Right now two builds of the same kernel version will install into the
same directory, e.g. /lib/modules/6.5.6-surface.
This doesn't really ultimately cause any issues, but having the build
number in uname -r and unique installation targets is good practice.
The pipefail option causes the script to terminate with an error,
because the pipes are closed while they are still being written
to from /dev/urandom.
It would be possible to disable pipefail locally for this command,
but using openssl seems easier and more robust anyways.
For the future we should consider adapting the Fedora python scripts
for Debian and move the logic out of the CI script into a dedicated
packaging script.
The GitHub runners usually have about 14 GB of free space. This is
not enough to build a full Fedora kernel with debug symbols.
Disabling the debug symbols is not an option, because they are needed
to generate data for BPF programs, and because it would mean more
patches to the spec file which I would like to avoid.
The runners contain a bunch of software that is entirely useless for
our purposes. For example, a full .NET distribution, the entire Android
SDK, and a bunch of cached container images that arent Fedora.
However, with GitHubs container directive it is not possible to remove
these, because no custom code is ever executed on the runner itself.
To execute code on the runner, the container has to be created and used
manually. To simplify this, all of the actual logic has been moved to a
dedicated script, similar to how the CI on iptsd is set up.
