diff options
Diffstat (limited to 'scripts')
12 files changed, 211 insertions, 41 deletions
diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 0929ea02..62896266 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -599,11 +599,19 @@ def BOOTLOADERchooseSerialConsole(child, live: bool) -> None: time.sleep(BOOTLOADER_SLEEP) child.send(KEY_RETURN) time.sleep(BOOTLOADER_SLEEP) + # GRUB submenus never time out on their own, so confirm we actually + # landed on this submenu before navigating further - otherwise a + # dropped keypress leaves the VM stuck here until the login wait + # elsewhere expires + child.expect('Select console type', timeout=BOOTLOADER_TMO) + # Select console type child.send(KEY_DOWN) time.sleep(BOOTLOADER_SLEEP) child.send(KEY_RETURN) time.sleep(BOOTLOADER_SLEEP) + child.expect(r'ttyS \(serial\)', timeout=BOOTLOADER_TMO) + # *ttyS (serial) child.send(KEY_DOWN) time.sleep(BOOTLOADER_SLEEP) @@ -723,6 +731,7 @@ def _image_update_cli_sequence(c, log, new_image_name, server_bind_host='127.0.0 'Would you like to set the new image as the default one for boot', 'An active configuration was found. Would you like to copy it to the new image', 'Would you like to copy SSH host keys', + 'Would you like to copy Bash history', 'Would you like to save the SSH known hosts (fingerprints)', 'Signature is not available. Do you want to continue with installation', 'There are unsaved changes to the configuration', @@ -747,9 +756,11 @@ def _image_update_cli_sequence(c, log, new_image_name, server_bind_host='127.0.0 c.sendline('y') elif i == 7: c.sendline('y') - elif i == 8 or i == 9: + elif i == 8: + c.sendline('y') + elif i == 9 or i == 10: raise Exception('add system image reported an error') - elif i == 10: + elif i == 11: log.info('add system image completed') break @@ -1356,18 +1367,17 @@ try: log.info('Smoketests will be run using vyconfd/vyos-commitd') log.info('Executing VyOS smoketests') + c.sendline('ls /usr/bin/vyos-smoketest 2>/dev/null') + c.expect('/usr/bin/vyos-smoketest') + c.expect(op_mode_prompt) c.sendline('/usr/bin/vyos-smoketest') i = c.expect(['\n +Invalid command:', '\n +Set failed', - 'No such file or directory', r'\n\S+@\S+[$#]'], timeout=test_timeout) + r'\n\S+@\S+[$#]'], timeout=test_timeout) if i == 0: raise Exception('Invalid command detected') if i == 1: raise Exception('Set syntax failed :/') - if i == 2: - tmp = '(W)hy (T)he (F)ace? VyOS smoketest not found!' - log.error(tmp) - raise Exception(tmp) c.sendline('echo EXITCODE:$\x16?') i = c.expect(['EXITCODE:0', 'EXITCODE:\d+']) diff --git a/scripts/image-build/build-vyos-image b/scripts/image-build/build-vyos-image index b181a6e4..a1458d99 100755 --- a/scripts/image-build/build-vyos-image +++ b/scripts/image-build/build-vyos-image @@ -31,6 +31,7 @@ import datetime import functools import string import subprocess +import tempfile class ImageBuildError(Exception): pass @@ -156,6 +157,7 @@ def build(): 'qemu-utils', 'gdisk', 'kpartx', + 'squashfs-tools', 'dosfstools' ], 'binaries': [] @@ -727,26 +729,37 @@ Pin-Priority: 600 manifest['artifacts'].append(iso_file) # Now create SBOM - syft_target_dir = 'chroot' - syft_base_path = os.getcwd() + f'/{syft_target_dir}' base_filename = iso_file.rstrip('.iso') - syft_cmd = [['syft', syft_target_dir, - '--source-name', 'VyOS', '--source-version', version, - '-o', f'cyclonedx-json={base_filename}.cdx.json', - '-o', f'spdx-json={base_filename}.spdx.json']] - - # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328 - syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json']) - syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json']) - - for c in syft_cmd: - with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, - text=True, bufsize=1) as p: - for line in p.stdout: - sys.stdout.write(line) - sys.stdout.flush() - p.wait() - print("I: Finished SBOM generation") + syft_target_dir = tempfile.mkdtemp(prefix='unsquashfs_rootfs-', dir=os.getcwd()) + syft_base_path = syft_target_dir + try: + # lb config builds the amd64 squashfs as xz with -Xbcj x86 (a BCJ pre-filter + # chained with LZMA2. Real unsquashfs/mksquashfs fully support multi-filter + # xz streams; syft's own Go-based squashfs/xz decoder apparently only handles + # plain single-filter. Extract squashfs first + print("I: Unpack squashfs for SBOM generation") + syft_cmd = [['unsquashfs', '-quiet', '-no-progress', '-force', '-dest', syft_target_dir, 'binary/live/filesystem.squashfs']] + # run syft on extracted content + syft_cmd.append(['syft', syft_target_dir, + '--source-name', 'VyOS', '--source-version', version, + '-o', f'cyclonedx-json={base_filename}.cdx.json', + '-o', f'spdx-json={base_filename}.spdx.json']) + + # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328 + syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json']) + syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json']) + + for c in syft_cmd: + with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, + text=True, bufsize=1) as p: + for line in p.stdout: + sys.stdout.write(line) + sys.stdout.flush() + p.wait() + print("I: Finished SBOM generation") + finally: + # remove temporary unpacked squashfs, even on failure/interruption + shutil.rmtree(syft_target_dir, ignore_errors=True) # If the flavor has `image_format = "iso"`, then the work is done. diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh index 69e2cf30..aa1f8d12 100755 --- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh +++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh @@ -58,8 +58,12 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \ -DCPACK_TYPE=Debian12 .. CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make -# Sign generated Kernel modules -${CWD}/sign-modules.sh . +# Sign generated Kernel modules. Keep the uncompressed .ko next to the +# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of +# its install step, and if the .ko CMake tracks as a build output were +# removed by compression, it would be silently rebuilt unsigned before +# being packaged. +${CWD}/sign-modules.sh . --keep cpack -G DEB diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index bae4051b..2c7554fa 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -72,6 +72,6 @@ fpm --input-type dir --output-type deb --name vyos-ipt-netflow \ --description "ipt_NETFLOW module" \ --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \ - ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \ + ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \ libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \ libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py index 6cb6f90f..a5094914 100755 --- a/scripts/package-build/linux-kernel/build.py +++ b/scripts/package-build/linux-kernel/build.py @@ -274,6 +274,7 @@ if __name__ == '__main__': arg_parser.add_argument('--config', default='package.toml', help='Path to the package configuration file') arg_parser.add_argument('--packages', nargs='+', help='Names of packages to build (default: all)', default=[]) arg_parser.add_argument('--install-dependencies', '-i', help='Only install build dependencies', action='store_true') + arg_parser.add_argument('--keep-kernel', '-k', help='Keep kernel intermediate objects and not create source tar-ball', action='store_true') args = arg_parser.parse_args() # Load package configuration @@ -311,7 +312,7 @@ if __name__ == '__main__': # Copy generated .deb packages to parent directory copy_packages(Path(package['name'])) - if linux_kernel_tarball: + if linux_kernel_tarball and not args.keep_kernel: source_dir = linux_kernel_tarball['source_dir'] trusted_keys = f'{source_dir}/trusted_keys.pem' if os.path.exists(trusted_keys): diff --git a/scripts/package-build/linux-kernel/config/02-module-signing.config b/scripts/package-build/linux-kernel/config/02-module-signing.config index d981ea63..3b98bc1e 100644 --- a/scripts/package-build/linux-kernel/config/02-module-signing.config +++ b/scripts/package-build/linux-kernel/config/02-module-signing.config @@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +CONFIG_MODULE_COMPRESS=y +# CONFIG_MODULE_COMPRESS_GZIP is not set +CONFIG_MODULE_COMPRESS_XZ=y +# CONFIG_MODULE_COMPRESS_ZSTD is not set +CONFIG_MODULE_COMPRESS_ALL=y +CONFIG_MODULE_DECOMPRESS=y diff --git a/scripts/package-build/linux-kernel/config/90-debug.config b/scripts/package-build/linux-kernel/config/90-debug.config index 28ffe431..9eb5d016 100644 --- a/scripts/package-build/linux-kernel/config/90-debug.config +++ b/scripts/package-build/linux-kernel/config/90-debug.config @@ -180,3 +180,10 @@ CONFIG_IO_STRICT_DEVMEM=y # CONFIG_KCOV is not set # CONFIG_RUNTIME_TESTING_MENU is not set # CONFIG_MEMTEST is not set + +# +# Kdump tool support +# +CONFIG_CRASH_DUMP=y +CONFIG_DEBUG_INFO=y +CONFIG_PROC_VMCORE=y diff --git a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig index 5036c070..0cfe2cb7 100644 --- a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig +++ b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig @@ -780,14 +780,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y CONFIG_MODVERSIONS=y CONFIG_ASM_MODVERSIONS=y # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_FORCE=y -CONFIG_MODULE_SIG_ALL=y -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA256 is not set -# CONFIG_MODULE_SIG_SHA384 is not set -CONFIG_MODULE_SIG_SHA512=y -CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set diff --git a/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch new file mode 100644 index 00000000..d69ef038 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch @@ -0,0 +1,66 @@ +From: Christian Breunig <christian@vyos.io> +Date: Sun, 5 Jul 2026 00:00:00 +0200 +Subject: [PATCH] cmake: package signed/compressed kernel modules + +sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and, +if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ, +compresses them to .ko.xz before cpack packages the Debian archive. +The Debian packaging rules installed the drivers by their exact +pre-sign build path (*.ko) unconditionally, so a compressed build +never actually shipped the compressed module. Mirror sign-modules.sh's +own .config check to pick the extension that actually ends up on disk. + +--- + cmake/debian/debian.cmake | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake +index 8db274a..64b8f7d 100644 +--- a/cmake/debian/debian.cmake ++++ b/cmake/debian/debian.cmake +@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR) + ) + endif() + ++# sign-modules.sh signs the built .ko files and, if the target kernel's ++# .config has module compression enabled, xz-compresses them in place. ++# Mirror that check here so we install whichever artifact actually ends ++# up on disk. ++SET(KMOD_EXT ".ko") ++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config") ++ FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$") ++ IF (_ACCEL_PPP_KMOD_COMPRESS_XZ) ++ SET(KMOD_EXT ".ko.xz") ++ ENDIF () ++ENDIF () ++ + if (BUILD_PPTP_DRIVER) + if (BUILD_DRIVER_ONLY) + SET(CPACK_PACKAGE_VERSION_MAJOR "0") +@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () + #INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra) +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + #SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})") + endif (BUILD_PPTP_DRIVER) + +@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_IPOE_DRIVER) + + if (BUILD_VLAN_MON_DRIVER) +@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_VLAN_MON_DRIVER) + + if (NOT BUILD_DRIVER_ONLY) diff --git a/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch b/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch new file mode 100644 index 00000000..8bccf3b2 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/kernel/0005-arm64-fix-relative-syscalltbl-path-in-Makefile.sysc.patch @@ -0,0 +1,57 @@ +From: Christian Breunig <christian@breunig.cc> +Date: Sat, 18 Jul 2026 18:30:00 +0000 +Subject: [PATCH] arm64: fix relative syscalltbl path in Makefile.syscalls + +Building the "linux-perf" Debian package (added by +0002-build-linux-perf-package.patch, via install_perf() invoking +"make -C tools/perf ... install") reproducibly fails on an arm64 build +host with: + + make[9]: *** No rule to make target + '.../tools/perf/libperf/arch/arm64/include/generated/uapi/asm/unistd_64.h'. + Stop. + +Root cause: tools/lib/perf/Makefile's "uapi-asm-generic:" recipe invokes +scripts/Makefile.asm-headers without "-C $(srctree)", so it inherits +whatever working directory tools/lib/perf/Makefile itself was invoked +with - which is tools/lib/perf/, not the kernel source root. This is +harmless for the generic default: + + syscalltbl := $(srctree)/scripts/syscall.tbl + +...which is absolute and thus resolves correctly regardless of the +working directory. arch/arm64/kernel/Makefile.syscalls, however, +overrides this with a relative path: + + syscalltbl = arch/arm64/tools/syscall_%.tbl + +When SRCARCH=arm64 (true both for the target kernel and, on a native +arm64 build host, for tools/perf's own build), this relative path is +looked up relative to tools/lib/perf/ instead of the kernel root, does +not exist there, and the "unistd_%.h" pattern rule that depends on it +can no longer be matched - so make reports no rule for the target at +all, rather than a missing-prerequisite error. + +This only surfaces on a native arm64 build host: on x86_64 hosts (the +common case for cross-building arm64 kernels) tools/perf builds for the +x86_64 host architecture, which has no such override and always uses +the safe, absolute default path. + +Fix by making arm64's override absolute too, matching the default and +every other reference in this file's callers. +--- + arch/arm64/kernel/Makefile.syscalls | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/Makefile.syscalls b/arch/arm64/kernel/Makefile.syscalls +index 0542a718871a..958f2335ec1b 100644 +--- a/arch/arm64/kernel/Makefile.syscalls ++++ b/arch/arm64/kernel/Makefile.syscalls +@@ -3,4 +3,4 @@ + syscall_abis_32 += + syscall_abis_64 += renameat rlimit memfd_secret + +-syscalltbl = arch/arm64/tools/syscall_%.tbl ++syscalltbl = $(srctree)/arch/arm64/tools/syscall_%.tbl +-- +2.39.5 diff --git a/scripts/package-build/linux-kernel/sign-modules.sh b/scripts/package-build/linux-kernel/sign-modules.sh index cfb368eb..1fb82165 100755 --- a/scripts/package-build/linux-kernel/sign-modules.sh +++ b/scripts/package-build/linux-kernel/sign-modules.sh @@ -1,15 +1,28 @@ -#!/bin/sh +#!/bin/sh -x BASE_DIR=$(dirname $0) MODULE_DIR=$1 +# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the +# .ko.xz it produces. Needed by callers whose build system tracks the +# uncompressed .ko as a build output (e.g. CMake custom commands) and +# would otherwise consider it missing and regenerate an unsigned copy. +KEEP_UNCOMPRESSED=$2 . ${BASE_DIR}/kernel-vars SIGN_FILE="${KERNEL_DIR}/scripts/sign-file" +CONFIG_FILE="${KERNEL_DIR}/.config" if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do echo "I: Signing ${MODULE} ..." ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE} + if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then + if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then + xz --compress --keep ${MODULE} + else + xz --compress ${MODULE} + fi + fi done + find ${MODULE_DIR} fi - diff --git a/scripts/package-build/openssl/package.toml b/scripts/package-build/openssl/package.toml index 6dfd32e0..b38022ca 100644 --- a/scripts/package-build/openssl/package.toml +++ b/scripts/package-build/openssl/package.toml @@ -2,4 +2,5 @@ name = "openssl" commit_id = "debian/openssl-3.0.20-1_deb12u2" scm_url = "https://salsa.debian.org/debian/openssl.git" -build_cmd = "dpkg-buildpackage -us -uc -tc -b" +pre_build_hook = "git reset --hard HEAD && git clean -ffdx" +build_cmd = "sed -i '1s/)/+vyos1)/' debian/changelog && dpkg-buildpackage -us -uc -tc -b" |