feat(build): source kernels from edera-dev/linux branches

[kaniini]

Builds kernels from github.com/edera-dev/linux instead of kernel.org tarballs plus a local patch series.

The Edera stack now lives as commits on edera/6.18-lts and edera/mainline, which makes patches/ redundant — it was a superset-free duplicate of what those branches already carry at 6.18+. Adding or dropping a patch becomes a commit on the kernel tree rather than a change here.

How it works

Matrix generation resolves each branch listed in config.yaml to the commit it points at (git ls-remote --heads), reads the kernel version out of that commit's Makefile, and builds from the commit's source archive. The branches carry no release tags of their own, so the Makefile is the authority; those are also the same fields the kernel itself uses to form KERNELRELEASE, so what we tag an image with is what the kernel inside reports.

Addressing the archive by commit rather than by branch keeps buildkit's ADD cache honest against a moving branch. The archive carries no .git, so setlocalversion contributes nothing and uname -r stays the plain version, exactly as under kernel.org tarballs.

source:
  repo: https://github.com/edera-dev/linux
branches:
- name: 6.18-lts
  ref: edera/6.18-lts
  aliases:
  - latest
- name: mainline
  ref: edera/mainline

Tags

Every build publishes one immutable tag plus moving aliases.

Branch	Commit	Version	Tags
edera/6.18-lts	efb09285bd95	6.18.52	6.18.52-gefb09285bd95, 6.18.52, 6.18, 6.18-lts, latest
edera/mainline	391f6f12ecf5	7.3.0-rc3	7.3.0-rc3-g391f6f12ecf5, 7.3.0-rc3, mainline

A prerelease deliberately does not claim the bare series tag (7.3), which belongs to the eventual 7.3 release.

The -g<commit> tag is also what makes rebuild detection work: a branch that picked up a patch between upstream releases looks new to filter_new_builds even though its version did not change. It names the source tree, not every build input — a configs/** merge republishes the same tag against the same commit, and the kconfig hash in the image metadata is what distinguishes those two builds. Shas are abbreviated to 12 characters, matching what git and scripts/setlocalversion do for a repo this size.

Build specs

Constraints match on branch names rather than version ranges, since the version is a property of the branch, not something this repo picks. Specs collapse to two types, both accepting branch / flavor / arch:

• new (default) — build what the registry does not already have, i.e. every branch that has moved. What the weekly cron runs.
• rebuild — build everything the config selects. A configs/** merge now forces this, since nothing moved on the kernel side and new would find nothing to do.

new
rebuild:branch=mainline
rebuild:branch=6.18-lts;flavor=host,zone

Provenance

Images record KERNEL_SRC_REPO / KERNEL_SRC_REF / KERNEL_SRC_COMMIT in their metadata, and the SBOM describes the source as a CycloneDX commit ancestry instead of a patch list — the honest shape now that there are no out-of-tree diffs to enumerate.

Removed

patches/ (36 files), hack/build/patchlist.py, hack/build/cdn-url.sh, the versions: and patches: config sections, kernel.org release/tag discovery, and the stable / lts / backbuild / only-latest* / manual / override / unsafe-all specs. Version-range constraints (lower / upper / series / current / exact) go with them. The only remaining kernel.org dependency is the linux-firmware snapshot used by zone-amdgpu.

Flavors

• zone-nvidiagpu is pinned to 6.18-lts. The old lower: '6.18' constraint nominally admitted mainline, but mainline never actually entered the matrix, so this preserves real behaviour rather than newly pointing NVIDIA's open modules at 7.3-rc3. One line to open up once a driver series in local_tags compiles against whatever mainline is rebased onto.
• zone-openpax is commented out until the openpax series is restored on the branches. Its kconfig fragments stay in configs/, so re-enabling it is an uncomment.
• The zone-amdgpu MSI-X hack is dropped as obsolete.

Testing

Matrix generation was run end to end against the live repo: 11 builds / 9 merges from rebuild, resolving both branches and producing the tag sets above. Generated docker.sh was checked for the plain, amdgpu-with-firmware and nvidia paths, and merge.sh for the manifest-list assembly. black, shfmt and shellcheck are clean at the versions pinned in lint.yml.

An actual kernel compile has not been run locally — that needs the buildenv container, and CI will cover it.