feat(kernel-hwe): add copied HWE kernel packaging - #18762
feat(kernel-hwe): add copied HWE kernel packaging#18762Rachel Menge (rlmenge) wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
A few concrete issues in newly added build/helper scripts and the kernel source download URI should be fixed to avoid breaking builds and introducing avoidable lint/security pitfalls.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR introduces a new kernel-hwe component by copying in a full downstream kernel packaging tree (spec, configs, helper scripts, SBAT templates, signing materials), and checks in the corresponding rendered output under specs/ along with a new component lock.
Changes:
- Add a new
kernel-hwecomponent definition that builds from a local spec and declares required source URIs/hashes. - Add the copied kernel packaging content under
base/comps/kernel-hwe/and the rendered mirror underspecs/k/kernel-hwe/. - Add a new
locks/kernel-hwe.lockto pin the component input fingerprint.
File summaries
| File | Description |
|---|---|
| base/comps/kernel-hwe/6.18-aarch64-azl.config | Copied kernel-hwe config input. |
| base/comps/kernel-hwe/6.18-x86_64-azl.config | Copied kernel-hwe config input. |
| base/comps/kernel-hwe/Makefile.rhelver | Copied kernel-hwe build metadata. |
| base/comps/kernel-hwe/Module.kabi_aarch64 | Copied kABI reference input. |
| base/comps/kernel-hwe/Module.kabi_dup_aarch64 | Copied kABI reference input. |
| base/comps/kernel-hwe/Module.kabi_dup_x86_64 | Copied kABI reference input. |
| base/comps/kernel-hwe/Module.kabi_x86_64 | Copied kABI reference input. |
| base/comps/kernel-hwe/Patchlist.changelog | Copied patch list/changelog metadata. |
| base/comps/kernel-hwe/README.rst | Copied upstream packaging documentation. |
| base/comps/kernel-hwe/azurelinux-ca-20230216.pem | Copied signing/trust material. |
| base/comps/kernel-hwe/check-kabi | Copied kABI check helper script. |
| base/comps/kernel-hwe/def_variants.yaml.fedora | Copied module packaging rules (Fedora flavor). |
| base/comps/kernel-hwe/def_variants.yaml.rhel | Copied module packaging rules (RHEL flavor). |
| base/comps/kernel-hwe/dracut-virt.conf | Copied dracut config for virt UKI/initramfs. |
| base/comps/kernel-hwe/fedoraimaca.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/filtermods.py | Copied packaging helper script. |
| base/comps/kernel-hwe/flavors | Copied flavor list. |
| base/comps/kernel-hwe/gating.yaml | Copied gating policy metadata. |
| base/comps/kernel-hwe/generate_all_configs.sh | Copied config-generation helper script. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-16k-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-16k-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-64k-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-64k-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-64k-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-aarch64-rt-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-rt-debug-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-rt-debug-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-rt-fedora.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe-x86_64-rt-rhel.config | Copied kernel-hwe variant config. |
| base/comps/kernel-hwe/kernel-hwe.changelog | Copied kernel-hwe changelog metadata. |
| base/comps/kernel-hwe/kernel-hwe.comp.toml | New component definition (local spec + source URIs/hashes). |
| base/comps/kernel-hwe/kernel-hwe.spec | New local HWE kernel spec (core of the component). |
| base/comps/kernel-hwe/kernel-local | Copied local override placeholder file. |
| base/comps/kernel-hwe/kernel.sbat.template | Copied SBAT template for kernel artifacts. |
| base/comps/kernel-hwe/kmod-nvidia-open-modprobe.conf | Copied modprobe config for NVIDIA open kmod. |
| base/comps/kernel-hwe/kmod-nvidia-open.inc | Copied spec include for NVIDIA open kmod subpackage. |
| base/comps/kernel-hwe/kvm_stat.logrotate | Copied logrotate configuration. |
| base/comps/kernel-hwe/linux-kernel-test.patch | Copied patch input. |
| base/comps/kernel-hwe/merge.py | Copied config merge helper script. |
| base/comps/kernel-hwe/mod-denylist.sh | Copied module denylist generation script. |
| base/comps/kernel-hwe/mod-sign.sh | Copied module signing helper script. |
| base/comps/kernel-hwe/nvidiagpuoot001.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/partial-clang-debug-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-clang-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-clang_lto-aarch64-debug-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-clang_lto-aarch64-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-clang_lto-x86_64-debug-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-clang_lto-x86_64-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-kgcov-debug-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/partial-kgcov-snip.config | Copied partial config snippet. |
| base/comps/kernel-hwe/process_configs.sh | Copied config processing helper script. |
| base/comps/kernel-hwe/redhatsecureboot501.cer | Copied signing/trust material. |
| base/comps/kernel-hwe/redhatsecurebootca5.cer | Copied signing/trust material. |
| base/comps/kernel-hwe/rheldup3.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/rhelima.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/rhelima_centos.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/rhelimaca1.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/rhelkpatch1.x509 | Copied signing key/cert material. |
| base/comps/kernel-hwe/rpminspect.yaml | Copied rpminspect configuration. |
| base/comps/kernel-hwe/sources | Copied sources manifest (hashes). |
| base/comps/kernel-hwe/uki-addons.sbat.template | Copied SBAT template for UKI addons. |
| base/comps/kernel-hwe/uki.sbat.template | Copied SBAT template for UKIs. |
| base/comps/kernel-hwe/uki_addons.json | Copied UKI addon definition JSON. |
| base/comps/kernel-hwe/uki_create_addons.py | Copied UKI addon generation helper script. |
| base/comps/kernel-hwe/x509.genkey.centos | Copied x509 key template. |
| base/comps/kernel-hwe/x509.genkey.fedora | Copied x509 key template. |
| base/comps/kernel-hwe/x509.genkey.rhel | Copied x509 key template. |
| locks/kernel-hwe.lock | New component lock (input fingerprint). |
| specs/k/kernel-hwe/6.18-aarch64-azl.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/6.18-x86_64-azl.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Makefile.rhelver | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Module.kabi_aarch64 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Module.kabi_dup_aarch64 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Module.kabi_dup_x86_64 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Module.kabi_x86_64 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/Patchlist.changelog | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/README.rst | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/azurelinux-ca-20230216.pem | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/check-kabi | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/def_variants.yaml.fedora | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/def_variants.yaml.rhel | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/dracut-virt.conf | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/fedoraimaca.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/filtermods.py | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/flavors | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/gating.yaml | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/generate_all_configs.sh | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-16k-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-16k-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-64k-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-64k-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-64k-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-aarch64-rt-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-rt-debug-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-rt-debug-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-rt-fedora.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe-x86_64-rt-rhel.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe.azl.macros | Rendered azldev-generated macros for kernel-hwe. |
| specs/k/kernel-hwe/kernel-hwe.changelog | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel-hwe.spec | Rendered kernel-hwe spec mirror. |
| specs/k/kernel-hwe/kernel-local | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kernel.sbat.template | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kmod-nvidia-open-modprobe.conf | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kmod-nvidia-open.inc | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/kvm_stat.logrotate | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/linux-kernel-test.patch | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/merge.py | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/mod-denylist.sh | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/mod-sign.sh | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/nvidiagpuoot001.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang-debug-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang_lto-aarch64-debug-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang_lto-aarch64-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang_lto-x86_64-debug-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-clang_lto-x86_64-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-kgcov-debug-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/partial-kgcov-snip.config | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/process_configs.sh | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/redhatsecureboot501.cer | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/redhatsecurebootca5.cer | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rheldup3.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rhelima.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rhelima_centos.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rhelimaca1.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rhelkpatch1.x509 | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/rpminspect.yaml | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/sources | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/uki-addons.sbat.template | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/uki.sbat.template | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/uki_addons.json | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/uki_create_addons.py | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/x509.genkey.centos | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/x509.genkey.fedora | Rendered kernel-hwe artifact mirror. |
| specs/k/kernel-hwe/x509.genkey.rhel | Rendered kernel-hwe artifact mirror. |
Review details
- Files reviewed: 78/163 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| filename = "kernel-6.18.43.1.tar.gz" | ||
| hash = "6941bcc7dc0b5e329b3a2bab967705e8c1eb1cb8ebe89a30d11c0db8dbb6c3ef68d6124c855f9912a27476335dd343c47b52209b252a36c2203842fc544b2b6d" | ||
| hash-type = "SHA512" | ||
| origin = { type = "download", uri = "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/azl4-hwe/6.18.43.1.tar.gz" } |
| mod="$rpm_buildroot/$1" | ||
| [ ! "$mod" ] && return 0 | ||
| if modinfo "$mod" | grep -q '^alias:\s\+net-'; then | ||
| mod="${1##*/}" |
| modules=$(find "$moddir" -type f -name '*.ko') | ||
|
|
||
| NPROC=$(nproc) | ||
| [ -z "$NPROC" ] && NPROC=1 | ||
|
|
||
| # NB: this loop runs 2000+ iterations. Try to be fast. | ||
| echo "$modules" | xargs -r -n16 -P "$NPROC" sh -c " | ||
| for mod; do | ||
| ./scripts/sign-file sha256 $MODSECKEY $MODPUBKEY \$mod | ||
| rm -f \$mod.sig \$mod.dig | ||
| done | ||
| " DUMMYARG0 # xargs appends ARG1 ARG2..., which go into $mod in for loop. |
| import getopt | ||
| import string | ||
| import sys |
| if not os.path.isdir(out_dir): | ||
| usage(f'out_dir_dir {out_dir} is not a dir, or does not exist!') |
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
There was a problem hiding this comment.
🟡 Changes recommended
Non-namespaced userspace packages can conflict with the default kernel, source configs target the wrong version, and required RPM inspection and smoke testing are missing.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (9)
Previously missed (6) — in code that hasn't changed since the last review.
base/comps/kernel-hwe/kernel-hwe.comp.toml:4
- The PR reports only a scratch build and defers installation/coexistence validation. For a new output-producing component,
AGENTS.md:24-30requires inspecting the RPMs and smoke-testing them in a mock chroot in addition to building; complete and document those checks before approval.
base/comps/kernel-hwe/kernel-hwe.comp.toml:13 - Both committed AZL configs (
6.18-x86_64-azl.configand6.18-aarch64-azl.config) identify themselves as generated for Linux 6.18.45.1, while this component pins the HWE 6.18.43.1 tree. Regenerate the architecture configs from the pinned HWE source so Kconfig additions/removals are resolved against the kernel actually being packaged.
base/comps/kernel-hwe/Makefile.rhelver:21 - Add the missing apostrophe in this contraction.
base/comps/kernel-hwe/check-kabi:125 - Correct this typo in the diagnostic comment.
base/comps/kernel-hwe/kernel-local:1 - Add the missing apostrophe in this contraction.
base/comps/kernel-hwe/uki_create_addons.py:3 - Correct the typo in this generated-input comment.
This issue also appears in the following locations of the same file:
- line 18
- line 19
base/comps/kernel-hwe/uki_create_addons.py:18
- Use the correct article here.
base/comps/kernel-hwe/uki_create_addons.py:19 - Use “a” before the consonant sound in “UKI.”
base/comps/kernel-hwe/uki_create_addons.py:51 - The parameter name is duplicated in this error message, making the diagnostic unnecessarily confusing.
- Files reviewed: 78/163 changed files
- Comments generated: 1
- Review effort level: Balanced
| # Keep release handling aligned with the source kernel spec. | ||
| release = { calculation = "manual" } | ||
|
|
||
| [components.kernel-hwe.build.defines] |
Summary
Adds the initial Azure Linux 4
kernel-hwepackage based on the HWE 6.18 source branch.This intentionally starts with a copied/rendered kernel package so HWE can be built and validated independently without restructuring the default kernel package at the same time. The longer-term direction is to extract common packaging into one shared spec with TOML-driven variant overlays once the real variant boundaries are established.
Changes
kernel-hwecomponent and rendered spec.rolling-lts/azl4-hwe/6.18.43.1.kernel.Validation
Follow-up
Before shipping HWE, the package will be validated for coexistence with the default kernel, including:
uname -ridentities;Common packaging will then be migrated to the shared kernel-variant model described in the proposed kernel-variants ADR.