Ryan Malloy
3b505644b2
Rebuilt with KBUILD_BUILD_USER/HOST/TIMESTAMP pinned. Without them the kernel bakes the builder's user@hostname and wall-clock build time into /proc/version, which publishes operator identity in a public artifact and makes the build unreproducible. Pinned, anyone can rebuild and diff the bytes — the only trust story available for an unsigned community kernel. The installer refuses to run on anything but a Pi 4, refuses a mismatched image/modules pair (vermagic failure means no /dev/pps0 on a kernel that otherwise boots fine — silent and miserable to debug), verifies SHA256SUMS, never touches kernel8.img, and leaves rollback as deleting one config.txt line. Boot-tested on the Pi: Stratum 1, 273 ns offset, PPS handler confirmed NOT threaded. Binaries ship as release assets, not in git.
34 lines
1.4 KiB
Bash
Executable File
34 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Reproducible RT kernel for the Cuckoo Escapement release.
|
|
#
|
|
# KBUILD_BUILD_{USER,HOST,TIMESTAMP} are the whole point of this rebuild: without
|
|
# them the kernel bakes the builder's `user@hostname` and the wall-clock build
|
|
# time into /proc/version, which (a) publishes operator identity and (b) makes
|
|
# the artifact unreproducible. Pinning all three means anyone can rebuild this
|
|
# and diff the bytes.
|
|
set -euo pipefail
|
|
cd "$HOME/src"
|
|
|
|
PATCH="$(cd "$(dirname "$0")" && pwd)/0001-pps-gpio-keep-timestamp-in-hard-irq-under-PREEMPT_RT.patch"
|
|
|
|
[ -d linux ] || git clone --depth=1 --branch rpi-6.18.y https://github.com/raspberrypi/linux
|
|
cd linux
|
|
|
|
export ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu-
|
|
export KBUILD_BUILD_USER=cuckoo
|
|
export KBUILD_BUILD_HOST=escapement
|
|
export KBUILD_BUILD_TIMESTAMP='Mon Jan 1 00:00:00 UTC 2024'
|
|
|
|
make bcm2711_defconfig
|
|
./scripts/config --enable EXPERT --enable PREEMPT_RT \
|
|
--set-str LOCALVERSION "-rt-cuckoo" --disable LOCALVERSION_AUTO
|
|
make olddefconfig
|
|
|
|
git apply --check "$PATCH" 2>/dev/null && git apply "$PATCH" && echo "PATCH APPLIED" \
|
|
|| grep -q IRQF_NO_THREAD drivers/pps/clients/pps-gpio.c && echo "PATCH ALREADY PRESENT"
|
|
|
|
grep -q "IRQF_NO_THREAD" drivers/pps/clients/pps-gpio.c || { echo "FATAL: patch missing"; exit 1; }
|
|
|
|
make -j"$(nproc)" Image modules dtbs
|
|
echo "BUILD OK: $(cat include/config/kernel.release)"
|