diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index d129afda4681..395193ca7679 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -1,27 +1,26 @@ { "4.14": { + "extra": "", "name": "linux-hardened-4.14.213.a.patch", "sha256": "0lkjgg6cbsaiypxij7p00q3y094qf0h172hc2p7wgy39777b45a7", "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.213.a/linux-hardened-4.14.213.a.patch" }, "4.19": { - "name": "linux-hardened-4.19.164.a.patch", - "sha256": "0fzv2sjmf0dmhzp58yr4ggzi3pxbjjhbhmav46pv98rbdm2vjwvk", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.164.a/linux-hardened-4.19.164.a.patch" + "extra": ".a", + "name": "linux-hardened-4.19.165.a.patch", + "sha256": "06v34jaj4jg6f3v05wbkkfnr69ahxqyyq0gam4ma3wgm74x6cf3s", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.165.a/linux-hardened-4.19.165.a.patch" + }, + "5.10": { + "extra": ".a", + "name": "linux-hardened-5.10.5.a.patch", + "sha256": "1fq2n60brhi6wjazkdgj2aqc4maskvlymbznl03hvj0x5kahjxvx", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.5.a/linux-hardened-5.10.5.a.patch" }, "5.4": { - "name": "linux-hardened-5.4.86.a.patch", - "sha256": "0j1wr6d42rbxd66vhsp9l3lp3nv0p1j0cpir9pxshd8w9zlbdy88", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.86.a/linux-hardened-5.4.86.a.patch" - }, - "5.8": { - "name": "linux-hardened-5.8.18.a.patch", - "sha256": "1r2n74nbyi3dp5zql9sk504xkpil6ylbyd99zqqva4nd3qg17c99", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.8.18.a/linux-hardened-5.8.18.a.patch" - }, - "5.9": { - "name": "linux-hardened-5.9.16.a.patch", - "sha256": "024wdzc9bwgr4nd4z0l6bazcl35jczhsmdl2lb26bvffjwg207rw", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.9.16.a/linux-hardened-5.9.16.a.patch" + "extra": ".a", + "name": "linux-hardened-5.4.87.a.patch", + "sha256": "01hpww6lm00iry8z4z86hh86x66h3xbmxknxhmmhh2zwz6ahkmfd", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.87.a/linux-hardened-5.4.87.a.patch" } } diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py index d6443d2e7511..b831c6491095 100755 --- a/pkgs/os-specific/linux/kernel/hardened/update.py +++ b/pkgs/os-specific/linux/kernel/hardened/update.py @@ -31,7 +31,7 @@ VersionComponent = Union[int, str] Version = List[VersionComponent] -Patch = TypedDict("Patch", {"name": str, "url": str, "sha256": str}) +Patch = TypedDict("Patch", {"name": str, "url": str, "sha256": str, "extra": str}) @dataclass @@ -99,7 +99,10 @@ def verify_openpgp_signature( return False -def fetch_patch(*, name: str, release: GitRelease) -> Optional[Patch]: +def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]: + release = release_info.release + extra = f'.{release_info.version[-1]}' + def find_asset(filename: str) -> str: try: it: Iterator[str] = ( @@ -130,7 +133,7 @@ def fetch_patch(*, name: str, release: GitRelease) -> Optional[Patch]: if not sig_ok: return None - return Patch(name=patch_filename, url=patch_url, sha256=sha256) + return Patch(name=patch_filename, url=patch_url, sha256=sha256, extra=extra) def parse_version(version_str: str) -> Version: @@ -252,7 +255,7 @@ for kernel_key in sorted(releases.keys()): update = True if update: - patch = fetch_patch(name=name, release=release) + patch = fetch_patch(name=name, release_info=release_info) if patch is None: failures = True else: diff --git a/pkgs/os-specific/linux/kernel/linux-5.8.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix similarity index 86% rename from pkgs/os-specific/linux/kernel/linux-5.8.nix rename to pkgs/os-specific/linux/kernel/linux-5.10.nix index dd11359dbf41..28f031431839 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.8.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix @@ -3,7 +3,7 @@ with stdenv.lib; buildLinux (args // rec { - version = "5.8.18"; + version = "5.10.5"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "0d2mm16mjyl2d734ak0lj8vd76h3r0san7l7g2zczd5pjkva7d2a"; + sha256 = "1x1fc4cywqnjm514q376d5540zsxmqv95n0lykaphz8qdbhsk49r"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-5.9.nix b/pkgs/os-specific/linux/kernel/linux-5.9.nix deleted file mode 100644 index 39cc9c56c5fc..000000000000 --- a/pkgs/os-specific/linux/kernel/linux-5.9.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args: - -with stdenv.lib; - -buildLinux (args // rec { - version = "5.9.16"; - - # modDirVersion needs to be x.y.z, will automatically add .0 if needed - modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; - - # branchVersion needs to be x.y - extraMeta.branch = versions.majorMinor version; - - src = fetchurl { - url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "11mbnjvb5d5gwbrwlkqvzpg1ij4m19l5wr3wca9iiyg5i2papmxh"; - }; -} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index 8ce1ac2b587c..1546de18241a 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -41,7 +41,8 @@ hardened = let mkPatch = kernelVersion: src: { name = lib.removeSuffix ".patch" src.name; - patch = fetchurl src; + patch = fetchurl (lib.filterAttrs (k: v: k != "extra") src); + extra = src.extra; }; patches = builtins.fromJSON (builtins.readFile ./hardened/patches.json); in lib.mapAttrs mkPatch patches; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index f2df7ab733ec..b5344a451572 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -17683,15 +17683,7 @@ in ]; }; - linux_5_8 = callPackage ../os-specific/linux/kernel/linux-5.8.nix { - kernelPatches = [ - kernelPatches.bridge_stp_helper - kernelPatches.request_key_helper - kernelPatches.export_kernel_fpu_functions."5.3" - ]; - }; - - linux_5_9 = callPackage ../os-specific/linux/kernel/linux-5.9.nix { + linux_5_10 = callPackage ../os-specific/linux/kernel/linux-5.10.nix { kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.request_key_helper @@ -17934,7 +17926,7 @@ in # Update this when adding the newest kernel major version! # And update linux_latest_for_hardened below if the patches are already available - linuxPackages_latest = linuxPackages_5_9; + linuxPackages_latest = linuxPackages_5_10; linux_latest = linuxPackages_latest.kernel; # Realtime kernel packages. @@ -17956,8 +17948,7 @@ in linuxPackages_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_14); linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19); linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4); - linuxPackages_5_8 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_8); - linuxPackages_5_9 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_9); + linuxPackages_5_10 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_10); # When adding to the list above: # - Update linuxPackages_latest to the latest version @@ -17995,7 +17986,7 @@ in # Hardened Linux hardenedLinuxPackagesFor = kernel': overrides: let # Note: We use this hack since the hardened patches can lag behind and we don't want to delay updates: - linux_latest_for_hardened = pkgs.linux_5_9; + linux_latest_for_hardened = pkgs.linux_5_10; kernel = (if kernel' == pkgs.linux_latest then linux_latest_for_hardened else kernel').override overrides; in linuxPackagesFor (kernel.override { structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix { @@ -18006,7 +17997,7 @@ in kernelPatches.tag_hardened kernelPatches.hardened.${kernel.meta.branch} ]; - modDirVersionArg = kernel.modDirVersion + "-hardened"; + modDirVersionArg = kernel.modDirVersion + (kernelPatches.hardened.${kernel.meta.branch}).extra + "-hardened"; isHardened = true; });