From ffdd932d79f9c985128ff90fd01c8576f3f77f47 Mon Sep 17 00:00:00 2001 From: David Casota Date: Tue, 5 May 2026 15:44:46 +0200 Subject: [PATCH] linux v6.12: strip canister Kconfig stubs when fips=0 When %{?fips} == 0 (the aarch64 default, or after an explicit x86_64 fips=0 override), neither the canister_build nor the canister_usage branch in %prep applies the patch that introduces the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS Kconfig symbols. The shipped config still carries the "# CONFIG_GCC_PLUGIN_..._STRUCTS is not set" comments, but the kernel tree no longer recognises those symbols, so the olddefconfig run inside check_for_config_applicability.inc drops them. The inc's diff -u .config.old .config then returns non-zero and %prep is killed before %build can run. Strip the two comment lines up-front so the diff guard stays clean. canister_build and canister_usage paths are unaffected because they run before this hunk and either rewrite the line in place (canister_usage) or delete it explicitly (canister_build). Reproducible by building this spec on aarch64 (fips=0 by default) or on x86_64 with --define 'fips 0'. The same fix shipped in common as 6.12.78-6 (see /root/common/SPECS/linux/v6.12/linux.spec in the photon 6.0 working tree). Co-developed-by: Claude Opus 4.7 (Anthropic) Signed-off-by: Claude Opus 4.7 (Anthropic) Signed-off-by: David Casota --- SPECS/linux/linux.spec | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/SPECS/linux/linux.spec b/SPECS/linux/linux.spec index 308254625d..5bd4ad4a96 100644 --- a/SPECS/linux/linux.spec +++ b/SPECS/linux/linux.spec @@ -77,7 +77,7 @@ Summary: Kernel Name: linux Version: 6.12.78 -Release: 4%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 5%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -690,6 +690,18 @@ sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %endif +# When fips=0 (e.g. aarch64 default, or x86_64 fips override), neither +# the canister_build nor canister_usage branch above runs, so the patch +# that adds the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS Kconfig symbols +# is never applied. The shipped .config still contains their "is not +# set" comments, `make olddefconfig` (run by +# check_for_config_applicability.inc) silently drops them, and the +# inc's `diff -u .config.old .config` returns non-zero -- killing +# %prep. Strip them up-front so the diff stays clean. +%if 0%{?fips} == 0 +sed -i '/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS/d;/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS/d' .config +%endif + %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -971,6 +983,10 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Tue May 05 2026 David Casota 6.12.78-5 +- %prep: when fips=0, strip CONFIG_GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS + comments from .config before olddefconfig so the + check_for_config_applicability.inc diff guard does not fail. * Mon Apr 27 2026 Ajay Kaher 6.12.78-4 - Disable CONFIG_PER_VMA_LOCK * Fri Apr 10 2026 Keerthana K 6.12.78-3