kernel.comp.toml

[components.kernel]

# Manual release calculation required because the spec uses %{specrelease} macro
# Release: %{pkg_release}
release = { calculation = "manual" }

# Skip debug kernel variant to reduce build time, and skip selftests as a
# temporary mitigation while kselftests packaging is fixed separately.
[components.kernel.build]
without = [
    "debug",
    "selftests",
]

[components.kernel.build.defines]
# RPM release number for the Azure Linux kernel package
azl_pkgrelease = "4"
# 4th version component from the AZL kernel source (6.18.31.1). Included in specrelease so it appears
# in the RPM Release tag, uname -r, and /lib/modules/ path (e.g. 6.18.31-1.1.azl4.aarch64).
kextraversion = "1"
# NVIDIA open GPU kernel module version (built as a subpackage of the kernel)
nvidia_open_version = "595.58.03"

# Download the source tarball from the AzureLinux kernel repo
[[components.kernel.source-files]]
filename = "kernel-6.18.31.1.tar.gz"
hash = "1bf684812ff3fc38974dc99b3e2309cb46dc5af93ac794e79a4a4f3dd17debfadb14510aeaaa7fa2d4c6254876a9f8bc67b900a1951c8dda5d94e5f5028a7557"
hash-type = "SHA512"
origin = { type = "download", uri = "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/azl4/6.18.31.1.tar.gz" }

# Download the NVIDIA open GPU kernel module source tarball
[[components.kernel.source-files]]
filename = "open-gpu-kernel-modules-595.58.03.tar.gz"
hash = "a422b6935209d590f57fa6766f59bb207d9130f8a6777af9245c4ff8cd0f4c4ccef4602a0b26d543e1e8efba24241180992fdb749ea4e5d2aa5218a584b85101"
hash-type = "SHA512"
origin = { type = "download", uri = "https://github.com/NVIDIA/open-gpu-kernel-modules/archive/refs/tags/595.58.03.tar.gz" }

# Insert version and release information from the component defines into the spec file, and update the source URL to match the AzureLinux kernel source structure
[[components.kernel.overlays]]
description = "Set specrpmversion to 6.18.31"
type = "spec-search-replace"
regex = "%define specrpmversion .+"
replacement = "%define specrpmversion 6.18.31"

[[components.kernel.overlays]]
description = "Derive specversion from specrpmversion. This becomes KVERREL which becomes the uname"
type = "spec-search-replace"
regex = "%define specversion .+"
replacement = "%define specversion %{specrpmversion}"

[[components.kernel.overlays]]
description = "Derive tarfile_release from specrpmversion (include for completeness but later overridden)"
type = "spec-search-replace"
regex = "%define tarfile_release .+"
replacement = "%define tarfile_release %{specrpmversion}"

[[components.kernel.overlays]]
description = "Set pkgrelease to azl_pkgrelease macro. Looks to only be realted to documentation"
type = "spec-search-replace"
regex = "%define pkgrelease .+"
replacement = "%define pkgrelease %{azl_pkgrelease}"

[[components.kernel.overlays]]
description = "Set specrelease to kextraversion.azl_pkgrelease.dist so the 4th version component flows into Release:, uname -r, and /lib/modules/ path"
type = "spec-search-replace"
regex = "%define specrelease .+"
replacement = "%define specrelease %{kextraversion}.%{azl_pkgrelease}%{?buildid}%{?dist}"

# Use the AzureLinux kernel source
[[components.kernel.overlays]]
description = "Use AzureLinux kernel source URL"
type = "spec-update-tag"
tag = "Source0"
value = "kernel-%{specrpmversion}.%{kextraversion}.tar.gz"

[[components.kernel.overlays]]
description = "Fix tarball extraction path for AzureLinux"
type = "spec-search-replace"
regex = "linux-%{tarfile_release}"
replacement = "CBL-Mariner-Linux-Kernel-rolling-lts-azl4-%{specrpmversion}.%{kextraversion}"

# Skip the Fedora process_configs.sh run — Fedora f43 configs target 6.18.13 and lack
# new config options in 6.18.31, causing -n (listnewconfig) to fail. Our AZL overlay at the
# end of %prep replaces all configs and re-runs process_configs.sh with strict validation.
[[components.kernel.overlays]]
description = "Skip Fedora process_configs.sh — f43 configs are for 6.18.13 and fail against 6.18.31 kernel. AZL re-runs at end of %prep."
type = "spec-search-replace"
regex = 'RHJOBS=\$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%\{name\} \./process_configs\.sh \$OPTS %\{specrpmversion\}'
replacement = 'echo "AZL: skipping Fedora process_configs.sh (re-run with AZL configs below)" # RHJOBS=$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%{name} ./process_configs.sh $OPTS %{specrpmversion}'

# Disable redhat-specific sources and patches since they are not applicable to AzureLinux
[[components.kernel.overlays]]
description = "Disable copy of Makefile.rhelver (Source1) — not applicable to AzureLinux"
type = "spec-search-replace"
regex = "cp -a %{SOURCE1} ."
replacement = "# cp -a %{SOURCE1} . (disabled for AzureLinux — Makefile.rhelver is Red Hat-specific)"

[[components.kernel.overlays]]
description = "Disable redhat patch declaration — not applicable to AzureLinux"
type = "spec-search-replace"
regex = "Patch1: patch-%{patchversion}-redhat.patch"
replacement = "# Patch1: patch-%{patchversion}-redhat.patch (disabled for AzureLinux)"

[[components.kernel.overlays]]
description = "Disable redhat patch application — not applicable to AzureLinux"
type = "spec-search-replace"
regex = "ApplyOptionalPatch patch-%{patchversion}-redhat.patch"
replacement = "# ApplyOptionalPatch patch-%{patchversion}-redhat.patch (disabled for AzureLinux)"

# Azure Linux kernel configs — full replacements for the Fedora-generated configs.
# The Fedora config pipeline runs fully (generate_all_configs.sh, merge.py, etc.),
# then we overwrite at the end of %prep with our AZL configs and re-run
# process_configs.sh to validate them (make olddefconfig + listnewconfig).

[[components.kernel.overlays]]
description = "Add AZL x86_64 kernel config to sources"
type = "file-add"
file = "6.18-x86_64-azl.config"
source = "6.18-x86_64-azl.config"

[[components.kernel.overlays]]
description = "Add AZL aarch64 kernel config to sources"
type = "file-add"
file = "6.18-aarch64-azl.config"
source = "6.18-aarch64-azl.config"

[[components.kernel.overlays]]
description = "Add AZL signing CA certificate (embedded as builtin trusted key via CONFIG_SYSTEM_TRUSTED_KEYS)"
type = "file-add"
file = "azurelinux-ca-20230216.pem"
source = "azurelinux-ca-20230216.pem"

[[components.kernel.overlays]]
description = "Register AZL x86_64 kernel config as Source5000"
type = "spec-insert-tag"
tag = "Source5000"
value = "6.18-x86_64-azl.config"

[[components.kernel.overlays]]
description = "Register AZL aarch64 kernel config as Source5001"
type = "spec-insert-tag"
tag = "Source5001"
value = "6.18-aarch64-azl.config"

[[components.kernel.overlays]]
description = "Register AZL signing CA certificate as Source5002"
type = "spec-insert-tag"
tag = "Source5002"
value = "azurelinux-ca-20230216.pem"

[[components.kernel.overlays]]
description = "Overwrite Fedora-generated configs with AZL configs and re-validate with process_configs.sh at the end of %prep — lets the entire Fedora config pipeline run first, then overwrites with our complete configs. Only copies the config matching the build arch to avoid cross-arch make failures."
type = "spec-append-lines"
section = "%prep"
lines = [
    "# AZL: Copy mariner.pem signing CA cert into kernel source tree",
    "%ifnarch noarch %nobuildarches",
    "cp %{SOURCE5002} linux-%{KVERREL}/certs/mariner.pem",
    "# AZL: Overwrite Fedora-generated configs with complete AZL kernel configs",
    '%{log_msg "AZL: Overwrite configs with AZL kernel configs"}',
    "cd linux-%{KVERREL}/configs",
    "# Remove all Fedora-generated configs — we replace with AZL configs for build arch only",
    "rm -f %{name}-%{specrpmversion}-*.config",
    "%ifarch x86_64",
    "cp %{SOURCE5000} %{name}-%{specrpmversion}-x86_64.config",
    "%endif",
    "%ifarch aarch64",
    "cp %{SOURCE5001} %{name}-%{specrpmversion}-aarch64.config",
    "%endif",
    "# Re-run process_configs.sh to validate AZL configs (make olddefconfig + listnewconfig)",
    'OPTS="-w -n -c"',
    "SPECPACKAGE_NAME=%{name} RHJOBS=$RPM_BUILD_NCPUS ./process_configs.sh $OPTS %{specrpmversion}",
    "cd ../..",
    "%endif",
]

# ============================================================================
# kmod subpackage framework — modular kmod builds alongside the kernel
#
# This framework allows building out-of-tree kernel modules as subpackages of
# the kernel RPM. Each kmod is defined in its own .inc file (e.g.
# kmod-nvidia-open.inc) with phase-gated sections that run at each RPM build
# phase (%description, %prep, %build, %install, %files).
#
# To add a new kmod:
#   1. Create kmod-<name>.inc with phase-gated sections
#   2. Add file-add overlays for .inc and any extra source files
#   3. Add spec-insert-tag overlays to register sources (Source6xxx range)
#   4. Add spec-search-replace overlays targeting the AZL-KMOD-*-ANCHOR
#      sentinels for each phase (the anchor survives replacement so the
#      next kmod can chain onto it)
# ============================================================================

# --- kmod-nvidia-open: source file registration ---
# Registers the NVIDIA open GPU kernel module sources and configuration files.
# Source numbers 6000-6099 are reserved for nvidia-open.

[[components.kernel.overlays]]
description = "Add kmod-nvidia-open.inc subpackage definition to sources"
type = "file-add"
file = "kmod-nvidia-open.inc"
source = "kmod-nvidia-open.inc"

[[components.kernel.overlays]]
description = "Add NVIDIA modprobe config file for kmod-nvidia-open subpackage"
type = "file-add"
file = "kmod-nvidia-open-modprobe.conf"
source = "kmod-nvidia-open-modprobe.conf"

[[components.kernel.overlays]]
description = "Register NVIDIA open-gpu-kernel-modules tarball as Source6000"
type = "spec-insert-tag"
tag = "Source6000"
value = "open-gpu-kernel-modules-%{nvidia_open_version}.tar.gz"

[[components.kernel.overlays]]
description = "Register NVIDIA modprobe config as Source6001"
type = "spec-insert-tag"
tag = "Source6001"
value = "kmod-nvidia-open-modprobe.conf"

[[components.kernel.overlays]]
description = "Register kmod-nvidia-open.inc as Source6002"
type = "spec-insert-tag"
tag = "Source6002"
value = "kmod-nvidia-open.inc"

# --- kmod framework: phase anchor insertion ---
# These overlays insert unique sentinel comments at unconditional locations in
# the upstream spec. Per-kmod overlays below target these sentinels with
# spec-search-replace, replacing SENTINEL with <kmod include> + SENTINEL so
# each sentinel survives for the next kmod to chain onto.

[[components.kernel.overlays]]
description = "Insert kmod package anchor after main %description — unconditional location for kmod subpackage declarations"
type = "spec-append-lines"
section = "%description"
lines = [
    "",
    "# AZL-KMOD-PACKAGE-ANCHOR — do not remove (kmod overlays chain here)",
]

[[components.kernel.overlays]]
description = "Insert kmod prep anchor at end of %prep — unconditional location for kmod source extraction"
type = "spec-append-lines"
section = "%prep"
lines = [
    "",
    "# AZL-KMOD-PREP-ANCHOR — do not remove (kmod overlays chain here)",
]

[[components.kernel.overlays]]
description = "Insert kmod build anchor before modsign macros — unconditional location at the end of the active %build body"
type = "spec-search-replace"
regex = '# Module signing \(modsign\)'
replacement = """# AZL-KMOD-BUILD-ANCHOR — do not remove (kmod overlays chain here)

# Module signing (modsign)"""

[[components.kernel.overlays]]
description = "Insert kmod install anchor before ### clean — unconditional location at the end of the active %install body"
type = "spec-search-replace"
regex = '### clean'
replacement = """# AZL-KMOD-INSTALL-ANCHOR — do not remove (kmod overlays chain here)

###
### clean"""

[[components.kernel.overlays]]
description = "Insert kmod files anchor after %files modules-extra-matched — unconditional location for kmod file lists"
type = "spec-append-lines"
section = "%files"
package = "modules-extra-matched"
lines = [
    "",
    "# AZL-KMOD-FILES-ANCHOR — do not remove (kmod overlays chain here)",
]

# --- kmod-nvidia-open: phase injection ---
# RPM %include is a preprocessor directive — it must appear directly in the spec
# text (not inside a %define macro). Each phase sets _kmod_phase and _kmod_name
# globals, then includes the kmod .inc file. The .inc file's %if guards select
# the correct section for that phase.
#
# To add a new kmod: duplicate the phase blocks below, changing _kmod_name and
# the %include path. Each block targets the framework anchor for its phase.

[[components.kernel.overlays]]
description = "Run kmod 'package' phase at package anchor — declares kmod subpackages"
type = "spec-search-replace"
regex = '# AZL-KMOD-PACKAGE-ANCHOR'
replacement = """# AZL: kmod subpackage declarations (nvidia-open)
%global _kmod_phase package
%global _kmod_name nvidia-open
%include %{_sourcedir}/kmod-nvidia-open.inc

# AZL-KMOD-PACKAGE-ANCHOR"""

[[components.kernel.overlays]]
description = "Run kmod 'prep' phase at prep anchor — extracts kmod source tarballs"
type = "spec-search-replace"
regex = '# AZL-KMOD-PREP-ANCHOR'
replacement = """# AZL: Prepare kmod subpackage sources (nvidia-open)
%global _kmod_phase prep
%global _kmod_name nvidia-open
%include %{_sourcedir}/kmod-nvidia-open.inc

# AZL-KMOD-PREP-ANCHOR"""

[[components.kernel.overlays]]
description = "Run kmod 'build' phase at build anchor — compiles NVIDIA modules against the just-built kernel"
type = "spec-search-replace"
regex = '# AZL-KMOD-BUILD-ANCHOR'
replacement = """# AZL: Build kmod subpackage modules (nvidia-open)
%global _kmod_phase build
%global _kmod_name nvidia-open
%include %{_sourcedir}/kmod-nvidia-open.inc

# AZL-KMOD-BUILD-ANCHOR"""

[[components.kernel.overlays]]
description = "Run kmod 'install' phase at install anchor — installs NVIDIA modules, configs, and licenses"
type = "spec-search-replace"
regex = '# AZL-KMOD-INSTALL-ANCHOR'
replacement = """# AZL: Install kmod subpackage files (nvidia-open)
%global _kmod_phase install
%global _kmod_name nvidia-open
%include %{_sourcedir}/kmod-nvidia-open.inc

# AZL-KMOD-INSTALL-ANCHOR"""

[[components.kernel.overlays]]
description = "Run kmod 'files' phase at files anchor — adds %post/%postun/%files for NVIDIA kmod subpackage"
type = "spec-search-replace"
regex = '# AZL-KMOD-FILES-ANCHOR'
replacement = """# AZL: kmod subpackage file lists and scriptlets (nvidia-open)
%global _kmod_phase files
%global _kmod_name nvidia-open
%include %{_sourcedir}/kmod-nvidia-open.inc

# AZL-KMOD-FILES-ANCHOR"""