Skip to content

linux 6.12.103-10: strip canister Kconfig symbols when fips=0 #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dcasota wants to merge 1 commit into from
Closed

linux 6.12.103-10: strip canister Kconfig symbols when fips=0 #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion SPECS/linux/linux.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
Summary: Kernel
Name: linux
Version: 6.12.103
Release: 9%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
Release: 10%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
URL: http://www.kernel.org/
Group: System Environment/Kernel
Vendor: VMware, Inc.
Expand Down Expand Up @@ -697,6 +697,16 @@ sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config
sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config
%endif

# When fips=0 (e.g. aarch64 default, or x86_64 fips override), neither the
# canister_build nor canister_usage branch above runs, so the patch that adds
# the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS Kconfig symbols is never applied.
# The shipped .config still has their "is not set" comments; `make olddefconfig`
# silently drops them and the check_for_config_applicability.inc diff guard then
# fails %prep. Strip them up-front so the diff stays clean. (PR #14)
%if 0%{?fips} == 0
sed -i '/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS/d;/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS/d' .config
%endif

%ifarch x86_64
sed -e "s,@@NAME@@,%{name},g" \
-e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
Expand Down Expand Up @@ -978,6 +988,10 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
%endif

%changelog
* Mon Aug 31 2026 Daniel Casota <dcasota@gmail.com> 6.12.103-10
- %prep: when fips=0, strip CONFIG_GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS
comments from .config before olddefconfig so the
check_for_config_applicability.inc diff guard does not fail (PR #14)
* Tue Aug 25 2026 Ajay Kaher <ajay.kaher@broadcom.com> 6.12.103-9
- Fixes CVEs
* Tue Aug 25 2026 Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com> 6.12.103-8
Expand Down