-linux-firmware.sh index 948a06fd..d542327d 100755 --- a/scripts/package-build/linux-kernel/build-linux-firmware.sh +++ b/scripts/package-build/linux-kernel/build-linux-firmware.sh @@ -1,4 +1,5 @@ #!/bin/bash +set -e # All selected drivers are then precomfiled "make drivers/foo/bar.i" and we grep for # the magic word "UNIQUE_ID_firmware" which identifies firmware files. @@ -6,6 +7,7 @@ CWD=$(pwd) LINUX_FIRMWARE="linux-firmware" KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh . ${KERNEL_VAR_FILE} @@ -20,7 +22,7 @@ if [ ! -d ${LINUX_FIRMWARE} ]; then fi # Retrieve firmware blobs from source files -FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko | xargs modinfo | grep "^firmware:" | awk '{print $2}') +FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko* | xargs modinfo | grep "^firmware:" | awk '{print $2}') # Debian package will use the descriptive Git commit as version GIT_COMMIT=$(cd ${CWD}/${LINUX_FIRMWARE}; git describe --always) @@ -87,10 +89,49 @@ done echo "I: Create linux-firmware package" rm -f ${VYOS_FIRMWARE_NAME}_*.deb -fpm --input-type dir --output-type deb --name ${VYOS_FIRMWARE_NAME} \ - --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \ - --description "Binary firmware for various drivers in the Linux kernel" \ - --architecture all --version ${GIT_COMMIT} --deb-compression gz -C ${VYOS_FIRMWARE_DIR} + +PACKAGE_VERSION=$(debian_version "${GIT_COMMIT}") + +cd ${VYOS_FIRMWARE_DIR} + +debmake -n -y -p ${VYOS_FIRMWARE_NAME} -u ${PACKAGE_VERSION} \ + -e maintainers@vyos.net -f "VyOS Package Maintainers" + +cat << EOF > debian/control +Source: ${VYOS_FIRMWARE_NAME} +Section: kernel +Priority: optional +Maintainer: VyOS Package Maintainers <maintainers@vyos.net> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.5.1 +Rules-Requires-Root: no + +Package: ${VYOS_FIRMWARE_NAME} +Architecture: all +Depends: \${misc:Depends} +Description: Binary firmware for various drivers in the Linux kernel + Firmware blobs assembled from linux-firmware.git for the drivers built + into the VyOS kernel. +EOF + +cat << EOF > debian/rules +#!/usr/bin/make -f +PACKAGE_BUILD_DIR := debian/${VYOS_FIRMWARE_NAME} + +%: + dh \$@ + +override_dh_auto_build: + @true + +override_dh_auto_install: + mkdir -p \${PACKAGE_BUILD_DIR} + cp -a lib \${PACKAGE_BUILD_DIR}/ +EOF + +debuild + +cd ${CWD} rm -rf "${LINUX_FIRMWARE_BUILD_DIR}" rm -rf ${VYOS_FIRMWARE_DIR} diff --git a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh index a810d765..76c1bd03 100755 --- a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh +++ b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh @@ -3,16 +3,14 @@ DROP_DEV_DBG_DEBS=1 DEB_DISTRO='debian12.1' CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh if [ $(id -u) -ne 0 ]; then echo "Mellanox OFED script needs to be run as root" exit fi -if ! dpkg-architecture -iamd64; then - echo "Mellanox OFED is only buildable on amd64 platforms" - exit 0 -fi +require_amd64 "Mellanox OFED" if [ ! -f ${KERNEL_VAR_FILE} ]; then echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first" diff --git a/scripts/package-build/linux-kernel/build-nat-rtsp.sh b/scripts/package-build/linux-kernel/build-nat-rtsp.sh index 33f1311d..ea3352b2 100755 --- a/scripts/package-build/linux-kernel/build-nat-rtsp.sh +++ b/scripts/package-build/linux-kernel/build-nat-rtsp.sh @@ -1,6 +1,8 @@ #!/bin/sh +set -e CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +. ${CWD}/common.sh SRC=${CWD}/nat-rtsp if [ ! -d ${SRC} ]; then @@ -18,31 +20,53 @@ fi cd ${SRC} git reset --hard HEAD git clean --force -d -x -make KERNELDIR=$KERNEL_DIR -# Copy binary to package directory -DEBIAN_DIR=tmp/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra -mkdir -p ${DEBIAN_DIR} -cp nf_conntrack_rtsp.ko nf_nat_rtsp.ko ${DEBIAN_DIR} +PACKAGE_NAME=nat-rtsp +PACKAGE_VERSION=$(debian_version "$(git describe --tags --always)") -DEBIAN_POSTINST="${CWD}/vyos-nat-rtsp.postinst" -echo "#!/bin/sh" > ${DEBIAN_POSTINST} -echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST} +debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \ + -e maintainers@vyos.net -f "VyOS Package Maintainers" -# Sign generated Kernel modules -${CWD}/sign-modules.sh ${DEBIAN_DIR} +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars -# Build Debian Package -fpm --input-type dir --output-type deb --name nat-rtsp \ - --version $(git describe --tags --always) --deb-compression gz \ - --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \ - --description "Connection tracking and NAT support for RTSP" \ - --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ - --after-install ${DEBIAN_POSTINST} \ - --license "GPL2" --chdir tmp +cat << EOF > debian/control +Source: ${PACKAGE_NAME} +Section: kernel +Priority: optional +Maintainer: VyOS Package Maintainers <maintainers@vyos.net> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.5.1 +Rules-Requires-Root: no -mv *.deb .. +Package: ${PACKAGE_NAME} +Architecture: any +Depends: \${misc:Depends} +Description: Connection tracking and NAT support for RTSP + Netfilter conntrack and NAT helper kernel modules for the RTSP protocol. +EOF -if [ -f ${DEBIAN_POSTINST} ]; then - rm -f ${DEBIAN_POSTINST} -fi +cat << EOF > debian/rules +#!/usr/bin/make -f +export KERNEL_DIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} + +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_build: + make KERNELDIR=\${KERNEL_DIR} + +override_dh_auto_install: + install -D -m 644 nf_conntrack_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_conntrack_rtsp.ko + install -D -m 644 nf_nat_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_nat_rtsp.ko + \${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF + +debuild diff --git a/scripts/package-build/linux-kernel/build-realtek-r8126.py b/scripts/package-build/linux-kernel/build-realtek-r8126.py deleted file mode 100755 index 31bad0ce..00000000 --- a/scripts/package-build/linux-kernel/build-realtek-r8126.py +++ /dev/null @@ -1,93 +0,0 @@ -#!/usr/bin/env python3 - -import os -from tomllib import loads as toml_loads -from requests import get -from pathlib import Path -from subprocess import run - -CWD = os.getcwd() - -# dependency modifier -def add_depends(package_dir: str, package_name: str, - depends: list[str]) -> None: - """Add dependencies to a package - Args: - package_dir (str): a directory where package sources are located - package_name (str): a name of package - depends (list[str]): a list of dependencies to add - """ - depends_list: str = ', '.join(depends) - depends_line: str = f'misc:Depends={depends_list}\n' - - substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars') - substvars_file.write_text(depends_line) - - -# find kernel version and source path -defaults_file: str = Path('../../../data/defaults.toml').read_text() -KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version') -KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor') -KERNEL_SRC: str = Path.cwd().as_posix() + '/linux' -# define variables -PACKAGE_NAME: str = 'vyos-drivers-realtek-r8126' -PACKAGE_VERSION: str = '10.016.00' -PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}' -SOURCES_ARCHIVE: str = f'r8126-{PACKAGE_VERSION}.tar.bz2' -SOURCES_URL: str = f'https://packages.vyos.net/source-mirror/{SOURCES_ARCHIVE}' - -# download sources -sources_archive = Path(SOURCES_ARCHIVE) -sources_archive.write_bytes(get(SOURCES_URL).content) - -# prepare sources -debmake_cmd: list[str] = [ - 'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p', - PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE -] -run(debmake_cmd) - -# add kernel to dependencies -add_depends(PACKAGE_DIR, PACKAGE_NAME, - [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}']) - -# configure build rules -build_rules_text: str = '''#!/usr/bin/make -f -# config -export KERNELDIR := {KERNEL_SRC} -PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME} -KVER := {KERNEL_VER}-{KERNEL_FLAVOR} -MODULES_DIR := updates/drivers/net/ethernet -# main packaging script based on dh7 syntax -%: -\tdh $@ - -override_dh_clean: -\tdh_clean --exclude=debian/{PACKAGE_NAME}.substvars - -override_dh_prep: -\tdh_prep --exclude=debian/{PACKAGE_NAME}.substvars - -override_dh_auto_clean: -\tmake clean - -override_dh_auto_build: -\techo "KERNELDIR=${{KERNELDIR}}" -\techo "CURDIR=${{CURDIR}}" -\tmake -C ${{KERNELDIR}} M=${{CURDIR}}/src modules - -override_dh_auto_install: -\tinstall -D -m 644 src/r8126.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/r8126.ko -\t${{KERNELDIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib -'''.format(KERNEL_SRC=KERNEL_SRC, PACKAGE_NAME=PACKAGE_NAME, KERNEL_VER=KERNEL_VER, KERNEL_FLAVOR=KERNEL_FLAVOR) - -build_rules_path = Path(f'{PACKAGE_DIR}/debian/rules') -build_rules_path.write_text(build_rules_text, encoding='utf-8') - -# build a package -debuild_cmd: list[str] = ['debuild'] -run(debuild_cmd, cwd=PACKAGE_DIR, check=True) - -# Sign generated Kernel modules -clean_cmd: list[str] = ['rm', '-rf', PACKAGE_DIR] -run(clean_cmd, cwd=CWD, check=True) diff --git a/scripts/package-build/linux-kernel/build-realtek-r8126.sh b/scripts/package-build/linux-kernel/build-realtek-r8126.sh new file mode 100755 index 00000000..1a4875e0 --- /dev/null +++ b/scripts/package-build/linux-kernel/build-realtek-r8126.sh @@ -0,0 +1,62 @@ +#!/bin/sh +set -e +CWD=$(pwd) +KERNEL_VAR_FILE=${CWD}/kernel-vars + +if [ ! -f ${KERNEL_VAR_FILE} ]; then + echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first" + exit 1 +fi + +. ${KERNEL_VAR_FILE} + +PACKAGE_NAME=vyos-drivers-realtek-r8126 +PACKAGE_VERSION=10.016.00 +PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION} +SOURCES_ARCHIVE=r8126-${PACKAGE_VERSION}.tar.bz2 +SOURCES_URL=https://packages.vyos.net/source-mirror/${SOURCES_ARCHIVE} + +if [ -e ${SOURCES_ARCHIVE} ]; then + rm -f ${SOURCES_ARCHIVE} +fi +curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL} + +debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE} + +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars + +cat << EOF > ${PACKAGE_DIR}/debian/rules +#!/usr/bin/make -f +# config +export KERNELDIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} +MODULES_DIR := updates/drivers/net/ethernet +# main packaging script based on dh7 syntax +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_clean: + make clean + +override_dh_auto_build: + echo "KERNELDIR=\${KERNELDIR}" + echo "CURDIR=\${CURDIR}" + make -C \${KERNELDIR} M=\${CURDIR}/src modules + +override_dh_auto_install: + install -D -m 644 src/r8126.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/r8126.ko + \${KERNELDIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib +EOF + +cd ${PACKAGE_DIR} +debuild +cd ${CWD} + +rm -rf ${PACKAGE_DIR} diff --git a/scripts/package-build/linux-kernel/build-realtek-r8152.py b/scripts/package-build/linux-kernel/build-realtek-r8152.py deleted file mode 100755 index b8b3866d..00000000 --- a/scripts/package-build/linux-kernel/build-realtek-r8152.py +++ /dev/null @@ -1,95 +0,0 @@ -#!/usr/bin/env python3 - -import os -from tomllib import loads as toml_loads -from requests import get -from pathlib import Path -from subprocess import run - -CWD = os.getcwd() - -# dependency modifier -def add_depends(package_dir: str, package_name: str, - depends: list[str]) -> None: - """Add dependencies to a package - Args: - package_dir (str): a directory where package sources are located - package_name (str): a name of package - depends (list[str]): a list of dependencies to add - """ - depends_list: str = ', '.join(depends) - depends_line: str = f'misc:Depends={depends_list}\n' - - substvars_file = Path(f'{package_dir}/debian/{package_name}.substvars') - substvars_file.write_text(depends_line) - - -# find kernel version and source path -defaults_file: str = Path('../../../data/defaults.toml').read_text() -architecture_file: str = Path('../../../data/architectures/amd64.toml').read_text() -KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version') -KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor') -KERNEL_SRC: str = Path.cwd().as_posix() + '/linux' -# define variables -PACKAGE_NAME: str = 'vyos-drivers-realtek-r8152' -PACKAGE_VERSION: str = '2.21.4' -PACKAGE_DIR: str = f'{PACKAGE_NAME}-{PACKAGE_VERSION}' -SOURCES_ARCHIVE: str = f'r8152-{PACKAGE_VERSION}.tar.bz2' -SOURCES_URL: str = f'https://packages.vyos.net/source-mirror/{SOURCES_ARCHIVE}' - -# download sources -sources_archive = Path(SOURCES_ARCHIVE) -sources_archive.write_bytes(get(SOURCES_URL).content) - -# prepare sources -debmake_cmd: list[str] = [ - 'debmake', '-e', 'support@vyos.io', '-f', 'VyOS Support', '-p', - PACKAGE_NAME, '-u', PACKAGE_VERSION, '-a', SOURCES_ARCHIVE -] -run(debmake_cmd) - -# add kernel to dependencies -add_depends(PACKAGE_DIR, PACKAGE_NAME, - [f'linux-image-{KERNEL_VER}-{KERNEL_FLAVOR}']) - -# configure build rules -build_rules_text: str = '''#!/usr/bin/make -f -# config -export KERNELDIR := {KERNEL_SRC} -PACKAGE_BUILD_DIR := debian/{PACKAGE_NAME} -KVER := {KERNEL_VER}-{KERNEL_FLAVOR} -MODULES_DIR := updates/drivers/net/usb -# main packaging script based on dh7 syntax -%: -\tdh $@ - -override_dh_clean: -\tdh_clean --exclude=debian/{PACKAGE_NAME}.substvars - -override_dh_prep: -\tdh_prep --exclude=debian/{PACKAGE_NAME}.substvars - -override_dh_auto_clean: -\tmake clean - -override_dh_auto_build: -\techo "KERNELDIR=${{KERNELDIR}}" -\techo "CURDIR=${{CURDIR}}" -\tmake -C ${{KERNELDIR}} M=${{CURDIR}} modules - -override_dh_auto_install: -\tinstall -D -m 644 r8152.ko ${{PACKAGE_BUILD_DIR}}/lib/modules/${{KVER}}/${{MODULES_DIR}}/r8152.ko -\t${{KERNELDIR}}/../sign-modules.sh ${{PACKAGE_BUILD_DIR}}/lib -\tinstall -D -m 644 50-usb-realtek-net.rules ${{PACKAGE_BUILD_DIR}}/etc/udev/rules.d/50-usb-realtek-net.rules -'''.format(KERNEL_SRC=KERNEL_SRC, PACKAGE_NAME=PACKAGE_NAME, KERNEL_VER=KERNEL_VER, KERNEL_FLAVOR=KERNEL_FLAVOR) - -build_rules_path = Path(f'{PACKAGE_DIR}/debian/rules') -build_rules_path.write_text(build_rules_text, encoding='utf-8') - -# build a package -debuild_cmd: list[str] = ['debuild'] -run(debuild_cmd, cwd=PACKAGE_DIR, check=True) - -# Sign generated Kernel modules -clean_cmd: list[str] = ['rm', '-rf', PACKAGE_DIR] -run(clean_cmd, cwd=CWD, check=True) diff --git a/scripts/package-build/linux-kernel/build-realtek-r8152.sh b/scripts/package-build/linux-kernel/build-realtek-r8152.sh new file mode 100755 index 00000000..959c7dad --- /dev/null +++ b/scripts/package-build/linux-kernel/build-realtek-r8152.sh @@ -0,0 +1,63 @@ +#!/bin/sh +set -e +CWD=$(pwd) +KERNEL_VAR_FILE=${CWD}/kernel-vars + +if [ ! -f ${KERNEL_VAR_FILE} ]; then + echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build-kernel.sh first" + exit 1 +fi + +. ${KERNEL_VAR_FILE} + +PACKAGE_NAME=vyos-drivers-realtek-r8152 +PACKAGE_VERSION=2.21.4 +PACKAGE_DIR=${PACKAGE_NAME}-${PACKAGE_VERSION} +SOURCES_ARCHIVE=r8152-${PACKAGE_VERSION}.tar.bz2 +SOURCES_URL=https://packages.vyos.net/source-mirror/${SOURCES_ARCHIVE} + +if [ -e ${SOURCES_ARCHIVE} ]; then + rm -f ${SOURCES_ARCHIVE} +fi +curl -L -o ${SOURCES_ARCHIVE} ${SOURCES_URL} + +debmake -e support@vyos.io -f "VyOS Support" -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} -a ${SOURCES_ARCHIVE} + +echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > ${PACKAGE_DIR}/debian/${PACKAGE_NAME}.substvars + +cat << EOF > ${PACKAGE_DIR}/debian/rules +#!/usr/bin/make -f +# config +export KERNELDIR := ${KERNEL_DIR} +PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME} +KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX} +MODULES_DIR := updates/drivers/net/usb +# main packaging script based on dh7 syntax +%: + dh \$@ + +override_dh_clean: + dh_clean --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_prep: + dh_prep --exclude=debian/${PACKAGE_NAME}.substvars + +override_dh_auto_clean: + make clean + +override_dh_auto_build: + echo "KERNELDIR=\${KERNELDIR}" + echo "CURDIR=\${CURDIR}" + make -C \${KERNELDIR} M=\${CURDIR} modules + +override_dh_auto_install: + install -D -m 644 r8152.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/\${MODULES_DIR}/r8152.ko + \${KERNELDIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib + install -D -m 644 50-usb-realtek-net.rules \${PACKAGE_BUILD_DIR}/etc/udev/rules.d/50-usb-realtek-net.rules +EOF + +cd ${PACKAGE_DIR} +debuild +cd ${CWD} + +rm -rf ${PACKAGE_DIR} diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py index 6cb6f90f..46a6a2ba 100755 --- a/scripts/package-build/linux-kernel/build.py +++ b/scripts/package-build/linux-kernel/build.py @@ -137,7 +137,7 @@ def build_package(package: dict, dependencies: list, # Execute the build command if package['build_cmd'] == 'build_kernel': - source_dir = build_kernel(package['kernel_version']) + source_dir = build_kernel(package['kernel_version'], package['kernel_flavor']) if linux_kernel_tarball is not None: linux_kernel_tarball.clear() linux_kernel_tarball['package_name'] = package['name'] @@ -191,7 +191,7 @@ def merge_dicts(defaults, package): return {**defaults, **package} -def build_kernel(kernel_version) -> str: +def build_kernel(kernel_version, kernel_flavor) -> str: """Build the Linux kernel""" source_dir = 'linux' # Git source repo name - preferred over TAR if not os.path.exists(source_dir): @@ -205,7 +205,9 @@ def build_kernel(kernel_version) -> str: source_dir = f'linux-{kernel_version}' os.symlink(source_dir, 'linux') - run(['./build-kernel.sh'], check=True) + # kernel_flavor is only known here (merged from data/defaults.toml); pass it down + # via the environment so build-kernel.sh doesn't need to re-read defaults.toml itself. + run(['./build-kernel.sh'], check=True, env={**os.environ, 'KERNEL_FLAVOR': kernel_flavor}) return(source_dir) @@ -242,17 +244,17 @@ def build_mellanox_ofed(): def build_realtek_r8126(): """Build Realtek r8126""" - run(['./build-realtek-r8126.py'], check=True) + run(['./build-realtek-r8126.sh'], check=True) def build_realtek_r8152(): """Build Realtek r8152""" - run(['./build-realtek-r8152.py'], check=True) + run(['./build-realtek-r8152.sh'], check=True) def build_jool(): """Build Jool""" - run(['echo y | ./build-jool.py'], check=True, shell=True) + run(['echo y | ./build-jool.sh'], check=True, shell=True) def build_ipt_netflow(commit_id, scm_url): """Build ipt_NETFLOW""" @@ -274,6 +276,7 @@ if __name__ == '__main__': arg_parser.add_argument('--config', default='package.toml', help='Path to the package configuration file') arg_parser.add_argument('--packages', nargs='+', help='Names of packages to build (default: all)', default=[]) arg_parser.add_argument('--install-dependencies', '-i', help='Only install build dependencies', action='store_true') + arg_parser.add_argument('--keep-kernel', '-k', help='Keep kernel intermediate objects and not create source tar-ball', action='store_true') args = arg_parser.parse_args() # Load package configuration @@ -311,7 +314,7 @@ if __name__ == '__main__': # Copy generated .deb packages to parent directory copy_packages(Path(package['name'])) - if linux_kernel_tarball: + if linux_kernel_tarball and not args.keep_kernel: source_dir = linux_kernel_tarball['source_dir'] trusted_keys = f'{source_dir}/trusted_keys.pem' if os.path.exists(trusted_keys): diff --git a/scripts/package-build/linux-kernel/common.sh b/scripts/package-build/linux-kernel/common.sh new file mode 100644 index 00000000..ad9689fa --- /dev/null +++ b/scripts/package-build/linux-kernel/common.sh @@ -0,0 +1,29 @@ +#!/bin/sh +# Shared helpers for scripts/package-build/linux-kernel/build-*.sh. +# Source this file (". ${CWD}/common.sh"); it defines functions only. + +# require_amd64 <component-name> +# Soft-exits (status 0) if not running on amd64. +require_amd64() { + if ! dpkg-architecture -iamd64; then + echo "${1} is only buildable on amd64 platforms" + exit 0 + fi +} + +# debian_version <raw-version-string> +# Sanitizes a git-describe-style string (e.g. "5.3-5-g5aeee02") into a +# version safe for a "3.0 (native)" Debian source package: +# - hyphens are replaced with "+", since debuild/dpkg-source treat any +# hyphen as "this needs a separate orig tarball" even for native +# packages, and reject the build asking for one that doesn't exist. +# - the result is prefixed with "0~" if it doesn't start with a digit, +# since Debian versions must start with a digit (a bare abbreviated +# git hash can start with a letter). +debian_version() { + v=$(echo "$1" | tr -- '-' '+') + case "$v" in + [0-9]*) echo "$v" ;; + *) echo "0~$v" ;; + esac +} diff --git a/scripts/package-build/linux-kernel/config/02-module-signing.config b/scripts/package-build/linux-kernel/config/02-module-signing.config index d981ea63..3b98bc1e 100644 --- a/scripts/package-build/linux-kernel/config/02-module-signing.config +++ b/scripts/package-build/linux-kernel/config/02-module-signing.config @@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +CONFIG_MODULE_COMPRESS=y +# CONFIG_MODULE_COMPRESS_GZIP is not set +CONFIG_MODULE_COMPRESS_XZ=y +# CONFIG_MODULE_COMPRESS_ZSTD is not set +CONFIG_MODULE_COMPRESS_ALL=y +CONFIG_MODULE_DECOMPRESS=y diff --git a/scripts/package-build/linux-kernel/config/90-debug.config b/scripts/package-build/linux-kernel/config/90-debug.config index 28ffe431..9eb5d016 100644 --- a/scripts/package-build/linux-kernel/config/90-debug.config +++ b/scripts/package-build/linux-kernel/config/90-debug.config @@ -180,3 +180,10 @@ CONFIG_IO_STRICT_DEVMEM=y # CONFIG_KCOV is not set # CONFIG_RUNTIME_TESTING_MENU is not set # CONFIG_MEMTEST is not set + +# +# Kdump tool support +# +CONFIG_CRASH_DUMP=y +CONFIG_DEBUG_INFO=y +CONFIG_PROC_VMCORE=y diff --git a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig index 5036c070..c9372b53 100644 --- a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig +++ b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig @@ -780,14 +780,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y CONFIG_MODVERSIONS=y CONFIG_ASM_MODVERSIONS=y # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_FORCE=y -CONFIG_MODULE_SIG_ALL=y -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA256 is not set -# CONFIG_MODULE_SIG_SHA384 is not set -CONFIG_MODULE_SIG_SHA512=y -CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set @@ -2223,6 +2215,7 @@ CONFIG_IWLWIFI=m CONFIG_IWLWIFI_LEDS=y CONFIG_IWLDVM=m CONFIG_IWLMVM=m +CONFIG_IWLMLD=m CONFIG_IWLWIFI_OPMODE_MODULAR=y # diff --git a/scripts/package-build/linux-kernel/config/x86/vyos_defconfig b/scripts/package-build/linux-kernel/config/x86/vyos_defconfig index 3ce5b449..778db7ce 100644 --- a/scripts/package-build/linux-kernel/config/x86/vyos_defconfig +++ b/scripts/package-build/linux-kernel/config/x86/vyos_defconfig @@ -1040,6 +1040,7 @@ CONFIG_PCI_IOV=y CONFIG_PCI_PRI=y CONFIG_PCI_PASID=y CONFIG_PCI_LABEL=y +CONFIG_PCI_HYPERV=m # CONFIG_PCIE_BUS_TUNE_OFF is not set CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_SAFE is not set @@ -1058,6 +1059,7 @@ CONFIG_HOTPLUG_PCI_SHPC=y # PCI controller drivers # CONFIG_VMD=m +CONFIG_PCI_HYPERV_INTERFACE=m # # DesignWare-based PCIe controllers @@ -1762,6 +1764,7 @@ CONFIG_NET_VENDOR_MICROCHIP=y # CONFIG_VCAP is not set CONFIG_NET_VENDOR_MICROSEMI=y CONFIG_NET_VENDOR_MICROSOFT=y +CONFIG_MICROSOFT_MANA=m CONFIG_NET_VENDOR_MYRI=y CONFIG_MYRI10GE=m CONFIG_MYRI10GE_DCA=y @@ -2071,6 +2074,7 @@ CONFIG_IWLWIFI=m CONFIG_IWLWIFI_LEDS=y CONFIG_IWLDVM=m CONFIG_IWLMVM=m +CONFIG_IWLMLD=m CONFIG_IWLWIFI_OPMODE_MODULAR=y # @@ -4099,7 +4103,7 @@ CONFIG_VHOST_VDPA=m # Microsoft Hyper-V guest support # CONFIG_HYPERV=y -CONFIG_HYPERV_VTL_MODE=y +# CONFIG_HYPERV_VTL_MODE is not set CONFIG_HYPERV_TIMER=y CONFIG_HYPERV_UTILS=m CONFIG_HYPERV_BALLOON=m diff --git a/scripts/package-build/linux-kernel/package.toml b/scripts/package-build/linux-kernel/package.toml index b3b27d5b..38596b26 100644 --- a/scripts/package-build/linux-kernel/package.toml +++ b/scripts/package-build/linux-kernel/package.toml @@ -18,7 +18,7 @@ build_cmd = "build_linux_firmware" [[packages]] name = "accel-ppp-ng" -commit_id = "69c867c" +commit_id = "9654bb6" scm_url = "https://github.com/accel-ppp/accel-ppp-ng.git" build_cmd = "build_accel_ppp_ng" diff --git a/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch new file mode 100644 index 00000000..d69ef038 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch @@ -0,0 +1,66 @@ +From: Christian Breunig <christian@vyos.io> +Date: Sun, 5 Jul 2026 00:00:00 +0200 +Subject: [PATCH] cmake: package signed/compressed kernel modules + +sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and, +if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ, +compresses them to .ko.xz before cpack packages the Debian archive. +The Debian packaging rules installed the drivers by their exact +pre-sign build path (*.ko) unconditionally, so a compressed build +never actually shipped the compressed module. Mirror sign-modules.sh's +own .config check to pick the extension that actually ends up on disk. + +--- + cmake/debian/debian.cmake | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake +index 8db274a..64b8f7d 100644 +--- a/cmake/debian/debian.cmake ++++ b/cmake/debian/debian.cmake +@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR) + ) + endif() + ++# sign-modules.sh signs the built .ko files and, if the target kernel's ++# .config has module compression enabled, xz-compresses them in place. ++# Mirror that check here so we install whichever artifact actually ends ++# up on disk. ++SET(KMOD_EXT ".ko") ++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config") ++ FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$") ++ IF (_ACCEL_PPP_KMOD_COMPRESS_XZ) ++ SET(KMOD_EXT ".ko.xz") ++ ENDIF () ++ENDIF () ++ + if (BUILD_PPTP_DRIVER) + if (BUILD_DRIVER_ONLY) + SET(CPACK_PACKAGE_VERSION_MAJOR "0") +@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () + #INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra) +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + #SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})") + endif (BUILD_PPTP_DRIVER) + +@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_IPOE_DRIVER) + + if (BUILD_VLAN_MON_DRIVER) +@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_VLAN_MON_DRIVER) + + if (NOT BUILD_DRIVER_ONLY) diff --git a/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch b/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch index 563a8cec..2e838a62 100644 --- a/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch +++ b/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch @@ -49,7 +49,7 @@ index 7a637e87005f..982c76d0b0ab 100644 - 1 - Allows you to have multiple network interfaces on the same subnet, and have the ARPs for each interface be answered diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h -index dccbeb25f701..b16f70e491d6 100644 +index 6032eea2539a..b3ecf2a418af 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -139,6 +139,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) @@ -109,10 +109,10 @@ index 942a887bf089..e6df2bfc4e40 100644 }; diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index b2e1328371d3..769d4e1f5cbf 100644 +index c98b1b919f18..e7eb01ce30d1 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c -@@ -5718,6 +5718,7 @@ static void ipv6_store_devconf(const struct ipv6_devconf *cnf, +@@ -5731,6 +5731,7 @@ static void ipv6_store_devconf(const struct ipv6_devconf *cnf, READ_ONCE(cnf->accept_untracked_na); array[DEVCONF_ACCEPT_RA_MIN_LFT] = READ_ONCE(cnf->accept_ra_min_lft); array[DEVCONF_FORCE_FORWARDING] = READ_ONCE(cnf->force_forwarding); @@ -120,7 +120,7 @@ index b2e1328371d3..769d4e1f5cbf 100644 } static inline size_t inet6_ifla6_size(void) -@@ -7253,6 +7254,13 @@ static const struct ctl_table addrconf_sysctl[] = { +@@ -7274,6 +7275,13 @@ static const struct ctl_table addrconf_sysctl[] = { .extra1 = (void *)SYSCTL_ZERO, .extra2 = (void *)SYSCTL_ONE, }, @@ -135,7 +135,7 @@ index b2e1328371d3..769d4e1f5cbf 100644 .procname = "ioam6_id", .data = &ipv6_devconf.ioam6_id, diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index f89220929c4e..8f92ef14d884 100644 +index ef66a3c86feb..4a1de714e3a9 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -717,6 +717,14 @@ static inline void rt6_probe(struct fib6_nh *fib6_nh) diff --git a/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch b/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch new file mode 100644 index 00000000..8bccf3b2 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch @@ -0,0 +1,57 @@ +From: Christian Breunig <christian@breunig.cc> +Date: Sat, 18 Jul 2026 18:30:00 +0000 +Subject: [PATCH] arm64: fix relative syscalltbl path in Makefile.syscalls + +Building the "linux-perf" Debian package (added by +0002-build-linux-perf-package.patch, via install_perf() invoking +"make -C tools/perf ... install") reproducibly fails on an arm64 build +host with: + + make[9]: *** No rule to make target + '.../tools/perf/libperf/arch/arm64/include/generated/uapi/asm/unistd_64.h'. + Stop. + +Root cause: tools/lib/perf/Makefile's "uapi-asm-generic:" recipe invokes +scripts/Makefile.asm-headers without "-C $(srctree)", so it inherits +whatever working directory tools/lib/perf/Makefile itself was invoked +with - which is tools/lib/perf/, not the kernel source root. This is +harmless for the generic default: + + syscalltbl := $(srctree)/scripts/syscall.tbl + +...which is absolute and thus resolves correctly regardless of the +working directory. arch/arm64/kernel/Makefile.syscalls, however, +overrides this with a relative path: + + syscalltbl = arch/arm64/tools/syscall_%.tbl + +When SRCARCH=arm64 (true both for the target kernel and, on a native +arm64 build host, for tools/perf's own build), this relative path is +looked up relative to tools/lib/perf/ instead of the kernel root, does +not exist there, and the "unistd_%.h" pattern rule that depends on it +can no longer be matched - so make reports no rule for the target at +all, rather than a missing-prerequisite error. + +This only surfaces on a native arm64 build host: on x86_64 hosts (the +common case for cross-building arm64 kernels) tools/perf builds for the +x86_64 host architecture, which has no such override and always uses +the safe, absolute default path. + +Fix by making arm64's override absolute too, matching the default and +every other reference in this file's callers. +--- + arch/arm64/kernel/Makefile.syscalls | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/Makefile.syscalls b/arch/arm64/kernel/Makefile.syscalls +index 0542a718871a..958f2335ec1b 100644 +--- a/arch/arm64/kernel/Makefile.syscalls ++++ b/arch/arm64/kernel/Makefile.syscalls +@@ -3,4 +3,4 @@ + syscall_abis_32 += + syscall_abis_64 += renameat rlimit memfd_secret + +-syscalltbl = arch/arm64/tools/syscall_%.tbl ++syscalltbl = $(srctree)/arch/arm64/tools/syscall_%.tbl +-- +2.39.5 diff --git a/scripts/package-build/linux-kernel/sign-modules.sh b/scripts/package-build/linux-kernel/sign-modules.sh index cfb368eb..1fb82165 100755 --- a/scripts/package-build/linux-kernel/sign-modules.sh +++ b/scripts/package-build/linux-kernel/sign-modules.sh @@ -1,15 +1,28 @@ -#!/bin/sh +#!/bin/sh -x BASE_DIR=$(dirname $0) MODULE_DIR=$1 +# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the +# .ko.xz it produces. Needed by callers whose build system tracks the +# uncompressed .ko as a build output (e.g. CMake custom commands) and +# would otherwise consider it missing and regenerate an unsigned copy. +KEEP_UNCOMPRESSED=$2 . ${BASE_DIR}/kernel-vars SIGN_FILE="${KERNEL_DIR}/scripts/sign-file" +CONFIG_FILE="${KERNEL_DIR}/.config" if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do echo "I: Signing ${MODULE} ..." ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE} + if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then + if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then + xz --compress --keep ${MODULE} + else + xz --compress ${MODULE} + fi + fi done + find ${MODULE_DIR} fi - diff --git a/scripts/package-build/openssl/package.toml b/scripts/package-build/openssl/package.toml index 6dfd32e0..b38022ca 100644 --- a/scripts/package-build/openssl/package.toml +++ b/scripts/package-build/openssl/package.toml @@ -2,4 +2,5 @@ name = "openssl" commit_id = "debian/openssl-3.0.20-1_deb12u2" scm_url = "https://salsa.debian.org/debian/openssl.git" -build_cmd = "dpkg-buildpackage -us -uc -tc -b" +pre_build_hook = "git reset --hard HEAD && git clean -ffdx" +build_cmd = "sed -i '1s/)/+vyos1)/' debian/changelog && dpkg-buildpackage -us -uc -tc -b" diff --git a/scripts/package-build/podman/.gitignore b/scripts/package-build/podman/.gitignore index dfba60a6..0ded0d2d 100644 --- a/scripts/package-build/podman/.gitignore +++ b/scripts/package-build/podman/.gitignore @@ -1 +1,3 @@ /podman/ +/aardvark-dns/ +/netavark/ diff --git a/scripts/package-build/podman/package.toml b/scripts/package-build/podman/package.toml index 3975e861..2cb05a55 100644 --- a/scripts/package-build/podman/package.toml +++ b/scripts/package-build/podman/package.toml @@ -1,4 +1,175 @@ [[packages]] +name = "netavark" +commit_id = "debian/1.14.0-2" +scm_url = "https://salsa.debian.org/debian/netavark" + +# The Debian packaging for netavark targets trixie/sid: it builds via dh-cargo +# against a wall of librust-*-dev packages that don't exist in the bookworm +# archive VyOS builds against, and bookworm's rustc (1.63) is below netavark's +# rust-version = "1.76" floor. Rewrite debian/control and debian/rules to build +# directly against crates.io with a rustup-installed toolchain instead, and +# drop the quilt patches that only exist to pin Cargo.toml/Cargo.lock to +# whatever librust-*-dev versions happen to be in the trixie/sid archive - our +# network build uses upstream's own (pristine) Cargo.lock instead. +# +# debian/patches/series and debian/control/rules are edited in place here +# rather than via a patch file: mk-build-deps (which runs before build_cmd) +# reads debian/control straight off disk, before dpkg-buildpackage's automatic +# quilt-patch application would ever get a chance to apply a patch to it. +pre_build_hook = """ +sed -i \ + -e '/^0009-Revert-fix-deps-update-rust-crate-rand-to-0.9.0.patch$/d' \ + -e '/^0010-Revert-fix-deps-update-rust-crate-sysctl-to-0.6.0.patch$/d' \ + -e '/^0012-relax-tokio-stream-dependency.patch$/d' \ + -e '/^0013-Relax-nispor-dependency.patch$/d' \ + -e '/^0013-Build-against-url-2.5.2.patch$/d' \ + -e '/^0013-compile-against-prost-12.6.patch$/d' \ + -e '/^0015-update-zbus.patch$/d' \ + debian/patches/series + +cat > debian/control <<'EOF' +Source: netavark +Section: net +Priority: optional +Maintainer: Reinhard Tartler <siretart@tauware.de> +Build-Depends: debhelper-compat (= 13), + pkg-config, + protobuf-compiler +Standards-Version: 4.7.2 +Homepage: https://github.com/containers/netavark +Vcs-Browser: https://salsa.debian.org/debian/netavark +Vcs-Git: https://salsa.debian.org/debian/netavark.git +Rules-Requires-Root: no + +Package: netavark +Architecture: any +Depends: ${misc:Depends}, ${shlibs:Depends} +Provides: container-network-stack (= 2) +Recommends: aardvark-dns, nftables +Breaks: aardvark-dns (<< 1.12) +Enhances: podman +Description: Rust based network stack for containers + Netavark is designed to work with but is also applicable + for other OCI container management applications. +EOF + +cat > debian/rules <<'EOF' +#!/usr/bin/make -f + +# cf. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091318 +export NETAVARK_DEFAULT_FW := nftables + +# VyOS builds on Debian bookworm, whose librust-*-dev / dh-cargo stack is far +# behind what this package needs, so we build directly against crates.io via +# the upstream Cargo.lock instead of Debian's offline vendored-crate scheme. +%: + dh $@ + +override_dh_auto_build: + cargo build --release --bin netavark --bin netavark-dhcp-proxy-client + +override_dh_auto_test: + +override_dh_auto_install: + install -D -m 0755 target/release/netavark \ + debian/netavark/usr/lib/podman/netavark + install -D -m 0755 target/release/netavark-dhcp-proxy-client \ + debian/netavark/usr/lib/podman/netavark-dhcp-proxy-client + install -D -m 664 contrib/systemd/system/netavark-dhcp-proxy.socket \ + debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.socket + sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \ + < contrib/systemd/system/netavark-dhcp-proxy.service.in \ + > debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service + sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \ + < contrib/systemd/system/netavark-firewalld-reload.service.in \ + > debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service + +override_dh_auto_clean: + rm -rf target +EOF +chmod 0755 debian/rules + +# bookworm's rustc (1.63) predates netavark's rust-version = "1.76"; install a +# current stable toolchain and shadow any apt-installed one via /usr/local/bin, +# which every later shell invocation in this build picks up ahead of /usr/bin. +if [ ! -x "$HOME/.cargo/bin/rustup" ]; then + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable +else + "$HOME/.cargo/bin/rustup" update stable +fi +sudo ln -sf "$HOME/.cargo/bin/cargo" /usr/local/bin/cargo +sudo ln -sf "$HOME/.cargo/bin/rustc" /usr/local/bin/rustc +sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup +""" + +[[packages]] +name = "aardvark-dns" +commit_id = "debian/1.14.0-3" +scm_url = "https://salsa.debian.org/debian/aardvark-dns" + +# aardvark-dns and netavark are versioned in lockstep upstream (this +# aardvark-dns Depends: netavark (>> 1.14)) and share the same trixie-only +# dh-cargo/librust-*-dev packaging problem on bookworm - see the netavark +# entry above for the full rationale. Same fix: build directly against +# crates.io with a rustup-installed toolchain. +pre_build_hook = """ +sed -i -e '/^relax-deps.patch$/d' debian/patches/series + +cat > debian/control <<'EOF' +Source: aardvark-dns +Section: net +Priority: optional +Maintainer: Reinhard Tartler <siretart@tauware.de> +Build-Depends: debhelper-compat (= 13) +Standards-Version: 4.7.2 +Homepage: https://github.com/containers/aardvark-dns +Vcs-Browser: https://salsa.debian.org/debian/aardvark-dns +Vcs-Git: https://salsa.debian.org/debian/aardvark-dns.git +Rules-Requires-Root: no + +Package: aardvark-dns +Architecture: any +Depends: netavark (>> 1.14), ${misc:Depends}, ${shlibs:Depends} +Enhances: podman +Description: Container-focused DNS server + Netavark is designed to work with podman but is also applicable for other OCI + container management applications. +EOF + +cat > debian/rules <<'EOF' +#!/usr/bin/make -f + +# VyOS builds on Debian bookworm, whose librust-*-dev / dh-cargo stack is far +# behind what this package needs, so we build directly against crates.io via +# the upstream Cargo.lock instead of Debian's offline vendored-crate scheme. +%: + dh $@ + +override_dh_auto_build: + cargo build --release --bin aardvark-dns + +override_dh_auto_test: + +override_dh_auto_install: + install -D -m 0755 target/release/aardvark-dns \ + debian/aardvark-dns/usr/lib/podman/aardvark-dns + +override_dh_auto_clean: + rm -rf target +EOF +chmod 0755 debian/rules + +if [ ! -x "$HOME/.cargo/bin/rustup" ]; then + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable +else + "$HOME/.cargo/bin/rustup" update stable +fi +sudo ln -sf "$HOME/.cargo/bin/cargo" /usr/local/bin/cargo +sudo ln -sf "$HOME/.cargo/bin/rustc" /usr/local/bin/rustc +sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup +""" + +[[packages]] name = "podman" commit_id = "v5.8.4" scm_url = "https://github.com/containers/podman" diff --git a/scripts/package-build/squid/.gitignore b/scripts/package-build/squid/.gitignore new file mode 100644 index 00000000..0b00d9fb --- /dev/null +++ b/scripts/package-build/squid/.gitignore @@ -0,0 +1 @@ +/squid/ diff --git a/scripts/package-build/squid/build.py b/scripts/package-build/squid/build.py new file mode 120000 index 00000000..3c76af73 --- /dev/null +++ b/scripts/package-build/squid/build.py @@ -0,0 +1 @@ +../build.py
\ No newline at end of file diff --git a/scripts/package-build/squid/package.toml b/scripts/package-build/squid/package.toml new file mode 100644 index 00000000..fc693be0 --- /dev/null +++ b/scripts/package-build/squid/package.toml @@ -0,0 +1,23 @@ +[[packages]] +name = "squid" +commit_id = "debian/7.6-2" +scm_url = "https://salsa.debian.org/squid-team/squid" + +[dependencies] + packages = [ + "libltdl-dev", + "dh-apparmor", + "libcppunit-dev", + "libcap2-dev", + "libecap3-dev", + "libgnutls28-dev", + "libldap2-dev", + "libnetfilter-conntrack-dev", + "libpam0g-dev", + "libsasl2-dev", + "libsystemd-dev", + "libtdb-dev", + "nettle-dev", + "libssl-dev" + ] + |