From af7fc05959a5962d25275bb451d4f943443a7746 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 30 Dec 2023 11:38:31 +0100 Subject: [PATCH 1/3] linux/hardened: read min supported kernel from kernels-org.json This one isn't 4.14 anymore and that should've been updated while removing 4.14, but is easy to miss. Since it's not expected that we have versions older than the oldest mainline version from `kernels-org.json`, determine the minimum supported version by reading it from there. Also, this means lesser places to update when dropping old kernels. This needs an additional change for the mainline updater to make sure that no older versions appear there[1]. This will be implemented in the next commit. [1] At the time of implementing this, the oldest supported kernel was 4.19, however 4.14 wasn't EOL yet and thus still picked up by the mainline updater. --- pkgs/os-specific/linux/kernel/hardened/update.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py index ce54c2980758..cb624ebe86b9 100755 --- a/pkgs/os-specific/linux/kernel/hardened/update.py +++ b/pkgs/os-specific/linux/kernel/hardened/update.py @@ -1,5 +1,5 @@ #! /usr/bin/env nix-shell -#! nix-shell -i python -p "python3.withPackages (ps: [ps.pygithub])" git gnupg +#! nix-shell -i python -p "python3.withPackages (ps: [ps.pygithub ps.packaging])" git gnupg # This is automatically called by ../update.sh. @@ -27,6 +27,8 @@ from typing import ( from github import Github from github.GitRelease import GitRelease +from packaging.version import parse as parse_version, Version + VersionComponent = Union[int, str] Version = List[VersionComponent] @@ -39,6 +41,11 @@ Patch = TypedDict("Patch", { }) +def read_min_kernel_branch() -> List[str]: + with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as f: + return list(parse_version(sorted(json.load(f).keys())[0]).release) + + @dataclass class ReleaseInfo: version: Version @@ -51,7 +58,7 @@ NIXPKGS_PATH = HERE.parents[4] HARDENED_GITHUB_REPO = "anthraxx/linux-hardened" HARDENED_TRUSTED_KEY = HERE / "anthraxx.asc" HARDENED_PATCHES_PATH = HERE / "patches.json" -MIN_KERNEL_VERSION: Version = [4, 14] +MIN_KERNEL_VERSION: Version = read_min_kernel_branch() def run(*args: Union[str, Path]) -> subprocess.CompletedProcess[bytes]: From 76d763eeb922e1c0ac9bee990f9ab93498decf1d Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 30 Dec 2023 11:40:59 +0100 Subject: [PATCH 2/3] linux: ignore kernel branches older than min supported branch Right now, hashes for 4.14 are kept (and thus also maintained by the hardened updater) even though we don't support that anymore, the oldest supported branch is 4.19. To avoid having to remember too many places where to drop a kernel when dropping an old one (next will be 4.19), the oldest kernel branch will be determined by the lowest version number in the keys of `kernels-org.json`. That way, it's sufficient to drop an old branch from this file and it will be ignored on the upcoming update runs. Yes, the code to read from that file is duplicated, but I'd expect the min version to change way more often than 3 lines of code reading a version from a JSON file[1]. The logic is fairly simple though: if the branch (i.e. MAJOR.MINOR) of a kernel that's listed on kernel.org[2] is older than the oldest version in `kernels-org.json`, it's omitted on update and a message is printed like this: [...] linux_5_4: 5.4.265 is latest, skipping... linux_4_19: 4.19.303 is latest, skipping... 4.14 is too old and not supported anymore, skipping... Kernels that have the branch `testing` are excluded from that check and always allowed. [1] Also, I'm unhappy already that I can't just do a relative import in here to deduplicate the function and for 3 lines of code it seems like unnecessarily much effort to create a python package structure here. [2] Kernels that got unlisted there are too old to be added/kept here anyways. --- .../linux/kernel/update-mainline.py | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py index 30b9ebec984c..020e55c5fe40 100755 --- a/pkgs/os-specific/linux/kernel/update-mainline.py +++ b/pkgs/os-specific/linux/kernel/update-mainline.py @@ -1,5 +1,5 @@ #!/usr/bin/env nix-shell -#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])" +#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ps.packaging ])" import json import os import pathlib @@ -10,6 +10,8 @@ from dataclasses import dataclass from enum import Enum from bs4 import BeautifulSoup, NavigableString, Tag +from packaging.version import parse as parse_version, Version +from typing import List HERE = pathlib.Path(__file__).parent ROOT = HERE.parent.parent.parent.parent @@ -80,6 +82,18 @@ def get_hash(kernel: KernelRelease): return f"sha256:{hash}" +def get_oldest_branch() -> Version: + with open(VERSIONS_FILE) as f: + return parse_version(sorted(json.load(f).keys())[0]) + + +def predates_oldest_branch(oldest: Version, to_compare: str) -> bool: + if to_compare == "testing": + return False + + return parse_version(to_compare) < oldest + + def commit(message): return subprocess.check_call(["git", "commit", "-m", message, VERSIONS_FILE]) @@ -97,6 +111,8 @@ def main(): parsed_releases = filter(None, [parse_release(release) for release in releases]) all_kernels = json.load(VERSIONS_FILE.open()) + oldest_branch = get_oldest_branch() + for kernel in parsed_releases: branch = get_branch(kernel.version) nixpkgs_branch = branch.replace(".", "_") @@ -106,6 +122,13 @@ def main(): print(f"linux_{nixpkgs_branch}: {kernel.version} is latest, skipping...") continue + if predates_oldest_branch(oldest_branch, kernel.branch): + print( + f"{kernel.branch} is too old and not supported anymore, skipping...", + file=sys.stderr + ) + continue + if old_version is None: message = f"linux_{nixpkgs_branch}: init at {kernel.version}" else: From 1ecd7075270529848da929a8fc8b1c3b1ef81716 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 30 Dec 2023 11:51:16 +0100 Subject: [PATCH 3/3] linux: remove 4.14 from kernels-org.json --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 13fd2ed4d371..7412b33436d6 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -27,10 +27,6 @@ "version": "4.19.303", "hash": "sha256:0dlbl47xs7z4yf9cxbxqzd7zs1f9070jr6ck231wgppa6lwwwb82" }, - "4.14": { - "version": "4.14.334", - "hash": "sha256:0iaaqdkszmfarvjfszc9rf7y9zsv3w82934xmvmzmsbiz86547ca" - }, "6.6": { "version": "6.6.8", "hash": "sha256:05i4ayj9wyjkd1s8ixx7bxwcyagqyx8rhj1zvbc3cjqyw4sc8djh"