diff mbox series

[8/9] UBUNTU: [Packaging] linux-restricted-modules -- consume published signatures

Message ID 20210308150004.1746089-9-apw@canonical.com
State New
Headers show
Series LP#1918134 -- LRMv4 switch to signing with Ubuntu Kernel Modules signing key | expand

Commit Message

Andy Whitcroft March 8, 2021, 3 p.m. UTC
Split our output into a pair of packages.  linux-objects-nvidia-* which
contain the raw .o files and associated helpers, and linux-modules-nvidia-*
which depend both the objects and the signatures packages and include
the control files to trigger construction and destruction of the final
signed kernel modules on the end-user system.

BugLink: https://bugs.launchpad.net/bugs/1918134
Signed-off-by: Andy Whitcroft <apw@canonical.com>
---
 debian/rules.in                     | 26 +++------
 debian/scripts/dkms-build--nvidia-N | 24 ++-------
 debian/scripts/gen-rules.lrm        | 83 +++++++++++++++++++++++------
 debian/source/options               |  2 +-
 4 files changed, 79 insertions(+), 56 deletions(-)
diff mbox series

Patch

diff --git a/debian/rules.in b/debian/rules.in
index 16033cb..d61feca 100755
--- a/debian/rules.in
+++ b/debian/rules.in
@@ -1,18 +1,7 @@ 
-#! /usr/bin/make -f
-
 ##export DH_VERBOSE := 1
 
 arch = $(shell dpkg-architecture -qDEB_HOST_ARCH)
 
-# Work out the source package name and version. The version
-# is identical to this package less any rebuild suffix (+lrmN).
-src_package := $(shell LC_ALL=C dpkg-parsechangelog -SSource)
-src_fullversion = $(shell LC_ALL=C dpkg-parsechangelog -SVersion)
-src_abi = $(shell echo "$(src_fullversion)" | sed -ne 's/\([0-9]*\.[0-9]*\.[0-9]*\-[0-9]*\)\..*/\1/p')
-src_version = $(shell echo $(src_fullversion) | sed -e 's/+[0-9][0-9]*$$//')
-src_series = $(shell dpkg-parsechangelog -SDistribution | sed -e 's/-\(security\|updates\|proposed\)$$//')
-src_kernel = $(shell echo "$(src_package)" | sed -e 's/restricted-modules-//')
-
 # Get variants, assuming primary if debian/variants is not present
 variants = --
 ifneq (,$(wildcard debian/variants))
@@ -28,7 +17,7 @@  endif
 control_files += $(filter-out $(primary_control_files),$(shell LC_ALL=C ls -d debian/control.d/*))
 
 test::
-	echo "$(src_fullversion) $(src_version)"
+	echo "$(src_version) $(src_main_version)"
 
 # We build our control file.  This has to be done before dh runs otherwise
 # we have no binary files and we will not run the appropriate targets.
@@ -44,34 +33,31 @@  pre-clean: $(control_files)
 					-e "s/\$${variant:suffix}/$$variant/g"		\
 					-e "s/\(\$${$(tp_key)[^}]*}\)/$${variant_first:+\1}/g" \
 					<$$i;						\
-				echo "";						\
 				variant_first='';					\
 			done;								\
 		else									\
 			cat $$i;							\
-			echo "";							\
 		fi;									\
 	done | sed									\
 		-e "/@BUILD-INTERLOCK@/{"						\
-		-e " r debian/control.gen"						\
+		-e " r debian/control.interlock-up"					\
 		-e " d"									\
 		-e " }"									\
 	     | sed									\
-		-e "s/\(\$${$(tp_key)\([^}]*\)}\)/kernel-testing--$(src_kernel)-\1-\2,/g" \
+		-e "s/\(\$${$(tp_key)\([^}]*\)}\)/kernel-testing--$(src_main_package)-\1-\2,/g" \
 		-e "s/@SRCPKGNAME@/$(src_package)/g"					\
 		-e "s/@ABI@/$(src_abi)/g"						\
-		-e "s/@VERSION@/$(src_version)/g"					\
+		-e "s/@VERSION@/$(src_main_version)/g"					\
 		-e "s/@SERIES@/$(src_series)/g"						\
 	    >debian/control.tmp
 	rm -f debian/control
 	mv debian/control.tmp debian/control
-	rm -rf ./$(src_version) UNSIGNED SIGNED
+	rm -rf ./$(src_main_version) UNSIGNED SIGNED
 	rm -f 	debian/linux-modules-*.install						\
 		debian/linux-modules-*.preinst 						\
 		debian/linux-modules-*.prerm 						\
 		debian/linux-modules-*.postinst 					\
 		debian/linux-modules-*.postrm
-	rm -rf $(dkms_dir)
 
 .PHONY: pre-clean
 
@@ -79,6 +65,8 @@  debian/scripts/fix-filenames: debian/scripts/fix-filenames.c
 	$(CC) -o $@ $^
 
 clean:: pre-clean
+	rm -f debian/scripts/fix-filenames
+	rm -rf $(dkms_dir)
 
 %:
 	dh $@
diff --git a/debian/scripts/dkms-build--nvidia-N b/debian/scripts/dkms-build--nvidia-N
index d37082c..75a16df 100755
--- a/debian/scripts/dkms-build--nvidia-N
+++ b/debian/scripts/dkms-build--nvidia-N
@@ -79,28 +79,10 @@  sed -e 's/.*-o  *\([^ ]*\) .*/rm -f \1/g' <"$pkgdir/bits/BUILD" >"$pkgdir/bits/C
 		:
 
 	elif [ "$sign" = "--lrm" ]; then
-		# We are in LRM build the package a copy in any signatures we can
-		# find for them.  These will be added after linking.
-		base="/usr/lib/linux/$abi_flavour"
-
-		# Check the GCC version we are using against that used in the kernel
-		# NOTE: that we treat this as only a warning, as if the binaries did come
-		# out differently then we will actually 
-		echo "II: checking gcc version ..."
-		cat "$base/compiler"
-		gcc --version
-		gcc_was=$(cat "$base/compiler" | sed -e 's/^GCC:/gcc/')
-		gcc_is=$(gcc --version | head -1)
-		if [ "$gcc_was" != "$gcc_is" ]; then
-			echo "WW: gcc version missmatch between linux and linux-restricted-modules"
-			echo "WW: was: $gcc_was  is: $gcc_is"
-		fi
-
-		# Apply any local signatures.
-		echo "II: adding signatures from $base ..."
-		cp "$base/signatures/$package/"*".ko.sig" "$pkgdir/bits"
-		sha256sum -c "$base/signatures/$package/SHA256SUMS" || exit 1
+		# We are in the LRM build; grab sha256 checksums and clean up.
+		sha256sum -b *.ko >"SHA256SUMS"
 		sh ./CLEAN
+
 	else
 		# We are in the main kernel, put the .kos together as we will
 		# on the users machine, sign them, and keep just the signature.
diff --git a/debian/scripts/gen-rules.lrm b/debian/scripts/gen-rules.lrm
index 7dc774e..a79eef0 100755
--- a/debian/scripts/gen-rules.lrm
+++ b/debian/scripts/gen-rules.lrm
@@ -1,12 +1,45 @@ 
 #!/bin/bash
 
+# Pick out relevant version and package information including our predecessor
+# packages: linux -> linux-restricted-modules-signatures -> linux-restricted-modules
+src_package=$(LC_ALL=C dpkg-parsechangelog -SSource)
+src_version=$(LC_ALL=C dpkg-parsechangelog -SVersion)
+src_abi=$(echo "${src_version}" | sed -ne 's/\([0-9]*\.[0-9]*\.[0-9]*\-[0-9]*\)\..*/\1/p')
+src_series=$(LC_ALL=C dpkg-parsechangelog -SDistribution | sed -e 's/-\(security\|updates\|proposed\)$//')
+
+# linux/5.8.0-41.46
+src_main_package=$(echo "${src_package}" | sed -e 's/-restricted-modules//')
+src_main_version=$(echo ${src_version} | sed -e 's/+[0-9][0-9\.]*$//')
+
+# linux-restricted-generate/5.8.0-41.46[+1]
+
+# linux-restricted-signatures/5.8.0-41.46[+1]
+src_sigs_package=$(echo "${src_package}" | sed -e 's/-restricted-modules/-restricted-signatures/')
+src_sigs_version=${src_version}
+
+# linux-restricted-modules/5.8.0-41.46[+1]
+
 mkdir -p "debian/control.d"
-cat "debian/rules.in" >"debian/rules.gen"
-: >"debian/control.gen"
+: >"debian/control.interlock-up"
 : >"debian/control.d/meta-nvidia"
 : >"debian/control.d/nvidia"
 : >"debian/control.d/migrate-nvidia"
 : >"debian/control.d/transitionals-local"
+: >"debian/control.d/signatures"
+
+cat - "debian/rules.in" >"debian/rules.gen" <<EOL
+#! /usr/bin/make -f
+
+src_package := ${src_package}
+src_version = ${src_version}
+src_abi = ${src_abi}
+src_series = ${src_series}
+src_main_package = ${src_main_package}
+src_main_version = ${src_main_version}
+src_sigs_package = ${src_sigs_package}
+src_sigs_version = ${src_sigs_version}
+
+EOL
 
 dkms_build_new=$(grep -c 'shift 7' debian/scripts/dkms-build)
 if [ "$dkms_build_new" -eq 0 ]; then
@@ -39,9 +72,8 @@  do
 
 	targets=$(echo "$archs" | sed -e 's/\</nvidia-/g')
 
-	cat - >>"debian/control.gen" <<EOL
- linux-headers-@ABI@-${flavour} (>= @VERSION@) [${archs}],
- linux-buildinfo-@ABI@-${flavour} (>= @VERSION@) [${archs}],
+	cat - >>"debian/control.interlock-up" <<EOL
+ linux-headers-${src_abi}-${flavour} (>= @VERSION@) [${archs}],
 EOL
 
 	while read package version extra
@@ -84,12 +116,14 @@  $targets::
 	mkdir -p \$(dkms_dir)/build \$(dkms_dir)/source
 	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
 	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/usr/lib/linux/triggers
-	\$(call build_dkms, \$(src_abi)-${flavour}, linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}, \$(CURDIR)/debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/\$(src_abi)-${flavour}/kernel, "", nvidia-${suffix_short}, pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-kernel-source-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-dkms-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb)
 	\$(call install_control,linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour},${flavour},nvidia,${suffix_short},postinst postrm prerm config templates)
+	install -d debian/linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
+	\$(call build_dkms, \$(src_abi)-${flavour}, linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}, \$(CURDIR)/debian/linux-objects-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/\$(src_abi)-${flavour}/kernel, "", nvidia-${suffix_short}, pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-kernel-source-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb pool/restricted/n/nvidia-graphics-drivers-${suffix_minus}/nvidia-dkms-${suffix_minus}_\$(dkms_nvidia_${suffix_under}_version)_\$(arch).deb)
 EOL
 
 		# debian/control.d/meta-nvidia
 		cat - >>"debian/control.d/meta-nvidia" <<EOL
+
 Package: linux-modules-nvidia-${suffix_minus}-${flavour}\${variant:suffix}
 Build-Profiles: <!stage1>
 Architecture: ${archs}
@@ -97,16 +131,16 @@  Section: kernel
 Provides: \${dkms:nvidia-${suffix_minus}-modules}, nvidia-prebuilt-kernel
 Depends:
  \${misc:Depends},
- linux-modules-nvidia-${suffix_minus}-@ABI@-${flavour} (= \${binary:Version}),
- \${nvk:nvidia-${suffix_minus}}
+ linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour} (= \${binary:Version}),
+ \${nvk:nvidia-${suffix_minus}},
 Description: Extra drivers for nvidia-${suffix_minus} for the ${flavour}\${variant:suffix} flavour
  Install extra signed nvidia-${suffix_minus} modules compatible with the ${flavour}\${variant:suffix} flavour.
-
 EOL
 
 		# debian/control.d/nvidia
 		cat - >>"debian/control.d/nvidia" <<EOL
-Package: linux-modules-nvidia-${suffix_minus}-@ABI@-${flavour}
+
+Package: linux-objects-nvidia-${suffix_minus}-${src_abi}-${flavour}
 Build-Profiles: <!stage1>
 Architecture: ${archs}
 Section: kernel
@@ -116,15 +150,34 @@  Depends:
  \${misc:Depends},
  \${shlibs:Depends},
  binutils,
- linux-image-@ABI@-${flavour} | linux-image-unsigned-@ABI@-${flavour},
-Description: Linux kernel nvidia modules for version @ABI@
- This package contains the Linux kernel nvidia modules for version @ABI@.
+Description: Linux kernel nvidia modules for version ${src_abi} (objects)
+ This package contains the Linux kernel nvidia modules for version ${src_abi}.
  .
  You likely do not want to install this package directly. Instead, install the
  one of the linux-modules-nvidia-${suffix_minus}-${flavour}* meta-packages,
  which will ensure that upgrades work correctly, and that supporting packages are
  also installed.
 
+Package: linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour}
+Build-Profiles: <!stage1>
+Architecture: ${archs}
+Section: kernel
+Priority: optional
+Built-Using: \${linux:BuiltUsing}
+Depends:
+ \${misc:Depends},
+ \${shlibs:Depends},
+ linux-image-${src_abi}-${flavour} | linux-image-unsigned-${src_abi}-${flavour},
+ linux-signatures-nvidia-${src_abi}-${flavour} (= ${src_sigs_version}),
+ linux-objects-nvidia-${suffix_minus}-${src_abi}-${flavour} (= \${binary:Version}),
+Description: Linux kernel nvidia modules for version ${src_abi}
+ This package pulls together the Linux kernel nvidia modules for
+ version ${src_abi} with the appropriate signatures.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-nvidia-${suffix_minus}-${flavour}* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
 EOL
 		# debian/control.d/migrate-nvidia
 		for cmd in $extra
@@ -135,13 +188,13 @@  EOL
 				from_minus=$(echo "$from" | sed -e 's/nvidia-graphics-drivers-//')
 				echo "II: general transition $from -> $package ($from_minus -> $suffix_minus)"
 				cat - >>"debian/control.d/migrate-nvidia" <<EOL
+
 Package: linux-modules-nvidia-${from_minus}-${flavour}\${variant:suffix}
 Architecture: ${archs}
 Section: oldlibs
 Depends: linux-modules-nvidia-${suffix_minus}-${flavour}\${variant:suffix}
 Description: Extra drivers for nvidia-${from_minus} for the ${flavour} flavour (dummy transitional package)
  Transitional package for upgrades of -${from_minus} to -${suffix_minus}.
-
 EOL
 				;;
 			esac
@@ -162,12 +215,12 @@  do
 	# debian/control.d/transitionals-local
 	echo "II: manual transition linux-modules-nvidia-$from -> linux-modules-nvidia-$to"
 	cat - >>"debian/control.d/transitionals-local" <<EOL
+
 Package: linux-modules-nvidia-${from}
 Architecture: ${archs}
 Section: oldlibs
 Depends: linux-modules-nvidia-${to}
 Description: Extra drivers for nvidia-${from} (dummy transitional package)
  Transitional package for upgrades of ${from} to ${to}.
-
 EOL
 done <"debian/package.config"
diff --git a/debian/source/options b/debian/source/options
index 693e1f7..34a8b9f 100644
--- a/debian/source/options
+++ b/debian/source/options
@@ -3,4 +3,4 @@  diff-ignore
 tar-ignore
 tar-ignore debian/control.d
 tar-ignore debian/rules.gen
-tar-ignore debian/control.gen
+tar-ignore debian/control.interlock-up