Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add and publish kernel-devel package #1156

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

jnohlgard
Copy link

This recipe is based on the Fedora kernel-devel RPM build spec 1.

The purpose of this image is to have a published smaller image to use as
a prerequisite when building external modules for the corresponding
kernel.

As a comparison, the size of this kernel-devel image for amd64 is 96 MiB
vs 12.8 GiB for the complete kernel-build intermediate image with all of
the sources and object files.

Copy link
Member

@smira smira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is something we won't accept, as it would publish an ephemeral signing key which is not what should happen

This recipe is based on the Fedora kernel-devel RPM build spec [1].

The purpose of this image is to have a published smaller image to use as
a prerequisite when building external modules for the corresponding
kernel.

As a comparison, the size of this kernel-devel image for amd64 is 96 MiB
vs 12.8 GiB for the complete kernel-build intermediate image with all of
the sources and object files.

[1]: https://src.fedoraproject.org/rpms/kernel/raw/rawhide/f/kernel.spec
@jnohlgard
Copy link
Author

I don't understand, there are no key files in this image AFAIK?
Is there anything that I can modify in this recipe to make it suitable for publishing?

The important feature here is to get the Module.symvers along with any generated headers and Makefiles in order to be able to build external modules as extensions to the Talos upstream kernel without having to compile the same kernel on my local machine and throwing away the results.

The whole kernel along with the external modules need to be signed by a key that is on the local build machine, but it does not need to recompile everything in order to do that.

@smira
Copy link
Member

smira commented Feb 11, 2025

The build stage generates an ephemeral signing key, so I would stay away from publishing any output of it without huge risk.

Not sure how you see using this output without having the key matching the kernel. So too many questions without answers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants