fetch-kernel.sh

#!/usr/bin/bash

set "${CI:+-x}" -euo pipefail

# ensures we pass a known dir for volume mount of output rpm files
KCWD=/tmp/kernel-cache
find "${KCWD}"

#shellcheck disable=SC2153
kernel_name="${KERNEL_NAME}"
#shellcheck disable=SC2153
kernel_version="${KERNEL_VERSION}"
#shellcheck disable=SC2153
kernel_flavor="${KERNEL_FLAVOR}"
build_tag="${KERNEL_BUILD_TAG:-latest}"

ARCH=$(uname -m)

dnf install -y --setopt=install_weak_deps=False dnf-plugins-core openssl
if [[ "$kernel_flavor" =~ "centos" ]]; then
    CENTOS_VER=$(rpm -E %centos)
    dnf config-manager --set-enabled crb
    dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm"
fi
dnf -y install --setopt=install_weak_deps=False dracut rpmrebuild sbsigntools

case "$kernel_flavor" in
    "centos"|"coreos"*|"main")
        ;;
    "centos-kmodsig")
        dnf -y install centos-release-kmods-kernel
        ;;
    "longterm"*)
        dnf -y copr enable kwizart/kernel-"${kernel_flavor}"
        ;;
    *)
        echo "unexpected kernel_flavor ${kernel_flavor} for query" >&2
        exit 1
        ;;
esac

if [[ "${kernel_flavor}" == "centos" ]]; then
    # Using curl instead of dnf download for https links
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-core-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-core-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-modules-extra-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/BaseOS/"$ARCH"/os/Packages/kernel-uki-virt-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/AppStream/"$ARCH"/os/Packages/kernel-devel-"$kernel_version".rpm
    curl -#fLO https://mirror.stream.centos.org/"$CENTOS_VER"-stream/AppStream/"$ARCH"/os/Packages/kernel-devel-matched-"$kernel_version".rpm
elif [[ "${kernel_flavor}" == "centos-kmodsig" ]]; then
    KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
    KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | rev | cut -d . -f 2- | rev)"
    # https://cbs.centos.org/kojifiles/packages/kernel/6.15.10/1.el10/x86_64/kernel-6.15.10-1.el10.x86_64.rpm
    BASE_URL="https://cbs.centos.org/kojifiles/packages/kernel/${KERNEL_MAJOR_MINOR_PATCH}/${KERNEL_RELEASE}/${ARCH}"
    for pkg in \
        kernel \
        kernel-core \
        kernel-devel \
        kernel-devel-matched \
        kernel-modules \
        kernel-headers; do
        curl -#fLO "${BASE_URL}/${pkg}-${kernel_version}.rpm"
    done
elif [[ "${kernel_flavor}" =~ "longterm" ]]; then
    dnf download -y --enablerepo="copr:copr.fedorainfracloud.org:kwizart:kernel-${kernel_flavor}" \
        kernel-longterm-"${kernel_version}" \
        kernel-longterm-core-"${kernel_version}" \
        kernel-longterm-modules-"${kernel_version}" \
        kernel-longterm-modules-core-"${kernel_version}" \
        kernel-longterm-modules-extra-"${kernel_version}" \
        kernel-longterm-devel-"${kernel_version}" \
        kernel-longterm-devel-matched-"${kernel_version}"
else
    KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
    KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | rev | cut -d . -f 2- | rev)"
    BASE_URL="https://kojipkgs.fedoraproject.org//packages/kernel/${KERNEL_MAJOR_MINOR_PATCH}/${KERNEL_RELEASE}/${ARCH}"
    # Using curl instead of dnf download for https links
    for pkg in \
        kernel \
        kernel-core \
        kernel-modules \
        kernel-modules-core \
        kernel-modules-extra \
        kernel-devel \
        kernel-devel-matched \
        kernel-uki-virt; do
        curl -#fLO "${BASE_URL}/${pkg}-${kernel_version}.rpm"
    done
fi

if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then
    echo "WARNING: Using test signing key."
    cp "${KCWD}"/certs/private_key.priv{.test,}
    cp "${KCWD}"/certs/public_key.der{.test,}
fi

trap 'rm -rf "${KCWD}/certs" /etc/pki/kernel/private/private_key*.priv /etc/pki/kernel/public/public_key*.crt' EXIT SIGINT

PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt"
PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv"

openssl x509 -in "${KCWD}"/certs/public_key.der -out "${KCWD}"/certs/public_key.crt

install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH"
install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH"

ls -la /
if [[ "${kernel_flavor}" == "centos-kmodsig" ]]; then
  dnf install -y \
      /"${kernel_name}-$kernel_version.rpm" \
      /"${kernel_name}-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-$kernel_version.rpm"
else
  dnf install -y \
      /"${kernel_name}-$kernel_version.rpm" \
      /"${kernel_name}-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-$kernel_version.rpm" \
      /"${kernel_name}-modules-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-extra-$kernel_version.rpm"
fi

# Strip Signatures from non-fedora Kernels
if [[ ${kernel_flavor} =~ main|coreos|centos ]]; then
    echo "Will not strip Fedora/CentOS signature(s) from ${kernel_flavor} kernel."
else
    EXISTING_SIGNATURES="$(sbverify --list /usr/lib/modules/"$kernel_version"/vmlinuz | grep '^signature \([0-9]\+\)$' | sed 's/^signature \([0-9]\+\)$/\1/')" || true
    if [[ -n "$EXISTING_SIGNATURES" ]]; then
        for SIGNUM in $EXISTING_SIGNATURES; do
            echo "Found existing signature at signum $SIGNUM, removing..."
            sbattach --remove /usr/lib/modules/"${kernel_version}"/vmlinuz
        done
    fi
fi

# Sign Kernel with Key
sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz

# Verify Signatures
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi

rm -f "$PRIVATE_KEY_PATH"

if [[ ${DUAL_SIGN:-} == "true" ]]; then
    SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt"
    SECOND_PRIVATE_KEY_PATH="/etc/pki/kernel/private/public_key_2.priv"
    if [[ ! -s "${KCWD}"/certs/private_key_2.priv ]]; then
        echo "WARNING: Using test signing key."
        cp "${KCWD}"/certs/private_key_2.priv{.test,}
        cp "${KCWD}"/certs/public_key_2.der{.test,}
        find "${KCWD}"/certs/
    fi
    openssl x509 -in "${KCWD}"/certs/public_key_2.der -out "${KCWD}"/certs/public_key_2.crt
    install -Dm644 "${KCWD}"/certs/public_key_2.crt "$SECOND_PUBLIC_KEY_PATH"
    install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH"
    sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
    sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
    if ! sbverify --cert "$SECOND_PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
        exit 1
    fi
    rm -f "$SECOND_PRIVATE_KEY_PATH"
fi

ln -s / /tmp/buildroot

# Rebuild RPMs and Verify
rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${kernel_name}-core-${kernel_version}"
rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
find /tmp
find /root
dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm

# Verify Again
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi
if [[ "${DUAL_SIGN:-}" == "true" ]] && ! sbverify --cert "${SECOND_PUBLIC_KEY_PATH:-}" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi

# Make Temp Dir
mkdir -p "${KCWD}"/rpms

# Move RPMs over
mv /kernel-*.rpm "${KCWD}"/rpms
if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then
  mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms
fi

# Delete keys in /tmp if we decide to publish this later
rm -rf "${KCWD}"/certs