[PATCH 8/9] UBUNTU: [Packaging] linux-restricted-modules -- consume published signatures
Andy Whitcroft
apw at canonical.com
Mon Mar 8 15:00:03 UTC 2021
Split our output into a pair of packages. linux-objects-nvidia-* which
contain the raw .o files and associated helpers, and linux-modules-nvidia-*
which depend both the objects and the signatures packages and include
the control files to trigger construction and destruction of the final
signed kernel modules on the end-user system.
BugLink: https://bugs.launchpad.net/bugs/1918134
Signed-off-by: Andy Whitcroft <apw at canonical.com>
---
debian/rules.in | 26 +++------
debian/scripts/dkms-build--nvidia-N | 24 ++-------
debian/scripts/gen-rules.lrm | 83 +++++++++++++++++++++++------
debian/source/options | 2 +-
4 files changed, 79 insertions(+), 56 deletions(-)
diff --git a/debian/rules.in b/debian/rules.in
index 16033cb..d61feca 100755
--- a/debian/rules.in
+++ b/debian/rules.in
@@ -1,18 +1,7 @@
-#! /usr/bin/make -f
-
##export DH_VERBOSE := 1
arch = $(shell dpkg-architecture -qDEB_HOST_ARCH)
-# Work out the source package name and version. The version
-# is identical to this package less any rebuild suffix (+lrmN).
-src_package := $(shell LC_ALL=C dpkg-parsechangelog -SSource)
-src_fullversion = $(shell LC_ALL=C dpkg-parsechangelog -SVersion)
-src_abi = $(shell echo "$(src_fullversion)" | sed -ne 's/\([0-9]*\.[0-9]*\.[0-9]*\-[0-9]*\)\..*/\1/p')
-src_version = $(shell echo $(src_fullversion) | sed -e 's/+[0-9][0-9]*$$//')
-src_series = $(shell dpkg-parsechangelog -SDistribution | sed -e 's/-\(security\|updates\|proposed\)$$//')
-src_kernel = $(shell echo "$(src_package)" | sed -e 's/restricted-modules-//')
-
# Get variants, assuming primary if debian/variants is not present
variants = --
ifneq (,$(wildcard debian/variants))
@@ -28,7 +17,7 @@ endif
control_files += $(filter-out $(primary_control_files),$(shell LC_ALL=C ls -d debian/control.d/*))
test::
- echo "$(src_fullversion) $(src_version)"
+ echo "$(src_version) $(src_main_version)"
# We build our control file. This has to be done before dh runs otherwise
# we have no binary files and we will not run the appropriate targets.
@@ -44,34 +33,31 @@ pre-clean: $(control_files)
-e "s/\$${variant:suffix}/$$variant/g" \
-e "s/\(\$${$(tp_key)[^}]*}\)/$${variant_first:+\1}/g" \
<$$i; \
- echo ""; \
variant_first=''; \
done; \
else \
cat $$i; \
- echo ""; \
fi; \
done | sed \
-e "/@BUILD-INTERLOCK@/{" \
- -e " r debian/control.gen" \
+ -e " r debian/control.interlock-up" \
-e " d" \
-e " }" \
| sed \
- -e "s/\(\$${$(tp_key)\([^}]*\)}\)/kernel-testing--$(src_kernel)-\1-\2,/g" \
+ -e "s/\(\$${$(tp_key)\([^}]*\)}\)/kernel-testing--$(src_main_package)-\1-\2,/g" \
-e "s/@SRCPKGNAME@/$(src_package)/g" \
-e "s/@ABI@/$(src_abi)/g" \
- -e "s/@VERSION@/$(src_version)/g" \
+ -e "s/@VERSION@/$(src_main_version)/g" \
-e "s/@SERIES@/$(src_series)/g" \
>debian/control.tmp
rm -f debian/control
mv debian/control.tmp debian/control
- rm -rf ./$(src_version) UNSIGNED SIGNED
+ rm -rf ./$(src_main_version) UNSIGNED SIGNED
rm -f debian/linux-modules-*.install \
debian/linux-modules-*.preinst \
debian/linux-modules-*.prerm \
debian/linux-modules-*.postinst \
debian/linux-modules-*.postrm
- rm -rf $(dkms_dir)
.PHONY: pre-clean
@@ -79,6 +65,8 @@ debian/scripts/fix-filenames: debian/scripts/fix-filenames.c
$(CC) -o $@ $^
clean:: pre-clean
+ rm -f debian/scripts/fix-filenames
+ rm -rf $(dkms_dir)
%:
dh $@
diff --git a/debian/scripts/dkms-build--nvidia-N b/debian/scripts/dkms-build--nvidia-N
index d37082c..75a16df 100755
--- a/debian/scripts/dkms-build--nvidia-N
+++ b/debian/scripts/dkms-build--nvidia-N
@@ -79,28 +79,10 @@ sed -e 's/.*-o *\([^ ]*\) .*/rm -f \1/g' <"$pkgdir/bits/BUILD" >"$pkgdir/bits/C
:
elif [ "$sign" = "--lrm" ]; then
- # We are in LRM build the package a copy in any signatures we can
- # find for them. These will be added after linking.
- base="/usr/lib/linux/$abi_flavour"
-
- # Check the GCC version we are using against that used in the kernel
- # NOTE: that we treat this as only a warning, as if the binaries did come
- # out differently then we will actually
- echo "II: checking gcc version ..."
- cat "$base/compiler"
- gcc --version
- gcc_was=$(cat "$base/compiler" | sed -e 's/^GCC:/gcc/')
- gcc_is=$(gcc --version | head -1)
- if [ "$gcc_was" != "$gcc_is" ]; then
- echo "WW: gcc version missmatch between linux and linux-restricted-modules"
- echo "WW: was: $gcc_was is: $gcc_is"
- fi
-
- # Apply any local signatures.
- echo "II: adding signatures from $base ..."
- cp "$base/signatures/$package/"*".ko.sig" "$pkgdir/bits"
- sha256sum -c "$base/signatures/$package/SHA256SUMS" || exit 1
+ # We are in the LRM build; grab sha256 checksums and clean up.
+ sha256sum -b *.ko >"SHA256SUMS"
sh ./CLEAN
+
else
# We are in the main kernel, put the .kos together as we will
# on the users machine, sign them, and keep just the signature.
diff --git a/debian/scripts/gen-rules.lrm b/debian/scripts/gen-rules.lrm
index 7dc774e..a79eef0 100755
--- a/debian/scripts/gen-rules.lrm
+++ b/debian/scripts/gen-rules.lrm
@@ -1,12 +1,45 @@
#!/bin/bash
+# Pick out relevant version and package information including our predecessor
+# packages: linux -> linux-restricted-modules-signatures -> linux-restricted-modules
+src_package=$(LC_ALL=C dpkg-parsechangelog -SSource)
+src_version=$(LC_ALL=C dpkg-parsechangelog -SVersion)
+src_abi=$(echo "${src_version}" | sed -ne 's/\([0-9]*\.[0-9]*\.[0-9]*\-[0-9]*\)\..*/\1/p')
+src_series=$(LC_ALL=C dpkg-parsechangelog -SDistribution | sed -e 's/-\(security\|updates\|proposed\)$//')
+
+# linux/5.8.0-41.46
+src_main_package=$(echo "${src_package}" | sed -e 's/-restricted-modules//')
+src_main_version=$(echo ${src_version} | sed -e 's/+[0-9][0-9\.]*$//')
+
+# linux-restricted-generate/5.8.0-41.46[+1]
+
+# linux-restricted-signatures/5.8.0-41.46[+1]
+src_sigs_package=$(echo "${src_package}" | sed -e 's/-restricted-modules/-restricted-signatures/')
+src_sigs_version=${src_version}
+
+# linux-restricted-modules/5.8.0-41.46[+1]
+
mkdir -p "debian/control.d"
-cat "debian/rules.in" >"debian/rules.gen"
-: >"debian/control.gen"
+: >"debian/control.interlock-up"
: >"debian/control.d/meta-nvidia"
: >"debian/control.d/nvidia"
: >"debian/control.d/migrate-nvidia"
: >"debian/control.d/transitionals-local"
+: >"debian/control.d/signatures"
+
+cat - "debian/rules.in" >"debian/rules.gen" <<EOL
+#! /usr/bin/make -f
+
+src_package := ${src_package}
+src_version = ${src_version}
+src_abi = ${src_abi}
+src_series = ${src_series}
+src_main_package = ${src_main_package}
+src_main_version = ${src_main_version}
+src_sigs_package = ${src_sigs_package}
+src_sigs_version = ${src_sigs_version}
+
+EOL
dkms_build_new=$(grep -c 'shift 7' debian/scripts/dkms-build)
if [ "$dkms_build_new" -eq 0 ]; then
@@ -39,9 +72,8 @@ do
targets=$(echo "$archs" | sed -e 's/\</nvidia-/g')
- cat - >>"debian/control.gen" <<EOL
- linux-headers- at ABI@-${flavour} (>= @VERSION@) [${archs}],
- linux-buildinfo- at ABI@-${flavour} (>= @VERSION@) [${archs}],
+ cat - >>"debian/control.interlock-up" <<EOL
+ linux-headers-${src_abi}-${flavour} (>= @VERSION@) [${archs}],
EOL
while read package version extra
@@ -84,12 +116,14 @@ $targets::
mkdir -p \$(dkms_dir)/build \$(dkms_dir)/source
install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/usr/lib/linux/triggers
- \$(call build_dkms, \$(src_abi)-${flavour}, linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}, \$(CURDIR)/debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/\$(src_abi)-${flavour}/kernel, "", nvidia-${suffix_short}, pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-kernel-source-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-dkms-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb)
\$(call install_control,linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour},${flavour},nvidia,${suffix_short},postinst postrm prerm config templates)
+ install -d debian/linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
+ \$(call build_dkms, \$(src_abi)-${flavour}, linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}, \$(CURDIR)/debian/linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/\$(src_abi)-${flavour}/kernel, "", nvidia-${suffix_short}, pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-kernel-source-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-dkms-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb)
EOL
# debian/control.d/meta-nvidia
cat - >>"debian/control.d/meta-nvidia" <<EOL
+
Package: linux-modules-nvidia-${suffix_minus}-${flavour}\${variant:suffix}
Build-Profiles: <!stage1>
Architecture: ${archs}
@@ -97,16 +131,16 @@ Section: kernel
Provides: \${dkms:nvidia-${suffix_minus}-modules}, nvidia-prebuilt-kernel
Depends:
\${misc:Depends},
- linux-modules-nvidia-${suffix_minus}- at ABI@-${flavour} (= \${binary:Version}),
- \${nvk:nvidia-${suffix_minus}}
+ linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour} (= \${binary:Version}),
+ \${nvk:nvidia-${suffix_minus}},
Description: Extra drivers for nvidia-${suffix_minus} for the ${flavour}\${variant:suffix} flavour
Install extra signed nvidia-${suffix_minus} modules compatible with the ${flavour}\${variant:suffix} flavour.
-
EOL
# debian/control.d/nvidia
cat - >>"debian/control.d/nvidia" <<EOL
-Package: linux-modules-nvidia-${suffix_minus}- at ABI@-${flavour}
+
+Package: linux-objects-nvidia-${suffix_minus}-${src_abi}-${flavour}
Build-Profiles: <!stage1>
Architecture: ${archs}
Section: kernel
@@ -116,15 +150,34 @@ Depends:
\${misc:Depends},
\${shlibs:Depends},
binutils,
- linux-image- at ABI@-${flavour} | linux-image-unsigned- at ABI@-${flavour},
-Description: Linux kernel nvidia modules for version @ABI@
- This package contains the Linux kernel nvidia modules for version @ABI at .
+Description: Linux kernel nvidia modules for version ${src_abi} (objects)
+ This package contains the Linux kernel nvidia modules for version ${src_abi}.
.
You likely do not want to install this package directly. Instead, install the
one of the linux-modules-nvidia-${suffix_minus}-${flavour}* meta-packages,
which will ensure that upgrades work correctly, and that supporting packages are
also installed.
+Package: linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour}
+Build-Profiles: <!stage1>
+Architecture: ${archs}
+Section: kernel
+Priority: optional
+Built-Using: \${linux:BuiltUsing}
+Depends:
+ \${misc:Depends},
+ \${shlibs:Depends},
+ linux-image-${src_abi}-${flavour} | linux-image-unsigned-${src_abi}-${flavour},
+ linux-signatures-nvidia-${src_abi}-${flavour} (= ${src_sigs_version}),
+ linux-objects-nvidia-${suffix_minus}-${src_abi}-${flavour} (= \${binary:Version}),
+Description: Linux kernel nvidia modules for version ${src_abi}
+ This package pulls together the Linux kernel nvidia modules for
+ version ${src_abi} with the appropriate signatures.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-nvidia-${suffix_minus}-${flavour}* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
EOL
# debian/control.d/migrate-nvidia
for cmd in $extra
@@ -135,13 +188,13 @@ EOL
from_minus=$(echo "$from" | sed -e 's/nvidia-graphics-drivers-//')
echo "II: general transition $from -> $package ($from_minus -> $suffix_minus)"
cat - >>"debian/control.d/migrate-nvidia" <<EOL
+
Package: linux-modules-nvidia-${from_minus}-${flavour}\${variant:suffix}
Architecture: ${archs}
Section: oldlibs
Depends: linux-modules-nvidia-${suffix_minus}-${flavour}\${variant:suffix}
Description: Extra drivers for nvidia-${from_minus} for the ${flavour} flavour (dummy transitional package)
Transitional package for upgrades of -${from_minus} to -${suffix_minus}.
-
EOL
;;
esac
@@ -162,12 +215,12 @@ do
# debian/control.d/transitionals-local
echo "II: manual transition linux-modules-nvidia-$from -> linux-modules-nvidia-$to"
cat - >>"debian/control.d/transitionals-local" <<EOL
+
Package: linux-modules-nvidia-${from}
Architecture: ${archs}
Section: oldlibs
Depends: linux-modules-nvidia-${to}
Description: Extra drivers for nvidia-${from} (dummy transitional package)
Transitional package for upgrades of ${from} to ${to}.
-
EOL
done <"debian/package.config"
diff --git a/debian/source/options b/debian/source/options
index 693e1f7..34a8b9f 100644
--- a/debian/source/options
+++ b/debian/source/options
@@ -3,4 +3,4 @@ diff-ignore
tar-ignore
tar-ignore debian/control.d
tar-ignore debian/rules.gen
-tar-ignore debian/control.gen
+tar-ignore debian/control.interlock-up
--
2.29.2
More information about the kernel-team
mailing list