Repository navigation
Follow-up: verify kernel tarball by default + abort cleanly when the build produced no packages - #17
Merged
Merged
Conversation
Address static analysis findings and review hardening: - fix SCRIPT_NAME references to SCRIPT_FILENAME - default and quote LIST_INSTALLED (fixes "[ == 1 ]" error on normal runs) - self-update (-u): use the script's own directory and preserve --dir and re-run arguments - apt-get install: add -y for non-interactive runs - honor GNUPGHOME override and probe gpg/gpgv binaries instead of hardcoding /usr/bin/gpgv2 - use -d instead of -x for directory existence checks - only wipe INSTALL_DIR when it is empty or contains the .kernel_installer marker, refuse otherwise - drop wget --no-check-certificate - silence stderr in the slib log pipeline - untrack log/kernel_installer.log and ignore log/ - add shellcheck CI workflow
Fetch slib.sh from the immutable commit matching the vendored copy and verify its sha256 before sourcing it, instead of piping the mutable main branch into a shell. Protects curl | bash users from executing tampered or unreviewed remote code. Note: when src/slib.sh changes on main, bump SLIB_REV to the new commit and SLIB_SHA256 to the output of `sha256sum src/slib.sh`.
- scripts/update-slib.sh: two-phase slib update (vendor from tmiland/slib, then --finalize <commit> to refresh SLIB_REV/SLIB_SHA256) - lint.yml: new 'slib pin' job fails on main when src/slib.sh and SLIB_SHA256 disagree, warns on other branches - document the maintenance workflow in README and kernel_installer.sh
Package names are now valid on Debian 12/13 and Ubuntu 22.04/24.04: - ncurses-dev -> libncurses-dev, liblz4-tool -> lz4, drop removed paxctl - install the built kernel debs with 'apt-get install ./...' so runtime dependencies (kmod, linux-base, initramfs-tools) resolve on minimal systems
Builds and installs a kernel on Debian 12/13 and Ubuntu 22.04/24.04 in containers, verifies the installed packages and files, uploads logs.
…, set TERM - artifact names used matrix.image (debian:12) which is invalid for upload-artifact - add failure step printing /var/log/kernel_installer.log (run_ok sends all command output there, so CI failures were invisible) - add dpkg-dev + procps to INSTALL_PKGS (dpkg-buildpackage/ps required) - wrap the non-olddefconfig 'make $CONFIG_OPTION' in run_ok like the else branch
The kernel's generated debian/control (scripts/package/mkdebian) declares Build-Depends-Arch: bc, bison, cpio, flex, gcc, kmod, libelf-dev, libssl-dev, rsync. dpkg-checkbuilddeps enforces this and aborts dpkg-buildpackage with: dpkg-checkbuilddeps: error: Unmet build dependencies: cpio kmod This was the root cause of the failing Debian/Ubuntu install test CI jobs.
Stable/longterm tarballs are now downloaded through the kernel.org get-verified-tarball helper (checksum + GPG signature verification) unless GET_VERIFIED_TARBALL=0 is set. A failed download/verification now aborts cleanly instead of falling through to unpack/build/install.
Verify the expected .deb packages exist before the install phase; a failed build no longer falls through to the installer with a cryptic error. The install directory is left in place for debugging.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #16 — review that one first; until it merges this PR also contains its commits, so the diff to review here is the last two commits (
749505a,abaaa78).Two robustness follow-ups:
749505a) — stable/longterm tarballs are now downloaded through the kernel.orgget-verified-tarballhelper (sha256 + GPG signature verification) unlessGET_VERIFIED_TARBALL=0is set. A failed download/verification aborts cleanly instead of falling through to unpack/build/install.abaaa78) — before installing, the script checks for the expected.debpackages; a failed build no longer falls through to the installer with a crypticUnsupported fileerror. The install directory is left in place for debugging.Testing
shellcheck kernel_installer.sh src/slib.sh scripts/update-slib.shclean.