From b36f771b3242817fad07c2dbbf7c410770521e44 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Mon, 23 Mar 2026 22:24:54 -0700 Subject: [PATCH 1/4] feat: Generate config and apply needed changes with new kernel-configurator action --- .github/workflows/arch.yaml | 69 +- .github/workflows/fedora.yaml | 72 +- .github/workflows/ubuntu.yaml | 65 +- arch/PKGBUILD | 2 - arch/config | 1 - arch/config.set | 3 + arch/config.unset | 5 + config | 12533 -------------------------------- fedora/config | 1 - fedora/config.set | 5 + fedora/config.unset | 4 + fedora/kernel.spec | 5 +- global.config.set | 84 + global.config.unset | 30 + ubuntu/config | 1 - ubuntu/config.set | 3 + ubuntu/config.unset | 5 + 17 files changed, 295 insertions(+), 12593 deletions(-) delete mode 120000 arch/config create mode 100644 arch/config.set create mode 100644 arch/config.unset delete mode 100644 config delete mode 120000 fedora/config create mode 100644 fedora/config.set create mode 100644 fedora/config.unset create mode 100644 global.config.set create mode 100644 global.config.unset delete mode 120000 ubuntu/config create mode 100644 ubuntu/config.set create mode 100644 ubuntu/config.unset diff --git a/.github/workflows/arch.yaml b/.github/workflows/arch.yaml index 87da241..97e9979 100644 --- a/.github/workflows/arch.yaml +++ b/.github/workflows/arch.yaml @@ -73,28 +73,69 @@ jobs: - name: Install dependencies run: | - pacman -Syu --noconfirm bc cpio gettext jq libelf pahole perl python rust rust-bindgen rust-src tar xz graphviz imagemagick python-sphinx python-yaml texlive-latexextra sed + pacman -Syu --noconfirm bc cpio gettext jq libelf pahole perl python rust rust-bindgen rust-src tar xz graphviz imagemagick python-sphinx python-yaml texlive-latexextra sed wget - - name: Configure AppArmor as default LSM + - name: Get version + id: version + shell: bash + run: | + if [ -n "${{ github.event.inputs.version }}" ]; then + OGC_VERSION="${{ github.event.inputs.version }}" + else + TAG="${{ github.ref_name }}" + OGC_VERSION="${TAG#v}" + fi + KERNEL_VERSION="${OGC_VERSION%-ogc*}" + MAJOR_VERSION="${KERNEL_VERSION%%.*}.x" + echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" + echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" + echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" + + - name: Download and extract kernel source + shell: bash + run: | + KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + MAJOR_VERSION="${{ steps.version.outputs.major_version }}" + OGC_VERSION="${{ steps.version.outputs.ogc_version }}" + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + tar -xf linux-${KERNEL_VERSION}.tar.xz + cd linux-${KERNEL_VERSION} + patch -Np1 < ../monolithic.patch + + - name: Generate default config + shell: bash run: | - sed -i 's/^CONFIG_LSM=.*/CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor,bpf"/' config + cd linux-${{ steps.version.outputs.kernel_version }} + make defconfig + + - name: Configure kernel + uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 + with: + config: linux-${{ steps.version.outputs.kernel_version }}/.config + set: | + global.config.set + arch/config.set + unset: | + global.config.unset + arch/config.unset - name: Build linux package id: build-kernel-package shell: bash run: | - su build bash -c "cd /home/build/linux/arch && MAKEFLAGS=-j$(nproc) makepkg --skippgpcheck" + KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + # Pre-populate makepkg source cache + cp linux-${KERNEL_VERSION}.tar.xz /home/build/linux/arch/ + cp monolithic.patch /home/build/linux/arch/ + # Copy patched config + cp linux-${KERNEL_VERSION}/.config /home/build/linux/arch/config + chown -R build /home/build/linux + su build bash -c "cd /home/build/linux/arch && MAKEFLAGS=-j$(nproc) makepkg --skippgpcheck --skipchecksums --skipinteg" . /home/build/linux/arch/PKGBUILD full_version=${pkgver}-${pkgrel} echo "full_version=$full_version" >> "$GITHUB_OUTPUT" - - name: Get OGC version - if: startsWith(github.ref, 'refs/tags/') - id: version - run: | - TAG="${{ github.ref_name }}" - echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" - - name: Setup ORAS if: startsWith(github.ref, 'refs/tags/') uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1 @@ -112,7 +153,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') id: push run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cd /home/build/linux/arch DIGEST=$(oras push --format json "${REPO}:${VERSION}" ./*.pkg.tar.zst | jq -r '.digest') @@ -134,7 +175,7 @@ jobs: - name: Sign artifacts if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign sign --yes "${REPO}:${VERSION}" cosign sign --yes "${REPO}:latest" @@ -142,7 +183,7 @@ jobs: - name: Verify signature if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign verify \ --certificate-identity-regexp=".*" \ diff --git a/.github/workflows/fedora.yaml b/.github/workflows/fedora.yaml index 50ecdff..0ff067f 100644 --- a/.github/workflows/fedora.yaml +++ b/.github/workflows/fedora.yaml @@ -61,28 +61,66 @@ jobs: - name: Dependencies run: | dnf -y builddep fedora/kernel.spec - dnf -y install jq sed + dnf -y install jq sed wget - - name: Configure SELinux as default LSM + - name: Get version + id: version + shell: bash run: | - sed -i 's/^CONFIG_LSM=.*/CONFIG_LSM="landlock,lockdown,yama,integrity,selinux,bpf"/' config + if [ -n "${{ github.event.inputs.version }}" ]; then + OGC_VERSION="${{ github.event.inputs.version }}" + else + TAG="${{ github.ref_name }}" + OGC_VERSION="${TAG#v}" + fi + KERNEL_VERSION="${OGC_VERSION%-ogc*}" + MAJOR_VERSION="${KERNEL_VERSION%%.*}.x" + echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" + echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" + echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" - - name: build + - name: Download and extract kernel source + shell: bash run: | - TOPDIR="$(pwd)/rpmbuild" + KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + MAJOR_VERSION="${{ steps.version.outputs.major_version }}" + OGC_VERSION="${{ steps.version.outputs.ogc_version }}" + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + tar -xf linux-${KERNEL_VERSION}.tar.xz + cd linux-${KERNEL_VERSION} + patch -Np1 < ../monolithic.patch + + - name: Generate default config + shell: bash + run: | + cd linux-${{ steps.version.outputs.kernel_version }} + make defconfig + - name: Configure kernel + uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 + with: + config: linux-${{ steps.version.outputs.kernel_version }}/.config + set: | + global.config.set + fedora/config.set + unset: | + global.config.unset + fedora/config.unset + + - name: Build + run: | + KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TOPDIR="$(pwd)/rpmbuild" mkdir -p "$TOPDIR"/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} - cp fedora/* $TOPDIR/SOURCES - + # Pre-populate SOURCES with already-downloaded files + cp linux-${KERNEL_VERSION}.tar.xz "$TOPDIR/SOURCES/" + cp monolithic.patch "$TOPDIR/SOURCES/" + cp fedora/kvm_stat.logrotate "$TOPDIR/SOURCES/" + # Copy patched config + cp linux-${KERNEL_VERSION}/.config "$TOPDIR/SOURCES/config" rpmbuild --define "_topdir $TOPDIR" -ba ./fedora/kernel.spec - - name: Get OGC version - if: startsWith(github.ref, 'refs/tags/') - id: version - run: | - TAG="${{ github.ref_name }}" - echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" - - name: Setup ORAS if: startsWith(github.ref, 'refs/tags/') uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1 @@ -100,7 +138,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') id: push run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" TOPDIR="$(pwd)/rpmbuild" mkdir -p /tmp/rpms @@ -126,7 +164,7 @@ jobs: - name: Sign artifacts if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign sign --yes "${REPO}:${VERSION}" cosign sign --yes "${REPO}:latest" @@ -134,7 +172,7 @@ jobs: - name: Verify signature if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign verify \ --certificate-identity-regexp=".*" \ diff --git a/.github/workflows/ubuntu.yaml b/.github/workflows/ubuntu.yaml index 81b9572..eb99e1a 100644 --- a/.github/workflows/ubuntu.yaml +++ b/.github/workflows/ubuntu.yaml @@ -65,28 +65,53 @@ jobs: apt-get install -y build-essential devscripts debhelper dh-python asciidoc-base bc bison cpio dwarves flex jq kmod libdw-dev libiberty-dev libnuma-dev libslang2-dev lz4 rsync wget xmlto git curl sed apt-get install -y libunwind-dev libpfm4-dev coccinelle openjdk-17-jdk libcapstone-dev libbabeltrace-dev systemtap-sdt-dev libzstd-dev dwarves zstd libbfd-dev libperl-dev libssl-dev - - name: Get sources + - name: Get version + id: version + shell: bash run: | - wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.19.8.tar.xz - wget https://github.com/OpenGamingCollective/linux/releases/download/v6.19.8-ogc1/monolithic.patch - tar -xf linux-6.19.8.tar.xz - cd linux-6.19.8 - cp ../config .config - sed -i 's/^CONFIG_LSM=.*/CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor,bpf"/' .config - patch -Np1 < "../monolithic.patch" + if [ -n "${{ github.event.inputs.version }}" ]; then + OGC_VERSION="${{ github.event.inputs.version }}" + else + TAG="${{ github.ref_name }}" + OGC_VERSION="${TAG#v}" + fi + KERNEL_VERSION="${OGC_VERSION%-ogc*}" + MAJOR_VERSION="${KERNEL_VERSION%%.*}.x" + echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" + echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" + echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" - - name: Build + - name: Download and extract kernel source run: | - cd linux-6.19.8 - make olddefconfig - fakeroot make -j$(nproc) bindeb-pkg + KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + MAJOR_VERSION="${{ steps.version.outputs.major_version }}" + OGC_VERSION="${{ steps.version.outputs.ogc_version }}" + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + tar -xf linux-${KERNEL_VERSION}.tar.xz + cd linux-${KERNEL_VERSION} + patch -Np1 < ../monolithic.patch + + - name: Generate default config + run: | + cd linux-${{ steps.version.outputs.kernel_version }} + make defconfig - - name: Get OGC version - if: startsWith(github.ref, 'refs/tags/') - id: version + - name: Configure kernel + uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 + with: + config: linux-${{ steps.version.outputs.kernel_version }}/.config + set: | + global.config.set + ubuntu/config.set + unset: | + global.config.unset + ubuntu/config.unset + + - name: Build run: | - TAG="${{ github.ref_name }}" - echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" + cd linux-${{ steps.version.outputs.kernel_version }} + fakeroot make -j$(nproc) bindeb-pkg - name: Setup ORAS if: startsWith(github.ref, 'refs/tags/') @@ -105,7 +130,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') id: push run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cd $GITHUB_WORKSPACE DIGEST=$(oras push --format json "${REPO}:${VERSION}" ./*.deb | jq -r '.digest') @@ -127,7 +152,7 @@ jobs: - name: Sign artifacts if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign sign --yes "${REPO}:${VERSION}" cosign sign --yes "${REPO}:latest" @@ -135,7 +160,7 @@ jobs: - name: Verify signature if: startsWith(github.ref, 'refs/tags/') run: | - VERSION="${{ steps.version.outputs.version }}" + VERSION="${{ steps.version.outputs.ogc_version }}" REPO="${{ env.OCI_REPO }}" cosign verify \ --certificate-identity-regexp=".*" \ diff --git a/arch/PKGBUILD b/arch/PKGBUILD index ff8b697..80f0e34 100644 --- a/arch/PKGBUILD +++ b/arch/PKGBUILD @@ -80,8 +80,6 @@ prepare() { echo "Setting config..." cp ../config .config - make olddefconfig - diff -u ../config .config || : make -s kernelrelease > version echo "Prepared $pkgbase version $(= 37 @@ -354,9 +354,6 @@ scripts/config -u DEFAULT_HOSTNAME # Set kernel version string as build salt scripts/config --set-str BUILD_SALT "%{kverstr}" -# Finalize the patched config -make %{?_smp_mflags} %{?llvm_build_env_vars} EXTRAVERSION=-%{krelstr} olddefconfig - # Save configuration for later reuse cat .config > config-linux-ogc diff --git a/global.config.set b/global.config.set new file mode 100644 index 0000000..f915299 --- /dev/null +++ b/global.config.set @@ -0,0 +1,84 @@ +# Gaming +CONFIG_NTSYNC=m + +# ASUS Ally +CONFIG_HID_ASUS=m +CONFIG_HID_ASUS_ALLY=m + +# Legion GO +CONFIG_HID_LENOVO=m +CONFIG_HID_LENOVO_GO=m +CONFIG_HID_LENOVO_GO_S=m +CONFIG_LENOVO_WMI_CAPDATA=m + +# ASUS Ally & Legion GO Gyro +CONFIG_IIO_SYSFS_TRIGGER=m +CONFIG_IIO_HRTIMER_TRIGGER=m + +# Steam Deck +CONFIG_MFD_STEAMDECK=m +CONFIG_SENSORS_STEAMDECK=m +CONFIG_LEDS_STEAMDECK=m +CONFIG_EXTCON_STEAMDECK=m +CONFIG_USB_DWC3=m +CONFIG_USB_DWC3_ULPI=y +CONFIG_USB_DWC3_DUAL_ROLE=y +CONFIG_USB_DWC3_PCI=m +CONFIG_USB_DWC3_HAPS=m +CONFIG_USB_DWC2=m +CONFIG_USB_DWC2_DUAL_ROLE=y +CONFIG_USB_DWC2_PCI=m +CONFIG_USB_CHIPIDEA=m +CONFIG_USB_CHIPIDEA_UDC=y +CONFIG_USB_CHIPIDEA_HOST=y +CONFIG_USB_CHIPIDEA_PCI=m +CONFIG_USB_CHIPIDEA_MSM=m +CONFIG_USB_CHIPIDEA_GENERIC=m +CONFIG_USB_ISP1760=m +CONFIG_USB_ISP1760_HCD=y +CONFIG_USB_ISP1761_UDC=y +CONFIG_USB_ISP1760_DUAL_ROLE=y +CONFIG_USB_GADGET=m +CONFIG_USB_GADGET_VBUS_DRAW=2 +CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 +CONFIG_SND_SOC_AMD_ACP_COMMON=m +CONFIG_SND_SPI=y +CONFIG_SND_SOC_AMD_SOF_MACH=m +CONFIG_SND_SOC_AMD_MACH_COMMON=m +CONFIG_SND_SOC_SOF=m +CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE=y +CONFIG_SND_SOC_SOF_IPC3=y +CONFIG_SND_SOC_SOF_INTEL_IPC4=y +CONFIG_SND_SOC_SOF_AMD_COMMON=m +CONFIG_SND_SOC_SOF_AMD_ACP63=m +CONFIG_SND_SOC_TOPOLOGY=y + +# Framework Laptops/Desktop +CONFIG_CROS_EC=m +CONFIG_CROS_EC_CHARDEV=m +CONFIG_CROS_EC_I2C=m +CONFIG_CROS_EC_LIGHTBAR=m +CONFIG_CROS_EC_LPC=m +CONFIG_CROS_EC_MKBP_PROXIMITY=m +CONFIG_CROS_EC_PROTO=m +CONFIG_CROS_EC_RPMSG=m +CONFIG_CROS_EC_SENSORHUB=m +CONFIG_CROS_EC_SPI=m +CONFIG_CROS_EC_SYSFS=m +CONFIG_CROS_EC_TYPEC=m +CONFIG_CROS_EC_UART=m +CONFIG_CROS_EC_UCSI=m +CONFIG_CROS_EC_WATCHDOG=m +CONFIG_CROS_HPS_I2C=m +CONFIG_CROS_KBD_LED_BACKLIGHT=m +CONFIG_CROS_KUNIT=m +CONFIG_CROS_KUNIT_EC_PROTO_TEST=m +CONFIG_CROS_TYPEC_SWITCH=m +CONFIG_CROS_USBPD_LOGGER=m +CONFIG_CROS_USBPD_NOTIFY=m +CONFIG_CROSS_MEMORY_ATTACH=y + +# Waydroid +CONFIG_ANDROID_BINDER_IPC=y +CONFIG_ANDROID_BINDERFS=y +CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder" \ No newline at end of file diff --git a/global.config.unset b/global.config.unset new file mode 100644 index 0000000..f0c837e --- /dev/null +++ b/global.config.unset @@ -0,0 +1,30 @@ +# Steam Deck +CONFIG_USB_DWC3_HOST +CONFIG_USB_DWC2_DEBUG +CONFIG_USB_DWC2_TRACK_MISSED_SOFS +CONFIG_USB_GADGET_DEBUG +CONFIG_USB_GADGET_DEBUG_FILES +CONFIG_USB_GADGET_DEBUG_FS +CONFIG_U_SERIAL_CONSOLE +CONFIG_USB_R8A66597 +CONFIG_USB_PXA27X +CONFIG_USB_MV_UDC +CONFIG_USB_MV_U3D +CONFIG_USB_M66592 +CONFIG_USB_BDC_UDC +CONFIG_USB_AMD5536UDC +CONFIG_USB_NET2272 +CONFIG_USB_NET2280 +CONFIG_USB_GOKU +CONFIG_USB_EG20T +CONFIG_USB_DUMMY_HCD +CONFIG_USB_CONFIGFS +CONFIG_PHY_SAMSUNG_USB2 +CONFIG_SND_SOC_AMD_ACP_PCI +CONFIG_SND_AMD_ASOC_RENOIR +CONFIG_SND_AMD_ASOC_REMBRANDT +CONFIG_SND_SOC_AMD_LEGACY_MACH + +# Framework Laptops/Desktop +CONFIG_CROS_EC_DEBUGFS +CONFIG_CROS_EC_ISHTP \ No newline at end of file diff --git a/ubuntu/config b/ubuntu/config deleted file mode 120000 index 3ca249e..0000000 --- a/ubuntu/config +++ /dev/null @@ -1 +0,0 @@ -../config \ No newline at end of file diff --git a/ubuntu/config.set b/ubuntu/config.set new file mode 100644 index 0000000..50a3603 --- /dev/null +++ b/ubuntu/config.set @@ -0,0 +1,3 @@ +# Ubuntu +CONFIG_DEFAULT_SECURITY_APPARMOR=y +CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor,bpf" \ No newline at end of file diff --git a/ubuntu/config.unset b/ubuntu/config.unset new file mode 100644 index 0000000..208d97b --- /dev/null +++ b/ubuntu/config.unset @@ -0,0 +1,5 @@ +# Ubuntu +CONFIG_DEFAULT_SECURITY_SELINUX +CONFIG_DEFAULT_SECURITY_SMACK +CONFIG_DEFAULT_SECURITY_TOMOYO +CONFIG_DEFAULT_SECURITY_DAC \ No newline at end of file From 2d3eeb46bb686f23423cf180cefd3da16ff75f54 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Tue, 24 Mar 2026 17:59:19 -0700 Subject: [PATCH 2/4] fix: Apply OpenSSF recommendations for permissions --- .github/workflows/arch.yaml | 10 +++++++--- .github/workflows/fedora.yaml | 10 +++++++--- .github/workflows/ubuntu.yaml | 10 +++++++--- 3 files changed, 21 insertions(+), 9 deletions(-) diff --git a/.github/workflows/arch.yaml b/.github/workflows/arch.yaml index 97e9979..67e4b6f 100644 --- a/.github/workflows/arch.yaml +++ b/.github/workflows/arch.yaml @@ -15,9 +15,6 @@ env: permissions: contents: read - packages: write - id-token: write - attestations: write concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -27,6 +24,13 @@ jobs: build-arch: runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + attestations: write + artifact-metadata: write + container: image: docker.io/archlinux:base-devel volumes: diff --git a/.github/workflows/fedora.yaml b/.github/workflows/fedora.yaml index 0ff067f..d5f8e95 100644 --- a/.github/workflows/fedora.yaml +++ b/.github/workflows/fedora.yaml @@ -15,9 +15,6 @@ env: permissions: contents: read - packages: write - id-token: write - attestations: write concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -27,6 +24,13 @@ jobs: build-rpm: runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + attestations: write + artifact-metadata: write + container: image: fedora:latest volumes: diff --git a/.github/workflows/ubuntu.yaml b/.github/workflows/ubuntu.yaml index eb99e1a..04ab8be 100644 --- a/.github/workflows/ubuntu.yaml +++ b/.github/workflows/ubuntu.yaml @@ -15,9 +15,6 @@ env: permissions: contents: read - packages: write - id-token: write - attestations: write concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -27,6 +24,13 @@ jobs: build-deb: runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + attestations: write + artifact-metadata: write + container: image: ubuntu:latest volumes: From 6b589ced2721f11fb68acbcb8600516849f7a744 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Tue, 24 Mar 2026 19:10:27 -0700 Subject: [PATCH 3/4] feat: Verify kernel sources via gpg fix: Set kernel version in all 3 build systems dynamically based on the OGC version --- .github/workflows/arch.yaml | 64 +++++++++++++++++++++++++---------- .github/workflows/fedora.yaml | 59 ++++++++++++++++++++++++-------- .github/workflows/ubuntu.yaml | 37 +++++++++++++++----- arch/PKGBUILD | 22 +++--------- fedora/kernel.spec | 24 ++++--------- 5 files changed, 130 insertions(+), 76 deletions(-) diff --git a/.github/workflows/arch.yaml b/.github/workflows/arch.yaml index 67e4b6f..41adc17 100644 --- a/.github/workflows/arch.yaml +++ b/.github/workflows/arch.yaml @@ -62,13 +62,6 @@ jobs: with: persist-credentials: false - - name: Create build user - run: | - useradd -m build - mkdir -p /home/build/linux - cp -vR * /home/build/linux - chown -vR build /home/build/linux - - name: Set up pacman keyring run: | pacman-key --init @@ -94,29 +87,66 @@ jobs: echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" + OGC_REV="${OGC_VERSION##*-ogc}" + BASE_KVER="${KERNEL_VERSION%.*}" + STABLE_KVER="${KERNEL_VERSION##*.}" + if [ "$STABLE_KVER" = "0" ]; then + TAR_KVER="$BASE_KVER" + else + TAR_KVER="$KERNEL_VERSION" + fi + echo "ogc_rev=$OGC_REV" >> "$GITHUB_OUTPUT" + echo "base_kver=$BASE_KVER" >> "$GITHUB_OUTPUT" + echo "stable_kver=$STABLE_KVER" >> "$GITHUB_OUTPUT" + echo "tar_kver=$TAR_KVER" >> "$GITHUB_OUTPUT" + + - name: Substitute versions + shell: bash + run: | + OGC_VERSION="${{ steps.version.outputs.ogc_version }}" + ARCH_PKGVER="${OGC_VERSION/-/.}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" + sed -i \ + -e "s/@@OGC_VERSION@@/${ARCH_PKGVER}/" \ + -e "s/@@TAR_KVER@@/${TAR_KVER}/" \ + arch/PKGBUILD + + - name: Create build user + run: | + useradd -m build + mkdir -p /home/build/linux + cp -vR * /home/build/linux + chown -vR build /home/build/linux - - name: Download and extract kernel source + - name: Download and verify kernel source shell: bash run: | - KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" MAJOR_VERSION="${{ steps.version.outputs.major_version }}" OGC_VERSION="${{ steps.version.outputs.ogc_version }}" - wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch - tar -xf linux-${KERNEL_VERSION}.tar.xz - cd linux-${KERNEL_VERSION} + # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) + gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ + ABAF11C65A2970B130ABE3C479BE3E4300411886 \ + 647F28654894E3BD457199BE38DBBDC86092693E + # Verify kernel tarball signature + xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + tar -xf linux-${TAR_KVER}.tar.xz + cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch - name: Generate default config shell: bash run: | - cd linux-${{ steps.version.outputs.kernel_version }} + cd linux-${{ steps.version.outputs.tar_kver }} make defconfig - name: Configure kernel uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 with: - config: linux-${{ steps.version.outputs.kernel_version }}/.config + config: linux-${{ steps.version.outputs.tar_kver }}/.config set: | global.config.set arch/config.set @@ -128,12 +158,12 @@ jobs: id: build-kernel-package shell: bash run: | - KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" # Pre-populate makepkg source cache - cp linux-${KERNEL_VERSION}.tar.xz /home/build/linux/arch/ + cp linux-${TAR_KVER}.tar.xz /home/build/linux/arch/ cp monolithic.patch /home/build/linux/arch/ # Copy patched config - cp linux-${KERNEL_VERSION}/.config /home/build/linux/arch/config + cp linux-${TAR_KVER}/.config /home/build/linux/arch/config chown -R build /home/build/linux su build bash -c "cd /home/build/linux/arch && MAKEFLAGS=-j$(nproc) makepkg --skippgpcheck --skipchecksums --skipinteg" . /home/build/linux/arch/PKGBUILD diff --git a/.github/workflows/fedora.yaml b/.github/workflows/fedora.yaml index d5f8e95..9456ea4 100644 --- a/.github/workflows/fedora.yaml +++ b/.github/workflows/fedora.yaml @@ -62,11 +62,6 @@ jobs: with: persist-credentials: false - - name: Dependencies - run: | - dnf -y builddep fedora/kernel.spec - dnf -y install jq sed wget - - name: Get version id: version shell: bash @@ -79,32 +74,66 @@ jobs: fi KERNEL_VERSION="${OGC_VERSION%-ogc*}" MAJOR_VERSION="${KERNEL_VERSION%%.*}.x" + OGC_REV="${OGC_VERSION##*-ogc}" + BASE_KVER="${KERNEL_VERSION%.*}" + STABLE_KVER="${KERNEL_VERSION##*.}" + if [ "$STABLE_KVER" = "0" ]; then + TAR_KVER="$BASE_KVER" + else + TAR_KVER="$KERNEL_VERSION" + fi echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" + echo "ogc_rev=$OGC_REV" >> "$GITHUB_OUTPUT" + echo "base_kver=$BASE_KVER" >> "$GITHUB_OUTPUT" + echo "stable_kver=$STABLE_KVER" >> "$GITHUB_OUTPUT" + echo "tar_kver=$TAR_KVER" >> "$GITHUB_OUTPUT" + + - name: Substitute versions + shell: bash + run: | + sed -i \ + -e "s/@@BASEKVER@@/${{ steps.version.outputs.base_kver }}/" \ + -e "s/@@STABLEKVER@@/${{ steps.version.outputs.stable_kver }}/" \ + -e "s/@@OGCVER@@/${{ steps.version.outputs.ogc_rev }}/" \ + -e "s/@@MAJOR_VERSION@@/${{ steps.version.outputs.major_version }}/" \ + fedora/kernel.spec + + - name: Dependencies + run: | + dnf -y builddep fedora/kernel.spec + dnf -y install gnupg2 jq sed wget - - name: Download and extract kernel source + - name: Download and verify kernel source shell: bash run: | - KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" MAJOR_VERSION="${{ steps.version.outputs.major_version }}" OGC_VERSION="${{ steps.version.outputs.ogc_version }}" - wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch - tar -xf linux-${KERNEL_VERSION}.tar.xz - cd linux-${KERNEL_VERSION} + # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) + gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ + ABAF11C65A2970B130ABE3C479BE3E4300411886 \ + 647F28654894E3BD457199BE38DBBDC86092693E + # Verify kernel tarball signature + xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + tar -xf linux-${TAR_KVER}.tar.xz + cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch - name: Generate default config shell: bash run: | - cd linux-${{ steps.version.outputs.kernel_version }} + cd linux-${{ steps.version.outputs.tar_kver }} make defconfig - name: Configure kernel uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 with: - config: linux-${{ steps.version.outputs.kernel_version }}/.config + config: linux-${{ steps.version.outputs.tar_kver }}/.config set: | global.config.set fedora/config.set @@ -114,15 +143,15 @@ jobs: - name: Build run: | - KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" TOPDIR="$(pwd)/rpmbuild" mkdir -p "$TOPDIR"/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} # Pre-populate SOURCES with already-downloaded files - cp linux-${KERNEL_VERSION}.tar.xz "$TOPDIR/SOURCES/" + cp linux-${TAR_KVER}.tar.xz "$TOPDIR/SOURCES/" cp monolithic.patch "$TOPDIR/SOURCES/" cp fedora/kvm_stat.logrotate "$TOPDIR/SOURCES/" # Copy patched config - cp linux-${KERNEL_VERSION}/.config "$TOPDIR/SOURCES/config" + cp linux-${TAR_KVER}/.config "$TOPDIR/SOURCES/config" rpmbuild --define "_topdir $TOPDIR" -ba ./fedora/kernel.spec - name: Setup ORAS diff --git a/.github/workflows/ubuntu.yaml b/.github/workflows/ubuntu.yaml index 04ab8be..4545f31 100644 --- a/.github/workflows/ubuntu.yaml +++ b/.github/workflows/ubuntu.yaml @@ -66,7 +66,7 @@ jobs: run: | export DEBIAN_FRONTEND=noninteractive apt-get update -y - apt-get install -y build-essential devscripts debhelper dh-python asciidoc-base bc bison cpio dwarves flex jq kmod libdw-dev libiberty-dev libnuma-dev libslang2-dev lz4 rsync wget xmlto git curl sed + apt-get install -y build-essential devscripts debhelper dh-python asciidoc-base bc bison cpio dwarves flex gnupg jq kmod libdw-dev libiberty-dev libnuma-dev libslang2-dev lz4 rsync wget xmlto git curl sed apt-get install -y libunwind-dev libpfm4-dev coccinelle openjdk-17-jdk libcapstone-dev libbabeltrace-dev systemtap-sdt-dev libzstd-dev dwarves zstd libbfd-dev libperl-dev libssl-dev - name: Get version @@ -84,27 +84,46 @@ jobs: echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT" echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT" echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT" + OGC_REV="${OGC_VERSION##*-ogc}" + BASE_KVER="${KERNEL_VERSION%.*}" + STABLE_KVER="${KERNEL_VERSION##*.}" + if [ "$STABLE_KVER" = "0" ]; then + TAR_KVER="$BASE_KVER" + else + TAR_KVER="$KERNEL_VERSION" + fi + echo "ogc_rev=$OGC_REV" >> "$GITHUB_OUTPUT" + echo "base_kver=$BASE_KVER" >> "$GITHUB_OUTPUT" + echo "stable_kver=$STABLE_KVER" >> "$GITHUB_OUTPUT" + echo "tar_kver=$TAR_KVER" >> "$GITHUB_OUTPUT" - - name: Download and extract kernel source + - name: Download and verify kernel source run: | - KERNEL_VERSION="${{ steps.version.outputs.kernel_version }}" + TAR_KVER="${{ steps.version.outputs.tar_kver }}" MAJOR_VERSION="${{ steps.version.outputs.major_version }}" OGC_VERSION="${{ steps.version.outputs.ogc_version }}" - wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${KERNEL_VERSION}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz + wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch - tar -xf linux-${KERNEL_VERSION}.tar.xz - cd linux-${KERNEL_VERSION} + # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) + gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ + ABAF11C65A2970B130ABE3C479BE3E4300411886 \ + 647F28654894E3BD457199BE38DBBDC86092693E + # Verify kernel tarball signature + xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + tar -xf linux-${TAR_KVER}.tar.xz + cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch - name: Generate default config run: | - cd linux-${{ steps.version.outputs.kernel_version }} + cd linux-${{ steps.version.outputs.tar_kver }} make defconfig - name: Configure kernel uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1 with: - config: linux-${{ steps.version.outputs.kernel_version }}/.config + config: linux-${{ steps.version.outputs.tar_kver }}/.config set: | global.config.set ubuntu/config.set @@ -114,7 +133,7 @@ jobs: - name: Build run: | - cd linux-${{ steps.version.outputs.kernel_version }} + cd linux-${{ steps.version.outputs.tar_kver }} fakeroot make -j$(nproc) bindeb-pkg - name: Setup ORAS diff --git a/arch/PKGBUILD b/arch/PKGBUILD index 80f0e34..a869b9d 100644 --- a/arch/PKGBUILD +++ b/arch/PKGBUILD @@ -1,7 +1,7 @@ # Maintainer: Jan Alexander Steffens (heftig) pkgbase=linux -pkgver=6.19.8.ogc1 +pkgver=@@OGC_VERSION@@ pkgrel=1 pkgdesc='Linux' url='https://github.com/OpenGamingCollective/linux' @@ -32,28 +32,16 @@ options=( !debug !strip ) -_srcname=linux-${pkgver%.*} -_srctag=v${pkgver%.*}-${pkgver##*.} +_srcname=linux-@@TAR_KVER@@ source=( - https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/${_srcname}.tar.{xz,sign} - $url/releases/download/$_srctag/monolithic.patch{,.sig} - config # the main kernel config file + ${_srcname}.tar.xz + monolithic.patch + config ) -validpgpkeys=( - ABAF11C65A2970B130ABE3C479BE3E4300411886 # Linus Torvalds - 647F28654894E3BD457199BE38DBBDC86092693E # Greg Kroah-Hartman - 83BC8889351B5DEBBB68416EB8AC08600F108CDF # Jan Alexander Steffens (heftig) - 5B1A871250F049FA3FBD968F229661A6685A4BFC # Bouke Haarsma (bouhaa) -) -# https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc sha256sums=('SKIP' - 'SKIP' - 'SKIP' 'SKIP' 'SKIP') b2sums=('SKIP' - 'SKIP' - 'SKIP' 'SKIP' 'SKIP') diff --git a/fedora/kernel.spec b/fedora/kernel.spec index edd5e1f..f0f73ac 100644 --- a/fedora/kernel.spec +++ b/fedora/kernel.spec @@ -7,7 +7,6 @@ # bieszczaders # https://copr.fedorainfracloud.org/coprs/bieszczaders/ %global _default_patch_fuzz 2 -%global _is_rc 0 %define _build_id_links none %define _disable_source_fetch 1 @@ -35,33 +34,23 @@ Name: kernel Summary: The Linux Kernel with Open Gaming Collective (OGC) patches -%define _basekver 6.19 -%define _stablekver 8 -%define _rcver rc7 +%define _basekver @@BASEKVER@@ +%define _stablekver @@STABLEKVER@@ %if %{_stablekver} == 0 %define _tarkver %{_basekver} %else %define _tarkver %{_basekver}.%{_stablekver} %endif -%if 0%{?_is_rc} -%define _tarkver %{_basekver}-%{_rcver} -%endif Version: %{_basekver}.%{_stablekver} -%if 0%{?_is_rc} -%define customver 0.%{_rcver} -%else -%define customver 200 -%endif - -Release:%{customver}.ogc%{?dist} +%define ogcver @@OGCVER@@ +Release: ogc%{ogcver}%{?dist} # Define rawhide fedora version %define _rawhidever 44 %define rpmver %{version}-%{release} -%define rpmverobsolete 6.12.9-200.fsync%{?dist} %define krelstr %{release}.%{_arch} %define kverstr %{version}-%{krelstr} @@ -69,7 +58,7 @@ License: GPLv2 and Redistributable, no modifications permitted Group: System Environment/Kernel Vendor: The Linux Community and OGC maintainer(s) URL: https://opengamingcollective.org -Source0: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-%{_tarkver}.tar.xz +Source0: https://cdn.kernel.org/pub/linux/kernel/v@@MAJOR_VERSION@@/linux-%{_tarkver}.tar.xz Source1: config # needed for kernel-tools Source2: kvm_stat.logrotate @@ -78,7 +67,7 @@ Source2: kvm_stat.logrotate ExcludeArch: %{ix86} # Stable patches -Patch0: https://github.com/OpenGamingCollective/linux/releases/download/v6.19.8-ogc1/monolithic.patch +Patch0: monolithic.patch %define __spec_install_post /usr/lib/rpm/brp-compress || : %define debug_package %{nil} @@ -151,7 +140,6 @@ Requires: %{name}-core-%{rpmver} = %{kverstr} Requires: %{name}-modules-%{rpmver} = %{kverstr} Provides: %{name}%{_basekver} = %{rpmver} Provides: kernel-uki-vert = %{rpmver} -Obsoletes: kernel <= %{rpmverobsolete} %description The kernel-%{flavor} meta package From 2e574b1fe6d201bd3822e5930d2c9d5a1d4c0c81 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Tue, 24 Mar 2026 21:00:43 -0700 Subject: [PATCH 4/4] feat: Add GPG verification of OGC monolithic patch --- .github/workflows/arch.yaml | 5 +++++ .github/workflows/fedora.yaml | 6 +++++- .github/workflows/ubuntu.yaml | 5 +++++ fedora/kernel.spec | 2 +- public.key | 30 ++++++++++++++++++++++++++++++ 5 files changed, 46 insertions(+), 2 deletions(-) create mode 100644 public.key diff --git a/.github/workflows/arch.yaml b/.github/workflows/arch.yaml index 41adc17..67b52e4 100644 --- a/.github/workflows/arch.yaml +++ b/.github/workflows/arch.yaml @@ -127,12 +127,17 @@ jobs: wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch.sig # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ ABAF11C65A2970B130ABE3C479BE3E4300411886 \ 647F28654894E3BD457199BE38DBBDC86092693E + # Import OGC patch signing key + gpg --import $GITHUB_WORKSPACE/public.key # Verify kernel tarball signature xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + # Verify OGC monolithic patch signature + gpg --verify monolithic.patch.sig monolithic.patch tar -xf linux-${TAR_KVER}.tar.xz cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch diff --git a/.github/workflows/fedora.yaml b/.github/workflows/fedora.yaml index 9456ea4..a39902e 100644 --- a/.github/workflows/fedora.yaml +++ b/.github/workflows/fedora.yaml @@ -97,7 +97,6 @@ jobs: -e "s/@@BASEKVER@@/${{ steps.version.outputs.base_kver }}/" \ -e "s/@@STABLEKVER@@/${{ steps.version.outputs.stable_kver }}/" \ -e "s/@@OGCVER@@/${{ steps.version.outputs.ogc_rev }}/" \ - -e "s/@@MAJOR_VERSION@@/${{ steps.version.outputs.major_version }}/" \ fedora/kernel.spec - name: Dependencies @@ -114,12 +113,17 @@ jobs: wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch.sig # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ ABAF11C65A2970B130ABE3C479BE3E4300411886 \ 647F28654894E3BD457199BE38DBBDC86092693E + # Import OGC patch signing key + gpg --import $GITHUB_WORKSPACE/public.key # Verify kernel tarball signature xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + # Verify OGC monolithic patch signature + gpg --verify monolithic.patch.sig monolithic.patch tar -xf linux-${TAR_KVER}.tar.xz cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch diff --git a/.github/workflows/ubuntu.yaml b/.github/workflows/ubuntu.yaml index 4545f31..543456b 100644 --- a/.github/workflows/ubuntu.yaml +++ b/.github/workflows/ubuntu.yaml @@ -105,12 +105,17 @@ jobs: wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch + wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch.sig # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman) gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \ ABAF11C65A2970B130ABE3C479BE3E4300411886 \ 647F28654894E3BD457199BE38DBBDC86092693E + # Import OGC patch signing key + gpg --import $GITHUB_WORKSPACE/public.key # Verify kernel tarball signature xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign - + # Verify OGC monolithic patch signature + gpg --verify monolithic.patch.sig monolithic.patch tar -xf linux-${TAR_KVER}.tar.xz cd linux-${TAR_KVER} patch -Np1 < ../monolithic.patch diff --git a/fedora/kernel.spec b/fedora/kernel.spec index f0f73ac..e4ee24a 100644 --- a/fedora/kernel.spec +++ b/fedora/kernel.spec @@ -58,7 +58,7 @@ License: GPLv2 and Redistributable, no modifications permitted Group: System Environment/Kernel Vendor: The Linux Community and OGC maintainer(s) URL: https://opengamingcollective.org -Source0: https://cdn.kernel.org/pub/linux/kernel/v@@MAJOR_VERSION@@/linux-%{_tarkver}.tar.xz +Source0: linux-%{_tarkver}.tar.xz Source1: config # needed for kernel-tools Source2: kvm_stat.logrotate diff --git a/public.key b/public.key new file mode 100644 index 0000000..b36a2a3 --- /dev/null +++ b/public.key @@ -0,0 +1,30 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGmHfnUBEAC0O8OIYxZgkHKnL7jGWhyrc7hzz96vJeDqR8lWT0CNWV5uVzQj +X+lZayepgM4h3I+YjsxXhz4ZPWAq73UETYs0gF6AEVlI0Hhsty/4cNTjIHhQ/sjx +d35jtzNjywOOuRE5x/RGoTbaLoiULN05jqTokwyhzxub4ucCTFkDwAtmbUofe0hd +KhC0qsBM76l5DHd1l7JGBZanE5ixxwx1WIy7BsAOlMW9EFMjO5HmtLkm+nnLJUfd +t2bJxTRCYI+wUaqGqogUVnxp2iLNncH/F5FFrY6oBIqlFHsdQjMJYRhZRmm1k5OW +lXPAwI/2DIDK9bnUmSA3Aib/PV4zTgiMvoYW/1nJoBFG3IaBkq3fJP/qS7ZXwUdw +P/V8PjvQBZHLcFrdJZYwgRy/6H7j5vUMPc+aXsLSK4NsnJoMGtLz0sMzn83eavqL +p3VhWyaGtbkRts4xR5DqZ7zgLHQAodKl+ulfzXWmQpnkjZ1QP07XK5wFQwTdsa9w +ad1pomtK7O1TUBZJ3fx0e1koSCFbOZF9ROAVTLL4m4kW78T6ONtyoGa7Hv+mWhu3 +UZd8Dn6CcVsRT2KXEs+38jW021BAUDekrC1lMdLUOwm6vifes/YqD+qIE9D9kFVC +fRsNhAuXXCVrOdxLiLNF2jJMgnVP0PupBTnpTSMedvmJhYwkzeRxAWhcVwARAQAB +tDlPcGVuIEdhbWluZyBDb2xsZWN0aXZlIDxjb250YWN0QG9wZW5nYW1pbmdjb2xs +ZWN0aXZlLm9yZz6JAlIEEwEKADwWIQRdFMGykCapNmsutDIrRA9kc0NcGgUCaYd+ +dQMbLwQFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQK0QPZHNDXBopNw// +VKtyOkxZ2UXMXyZO/jcAd7ptGPN+nzS7ihh6uDIy1LVCp58LcGtJIhN7+N6dfpot +wo7R7q66Z0iIOP+ua4fH5ZEyxHwD6jNtzdM3nhzh+cQN4tDDn/acVNXP0KP7M0Q5 +evMBcnTWlzZX2a7HfzDiq/1j9lYu59GA38I3J7ROqM28U0BxceIrMreaWHwObqwN +3sPcj+Hqt5uL7Rvquyzt85tuzCJqU0FfWpq3Ts+nSHCfVCtYRBBPI9d3mCviCOBe +3vGxmVgk0VqUcQUxysQiLo8Qo3vaHoUJDJ3C1u/WbZ2yUYBhNcvDnf6DZQAtCOrX +y+X4ahEe36h44Rdq+1hXC4fkE9IdqAi2H13ca6aXXiawUuHr4cMKCqxsa6F2K7ky +HSrAPnXOhUadGdFAc7ZnMssbugwoFjRRc8d0tD8lRi3xJqAabxIxRIgr04Lbk2w8 +l45rYC6zgXk1XE/NAkUu6W+zPMpEL1MpFWwIMnczcx08KDvvQQZkG1lmV4AcDsa/ +V1NIk55y1Y2G3s9Qua3MIxnyLGD8rD0m8zr096QbEIsXUJsgP6313PedM3iChEEQ +3MKP8k9qg1uyNf2clwAII0XIBVfsLQkBk5kXu+V9XycfHei+E9R94/QRfr/WmnaO +/AlB0LE+oWAYc2jgqSVmDcLRkVrr8T0puuxoXNs7kEU= +=2RQf +-----END PGP PUBLIC KEY BLOCK----- +