sys-kernel/hardened-kernel: bump v6.12.4

sys-kernel/hardened-kernel/Manifest

@@ -4,17 +4,26 @@ DIST genpatches-6.10-17.extras.tar.xz 4060 BLAKE2B 85b844a23a44636e7e9208adcdb1f
 DIST genpatches-6.11-10.base.tar.xz 757872 BLAKE2B 72566af9a781288f516dcd30881851fe371a0f3d072aeabbd9d3e57ea96896cb9d8f0d594f8729215baa83d9546c675789b596dac5781b3640e963059d23223b SHA512 ae04d309e3b97cfd7f09993cf297fa5825c53e83acc54805f1f6f2d09cd07aa1715866be3d59874d0131d1746a398b9449fda1987ea6bdbd66402e411569d874
 DIST genpatches-6.11-10.experimental.tar.xz 77928 BLAKE2B a0928f0ff7eb6b9a5659d0ab41dafcf3b474cd7aa357b65a7a147972132c08703a88467e51b7dbd8004781cb0cb8a9620190737963f1fcc1e9e5d98f68ba72d6 SHA512 2be91396f9ec97b2e051db72742e3db1edaa56255c7a2cde2ce2ecc1de4771e92ba6d55e863380fe4dc6ef8d8778bec1a9926a9ffe2dd5d1036b9c36a9afae13
 DIST genpatches-6.11-10.extras.tar.xz 4060 BLAKE2B a94b8799f6c1d338a17e25b1dde6aa616754bfde092eb5ad1da11a6ec8b1107dce827d05ecc756a4918339329190e6572bb089de89d9a11c8c08f067eb7b269d SHA512 1a166a0054827ac9bef700d075cc2a1e3934dbe7b7aa64b34109b521f5bb21e231d59be4643f6faf702e5d0b3cb7d82e8cc1ba1f77e3bf88c38f9b6ffc61e35f
+DIST genpatches-6.12-6.base.tar.xz 365140 BLAKE2B bf281f8314de03b6ac24de430632999188ff1573f46f58cab999f92fbcf0c2e5fd14413892e5a961eb1ee8b64360a253e8cc26d24f8687b413ff9cc1df72a4c2 SHA512 ddca7ef8f67bdc182ccfeb6ed2e5fd08297287fcd5744285c549643a854c7d6148342a3ac1a13ad6cdd87c334acc5abc58a7f6e6a58f34db8ce9dca2b0802152
+DIST genpatches-6.12-6.experimental.tar.xz 78104 BLAKE2B 52c6578ce4e6d3618e30d8ec2032c7e7fb642b4eca551d5bf3cbd635c40d1f7fcc5e453c05ff4376ca0261892e73ccc534d74ad33b68e50eeb69486c9d0b8e36 SHA512 9e924b32bf695ef62c4009152633a188927702534e2825f66cc2bbd75ddf0bdb141c8a7dacea4e33b2fe259b1da70010ba3dbe4c44cbdd7164b1a37f6f70df36
+DIST genpatches-6.12-6.extras.tar.xz 4056 BLAKE2B 4d3a72ea884a1b6cc84034277d6cfb57f7cc3fd43e9d229b46707c07dcef1af73bbd61aa880805ca5746c3b470335ad48c10d55f442f3396f0aaaa9a7a23c73b SHA512 538ba6590f3f4ff9bcb44131393a95a677ee6c59b6ee67ad2519ff242fb182358cd217d5e0533e11225646ecc92e8efeb4688c332db70d35a977a8e3cb475787
 DIST gentoo-kernel-config-g13.tar.gz 5759 BLAKE2B 831f89078e539c8b4ce244528dfd847c12a45b52d540eb10d85ec0d9deb1c14288d8de12456865c92d16e3523ec3595676787a8f3b79545d76870b0fb68deb5d SHA512 2a7230cce57a67e3333f9a88a311afe4a928e27ce76036747451cb77d3186569ad11d7a5b827748ad53290a17ad63637a8362ca896516f85ff0944a8d68265a6
 DIST gentoo-kernel-config-g14.tar.gz 5686 BLAKE2B e5147ff4ffab92428b3e7f1b0897b997f8a298805f4f43b0a4d3047607bbb1a5ebfc268e0bb9688372a5eda561df9f256c78e00cdd7e3caf7868724214722f56 SHA512 f79638f9ff9dd0154512baf0234024216b6708d35a3c03a580ca5913286ad1ea13bdde5ea9b4722c6a7cd8d591c11ec52c1e225111a260343cd56aa1f1a88502
 DIST kernel-aarch64-fedora.config.6.10.1-gentoo 281641 BLAKE2B f4157148dda5fe453b055fea66756e380fbaaf0378b9d1f74044af4ccb5b3da9bc7448e8ec553d30632be1bfe83e961f5751458cc4018d1e8df531251d32e3d8 SHA512 0f5a492318891b295a226f70d5579095ce34d9b547410a1873131c455356ab576b5093b8d1d32a166a01e033802b083e72a7c0f1236495d36ab0d6cd367eebbf
 DIST kernel-aarch64-fedora.config.6.11.5-gentoo 285046 BLAKE2B e8ae27d70fa023976e950d4edcb38963e2fff39efa5cd1ff5922278e871efe6e6cda11c609e721eb2a3f7b030ea75447be384065d3b177000c301fc287a34d7f SHA512 121bbeebace3b760ff6ef36cf9970def3073966ea2fc1089c19c08d27a0524502dedc8c988c5239e78ce04caea6feb5ba7b5d53e0319b22ba63ce6cbc2a07e75
+DIST kernel-aarch64-fedora.config.6.12.1-gentoo 287989 BLAKE2B fbf6183487ffc6d30543c6b9caedbca224cc9ce4ec917e35ab351030212b721af8cc33aafa1feb229a1d6b45c9f45329f8e4957bdb3d43bee7ac223eeb90a994 SHA512 fad6121dfe4a3c82039cfe77614e90b4a954fe12d156f29ef9a596745327a3d30c7a40fc4002405a692685c7deaf9a7d3d6f944d505bc51ed5c387f9c9fd6311
 DIST kernel-i686-fedora.config.6.10.1-gentoo 250040 BLAKE2B 0cbc4d4a0ae82cb44be5aaad35f1d8beaa30eb829d31edf1a7296acff65ae2773dfa8b7da3cc0c02a08db1f355c7fd4fa080daf97b5d66c9b69c6c1f2e421ede SHA512 eee7747b6160e9caf6429e67d3471c4dd7f0f72a0613c0e19944c86b4e0a8025b737de41b6b072cc88f40331a2b2a780ae60c426957db36ff2015850a6d7bc39
 DIST kernel-i686-fedora.config.6.11.5-gentoo 252533 BLAKE2B 2578babdc1916dded2da15e51c497219c551b83bf7ca32c1be8fd79dc7d7c57afc797c6cb736c0b8ba0e71a6a8db73be2db48c594355737a6ff24fb9bbe9c632 SHA512 6ae96a64e6a3b0ee2fd1bd7e9a0cdbfa1ea5a22a1066811d87dbeb6335d625b7d336366d73ff9936714103a9c1ccb4d01863092d4d252791366a34758916851f
+DIST kernel-i686-fedora.config.6.12.1-gentoo 255123 BLAKE2B 186e22a426f2485ba46429852d94e139b91cc3508eb405028b3fd779a224a2c8eaf3e6a15bbee7ebc54a295bf8c3d434d972cd33b42b87951cf826435a3c3d65 SHA512 90f505be0faab191dc06dba834e4d6726f88d9868b6610ab5b89c496a4b4c37e9ce414e6e1447136edb028420a243b1ce620de5e97aa2b4b784e20a6eeacd015
 DIST kernel-ppc64le-fedora.config.6.10.1-gentoo 237077 BLAKE2B a1d816e8015e1c2548c9323e5c595b18ebee2e5d79a9269a3aadc3daee658a2c54fcce97f7182901610fd51dc667c24699345be9e1b28d736d4acf3c41b6b2a5 SHA512 945a529c5dfe3ef92ccb3699d00e28aa1620c4de52fcd611a5c09971bed16a40594c888fa360270fc74b6cf2ea7a973cfa230d35fec4972dcb224d58ec695106
 DIST kernel-ppc64le-fedora.config.6.11.5-gentoo 239546 BLAKE2B 1ea0246c6416a81ebe30dd534ba60ebbef9f8aca4bb36b4f961d9f781a88c8c5ea67fe7cabd959332b02096ce8152567045dd85be79a25cb0b80aa5adae5008f SHA512 9d0eceea756171a6971faa15a04d9cd0c17e5c92db39c2546ab238bda6ef4a88532fe6079f20d3b225c6eb5d26c63e5134e78c617d02b30e1e90e2c7ae18ecc9
+DIST kernel-ppc64le-fedora.config.6.12.1-gentoo 241811 BLAKE2B 59fcfd508a208e7a6a393d1b35811e553098669e9db7302fe929d998fb705330f104b671ba34d6e5992f9c4ddb2e7f30509a261f324400cb3cd5216405ef4614 SHA512 ab0bf86e20bf3348b8703fbf7aeb29105a02ca768f9a4cf47fc59c77e452b4659367bd8c10ceb67295d869158905e2c76c2a55745e01db3fab420ce257c11cb6
 DIST kernel-x86_64-fedora.config.6.10.1-gentoo 251109 BLAKE2B 511862bd42123b8e8072be0d3a2693187713eebc73d8938770b862ffa25e7a6f69225971aa6bbcc1adc0e8d43863514e9f2ed1dc1035f044d9b402e122a6144b SHA512 af5e3c7eb64535f875883e61bbcb018dd1aa25f661d7e4fc985da3165be074037045f97cc2d6b1882edc9d07aa83c78358867c6742babdf19d9515108c74c44c
 DIST kernel-x86_64-fedora.config.6.11.5-gentoo 253618 BLAKE2B 1c366b738886b8ab0614c38a8f4e71ab4edc6e33083ff129a9235ee68faf9280c124e8c28280dd9f041532a69dc64242fa3d49f1b11a155945227fe3363d0793 SHA512 e25c967e0f18f8de3a4a3e7fa4af06c08f507ca1c98c5dcb7311b776f77877231fef23c989c7e4321c51d4b2d68783244bb9162f27a4db08daa8e6c799e79b52
+DIST kernel-x86_64-fedora.config.6.12.1-gentoo 256170 BLAKE2B 39e03735453c66f4262005517fe00e66da0b8c813f7d4a0247083a69eac998c81d75ccdd6c56a389f287f2b9dd5d20e3703b9cfb4d3f89b4672897d026a6a00b SHA512 57f584d82145c5d35bd71f7b3fa5f45adb12cc46915d6f88c7c6f291b6dfde73a4a7f4b796cecf46b145fde5090efc26fdc4fe3945b37d5878efc94ce39b4b7a
 DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84a20015239cf157e3f4f51c7ac5efedc8a51132b2d7482f9276ac418de6624831c8a3b806130d9c2d2124c539b SHA512 baa2487954044f991d2ae254d77d14a1f0185dd62c9f0fcaff69f586c9f906823017b8db1c4588f27b076dfa3ebb606929fec859f60ea419e7974330b9289cc2
 DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
+DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
 DIST linux-hardened-v6.10.14-hardened1.patch 94803 BLAKE2B 7cefbbe200d2ef141e04227ca9ae0cfa58b620a2cc48f8de065617923a1e77e1ded2885b6a2666badf1ae00fe3e4436950cd560c461bb5eb52c36c423adaf9e9 SHA512 763559f27802d946b4ff62def550e4aa73ccfa98d98784b70cbfc10df0fc515db8d02f00e5bdf908bfbb870c5988074a0420d0c27214bcebacbdf5ebb084e60d
 DIST linux-hardened-v6.11.8-hardened1.patch 95386 BLAKE2B c8afa1a25191e73d0a1208ce3bc7dea7d856d2697adcd3f5a9d1ec9695f393aa42099353699c1f58dd056c6fb4215860661a6a17358c887877612ac58a4cf3f6 SHA512 d5baa895f069af8e8f3e6d605e86e10137de6a3d956d8dc092e6c3ed4c52ae6faa9dc10dce2bee6696a75e0d7e595f912e06f64a36965ef282918145567597b3
+DIST linux-hardened-v6.12.4-hardened1.patch 89620 BLAKE2B 595e4c2fe7685de85baadac52a4b7cfda9c3d65ab38f6ec99c2f1c126f133c50e92b6e31e67ae8254f553e11aeb5a7ce2cbf968c4808c1c372ce8cf7a7a2a686 SHA512 d9629c8a805791d385035a1407fcea153e3233ee263cde829ed78a6261e9062098e14db3091a3f0563a19304186dd08b049126e5408263af04d89514cc56edbe

sys-kernel/hardened-kernel/hardened-kernel-6.12.4.ebuild

@@ -0,0 +1,138 @@
+# Copyright 2020-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+KERNEL_IUSE_GENERIC_UKI=1
+KERNEL_IUSE_MODULES_SIGN=1
+
+inherit kernel-build toolchain-funcs
+
+MY_P=linux-${PV%.*}
+GENPATCHES_P=genpatches-${PV%.*}-$(( ${PV##*.} + 2 ))
+CONFIG_VER=6.12.1-gentoo
+GENTOO_CONFIG_VER=g14
+HARDENED_PATCH_VER="${PV}-hardened1"
+GENPATCHES_EXCLUDE="1500_XATTR_USER_PREFIX.patch
+	1510_fs-enable-link-security-restrictions-by-default.patch
+	2900_dev-root-proc-mount-fix.patch
+	4200_fbcondecor.patch
+	4400_alpha-sysctl-uac.patch"
+
+DESCRIPTION="Linux kernel built with Gentoo patches"
+HOMEPAGE="
+	https://wiki.gentoo.org/wiki/Project:Distribution_Kernel
+	https://www.kernel.org/
+"
+SRC_URI+="
+	https://cdn.kernel.org/pub/linux/kernel/v$(ver_cut 1).x/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mpagano/dist/genpatches/${GENPATCHES_P}.base.tar.xz
+	https://dev.gentoo.org/~mpagano/dist/genpatches/${GENPATCHES_P}.extras.tar.xz
+	experimental? (
+		https://dev.gentoo.org/~mpagano/dist/genpatches/${GENPATCHES_P}.experimental.tar.xz
+	)
+	https://github.com/anthraxx/linux-hardened/releases/download/v${HARDENED_PATCH_VER}/linux-hardened-v${HARDENED_PATCH_VER}.patch
+	https://github.com/projg2/gentoo-kernel-config/archive/${GENTOO_CONFIG_VER}.tar.gz
+		-> gentoo-kernel-config-${GENTOO_CONFIG_VER}.tar.gz
+	amd64? (
+		https://raw.githubusercontent.com/projg2/fedora-kernel-config-for-gentoo/${CONFIG_VER}/kernel-x86_64-fedora.config
+			-> kernel-x86_64-fedora.config.${CONFIG_VER}
+	)
+	arm64? (
+		https://raw.githubusercontent.com/projg2/fedora-kernel-config-for-gentoo/${CONFIG_VER}/kernel-aarch64-fedora.config
+			-> kernel-aarch64-fedora.config.${CONFIG_VER}
+	)
+	ppc64? (
+		https://raw.githubusercontent.com/projg2/fedora-kernel-config-for-gentoo/${CONFIG_VER}/kernel-ppc64le-fedora.config
+			-> kernel-ppc64le-fedora.config.${CONFIG_VER}
+	)
+	x86? (
+		https://raw.githubusercontent.com/projg2/fedora-kernel-config-for-gentoo/${CONFIG_VER}/kernel-i686-fedora.config
+			-> kernel-i686-fedora.config.${CONFIG_VER}
+	)
+"
+S=${WORKDIR}/${MY_P}
+
+KEYWORDS="amd64 ~arm arm64 ~hppa ~loong ~ppc ppc64 ~riscv ~sparc x86"
+IUSE="debug +experimental"
+REQUIRED_USE="
+	arm? ( savedconfig )
+	hppa? ( savedconfig )
+	riscv? ( savedconfig )
+	sparc? ( savedconfig )
+"
+
+RDEPEND="
+	!sys-kernel/gentoo-kernel-bin:${SLOT}
+"
+BDEPEND="
+	debug? ( dev-util/pahole )
+"
+PDEPEND="
+	>=virtual/dist-kernel-${PV}
+"
+
+QA_FLAGS_IGNORED="
+	usr/src/linux-.*/scripts/gcc-plugins/.*.so
+	usr/src/linux-.*/vmlinux
+	usr/src/linux-.*/arch/powerpc/kernel/vdso.*/vdso.*.so.dbg
+"
+
+src_prepare() {
+	# remove some genpatches causes conflicts with linux-hardened patch
+	for patch in ${GENPATCHES_EXCLUDE}; do
+		rm -f ${WORKDIR}/${patch}
+	done
+	# Remove already exists changes in linux-hardened patch
+	sed -i '322,337d' "${WORKDIR}/4567_distro-Gentoo-Kconfig.patch"
+	# include linux-hardened patch with priority
+	cp ${DISTDIR}/linux-hardened-v${HARDENED_PATCH_VER}.patch ${WORKDIR}/1199_linux-hardened-${HARDENED_PATCH_VER}.patch
+
+	local PATCHES=(
+		# meh, genpatches have no directory
+		"${WORKDIR}"/*.patch
+	)
+	default
+
+	sed -i "s@\-hardened1@@g" Makefile || die
+
+	local biendian=false
+
+	# prepare the default config
+	case ${ARCH} in
+		amd64)
+			cp "${FILESDIR}/${MY_P}.amd64.config" .config || die
+			;;
+		*)
+			die "Unsupported arch ${ARCH}"
+			;;
+	esac
+
+	local myversion="-hardened"
+	echo "CONFIG_LOCALVERSION=\"${myversion}\"" > "${T}"/version.config || die
+	local dist_conf_path="${WORKDIR}/gentoo-kernel-config-${GENTOO_CONFIG_VER}"
+
+	local merge_configs=(
+		"${T}"/version.config
+	)
+	use debug || merge_configs+=(
+		"${dist_conf_path}"/no-debug.config
+	)
+
+	merge_configs+=( "${dist_conf_path}"/hardened-base.config )
+
+	tc-is-gcc && merge_configs+=( "${dist_conf_path}"/hardened-gcc-plugins.config )
+
+	if [[ -f "${dist_conf_path}/hardened-${ARCH}.config" ]]; then
+		merge_configs+=( "${dist_conf_path}/hardened-${ARCH}.config" )
+	fi
+
+	# this covers ppc64 and aarch64_be only for now
+	if [[ ${biendian} == true && $(tc-endian) == big ]]; then
+		merge_configs+=( "${dist_conf_path}/big-endian.config" )
+	fi
+
+	use secureboot && merge_configs+=( "${dist_conf_path}/secureboot.config" )
+
+	kernel-build_merge_configs "${merge_configs[@]}"
+}