Skip to content

linux v6.12: strip canister Kconfig stubs when fips=0 (RFC, needs build verification) - #13

Closed
dcasota wants to merge 1 commit into
photon5-experimental-1from
linux-fips0-canister-kconfig-strip
Closed

dcasota wants to merge 1 commit into
photon5-experimental-1from
linux-fips0-canister-kconfig-strip

Conversation

@dcasota

@dcasota dcasota commented May 5, 2026

Copy link
Copy Markdown
Owner

Summary

When %{?fips} == 0 (aarch64 default, or x86_64 with explicit fips=0
override), neither the canister_build nor canister_usage branch in
%prep runs, so the patch that adds
CONFIG_GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS is never applied. The
shipped .config still carries the corresponding is not set comments
but the kernel tree no longer recognises the symbols. make olddefconfig (run inside check_for_config_applicability.inc)
silently drops them, and the inc's diff -u .config.old .config returns
non-zero, killing %prep.

This patch strips the two comment lines up-front under
%if 0%{?fips} == 0, leaving the canister_build / canister_usage
paths untouched.

Provenance

The fix has been validated on Photon 6.0 (linux-6.12.78-6.ph6) where
the same condition reproduces; this PR is the port to
photon5-experimental-1 (SPECS/linux/linux.spec at 6.12.78-4).

Test plan

  • make build PKG=linux-esx on aarch64 (fips=0 default) - confirm %prep runs to completion
  • make build PKG=linux on x86_64 with --define 'fips 0' - confirm same
  • make build PKG=linux on x86_64 with default fips=1 - confirm no regression (canister paths unchanged)
  • Inspect built .config for absence of the stripped Kconfig lines

AI-assistance disclosure

Per Documentation/process/coding-assistants.rst, this patch was
prepared with assistance from Claude Opus 4.7 (Anthropic). The fix has
been understood, reviewed and is being submitted as a draft for build
verification on the target branch before merging.

When %{?fips} == 0 (the aarch64 default, or after an explicit
x86_64 fips=0 override), neither the canister_build nor the
canister_usage branch in %prep applies the patch that introduces
the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS Kconfig symbols. The
shipped config still carries the "# CONFIG_GCC_PLUGIN_..._STRUCTS
is not set" comments, but the kernel tree no longer recognises
those symbols, so the olddefconfig run inside
check_for_config_applicability.inc drops them. The inc's
diff -u .config.old .config then returns non-zero and %prep is
killed before %build can run.

Strip the two comment lines up-front so the diff guard stays
clean. canister_build and canister_usage paths are unaffected
because they run before this hunk and either rewrite the line in
place (canister_usage) or delete it explicitly (canister_build).

Reproducible by building this spec on aarch64 (fips=0 by default)
or on x86_64 with --define 'fips 0'. The same fix shipped in
common as 6.12.78-6 (see /root/common/SPECS/linux/v6.12/linux.spec
in the photon 6.0 working tree).

Co-developed-by: Claude Opus 4.7 (Anthropic) <noreply@anthropic.com>
Signed-off-by: Claude Opus 4.7 (Anthropic) <noreply@anthropic.com>
Signed-off-by: David Casota <dcasota@gmail.com>
@dcasota
dcasota deleted the branch photon5-experimental-1 May 11, 2026 20:52
@dcasota dcasota closed this May 11, 2026
@dcasota

dcasota commented May 11, 2026

Copy link
Copy Markdown
Owner Author

Continued as #14 (retargeted from the deleted photon5-experimental-1 to 5.0). GitHub blocked reopening this PR because both the base ref was deleted and the head branch was force-pushed during the same cleanup pass. Leaving #13 as historical record.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant