Compare commits
No commits in common. 'c9' and 'i8c' have entirely different histories.
@ -1,3 +1,10 @@
|
||||
SOURCES/linux-5.14.0-284.30.1.rt14.315.el9_2.tar.xz
|
||||
SOURCES/centossecureboot201.cer
|
||||
SOURCES/centossecurebootca2.cer
|
||||
SOURCES/linux-4.18.0-553.33.1.rt7.374.el8_10.tar.xz
|
||||
SOURCES/redhatsecureboot302.cer
|
||||
SOURCES/redhatsecureboot303.cer
|
||||
SOURCES/redhatsecureboot501.cer
|
||||
SOURCES/redhatsecurebootca3.cer
|
||||
SOURCES/redhatsecurebootca7.cer
|
||||
SOURCES/rheldup3.x509
|
||||
SOURCES/rhelkpatch1.x509
|
||||
|
||||
@ -1,3 +1,10 @@
|
||||
0d802ace2aafef1924564fa2a4aaf518014e453d SOURCES/linux-5.14.0-284.30.1.rt14.315.el9_2.tar.xz
|
||||
2ba40bf9138b48311e5aa1b737b7f0a8ad66066f SOURCES/centossecureboot201.cer
|
||||
bfdb3d7cffc43f579655af5155d50c08671d95e5 SOURCES/centossecurebootca2.cer
|
||||
727272aa62f65db0438c0758f5ff9fa91d5f6f93 SOURCES/linux-4.18.0-553.33.1.rt7.374.el8_10.tar.xz
|
||||
13e5cd3f856b472fde80a4deb75f4c18dfb5b255 SOURCES/redhatsecureboot302.cer
|
||||
e89890ca0ded2f9058651cc5fa838b78db2e6cc2 SOURCES/redhatsecureboot303.cer
|
||||
ba0b760e594ff668ee72ae348adf3e49b97f75fb SOURCES/redhatsecureboot501.cer
|
||||
cf9230e69000076727e5b784ec871d22716dc5da SOURCES/redhatsecurebootca3.cer
|
||||
905d91a282727c7f5ad433a49ac42a0772311c6a SOURCES/redhatsecurebootca7.cer
|
||||
95b9b811c7b0a6c98b2eafc4e7d6d24f2cb63289 SOURCES/rheldup3.x509
|
||||
d90885108d225a234a5a9d054fc80893a5bd54d0 SOURCES/rhelkpatch1.x509
|
||||
|
||||
@ -1,69 +0,0 @@
|
||||
RHEL_MAJOR = 9
|
||||
RHEL_MINOR = 2
|
||||
|
||||
#
|
||||
# RHEL_RELEASE
|
||||
# -------------
|
||||
#
|
||||
# Represents build number in 'release' part of RPM's name-version-release.
|
||||
# name is <package_name>, e.g. kernel
|
||||
# version is upstream kernel version this kernel is based on, e.g. 4.18.0
|
||||
# release is <RHEL_RELEASE>.<dist_tag>[<buildid>], e.g. 100.el8
|
||||
#
|
||||
# Use this spot to avoid future merge conflicts.
|
||||
# Do not trim this comment.
|
||||
RHEL_RELEASE = 284.30.1
|
||||
|
||||
#
|
||||
# ZSTREAM
|
||||
# -------
|
||||
#
|
||||
# This variable controls whether we use zstream numbering or not for the
|
||||
# package release. The zstream release keeps the build number of the last
|
||||
# build done for ystream for the Beta milestone, and increments a second
|
||||
# number for each build. The third number is used for branched builds
|
||||
# (eg.: for builds with security fixes or hot fixes done outside of the
|
||||
# batch release process).
|
||||
#
|
||||
# For example, with ZSTREAM unset or set to "no", all builds will contain
|
||||
# a release with only the build number, eg.: kernel-<kernel version>-X.el*,
|
||||
# where X is the build number. With ZSTREAM set to "yes", we will have
|
||||
# builds with kernel-<kernel version>-X.Y.Z.el*, where X is the last
|
||||
# RHEL_RELEASE number before ZSTREAM flag was set to yes, Y will now be the
|
||||
# build number and Z will always be 1 except if you're doing a branched build
|
||||
# (when you give RHDISTGIT_BRANCH on the command line, in which case the Z
|
||||
# number will be incremented instead of the Y).
|
||||
#
|
||||
ZSTREAM ?= yes
|
||||
|
||||
#
|
||||
# Early y+1 numbering
|
||||
# --------------------
|
||||
#
|
||||
# In early y+1 process, RHEL_RELEASE consists of 2 numbers: x.y
|
||||
# First is RHEL_RELEASE inherited/merged from y as-is, second number
|
||||
# is incremented with each build starting from 1. After merge from y,
|
||||
# it resets back to 1. This way y+1 nvr reflects status of last merge.
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# rhel8.0 rhel-8.1
|
||||
# kernel-4.18.0-58.el8 --> kernel-4.18.0-58.1.el8
|
||||
# kernel-4.18.0-58.2.el8
|
||||
# kernel-4.18.0-59.el8 kernel-4.18.0-59.1.el8
|
||||
# kernel-4.18.0-60.el8
|
||||
# kernel-4.18.0-61.el8 --> kernel-4.18.0-61.1.el8
|
||||
#
|
||||
#
|
||||
# Use this spot to avoid future merge conflicts.
|
||||
# Do not trim this comment.
|
||||
EARLY_YSTREAM ?= no
|
||||
EARLY_YBUILD:=
|
||||
EARLY_YRELEASE:=
|
||||
ifneq ("$(ZSTREAM)", "yes")
|
||||
ifeq ("$(EARLY_YSTREAM)","yes")
|
||||
RHEL_RELEASE:=$(RHEL_RELEASE).$(EARLY_YRELEASE)
|
||||
endif
|
||||
endif
|
||||
|
||||
RTBUILD:=.315
|
||||
@ -1,25 +0,0 @@
|
||||
===================
|
||||
The Kernel dist-git
|
||||
===================
|
||||
|
||||
The kernel is maintained in a `source tree`_ rather than directly in dist-git.
|
||||
The specfile is maintained as a `template`_ in the source tree along with a set
|
||||
of build scripts to generate configurations, (S)RPMs, and to populate the
|
||||
dist-git repository.
|
||||
|
||||
The `documentation`_ for the source tree covers how to contribute and maintain
|
||||
the tree.
|
||||
|
||||
If you're looking for the downstream patch set it's available in the source
|
||||
tree with "git log master..ark-patches" or
|
||||
`online`_.
|
||||
|
||||
Each release in dist-git is tagged in the source repository so you can easily
|
||||
check out the source tree for a build. The tags are in the format
|
||||
name-version-release, but note release doesn't contain the dist tag since the
|
||||
source can be built in different build roots (Fedora, CentOS, etc.)
|
||||
|
||||
.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
|
||||
.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
|
||||
.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
|
||||
.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches
|
||||
@ -1,166 +0,0 @@
|
||||
#!/usr/bin/python3
|
||||
#
|
||||
# check-kabi - Red Hat kABI reference checking tool
|
||||
#
|
||||
# We use this script to check against reference Module.kabi files.
|
||||
#
|
||||
# Author: Jon Masters <jcm@redhat.com>
|
||||
# Copyright (C) 2007-2009 Red Hat, Inc.
|
||||
#
|
||||
# This software may be freely redistributed under the terms of the GNU
|
||||
# General Public License (GPL).
|
||||
|
||||
# Changelog:
|
||||
#
|
||||
# 2018/06/01 - Update for python3 by Petr Oros.
|
||||
# 2009/08/15 - Updated for use in RHEL6.
|
||||
# 2007/06/13 - Initial rewrite in python by Jon Masters.
|
||||
|
||||
__author__ = "Jon Masters <jcm@redhat.com>"
|
||||
__version__ = "2.0"
|
||||
__date__ = "2009/08/15"
|
||||
__copyright__ = "Copyright (C) 2007-2009 Red Hat, Inc"
|
||||
__license__ = "GPL"
|
||||
|
||||
import getopt
|
||||
import string
|
||||
import sys
|
||||
|
||||
true = 1
|
||||
false = 0
|
||||
|
||||
|
||||
def load_symvers(symvers, filename):
|
||||
"""Load a Module.symvers file."""
|
||||
|
||||
symvers_file = open(filename, "r")
|
||||
|
||||
while true:
|
||||
in_line = symvers_file.readline()
|
||||
if in_line == "":
|
||||
break
|
||||
if in_line == "\n":
|
||||
continue
|
||||
checksum, symbol, directory, type, *ns = in_line.split()
|
||||
ns = ns[0] if ns else None
|
||||
|
||||
symvers[symbol] = in_line[0:-1]
|
||||
|
||||
|
||||
def load_kabi(kabi, filename):
|
||||
"""Load a Module.kabi file."""
|
||||
|
||||
kabi_file = open(filename, "r")
|
||||
|
||||
while true:
|
||||
in_line = kabi_file.readline()
|
||||
if in_line == "":
|
||||
break
|
||||
if in_line == "\n":
|
||||
continue
|
||||
checksum, symbol, directory, type, *ns = in_line.split()
|
||||
ns = ns[0] if ns else None
|
||||
|
||||
kabi[symbol] = in_line[0:-1]
|
||||
|
||||
|
||||
def check_kabi(symvers, kabi):
|
||||
"""Check Module.kabi and Module.symvers files."""
|
||||
|
||||
fail = 0
|
||||
warn = 0
|
||||
changed_symbols = []
|
||||
moved_symbols = []
|
||||
ns_symbols = []
|
||||
|
||||
for symbol in kabi:
|
||||
abi_hash, abi_sym, abi_dir, abi_type, *abi_ns = kabi[symbol].split()
|
||||
abi_ns = abi_ns[0] if abi_ns else None
|
||||
if symbol in symvers:
|
||||
sym_hash, sym_sym, sym_dir, sym_type, *sym_ns = symvers[symbol].split()
|
||||
sym_ns = sym_ns[0] if sym_ns else None
|
||||
if abi_hash != sym_hash:
|
||||
fail = 1
|
||||
changed_symbols.append(symbol)
|
||||
|
||||
if abi_dir != sym_dir:
|
||||
warn = 1
|
||||
moved_symbols.append(symbol)
|
||||
|
||||
if abi_ns != sym_ns:
|
||||
warn = 1
|
||||
ns_symbols.append(symbol)
|
||||
else:
|
||||
fail = 1
|
||||
changed_symbols.append(symbol)
|
||||
|
||||
if fail:
|
||||
print("*** ERROR - ABI BREAKAGE WAS DETECTED ***")
|
||||
print("")
|
||||
print("The following symbols have been changed (this will cause an ABI breakage):")
|
||||
print("")
|
||||
for symbol in changed_symbols:
|
||||
print(symbol)
|
||||
print("")
|
||||
|
||||
if warn:
|
||||
print("*** WARNING - ABI SYMBOLS MOVED ***")
|
||||
if moved_symbols:
|
||||
print("")
|
||||
print("The following symbols moved (typically caused by moving a symbol from being")
|
||||
print("provided by the kernel vmlinux out to a loadable module):")
|
||||
print("")
|
||||
for symbol in moved_symbols:
|
||||
print(symbol)
|
||||
print("")
|
||||
if ns_symbols:
|
||||
print("")
|
||||
print("The following symbols changed symbol namespaces:")
|
||||
print("")
|
||||
for symbol in ns_symbols:
|
||||
print(symbol)
|
||||
print("")
|
||||
|
||||
"""Halt the build, if we got errors and/or warnings. In either case,
|
||||
double-checkig is required to avoid introducing / concealing
|
||||
KABI inconsistencies."""
|
||||
if fail or warn:
|
||||
sys.exit(1)
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
def usage():
|
||||
print("""
|
||||
check-kabi: check Module.kabi and Module.symvers files.
|
||||
|
||||
check-kabi [ -k Module.kabi ] [ -s Module.symvers ]
|
||||
|
||||
""")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
symvers_file = ""
|
||||
kabi_file = ""
|
||||
|
||||
opts, args = getopt.getopt(sys.argv[1:], 'hk:s:')
|
||||
|
||||
for o, v in opts:
|
||||
if o == "-s":
|
||||
symvers_file = v
|
||||
if o == "-h":
|
||||
usage()
|
||||
sys.exit(0)
|
||||
if o == "-k":
|
||||
kabi_file = v
|
||||
|
||||
if (symvers_file == "") or (kabi_file == ""):
|
||||
usage()
|
||||
sys.exit(1)
|
||||
|
||||
symvers = {}
|
||||
kabi = {}
|
||||
|
||||
load_symvers(symvers, symvers_file)
|
||||
load_kabi(kabi, kabi_file)
|
||||
check_kabi(symvers, kabi)
|
||||
@ -1,38 +0,0 @@
|
||||
# generic + compressed please
|
||||
hostonly="no"
|
||||
compress="xz"
|
||||
|
||||
# VMs can't update microcode anyway
|
||||
early_microcode="no"
|
||||
|
||||
# modules: basics
|
||||
dracutmodules+=" base systemd systemd-initrd dracut-systemd dbus dbus-broker usrmount shutdown "
|
||||
|
||||
# modules: storage support
|
||||
dracutmodules+=" dm lvm rootfs-block fs-lib "
|
||||
|
||||
# modules: tpm and crypto
|
||||
dracutmodules+=" crypt crypt-loop tpm2-tss "
|
||||
|
||||
# WALinuxagent-cvm with CVM specific udev rules
|
||||
dracutmodules+=" walinuxagentcvm "
|
||||
|
||||
# drivers: virtual buses, pci
|
||||
drivers+=" virtio-pci virtio-mmio " # qemu-kvm
|
||||
drivers+=" hv-vmbus pci-hyperv " # hyperv
|
||||
drivers+=" xen-pcifront " # xen
|
||||
|
||||
# drivers: storage
|
||||
drivers+=" ahci nvme sd_mod sr_mod " # generic
|
||||
drivers+=" virtio-blk virtio-scsi " # qemu-kvm
|
||||
drivers+=" hv-storvsc " # hyperv
|
||||
drivers+=" xen-blkfront " # xen
|
||||
|
||||
# root encryption
|
||||
drivers+=" dm_crypt "
|
||||
|
||||
# filesystems
|
||||
filesystems+=" vfat ext4 xfs overlay "
|
||||
|
||||
# systemd-pcrphase
|
||||
install_items+=" /lib/systemd/system/systemd-pcrphase-initrd.service /usr/lib/systemd/systemd-pcrphase /usr/lib/systemd/system/initrd.target.wants/systemd-pcrphase-initrd.service "
|
||||
@ -1,6 +1,6 @@
|
||||
--- !Policy
|
||||
product_versions:
|
||||
- rhel-9
|
||||
- rhel-8
|
||||
decision_context: osci_compose_gate
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: cki.tier1-x86_64.functional}
|
||||
|
||||
@ -0,0 +1,31 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
. /etc/os-release
|
||||
|
||||
kernelver=$1 && shift
|
||||
rootfs=$1 && shift
|
||||
variant=$1 && shift
|
||||
|
||||
output="${rootfs}/lib/modules/${kernelver}/bls.conf"
|
||||
date=$(date -u +%Y%m%d%H%M%S)
|
||||
|
||||
if [ "${variant:-5}" = "debug" ]; then
|
||||
debugname=" with debugging"
|
||||
debugid="-debug"
|
||||
else
|
||||
debugname=""
|
||||
debugid=""
|
||||
fi
|
||||
|
||||
cat >${output} <<EOF
|
||||
title ${NAME} (${kernelver}) ${VERSION}${debugname}
|
||||
version ${kernelver}${debugid}
|
||||
linux ${bootprefix}/vmlinuz-${kernelver}
|
||||
initrd ${bootprefix}/initramfs-${kernelver}.img
|
||||
options \$kernelopts
|
||||
id ${ID}-${date}-${kernelver}${debugid}
|
||||
grub_users \$grub_users
|
||||
grub_arg --unrestricted
|
||||
grub_class kernel${variant}
|
||||
EOF
|
||||
@ -1,2 +0,0 @@
|
||||
# This file is intentionally left empty in the stock kernel. Its a nicety
|
||||
# added for those wanting to do custom rebuilds with altered config opts.
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,72 +0,0 @@
|
||||
#! /usr/bin/perl
|
||||
|
||||
my @args=@ARGV;
|
||||
my %configvalues;
|
||||
my @configoptions;
|
||||
my $configcounter = 0;
|
||||
|
||||
# optionally print out the architecture as the first line of our output
|
||||
my $arch = $args[2];
|
||||
if (defined $arch) {
|
||||
print "# $arch\n";
|
||||
}
|
||||
|
||||
# first, read the override file
|
||||
|
||||
open (FILE,"$args[0]") || die "Could not open $args[0]";
|
||||
while (<FILE>) {
|
||||
my $str = $_;
|
||||
my $configname;
|
||||
|
||||
if (/\# ([\w]+) is not set/) {
|
||||
$configname = $1;
|
||||
} elsif (/^\#/) {
|
||||
# fall through on comments like 'avoid CONFIG_FOO=y'
|
||||
;
|
||||
} elsif (/([\w]+)=/) {
|
||||
$configname = $1;
|
||||
}
|
||||
|
||||
if (defined($configname) && !exists($configvalues{$configname})) {
|
||||
$configvalues{$configname} = $str;
|
||||
$configoptions[$configcounter] = $configname;
|
||||
$configcounter ++;
|
||||
}
|
||||
};
|
||||
|
||||
# now, read and output the entire configfile, except for the overridden
|
||||
# parts... for those the new value is printed.
|
||||
|
||||
open (FILE2,"$args[1]") || die "Could not open $args[1]";
|
||||
while (<FILE2>) {
|
||||
my $configname;
|
||||
|
||||
if (/\# ([\w]+) is not set/) {
|
||||
$configname = $1;
|
||||
} elsif (/^\#/) {
|
||||
# fall through on comments like 'avoid CONFIG_FOO=y'
|
||||
;
|
||||
} elsif (/([\w]+)=/) {
|
||||
$configname = $1;
|
||||
}
|
||||
|
||||
if (defined($configname) && exists($configvalues{$configname})) {
|
||||
print "$configvalues{$configname}";
|
||||
delete($configvalues{$configname});
|
||||
} else {
|
||||
print "$_";
|
||||
}
|
||||
}
|
||||
|
||||
# now print the new values from the overridden configfile
|
||||
my $counter = 0;
|
||||
|
||||
while ($counter < $configcounter) {
|
||||
my $configname = $configoptions[$counter];
|
||||
if (exists($configvalues{$configname})) {
|
||||
print "$configvalues{$configname}";
|
||||
}
|
||||
$counter++;
|
||||
}
|
||||
|
||||
1;
|
||||
@ -1,3 +0,0 @@
|
||||
afs
|
||||
rxperf
|
||||
rxrpc
|
||||
@ -1,5 +0,0 @@
|
||||
# kgcov
|
||||
CONFIG_GCOV_KERNEL=y
|
||||
CONFIG_GCOV_PROFILE_ALL=y
|
||||
# CONFIG_GCOV_PROFILE_FTRACE is not set
|
||||
# CONFIG_OPEN_DICE is not set
|
||||
@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET="$1"
|
||||
|
||||
for i in "$RPM_SOURCE_DIR"/*."$TARGET"; do
|
||||
NEW=${i%.$TARGET}
|
||||
cp "$i" "$(basename "$NEW")"
|
||||
done
|
||||
@ -1,16 +0,0 @@
|
||||
[ req ]
|
||||
default_bits = 3072
|
||||
distinguished_name = req_distinguished_name
|
||||
prompt = no
|
||||
x509_extensions = myexts
|
||||
|
||||
[ req_distinguished_name ]
|
||||
O = The CentOS Project
|
||||
CN = CentOS Stream kernel signing key
|
||||
emailAddress = security@centos.org
|
||||
|
||||
[ myexts ]
|
||||
basicConstraints=critical,CA:FALSE
|
||||
keyUsage=digitalSignature
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue