| Message ID | 20200619073142.508284-1-Jason@zx2c4.com |
|---|---|
| State | New |
| Headers | show |
| Series | [bionic] UBUNTU: SAUCE: wireguard: add dkms to build so module gets signed | expand |
On Fri, Jun 19, 2020 at 01:31:42AM -0600, Jason A. Donenfeld wrote: > Now that wireguard-dkms has been put into Bionic's -proposed, and soon > to -updates, we can properly put wireguard.ko into the Bionic kernel in > the nicely signed version that users have on Focal and Eoan. Because > everybody is very busy due to recent security things, according to > apw@, I figured it'd be easiest to just attempt to do this myself. > > Now, I'm not a Canonical kernel maintainer and these scripts aren't > mine, but I still tried my hardest to copy the patterns used in the > Focal kernel, while updating it for the subtle macro differences used by > the Bionic kernel. > > In my testing, this appears to work very well, though I temporarily had > to change ~18.04.1 to ~20.04.1 in the dkms-versions file, because the > new 18.04.1 one doesn't appear to have propagated to the archives yet. > But as the package moves from -proposed to -updates, I expect that issue > to go away pretty soon on its own. Beyond that, this appears to have > worked entirely as planned, and the resulting deb arrived with a fully > functional wireguard.ko. > > So, hopefully you can take this patch as-is, and it won't require > further delay or hassle. If not as-is, at the very least this should > require very minimal tweeking from code owners. > > That way, a signed wireguard.ko is able to be shipped with Bionic for > the June 29 kernel update and not be delayed for another month. This looks pretty close for bionic:linux, Nacking in favour of a tested series which includes the bionic:linux-meta changes needed to bring the provides infrastructure that the wireguard package relies on. -apw
diff --git a/debian.master/abi/4.15.0-106.107/amd64/generic.modules b/debian.master/abi/4.15.0-106.107/amd64/generic.modules index 89033f0d3f41..f343cdd9c398 100644 --- a/debian.master/abi/4.15.0-106.107/amd64/generic.modules +++ b/debian.master/abi/4.15.0-106.107/amd64/generic.modules @@ -4969,6 +4969,7 @@ wimax winbond-840 winbond-cir wire +wireguard wishbone-serial wl1251 wl1251_sdio diff --git a/debian.master/abi/4.15.0-106.107/amd64/lowlatency.modules b/debian.master/abi/4.15.0-106.107/amd64/lowlatency.modules index 1a5a5aa8ca4b..ec056b847ebc 100644 --- a/debian.master/abi/4.15.0-106.107/amd64/lowlatency.modules +++ b/debian.master/abi/4.15.0-106.107/amd64/lowlatency.modules @@ -4970,6 +4970,7 @@ wimax winbond-840 winbond-cir wire +wireguard wishbone-serial wl1251 wl1251_sdio diff --git a/debian.master/abi/4.15.0-106.107/arm64/generic.modules b/debian.master/abi/4.15.0-106.107/arm64/generic.modules index d869d759c89f..a4a0ea34656a 100644 --- a/debian.master/abi/4.15.0-106.107/arm64/generic.modules +++ b/debian.master/abi/4.15.0-106.107/arm64/generic.modules @@ -5051,6 +5051,7 @@ wilc1000-spi wimax winbond-840 wire +wireguard wishbone-serial wl1251 wl1251_sdio diff --git a/debian.master/abi/4.15.0-106.107/armhf/generic-lpae.modules b/debian.master/abi/4.15.0-106.107/armhf/generic-lpae.modules index bf527e703040..42ffbf50e7db 100644 --- a/debian.master/abi/4.15.0-106.107/armhf/generic-lpae.modules +++ b/debian.master/abi/4.15.0-106.107/armhf/generic-lpae.modules @@ -5038,6 +5038,7 @@ wilc1000-spi wimax winbond-840 wire +wireguard wishbone-serial wl1251 wl1251_sdio diff --git a/debian.master/abi/4.15.0-106.107/armhf/generic.modules b/debian.master/abi/4.15.0-106.107/armhf/generic.modules index e286b9ac66e6..8b654ea0adef 100644 --- a/debian.master/abi/4.15.0-106.107/armhf/generic.modules +++ b/debian.master/abi/4.15.0-106.107/armhf/generic.modules @@ -5155,6 +5155,7 @@ wilc1000-spi wimax winbond-840 wire +wireguard wishbone-serial wkup_m3_rproc wl1251 diff --git a/debian.master/abi/4.15.0-106.107/i386/generic.modules b/debian.master/abi/4.15.0-106.107/i386/generic.modules index 222984800975..85caffdfb0fc 100644 --- a/debian.master/abi/4.15.0-106.107/i386/generic.modules +++ b/debian.master/abi/4.15.0-106.107/i386/generic.modules @@ -5078,6 +5078,7 @@ wimax winbond-840 winbond-cir wire +wireguard wishbone-serial wistron_btns wl1251 diff --git a/debian.master/abi/4.15.0-106.107/i386/lowlatency.modules b/debian.master/abi/4.15.0-106.107/i386/lowlatency.modules index 0e5d78b00f21..bf59d657d9be 100644 --- a/debian.master/abi/4.15.0-106.107/i386/lowlatency.modules +++ b/debian.master/abi/4.15.0-106.107/i386/lowlatency.modules @@ -5079,6 +5079,7 @@ wimax winbond-840 winbond-cir wire +wireguard wishbone-serial wistron_btns wl1251 diff --git a/debian.master/abi/4.15.0-106.107/ppc64el/generic.modules b/debian.master/abi/4.15.0-106.107/ppc64el/generic.modules index 0d9140953fbd..c08bce0391a3 100644 --- a/debian.master/abi/4.15.0-106.107/ppc64el/generic.modules +++ b/debian.master/abi/4.15.0-106.107/ppc64el/generic.modules @@ -4632,6 +4632,7 @@ wimax winbond-840 windfarm_core wire +wireguard wishbone-serial wl1251 wl1251_sdio diff --git a/debian.master/abi/4.15.0-106.107/s390x/generic.modules b/debian.master/abi/4.15.0-106.107/s390x/generic.modules index 14c752fc84f6..776ef861f3ec 100644 --- a/debian.master/abi/4.15.0-106.107/s390x/generic.modules +++ b/debian.master/abi/4.15.0-106.107/s390x/generic.modules @@ -813,6 +813,7 @@ vsock_diag vsockmon vx855 vxlan +wireguard wp512 x_tables xcbc diff --git a/debian.master/rules.d/amd64.mk b/debian.master/rules.d/amd64.mk index 3d248c270232..daffd0d7a3dc 100644 --- a/debian.master/rules.d/amd64.mk +++ b/debian.master/rules.d/amd64.mk @@ -23,3 +23,4 @@ do_tools_common = true do_tools_acpidbg = true do_zfs = true do_dkms_nvidia = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/arm64.mk b/debian.master/rules.d/arm64.mk index c49d25e752df..e524e9ac9a22 100644 --- a/debian.master/rules.d/arm64.mk +++ b/debian.master/rules.d/arm64.mk @@ -20,3 +20,4 @@ do_tools_bpftool = true do_dtbs = true do_zfs = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/armhf.mk b/debian.master/rules.d/armhf.mk index 085e8acdc8aa..d0c2d7f29048 100644 --- a/debian.master/rules.d/armhf.mk +++ b/debian.master/rules.d/armhf.mk @@ -17,3 +17,4 @@ do_tools_perf_jvmti = true do_tools_bpftool = true do_dtbs = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/i386.mk b/debian.master/rules.d/i386.mk index 89ad2a6c26cf..61adfcbc7d3a 100644 --- a/debian.master/rules.d/i386.mk +++ b/debian.master/rules.d/i386.mk @@ -17,3 +17,4 @@ do_tools_bpftool = true do_tools_x86 = true do_tools_hyperv = true do_extras_package = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/ppc64el.mk b/debian.master/rules.d/ppc64el.mk index 3934ef482a57..a0bc38892cd8 100644 --- a/debian.master/rules.d/ppc64el.mk +++ b/debian.master/rules.d/ppc64el.mk @@ -19,3 +19,4 @@ do_tools_bpftool = true #do_flavour_image_package = false do_zfs = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/s390x.mk b/debian.master/rules.d/s390x.mk index cbc188507892..7eded44aadf1 100644 --- a/debian.master/rules.d/s390x.mk +++ b/debian.master/rules.d/s390x.mk @@ -19,3 +19,4 @@ do_tools_perf_jvmti = true do_tools_bpftool = true do_zfs = true +do_dkms_wireguard = true diff --git a/debian.master/rules.d/x32.mk b/debian.master/rules.d/x32.mk index e0ccff961f02..059669782446 100644 --- a/debian.master/rules.d/x32.mk +++ b/debian.master/rules.d/x32.mk @@ -12,3 +12,5 @@ no_dumpfile = true uefi_signed = true do_flavour_image_package = false + +do_dkms_wireguard = true diff --git a/debian/dkms-versions b/debian/dkms-versions index e04ed8315cf3..3db891dadd66 100644 --- a/debian/dkms-versions +++ b/debian/dkms-versions @@ -3,3 +3,4 @@ zfs-linux 0.7.5-1ubuntu16.9 nvidia-graphics-drivers-390 390.132-0ubuntu0.18.04.1 nvidia-graphics-drivers-435 435.21-0ubuntu0.18.04.2 nvidia-graphics-drivers-440 440.59-0ubuntu0.18.04.1 +wireguard-linux-compat 1.0.20200611-1ubuntu1~18.04.1 diff --git a/debian/rules b/debian/rules index bfc23aa45270..b517f41a5beb 100755 --- a/debian/rules +++ b/debian/rules @@ -45,6 +45,7 @@ ifneq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH)) disable_d_i=true do_zfs=false do_dkms_nvidia=false + do_dkms_wireguard=false endif # Are any of the kernel signing options enabled. @@ -94,6 +95,10 @@ ifeq ($(do_zfs),false) do_zfs_disable:=$(shell cat $(DROOT)/zfs-modules.ignore >>$(prev_abidir)/../modules.ignore) endif +ifeq ($(do_dkms_wireguard),false) + do_wireguard_disable:=$(shell cat $(DROOT)/wireguard-modules.ignore >>$(prev_abidir)/../modules.ignore) +endif + # Either tools package needs the common source preparation do_any_tools=$(sort $(filter-out false,$(do_linux_tools) $(do_cloud_tools))) @@ -110,6 +115,7 @@ dkms_spl_linux_version=$(shell gawk '/^spl-linux / { print $$2; }' debian/dkms-v dkms_nvidia_390_version=$(shell gawk '/^nvidia-graphics-drivers-390/ { print $$2; }' debian/dkms-versions) dkms_nvidia_435_version=$(shell gawk '/^nvidia-graphics-drivers-435/ { print $$2; }' debian/dkms-versions) dkms_nvidia_440_version=$(shell gawk '/^nvidia-graphics-drivers-440/ { print $$2; }' debian/dkms-versions) +dkms_wireguard_version=$(shell gawk '/^wireguard-linux-compat / { print $$2; }' debian/dkms-versions) # Debian Build System targets binary: binary-indep binary-arch diff --git a/debian/rules.d/2-binary-arch.mk b/debian/rules.d/2-binary-arch.mk index 0e2b48d4ce5b..62af6bf55f11 100644 --- a/debian/rules.d/2-binary-arch.mk +++ b/debian/rules.d/2-binary-arch.mk @@ -401,6 +401,8 @@ endif $(if $(filter true,$(enable_zfs)),$(call build_dkms, $(mods_pkg_name)-$*, $(pkgdir)/lib/modules/$(abi_release)-$*/kernel, spl, pool/universe/s/spl-linux/spl-dkms_$(dkms_spl_linux_version)_all.deb)) $(if $(filter true,$(enable_zfs)),$(call build_dkms, $(mods_pkg_name)-$*, $(pkgdir)/lib/modules/$(abi_release)-$*/kernel, zfs, pool/universe/z/zfs-linux/zfs-dkms_$(dkms_zfs_linux_version)_all.deb)) + $(if $(filter true,$(do_dkms_wireguard)),$(call build_dkms, $(mods_pkg_name)-$*, $(pkgdir)/lib/modules/$(abi_release)-$*/kernel, wireguard, pool/universe/w/wireguard-linux-compat/wireguard-dkms_$(dkms_wireguard_version)_all.deb)) + ifeq ($(do_dkms_nvidia),true) $(call build_dkms, $(bldinfo_pkg_name)-$*, $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/signatures, nvidia-390, pool/restricted/n/nvidia-graphics-drivers-390/nvidia-kernel-source-390_$(dkms_nvidia_390_version)_$(arch).deb pool/restricted/n/nvidia-graphics-drivers-390/nvidia-dkms-390_$(dkms_nvidia_390_version)_$(arch).deb) $(call build_dkms, $(bldinfo_pkg_name)-$*, $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/signatures, nvidia-435, pool/restricted/n/nvidia-graphics-drivers-435/nvidia-kernel-source-435_$(dkms_nvidia_435_version)_$(arch).deb pool/restricted/n/nvidia-graphics-drivers-435/nvidia-dkms-435_$(dkms_nvidia_435_version)_$(arch).deb) diff --git a/debian/wireguard-modules.ignore b/debian/wireguard-modules.ignore new file mode 100644 index 000000000000..a82c63a2033f --- /dev/null +++ b/debian/wireguard-modules.ignore @@ -0,0 +1 @@ +wireguard
Now that wireguard-dkms has been put into Bionic's -proposed, and soon to -updates, we can properly put wireguard.ko into the Bionic kernel in the nicely signed version that users have on Focal and Eoan. Because everybody is very busy due to recent security things, according to apw@, I figured it'd be easiest to just attempt to do this myself. Now, I'm not a Canonical kernel maintainer and these scripts aren't mine, but I still tried my hardest to copy the patterns used in the Focal kernel, while updating it for the subtle macro differences used by the Bionic kernel. In my testing, this appears to work very well, though I temporarily had to change ~18.04.1 to ~20.04.1 in the dkms-versions file, because the new 18.04.1 one doesn't appear to have propagated to the archives yet. But as the package moves from -proposed to -updates, I expect that issue to go away pretty soon on its own. Beyond that, this appears to have worked entirely as planned, and the resulting deb arrived with a fully functional wireguard.ko. So, hopefully you can take this patch as-is, and it won't require further delay or hassle. If not as-is, at the very least this should require very minimal tweeking from code owners. That way, a signed wireguard.ko is able to be shipped with Bionic for the June 29 kernel update and not be delayed for another month. Cc: Tony Espy <espy@canonical.com> Cc: Yannick Duhalde <Yannick.Duhalde@se.com> Cc: Andy Whitcroft <apw@canonical.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- debian.master/abi/4.15.0-106.107/amd64/generic.modules | 1 + debian.master/abi/4.15.0-106.107/amd64/lowlatency.modules | 1 + debian.master/abi/4.15.0-106.107/arm64/generic.modules | 1 + debian.master/abi/4.15.0-106.107/armhf/generic-lpae.modules | 1 + debian.master/abi/4.15.0-106.107/armhf/generic.modules | 1 + debian.master/abi/4.15.0-106.107/i386/generic.modules | 1 + debian.master/abi/4.15.0-106.107/i386/lowlatency.modules | 1 + debian.master/abi/4.15.0-106.107/ppc64el/generic.modules | 1 + debian.master/abi/4.15.0-106.107/s390x/generic.modules | 1 + debian.master/rules.d/amd64.mk | 1 + debian.master/rules.d/arm64.mk | 1 + debian.master/rules.d/armhf.mk | 1 + debian.master/rules.d/i386.mk | 1 + debian.master/rules.d/ppc64el.mk | 1 + debian.master/rules.d/s390x.mk | 1 + debian.master/rules.d/x32.mk | 2 ++ debian/dkms-versions | 1 + debian/rules | 6 ++++++ debian/rules.d/2-binary-arch.mk | 2 ++ debian/wireguard-modules.ignore | 1 + 20 files changed, 27 insertions(+) create mode 100644 debian/wireguard-modules.ignore