packages: bump keyutils to 1.6.3 and move to kernel.org source #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build ONIE (kvm_x86_64) | |
| # Builds the generic amd64 ONIE image for the kvm_x86_64 target, intended | |
| # to run as a VM under KVM/QEMU. The build follows the upstream-recommended | |
| # containerized flow (see contrib/build-env and machine/kvm_x86_64/INSTALL), | |
| # with secure boot disabled so no signing keys are required. | |
| # Run on every push and pull request: the point of this workflow is to | |
| # confirm the change still builds, and the kvm_x86_64 image depends on far | |
| # more than the build files (installer/, rootconf/, patches/, ...), so path | |
| # filtering would risk skipping validation on build-affecting changes. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| pull_request: | |
| # Cancel an in-progress run when a newer commit is pushed to the same ref, | |
| # so stacked pushes don't pile up concurrent builds. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build kvm_x86_64 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Determine host UID/GID | |
| id: ids | |
| run: | | |
| echo "uid=$(id -u)" >> "$GITHUB_OUTPUT" | |
| echo "gid=$(id -g)" >> "$GITHUB_OUTPUT" | |
| - name: Build the ONIE build-environment image | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: .github/onie-build | |
| tags: onie-build-env:latest | |
| build-args: | | |
| UID=${{ steps.ids.outputs.uid }} | |
| GID=${{ steps.ids.outputs.gid }} | |
| load: true | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Disable secure boot in the kernel config | |
| # The kvm_x86_64 kernel config defaults to expecting signing keys. | |
| # The repo ships a config-insecure variant for non-secure-boot builds. | |
| run: cp machine/kvm_x86_64/kernel/config-insecure machine/kvm_x86_64/kernel/config | |
| # Cache the crosstool-NG cross toolchain -- the long pole of a cold | |
| # build. We cache the whole stamp chain (so make does not rebuild on a | |
| # missing root stamp) but only the parts the warm, no-op path actually | |
| # needs -- NOT the multi-GB crosstool-NG build scratch or ct-ng source | |
| # tree, which are only used while building the toolchain. On a cache | |
| # hit "make xtools" is a no-op and the real build only uses the | |
| # installed toolchain, so dropping the scratch keeps the cache blob | |
| # small and fast/reliable to restore. | |
| # | |
| # build/stamp-project -- top-of-chain project stamp | |
| # build/download -- toolchain tarballs + download stamps | |
| # build/crosstool-ng/stamp -- crosstool-NG build stamps | |
| # build/x-tools/*/stamp -- xtools build stamps | |
| # build/x-tools/*/install -- the installed cross toolchain | |
| # build/x-tools/*/build/.config -- xtools config (an xtools-build prereq) | |
| # | |
| # The key is tied to every input that can change the toolchain -- | |
| # including the Dockerfile, since it defines the compiler/host | |
| # environment the toolchain is built in. No loose restore-keys: any | |
| # input change forces a clean rebuild rather than restoring a | |
| # mismatched toolchain. | |
| - name: Restore cross-toolchain cache | |
| id: xtools-cache | |
| uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| build/stamp-project | |
| build/download | |
| build/crosstool-ng/stamp | |
| build/x-tools/*/stamp | |
| build/x-tools/*/install | |
| build/x-tools/*/build/.config | |
| key: onie-xtools-kvm_x86_64-${{ hashFiles('build-config/make/xtools.make', 'build-config/make/crosstool-ng.make', 'build-config/make/compiler.make', 'build-config/conf/crosstool/**', 'patches/crosstool-NG/**', '.github/onie-build/Dockerfile') }} | |
| # ONIE drives its build with stamp files compared by mtime. A fresh | |
| # checkout gives every repo source file a current mtime, which is newer | |
| # than the restored stamps -- so make would consider the toolchain | |
| # stale and rebuild it (e.g. build/.../.config depends on the | |
| # checked-out conf/crosstool config). A cache hit means the key | |
| # matched, i.e. every toolchain input is unchanged and the restored | |
| # toolchain is valid, so bump the restored artifacts ahead of the | |
| # checkout to make "make xtools" a genuine no-op. | |
| - name: Mark restored toolchain up to date | |
| if: steps.xtools-cache.outputs.cache-hit == 'true' | |
| # Restoring build/stamp-project makes make skip the project-stamp | |
| # recipe, which is what normally creates the project output dirs -- | |
| # so recreate them (build/images is an output, not part of the | |
| # cache, and the kernel install copies vmlinuz into it). | |
| # | |
| # Then touch only the files make compares -- the stamp files and the | |
| # toolchain .config. Do NOT touch the toolchain tree itself: it | |
| # contains read-only binaries and symlinks to host tools (bash, | |
| # make, ...) that touch would follow and fail to update. | |
| run: | | |
| mkdir -p build build/images build/download | |
| find build/stamp-project build/download \ | |
| build/crosstool-ng/stamp \ | |
| build/x-tools/*/stamp \ | |
| build/x-tools/*/build/.config \ | |
| -type f -exec touch {} + | |
| - name: Build cross toolchain | |
| run: | | |
| docker run --rm --privileged \ | |
| -v "${PWD}:/onie" \ | |
| onie-build-env \ | |
| bash -lc 'cd build-config && make -j"$(nproc)" \ | |
| MACHINE=kvm_x86_64 \ | |
| SECURE_BOOT_ENABLE=no \ | |
| SECURE_BOOT_EXT=no \ | |
| SECURE_GRUB=no \ | |
| xtools' | |
| # Save only on a cache miss, and only after the toolchain build above | |
| # succeeded (default if: success()), so a broken toolchain is never | |
| # cached. Running before the full build means a later-stage failure | |
| # still preserves the toolchain for the next run. | |
| - name: Save cross-toolchain cache | |
| if: steps.xtools-cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| build/stamp-project | |
| build/download | |
| build/crosstool-ng/stamp | |
| build/x-tools/*/stamp | |
| build/x-tools/*/install | |
| build/x-tools/*/build/.config | |
| key: ${{ steps.xtools-cache.outputs.cache-primary-key }} | |
| - name: Build ONIE | |
| run: | | |
| docker run --rm --privileged \ | |
| -v "${PWD}:/onie" \ | |
| onie-build-env \ | |
| bash -lc 'cd build-config && make -j"$(nproc)" \ | |
| MACHINE=kvm_x86_64 \ | |
| SECURE_BOOT_ENABLE=no \ | |
| SECURE_BOOT_EXT=no \ | |
| SECURE_GRUB=no \ | |
| all recovery-iso' |