From 12038e88d4fe42617f9cd39ccfd1184a52e5810a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 8 Jul 2026 20:42:14 +0200 Subject: Kernel: T5641: module signing done by common config - remove from arm64 --- scripts/package-build/linux-kernel/config/arm64/vyos_defconfig | 8 -------- 1 file changed, 8 deletions(-) (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig index 5036c070..0cfe2cb7 100644 --- a/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig +++ b/scripts/package-build/linux-kernel/config/arm64/vyos_defconfig @@ -780,14 +780,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y CONFIG_MODVERSIONS=y CONFIG_ASM_MODVERSIONS=y # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_FORCE=y -CONFIG_MODULE_SIG_ALL=y -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA256 is not set -# CONFIG_MODULE_SIG_SHA384 is not set -CONFIG_MODULE_SIG_SHA512=y -CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" # CONFIG_TRIM_UNUSED_KSYMS is not set -- cgit v1.2.3 From 21c7e66112d3ec360a9902037d086fdb15e4ebeb Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 8 Jul 2026 20:45:13 +0200 Subject: Kernel: T5641: enable module compression to save disk space After signing the Linux Kernel modules with the ephemeral key, proceed by compressing the Kernel modules with xz to reduce the final ISO image size. Initial tests have shown a size reduction by 60MiB. --- .../linux-kernel/build-accel-ppp-ng.sh | 8 ++- .../linux-kernel/build-ipt-netflow.sh | 2 +- .../linux-kernel/config/02-module-signing.config | 6 ++ ...-package-signed-compressed-kernel-modules.patch | 66 ++++++++++++++++++++++ scripts/package-build/linux-kernel/sign-modules.sh | 17 +++++- 5 files changed, 94 insertions(+), 5 deletions(-) create mode 100644 scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh index 69e2cf30..aa1f8d12 100755 --- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh +++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh @@ -58,8 +58,12 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \ -DCPACK_TYPE=Debian12 .. CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make -# Sign generated Kernel modules -${CWD}/sign-modules.sh . +# Sign generated Kernel modules. Keep the uncompressed .ko next to the +# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of +# its install step, and if the .ko CMake tracks as a build output were +# removed by compression, it would be silently rebuilt unsigned before +# being packaged. +${CWD}/sign-modules.sh . --keep cpack -G DEB diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index bae4051b..2c7554fa 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -72,6 +72,6 @@ fpm --input-type dir --output-type deb --name vyos-ipt-netflow \ --description "ipt_NETFLOW module" \ --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \ --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \ - ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \ + ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \ libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \ libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so diff --git a/scripts/package-build/linux-kernel/config/02-module-signing.config b/scripts/package-build/linux-kernel/config/02-module-signing.config index d981ea63..3b98bc1e 100644 --- a/scripts/package-build/linux-kernel/config/02-module-signing.config +++ b/scripts/package-build/linux-kernel/config/02-module-signing.config @@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_MODULE_SIG_KEY_TYPE_RSA=y # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +CONFIG_MODULE_COMPRESS=y +# CONFIG_MODULE_COMPRESS_GZIP is not set +CONFIG_MODULE_COMPRESS_XZ=y +# CONFIG_MODULE_COMPRESS_ZSTD is not set +CONFIG_MODULE_COMPRESS_ALL=y +CONFIG_MODULE_DECOMPRESS=y diff --git a/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch new file mode 100644 index 00000000..d69ef038 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch @@ -0,0 +1,66 @@ +From: Christian Breunig +Date: Sun, 5 Jul 2026 00:00:00 +0200 +Subject: [PATCH] cmake: package signed/compressed kernel modules + +sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and, +if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ, +compresses them to .ko.xz before cpack packages the Debian archive. +The Debian packaging rules installed the drivers by their exact +pre-sign build path (*.ko) unconditionally, so a compressed build +never actually shipped the compressed module. Mirror sign-modules.sh's +own .config check to pick the extension that actually ends up on disk. + +--- + cmake/debian/debian.cmake | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake +index 8db274a..64b8f7d 100644 +--- a/cmake/debian/debian.cmake ++++ b/cmake/debian/debian.cmake +@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR) + ) + endif() + ++# sign-modules.sh signs the built .ko files and, if the target kernel's ++# .config has module compression enabled, xz-compresses them in place. ++# Mirror that check here so we install whichever artifact actually ends ++# up on disk. ++SET(KMOD_EXT ".ko") ++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config") ++ FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$") ++ IF (_ACCEL_PPP_KMOD_COMPRESS_XZ) ++ SET(KMOD_EXT ".ko.xz") ++ ENDIF () ++ENDIF () ++ + if (BUILD_PPTP_DRIVER) + if (BUILD_DRIVER_ONLY) + SET(CPACK_PACKAGE_VERSION_MAJOR "0") +@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () + #INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra) +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + #SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})") + endif (BUILD_PPTP_DRIVER) + +@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_IPOE_DRIVER) + + if (BUILD_VLAN_MON_DRIVER) +@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER) + SET(CPACK_DEBIAN_PACKAGE_DEPENDS "") + SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst") + endif () +- INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra) ++ INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra) + endif (BUILD_VLAN_MON_DRIVER) + + if (NOT BUILD_DRIVER_ONLY) diff --git a/scripts/package-build/linux-kernel/sign-modules.sh b/scripts/package-build/linux-kernel/sign-modules.sh index cfb368eb..1fb82165 100755 --- a/scripts/package-build/linux-kernel/sign-modules.sh +++ b/scripts/package-build/linux-kernel/sign-modules.sh @@ -1,15 +1,28 @@ -#!/bin/sh +#!/bin/sh -x BASE_DIR=$(dirname $0) MODULE_DIR=$1 +# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the +# .ko.xz it produces. Needed by callers whose build system tracks the +# uncompressed .ko as a build output (e.g. CMake custom commands) and +# would otherwise consider it missing and regenerate an unsigned copy. +KEEP_UNCOMPRESSED=$2 . ${BASE_DIR}/kernel-vars SIGN_FILE="${KERNEL_DIR}/scripts/sign-file" +CONFIG_FILE="${KERNEL_DIR}/.config" if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do echo "I: Signing ${MODULE} ..." ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE} + if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then + if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then + xz --compress --keep ${MODULE} + else + xz --compress ${MODULE} + fi + fi done + find ${MODULE_DIR} fi - -- cgit v1.2.3 From 2fde86f151627dc2940bbdd7e478d856f12f98f5 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 8 Jul 2026 20:46:50 +0200 Subject: Kernel: T5641: add --keep-kernel build option to not call "make mrproper" Option useful during development to not automatically clean the Linux Kernel source folder of all its intermediate files. --- scripts/package-build/linux-kernel/build.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py index 6cb6f90f..a5094914 100755 --- a/scripts/package-build/linux-kernel/build.py +++ b/scripts/package-build/linux-kernel/build.py @@ -274,6 +274,7 @@ if __name__ == '__main__': arg_parser.add_argument('--config', default='package.toml', help='Path to the package configuration file') arg_parser.add_argument('--packages', nargs='+', help='Names of packages to build (default: all)', default=[]) arg_parser.add_argument('--install-dependencies', '-i', help='Only install build dependencies', action='store_true') + arg_parser.add_argument('--keep-kernel', '-k', help='Keep kernel intermediate objects and not create source tar-ball', action='store_true') args = arg_parser.parse_args() # Load package configuration @@ -311,7 +312,7 @@ if __name__ == '__main__': # Copy generated .deb packages to parent directory copy_packages(Path(package['name'])) - if linux_kernel_tarball: + if linux_kernel_tarball and not args.keep_kernel: source_dir = linux_kernel_tarball['source_dir'] trusted_keys = f'{source_dir}/trusted_keys.pem' if os.path.exists(trusted_keys): -- cgit v1.2.3