ZeroDownTime/alpine-overlay
3
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

feat: all things KubeZero v1.30

Browse Source
This commit is contained in:
Stefan Reimer 2024-10-25 16:22:11 +00:00
parent 120158a8dd
commit cd3e76dca8
48 changed files with 21583 additions and 343 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Dockerfile
View File

@ -5,6 +5,7 @@ ARG BUILDUSER=alpine
RUN echo "http://dl-cdn.alpinelinux.org/alpine/${ALPINE}/main" > /etc/apk/repositories && \
echo "http://dl-cdn.alpinelinux.org/alpine/${ALPINE}/community" >> /etc/apk/repositories && \
echo "@edge-main http://dl-cdn.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories && \
#echo "http://dl-cdn.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories && \
echo "@edge-community http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories
RUN apk -U --no-cache upgrade && \

23
Makefile
View File

@ -11,7 +11,7 @@ PKG := '*'
CF_DIST := E11OFTOA3L8IVY
ALPINE_RELEASE = $(shell echo $(GIT_TAG) | sed -e 's/-.*$$//')
ALPINE_MAJOR := $(shell echo $(ALPINE_RELEASE) | sed -e 's/\.[0-9]$$//')
ALPINE_MAJOR := $(shell echo $(ALPINE_RELEASE) | sed -e 's/\.[0-9]$$//' -e's/v//')
.PHONY: aarch64-toolchain packages distfiles aports apk init_apk_repo
@ -31,9 +31,10 @@ distfiles:
mkdir -p distfiles
aports:
[ -d aports/.git ] && { cd aports; git pull origin $(ALPINE_RELEASE); }
[ -d aports/.git ] || { git clone https://gitlab.alpinelinux.org/alpine/aports.git && \
cd aports && git checkout $(ALPINE_RELEASE); }
mkdir -p aports && cd aports
[ -d .git ] && git pull
[ -d .git ] || git clone https://gitlab.alpinelinux.org/alpine/aports.git .
git checkout origin/$(ALPINE_MAJOR)-stable
apk: packages distfiles
podman run -it --rm --platform linux/$(_ARCH) \
@ -48,17 +49,17 @@ apk: packages distfiles
$(REGISTRY)/$(IMAGE):$(ALPINE_RELEASE) $(PKG)
download:
aws s3 sync s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/x86_64/ packages/kubezero/x86_64/ --exclude APKINDEX.tar.gz
#aws s3 sync s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/aarch64/ packages/kubezero/aarch64/ --exclude APKINDEX.tar.gz
aws s3 sync s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/x86_64/ packages/kubezero/x86_64/ --exclude APKINDEX.tar.gz
#aws s3 sync s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/aarch64/ packages/kubezero/aarch64/ --exclude APKINDEX.tar.gz
invalidate_cdn:
aws cloudfront create-invalidation --distribution $(CF_DIST) --paths "/alpine/*"
upload: invalidate_cdn
aws s3 sync --delete packages/kubezero/x86_64/ s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/x86_64/ --exclude APKINDEX.tar.gz
#aws s3 sync --delete packages/kubezero/aarch64/ s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/aarch64/ --exclude APKINDEX.tar.gz
aws s3 cp packages/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/x86_64/ --cache-control max-age=1
#aws s3 cp packages/kubezero/aarch64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/aarch64/ --cache-control max-age=1
aws s3 sync --delete packages/kubezero/x86_64/ s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/x86_64/ --exclude APKINDEX.tar.gz
#aws s3 sync --delete packages/kubezero/aarch64/ s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/aarch64/ --exclude APKINDEX.tar.gz
aws s3 cp packages/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/x86_64/ --cache-control max-age=1
#aws s3 cp packages/kubezero/aarch64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/aarch64/ --cache-control max-age=1
init_apk_repo:
aws s3 cp s3://zero-downtime-web-cdn/alpine/v3.19/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(ALPINE_MAJOR)/kubezero/x86_64/APKINDEX.tar.gz
aws s3 cp s3://zero-downtime-web-cdn/alpine/v3.19/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/v$(ALPINE_MAJOR)/kubezero/x86_64/APKINDEX.tar.gz

6
kubezero/aws-iam-authenticator/APKBUILD
View File

@ -1,14 +1,14 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=aws-iam-authenticator
pkgver=0.6.22
pkgver=0.6.27
pkgrel=0
pkgdesc="AWS aws-iam-authenticator"
url="https://github.com/kubernetes-sigs/aws-iam-authenticator"
arch="x86_64 aarch64 armv7 x86"
license="Apache-2.0"
makedepends="go bash"
options="!check chmod-clean"
options="!check chmod-clean net"
source="$pkgname-$pkgver.tar.gz::https://github.com/kubernetes-sigs/$pkgname/archive/refs/tags/v$pkgver.tar.gz"
build() {
@ -20,5 +20,5 @@ package() {
}
sha512sums="
5a80f9bdaad86f3ff1140e49bd7b1dc1cceaa4e8885a4f60bb638e64ce542f0177641bb47c6b2cb5e95dabede30d385bce320bb466d627760630270969cf6876 aws-iam-authenticator-0.6.22.tar.gz
5940b02a4b8dd46a3ce0b2d5ed55bbe15ebcbd7431d53449986ce33501a38b71cf9db5ab7d5c6d4969b91b5d89d2a2bb5acc6648a9e552c100c58aba568c98ba aws-iam-authenticator-0.6.27.tar.gz
"

4
kubezero/aws-neuron-driver/APKBUILD
View File

@ -5,7 +5,7 @@
# Todo: needs fix of https://github.com/aws-neuron/aws-neuron-sdk/issues/843
#
pkgname=aws-neuron-driver
pkgver=2.17.17.0
pkgver=2.18.12.0
pkgrel=0
pkgdesc="Linux Kernel module for AWS Neuron INF instances"
url="https://awsdocs-neuron.readthedocs-hosted.com/en/latest/release-notes/index.html#"
@ -47,5 +47,5 @@ package() {
}
sha512sums="
e14531f50bb7b4c2854a6e1c53e8a4d5a639abc2657b6f5458e5f9f4f54f4f1e55bbd240e2bf96779ec0ec52fdfe4ab4148b7fa888bbed6f3ddcb9d20c2c742f aws-neuron-driver-2.17.17.0.deb
fdabcd3acff8576e0edbb9cb20892c2ae2be96d84313e5576ee295672b7964ceb81cc512ff760820c903ee4eec831162bec17ebc8c4a32676b9c670c29dcdbeb aws-neuron-driver-2.18.12.0.deb
"

6
kubezero/cri-o/APKBUILD
View File

@ -3,7 +3,7 @@
# Contributor: TBK <alpine@jjtc.eu>
# Maintainer: ungleich <foss@ungleich.ch>
pkgname=cri-o
pkgver=1.29.7
pkgver=1.30.6
pkgrel=0
pkgdesc="OCI-based implementation of Kubernetes Container Runtime Interface"
url="https://github.com/cri-o/cri-o/"
@ -104,8 +104,8 @@ package() {
}
sha512sums="
607177d73df4a1c9a5960595ee793c83803883daf4f1cf3b3b95afc982e5e330e6f79fe20a11ba5512fde1022fc9f55f2e08b0f99cbb3e65f44752fe5ceafdf2 cri-o-1.29.7.tar.gz
1f60719677295c9c5c615eb25d9159bde0af68a132eee67747f57fe76642d457c98c896c6189f85637d7b4ac24ba55fd9eaeb1699f43c3c5077b645f72a479fb crio.conf
3e8e3422a0fac9b603775a9b05626134b0e8b37425ddbbf39e155283ecdc7ac50184bb578179bc25585711286320034251318c599039d3b539d0f4d7f334c341 cri-o-1.30.6.tar.gz
469eddef2e7b24f3ac7b192da3851ada7332f8f93cd4503d8c4d62cc39f669d7893e69c654bc2d86e3d89919fa6da765a393576bcdeb94f1a024bec4fa5cbe2f crio.conf
e9149cc2ddd24328c5290d3aea895c01e2798e066897535384f615a556496acdd52a603a0f4ac3c4c70bd5c363592f23c8b4d1987bf738300112fc62e1def555 crio.initd
1115228546a696eeebeb6d4b3e5c3152af0c99a2559097fc5829d8b416d979c457b4b1789e0120054babf57f585d3f63cbe49949d40417ae7aab613184bf4516 crio.logrotated
0a567dfa431ab1e53f2a351689be8d588a60cc5fcdbda403ec4f8b6ab9b1c18ad425f6c47f9a5ab1491e3a61a269dc4efa6a59e91e7521fa2b6bb165074aa8e0 cni-plugins-path.patch

7
kubezero/cri-o/crio.conf
View File

@ -1,11 +1,10 @@
[crio.runtime]
# Overide defaults to not use systemd cgroups.
conmon_cgroup = "pod"
cgroup_manager = "cgroupfs"
default_runtime = "crun"
[crio.runtime.runtimes.crun]
runtime_path = "/usr/bin/crun"
runtime_type = "oci"
runtime_root = "/run/crun"
monitor_cgroup = "pod"
monitor_exec_cgroup = "container"

4
kubezero/cri-tools/APKBUILD
View File

@ -1,7 +1,7 @@
# Contributor: Francesco Colista <fcolista@alpinelinux.org>
# Maintainer: Francesco Colista <fcolista@alpinelinux.org>
pkgname=cri-tools
pkgver=1.29.0
pkgver=1.30.1
pkgrel=0
pkgdesc="CLI tool for Kubelet Container Runtime Interface (CRI)"
url="https://github.com/kubernetes-sigs/cri-tools"
@ -27,5 +27,5 @@ package() {
}
sha512sums="
8e18e21017ea3140baaae7fedc85811738f1793962d5a9494117d5d0dd7f3f01468ca4768066be0bd80760b494c0c69d426603cc0326b9f95070db2547b6b8c2 cri-tools-1.29.0.tar.gz
c3a989ec57016a05a83adbabab7ec49da267f0d6cfc603a4cb8cb4699fe499c16b49e910fb6bfda413a57f45eb3a3d6f0a5c5b8d76895695ed3870343a0c4db9 cri-tools-1.30.1.tar.gz
"

6
kubezero/ecr-credential-provider/APKBUILD
View File

@ -1,14 +1,14 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=ecr-credential-provider
pkgver=1.29.5
pkgver=1.30.3
pkgrel=0
pkgdesc="AWS Kubernetes ecr-credential-provider"
url="https://github.com/kubernetes/cloud-provider-aws"
arch="x86_64 aarch64 armv7 x86"
license="Apache-2.0"
makedepends="go bash"
options="!check chmod-clean"
options="!check chmod-clean net"
source="$pkgname-$pkgver.tar.gz::https://github.com/kubernetes/cloud-provider-aws/archive/refs/tags/v$pkgver.tar.gz"
builddir="$srcdir/cloud-provider-aws-$pkgver"
@ -24,5 +24,5 @@ package() {
}
sha512sums="
4ffe2c2f4cdd42d0fb20dc1937088c89b4e7cf816493c8a89f16d95f8090faf780e9e60ffe1c38ffde2f74593f9c6b77927f38c4443aa62e44c7eb35c333017c ecr-credential-provider-1.29.5.tar.gz
aa351cd531e452dd4ccead4a591a9161a25737ada93a7317c5c181c3d4fe55b279e94b686d8c03665ebee01191129a52b01c9dabfba7075c5e9bde52e6a341c8 ecr-credential-provider-1.30.3.tar.gz
"

9
kubezero/falco/APKBUILD
View File

@ -1,7 +1,7 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=falco
pkgver=0.38.1
pkgver=0.39.1
pkgrel=0
pkgdesc="Falco is the open source solution for runtime security for hosts, containers, Kubernetes and the cloud"
url="https://github.com/falcosecurity/falco"
@ -32,6 +32,8 @@ source="
falco.initd
"
subpackages="$pkgname-openrc"
prepare() {
[[ -d build ]] || mkdir build
}
@ -52,6 +54,7 @@ build() {
-DBUILD_DRIVER=Off \
-DBUILD_BPF=Off \
-DBUILD_LIBSCAP_MODERN_BPF=On \
-DADD_FALCOCTL_DEPENDENCY=OFF \
..
make falco
@ -76,8 +79,8 @@ package() {
}
sha512sums="
f76b228328a3cf29f5795f7239393d7d05101f488e6ff09f5434237e906ec04a0139a5c91089c36cf3d01058584773b8fe0b1742e760a3e4953237fbc49e834f falco-0.38.1.tar.gz
bb547691640fed21cc4976f469cf3813f888d9cc55e1a4631133c8cd9e6b1adce1d279dddfdf6b191442eeacd0e635a48d4ffa10913059f6117b5710e284899e falco-0.39.1.tar.gz
b152fcf6cd81895efa37797ab7ff1aac7350b5f51f2648aa9e3cce9d5ece55791ddf82c396e9da216293e2379a785a294cc972f28a91162dc5bc88ab09e1ab08 falco.patch
487b8b64d2399fd7b706be29e3722983bcdfde3ab5cf0f78b2e9fe1055a4ad958976f591e739491e25a06d7cdf6894c1e153e892a87b83c7a962e23c9a104528 rules.patch
b6cf8bda946b71241b332d25bcde73e73159ae0993be4291c158e23e44f927b4432d53b9d6d730aee442c94ffc75e119b9f6467e94a0950a19a5f1369afb4e13 rules.patch
9d1292a99bab7792bfe344940fa41ccf01318d5f30f854b01457e9f53ccca27f7f334466c061a11fbe8ebf918aeeb7f723b16a233c9e3bd60dd632d831ae9f5c falco.initd
"

1250
kubezero/falco/falco_rules.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

10
kubezero/falco/rules.patch
View File

@ -6,24 +6,24 @@
- list: userexec_binaries
- items: [sudo, su, suexec, critical-stack, dzdo]
+ items: [doas, sudo, su, suexec, critical-stack, dzdo]
- list: user_mgmt_binaries
items: [login_binaries, passwd_binaries, shadowutils_binaries]
@@ -200,7 +200,7 @@
]
- list: sensitive_file_names
- items: [/etc/shadow, /etc/sudoers, /etc/pam.conf, /etc/security/pwquality.conf]
+ items: [/etc/shadow, /etc/doas.d/doas.conf, /etc/sudoers, /etc/pam.conf, /etc/security/pwquality.conf]
- list: sensitive_directory_names
items: [/, /etc, /etc/, /root, /root/]
@@ -208,7 +208,7 @@
- macro: sensitive_files
condition: >
((fd.name startswith /etc and fd.name in (sensitive_file_names)) or
(fd.name in (sensitive_file_names) or
- fd.directory in (/etc/sudoers.d, /etc/pam.d))
+ fd.directory in (/etc/sudoers.d, /etc/pam.d, /etc/doas.d))
# Indicates that the process is new. Currently detected using time
# since process was started, using a threshold of 5 seconds.

6
kubezero/falcoctl/APKBUILD
View File

@ -1,7 +1,5 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=falcoctl
pkgver=0.8.0
pkgver=0.10.0
pkgrel=0
pkgdesc="The official CLI tool for working with Falco and its ecosystem components."
url="https://github.com/falcosecurity/falcoctl"
@ -33,5 +31,5 @@ package() {
}
sha512sums="
e62b59339ed1005bfcb9e59242bc187e8c9505173fc2c506f8990abf905062aaccdcc465fd01ffeec90886af1f4afea8448c3f128c84b18b145ffdf0a0f90dbf falcoctl-0.8.0.tar.gz
d4b029f9b49de1cde431cadb2948e9b0e9e5aa4b9105f5f404814c410d6cf9af2bd52c52cebec45743f369ba7bded535c94a4a04eec40d0cba63a385b1531926 falcoctl-0.10.0.tar.gz
"

152
kubezero/fluent-bit/APKBUILD
View File

@ -1,7 +1,7 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=fluent-bit
pkgver=2.2.2
pkgver=3.1.9
pkgrel=0
pkgdesc="Fast and Lightweight Log processor and forwarder"
url="https://fluentbit.io/"
@ -9,104 +9,104 @@ url="https://fluentbit.io/"
arch="all !ppc64le !s390x !riscv64"
license="Apache-2.0"
makedepends="
bison
cmake
flex
gtest-dev
linux-headers
musl-fts-dev
openssl-dev
yaml-dev
zlib-dev
"
bison
cmake
flex
gtest-dev
linux-headers
musl-fts-dev
openssl-dev
yaml-dev
zlib-dev
"
subpackages="
$pkgname-dev
$pkgname-openrc
"
$pkgname-dev
$pkgname-openrc
"
source="$pkgname-$pkgver.tar.gz::https://github.com/fluent/fluent-bit/archive/v$pkgver.tar.gz
fluent-bit.confd
fluent-bit.initd
chunkio-static-lib-fts.patch
exclude-luajit.patch
xsi-strerror.patch
fluent-bit.conf
zdt-parsers.conf
fluent-bit.logrotated
"
fluent-bit.initd
chunkio-static-lib-fts.patch
exclude-luajit.patch
musl-strerror_r.patch
fluent-bit.confd
fluent-bit.conf
zdt-parsers.conf
fluent-bit.logrotated
"
# enable check when this solved - https://github.com/fluent/fluent-bit/issues/2464#issuecomment-673280055
# Disable all things AWS to make tests pass
options="!check"
build() {
if [ "$CBUILD" != "$CHOST" ]; then
CMAKE_CROSSOPTS="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux -DCMAKE_C_COMPILER=$CHOST-gcc"
fi
# default CORE_STACK_SIZE=((3 * PTHREAD_STACK_MIN) / 2)=3072 is invalid
# set default to 24576
# Disable stream processor due to issue see: https://github.com/fluent/fluent-bit/issues/2464
cmake -B build \
-DCMAKE_INSTALL_PREFIX=/usr \
-DCMAKE_INSTALL_LIBDIR=lib \
-DCMAKE_BUILD_TYPE=None \
-DFLB_CORO_STACK_SIZE=24576 \
-DFLB_RELEASE=Yes \
-DFLB_DEBUG=Off \
-DFLB_SHARED_LIB=Off \
-DFLB_JEMALLOC=Yes \
-DFLB_IN_SYSTEMD=Off \
-DFLB_PROXY_GO=No \
-DFLB_TLS=Yes \
-DFLB_HTTP_SERVER=Yes \
$CMAKE_CROSSOPTS .
make -C build
#-DCMAKE_FIND_LIBRARY_SUFFIXES=".a" \
#-DCMAKE_EXE_LINKER_FLAGS="-static" \
#-DFLB_STREAM_PROCESSOR=No \
#-DFLB_LUAJIT=Yes \
#-DFLB_FILTER_LUA=Off \
#-DFLB_TESTS_INTERNAL=Yes \
#-DFLB_AWS=No \
#-DFLB_SIGNV4=No \
#-DFLB_OUT_S3=No \
#-DFLB_OUT_CLOUDWATCH_LOGS=No \
#-DFLB_OUT_KINESIS_FIREHOSE=No \
#-DFLB_OUT_KINESIS_STREAMS=No \
#-DFLB_OUT_BIGQUERY=No \
#-DFLB_FILTER_AWS=No \
#-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON \
if [ "$CBUILD" != "$CHOST" ]; then
CMAKE_CROSSOPTS="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux -DCMAKE_C_COMPILER=$CHOST-gcc"
fi
# default CORE_STACK_SIZE=((3 * PTHREAD_STACK_MIN) / 2)=3072 is invalid
# set default to 24576
# Disable stream processor due to issue see: https://github.com/fluent/fluent-bit/issues/2464
cmake -B build \
-DCMAKE_INSTALL_PREFIX=/usr \
-DCMAKE_INSTALL_LIBDIR=lib \
-DCMAKE_BUILD_TYPE=None \
-DFLB_CORO_STACK_SIZE=24576 \
-DFLB_RELEASE=Yes \
-DFLB_DEBUG=Off \
-DFLB_SHARED_LIB=Off \
-DFLB_JEMALLOC=Yes \
-DFLB_IN_SYSTEMD=Off \
-DFLB_PROXY_GO=No \
-DFLB_TLS=Yes \
-DFLB_HTTP_SERVER=Yes \
$CMAKE_CROSSOPTS .
make -C build
#-DCMAKE_FIND_LIBRARY_SUFFIXES=".a" \
#-DCMAKE_EXE_LINKER_FLAGS="-static" \
#-DFLB_STREAM_PROCESSOR=No \
#-DFLB_LUAJIT=Yes \
#-DFLB_FILTER_LUA=Off \
#-DFLB_TESTS_INTERNAL=Yes \
#-DFLB_AWS=No \
#-DFLB_SIGNV4=No \
#-DFLB_OUT_S3=No \
#-DFLB_OUT_CLOUDWATCH_LOGS=No \
#-DFLB_OUT_KINESIS_FIREHOSE=No \
#-DFLB_OUT_KINESIS_STREAMS=No \
#-DFLB_OUT_BIGQUERY=No \
#-DFLB_FILTER_AWS=No \
#-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON \
}
check() {
CTEST_OUTPUT_ON_FAILURE=1 make -C build test
CTEST_OUTPUT_ON_FAILURE=1 make -C build test
}
package() {
make -C build DESTDIR="$pkgdir" install
make -C build DESTDIR="$pkgdir" install
install -Dm755 "$srcdir"/$pkgname.initd \
"$pkgdir"/etc/init.d/$pkgname
install -Dm644 "$srcdir"/$pkgname.confd \
"$pkgdir"/etc/conf.d/$pkgname
install -Dm755 "$srcdir"/$pkgname.initd \
"$pkgdir"/etc/init.d/$pkgname
install -Dm644 "$srcdir"/$pkgname.confd \
"$pkgdir"/etc/conf.d/$pkgname
mv "$pkgdir"/usr/etc/* "$pkgdir"/etc
rm "$pkgdir"/etc/fluent-bit/fluent-bit.conf
mv "$pkgdir"/usr/etc/* "$pkgdir"/etc
rm "$pkgdir"/etc/fluent-bit/fluent-bit.conf
mkdir -p "$pkgdir"/var/spool/fluent-bit
install -Dm644 "$srcdir/fluent-bit.conf" "$pkgdir/etc/fluent-bit/fluent-bit.conf"
install -Dm644 "$srcdir/zdt-parsers.conf" "$pkgdir/etc/fluent-bit/zdt-parsers.conf"
mkdir -p "$pkgdir"/var/spool/fluent-bit
install -Dm644 "$srcdir/fluent-bit.conf" "$pkgdir/etc/fluent-bit/fluent-bit.conf"
install -Dm644 "$srcdir/zdt-parsers.conf" "$pkgdir/etc/fluent-bit/zdt-parsers.conf"
install -Dm644 "$srcdir"/fluent-bit.logrotated "$pkgdir"/etc/logrotate.d/fluentbit
install -Dm644 "$srcdir"/fluent-bit.logrotated "$pkgdir"/etc/logrotate.d/fluentbit
touch "$pkgdir"/etc/fluent-bit/metadata.conf
touch "$pkgdir"/etc/fluent-bit/metadata.conf
}
sha512sums="
681c1db0256d0b50d986194597b700f790726a1394b3ad92c92a26c95d04bf2b65203e94ef2aeb0f0b3403870748ec0ebbec2cd49548857fbadc5c745581452f fluent-bit-2.2.2.tar.gz
f6431397c80a036980b5377b51e38aec25dfceeb8dbe4cd54dce1f6e77d669d9f8daf983fcc96d25332385888f1809ced5e8ab0e8ccfcd93d19494036e3dc949 fluent-bit.confd
fbf6a8c8b35cafb8fc2f95e5a52dee835c86af9f1bcded9edabca9586c41cf9c4ded776018dfecc0f96b7f7a68587f263fb19704c458f8606b6b1033a323034e fluent-bit-3.1.9.tar.gz
8ba6c8e84dee90176f9b4375fb2c6444fa5d32fa601d9bcf3ea7960fec87f1ef664f175caf08bd0b052843e971efdbf08e2a5cd180ad9a8f23ff2c5cb233814f fluent-bit.initd
6bd7d8b4da93a17f29b6ea1e0286ea226d0e376024284741110936779b3229bd8d6cd03ffbdc5d3b4842294e7f32a888de0dd16b0851b65d91b062ca58530ea0 chunkio-static-lib-fts.patch
e3308a8377fb8ba496415b7a31e9e022e5aa9965d27a0c33ea5166a29049b72cb364bbcdf9d8611ef3407b0968f9bd4adff12cdb39728bbebd382710e5bc75d0 exclude-luajit.patch
d61f30344af997f126486fa5b34cd3fbfe88bfc9aea394a8c60d0206f4db8db998eadf637a3a581b89512411c1e7980c414e236e455d5e2b889d20a556ee6577 xsi-strerror.patch
aa1449f8f4599330e1a01c2837f22cb1d10ce5926d9cb92f92fb89939c7b6af3116d3339566709ad466ebf6e37a5b178e84619ec6a1608327241a0374992be81 exclude-luajit.patch
f11e4e6f674e2e7d56f3b77e1f6f0afbf1d15004f5d43d91080697ec39ef53d330565c46b02cb5d97612450fe0cc0a9e9a4c895c0fe021057a7cc2b6e62557bc musl-strerror_r.patch
f6431397c80a036980b5377b51e38aec25dfceeb8dbe4cd54dce1f6e77d669d9f8daf983fcc96d25332385888f1809ced5e8ab0e8ccfcd93d19494036e3dc949 fluent-bit.confd
52aba9d23584d64842bc967504701a10166a43a03ca0d31de9b6cbffaacdbaa7d99f0fd55a4b0194e3b65d456817cb1779b86d468d81c1d9681a6fa708e85449 fluent-bit.conf
31899a3c68bbb43adb9025a3a46bad4ca0c740d5bca5c252c8667197575698d98ac4a3b6e11ee160c4bb8df0d0089b639bfd7d0ffa52391e6c4f8f734a6952a6 zdt-parsers.conf
e166b0ff11a1789599e93f86b72102ca6a06725c98553a8fdd48c8d6414bfa765c3958d07bfb4c4d99101d8cdf7d00db1a8506d48c2cbd6bd375ce43c43d2bf9 fluent-bit.logrotated

11
kubezero/fluent-bit/exclude-luajit.patch
View File

@ -1,12 +1,11 @@
otherwise it installs an unused /usr/bin/luajit ....
-0
diff --git a/cmake/luajit.cmake b/cmake/luajit.cmake
index b6774eb..f8042ae 100644
--- a/cmake/luajit.cmake
+++ b/cmake/luajit.cmake
@@ -1,4 +1,4 @@
# luajit cmake
option(LUAJIT_DIR "Path of LuaJIT 2.1 source dir" ON)
set(LUAJIT_DIR ${FLB_PATH_ROOT_SOURCE}/${FLB_PATH_LIB_LUAJIT})
@@ -6,5 +6,5 @@
${LUAJIT_DIR}/src
${CMAKE_CURRENT_BINARY_DIR}/lib/luajit-cmake
)
-add_subdirectory("lib/luajit-cmake")
+add_subdirectory("lib/luajit-cmake" EXCLUDE_FROM_ALL)
set(LUAJIT_LIBRARIES "libluajit")

35
kubezero/fluent-bit/musl-strerror_r.patch Normal file
View File

@ -0,0 +1,35 @@
Fix -Wint-conversion error with gcc 14 due to musl using POSIX strerror_r.
```
/home/build/aports/testing/fluent-bit/src/fluent-bit-3.1.9/src/flb_network.c: In function 'net_connect_async':
/home/build/aports/testing/fluent-bit/src/fluent-bit-3.1.9/src/flb_network.c:566:17: error: assignment to 'char *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
566 | str = strerror_r(error, so_error_buf, sizeof(so_error_buf));
```
--- fluent-bit-3.1.9-origin/src/flb_network.c
+++ fluent-bit-3.1.9/src/flb_network.c
@@ -549,24 +549,18 @@
if (u_conn->net_error > 0) {
error = u_conn->net_error;
}
/* Connection is broken, not much to do here */
-#if ((defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200112L) || \
- (defined(_XOPEN_SOURCE) || _XOPEN_SOURCE - 0L >= 600L)) && \
- (!defined(_GNU_SOURCE))
ret = strerror_r(error, so_error_buf, sizeof(so_error_buf));
if (ret == 0) {
str = so_error_buf;
}
else {
flb_errno();
return -1;
}
-#else
- str = strerror_r(error, so_error_buf, sizeof(so_error_buf));
-#endif
flb_error("[net] TCP connection failed: %s:%i (%s)",
u->tcp_host, u->tcp_port, str);
return -1;
}
}

15
kubezero/fluent-bit/xsi-strerror.patch
View File

@ -1,15 +0,0 @@
--- a/src/flb_network.c
+++ b/src/flb_network.c
@@ -523,9 +523,10 @@
}
/* Connection is broken, not much to do here */
- str = strerror_r(error, so_error_buf, sizeof(so_error_buf));
+ /* XXX: XSI */
+ int _err = strerror_r(error, so_error_buf, sizeof(so_error_buf));
flb_error("[net] TCP connection failed: %s:%i (%s)",
- u->tcp_host, u->tcp_port, str);
+ u->tcp_host, u->tcp_port, so_error_buf);
return -1;
}
}

14
kubezero/kubernetes/APKBUILD
View File

@ -5,7 +5,7 @@
# Contributor: Dave <dj.2dixx@gmail.com>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=kubernetes
pkgver=1.29.7
pkgver=1.30.6
pkgrel=0
pkgdesc="Container Cluster Manager"
url="https://kubernetes.io/"
@ -72,6 +72,14 @@ export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
# Without this the build scripts will attempt to download a whole Go toolchain
# with the 'gimme' script when our Go does not match version from '.go-version'
export FORCE_HOST_GO=y
# Without this some architectures (x86, armv7, s390x) encounter the error:
# "-buildmode=pie requires external (cgo) linking, but cgo is not enabled"
export KUBE_CGO_OVERRIDES="$_agent $_cli $_services"
build() {
for _pkgs in $_agent $_cli $_services ; do
make -j1 GOFLAGS="$GOFLAGS -buildmode=pie -v -tags=providerless" GOLDFLAGS="-extldflags=-static" WHAT=cmd/$_pkgs
@ -205,7 +213,7 @@ _do_zshcomp() {
}
sha512sums="
bce18d12164704f4d55d7566737bdff8305c5613af7a8df4b49cfa5f90f6b51f879159c4da7fbe436fdf7c4fcf5331f3f35e63f8dbc4c833559e6e2b1a61d08f kubernetes-1.29.7.tar.gz
c4b5ebb08dbd9daeac2f4da5a1b93c397473e7cf12439291ce80e43b4aae1d233c6e980a080b5c8aaa12e296aa04e068f8b00b23386b23802b99c2ce8f42c800 kubernetes-1.30.6.tar.gz
5427c2e653504cfd5b0bcaf195d4734ee40947ddfebc9f155cd96dddccfc27692c29d94af4ac99f1018925b52995c593b584c5d7a82df2f185ebce1a9e463c40 make-e2e_node-run-over-distro-bins.patch
94d07edfe7ca52b12e85dd9e29f4c9edcd144abc8d120fb71e2a0507f064afd4bac5dde30da7673a35bdd842b79a4770a03a1f3946bfae361c01dd4dc4903c64 make-test-cmd-run-over-hyperkube-based-kubectl.patch
e690daff2adb1013c92124f32e71f8ed9a18c611ae6ae5fcb5ce9674768dbf9d911a05d7e4028488cda886e63b82e8ac0606d14389a05844c1b5538a33dd09d1 kube-apiserver.initd
@ -221,6 +229,6 @@ d7e022ee22da191bda7382f87cb293d9c9d115a3df0c2054bf918279eb866f99c6d5c21e4c98eae8
af88b382ab75657d0ff13c3f8f6d924cef9f2df7807a9a27daa63495981801bc4b607998f65c0758c11a7e070e43c24f7184ba7720711109c74b1c4d57919e34 kube-scheduler.confd
3692da349dd6ed0f5acc09d7b95ac562ffecb103e2270bebdfe4a7808d48dada9d2debff262d85b11c47f9ca3f0c20000712d03629ed813ff08a3e02d69267e6 kube-scheduler.logrotated
372cdf2fbb24a229ed7b3450b54197c006928cb8d2fd756f2713e1e6961849c7aaa35b20b14fb75d1a12ef1e35258048738aa22b5f9783af8fa0a31dfd1b5bbd kubelet.initd
44eb973de8ee8e0c5a77d76ab0e105fe0ae892be1ff86c238a5449b43f83cab6f844575b6c3218f08c5ff077e9f828f5aef72425c1d77546cce2e0136e8a8da8 kubelet.confd
cc4fd92a9f288336cf204a38d6913ca25e20b78d0c4abb74b6b2b8cf634d7df774144bde1101048d9d9ab0f140ffb62ce31cf3bb2a69ddeadd04c273dfcb58a0 kubelet.confd
941f4a7579dcf78da2d323ac69195e95eba6600e6fcefe9231447f11c9867a7aa57b4189ee1fefb10eab19c89665ea2e7696b539c92e99fbcde905d2ff85be58 kubelet.logrotated
"

2
kubezero/kubernetes/kubelet.confd
View File

@ -1 +1 @@
command_args="--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --image-credential-provider-bin-dir=/usr/libexec/kubernetes/kubelet-plugins --image-credential-provider-config=/etc/kubernetes/credential-provider.yaml"
command_args="--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --config-dir=/var/lib/kubelet/conf.d --image-credential-provider-bin-dir=/usr/libexec/kubernetes/kubelet-plugins --image-credential-provider-config=/etc/kubernetes/credential-provider.yaml"

10
kubezero/kubezero/APKBUILD
View File

@ -1,9 +1,9 @@
# Contributor: Stefan Reimer <stefan@zero-downtime.net>
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=kubezero
pkgver=1.29.7
_crio=1.29.7
_ecr=1.29.5
pkgver=1.30.6
_crio=1.30.6
_ecr=1.30.3
pkgrel=0
pkgdesc="KubeZero release package"
@ -18,7 +18,7 @@ depends="
kubelet~$pkgver
kubectl~$pkgver
ecr-credential-provider~$_ecr
aws-iam-authenticator~0.6.22
aws-iam-authenticator~0.6.27
"
options="!check"
#install="$pkgname.post-install"
@ -28,7 +28,7 @@ subpackages="
"
IMAGES="
quay.io/cilium/cilium:v1.15.7
quay.io/cilium/cilium:v1.16.3
ghcr.io/k8snetworkplumbingwg/multus-cni:v3.9.3
"

64
kubezero/libexecinfo/10-execinfo.patch
View File

@ -1,64 +0,0 @@
--- a/execinfo.c.orig
+++ b/execinfo.c
@@ -69,7 +69,8 @@
char **
backtrace_symbols(void *const *buffer, int size)
{
- int i, clen, alen, offset;
+ size_t clen, alen;
+ int i, offset;
char **rval;
char *cp;
Dl_info info;
@@ -78,7 +79,6 @@
rval = malloc(clen);
if (rval == NULL)
return NULL;
- (char **)cp = &(rval[size]);
for (i = 0; i < size; i++) {
if (dladdr(buffer[i], &info) != 0) {
if (info.dli_sname == NULL)
@@ -92,14 +92,14 @@
2 + /* " <" */
strlen(info.dli_sname) + /* "function" */
1 + /* "+" */
- D10(offset) + /* "offset */
+ 10 + /* "offset */
5 + /* "> at " */
strlen(info.dli_fname) + /* "filename" */
1; /* "\0" */
rval = realloc_safe(rval, clen + alen);
if (rval == NULL)
return NULL;
- snprintf(cp, alen, "%p <%s+%d> at %s",
+ snprintf((char *) rval + clen, alen, "%p <%s+%d> at %s",
buffer[i], info.dli_sname, offset, info.dli_fname);
} else {
alen = 2 + /* "0x" */
@@ -108,12 +108,15 @@
rval = realloc_safe(rval, clen + alen);
if (rval == NULL)
return NULL;
- snprintf(cp, alen, "%p", buffer[i]);
+ snprintf((char *) rval + clen, alen, "%p", buffer[i]);
}
- rval[i] = cp;
- cp += alen;
+ rval[i] = (char *) clen;
+ clen += alen;
}
+ for (i = 0; i < size; i++)
+ rval[i] += (long) rval;
+
return rval;
}
@@ -155,6 +158,6 @@
return;
snprintf(buf, len, "%p\n", buffer[i]);
}
- write(fd, buf, len - 1);
+ write(fd, buf, strlen(buf));
}
}

24
kubezero/libexecinfo/20-define-gnu-source.patch
View File

@ -1,24 +0,0 @@
--- a/execinfo.c.orig
+++ b/execinfo.c
@@ -26,6 +26,7 @@
* $Id: execinfo.c,v 1.3 2004/07/19 05:21:09 sobomax Exp $
*/
+#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/uio.h>
#include <dlfcn.h>
--- a/stacktraverse.c.orig
+++ b/stacktraverse.c
@@ -1,3 +1,4 @@
+#define _GNU_SOURCE
#include <stddef.h>
#include "stacktraverse.h"
--- a/test.c.orig
+++ b/test.c
@@ -1,3 +1,4 @@
+#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>

44
kubezero/libexecinfo/30-linux-makefile.patch
View File

@ -1,44 +0,0 @@
--- a/Makefile.orig
+++ b/Makefile
@@ -23,24 +23,25 @@
# SUCH DAMAGE.
#
# $Id: Makefile,v 1.3 2004/07/19 05:19:55 sobomax Exp $
+#
+# Linux Makefile by Matt Smith <mcs@darkregion.net>, 2011/01/04
-LIB= execinfo
+CC=cc
+AR=ar
+EXECINFO_CFLAGS=$(CFLAGS) -O2 -pipe -fno-strict-aliasing -std=gnu99 -fstack-protector -c
+EXECINFO_LDFLAGS=$(LDFLAGS)
-SRCS= stacktraverse.c stacktraverse.h execinfo.c execinfo.h
+all: static dynamic
-INCS= execinfo.h
+static:
+ $(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c
+ $(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c
+ $(AR) rcs libexecinfo.a stacktraverse.o execinfo.o
-SHLIB_MAJOR= 1
-SHLIB_MINOR= 0
+dynamic:
+ $(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c -o stacktraverse.So
+ $(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c -o execinfo.So
+ $(CC) -shared -Wl,-soname,libexecinfo.so.1 -o libexecinfo.so.1 stacktraverse.So execinfo.So
-NOPROFILE= yes
-
-DPADD= ${LIBM}
-LDADD= -lm
-
-#WARNS?= 4
-
-#stacktraverse.c: gen.py
-# ./gen.py > stacktraverse.c
-
-.include <bsd.lib.mk>
+clean:
+ rm -rf *.o *.So *.a *.so

50
kubezero/libexecinfo/APKBUILD
View File

@ -1,50 +0,0 @@
# Contributor: Philipp Andronov <filipp.andronov@gmail.com>
# Maintainer: Matt Smith <mcs@darkregion.net>
pkgname=libexecinfo
pkgver=1.1
pkgrel=1
pkgdesc="A quick-n-dirty BSD licensed clone of the GNU libc backtrace facility."
options="!check" # No testsuite
url="https://www.freshports.org/devel/libexecinfo"
arch="all"
license="BSD-2-Clause"
subpackages="$pkgname-static ${pkgname}-dev"
source="http://distcache.freebsd.org/local-distfiles/itetcu/$pkgname-$pkgver.tar.bz2
10-execinfo.patch
20-define-gnu-source.patch
30-linux-makefile.patch
"
build() {
cd "$builddir"
export CFLAGS="${CFLAGS} -fno-omit-frame-pointer"
make
}
package() {
cd "$builddir"
install -D -m755 "$builddir"/execinfo.h \
"$pkgdir"/usr/include/execinfo.h
install -D -m755 "$builddir"/stacktraverse.h \
"$pkgdir"/usr/include/stacktraverse.h
install -D -m755 "$builddir"/libexecinfo.a \
"$pkgdir"/usr/lib/libexecinfo.a
install -D -m755 "$builddir"/libexecinfo.so.1 \
"$pkgdir"/usr/lib/libexecinfo.so.1
ln -s /usr/lib/libexecinfo.so.1 \
"$pkgdir"/usr/lib/libexecinfo.so
}
static() {
depends=""
pkgdesc="$pkgdesc (static library)"
mkdir -p "$subpkgdir"/usr/lib
mv "$pkgdir"/usr/lib/*.a "$subpkgdir"/usr/lib
}
sha512sums="51fea7910ef6873061a25c22434ce4da724e9d8e37616a069ad0a58c0463755be4c6c7da88cd747484c2f3373909d7be4678b32a4bd91b6d9e0f74526094e92c libexecinfo-1.1.tar.bz2
cd35c9046d88b39b05bc36faffb1e71ae3b2140632da7da37f374fff671d4ad812eebd0581011ff9e3b25d3cb4bc962cf35957074f713817b3b617511425af1a 10-execinfo.patch
c961b2f86cba291e8c69a507e3880354ad7369fd04c8948d54c4db0578fe30cca8f4250742cb63d1ab6e5875988f04c4729256197030369404f0e925f299a66c 20-define-gnu-source.patch
13d3df88a6dabd78ee2cf50092511f5a10f0e5ff3d81dbacb182fcf85ceb0c13a5f0252397b4eb0ac57f8d8bd3fc3af6c05865d6398cbc1517f347210c5750da 30-linux-makefile.patch"

28
kubezero/linux-lts/0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch Normal file
View File

@ -0,0 +1,28 @@
From b4d7a16d2b76e09ec88ff53a86f6e263c329e160 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 28 Nov 2023 14:35:54 +0100
Subject: [PATCH 1/5] powerpc/boot/wrapper: Add "-z notext" flag for ppc64le
This is a follow up to commit 4c078c86b4a4 (powerpc/boot/wrapper: Add
"-z notext" flag to disable diagnostic)
Ref: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14560
---
arch/powerpc/boot/wrapper | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index 352d7de24018..ceaef956f821 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -268,6 +268,7 @@ pseries)
if [ "$format" != "elf32ppc" ]; then
link_address=
pie=-pie
+ notext='-z notext'
fi
make_space=n
;;
--
2.43.0

30
kubezero/linux-lts/0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch Normal file
View File

@ -0,0 +1,30 @@
From b7a5aef6b0d761be21e8df6cd11a963f762768ea Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 13 Dec 2022 16:45:51 +0100
Subject: [PATCH 2/5] x86: Compress vmlinux with zstd -19 instead of -22
This gives slightly bigger kernel but it avoids run out of memory on 32
bit kernels with the error:
zstd kernel compression error 11
https://forums.gentoo.org/viewtopic-p-8641020.html#8641020
---
arch/x86/boot/compressed/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 71fc531b95b4..260d38e772b0 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -147,7 +147,7 @@ $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
$(call if_changed,lz4_with_size)
$(obj)/vmlinux.bin.zst: $(vmlinux.bin.all-y) FORCE
- $(call if_changed,zstd22_with_size)
+ $(call if_changed,zstd_with_size)
suffix-$(CONFIG_KERNEL_GZIP) := gz
suffix-$(CONFIG_KERNEL_BZIP2) := bz2
--
2.43.0

36
kubezero/linux-lts/0003-kexec-add-kexec_load_disabled-boot-option.patch Normal file
View File

@ -0,0 +1,36 @@
From cf29b5a58ef88adf96317c3c933a16f9c865e09a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 14 Jul 2022 13:23:51 +0200
Subject: [PATCH 3/5] kexec: add kexec_load_disabled boot option
Make kexec_load disabled by default and add a boot option to enable it:
kexec_load_disabled=0
---
kernel/kexec_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 9dc728982d79..7650ffe5631e 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -942,7 +942,16 @@ static struct kexec_load_limit load_limit_panic = {
struct kimage *kexec_image;
struct kimage *kexec_crash_image;
-static int kexec_load_disabled;
+static int kexec_load_disabled = 1;
+
+static int __init kexec_load_disabled_setup(char *str)
+{
+ unsigned long disabled;
+ if (!kstrtoul(str, 0, &disabled))
+ kexec_load_disabled = disabled ? 1 : 0;
+ return 1;
+}
+__setup("kexec_load_disabled=", kexec_load_disabled_setup);
#ifdef CONFIG_SYSCTL
static int kexec_limit_handler(struct ctl_table *table, int write,
--
2.43.0

26
kubezero/linux-lts/0004-objtool-respect-AWK-setting.patch Normal file
View File

@ -0,0 +1,26 @@
From dc34b09b20b7aa88ca55742a113d223f33c09c32 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 28 Nov 2023 14:22:46 +0100
Subject: [PATCH 4/5] objtool: respect AWK setting
AWK= is not passed on as an makefile argument so we need pass it as an env.
---
tools/objtool/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index 83b100c1e7f6..6ccddfa6de4f 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -42,7 +42,7 @@ OBJTOOL_CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
# Always want host compilation.
HOST_OVERRIDES := CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)"
-AWK = awk
+AWK ?= awk
MKDIR = mkdir
ifeq ($(V),1)
--
2.43.0

35
kubezero/linux-lts/0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch Normal file
View File

@ -0,0 +1,35 @@
From 0306d648bbd12489c9ffbe8f5bd9cc82fa5eadd8 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@dereferenced.org>
Date: Tue, 18 Feb 2020 21:10:22 +0000
Subject: [PATCH 5/5] powerpc: config: defang gcc check for stack-protector
support
When we rebase kernel configs in Alpine, it is common to do so from
an environment where CARCH does not match CHOST.
Accordingly, we assume that the gcc check will always pass, and
simply remove it in preference for always enabling the
HAVE_STACKPROTECTOR config option.
Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
---
arch/powerpc/Kconfig | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index d5d5388973ac..0ba9d88de22f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -271,8 +271,7 @@ config PPC
select HAVE_RSEQ
select HAVE_SETUP_PER_CPU_AREA if PPC64
select HAVE_SOFTIRQ_ON_OWN_STACK
- select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2)
- select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13)
+ select HAVE_STACKPROTECTOR
select HAVE_STATIC_CALL if PPC32
select HAVE_SYSCALL_TRACEPOINTS
select HAVE_VIRT_CPU_ACCOUNTING
--
2.43.0

38
kubezero/linux-lts/1337-nftables-ipv6.patch Normal file
View File

@ -0,0 +1,38 @@
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index d80abd6ccaf8f71fa70605fef7edada827a19ceb..6dcf4bc7e30b2ae364a1cd9ac8df954a90905c52 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = {
{
.name = "NFLOG",
.revision = 0,
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_IPV6,
.checkentry = nflog_tg_check,
.destroy = nflog_tg_destroy,
.target = nflog_tg,
diff --git a/net/netfilter/xt_TRACE.c b/net/netfilter/xt_TRACE.c
index f3fa4f11348cd8ad796ce94f012cd48aa7a9020f..2a029b4adbcadf95e493b153f613a210624a9101 100644
--- a/net/netfilter/xt_TRACE.c
+++ b/net/netfilter/xt_TRACE.c
@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = {
.target = trace_tg,
.checkentry = trace_tg_check,
.destroy = trace_tg_destroy,
+ .me = THIS_MODULE,
},
#endif
};
diff --git a/net/netfilter/xt_mark.c b/net/netfilter/xt_mark.c
index f76fe04fc9a4e19f18ac323349ba6f22a00eafd7..65b965ca40ea7ea5d9feff381b433bf267a424c4 100644
--- a/net/netfilter/xt_mark.c
+++ b/net/netfilter/xt_mark.c
@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
{
.name = "MARK",
.revision = 2,
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_IPV6,
.target = mark_tg,
.targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE,

378
kubezero/linux-lts/APKBUILD Normal file
View File

@ -0,0 +1,378 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
_flavor=lts
pkgname=linux-$_flavor
pkgver=6.6.58
_kernver=${pkgver%.*}
pkgrel=0
pkgdesc="Linux lts kernel"
url="https://www.kernel.org"
depends="initramfs-generator"
_depends_dev="perl gmp-dev mpc1-dev mpfr-dev elfutils-dev bash flex bison zstd"
makedepends="$_depends_dev sed installkernel bc linux-headers linux-firmware-any openssl-dev>3 mawk
diffutils findutils zstd pahole python3 gcc>=13.1.1_git20230624"
options="!strip !check"
_config=${config:-config-lts.${CARCH}}
source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz
0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
0003-kexec-add-kexec_load_disabled-boot-option.patch
0004-objtool-respect-AWK-setting.patch
0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
1337-nftables-ipv6.patch
lts.aarch64.config
lts.armv7.config
lts.x86.config
lts.x86_64.config
lts.ppc64le.config
lts.s390x.config
lts.loongarch64.config
virt.aarch64.config
virt.armv7.config
virt.ppc64le.config
virt.x86.config
virt.x86_64.config
"
subpackages="$pkgname-dev:_dev:$CBUILD_ARCH $pkgname-doc"
for _i in $source; do
case $_i in
*.$CARCH.config)
_f=${_i%."$CARCH".config}
_flavors="$_flavors $_f"
if [ "linux-$_f" != "$pkgname" ]; then
subpackages="$subpackages linux-$_f::$CBUILD_ARCH linux-$_f-dev:_dev:$CBUILD_ARCH"
fi
;;
esac
done
builddir="$srcdir"/linux-$_kernver
if [ "${pkgver%.0}" = "$pkgver" ]; then
source="$source
https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/patch-$pkgver.xz"
fi
arch="all !armhf !riscv64"
license="GPL-2.0-only"
# secfixes:
# 5.10.4-r0:
# - CVE-2020-29568
# - CVE-2020-29569
# 5.15.74-r0:
# - CVE-2022-41674
# - CVE-2022-42719
# - CVE-2022-42720
# - CVE-2022-42721
# - CVE-2022-42722
# 6.1.27-r3:
# - CVE-2023-32233
# 6.6.13-r1:
# - CVE-46838
prepare() {
if [ "$_kernver" != "$pkgver" ]; then
msg "Applying patch-$pkgver.xz"
unxz -c < "$srcdir"/patch-$pkgver.xz | patch -p1 -N
fi
default_prepare
# remove localversion from patch if any
rm -f localversion*
}
_kernelarch() {
local arch="$1"
case "$arch" in
aarch64*) arch="arm64" ;;
arm*) arch="arm" ;;
ppc*) arch="powerpc" ;;
s390*) arch="s390" ;;
riscv*) arch="riscv" ;;
loongarch64) arch="loongarch" ;;
esac
echo "$arch"
}
_prepareconfig() {
local _flavor="$1"
local _arch="$2"
local _config=$_flavor.$_arch.config
local _builddir="$srcdir"/build-$_flavor.$_arch
mkdir -p "$_builddir"
echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
cp "$srcdir"/$_config "$_builddir"/.config
msg "Configuring $_flavor kernel ($_arch)"
make -C "$builddir" \
O="$_builddir" \
ARCH="$(_kernelarch $_arch)" \
olddefconfig
if grep "CONFIG_MODULE_SIG=y" "$_builddir"/.config >/dev/null; then
if [ -f "$KERNEL_SIGNING_KEY" ]; then
sed -i -e "s:^CONFIG_MODULE_SIG_KEY=.*:CONFIG_MODULE_SIG_KEY=\"$KERNEL_SIGNING_KEY\":" \
"$_builddir"/.config
msg "Using $KERNEL_SIGNING_KEY to sign $_flavor kernel ($_arch) modules"
else
warning "KERNEL_SIGNING_KEY was not set. A signing key will be generated, but 3rd"
warning "party modules can not be signed"
fi
fi
}
listconfigs() {
for i in $source; do
case "$i" in
*.config) echo $i;;
esac
done
}
prepareconfigs() {
for _config in $(listconfigs); do
local _flavor=${_config%%.*}
local _arch=${_config%.config}
_arch=${_arch#*.}
local _builddir="$srcdir"/build-$_flavor.$_arch
_prepareconfig "$_flavor" "$_arch"
done
}
# this is supposed to be run before version is bumped so we can compare
# what new kernel config knobs are introduced
prepareupdate() {
clean && fetch && unpack && prepare && deps
prepareconfigs
rm -r "$builddir"
}
updateconfigs() {
if ! [ -d "$builddir" ]; then
deps && fetch && unpack && prepare
fi
for _config in ${CONFIGS:-$(listconfigs)}; do
msg "updating $_config"
local _flavor=${_config%%.*}
local _arch=${_config%.config}
_arch=${_arch#*.}
local _builddir="$srcdir"/build-$_flavor.$_arch
mkdir -p "$_builddir"
echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
local actions="listnewconfig oldconfig"
if ! [ -f "$_builddir"/.config ]; then
cp "$srcdir"/$_config "$_builddir"/.config
actions="olddefconfig"
fi
env | grep ^CONFIG_ >> "$_builddir"/.config || true
make -j1 -C "$builddir" \
O="$_builddir" \
ARCH="$(_kernelarch $_arch)" \
$actions savedefconfig
cp "$_builddir"/defconfig "$startdir"/$_config
done
}
set_kbuild_timestamp() {
# KBUILD_BUILD_TIMESTAMP needs to be parsable by busybox date
export KBUILD_BUILD_TIMESTAMP="$(date '+%Y-%m-%d %H:%M:%S' -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
}
build() {
unset LDFLAGS
# for some reason these sometimes leak into the kernel build,
# -Werror=format-security breaks some stuff
unset CFLAGS CPPFLAGS CXXFLAGS
set_kbuild_timestamp
for i in $_flavors; do
_prepareconfig "$i" "$CARCH"
done
for i in $_flavors; do
msg "Building $i kernel"
cd "$srcdir"/build-$i.$CARCH
# set org in cert for modules signing
# https://www.kernel.org/doc/html/v6.1/admin-guide/module-signing.html#generating-signing-keys
mkdir -p certs
sed -e 's/#O = Unspecified company/O = alpinelinux.org/' \
"$builddir"/certs/default_x509.genkey \
> certs/x509.genkey
make ARCH="$(_kernelarch $CARCH)" \
CC="${CC:-gcc}" \
AWK="${AWK:-mawk}" \
KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine"
done
}
_package() {
local _buildflavor="$1" _outdir="$2"
set_kbuild_timestamp
cd "$srcdir"/build-$_buildflavor.$CARCH
local _abi_release="$(make -s kernelrelease)"
# modules_install seems to regenerate a defect Modules.symvers on s390x. Work
# around it by backing it up and restore it after modules_install
cp Module.symvers Module.symvers.backup
mkdir -p "$_outdir"/boot "$_outdir"/lib/modules
local _install
case "$CARCH" in
arm*|aarch64|riscv*) _install="zinstall dtbs_install";;
*) _install=install;;
esac
make modules_install $_install \
ARCH="$(_kernelarch $CARCH)" \
INSTALL_MOD_PATH="$_outdir" \
INSTALL_MOD_STRIP=1 \
INSTALL_PATH="$_outdir"/boot \
INSTALL_DTBS_PATH="$_outdir/boot/dtbs-$_buildflavor"
cp Module.symvers.backup Module.symvers
rm -f "$_outdir"/lib/modules/"$_abi_release"/build \
"$_outdir"/lib/modules/"$_abi_release"/source
rm -rf "$_outdir"/lib/firmware
install -D -m644 include/config/kernel.release \
"$_outdir"/usr/share/kernel/$_buildflavor/kernel.release
case "$CARCH" in
loongarch64)
mv "$_outdir"/boot/vmlinuz-$_abi_release \
"$_outdir"/boot/vmlinuz-$_buildflavor
mv "$_outdir"/boot/config-$_abi_release \
"$_outdir"/boot/config-$_buildflavor
mv "$_outdir"/boot/System.map-$_abi_release \
"$_outdir"/boot/System.map-$_buildflavor
;;
esac
}
# main flavor installs in $pkgdir
package() {
depends="$depends linux-firmware-any"
_package "$_flavor" "$pkgdir"
# copy files for linux-lts-doc sub package
mkdir -p "$pkgdir"/usr/share/doc
cp -r "$builddir"/Documentation \
"$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/
# remove files that aren't part of the documentation itself
for nondoc in \
.gitignore conf.py docutils.conf \
dontdiff Kconfig Makefile
do
rm "$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/"$nondoc"
done
# create /usr/share/doc/linux-doc symlink
cd "$pkgdir"/usr/share/doc; ln -s linux-doc-"$pkgver" linux-doc
}
# subflavors install in $subpkgdir
virt() {
_package virt "$subpkgdir"
}
_dev() {
local _flavor=$(echo $subpkgname | sed -E 's/(^linux-|-dev$)//g')
local _builddir="$srcdir"/build-$_flavor.$CARCH
local _abi_release="$(make -C "$_builddir" -s kernelrelease)"
# copy the only the parts that we really need for build 3rd party
# kernel modules and install those as /usr/src/linux-headers,
# simlar to what ubuntu does
#
# this way you dont need to install the 300-400 kernel sources to
# build a tiny kernel module
#
pkgdesc="Headers and script for third party modules for $_flavor kernel"
depends="$_depends_dev"
local dir="$subpkgdir"/usr/src/linux-headers-"$_abi_release"
set_kbuild_timestamp
# first we import config, run prepare to set up for building
# external modules, and create the scripts
mkdir -p "$dir"
cp -a "$_builddir"/.config "$_builddir"/localversion-alpine \
"$dir"/
install -D -t "$dir"/certs "$_builddir"/certs/signing_key.x509 || :
make -C "$builddir" \
O="$dir" \
ARCH="$(_kernelarch $CARCH)" \
AWK="${AWK:-mawk}" \
prepare modules_prepare scripts
# remove the stuff that points to real sources. we want 3rd party
# modules to believe this is the sources
rm "$dir"/Makefile "$dir"/source
# copy the needed stuff from real sources
#
# this is taken from ubuntu kernel build script
# http://kernel.ubuntu.com/git/ubuntu/ubuntu-zesty.git/tree/debian/rules.d/3-binary-indep.mk
cd "$builddir"
find . -path './include/*' -prune \
-o -path './scripts/*' -prune -o -type f \
\( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
-name '*.sh' -o -name '*.pl' -o -name '*.lds' -o -name 'Platform' \) \
-print | cpio -pdm "$dir"
cp -a scripts include "$dir"
find "arch/$_karch" -name include -type d -print | while IFS='' read -r folder; do
find "$folder" -type f
done | sort -u | cpio -pdm "$dir"
install -Dm644 "$srcdir"/build-$_flavor.$CARCH/Module.symvers \
"$dir"/Module.symvers
# remove unneeded things
msg "Removing documentation..."
rm -r "$dir"/Documentation
find "$dir" -type f -name '*.o' -printf 'Removing %P\n' -delete
local _karch="$(_kernelarch $CARCH | sed 's/x86_64/x86/')"
msg "Removing unneeded arch headers..."
for i in "$dir"/arch/*; do
if [ "${i##*/}" != "$_karch" ]; then
echo " ${i##*/}"
rm -r "$i"
fi
done
mkdir -p "$subpkgdir"/lib/modules/"$_abi_release"
ln -sf /usr/src/linux-headers-"$_abi_release" \
"$subpkgdir"/lib/modules/"$_abi_release"/build
}
sha512sums="
458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 linux-6.6.tar.xz
58bf9e84fb01f811f0cada7f7953d111908f0b0650648d6a3522061fe08c9fe284c9315515ae386189253e37d0c92419f78048d6568e2e426654b1e61010685f 0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
763dcb40f698d43b0bb856f44493973e840b66efe62a8fd41a08b6e3fa38cf903e059d107be3735ab2f38a0f27bdb0262798e5e530a1905f96195cd8bcf62fdf 0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
75f232b6becee7d36d360ffaf2aaa837d13518f9ec620ca159bcb2a0e98eb18a77631406a9b44244ea0164a7ed59fad583823909681e9b894a012f9d13365b69 0003-kexec-add-kexec_load_disabled-boot-option.patch
2956050bb332411d00a285e9656618f2e34b631492bbc19bef54d83a6e91b8531f4e18830b9313cfe52fbf8a8ca6fb76cf55b3ddd146ca3b977046cf2fd10cad 0004-objtool-respect-AWK-setting.patch
4b16f15b47b5e5835b926126e39723f519290469517875cfb2d2b857a93ad1344f0d1ba4b255289e20f4da9c867647526b344f752981cee0a48c51577badac3f 0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
a7085f581773cd492d8ed76638abe0d81924107778c3eb87ea495fba9aff69b2f28cb01d0ca6101bd849641ccc8294c238486043f492dc44ee26d7111a6b76cc 1337-nftables-ipv6.patch
a8286ac0cbff0736ab7d5503a19034b11d69d1faa84316bef69087102a009c27b9f54daf9d55d55112e8eef4f239d1dd3a34fe1b55c1aa078ca638a85e0ded1b lts.aarch64.config
2fd7ce3f044f72718b51c7db81bb0f720630a8a4164b97036bfe1a0816efc6903ca83f580543ea4bdca6031d912af9138c44f90722ceff8d5e928412ad23a609 lts.armv7.config
b2534172f8eeb14edb5855c59e806ce07fdfbc1a5a4fe206dd037f17aa21b894d927c1cdcf7c87bb364efd491bb226e3ee21e7f46d26a1afc05f9385260985eb lts.x86.config
eff52f6533953312290456124f11e3532dbcbc389a46556c638c7a2d77a0ced2d6316e159c2f0d9bc026fd1a06520f70dd9b1c748fd618e825f4da2cfdf42cad lts.x86_64.config
243eb831ef4cf7ae8c18e80433447ddfc437b3eda51c8a584e1d0006b214aac77b1801e66860e6cdcbba04b7c9a15c66cd602811cdf30cb7edf0f43778fb1922 lts.ppc64le.config
60327486c2668ee24041f86a22d3856dcac3c9e358f4e16a16f6d302d79095ca5a08c4011141050eafe06ba2d1c3eccd142b79ffa469338e213ae2156e29aa44 lts.s390x.config
4697069b98b81243a18d97ed668a00c08504b55255e4d4392a0f1e63403b6d72036d440b4e54c63c8932ca243164729486e1cea229bd8baf5201fb969f838450 lts.loongarch64.config
b79a6cf6578c49b582931e0f38564e69714bfa2b03c7615301e4cdf0ba9617bf42e01952f4a8a99d82c68733c0aed8b45b4e72ba0a175ce75dc8a14f12fe0f83 virt.aarch64.config
fdd8ff5bac36fc6421c3e71af89346c9a84fedfebc49e61353185561c9737bd59f9692fb09af553eaee5dd104e6f170e9cb460c0a54ee429cffe9a7b150b0379 virt.armv7.config
4dab1bb85d5eaf95ee85beae150c888140583feb1f5bbaec1cf17e2ff73d604590b5aee4edb51caec2ae28adbcf451e88cf3d39bff01887e28ae05c2e104535e virt.ppc64le.config
2110f9a8b62af734f67e1024b598645433786bceec2517ca529bd705ebabb3265395ea1e4416260b69778f4c8a5e90db10877d7136841a06c41ffff3279cfb8f virt.x86.config
c9f51f49e82f14f1ce5420c9c7deca77b2b54b3c2ff1d2ad377b57a028689c614c573f7d413c960c62a6d0c0463fbd17c1ae8d25c7c70c09217946f2c7c4ef11 virt.x86_64.config
9feecb9b368461c27c93cdc852d30caaa53fedb6f7c8cf066feb5ec35a87b016250b7573d17b1cdb992df80a840b5bc80d4aa84a00b631ac4bfaa8b64bc23cda patch-6.6.58.xz
"

2965
kubezero/linux-lts/lts.aarch64.config Normal file
View File

File diff suppressed because it is too large Load Diff

2241
kubezero/linux-lts/lts.armv7.config Normal file
View File

File diff suppressed because it is too large Load Diff

888
kubezero/linux-lts/lts.loongarch64.config Normal file
View File

@ -0,0 +1,888 @@
# CONFIG_LOCALVERSION_AUTO is not set
CONFIG_SYSVIPC=y
CONFIG_POSIX_MQUEUE=y
CONFIG_NO_HZ=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_PREEMPT=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_LOG_BUF_SHIFT=18
CONFIG_NUMA_BALANCING=y
CONFIG_MEMCG=y
CONFIG_BLK_CGROUP=y
CONFIG_CFS_BANDWIDTH=y
CONFIG_RT_GROUP_SCHED=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
CONFIG_NAMESPACES=y
CONFIG_USER_NS=y
CONFIG_CHECKPOINT_RESTORE=y
CONFIG_SCHED_AUTOGROUP=y
CONFIG_RELAY=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_EXPERT=y
CONFIG_KALLSYMS_ALL=y
CONFIG_PERF_EVENTS=y
CONFIG_KEXEC=y
CONFIG_CRASH_DUMP=y
CONFIG_NUMA=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_HIBERNATION=y
CONFIG_ACPI_SPCR_TABLE=y
CONFIG_ACPI_TAD=y
CONFIG_ACPI_DOCK=y
CONFIG_ACPI_IPMI=m
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_HOTPLUG_MEMORY=y
CONFIG_JUMP_LABEL=y
CONFIG_MODULES=y
CONFIG_MODULE_FORCE_LOAD=y
CONFIG_MODULE_UNLOAD=y
CONFIG_MODULE_FORCE_UNLOAD=y
CONFIG_MODVERSIONS=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_BSD_DISKLABEL=y
CONFIG_UNIXWARE_DISKLABEL=y
CONFIG_IOSCHED_BFQ=y
CONFIG_BINFMT_MISC=m
CONFIG_ZSWAP=y
CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
CONFIG_Z3FOLD=y
# CONFIG_COMPAT_BRK is not set
CONFIG_MEMORY_HOTPLUG=y
CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
CONFIG_MEMORY_HOTREMOVE=y
CONFIG_KSM=y
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_USERFAULTFD=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_TLS=m
CONFIG_TLS_DEVICE=y
CONFIG_XFRM_USER=y
CONFIG_NET_KEY=y
CONFIG_XDP_SOCKETS=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_PNP=y
CONFIG_IP_PNP_DHCP=y
CONFIG_IP_PNP_BOOTP=y
CONFIG_IP_PNP_RARP=y
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE_DEMUX=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE=y
CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_INET_ESP=m
CONFIG_INET_UDP_DIAG=y
CONFIG_TCP_CONG_ADVANCED=y
CONFIG_TCP_CONG_BBR=m
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_ROUTE_INFO=y
CONFIG_INET6_ESP=m
CONFIG_IPV6_MROUTE=y
CONFIG_NETWORK_PHY_TIMESTAMPING=y
CONFIG_NETFILTER=y
CONFIG_BRIDGE_NETFILTER=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
CONFIG_NF_CONNTRACK_PPTP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_TABLES=m
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
CONFIG_NFT_OSF=m
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NETFILTER_XT_SET=m
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HMARK=m
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
CONFIG_NETFILTER_XT_TARGET_LED=m
CONFIG_NETFILTER_XT_TARGET_LOG=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
CONFIG_NETFILTER_XT_TARGET_TRACE=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NETFILTER_XT_MATCH_CGROUP=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m