Enable filesystem integrity verification features:
- FS_VERITY: Per-file Merkle tree integrity verification. Files with
fs-verity enabled become immutable and are verified block-by-block
on read. Zero overhead when not used. Already enabled by default
in Fedora, Ubuntu, and Arch.
- FS_VERITY_BUILTIN_SIGNATURES: Allow verifying fs-verity signatures
against keys in the kernel keyring.
- SECURITY_IPE: Integrity Policy Enforcement LSM (merged in 6.12).
Allows enforcing policies based on file integrity properties like
fs-verity measurements or dm-verity. Useful for verified boot and
ensuring only integrity-verified files can be executed.
- IPE_PROP_FS_VERITY: Allow IPE to use fs-verity as a trust source.
- IPE_PROP_FS_VERITY_BUILTIN_SIG: Allow IPE to require signed fs-verity.
These features have no runtime impact unless explicitly used, but enable
important security use cases like immutable package stores (NixOS /nix/store)
and verified boot configurations.
Rust may not be available for i686 and the counfigration would fail.
Fixes: 6b6c8b1402 ("linux/common-config: explicitly select RUST_FW_LOADER_ABSTRACTIONS for now")
Recently, there has been an issue with `nix-prefetch` that broke the
update script:
```
--- SHOWING ERROR LOG FOR linux-xanmod-6.12.62 ----------------------
this path will be fetched (0.02 MiB download, 0.07 MiB unpacked):
/nix/store/6xiirw87j5l8n6da4ijibw90r8v1b7zh-nix-prefetch-0.4.1
copying path '/nix/store/6xiirw87j5l8n6da4ijibw90r8v1b7zh-nix-prefetch-0.4.1' from 'https://cache.nixos.org'...
Updating Xanmod "lts" from 6.12.62 to 6.12.63 (xanmod1)
error:
… while calling the 'zipAttrsWith' builtin
at /nix/store/wdqrnd6fkxdsf4xn2kkfa8f42shfw0i3-source/lib/attrsets.nix:1701:5:
1700| in
1701| f [ ] [ rhs lhs ];
| ^
1702|
… while evaluating a branch condition
at /nix/store/wdqrnd6fkxdsf4xn2kkfa8f42shfw0i3-source/lib/attrsets.nix:1478:29:
1477| */
1478| optionalAttrs = cond: as: if cond then as else { };
| ^
1479|
(stack trace truncated; use '--show-trace' to show the full, detailed trace)
error: expected a set but found a function: «lambda extendsWithExclusion @ /nix/store/wdqrnd6fkxdsf4xn2kkfa8f42shfw0i3-source/lib/customisation.nix:846:30»
```
It's possible that this is caused by something else, but we should keep
the update script working until we find out what exactly and fix it.
Note: This first started happening to me on `nixos-25.11`, and is
[reproducible by other people](https://github.com/NixOS/nixpkgs/pull/468873#issuecomment-3624990626)
Until 5.15, HYPERV only supports x86, so forcing module broke
configuration of 5.10 on aarch64. Our kernel configuration script
sets every module it can to "m" anyway, so it was redundant and
breakage-prone to set any value here for pre-6.18.
I've confiremd that HYPERV is still set to "m" on 6.12 after this
change.
Fixes: e9b977bc41 ("linux/common-config: update for 6.18")
6.1.y is old enough that we use simpledrm, but not old enough that
GOOGLE_FRAMEBUFFER_COREBOOT supports simpledrm. Explicitly setting
GOOGLE_FRAMEBUFFER_COREBOOT to module therefore broke 6.1.y build.
Our kernel configuration system will always answer "m" where possible,
so it's not usually necessary to set options to "module" like this.
It's less fragile to rely on that default where possible.
I've checked that building the kernel configfile now works on 5.10.y,
6.1.y, 6.12.y, and 6.18.y, and checked that all these options still
get set to "m" on at least the latter two.
Fixes: fca84bde0f ("linux/common-config: Enable coreboot firmware drivers")
