diff options
Diffstat (limited to 'libre/linux-libre/PKGBUILD')
| -rw-r--r-- | libre/linux-libre/PKGBUILD | 84 |
1 files changed, 63 insertions, 21 deletions
diff --git a/libre/linux-libre/PKGBUILD b/libre/linux-libre/PKGBUILD index 1004f2de9..65f997a8a 100644 --- a/libre/linux-libre/PKGBUILD +++ b/libre/linux-libre/PKGBUILD @@ -13,7 +13,7 @@ pkgbase=linux-libre # Build stock kernel #pkgbase=linux-libre-custom # Build kernel with a different name _pkgbasever=4.14-gnu -_pkgver=4.14.7-gnu +_pkgver=4.14.12-gnu _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname _replacesoldkernels=() # '%' gets replaced with _kernelname @@ -23,7 +23,7 @@ _srcname=linux-${_pkgbasever%-*} _archpkgver=${_pkgver%-*} pkgver=${_pkgver//-/_} pkgrel=1 -rcnrel=armv7-x2 +rcnrel=armv7-x4 arch=('i686' 'x86_64' 'armv7h') url="https://linux-libre.fsfla.org/" license=('GPL2') @@ -38,13 +38,10 @@ source=( "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_vga16.ppm"{,.sig} # the main kernel config files 'config.i686' 'config.x86_64' 'config.armv7h' - # pacman hooks for initramfs regeneration - '60-linux.hook' - '90-linux.hook' + # pacman hooks for depmod and initramfs regeneration + '60-linux.hook' '90-linux.hook' # standard config files for mkinitcpio ramdisk 'linux.preset' - '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch' - '0002-fix-Atmel-maXTouch-touchscreen-support.patch' # armv7h patches "https://repo.parabola.nu/other/rcn-libre/patches/${_pkgver%-*}/rcn-libre-${_pkgver%-*}-${rcnrel}.patch"{,.sig} '0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch' @@ -56,10 +53,19 @@ source=( '0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch' '0008-disable-USB3-port-on-ODROID-XU.patch' '0009-ARM-dove-enable-ethernet-on-D3Plug.patch' -) + # other patches + '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch' + '0002-fix-Atmel-maXTouch-touchscreen-support.patch' + '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch' + '0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch' + '0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch' + '0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch' + '0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch' + '0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch' + ) sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e684147ebed91d1528d2685423dd784c5fca0f3650f874f2b93cfc6b7689b9a87f' 'SKIP' - '5c62bbc5d3bc5aa67eed8c4952e86263cc86bd9406cfe30a87ee4ff891b8aeb23e78df82d7cfefcdbedce17520b7fe3d515d930905ee2ceaf6c7462399670fb7' + '2e8abb699328db2b156890b6ab966ba0c8cefbf64c909d13290c92ca99419b5fb06a53d3d93ed83ed6bd28edb6eeba73bd996f3cb2bc150c3b8709b2e2bbea17' 'SKIP' '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3' 'SKIP' @@ -67,15 +73,13 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841 'SKIP' '7a3716bfe3b9f546da309c7492f3e08f8f506813afeb1c737a474c83313d5c313cf4582b65215c2cfce3b74d9d1021c96e8badafe8f6e5b01fe28d2b5c61ae78' 'SKIP' - '6dac1e8ab08eea83dfb70d31c698002fe1f63530e046ecf2a8a7f708cbe9ac116a8ff532b27a75c92b978b53621bf76f9361b42cfed8bcbfdcad2cad145e7e6b' - '61407e3f5f3db60fc37e03f184b81b8a275a9795d3943bdeefd1a55efffe2fd178e162c3d2b40c446e25742468a3e9049001326ce62b7da62ee683c7c06b8215' - '873eba395fb0540b21760e17dc8442b2c04a159dcd597cd2574536f20195c7c38f35cbbaa1e4d47ed0ee440215adfb2f03f9602180175bf2cacdbfbdb3ad1cfe' + '702101a78169ad81532f416b44b74bf7723055169027489a1e95eea9909ed693f20fe3a595152f284cc0837ff09202231a82285c55c25db35447d15492f21aed' + 'c0cad633c02bfb3ac0dd3c3daaa044b808bf6f3cfbd1035c31d95dfca338d3ad0eae50f6d9c264f6e8eaa3b590d8b500401509f55f8198406c726f6727ce0b05' + '7ff4babbe27585e0576d0a66f03cf41bd7556f8047db36f5e1f8391f1c624466fb714a7cfd0d91ae608eb5a123dfb7ad315ee900d8a81c9a2b1b769f4eb356a4' '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a' '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' - '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' - 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' - 'ee810f2a28e5e07be61a6f3593eb6e1829803aff51ed959caaca6c4f83b7dde477bacbbb0581bd2dbd5bed1591170cf94666efe04064b16cc1ce7adac0813be4' + '6a9a290f0fa71973f40a0335017b65bac0486fe719fa79d5cab9358d03c43613f796f5cfcf68bd89964fcb71e05dcead40516b28f78cd25ab9a841c05cbd5874' 'SKIP' '29c709ee6892a668c77945142ed9749cb8a3135575a4316f4a3cc85fbda41c09fdd65e32507b654c96aa438bd2aed08c09919bb162daee969643aafd053321c4' '5b35ef2c675aed00ddf82b8a96a486230fad78f05b5a69c95a57632d6c7f428f026439f3ced72cf54156ffd4fd563e68d4285ba6f42428c00b966257951039c3' @@ -85,7 +89,15 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841 '23f21fb05188479fb2238229a88d1d45f30052e3d7dcbbf99c5b9a763493eac122795431cf6932e85bd6e091380179b62e986782fafe7e8c2bd53940199b925e' '45a21f9dfec613c8f4dba284aaf80e307612440893536295a32ec805e11439272a0949921a22f12f67600df8415870aa27101b7e3d3869aea88ad3e1cb614086' '6c93bc1e8d580af288921e10c456bdbda1dcb6d6f08c111cddaf9a32b43c2df41b50136bc09aaac1da9c3cae667bba6e075d590dcc465107ae6e2c3dcf7da657' - 'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545') + 'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545' + '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' + 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' + '05f2c577450cfeae4b66a7d022a9dd0dab0dbf36e9738423efa8f45aaf0755b48a89f1f88b042946205e681458f76c5c5177c16869094839b7b234e0e2b27511' + 'fd9bdc818326fa36c9f1813d0d1821de5e325b646e1c307c197ad38bada7f298d35b4bc1bbf1c2854689f3ba71144879e799a1123037caccd6e3f64edfc22d54' + '814517d08c35cc886fe3382619d41107d6139a703c27186d0ce58e187eaf4e84891572e58246750ac8602555794ed6f74d946565b98860787a0aa617fb946dda' + 'e6605e923c967b5f8db619868b15ea5b0d4254c62cf12bb920f38659933d6ca25a643d3e044c4915a8309071461f5f14c55d0aa0329c113bce4780d4fa3afbb7' + '0dec1482efe6e5d762a3061f365e43191484f055b738112452b8ca39e162b935d99cf16b25c0b253d6b532fabc54bde2f5c09be91887156ed6ae06d1558f94b9' + 'fcc40dc86dd432be76854e3c51889db488de0f1029ecc227b92c4f58c62ba928f7dc3b9515ac3ca0a08d6a0a72ca4a1a754d47c4fb274fe89f09a2a336088e7a') validpgpkeys=( '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P. @@ -108,6 +120,7 @@ prepare() { if [ "${_pkgbasever}" != "${_pkgver}" ]; then patch -p1 -i ../patch-${_pkgbasever}-${_pkgver} fi + chmod +x tools/objtool/sync-check.sh # GNU patch doesn't support git-style file mode if [ "${CARCH}" = "armv7h" ]; then # RCN patch (CM3 firmware deblobbed and AUFS removed) @@ -132,8 +145,28 @@ prepare() { install -m644 -t drivers/video/logo \ "${srcdir}/logo_linux_"{clut224.ppm,vga16.ppm,mono.pbm} + # security patches + # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git + + # disable USER_NS for non-root users by default + patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch + + # https://bugs.archlinux.org/task/56575 + patch -Np1 -i ../0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch + + # https://nvd.nist.gov/vuln/detail/CVE-2017-8824 + patch -Np1 -i ../0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch + + # https://bugs.archlinux.org/task/56605 + patch -Np1 -i ../0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch + + # https://bugs.archlinux.org/task/56846 + patch -Np1 -i ../0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch + + # https://bugs.archlinux.org/task/56711 + patch -Np1 -i ../0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch # maintain the TTY over USB disconnects # http://www.coreboot.org/EHCI_Gadget_Debug @@ -147,12 +180,12 @@ prepare() { cp -Tf ../config.${CARCH} .config if [ "${_kernelname}" != "" ]; then - sed -i "s|CONFIG_LOCALVERSION=.*|CONFIG_LOCALVERSION=\"${_kernelname}\"|g" ./.config.${CARCH} - sed -i "s|CONFIG_LOCALVERSION_AUTO=.*|CONFIG_LOCALVERSION_AUTO=n|" ./.config.${CARCH} + sed -i "s|CONFIG_LOCALVERSION=.*|CONFIG_LOCALVERSION=\"${_kernelname}\"|g" ./.config + sed -i "s|CONFIG_LOCALVERSION_AUTO=.*|CONFIG_LOCALVERSION_AUTO=n|" ./.config fi - # set extraversion to pkgrel - sed -ri "s|^(EXTRAVERSION =).*|\1 -${pkgrel}|" Makefile + # append pkgrel to extraversion + sed -ri "s|^(EXTRAVERSION =.*\S).*|\1-${pkgrel}|" Makefile # don't run depmod on 'make install'. We'll do this ourselves in packaging sed -i '2iexit 0' scripts/depmod.sh @@ -210,7 +243,7 @@ _package() { fi # make room for external modules - local _extramodules="extramodules-${_basekernel}${_kernelname:--ARCH}" + local _extramodules="extramodules-${_basekernel}${_kernelname}" ln -s "../${_extramodules}" "${pkgdir}/usr/lib/modules/${_kernver}/extramodules" # add real version for building modules and running depmod from hook @@ -229,11 +262,20 @@ _package() { fi # sed expression for following substitutions + if [ "${CARCH}" = "armv7h" ]; then local _subst=" + s|/boot/vmlinuz-%PKGBASE%|${_kernver}|g s|%PKGBASE%|${pkgbase}|g s|%KERNVER%|${_kernver}|g s|%EXTRAMODULES%|${_extramodules}|g " + elif [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then + local _subst=" + s|%PKGBASE%|${pkgbase}|g + s|%KERNVER%|${_kernver}|g + s|%EXTRAMODULES%|${_extramodules}|g + " + fi # hack to allow specifying an initially nonexisting install file sed "${_subst}" "${startdir}/${install}" > "${startdir}/${install}.pkg" |