warehack.ing/cuckoo-escapement
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity

Kernel release 6.18.38-rt-cuckoo+: reproducible build, guarded installer

Browse source 
Rebuilt with KBUILD_BUILD_USER/HOST/TIMESTAMP pinned. Without them the kernel
bakes the builder's user@hostname and wall-clock build time into /proc/version,
which publishes operator identity in a public artifact and makes the build
unreproducible. Pinned, anyone can rebuild and diff the bytes — the only trust
story available for an unsigned community kernel.

The installer refuses to run on anything but a Pi 4, refuses a mismatched
image/modules pair (vermagic failure means no /dev/pps0 on a kernel that
otherwise boots fine — silent and miserable to debug), verifies SHA256SUMS,
never touches kernel8.img, and leaves rollback as deleting one config.txt line.

Boot-tested on the Pi: Stratum 1, 273 ns offset, PPS handler confirmed NOT
threaded. Binaries ship as release assets, not in git.
This commit is contained in:
Ryan Malloy 2026-07-14 09:52:17 -06:00
parent 6b6d80ded3
commit 3b505644b2
15 changed files with 333 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.gitignore vendored
View file

@ -4,3 +4,8 @@ __pycache__/
dist/
*.egg-info/
node_modules/
# Kernel release binaries — 32 MB. These are published as Gitea release assets,
# not committed. Rebuild them with kernel/build.sh; verify with SHA256SUMS.
kernel/release/*.img.gz
kernel/release/*.tar.gz