Skip to content

feat(kernel-hwe): add copied HWE kernel packaging - #18762

Draft
Rachel Menge (rlmenge) wants to merge 2 commits into
microsoft:4.0from
rlmenge:rlmenge/4.0/kernel-hwel
Draft

feat(kernel-hwe): add copied HWE kernel packaging#18762
Rachel Menge (rlmenge) wants to merge 2 commits into
microsoft:4.0from
rlmenge:rlmenge/4.0/kernel-hwel

Conversation

@rlmenge

@rlmenge Rachel Menge (rlmenge) commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds the initial Azure Linux 4 kernel-hwe package based on the HWE 6.18 source branch.

This intentionally starts with a copied/rendered kernel package so HWE can be built and validated independently without restructuring the default kernel package at the same time. The longer-term direction is to extract common packaging into one shared spec with TOML-driven variant overlays once the real variant boundaries are established.

Changes

  • Adds the independently named kernel-hwe component and rendered spec.
  • Pins the HWE source to rolling-lts/azl4-hwe/6.18.43.1.
  • Adds x86_64 and aarch64 configurations and generated packaging inputs.
  • Produces HWE-specific kernel packages without replacing the default kernel.
  • Adds the NVIDIA open-kernel-module source and packaging inputs.
  • Adds the generated lock and component outputs.

Validation

  • Scratch package build passed.
  • Rendered-spec and lock drift checks passed.
  • TOML validation passed.
  • The required-config check currently reports differences against an outdated policy; those results are not being used as the HWE configuration source of truth.

Follow-up

Before shipping HWE, the package will be validated for coexistence with the default kernel, including:

  • unique package and uname -r identities;
  • concurrent installation and upgrades;
  • boot selection and removal;
  • kernel-module dependency resolution;
  • install-only retention; and
  • Secure Boot and module signing.

Common packaging will then be migrated to the shared kernel-variant model described in the proposed kernel-variants ADR.

Copilot AI balanced review requested due to automatic review settings September 8, 2026 19:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

A few concrete issues in newly added build/helper scripts and the kernel source download URI should be fixed to avoid breaking builds and introducing avoidable lint/security pitfalls.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR introduces a new kernel-hwe component by copying in a full downstream kernel packaging tree (spec, configs, helper scripts, SBAT templates, signing materials), and checks in the corresponding rendered output under specs/ along with a new component lock.

Changes:

  • Add a new kernel-hwe component definition that builds from a local spec and declares required source URIs/hashes.
  • Add the copied kernel packaging content under base/comps/kernel-hwe/ and the rendered mirror under specs/k/kernel-hwe/.
  • Add a new locks/kernel-hwe.lock to pin the component input fingerprint.
File summaries
File Description
base/comps/kernel-hwe/6.18-aarch64-azl.config Copied kernel-hwe config input.
base/comps/kernel-hwe/6.18-x86_64-azl.config Copied kernel-hwe config input.
base/comps/kernel-hwe/Makefile.rhelver Copied kernel-hwe build metadata.
base/comps/kernel-hwe/Module.kabi_aarch64 Copied kABI reference input.
base/comps/kernel-hwe/Module.kabi_dup_aarch64 Copied kABI reference input.
base/comps/kernel-hwe/Module.kabi_dup_x86_64 Copied kABI reference input.
base/comps/kernel-hwe/Module.kabi_x86_64 Copied kABI reference input.
base/comps/kernel-hwe/Patchlist.changelog Copied patch list/changelog metadata.
base/comps/kernel-hwe/README.rst Copied upstream packaging documentation.
base/comps/kernel-hwe/azurelinux-ca-20230216.pem Copied signing/trust material.
base/comps/kernel-hwe/check-kabi Copied kABI check helper script.
base/comps/kernel-hwe/def_variants.yaml.fedora Copied module packaging rules (Fedora flavor).
base/comps/kernel-hwe/def_variants.yaml.rhel Copied module packaging rules (RHEL flavor).
base/comps/kernel-hwe/dracut-virt.conf Copied dracut config for virt UKI/initramfs.
base/comps/kernel-hwe/fedoraimaca.x509 Copied signing key/cert material.
base/comps/kernel-hwe/filtermods.py Copied packaging helper script.
base/comps/kernel-hwe/flavors Copied flavor list.
base/comps/kernel-hwe/gating.yaml Copied gating policy metadata.
base/comps/kernel-hwe/generate_all_configs.sh Copied config-generation helper script.
base/comps/kernel-hwe/kernel-hwe-aarch64-16k-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-16k-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-64k-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-64k-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-aarch64-rt-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-rt-debug-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-rt-debug-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-rt-fedora.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe-x86_64-rt-rhel.config Copied kernel-hwe variant config.
base/comps/kernel-hwe/kernel-hwe.changelog Copied kernel-hwe changelog metadata.
base/comps/kernel-hwe/kernel-hwe.comp.toml New component definition (local spec + source URIs/hashes).
base/comps/kernel-hwe/kernel-hwe.spec New local HWE kernel spec (core of the component).
base/comps/kernel-hwe/kernel-local Copied local override placeholder file.
base/comps/kernel-hwe/kernel.sbat.template Copied SBAT template for kernel artifacts.
base/comps/kernel-hwe/kmod-nvidia-open-modprobe.conf Copied modprobe config for NVIDIA open kmod.
base/comps/kernel-hwe/kmod-nvidia-open.inc Copied spec include for NVIDIA open kmod subpackage.
base/comps/kernel-hwe/kvm_stat.logrotate Copied logrotate configuration.
base/comps/kernel-hwe/linux-kernel-test.patch Copied patch input.
base/comps/kernel-hwe/merge.py Copied config merge helper script.
base/comps/kernel-hwe/mod-denylist.sh Copied module denylist generation script.
base/comps/kernel-hwe/mod-sign.sh Copied module signing helper script.
base/comps/kernel-hwe/nvidiagpuoot001.x509 Copied signing key/cert material.
base/comps/kernel-hwe/partial-clang-debug-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-clang-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-clang_lto-aarch64-debug-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-clang_lto-aarch64-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-clang_lto-x86_64-debug-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-clang_lto-x86_64-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-kgcov-debug-snip.config Copied partial config snippet.
base/comps/kernel-hwe/partial-kgcov-snip.config Copied partial config snippet.
base/comps/kernel-hwe/process_configs.sh Copied config processing helper script.
base/comps/kernel-hwe/redhatsecureboot501.cer Copied signing/trust material.
base/comps/kernel-hwe/redhatsecurebootca5.cer Copied signing/trust material.
base/comps/kernel-hwe/rheldup3.x509 Copied signing key/cert material.
base/comps/kernel-hwe/rhelima.x509 Copied signing key/cert material.
base/comps/kernel-hwe/rhelima_centos.x509 Copied signing key/cert material.
base/comps/kernel-hwe/rhelimaca1.x509 Copied signing key/cert material.
base/comps/kernel-hwe/rhelkpatch1.x509 Copied signing key/cert material.
base/comps/kernel-hwe/rpminspect.yaml Copied rpminspect configuration.
base/comps/kernel-hwe/sources Copied sources manifest (hashes).
base/comps/kernel-hwe/uki-addons.sbat.template Copied SBAT template for UKI addons.
base/comps/kernel-hwe/uki.sbat.template Copied SBAT template for UKIs.
base/comps/kernel-hwe/uki_addons.json Copied UKI addon definition JSON.
base/comps/kernel-hwe/uki_create_addons.py Copied UKI addon generation helper script.
base/comps/kernel-hwe/x509.genkey.centos Copied x509 key template.
base/comps/kernel-hwe/x509.genkey.fedora Copied x509 key template.
base/comps/kernel-hwe/x509.genkey.rhel Copied x509 key template.
locks/kernel-hwe.lock New component lock (input fingerprint).
specs/k/kernel-hwe/6.18-aarch64-azl.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/6.18-x86_64-azl.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Makefile.rhelver Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Module.kabi_aarch64 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Module.kabi_dup_aarch64 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Module.kabi_dup_x86_64 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Module.kabi_x86_64 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/Patchlist.changelog Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/README.rst Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/azurelinux-ca-20230216.pem Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/check-kabi Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/def_variants.yaml.fedora Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/def_variants.yaml.rhel Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/dracut-virt.conf Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/fedoraimaca.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/filtermods.py Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/flavors Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/gating.yaml Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/generate_all_configs.sh Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-16k-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-16k-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-64k-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-64k-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-aarch64-rt-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-rt-debug-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-rt-debug-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-rt-fedora.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe-x86_64-rt-rhel.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe.azl.macros Rendered azldev-generated macros for kernel-hwe.
specs/k/kernel-hwe/kernel-hwe.changelog Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel-hwe.spec Rendered kernel-hwe spec mirror.
specs/k/kernel-hwe/kernel-local Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kernel.sbat.template Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kmod-nvidia-open-modprobe.conf Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kmod-nvidia-open.inc Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/kvm_stat.logrotate Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/linux-kernel-test.patch Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/merge.py Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/mod-denylist.sh Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/mod-sign.sh Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/nvidiagpuoot001.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang-debug-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang_lto-aarch64-debug-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang_lto-aarch64-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang_lto-x86_64-debug-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-clang_lto-x86_64-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-kgcov-debug-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/partial-kgcov-snip.config Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/process_configs.sh Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/redhatsecureboot501.cer Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/redhatsecurebootca5.cer Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rheldup3.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rhelima.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rhelima_centos.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rhelimaca1.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rhelkpatch1.x509 Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/rpminspect.yaml Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/sources Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/uki-addons.sbat.template Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/uki.sbat.template Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/uki_addons.json Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/uki_create_addons.py Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/x509.genkey.centos Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/x509.genkey.fedora Rendered kernel-hwe artifact mirror.
specs/k/kernel-hwe/x509.genkey.rhel Rendered kernel-hwe artifact mirror.
Review details
  • Files reviewed: 78/163 changed files
  • Comments generated: 5
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

filename = "kernel-6.18.43.1.tar.gz"
hash = "6941bcc7dc0b5e329b3a2bab967705e8c1eb1cb8ebe89a30d11c0db8dbb6c3ef68d6124c855f9912a27476335dd343c47b52209b252a36c2203842fc544b2b6d"
hash-type = "SHA512"
origin = { type = "download", uri = "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/azl4-hwe/6.18.43.1.tar.gz" }
Comment on lines +27 to +30
mod="$rpm_buildroot/$1"
[ ! "$mod" ] && return 0
if modinfo "$mod" | grep -q '^alias:\s\+net-'; then
mod="${1##*/}"
Comment on lines +16 to +27
modules=$(find "$moddir" -type f -name '*.ko')

NPROC=$(nproc)
[ -z "$NPROC" ] && NPROC=1

# NB: this loop runs 2000+ iterations. Try to be fast.
echo "$modules" | xargs -r -n16 -P "$NPROC" sh -c "
for mod; do
./scripts/sign-file sha256 $MODSECKEY $MODPUBKEY \$mod
rm -f \$mod.sig \$mod.dig
done
" DUMMYARG0 # xargs appends ARG1 ARG2..., which go into $mod in for loop.
Comment on lines +25 to +27
import getopt
import string
import sys
Comment on lines +50 to +51
if not os.path.isdir(out_dir):
usage(f'out_dir_dir {out_dir} is not a dir, or does not exist!')
@rlmenge

Copy link
Copy Markdown
Contributor Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

Copilot AI review requested due to automatic review settings September 10, 2026 21:27

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Non-namespaced userspace packages can conflict with the default kernel, source configs target the wrong version, and required RPM inspection and smoke testing are missing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (9)

Previously missed (6) — in code that hasn't changed since the last review.

base/comps/kernel-hwe/kernel-hwe.comp.toml:4

  • The PR reports only a scratch build and defers installation/coexistence validation. For a new output-producing component, AGENTS.md:24-30 requires inspecting the RPMs and smoke-testing them in a mock chroot in addition to building; complete and document those checks before approval.
    base/comps/kernel-hwe/kernel-hwe.comp.toml:13
  • Both committed AZL configs (6.18-x86_64-azl.config and 6.18-aarch64-azl.config) identify themselves as generated for Linux 6.18.45.1, while this component pins the HWE 6.18.43.1 tree. Regenerate the architecture configs from the pinned HWE source so Kconfig additions/removals are resolved against the kernel actually being packaged.
    base/comps/kernel-hwe/Makefile.rhelver:21
  • Add the missing apostrophe in this contraction.
    base/comps/kernel-hwe/check-kabi:125
  • Correct this typo in the diagnostic comment.
    base/comps/kernel-hwe/kernel-local:1
  • Add the missing apostrophe in this contraction.
    base/comps/kernel-hwe/uki_create_addons.py:3
  • Correct the typo in this generated-input comment.

This issue also appears in the following locations of the same file:

  • line 18
  • line 19

base/comps/kernel-hwe/uki_create_addons.py:18

  • Use the correct article here.
    base/comps/kernel-hwe/uki_create_addons.py:19
  • Use “a” before the consonant sound in “UKI.”
    base/comps/kernel-hwe/uki_create_addons.py:51
  • The parameter name is duplicated in this error message, making the diagnostic unnecessarily confusing.
  • Files reviewed: 78/163 changed files
  • Comments generated: 1
  • Review effort level: Balanced

# Keep release handling aligned with the source kernel spec.
release = { calculation = "manual" }

[components.kernel-hwe.build.defines]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants