diff options
Diffstat (limited to 'scripts/package-build/linux-kernel')
8 files changed, 118 insertions, 28 deletions
diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh index 69e2cf30..aa1f8d12 100755 --- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh +++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh @@ -58,8 +58,12 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \ -DCPACK_TYPE=Debian12 .. CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make -# Sign generated Kernel modules -${CWD}/sign-modules.sh . +# Sign generated Kernel modules. Keep the uncompressed .ko next to the +# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of +# its install step, and if the .ko CMake tracks as a build output were +# removed by compression, it would be silently rebuilt unsigned before +# being packaged. +${CWD}/sign-modules.sh . --keep cpack -G DEB diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index bae4051b..2c7554fa 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -72,6 +72,6 @@ fpm --input-type dir --output-type deb --name vyos-ipt-netflow \ --description "ipt_NETFLOW module" \ --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \ - ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \ + ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \ libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \ libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py index 6cb6f90f..a5094914 100755 --- a/scripts/package-build/linux-kernel/build.py +++ b/scripts/package-build/linux-kernel/build.py @@ -274,6 +274,7 @@ if __name__ == '__main__': arg_parser.add_argument('--config', default='package.toml', help='Path to the package configuration file') arg_parser.add_argument('--packages', nargs='+', help='Names of packages to build (default: all)', default=[]) arg_parser.add_argument('--install-dependencies', '-i', help='Only install build dependencies', action='store_true') + arg_parser.add_argument('--keep-kernel', '-k', help='Keep kernel intermediate objects and not create source tar-ball', action='store_true') args = arg_parser.parse_args() # Load package configuration @@ -311,7 +312,7 @@ if __name__ == '__main__': # Copy generated .deb packages to parent directory copy_packages(Path(package['name'])) - if linux_kernel_tarball: + if linux_kernel_tarball and not args.keep_kernel: source_dir = linux_kernel_tarball['source_dir'] trusted_keys = f'{source_dir}/trusted_keys.pem' if os.path.exists(trusted_keys): diff --git a/scripts/package-build/linux-kernel/config/02-module-signing.config b/scripts/package-build/linux-kernel/config/02-module-signing.config index d981ea63..3b98bc1e 100644 --- a/scripts/package-build/linux-kernel/config/02-module-signing.config +++ b/scripts/package-build/linux-kernel/config/02-module-signing.config @@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +CONFIG_MODULE_COMPRESS=y +# CONFIG_MODULE_COMPRESS_GZIP is not set +CONFIG_MODULE_COMPRESS_XZ=y +# CONFIG_MODULE_COMPRESS_ZSTD is not set +CONFIG_MODULE_COMPRESS_ALL=y +CONFIG_MODULE_DECOMPRESS=y diff --git a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig index 5036c070..0cfe2cb7 100644 --- a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig +++ b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig @@ -780,14 +780,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y CONFIG_MODVERSIONS=y CONFIG_ASM_MODVERSIONS=y # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_FORCE=y -CONFIG_MODULE_SIG_ALL=y -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA256 is not set -# CONFIG_MODULE_SIG_SHA384 is not set -CONFIG_MODULE_SIG_SHA512=y -CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set diff --git a/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch new file mode 100644 index 00000000..d69ef038 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch @@ -0,0 +1,66 @@ +From: Christian Breunig <christian@vyos.io> +Date: Sun, 5 Jul 2026 00:00:00 +0200 +Subject: [PATCH] cmake: package signed/compressed kernel modules + +sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and, +if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ, +compresses them to .ko.xz before cpack packages the Debian archive. +The Debian packaging rules installed the drivers by their exact +pre-sign build path (*.ko) unconditionally, so a compressed build +never actually shipped the compressed module. Mirror sign-modules.sh's +own .config check to pick the extension that actually ends up on disk. + +--- + cmake/debian/debian.cmake | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake +index 8db274a..64b8f7d 100644 +--- a/cmake/debian/debian.cmake ++++ b/cmake/debian/debian.cmake +@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR) + ) + endif() + ++# sign-modules.sh signs the built .ko files and, if the target kernel's ++# .config has module compression enabled, xz-compresses them in place. ++# Mirror that check here so we install whichever artifact actually ends ++# up on disk. ++SET(KMOD_EXT ".ko") ++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config") ++ FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$") ++ IF (_ACCEL_PPP_KMOD_COMPRESS_XZ) ++ SET(KMOD_EXT ".ko.xz") ++ ENDIF () ++ENDIF () ++ + if (BUILD_PPTP_DRIVER) + if (BUILD_DRIVER_ONLY) + SET(CPACK_PACKAGE_VERSION_MAJOR "0") +@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () + #INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra) +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + #SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})") + endif (BUILD_PPTP_DRIVER) + +@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_IPOE_DRIVER) + + if (BUILD_VLAN_MON_DRIVER) +@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_VLAN_MON_DRIVER) + + if (NOT BUILD_DRIVER_ONLY) diff --git a/scripts/package-build/linux-kernel/patches/kernel/0004-l2tp-defer-route-at-tunnel-create.patch b/scripts/package-build/linux-kernel/patches/kernel/0004-l2tp-defer-route-at-tunnel-create.patch index b19a57e8..1020869e 100644 --- a/scripts/package-build/linux-kernel/patches/kernel/0004-l2tp-defer-route-at-tunnel-create.patch +++ b/scripts/package-build/linux-kernel/patches/kernel/0004-l2tp-defer-route-at-tunnel-create.patch @@ -30,10 +30,15 @@ Assisted-by: Cursor:claude-4.8-opus Signed-off-by: Christian Breunig <christian@breunig.cc> --- -diff --git i/net/l2tp/l2tp_core.c w/net/l2tp/l2tp_core.c -index 9156a937334a..6fd9c1d89533 100644 ---- i/net/l2tp/l2tp_core.c -+++ w/net/l2tp/l2tp_core.c + net/l2tp/l2tp_core.c | 65 +++++++++++++++++++++++- + net/l2tp/l2tp_ip.c | 37 ++++++++++++++ + net/l2tp/l2tp_ip6.c | 117 +++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 218 insertions(+), 1 deletion(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index fd78928e9be2..0be01b28b7a8 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c @@ -55,6 +55,8 @@ #include <net/inet_ecn.h> #include <net/ip6_route.h> @@ -43,7 +48,7 @@ index 9156a937334a..6fd9c1d89533 100644 #include <asm/byteorder.h> #include <linux/atomic.h> -@@ -1453,6 +1455,67 @@ static void l2tp_tunnel_del_work(struct work_struct *work) +@@ -1454,6 +1456,67 @@ static void l2tp_tunnel_del_work(struct work_struct *work) * These sockets are freed when the namespace exits using the pernet * exit hook. */ @@ -111,7 +116,7 @@ index 9156a937334a..6fd9c1d89533 100644 static int l2tp_tunnel_sock_create(struct net *net, u32 tunnel_id, u32 peer_tunnel_id, -@@ -1490,7 +1553,7 @@ static int l2tp_tunnel_sock_create(struct net *net, +@@ -1491,7 +1554,7 @@ static int l2tp_tunnel_sock_create(struct net *net, udp_conf.local_udp_port = htons(cfg->local_udp_port); udp_conf.peer_udp_port = htons(cfg->peer_udp_port); @@ -120,10 +125,10 @@ index 9156a937334a..6fd9c1d89533 100644 if (err < 0) goto out; -diff --git i/net/l2tp/l2tp_ip.c w/net/l2tp/l2tp_ip.c -index 29795d2839e8..d63b00f09421 100644 ---- i/net/l2tp/l2tp_ip.c -+++ w/net/l2tp/l2tp_ip.c +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 29795d2839e8..0d904a50b9a3 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c @@ -24,6 +24,7 @@ #include <net/xfrm.h> #include <net/net_namespace.h> @@ -182,10 +187,10 @@ index 29795d2839e8..d63b00f09421 100644 if (rc < 0) goto out_sk; -diff --git i/net/l2tp/l2tp_ip6.c w/net/l2tp/l2tp_ip6.c -index ea232f338dcb..610e666c0a58 100644 ---- i/net/l2tp/l2tp_ip6.c -+++ w/net/l2tp/l2tp_ip6.c +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index ea232f338dcb..e4e34db4c37f 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c @@ -28,6 +28,8 @@ #include <net/transp_v6.h> #include <net/addrconf.h> @@ -324,3 +329,6 @@ index ea232f338dcb..610e666c0a58 100644 if (rc < 0) goto out_sk; +-- +2.39.5 + diff --git a/scripts/package-build/linux-kernel/sign-modules.sh b/scripts/package-build/linux-kernel/sign-modules.sh index cfb368eb..1fb82165 100755 --- a/scripts/package-build/linux-kernel/sign-modules.sh +++ b/scripts/package-build/linux-kernel/sign-modules.sh @@ -1,15 +1,28 @@ -#!/bin/sh +#!/bin/sh -x BASE_DIR=$(dirname $0) MODULE_DIR=$1 +# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the +# .ko.xz it produces. Needed by callers whose build system tracks the +# uncompressed .ko as a build output (e.g. CMake custom commands) and +# would otherwise consider it missing and regenerate an unsigned copy. +KEEP_UNCOMPRESSED=$2 . ${BASE_DIR}/kernel-vars SIGN_FILE="${KERNEL_DIR}/scripts/sign-file" +CONFIG_FILE="${KERNEL_DIR}/.config" if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do echo "I: Signing ${MODULE} ..." ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE} + if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then + if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then + xz --compress --keep ${MODULE} + else + xz --compress ${MODULE} + fi + fi done + find ${MODULE_DIR} fi - |