Single-stable-line kernel pipeline + audit fixes #20

Merged

zach merged 1 commit from feat/multiline-6.12-and-audit-fixes into main 2026-07-01 01:24:05 +00:00

Conversation 0 Commits 1 Files changed 27 +762 -181

zach commented 2026-07-01 01:19:13 +00:00

Owner

Copy link

Summary

Two threads:

1. Audit fixes — 7 issues found while exploring the repo.
2. A line-parameterized build pipeline — tracks one rolling stable line today (7.0 → 7.1), built so tracking more lines later is mostly config. Directly de-risks the 7.0 → 7.1 advance (scoped drift baseline).

Builds remain tag-driven, and the registry lists only the stable line — nothing here builds more than one kernel.

Kernel-line machinery

• Registry configs/lines.toml + helper tools/lines.py (series, kind, keep_in_main, seed).
• Per-line seed selection configs/seeds/<X.Y>.toml via the tag-derived SERIES; configs/upstream-seed.toml is now a back-compat symlink to the stable seed.
• Per-series meta-packages + a stable-only umbrella (linux-image-hardened-unredacted-amd64 tracks current stable, follows 7.0 → 7.1 automatically).
• Prune retention bucketed per (major, minor) with each line's keep_in_main and a keep_in_main = 0 explicit-sunset knob; new manual-dispatch prune.yml (dry-run default, type-the-distribution confirm gate).
• Hardening-drift baseline scoped to the same line — advancing 7.0 → 7.1 no longer false-fails against a cross-series final.config.

Audit fixes

• publish.py/prune.py: structured Fastly purge status (fail-closed) instead of substring-sniffing the reason string.
• validate.yml: new dep-list parity guard across build-kernel.yml, the runner Dockerfile, and repro-check.sh.
• repro-check.yml: runs on a host-execution runner label (linux-hardened-host) — fixes docker-in-docker + the bind-mount path.
• build-kernel.yml: corrected the stale network-isolation comment (isolation IS implemented via unshare -n; CAP_SYS_ADMIN).
• SECURITY.md/verifying-packages.md: verify the apt-repo fingerprint against both real sources (dropped the never-published third).
• incompatibilities.md/README.md/dkms.md: honest "not yet validated" DKMS wording; fixed the dangling VirtualBox table reference.

Deferred (documented)

• Per-line cve-watch — it correctly tracks the single stable line today; rewriting the CVE tripwire wasn't worth the risk for a Phase-B nicety.
• LTS lines (distro-sourced seed) — design retained in config-architecture.md + git history.

Operator follow-ups (not blocking merge)

• Add the linux-hardened-host:host runner label + host prereqs so repro-check.yml runs (see runner-setup.md).
• Advancing to 7.1 is a small post-merge step (add configs/seeds/7.1.toml, flip lines.toml, repoint the symlink).

Verification

py_compile, shellcheck, bash -n, yamllint, workflow-expression guards, dep-list parity, and prune-selection unit-checks all pass locally.

🤖 Generated with Claude Code

## Summary Two threads: 1. **Audit fixes** — 7 issues found while exploring the repo. 2. **A line-parameterized build pipeline** — tracks one rolling **stable** line today (7.0 → 7.1), built so tracking more lines later is mostly config. Directly de-risks the 7.0 → 7.1 advance (scoped drift baseline). Builds remain tag-driven, and the registry lists only the stable line — nothing here builds more than one kernel. ## Kernel-line machinery - Registry `configs/lines.toml` + helper `tools/lines.py` (series, kind, keep_in_main, seed). - Per-line seed selection `configs/seeds/<X.Y>.toml` via the tag-derived `SERIES`; `configs/upstream-seed.toml` is now a back-compat symlink to the stable seed. - Per-series meta-packages + a stable-only **umbrella** (`linux-image-hardened-unredacted-amd64` tracks current stable, follows 7.0 → 7.1 automatically). - Prune retention bucketed per `(major, minor)` with each line's `keep_in_main` and a `keep_in_main = 0` explicit-sunset knob; new manual-dispatch **`prune.yml`** (dry-run default, type-the-distribution confirm gate). - Hardening-drift baseline **scoped to the same line** — advancing 7.0 → 7.1 no longer false-fails against a cross-series `final.config`. ## Audit fixes - `publish.py`/`prune.py`: structured Fastly purge status (fail-closed) instead of substring-sniffing the reason string. - `validate.yml`: new **dep-list parity** guard across build-kernel.yml, the runner Dockerfile, and repro-check.sh. - `repro-check.yml`: runs on a **host-execution** runner label (`linux-hardened-host`) — fixes docker-in-docker + the bind-mount path. - `build-kernel.yml`: corrected the stale network-isolation comment (isolation IS implemented via `unshare -n`; `CAP_SYS_ADMIN`). - `SECURITY.md`/`verifying-packages.md`: verify the apt-repo fingerprint against both real sources (dropped the never-published third). - `incompatibilities.md`/`README.md`/`dkms.md`: honest "not yet validated" DKMS wording; fixed the dangling VirtualBox table reference. ## Deferred (documented) - Per-line **cve-watch** — it correctly tracks the single stable line today; rewriting the CVE tripwire wasn't worth the risk for a Phase-B nicety. - **LTS lines** (distro-sourced seed) — design retained in `config-architecture.md` + git history. ## Operator follow-ups (not blocking merge) - Add the `linux-hardened-host:host` runner label + host prereqs so `repro-check.yml` runs (see `runner-setup.md`). - Advancing to 7.1 is a small post-merge step (add `configs/seeds/7.1.toml`, flip `lines.toml`, repoint the symlink). ## Verification `py_compile`, `shellcheck`, `bash -n`, `yamllint`, workflow-expression guards, dep-list parity, and prune-selection unit-checks all pass locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

zach added 1 commit 2026-07-01 01:19:13 +00:00

feat: single-stable-line kernel pipeline + audit fixes ... 49cf1a8c71

Line-parameterized build pipeline (tracking one rolling stable line today,
capable of more) plus fixes for 7 issues found in the codebase audit.

Kernel-line machinery (configs/lines.toml + tools/lines.py registry):
- per-line config seed selection: configs/seeds/<X.Y>.toml via SERIES
  (configs/upstream-seed.toml kept as a back-compat symlink to the stable seed)
- per-series meta-packages + a stable-only umbrella (build-debs.sh), so
  linux-image-hardened-unredacted-amd64 tracks current stable and follows a
  7.0 -> 7.1 transition automatically
- prune retention bucketed per (major,minor) with each line's keep_in_main and
  a keep_in_main=0 explicit-sunset knob (prune.py); new manual-dispatch
  prune.yml (dry-run default, type-the-distribution confirm gate)
- hardening-drift baseline scoped to the same line (build-kernel.yml), so
  advancing 7.0 -> 7.1 no longer false-fails against a cross-series final.config
- seed-bump targets the stable line's per-line seed file (bump-seed.sh
  --pin-file, symlink-safe rewrite)

Audit fixes:
- publish.py/prune.py: structured Fastly purge status instead of sniffing the
  reason string for "missing" (fail-closed)
- validate.yml: dep-list parity guard across build-kernel.yml, the runner
  Dockerfile, and repro-check.sh's inline subset
- repro-check.yml: run on a host-execution runner label (linux-hardened-host)
  to fix docker-in-docker + the bind-mount path; runner-setup.md documents it
- build-kernel.yml: correct the stale network-isolation comment (isolation IS
  implemented via unshare -n; CAP_SYS_ADMIN, not CAP_NET_ADMIN)
- SECURITY.md/verifying-packages.md: verify the apt-repo fingerprint against
  both real sources (dropped the never-published third source)
- incompatibilities.md/README.md/dkms.md: honest "not yet validated" DKMS
  wording; fixed the dangling VirtualBox table reference

Adding an LTS line later (distro-sourced seed) is documented in
config-architecture.md and recoverable from the plan/git history.

Verified: py_compile, shellcheck, bash -n, yamllint, workflow-expression
guards, dep-list parity, and prune selection unit-checks all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

zach force-pushed feat/multiline-6.12-and-audit-fixes from 49cf1a8c71 to 6ac3b73691 2026-07-01 01:22:46 +00:00 Compare

zach merged commit fc6b84ec11 into main 2026-07-01 01:24:05 +00:00

zach referenced this pull request from a commit 2026-07-01 01:24:07 +00:00

Merge pull request 'Single-stable-line kernel pipeline + audit fixes' (#20) from feat/multiline-6.12-and-audit-fixes into main

zach deleted branch feat/multiline-6.12-and-audit-fixes 2026-07-01 01:24:08 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted!20

No description provided.