Add support for 6.18.* kernels (for Debian 13 VMs in SecureDrop Workstation)

.github/workflows/ci.yml

@@ -35,6 +35,7 @@ jobs:
       matrix:
         target:
           - tiny-6.6
+          - tiny-6.18
         # Build twice for comparison
         build:
           - one
@@ -70,6 +71,7 @@ jobs:
       matrix:
         target:
           - tiny-6.6
+          - tiny-6.18
     steps:
       - name: Install dependencies
         run: |

Dockerfile

@@ -1,4 +1,4 @@
-ARG BUILD_DISTRO=bookworm
+ARG BUILD_DISTRO=trixie
 FROM debian:$BUILD_DISTRO
 
 ARG UID=1000
@@ -18,9 +18,10 @@ RUN apt-get update && \
     fakeroot \
     flex \
     git \
+    gpgv \
     kmod \
     libelf-dev \
-    liblz4-tool \
+    lz4 \
     libssl-dev \
     ncurses-dev \
     python3 \

Makefile

@@ -24,6 +24,17 @@ tiny-6.6: ## Builds latest 6.6 kernel, unpatched
 		--return \
 		$(OUT)
 
+.PHONY: tiny-6.18
+tiny-6.18: OUT:=$(SCRIPT_OUTPUT_PREFIX)-tiny-6.18.$(SCRIPT_OUTPUT_EXT)
+tiny-6.18: ## Builds latest 6.18 kernel, unpatched
+	LINUX_MAJOR_VERSION="6.18" LOCALVERSION="tiny" \
+		BUILD_DISTRO="trixie" \
+		LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/tinyconfig-6.18" \
+		script \
+		--command ./scripts/build-kernel-wrapper \
+		--return \
+		$(OUT)
+
 .PHONY: grsec
 grsec: OUT:=$(SCRIPT_OUTPUT_PREFIX)-grsec.$(SCRIPT_OUTPUT_EXT)
 grsec: ## Builds grsecurity-patched kernel (requires credentials)
@@ -46,7 +57,8 @@ reprotest-sd: ## DEBUG Builds SD kernel config without grsec in CI
 
 securedrop-core-6.6: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-core-6.6.$(SCRIPT_OUTPUT_EXT)
 securedrop-core-6.6: ## Builds kernels for SecureDrop servers, 6.6.x
-	GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="securedrop" \
+	LINUX_MAJOR_VERSION=6.6 \
+	  GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="securedrop" \
 		LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-securedrop-6.6" \
 		script \
 		--command ./scripts/build-kernel-wrapper \
@@ -55,13 +67,25 @@ securedrop-core-6.6: ## Builds kernels for SecureDrop servers, 6.6.x
 
 securedrop-workstation-6.6: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-workstation-6.6.$(SCRIPT_OUTPUT_EXT)
 securedrop-workstation-6.6: ## Builds kernels for SecureDrop Workstation, 6.6.x
-	GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="workstation" \
+	LINUX_MAJOR_VERSION=6.6 \
+	  GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="workstation" \
 		LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-workstation-6.6" \
 		script \
 		--command ./scripts/build-kernel-wrapper \
 		--return \
 		$(OUT)
 
+securedrop-workstation-6.18: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-workstation-6.18.$(SCRIPT_OUTPUT_EXT)
+securedrop-workstation-6.18: ## Builds kernels for SecureDrop Workstation, 6.18.x
+	LINUX_MAJOR_VERSION=6.18 \
+    GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable12 LOCALVERSION="workstation" \
+		BUILD_DISTRO="trixie" \
+		LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-workstation-6.18" \
+		script \
+		--command ./scripts/build-kernel-wrapper \
+		--return \
+		$(OUT)
+
 .PHONY: help
 help: ## Prints this message and exits.
 	@printf "Subcommands:\n\n"

build-kernel.py

@@ -131,8 +131,9 @@ def main():  # noqa: PLR0915
 
     os.chdir(f"linux-{linux_version}")
     # Copy debian/
-    print("Setting up our debian/ tree")
+    print(f"Setting up our debian/ tree for Linux {linux_major_version}")
     shutil.copytree("/debian", "debian")
+    shutil.move(f"debian/rules-{linux_major_version}", "debian/rules")
 
     template_variables = {
         "linux_build_version": linux_build_version,