From 520bb8e34f7a0a0695c7839dbd0e0c8273b11257 Mon Sep 17 00:00:00 2001 From: Marly Salazar Date: Thu, 17 Sep 2026 12:15:37 -0700 Subject: [PATCH 1/3] fix(buildenv): ensure uv in buildenv container --- Dockerfile.buildenv | 50 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/Dockerfile.buildenv b/Dockerfile.buildenv index c9bd364e..fa5d78e7 100644 --- a/Dockerfile.buildenv +++ b/Dockerfile.buildenv @@ -55,14 +55,62 @@ RUN case "${TARGETARCH}" in \ done ENV PATH="/usr/lib/sccache:${PATH}" +# The kernel build shells out to the repo's Python helpers from *inside* this +# container - hack/build/common.sh runs `uv run patchlist.py` to pick the patch +# set - so uv has to live in the image. setup-uv in the workflow only installs +# it on the runner, which the container never sees. +ARG UV_VERSION=0.12.15 +ARG UV_SHA256_AMD64=f97935763c04be3e692460a7aaeaaab8fc3b78fcf8b389da820b38ae7423a638 +ARG UV_SHA256_ARM64=0e9a3499b0587d449c9ff684c0160da607826e4af1cee220bc87f378702d3e08 +RUN case "${TARGETARCH}" in \ + amd64) UV_ARCH=x86_64 UV_SHA256="${UV_SHA256_AMD64}" ;; \ + arm64) UV_ARCH=aarch64 UV_SHA256="${UV_SHA256_ARM64}" ;; \ + *) echo "unsupported TARGETARCH ${TARGETARCH}" >&2; exit 1 ;; \ + esac && \ + UV_DIST="uv-${UV_ARCH}-unknown-linux-gnu" && \ + curl -Lf -o /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${UV_DIST}.tar.gz" && \ + echo "${UV_SHA256} /tmp/uv.tar.gz" | sha256sum -c - && \ + tar -xz -C /tmp -f /tmp/uv.tar.gz && \ + install -m 0755 "/tmp/${UV_DIST}/uv" /usr/local/bin/uv && \ + install -m 0755 "/tmp/${UV_DIST}/uvx" /usr/local/bin/uvx && \ + rm -rf /tmp/uv.tar.gz "/tmp/${UV_DIST}" + +# pyproject.toml requires >=3.14 but bookworm ships 3.11, so uv would fetch a +# managed CPython mid-build on every run. Bake it in for the same reason the +# compilers are baked in: the toolchain stays a reviewed input rather than a +# build-day download. Keep in step with .python-version - a skew only costs a +# runtime download, it does not break the build. +ARG UV_PYTHON_VERSION=3.14.7 +ENV UV_PYTHON_INSTALL_DIR=/usr/local/share/uv/python +RUN uv python install "${UV_PYTHON_VERSION}" && \ + chmod -R a+rX /usr/local/share/uv + RUN useradd -ms /bin/sh build +# Warm uv's cache with the project's locked dependencies. The compile container +# runs --rm, so nothing survives between builds: without this, every kernel +# build re-fetches packaging and pyyaml from PyPI just to compute the patch +# list, and a registry hiccup fails the build. The deb-installed python3 this +# replaced had those baked in, so this keeps the patch step hermetic the way it +# used to be. A uv.lock change only costs a fetch, it does not break the build. +# link-mode=copy because the cache lives in the image while .venv is created +# in the bind-mounted build tree; hardlinks across the two fail and uv warns +# on every build otherwise. +ENV UV_CACHE_DIR=/usr/local/share/uv/cache \ + UV_LINK_MODE=copy +COPY pyproject.toml uv.lock .python-version /tmp/warm/ +RUN cd /tmp/warm && uv sync --frozen && \ + rm -rf /tmp/warm && \ + chown -R build:build /usr/local/share/uv/cache + # Self-describing package manifest: lets any two image digests be diffed # without external records (docker run cat /usr/share/buildenv/packages.tsv). # The buildenv-diff workflow uses this to summarize dependabot digest bumps. RUN mkdir -p /usr/share/buildenv && \ { dpkg-query -W -f '${Package}\t${Version}\t${Architecture}\n' | sort; \ - printf 'sccache\t%s\tgithub-release\n' "${SCCACHE_VERSION}"; } \ + printf 'sccache\t%s\tgithub-release\n' "${SCCACHE_VERSION}"; \ + printf 'uv\t%s\tgithub-release\n' "${UV_VERSION}"; \ + printf 'python\t%s\tuv-managed\n' "${UV_PYTHON_VERSION}"; } \ >/usr/share/buildenv/packages.tsv LABEL org.opencontainers.image.source="https://github.com/edera-dev/linux-kernel-oci" From a139693b1bffbf39ad6e456387e35c39b9d27acc Mon Sep 17 00:00:00 2001 From: Marly Salazar Date: Thu, 17 Sep 2026 12:15:59 -0700 Subject: [PATCH 2/3] fix(build): ensure that common conforms to no pipefail --- hack/build/common.sh | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/hack/build/common.sh b/hack/build/common.sh index 0c813975..c5c27a50 100644 --- a/hack/build/common.sh +++ b/hack/build/common.sh @@ -77,7 +77,20 @@ if [ ! -f "${KERNEL_SRC}/Makefile" ]; then rm "${KERNEL_SRC}.txz" fi - uv run "hack/build/patchlist.py" "${KERNEL_VERSION}" "${KERNEL_FLAVOR}" | while read -r PATCH_NAME; do + # Generate the patch list up front rather than piping it straight into the + # loop: in a pipeline the exit status of uv is discarded, so a failing + # patchlist.py would silently look like "no patches to apply". + if ! PATCH_LIST="$(uv run "hack/build/patchlist.py" "${KERNEL_VERSION}" "${KERNEL_FLAVOR}")"; then + echo "ERROR: failed to generate patch list for ${KERNEL_VERSION} (${KERNEL_FLAVOR})." >&2 + exit 1 + fi + + while read -r PATCH_NAME; do + [ -n "${PATCH_NAME}" ] || continue + if [ ! -f "${KERNEL_DIR}/${PATCH_NAME}" ]; then + echo "ERROR: patch file not found: ${KERNEL_DIR}/${PATCH_NAME}" >&2 + exit 1 + fi cd "${KERNEL_SRC}" if [ "${KERNEL_SRC_IS_TAR}" = "1" ]; then patch --verbose -p1 <"${KERNEL_DIR}/${PATCH_NAME}" @@ -85,7 +98,9 @@ if [ ! -f "${KERNEL_SRC}/Makefile" ]; then git --verbose apply "${KERNEL_DIR}/${PATCH_NAME}" fi cd "${KERNEL_DIR}" - done + done < Date: Thu, 17 Sep 2026 12:16:16 -0700 Subject: [PATCH 3/3] fix(ci): bump setup-uv versions --- .github/workflows/lint.yml | 2 +- .github/workflows/matrix.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 069d7626..9aa3d02e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -31,7 +31,7 @@ jobs: curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck" - name: Install the latest version of uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: python-version: "3.14" - name: Show versions diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml index 9639181d..fb1c5e93 100644 --- a/.github/workflows/matrix.yml +++ b/.github/workflows/matrix.yml @@ -28,7 +28,7 @@ jobs: with: egress-policy: audit - name: Install the latest version of uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: python-version: "3.14" - name: Setup Crane @@ -150,7 +150,7 @@ jobs: connection-string-ro: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING_RO }} key-prefix: kernel - name: Install the latest version of uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: python-version: "3.14" - name: generate docker script