Reuse upstream tarball for non-grsec builds

To avoid repacking the kernel source on non-grsec builds, we can reuse the upstream tarball. The only thing we modify in the kernel source is `.config`, which we can place in the debian/ directory.
freedomofpress · Apr 1, 2024 · 5658525 · 5658525
1 parent 9dde4a0
commit 5658525
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 18 deletions.
diff --git a/build-kernel.py b/build-kernel.py
@@ -86,8 +86,10 @@ def main():
         ]
     )
     print(f"Extracting Linux kernel source {linux_version}")
+    # We'll reuse the original tarball if we're not patching it
+    keep_xz = ["--keep"] if not grsecurity else []
     subprocess.check_call(
-        ["xz", "-d", "-T", "0", "-v", f"linux-{linux_version}.tar.xz"]
+        ["xz", "-d", "-T", "0", "-v", f"linux-{linux_version}.tar.xz"] + keep_xz
     )
     subprocess.check_call(
         [
@@ -101,9 +103,6 @@ def main():
     shutil.unpack_archive(
         f"linux-{linux_version}.tar"
     )
-    # Copy custom /config
-    print("Copying custom config for kernel source", linux_version)
-    shutil.copy("/config", f"linux-{linux_version}/.config")
 
     # Apply grsec patches
     if grsecurity:
@@ -113,19 +112,24 @@ def main():
             cwd=f"linux-{linux_version}",
         )
 
-    # Generate orig tarball
-    print("Generating orig tarball")
+    # If we applied grsec patches, we need to generate a new orig tarball,
+    # otherwise we can re-use the upstream one
     linux_build_version = f"{linux_version}-{build_version}"
     version_suffix = ("grsec-" if grsecurity else "") + local_version
-    subprocess.check_call(
-        [
-            "tar",
-            "--use-compress-program=xz -T 0",
-            "-cf",
-            f"linux-upstream_{linux_build_version}-{version_suffix}.orig.tar.xz",
-            f"linux-{linux_version}",
-        ]
-    )
+    orig_tarball = f"linux-upstream_{linux_build_version}-{version_suffix}.orig.tar.xz"
+    if grsecurity:
+        print("Generating orig tarball")
+        subprocess.check_call(
+            [
+                "tar",
+                "--use-compress-program=xz -T 0",
+                "-cf",
+                orig_tarball,
+                f"linux-{linux_version}",
+            ]
+        )
+    else:
+        shutil.copy(f"linux-{linux_version}.tar.xz", orig_tarball)
 
     os.chdir(f"linux-{linux_version}")
     # Copy debian/
@@ -149,6 +153,10 @@ def main():
     render_template("debian/changelog", template_variables)
     render_template("debian/rules.vars", template_variables)
 
+    # Copy custom /config
+    print("Copying custom config for kernel source", linux_version)
+    shutil.copy("/config", "debian/kconfig")
+
     # Building Linux kernel source
     print("Building Linux kernel source", linux_version)
     subprocess.check_call(

diff --git a/debian/rules b/debian/rules
@@ -9,6 +9,9 @@ include debian/rules.vars
 # and then reversing back (n.b. only needed for 5.15 support)
 DEBIAN_REVISION=$(shell echo $(DEB_VERSION) | rev | cut -d'-' -f1 | rev)
 
+# Where to find the configuration
+export KCONFIG_CONFIG=debian/kconfig
+
 srctree ?= .
 
 ifneq (,$(filter-out parallel=1,$(filter parallel=%,$(DEB_BUILD_OPTIONS))))
@@ -41,13 +44,10 @@ endif
 build: build-arch build-indep
 build-indep:
 build-arch:
-	echo $(DEB_VERSION_UPSTREAM)
 ifeq ($(findstring 5.15.,$(DEB_VERSION_UPSTREAM)),5.15.)
-	echo "equal"
 	$(MAKE) KERNELRELEASE=$(KERNELRELEASE) ARCH=$(ARCH) \
 	KBUILD_BUILD_VERSION=$(DEBIAN_REVISION) -f $(srctree)/Makefile
 else
-	echo "not equal"
 	$(MAKE) -f $(srctree)/Makefile ARCH=$(ARCH) \
 	KERNELRELEASE=$(KERNELRELEASE) \
 	$(shell $(srctree)/scripts/package/deb-build-option) \