diff options
Diffstat (limited to 'libre/linux-libre-hardened/PKGBUILD')
-rw-r--r-- | libre/linux-libre-hardened/PKGBUILD | 307 |
1 files changed, 163 insertions, 144 deletions
diff --git a/libre/linux-libre-hardened/PKGBUILD b/libre/linux-libre-hardened/PKGBUILD index 2456c535f..48c3b5b98 100644 --- a/libre/linux-libre-hardened/PKGBUILD +++ b/libre/linux-libre-hardened/PKGBUILD @@ -7,27 +7,27 @@ # Contributor: Luke R. <g4jc@openmailbox.org> pkgbase=linux-libre-hardened -_pkgbasever=4.17-gnu -_pkgver=4.17.11-gnu +_srcbasever=4.18-gnu +_srcver=4.18.2-gnu _hardenedver=a _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname _replacesoldkernels=('linux-grsec' 'linux-libre-grsec') # '%' gets replaced with _kernelname _replacesoldmodules=() # '%' gets replaced with _kernelname -_srcname=linux-${_pkgbasever%-*} -_archpkgver=${_pkgver%-*} -pkgver=${_pkgver//-/_}.${_hardenedver} +_srcname=linux-${_srcbasever%-*} +_archpkgver=${_srcver%-*} +pkgver=${_srcver//-/_}.${_hardenedver} pkgrel=1 -arch=('x86_64') +arch=(x86_64) url="https://linux-libre.fsfla.org/" -license=('GPL2') -makedepends=('xmlto' 'kmod' 'inetutils' 'bc' 'libelf') +license=(GPL2) +makedepends=(xmlto kmod inetutils bc libelf python-sphinx graphviz) options=('!strip') source=( - "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgbasever}/linux-libre-${_pkgbasever}.tar.xz"{,.sign} - "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgver}/patch-${_pkgbasever}-${_pkgver}.xz"{,.sign} - "https://github.com/anthraxx/linux-hardened/releases/download/${_pkgver%-*}.${_hardenedver}/linux-hardened-${_pkgver%-*}.${_hardenedver}.patch"{,.sig} + "https://linux-libre.fsfla.org/pub/linux-libre/releases/$_srcbasever/linux-libre-$_srcbasever.tar.xz"{,.sign} + "https://linux-libre.fsfla.org/pub/linux-libre/releases/$_srcver/patch-$_srcbasever-$_srcver.xz"{,.sign} + "https://github.com/anthraxx/linux-hardened/releases/download/${_srcver%-*}.${_hardenedver}/linux-hardened-${_srcver%-*}.${_hardenedver}.patch"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_clut224.ppm"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_mono.pbm"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_vga16.ppm"{,.sig} @@ -40,10 +40,7 @@ source=( # other patches '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch' '0002-fix-Atmel-maXTouch-touchscreen-support.patch' - 'ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch' - 'Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch' - 'mac80211-disable-BHs-preemption-in-ieee80211_tx_cont.patch' - 'ACPICA-AML-Parser-ignore-control-method-status-in-module-level-code.patch' + 'increase-timeout-in-lspcon_wait_mode.patch' ) validpgpkeys=( '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva @@ -51,11 +48,11 @@ validpgpkeys=( '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P. 'E240B57E2C4630BA768E2F26FC1B547C8D8172C8' # Levente Polyak ) -sha512sums=('a09014005d64839e958cabb20dbd50e051907b1afea2f517f41f0a9312fa1bc8447690e64ec0e6488a778be8a7384891c003f39029ff5799f9884482628aadf2' +sha512sums=('0c221c6e84eb5bc270ef79454bf407079daed84534afb1d449d40fa46e42868a471d3063016a4eb3f68d42879e18ee314ab30716116805fee35b5084b23df2a9' 'SKIP' - 'a977ac21aa66b7d01ccc207f74d6213cdeed7ab0dd40c5569f97a97f42244c9db002f79d84ad6b4583d1a3b5f357f55bb12da214078c919ac2b70800b0b6ae69' + '4e2a499ba5bf715aa4a41fac5b0a135da5170382960960d746e3cf55c4174162345c63f7e761df348f43c1fe9074e67dc651de0486225297709fb3955e38f12b' 'SKIP' - '25fcaf8ee67f3864a740b976dd2a5999ff7c9ea1803c58f4338f22cd9171c3bb6830bcddf5b562860b30c1eab7c2f7e18eebe3a427afe1fdef58cdc7d0f2f5a3' + '1079145e514f9b253e0864895bbcec1c9f0da0b60d8baa9ec63e1904b2f42c958c146f1dc329cad47b3912ac4d0dbf00cb684a4dd36492ab9706693728c8b59d' 'SKIP' '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3' 'SKIP' @@ -63,16 +60,13 @@ sha512sums=('a09014005d64839e958cabb20dbd50e051907b1afea2f517f41f0a9312fa1bc8447 'SKIP' '7a3716bfe3b9f546da309c7492f3e08f8f506813afeb1c737a474c83313d5c313cf4582b65215c2cfce3b74d9d1021c96e8badafe8f6e5b01fe28d2b5c61ae78' 'SKIP' - 'a0555fab3447453d6d6e77d48f02a90b306525d5d47ae12dd67b3a9156b392f062fc3e5f5d7fe2c114d3fa6592f9752cb253d6158dbcca5dd59869dcb49d848c' + '78740a7a4bd75d65571fc5a6e5f2a3c1e7e10cd7aaf12330eab364792df0b10c092c73527d10dae8c0260f7e572eae581159e518c41612ee596b9d2ce761d4bc' '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a' '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' - '994d328326ca1e65fc4b1ea26d858e040367112881af4d2f33b953fd138fa44009f898211f84e29e1158ca61bd7080e871933dba4d7e8f084640a02110cfc920' - 'cc8852b089aa24f588ad1af726503ecd1012ad7e1cbc47ea77f03a5f7aecd25306d40f2e16b8a1afeafe7e2e97b6b6840c9f462ed7be358090117e2e024df1bd' - '662e8cc92c2034de247530a981ed24d3d85109e5d0742a9c53c6def9528c151c3177c95992b8d9d1173b64817960ac7c6cb029817fa39cce48d8199823b8271a' - '0baf3c296acac5bd48e5221f360c59f440844066e7a39ee34eab318938ec2e93ad81d274862784a80e1c0fefc60cbb073bd6a4dbcb6884d9f602ade5c854cefc') + '0555e6099878dabd835284c173a0d3f98d72b37168cc7a5938db5d3639592d8a7b59ab2914f9922dfcd6d678a6bf713a07402dab1c7008182174b7e0ad0a45b6') _kernelname=${pkgbase#linux-libre} _replacesarchkernel=("${_replacesarchkernel[@]/\%/${_kernelname}}") @@ -80,29 +74,22 @@ _replacesoldkernels=("${_replacesoldkernels[@]/\%/${_kernelname}}") _replacesoldmodules=("${_replacesoldmodules[@]/\%/${_kernelname}}") prepare() { - cd ${_srcname} + cd $_srcname # add upstream patch - if [ "${_pkgbasever}" != "${_pkgver}" ]; then - patch -p1 -i ../patch-${_pkgbasever}-${_pkgver} + if [ "$_srcbasever" != "$_srcver" ]; then + patch -p1 -i ../patch-$_srcbasever-$_srcver fi - # add linux hardened patch - patch -p1 -i ../linux-hardened-${_pkgver%-*}.${_hardenedver}.patch + # add linux-hardened patch + patch -p1 -i ../linux-hardened-${_srcver%-*}.${_hardenedver}.patch # add freedo as boot logo install -m644 -t drivers/video/logo \ ../logo_linux_{clut224.ppm,vga16.ppm,mono.pbm} - # https://bugs.archlinux.org/task/56780 - patch -p1 -i ../ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch - - # https://bugs.archlinux.org/task/56711 - patch -p1 -i ../Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch - - # Fix iwd provoking a BUG - patch -p1 -i ../mac80211-disable-BHs-preemption-in-ieee80211_tx_cont.patch - patch -p1 -i ../ACPICA-AML-Parser-ignore-control-method-status-in-module-level-code.patch + # Arch's linux-hardened patches + patch -p1 -i ../increase-timeout-in-lspcon_wait_mode.patch # maintain the TTY over USB disconnects # http://www.coreboot.org/EHCI_Gadget_Debug @@ -113,81 +100,81 @@ prepare() { # http://www.fsfla.org/pipermail/linux-libre/2015-November/003202.html patch -p1 -i ../0002-fix-Atmel-maXTouch-touchscreen-support.patch - # append pkgrel to extraversion and empty localversion - sed -e "/^EXTRAVERSION = -gnu/s/-gnu.*/-gnu.${_hardenedver}-${pkgrel}/" \ - -e "/^EXTRAVERSION =/aLOCALVERSION =" \ - -i Makefile + msg2 "Setting version..." + sed -e "/^EXTRAVERSION = -gnu/s/= -gnu.*/= -gnu.${_hardenedver}/" -i Makefile + scripts/setlocalversion --save-scmversion + echo "-$pkgrel" > localversion.10-pkgrel + echo "$_kernelname" > localversion.20-pkgname + msg2 "Setting config..." cp ../config.x86_64 .config make olddefconfig + + make -s kernelrelease > ../version + msg2 "Prepared %s version %s" "$pkgbase" "$(<../version)" } build() { - cd ${_srcname} - - make bzImage modules + cd $_srcname + make bzImage modules htmldocs } _package() { pkgdesc="The ${pkgbase^} kernel and modules" - [ "${pkgbase}" = "linux-libre" ] && groups=('base' 'base-openrc') - depends=('coreutils' 'linux-libre-firmware' 'kmod' 'mkinitcpio>=0.7') + [[ $pkgbase = linux-libre ]] && groups=(base base-openrc) + depends=(coreutils linux-libre-firmware kmod mkinitcpio) optdepends=('crda: to set the correct wireless channels of your country' 'usbctl: deny_new_usb control') - provides=("${_replacesarchkernel[@]/%/=${_archpkgver}}" "LINUX-ABI_VERSION=${_pkgver%%-*}") + provides=("${_replacesarchkernel[@]/%/=${_archpkgver}}" "LINUX-ABI_VERSION=${_srcver%%-*}") conflicts=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") replaces=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") - backup=("etc/mkinitcpio.d/${pkgbase}.preset") + backup=("etc/mkinitcpio.d/$pkgbase.preset") install=linux.install - cd ${_srcname} + local kernver="$(<version)" - # get kernel version - _kernver="$(make kernelrelease)" - _basekernel=${_kernver%%-*} - _basekernel=${_basekernel%.*} + cd $_srcname - mkdir -p "${pkgdir}"/{boot,usr/lib/modules} - make INSTALL_MOD_PATH="${pkgdir}/usr" DEPMOD=/doesnt/exist modules_install - cp arch/x86/boot/bzImage "${pkgdir}/boot/vmlinuz-${pkgbase}" + msg2 "Installing boot image..." + install -Dm644 "$(make -s image_name)" "$pkgdir/boot/vmlinuz-$pkgbase" - # make room for external modules - local _extramodules="extramodules-${_basekernel}${_kernelname}" - ln -s "../${_extramodules}" "${pkgdir}/usr/lib/modules/${_kernver}/extramodules" + msg2 "Installing modules..." + local modulesdir="$pkgdir/usr/lib/modules/$kernver" + mkdir -p "$modulesdir" + make INSTALL_MOD_PATH="$pkgdir/usr" modules_install - # add real version for building modules and running depmod from hook - echo "${_kernver}" | - install -Dm644 /dev/stdin "${pkgdir}/usr/lib/modules/${_extramodules}/version" + # a place for external modules, + # with version file for building modules and running depmod from hook + local extramodules="extramodules$_kernelname" + local extradir="$pkgdir/usr/lib/modules/$extramodules" + install -Dt "$extradir" -m644 ../version + ln -sr "$extradir" "$modulesdir/extramodules" # remove build and source links - rm "${pkgdir}"/usr/lib/modules/${_kernver}/{source,build} - - # now we call depmod... - depmod -b "${pkgdir}/usr" -F System.map "${_kernver}" - - # add vmlinux - install -Dt "${pkgdir}/usr/lib/modules/${_kernver}/build" -m644 vmlinux + rm "$modulesdir"/{source,build} + msg2 "Installing hooks..." # sed expression for following substitutions - local _subst=" - s|%PKGBASE%|${pkgbase}|g - s|%KERNVER%|${_kernver}|g - s|%EXTRAMODULES%|${_extramodules}|g + local subst=" + s|%PKGBASE%|$pkgbase|g + s|%KERNVER%|$kernver|g + s|%EXTRAMODULES%|$extramodules|g " # hack to allow specifying an initially nonexisting install file - sed "${_subst}" "${startdir}/${install}" > "${startdir}/${install}.pkg" - true && install=${install}.pkg - - # install mkinitcpio preset file - sed "${_subst}" ../linux.preset | - install -Dm644 /dev/stdin "${pkgdir}/etc/mkinitcpio.d/${pkgbase}.preset" - - # install pacman hooks - sed "${_subst}" ../60-linux.hook | - install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/60-${pkgbase}.hook" - sed "${_subst}" ../90-linux.hook | - install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/90-${pkgbase}.hook" + sed "$subst" "$startdir/$install" > "$startdir/$install.pkg" + true && install=$install.pkg + + # fill in mkinitcpio preset and pacman hooks + sed "$subst" ../linux.preset | install -Dm644 /dev/stdin \ + "$pkgdir/etc/mkinitcpio.d/$pkgbase.preset" + sed "$subst" ../60-linux.hook | install -Dm644 /dev/stdin \ + "$pkgdir/usr/share/libalpm/hooks/60-$pkgbase.hook" + sed "$subst" ../90-linux.hook | install -Dm644 /dev/stdin \ + "$pkgdir/usr/share/libalpm/hooks/90-$pkgbase.hook" + + msg2 "Fixing permissions..." + chmod -Rc u=rwX,go=rX "$pkgdir" } _package-headers() { @@ -196,68 +183,82 @@ _package-headers() { conflicts=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") replaces=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") - cd ${_srcname} - local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" + local builddir="$pkgdir/usr/lib/modules/$(<version)/build" - install -Dt "${_builddir}" -m644 Makefile .config Module.symvers - install -Dt "${_builddir}/kernel" -m644 kernel/Makefile + cd $_srcname - mkdir "${_builddir}/.tmp_versions" + msg2 "Installing build files..." + install -Dt "$builddir" -m644 Makefile .config Module.symvers System.map vmlinux + install -Dt "$builddir/kernel" -m644 kernel/Makefile + install -Dt "$builddir/arch/x86" -m644 arch/x86/Makefile + cp -t "$builddir" -a scripts - cp -t "${_builddir}" -a include scripts + # add objtool for external module building and enabled VALIDATION_STACK option + install -Dt "$builddir/tools/objtool" tools/objtool/objtool + + # add xfs and shmem for aufs building + mkdir -p "$builddir"/{fs/xfs,mm} - install -Dt "${_builddir}/arch/x86" -m644 arch/x86/Makefile - install -Dt "${_builddir}/arch/x86/kernel" -m644 arch/x86/kernel/asm-offsets.s + # ??? + mkdir "$builddir/.tmp_versions" - cp -t "${_builddir}/arch/x86" -a arch/x86/include + msg2 "Installing headers..." + cp -t "$builddir" -a include + cp -t "$builddir/arch/x86" -a arch/x86/include + install -Dt "$builddir/arch/x86/kernel" -m644 arch/x86/kernel/asm-offsets.s - install -Dt "${_builddir}/drivers/md" -m644 drivers/md/*.h - install -Dt "${_builddir}/net/mac80211" -m644 net/mac80211/*.h + install -Dt "$builddir/drivers/md" -m644 drivers/md/*.h + install -Dt "$builddir/net/mac80211" -m644 net/mac80211/*.h # http://bugs.archlinux.org/task/13146 - install -Dt "${_builddir}/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h + install -Dt "$builddir/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h # http://bugs.archlinux.org/task/20402 - install -Dt "${_builddir}/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h - install -Dt "${_builddir}/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h - install -Dt "${_builddir}/drivers/media/tuners" -m644 drivers/media/tuners/*.h - - # add xfs and shmem for aufs building - mkdir -p "${_builddir}"/{fs/xfs,mm} - - # copy in Kconfig files - find . -name Kconfig\* -exec install -Dm644 {} "${_builddir}/{}" \; - - # add objtool for external module building and enabled VALIDATION_STACK option - install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool - - # remove unneeded architectures - local _arch - for _arch in "${_builddir}"/arch/*/; do - [[ ${_arch} == */x86/ ]] && continue - rm -r "${_arch}" + install -Dt "$builddir/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h + install -Dt "$builddir/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h + install -Dt "$builddir/drivers/media/tuners" -m644 drivers/media/tuners/*.h + + msg2 "Installing KConfig files..." + find . -name 'Kconfig*' -exec install -Dm644 {} "$builddir/{}" \; + + msg2 "Removing unneeded architectures..." + local arch + for arch in "$builddir"/arch/*/; do + [[ $arch = */x86/ ]] && continue + echo "Removing $(basename "$arch")" + rm -r "$arch" done - # remove files already in linux-docs package - rm -r "${_builddir}/Documentation" - - # remove now broken symlinks - find -L "${_builddir}" -type l -printf 'Removing %P\n' -delete + msg2 "Removing documentation..." + rm -r "$builddir/Documentation" + + msg2 "Removing broken symlinks..." + find -L "$builddir" -type l -printf 'Removing %P\n' -delete + + msg2 "Removing loose objects..." + find "$builddir" -type f -name '*.o' -printf 'Removing %P\n' -delete + + msg2 "Stripping build tools..." + local file + while read -rd '' file; do + case "$(file -bi "$file")" in + application/x-sharedlib\;*) # Libraries (.so) + strip -v $STRIP_SHARED "$file" ;; + application/x-archive\;*) # Libraries (.a) + strip -v $STRIP_STATIC "$file" ;; + application/x-executable\;*) # Binaries + strip -v $STRIP_BINARIES "$file" ;; + application/x-pie-executable\;*) # Relocatable binaries + strip -v $STRIP_SHARED "$file" ;; + esac + done < <(find "$builddir" -type f -perm -u+x ! -name vmlinux -print0) - # Fix permissions - chmod -R u=rwX,go=rX "${_builddir}" + msg2 "Adding symlink..." + mkdir -p "$pkgdir/usr/src" + ln -sr "$builddir" "$pkgdir/usr/src/$pkgbase-$pkgver" - # strip scripts directory - local _binary _strip - while read -rd '' _binary; do - case "$(file -bi "${_binary}")" in - *application/x-sharedlib*) _strip="${STRIP_SHARED}" ;; # Libraries (.so) - *application/x-archive*) _strip="${STRIP_STATIC}" ;; # Libraries (.a) - *application/x-executable*) _strip="${STRIP_BINARIES}" ;; # Binaries - *) continue ;; - esac - /usr/bin/strip ${_strip} "${_binary}" - done < <(find "${_builddir}/scripts" -type f -perm -u+w -print0 2>/dev/null) + msg2 "Fixing permissions..." + chmod -Rc u=rwX,go=rX "$pkgdir" } _package-docs() { @@ -266,21 +267,39 @@ _package-docs() { conflicts=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") replaces=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") - cd ${_srcname} - local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" + local builddir="$pkgdir/usr/lib/modules/$(<version)/build" + + cd $_srcname + + msg2 "Installing documentation..." + mkdir -p "$builddir" + cp -t "$builddir" -a Documentation + + msg2 "Removing doctrees..." + rm -r "$builddir/Documentation/output/.doctrees" + + msg2 "Moving HTML docs..." + local src dst + while read -rd '' src; do + dst="$builddir/Documentation/${src#$builddir/Documentation/output/}" + mkdir -p "${dst%/*}" + mv "$src" "$dst" + rmdir -p --ignore-fail-on-non-empty "${src%/*}" + done < <(find "$builddir/Documentation/output" -type f -print0) - mkdir -p "${_builddir}" - cp -t "${_builddir}" -a Documentation + msg2 "Adding symlink..." + mkdir -p "$pkgdir/usr/share/doc" + ln -sr "$builddir/Documentation" "$pkgdir/usr/share/doc/$pkgbase" - # Fix permissions - chmod -R u=rwX,go=rX "${_builddir}" + msg2 "Fixing permissions..." + chmod -Rc u=rwX,go=rX "$pkgdir" } -pkgname=("${pkgbase}" "${pkgbase}-headers" "${pkgbase}-docs") -for _p in ${pkgname[@]}; do - eval "package_${_p}() { - $(declare -f "_package${_p#${pkgbase}}") - _package${_p#${pkgbase}} +pkgname=("$pkgbase" "$pkgbase-headers" "$pkgbase-docs") +for _p in "${pkgname[@]}"; do + eval "package_$_p() { + $(declare -f "_package${_p#$pkgbase}") + _package${_p#$pkgbase} }" done |