toolchain: Debian 13 / GCC 14 / crosstool-NG 1.28 / uClibc-ng 1.0.54

Move the cross-toolchain and build host to a modern base, and standardize
all machines on it.  The secure-boot signing stack (shim 16.1, host pesign,
gnu-efi removal, grub SBAT) is no longer here -- it moved to the EFI/boot
stack PR (#1128), since none of it requires GCC 14.

  - Build host Debian 11 -> Debian 13 (trixie).  The old crosstool-NG 1.24 /
    GCC 8.3 toolchain cannot build on a Debian 13 host, so host and toolchain
    move together.
  - crosstool-NG 1.24 -> 1.28.0, GCC 8.3 -> 14, uClibc-ng 1.0.38 -> 1.0.54,
    binutils 2.45; XTOOLS_LINUX_VERSION decoupling so image-kernel bumps no
    longer rebuild the toolchain.
  - mokutil 0.4.0 -> 0.7.2 (adds a libkeyutils dependency).
  - grub i386-pc kernel.img link fix for binutils >= 2.39 (custom linker
    script + autogen + autoconf-archive) -- needs the new toolchain.
  - images.make GCC 14 libstdc++ SONAME (libstdc++.so.6.0.33).
  - Build pre-6.x kernels under GCC 14 (KERNEL_OLD_GCC_COMPAT): the existing
    5.4 kernel is kept and built under the new toolchain via
    CONFIG_STACK_VALIDATION= + -Wno-error, letting the toolchain move land
    independently of the kernel bump.

Signed-off-by: Brad House <bhouse@nexthop.ai>

Author: bhouse-nexthop

.github/onie-build/Dockerfile

@@ -1,16 +1,16 @@
 # ONIE build environment for CI.
 #
-# Debian 11 is required: onie/build-config/Makefile still pulls in
-# python2-era tooling (python-all-dev) that is unavailable on newer
-# Debian releases.
+# Debian 13 (trixie) host for the modernized toolchain.  Required because
+# kernel 6.18's objtool needs a newer host libelf than Debian 11 ships
+# (0.183 fails with "elf_update: invalid section alignment"), and
+# crosstool-NG 1.28 / GCC 14 align with the trixie host toolchain.  (The
+# old crosstool-NG 1.24 / GCC 8.3 toolchain could NOT build on trixie.)
 #
 # This image builds the generic kvm_x86_64 target with secure boot
-# enabled.  It includes the secure-boot key-generation and EFI signing
-# tooling (gnupg2, efitools, sbsigntool, pesign), and the NSS command-line
-# tools the shim signing step shells out to (libnss3-tools:
-# pk12util/certutil).  shim's ENABLE_SHIM_HASH step uses the host pesign
-# (Debian 11 ships pesign 0.112).
-FROM debian:11
+# enabled.  It includes the secure-boot tooling needed to exercise the SB
+# build path -- pesign, efitools, sbsigntool and gnupg2 (for key
+# generation and EFI signing).
+FROM debian:13
 WORKDIR /onie
 
 # Tolerate transient Debian mirror hiccups (connection resets mid-fetch).
@@ -24,7 +24,7 @@ RUN apt-get update && apt-get install -y \
     autopoint \
     bc \
     bison \
-    bsdmainutils \
+    bsdextrautils \
     build-essential \
     coreutils \
     cpio \
@@ -43,20 +43,15 @@ RUN apt-get update && apt-get install -y \
     libelf-dev \
     libexpat1 \
     libexpat1-dev \
-    libncurses5 \
-    libncurses5-dev \
-    libnspr4-dev \
-    libnss3-dev \
-    libnss3-tools \
+    libncurses-dev \
     libpopt-dev \
-    pesign \
     libssl-dev \
     libtool \
     libtool-bin \
     locales \
     mtools \
+    pesign \
     pkgconf \
-    python-all-dev \
     python3-all-dev \
     python3-sphinx \
     python3-venv \

.github/workflows/build-onie.yml

@@ -40,6 +40,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      # The GCC 14 / Debian 13 toolchain build plus the full image (restored
+      # x-tools cache + every package + kernel + recovery ISO) exceeds the
+      # ~14 GB free on a stock ubuntu-latest runner.  Reclaim ~25 GB of
+      # preinstalled toolchains we do not use so the build has headroom.
+      - name: Free up runner disk space
+        run: |
+          echo "Disk before cleanup:"; df -h /
+          sudo rm -rf /usr/local/lib/android /opt/hostedtoolcache /usr/share/dotnet \
+                      /usr/local/.ghcup /usr/share/swift /usr/local/share/powershell \
+                      /usr/local/lib/node_modules || true
+          echo "Disk after cleanup:"; df -h /
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 

build-config/conf/crosstool/gcc-14.3.0/uClibc-ng-1.0.54/crosstool.x86_64.defconfig

@@ -0,0 +1,49 @@
+CT_CONFIG_VERSION="4"
+CT_LOCAL_TARBALLS_DIR="${DOWNLOADDIR}"
+CT_WORK_DIR="${CT_TOP_DIR}/build"
+CT_PREFIX_DIR="${XTOOLS_INSTALL_DIR}/${CT_TARGET}"
+CT_STRIP_TARGET_TOOLCHAIN_EXECUTABLES=y
+CT_LOG_INFO=y
+# CT_LOG_PROGRESS_BAR is not set
+CT_ARCH_X86=y
+CT_ARCH_64=y
+CT_TOOLCHAIN_PKGVERSION="ONIE-${LSB_RELEASE_TAG}"
+CT_TARGET_VENDOR="onie"
+CT_TARGET_ALIAS="x86_64"
+CT_TOOLCHAIN_ENABLE_NLS=y
+CT_KERNEL_LINUX=y
+CT_BINUTILS_FOR_TARGET=y
+CT_LIBC_UCLIBC_NG=y
+CT_LIBC_UCLIBC_CONFIG_FILE="${UCLIBC_CONFIG}"
+CT_LIBC_UCLIBC_LOCALES=y
+CT_GCC_V_14=y
+# CT_CC_GCC_LIBMPX is not set
+CT_CC_LANG_CXX=y
+CT_DEBUG_DUMA=y
+CT_DEBUG_GDB=y
+CT_DEBUG_LTRACE=y
+CT_DEBUG_STRACE=y
+CT_GETTEXT_V_0_19_8_1=y
+CT_LIBICONV_V_1_15=y
+CT_NCURSES_V_6_0=y
+CT_COMP_TOOLS_AUTOCONF=y
+CT_AUTOCONF_V_2_69=y
+CT_COMP_TOOLS_AUTOMAKE=y
+CT_AUTOMAKE_V_1_15=y
+CT_COMP_TOOLS_LIBTOOL=y
+CT_LIBTOOL_V_2_4=y
+CT_COMP_TOOLS_M4=y
+CT_COMP_TOOLS_MAKE=y
+
+#
+# Component versions that match the crosstool-NG 1.28.0 defaults are pinned
+# explicitly here so the toolchain spec stays visible and is protected against
+# silent drift if crosstool-NG is ever bumped (savedefconfig omits defaults).
+#
+CT_BINUTILS_V_2_45=y
+CT_UCLIBC_NG_V_1_0_54=y
+CT_GDB_V_16=y
+CT_GMP_V_6_3=y
+CT_ISL_V_0_27=y
+CT_MPC_V_1_3=y
+CT_MPFR_V_4_2=y