seed: bump to 37b066fa9489 #55

Merged

zach merged 2 commits from automated/seed-bump-37b066fa9489 into main 2026-09-14 04:29:45 +00:00

Conversation 0 Commits 2 Files changed 4 +47 -4

unredacted_bot commented 2026-09-14 04:00:38 +00:00

Owner

Copy link

Automated seed-bump proposal from tools/bump-seed.sh — the anthraxx commit signature was verified against keys/anthraxx.gpg.

Review before merging: confirm the new seed targets the kernel version we build (the seed may legitimately lag) and that the hardening delta below is acceptable. Merging only updates the pinned config seed; the next kernel tag picks it up, and build-kernel.yml's fidelity assertion + hardening-drift guard run on that build.

fetching CURRENT pinned commit (0da7f2ad14d15cc7d210792a3c1fbbc0a261f5e3) for diff baseline...
checking out NEW ref (origin/HEAD)...
  signature: OK (signed by E240B57E2C4630BA768E2F26FC1B547C8D8172C8)

==================== summary ====================
  url        : https://gitlab.archlinux.org/archlinux/packaging/packages/linux-hardened.git
  old commit : 0da7f2ad14d15cc7d210792a3c1fbbc0a261f5e3  (sha256 0f140679412714ba8b5bb97855110d16f06d9616cafcc0119fad7fd69c9721b0)
  new commit : 37b066fa9489d5c1e1859140d8e1008364bfe5cb  (sha256 6faacf4b76f4e49c9290c3dd7a778cb342b4a05b3198244d4ee86cb73fbec023)
  new tag    : 7.2.5.hardened1-1

  WARNING -- SERIES BOUNDARY: seed moves 7.1 -> 7.2
    Re-read the header comment in configs/seeds/7.1.toml and update it in the SAME
    commit/PR as this pin -- this script does not touch prose.

==================== kconfig delta (hardening-relevant only) ====================
  (no hardening-relevant changes; only drivers/CC_HAS_*/fs etc.)

==================== rewriting upstream-seed.toml ====================
updated /workspace/unredacted/linux-hardened-unredacted/configs/seeds/7.1.toml

Next steps:
  git diff configs/seeds/7.1.toml
  # If the kconfig delta above introduced symbols you want pinned in
  # intent.config, add them and re-check policy parity locally.
  git add configs/seeds/7.1.toml [configs/intent.config configs/POLICY.md]
  git commit -m "seed: bump to origin/HEAD (37b066fa9489d5c1e1859140d8e1008364bfe5cb)"

Automated seed-bump proposal from `tools/bump-seed.sh` — the anthraxx commit signature was verified against `keys/anthraxx.gpg`. **Review before merging:** confirm the new seed targets the kernel version we build (the seed may legitimately lag) and that the hardening delta below is acceptable. Merging only updates the pinned config seed; the next kernel tag picks it up, and `build-kernel.yml`'s fidelity assertion + hardening-drift guard run on that build. ``` fetching CURRENT pinned commit (0da7f2ad14d15cc7d210792a3c1fbbc0a261f5e3) for diff baseline... checking out NEW ref (origin/HEAD)... signature: OK (signed by E240B57E2C4630BA768E2F26FC1B547C8D8172C8) ==================== summary ==================== url : https://gitlab.archlinux.org/archlinux/packaging/packages/linux-hardened.git old commit : 0da7f2ad14d15cc7d210792a3c1fbbc0a261f5e3 (sha256 0f140679412714ba8b5bb97855110d16f06d9616cafcc0119fad7fd69c9721b0) new commit : 37b066fa9489d5c1e1859140d8e1008364bfe5cb (sha256 6faacf4b76f4e49c9290c3dd7a778cb342b4a05b3198244d4ee86cb73fbec023) new tag : 7.2.5.hardened1-1 WARNING -- SERIES BOUNDARY: seed moves 7.1 -> 7.2 Re-read the header comment in configs/seeds/7.1.toml and update it in the SAME commit/PR as this pin -- this script does not touch prose. ==================== kconfig delta (hardening-relevant only) ==================== (no hardening-relevant changes; only drivers/CC_HAS_*/fs etc.) ==================== rewriting upstream-seed.toml ==================== updated /workspace/unredacted/linux-hardened-unredacted/configs/seeds/7.1.toml Next steps: git diff configs/seeds/7.1.toml # If the kconfig delta above introduced symbols you want pinned in # intent.config, add them and re-check policy parity locally. git add configs/seeds/7.1.toml [configs/intent.config configs/POLICY.md] git commit -m "seed: bump to origin/HEAD (37b066fa9489d5c1e1859140d8e1008364bfe5cb)" ```

unredacted_bot added 1 commit 2026-09-14 04:00:38 +00:00

seed: bump to 37b066fa9489 d15a0cf8fe

zach added 1 commit 2026-09-14 04:24:38 +00:00

lines: advance stable line 7.1 -> 7.2 (seed 7.2.5.hardened1-1) ... fc6d455c7b

The automated seed bump pinned anthraxx's 7.2.5.hardened1-1 config into
configs/seeds/7.1.toml, which validate.yml's seed-pins-well-formed job
rejects as a cross-series pin (tag series != filename series). Rather than
mark 7.1 as a cross-series stopgap, stand the 7.2 line up properly per
configs/lines.toml / docs/operators/config-architecture.md:

  - configs/seeds/7.1.toml: restored to its last same-line pin
    (7.1.9.hardened1-1), unchanged from main.
  - configs/seeds/7.2.toml: new same-line seed, populated by
    tools/bump-seed.sh --pin-file configs/seeds/7.2.toml 7.2.5.hardened1-1
    (commit signature verified against keys/anthraxx.gpg; commit + sha256
    match the bot's run). Header prose written for 7.2; kconfig delta vs the
    7.1.9 seed shows no hardening-relevant changes.
  - configs/upstream-seed.toml: symlink repointed -> seeds/7.2.toml.
  - configs/lines.toml: stable line series/seed -> 7.2.
  - docs: current-line note updated.

The first v7.2.x build has no same-line drift baseline in releases/, so
build-kernel.yml will log the documented "hardening-drift guard SKIPPED"
warning for it; subsequent 7.2 builds baseline against that release.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

zach merged commit 4bf78eb6ed into main 2026-09-14 04:29:45 +00:00

zach deleted branch automated/seed-bump-37b066fa9489 2026-09-14 04:29:45 +00:00

zach referenced this pull request from a commit 2026-09-14 04:29:46 +00:00

Merge pull request 'seed: bump to 37b066fa9489' (#55) from automated/seed-bump-37b066fa9489 into main

zach referenced this pull request 2026-09-14 04:38:07 +00:00

seed-bump: advance the stable line automatically at a series boundary #56

zach referenced this pull request from a commit 2026-09-14 04:38:08 +00:00

seed-bump: advance the stable line automatically at a series boundary

zach referenced this pull request from a commit 2026-09-14 04:46:31 +00:00

intent: follow 7.2 rename RANDOM_KMALLOC_CACHES -> KMALLOC_PARTITION_CACHES

zach referenced this pull request 2026-09-14 04:46:32 +00:00

intent: follow 7.2 rename RANDOM_KMALLOC_CACHES -> KMALLOC_PARTITION_CACHES #57

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted!55

No description provided.