sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
77 lines
3.9 KiB
Bash
77 lines
3.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Server-only diagnostic build. Uses its own sources/output; never resets LIVE.
|
|
# Usage: bash this-script ROOT <family>
|
|
# family: see 009-fortify-select-family.py GROUPS
|
|
set -euo pipefail
|
|
RUN=${1:?isolated root required}
|
|
FAMILY=${2:?family required}
|
|
case "$FAMILY" in
|
|
full|memory|strings|strings-copy|strings-len|\
|
|
strings-strcpy-strlen|strings-copy-strlen|strings-copy-strnlen|\
|
|
strings-strlen-restcopy|strings-strlen-ncopy|strings-strlen-cat|\
|
|
strings-strlen-strncpy|strings-strlen-strlcpy) ;;
|
|
*) echo "bad family: $FAMILY" >&2; exit 2;;
|
|
esac
|
|
test -d "$RUN/inputs"
|
|
# Subdir name matches family (strings-copy → strings-copy/)
|
|
test ! -e "$RUN/$FAMILY"
|
|
TOP=/srv/rom/src/lineage
|
|
LIVE=$TOP/kernel/google/msm-4.14
|
|
PIN=28f9290ae067d3e7857126eb6312720dbe9c7c80
|
|
CLANG=$TOP/prebuilts/clang/host/linux-x86/clang-r563880c
|
|
BASE=$RUN/$FAMILY
|
|
SRC=$BASE/src
|
|
OUT=$BASE/out
|
|
mkdir -p "$SRC" "$OUT"
|
|
git -C "$LIVE" archive "$PIN" | tar -x -C "$SRC"
|
|
python3 "$RUN/inputs/apply_fortify_clang.py" "$SRC"
|
|
patch -p1 --batch -d "$SRC" < "$RUN/inputs/0001-driver-bounds-rtac-fils.patch"
|
|
python3 "$RUN/inputs/009-fortify-select-family.py" "$SRC" "$FAMILY"
|
|
cp "$RUN/inputs/failed-full.config" "$OUT/.config"
|
|
cp "$OUT/.config" "$BASE/input.config"
|
|
export PATH="$TOP/prebuilts/tools-lineage/linux-x86/bin:$TOP/prebuilts/build-tools/linux-x86/bin:$CLANG/bin:$TOP/out/host/linux-x86/bin:/usr/bin:/bin"
|
|
export HIP_PATH=none
|
|
export PERL5LIB="$TOP/prebuilts/tools-lineage/common/perl-base"
|
|
export BISON_PKGDATADIR="$TOP/prebuilts/build-tools/common/bison"
|
|
export KBUILD_BUILD_USER=nobody KBUILD_BUILD_HOST=android-build
|
|
# An archived patched tree needs the same release suffix as installed modules.
|
|
export LOCALVERSION=-g28f9290ae067-dirty
|
|
MAKE=("$TOP/prebuilts/build-tools/linux-x86/bin/make" -j8
|
|
"HOSTCFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -I$TOP/prebuilts/kernel-build-tools/linux-x86/include"
|
|
"HOSTLDFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -Wl,-rpath,$TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -L $TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -fuse-ld=lld --rtlib=compiler-rt"
|
|
LLVM=1 LLVM_IAS=1 "LZ4=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/lz4"
|
|
"LEX=$TOP/prebuilts/build-tools/linux-x86/bin/flex"
|
|
"YACC=$TOP/prebuilts/build-tools/linux-x86/bin/bison"
|
|
"M4=$TOP/prebuilts/build-tools/linux-x86/bin/m4"
|
|
"PAHOLE=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/pahole"
|
|
"LIBCLANG_PATH=$CLANG/lib" "DTC_EXT=$TOP/out/host/linux-x86/bin/dtc"
|
|
-C "$SRC" "O=$OUT" ARCH=arm64 CC=clang LD=ld.lld)
|
|
"${MAKE[@]}" olddefconfig
|
|
diff -u "$BASE/input.config" "$OUT/.config" > "$BASE/config.diff" || {
|
|
cat "$BASE/config.diff"
|
|
echo 'STOP: unexpected configuration drift' >&2
|
|
exit 3
|
|
}
|
|
"$CLANG/bin/clang" --version > "$BASE/toolchain.txt"
|
|
printf '%s\n' "$PIN" > "$BASE/source-commit.txt"
|
|
printf '%q ' "${MAKE[@]}" > "$BASE/make-command.txt"
|
|
"${MAKE[@]}" Image.lz4 modules
|
|
cp "$OUT/.config" "$BASE/final.config"
|
|
test "$(cat "$OUT/include/config/kernel.release")" = '4.14.357-openela-g28f9290ae067-dirty'
|
|
if "$CLANG/bin/llvm-nm" "$OUT/vmlinux" | grep -Eq ' [Tt] __((read_overflow[23]?)|(write_overflow))$'; then
|
|
echo 'STOP: forbidden overflow stubs' >&2
|
|
exit 4
|
|
fi
|
|
mkdir "$BASE/pack"
|
|
cd "$BASE/pack"
|
|
MB=$(find /srv/rom/prebuilts/magisk -type f -name magiskboot -print -quit)
|
|
test -n "$MB"
|
|
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
|
|
"$MB" unpack "$GOOD" > "$BASE/good-header.txt" 2>&1
|
|
sha256sum ramdisk.cpio > "$BASE/ramdisk.sha256"
|
|
cp "$OUT/arch/arm64/boot/Image" kernel
|
|
"$MB" repack "$GOOD" "$BASE/boot-make.img"
|
|
sha256sum "$BASE/boot-make.img" "$OUT/arch/arm64/boot/Image" "$OUT/vmlinux" > "$BASE/SHA256SUMS"
|
|
printf 'DIAGNOSTIC ONLY: %s family; not full FORTIFY. Requires local unpack/header/kernel verification before LAB use.\n' "$FAMILY" > "$BASE/README.txt"
|
|
echo "BUILD COMPLETE: $BASE/boot-make.img"
|