|
| 1 | +%global debug_package %{nil} |
| 2 | +%global buildarch aarch64 |
| 3 | +%define uname_r %{version}-%{release} |
| 4 | +Summary: Signed Linux Kernel for %{buildarch} systems |
| 5 | +Name: kernel-hwe-signed-%{buildarch} |
| 6 | +Version: 6.12.40.1 |
| 7 | +Release: 1%{?dist} |
| 8 | +License: GPLv2 |
| 9 | +Vendor: Microsoft Corporation |
| 10 | +Distribution: Azure Linux |
| 11 | +Group: System Environment/Kernel |
| 12 | +URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel |
| 13 | +# This package's "version" and "release" must reflect the unsigned version that |
| 14 | +# was signed. |
| 15 | +# An important consequence is that when making a change to this package, the |
| 16 | +# unsigned version/release must be increased to keep the two versions consistent. |
| 17 | +# Ideally though, this spec will not change much or at all, so the version will |
| 18 | +# just track the unsigned package's version/release. |
| 19 | +# |
| 20 | +# To populate these sources: |
| 21 | +# 1. Build the unsigned packages as normal |
| 22 | +# 2. Sign the desired binary |
| 23 | +# 3. Place the unsigned package and signed binary in this spec's folder |
| 24 | +# 4. Build this spec |
| 25 | +Source0: kernel-hwe-%{version}-%{release}.%{buildarch}.rpm |
| 26 | +Source1: vmlinuz-%{uname_r} |
| 27 | +ExclusiveArch: aarch64 |
| 28 | +BuildRequires: cpio |
| 29 | +BuildRequires: grub2-rpm-macros |
| 30 | +BuildRequires: openssl |
| 31 | +BuildRequires: sed |
| 32 | +%{?grub2_configuration_requires} |
| 33 | + |
| 34 | +%description |
| 35 | +This package contains the Linux kernel package with kernel signed with the production key |
| 36 | + |
| 37 | +%package -n kernel-hwe |
| 38 | +Summary: Linux Kernel |
| 39 | +Group: System Environment/Kernel |
| 40 | +Requires: filesystem |
| 41 | +Requires: kmod |
| 42 | +Requires(post): coreutils |
| 43 | +Requires(postun): coreutils |
| 44 | + |
| 45 | +%description -n kernel-hwe |
| 46 | +The kernel package contains the signed Linux kernel. |
| 47 | + |
| 48 | +%prep |
| 49 | + |
| 50 | +%build |
| 51 | +mkdir rpm_contents |
| 52 | +pushd rpm_contents |
| 53 | + |
| 54 | +# This spec's whole purpose is to inject the signed kernel binary |
| 55 | +rpm2cpio %{SOURCE0} | cpio -idmv |
| 56 | +cp %{SOURCE1} ./boot/vmlinuz-%{uname_r} |
| 57 | + |
| 58 | +popd |
| 59 | + |
| 60 | +%install |
| 61 | +pushd rpm_contents |
| 62 | + |
| 63 | +# Don't use * wildcard. It does not copy over hidden files in the root folder... |
| 64 | +cp -rp ./. %{buildroot}/ |
| 65 | + |
| 66 | +popd |
| 67 | + |
| 68 | +%triggerin -n kernel-hwe -- initramfs |
| 69 | +mkdir -p %{_localstatedir}/lib/rpm-state/initramfs/pending |
| 70 | +touch %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r} |
| 71 | +echo "initrd generation of kernel %{uname_r} will be triggered later" >&2 |
| 72 | + |
| 73 | +%triggerun -n kernel-hwe -- initramfs |
| 74 | +rm -rf %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r} |
| 75 | +rm -rf /boot/initramfs-%{uname_r}.img |
| 76 | +echo "initrd of kernel %{uname_r} removed" >&2 |
| 77 | + |
| 78 | +%postun -n kernel-hwe |
| 79 | +%grub2_postun |
| 80 | + |
| 81 | +%post -n kernel-hwe |
| 82 | +/sbin/depmod -a %{uname_r} |
| 83 | +%grub2_post |
| 84 | + |
| 85 | +%files -n kernel-hwe |
| 86 | +%defattr(-,root,root) |
| 87 | +%license COPYING |
| 88 | +/boot/System.map-%{uname_r} |
| 89 | +/boot/config-%{uname_r} |
| 90 | +/boot/vmlinuz-%{uname_r} |
| 91 | +%defattr(0644,root,root) |
| 92 | +/lib/modules/%{uname_r}/* |
| 93 | +%exclude /lib/modules/%{uname_r}/build |
| 94 | +%exclude /lib/modules/%{uname_r}/kernel/drivers/gpu |
| 95 | +%exclude /lib/modules/%{uname_r}/kernel/sound |
| 96 | +%exclude /module_info.ld |
| 97 | + |
| 98 | +%changelog |
| 99 | +* Fri Aug 15 2025 Siddharth Chintamaneni <[email protected]> - 6.12.40.1-1 |
| 100 | +- Original version for Azure Linux |
| 101 | +- License verified |
0 commit comments