pkg: fedora: Create containers manually, reclaim space from the runner
The GitHub runners usually have about 14 GB of free space. This is
not enough to build a full Fedora kernel with debug symbols.
Disabling the debug symbols is not an option, because they are needed
to generate data for BPF programs, and because it would mean more
patches to the spec file which I would like to avoid.
The runners contain a bunch of software that is entirely useless for
our purposes. For example, a full .NET distribution, the entire Android
SDK, and a bunch of cached container images that arent Fedora.
However, with GitHubs container directive it is not possible to remove
these, because no custom code is ever executed on the runner itself.
To execute code on the runner, the container has to be created and used
manually. To simplify this, all of the actual logic has been moved to a
dedicated script, similar to how the CI on iptsd is set up.
2023-07-22 18:27:44 +00:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
|
|
|
set -euxo pipefail
|
|
|
|
|
|
|
|
if [ -z "$1" ]; then
|
|
|
|
$0 setup-builddeps
|
|
|
|
$0 setup-secureboot
|
|
|
|
$0 build-packages
|
|
|
|
$0 sign-packages
|
|
|
|
exit
|
|
|
|
fi
|
|
|
|
|
|
|
|
dnf()
|
|
|
|
{
|
|
|
|
command dnf -y "$@"
|
|
|
|
}
|
|
|
|
|
|
|
|
case "$1" in
|
|
|
|
setup-builddeps)
|
|
|
|
# Setup build environment
|
|
|
|
dnf distro-sync
|
|
|
|
dnf install @rpm-development-tools git rpm-sign
|
|
|
|
|
|
|
|
# Install build dependencies
|
|
|
|
dnf builddep kernel
|
|
|
|
|
2024-03-01 11:34:41 +00:00
|
|
|
# TODO: remove with 6.8
|
|
|
|
dnf install bpftool
|
|
|
|
|
pkg: fedora: Create containers manually, reclaim space from the runner
The GitHub runners usually have about 14 GB of free space. This is
not enough to build a full Fedora kernel with debug symbols.
Disabling the debug symbols is not an option, because they are needed
to generate data for BPF programs, and because it would mean more
patches to the spec file which I would like to avoid.
The runners contain a bunch of software that is entirely useless for
our purposes. For example, a full .NET distribution, the entire Android
SDK, and a bunch of cached container images that arent Fedora.
However, with GitHubs container directive it is not possible to remove
these, because no custom code is ever executed on the runner itself.
To execute code on the runner, the container has to be created and used
manually. To simplify this, all of the actual logic has been moved to a
dedicated script, similar to how the CI on iptsd is set up.
2023-07-22 18:27:44 +00:00
|
|
|
# Install additional build dependencies
|
|
|
|
dnf install sbsigntools
|
|
|
|
;;
|
|
|
|
setup-secureboot)
|
|
|
|
if [ -z "${SB_KEY:-}" ]; then
|
|
|
|
echo "WARNING: No secureboot key configured, skipping signing."
|
|
|
|
exit
|
|
|
|
fi
|
|
|
|
|
|
|
|
# Install the surface secureboot certificate
|
|
|
|
echo "${SB_KEY}" | base64 -d > pkg/fedora/kernel-surface/secureboot/MOK.key
|
|
|
|
cp pkg/keys/surface.crt pkg/fedora/kernel-surface/secureboot/MOK.crt
|
|
|
|
;;
|
|
|
|
build-packages)
|
|
|
|
pushd pkg/fedora/kernel-surface || exit 1
|
|
|
|
|
|
|
|
# setup git
|
|
|
|
git config --global user.name "surfacebot"
|
|
|
|
git config --global user.email "surfacebot@users.noreply.github.com"
|
|
|
|
|
|
|
|
# Build source RPM packages
|
|
|
|
python3 build-linux-surface.py --mode srpm --ark-dir kernel-ark --outdir srpm
|
|
|
|
|
|
|
|
# Remove the kernel-ark tree to get as much free disk space as possible
|
|
|
|
rm -rf kernel-ark
|
|
|
|
|
|
|
|
# Build binary RPM packages
|
2023-08-01 19:25:36 +00:00
|
|
|
find srpm -name '*.src.rpm' -type f -print0 | xargs -0 -I '{}' \
|
|
|
|
rpmbuild -rb --define "_topdir ${PWD}/rpmbuild" --define "_rpmdir ${PWD}/out" {}
|
pkg: fedora: Create containers manually, reclaim space from the runner
The GitHub runners usually have about 14 GB of free space. This is
not enough to build a full Fedora kernel with debug symbols.
Disabling the debug symbols is not an option, because they are needed
to generate data for BPF programs, and because it would mean more
patches to the spec file which I would like to avoid.
The runners contain a bunch of software that is entirely useless for
our purposes. For example, a full .NET distribution, the entire Android
SDK, and a bunch of cached container images that arent Fedora.
However, with GitHubs container directive it is not possible to remove
these, because no custom code is ever executed on the runner itself.
To execute code on the runner, the container has to be created and used
manually. To simplify this, all of the actual logic has been moved to a
dedicated script, similar to how the CI on iptsd is set up.
2023-07-22 18:27:44 +00:00
|
|
|
|
|
|
|
popd || exit 1
|
|
|
|
;;
|
|
|
|
sign-packages)
|
|
|
|
if [ -z "${GPG_KEY:-}" ] || [ -z "${GPG_KEY_ID:-}" ]; then
|
|
|
|
echo "WARNING: No GPG key configured, skipping signing."
|
|
|
|
exit
|
|
|
|
fi
|
|
|
|
|
|
|
|
pushd pkg/fedora/kernel-surface/out/x86_64 || exit 1
|
|
|
|
|
|
|
|
# import GPG key
|
|
|
|
echo "${GPG_KEY}" | base64 -d | gpg --import --no-tty --batch --yes
|
|
|
|
|
|
|
|
# sign packages
|
2023-08-01 19:25:36 +00:00
|
|
|
find . -name '*.rpm' -type f -print0 | xargs -0 -I '{}' \
|
|
|
|
rpm --resign {} --define "_gpg_name ${GPG_KEY_ID}"
|
pkg: fedora: Create containers manually, reclaim space from the runner
The GitHub runners usually have about 14 GB of free space. This is
not enough to build a full Fedora kernel with debug symbols.
Disabling the debug symbols is not an option, because they are needed
to generate data for BPF programs, and because it would mean more
patches to the spec file which I would like to avoid.
The runners contain a bunch of software that is entirely useless for
our purposes. For example, a full .NET distribution, the entire Android
SDK, and a bunch of cached container images that arent Fedora.
However, with GitHubs container directive it is not possible to remove
these, because no custom code is ever executed on the runner itself.
To execute code on the runner, the container has to be created and used
manually. To simplify this, all of the actual logic has been moved to a
dedicated script, similar to how the CI on iptsd is set up.
2023-07-22 18:27:44 +00:00
|
|
|
|
|
|
|
popd || exit 1
|
|
|
|
;;
|
|
|
|
esac
|