%global baseversion 7.2.2_zen1_yny %global pkg_release 1 %global KVER %{baseversion}-%{pkg_release}%{?dist} %global extraver _zen1_yny-%{pkg_release}%{?dist} %{!?make: %define make make} Name: kernel-yny Version: %{baseversion} Release: %{pkg_release}%{?dist} Summary: Custom Linux Kernel with Zen patches and CJK TTY support License: GPL-2.0-only URL: https://www.kernel.org Source0: linux-7.2.2-zen1-yny.tar.xz # Canonical kernel-yny kernel signing private key (Ye Ningyuan # , RSA 4096). Fixed forever: every build signs # the kernel image and all modules with this one key. Its public # certificate is published in the kernel-yny-keys package and enrolled in # the machine's MOK for Secure Boot. Source1: signing_key.pem BuildRequires: bc binutils bison dwarves flex gcc make openssl openssl-devel perl python3 rsync BuildRequires: elfutils-devel elfutils-libelf-devel glibc-static zstd BuildRequires: rpm-build kernel-rpm-macros BuildRequires: sbsigntools Provides: kernel = %{version} Provides: kernel-uname-r = %{KVER} Provides: kernel-%{_target_cpu} = %{version} %description Custom Linux Kernel %{version} with Zen kernel patches and CJK TTY support. %package devel Summary: Development files for the %{name} kernel AutoReqProv: no Provides: kernel-devel = %{version} Provides: kernel-devel-uname-r = %{KVER} Provides: kernel-devel-%{_target_cpu} = %{version} %description devel Kernel headers and development files for building modules against the %{name} kernel. %package headers Summary: Header files for the %{name} kernel Obsoletes: kernel-headers < %{version} Provides: kernel-headers = %{version} %description headers C header files for the %{name} kernel. %prep %setup -q -n linux-7.2.2 # Generate Makefile.rhelver (required by the Fedora redhat patch) cat > Makefile.rhelver <<'RHELEOF' RHEL_MAJOR = 10 RHEL_MINOR = 99 RHEL_RELEASE = 1 RHEL_REBASE_NUM = 1 AUTOMOTIVE_MAJOR = 2 AUTOMOTIVE_MINOR = 99 DERIVATIVE_BUILD = 0 RHELEOF echo "Makefile version: $(head -4 Makefile)" # Install the canonical kernel-yny signing private key (Source1). # Point CONFIG_MODULE_SIG_KEY at a NON-default path: certs/Makefile only # auto-generates the key when CONFIG_MODULE_SIG_KEY=certs/signing_key.pem # (it regenerates whenever x509.genkey is newer OR no saved command record # exists in certs/.signing_key.pem.cmd, silently replacing our key with an # autogenerated one that is not enrolled in MOK -> no boot under Secure # Boot). With the path below that block is skipped entirely, so the build # can only ever sign with THIS key. cp %{SOURCE1} certs/kernel-yny-signing.pem chmod 600 certs/kernel-yny-signing.pem openssl x509 -in certs/kernel-yny-signing.pem -noout -subject \ | grep -q "kernel-yny" || { echo "ERROR: Source1 is not the kernel-yny signing key"; exit 1; } sed -i 's|^CONFIG_MODULE_SIG_KEY=.*|CONFIG_MODULE_SIG_KEY="certs/kernel-yny-signing.pem"|' .config grep -q 'CONFIG_MODULE_SIG_KEY="certs/kernel-yny-signing.pem"' .config \ || { echo "ERROR: failed to set CONFIG_MODULE_SIG_KEY"; exit 1; } %build make -j$(nproc) olddefconfig # olddefconfig must have preserved the non-default signing key path grep -q 'CONFIG_MODULE_SIG_KEY="certs/kernel-yny-signing.pem"' .config \ || { echo "ERROR: MODULE_SIG_KEY changed during olddefconfig"; exit 1; } make -j$(nproc) EXTRAVERSION=%{extraver} LOCALVERSION= # The build must have used OUR key, not a regenerated one openssl x509 -in certs/kernel-yny-signing.pem -noout -subject \ | grep -q "kernel-yny" || { echo "ERROR: signing key was replaced during build"; exit 1; } openssl x509 -in certs/signing_key.x509 -noout -subject \ | grep -q "kernel-yny" || { echo "ERROR: embedded cert is not kernel-yny"; exit 1; } # Sign the kernel image (PE/EFI) with the kernel-yny signing key. # Modules are signed at modules_install time by CONFIG_MODULE_SIG_ALL # using the same key. Public key shipped in kernel-yny-keys. sbsign --key certs/kernel-yny-signing.pem --cert certs/kernel-yny-signing.pem \ --output arch/x86/boot/bzImage.signed arch/x86/boot/bzImage mv arch/x86/boot/bzImage.signed arch/x86/boot/bzImage sbverify --cert certs/kernel-yny-signing.pem arch/x86/boot/bzImage # Fail the build if the image was signed with a regenerated key instead of # the kernel-yny key (whose public cert is enrolled in MOK). sbverify --list arch/x86/boot/bzImage | grep -q "kernel-yny" \ || { echo "ERROR: bzImage not signed with kernel-yny key"; exit 1; } %install mkdir -p %{buildroot}/boot mkdir -p %{buildroot}/lib/modules/%{KVER} mkdir -p %{buildroot}/usr/src/kernels/%{KVER} mkdir -p %{buildroot}/usr/include cp arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{KVER} cp System.map %{buildroot}/boot/System.map-%{KVER} cp .config %{buildroot}/boot/config-%{KVER} make INSTALL_MOD_PATH=%{buildroot} INSTALL_MOD_STRIP=1 KERNELRELEASE=%{KVER} modules_install make INSTALL_HDR_PATH=%{buildroot}/usr KERNELRELEASE=%{KVER} headers_install cp System.map %{buildroot}/lib/modules/%{KVER}/ cp .config %{buildroot}/lib/modules/%{KVER}/config cp arch/x86/boot/bzImage %{buildroot}/lib/modules/%{KVER}/vmlinuz ln -fns /usr/src/kernels/%{KVER} %{buildroot}/lib/modules/%{KVER}/build make srctree=. run-command KBUILD_RUN_COMMAND='${srctree}/scripts/package/install-extmod-build %{buildroot}/usr/src/kernels/%{KVER}' # akmods' brp-kmodsign needs the sign-file host tool in kernel-devel install -m 0755 scripts/sign-file %{buildroot}/usr/src/kernels/%{KVER}/scripts/sign-file %files /boot/vmlinuz-%{KVER} /boot/System.map-%{KVER} /boot/config-%{KVER} /lib/modules/%{KVER} %exclude /lib/modules/%{KVER}/build %files devel /usr/src/kernels/%{KVER} /lib/modules/%{KVER}/build %files headers /usr/include %post if [ -x /usr/bin/kernel-install ]; then /usr/bin/kernel-install add %{KVER} /lib/modules/%{KVER}/vmlinuz fi /usr/sbin/depmod -a %{KVER} %preun if [ -x /usr/bin/kernel-install ]; then /usr/bin/kernel-install remove %{KVER} fi %changelog * Sun Aug 30 2026 kernel-yny-builder - 7.2.2_zen1_yny-1 - Rebase to upstream stable 7.2.2 (from 7.2.0, incl. inet frags GSO security fix) - Replace the Fedora redhat patch with the f45 kernel-7.2.2-300 version (43 files, from dist-git commit 1cc178e9e: platform-keyring module-sign fallback, EFI secure boot fixes, lockdown, crypto/ACPI/IPMI/pci quirks) - Replace the hand-ported Zen sauce with the official zen-kernel v7.2.2-zen1 tag diff (147 files incl. include/ and sched/alt sources; CONFIG_SCHED_ALT left off, EEVDF interactive tuning via CONFIG_ZEN_INTERACTIVE kept) - CJKTTY patches kept at the 7.2 series (cjktty-7.2.patch + 32x32 font data) - Config from Fedora f45 kernel-7.2.2-300 kernel-x86_64-fedora.config + FONT_CJK_16x16/32x32 + binder + MODULE_SIG(+ALL) + ZEN_INTERACTIVE, CONFIG_MODULE_SIG_KEY at the non-default certs/kernel-yny-signing.pem * Sun Aug 23 2026 kernel-yny-builder - 7.2.0_zen1_yny-1 - Rebase to upstream stable 7.2.0 (from 7.1.8) - Merge full Fedora patch-7.2-redhat.patch (76 files, from dist-git kernel-7.2.0-61: platform-keyring module-sign fallback, EFI secure boot fixes, lockdown, crypto/ACPI/IPMI/pci quirks, Makefile.rhelver support) - Zen patches rebased to 7.2 (zen-kernel 7.2 base) - CJKTTY patches rebased to 7.2 (cjktty-7.2.patch + 32x32 font data) - Config from Fedora kernel-7.2.0-61 kernel-x86_64-fedora.config + FONT_CJK_16x16/32x32 + binder + MODULE_SIG(+ALL) * Sun Aug 16 2026 kernel-yny-builder - 7.1.8_zen1_yny-10 - Add patchlevel to uname (KVER = 7.1.8_zen1_yny-.fc44): each build release is now a distinct kernel so package management (kernel, devel, headers, kmod-nvidia) never collides between builds of the same version - Ship the signing private key as explicit Source1 (signing_key.pem) in the SRPM; this one key is used by every build from now on - Point CONFIG_MODULE_SIG_KEY at certs/kernel-yny-signing.pem (non-default path): certs/Makefile only auto-generates the key for the default path certs/signing_key.pem (it did so even when the key was newest, because a missing certs/.signing_key.pem.cmd record triggers if_changed), silently replacing our key with an autogenerated one not enrolled in MOK - Build-time verification: key subject, embedded cert subject and bzImage signature must all be kernel-yny, otherwise the build fails * Sun Aug 16 2026 kernel-yny-builder - 7.1.8_zen1_yny-9 - Attempted fix of the -8 key regeneration by shipping certs/x509.genkey and touching certs/signing_key.pem (insufficient: Kbuild if_changed still regenerates the key when no saved command record exists); superseded by -10 * Sun Aug 16 2026 kernel-yny-builder - 7.1.8_zen1_yny-8 - Merge full Fedora patch-7.1-redhat.patch (74 files: EFI secure boot fixes, ACPI/IPMI/pci quirks, amd isp4 media driver, crypto fixes, lockdown, platform-keyring module-sign fallback, Makefile.rhelver support) * Sun Aug 16 2026 kernel-yny-builder - 7.1.8_zen1_yny-7 - Add Fedora platform-keyring fallback for module signature verification (fedora-modsign-platform-keyring-fallback.patch): MOK keys live in the .platform keyring but upstream mod_verify_sig only checks the secondary keyring, so akmods-signed modules were rejected under Secure Boot * Sun Aug 16 2026 kernel-yny-builder - 7.1.8_zen1_yny-6 - Sign kernel image and modules with dedicated kernel-yny signing key (Ye Ningyuan , key in certs/signing_key.pem); public key published in kernel-yny-keys package * Sat Aug 15 2026 kernel-yny-builder - 7.1.8_zen1_yny-5 - Fix zen patch extraction: include include/ changes (tsk_seruntime in sched.h) that -4 build missed * Sat Aug 15 2026 kernel-yny-builder - 7.1.8_zen1_yny-4 - Rebuild source tree from scratch: pristine 7.1.8 + zen + cjktty patches, full Fedora f44 kernel-7.1.8-200 config (fixes missing tools/bpf in -3) * Sat Aug 15 2026 kernel-yny-builder - 7.1.8_zen1_yny-3 - Rebase config on Fedora f44 kernel-7.1.8-200 kernel-x86_64-fedora.config (fixes missing NVMe/btrfs drivers that caused GRUB boot hang) * Sat Aug 15 2026 kernel-yny-builder - 7.1.8_zen1_yny-2 - Enable CONFIG_MODULE_SIG so kernel-devel ships scripts/sign-file (akmods fix) - Add 32x32 CJK font data (cjktty-add-cjk32x32-font-data.patch) * Sat Aug 15 2026 kernel-yny-builder - 7.1.8_zen1_yny-1 - Update to 7.1.8-zen1 with CJK TTY support * Wed Aug 05 2026 kernel-yny-builder - 7.1.6_zen1_yny-1 - Update to 7.1.6-zen1 with CJK TTY support * Sat Jul 04 2026 Ye Ningyuan - 7.1.2_yny-1 - Initial build with Zen patches and CJK TTY support