From 9c464296a4424044d3e8c953c9523d88adb8dc5a Mon Sep 17 00:00:00 2001 From: Guanquan Tian Date: Tue, 8 Sep 2026 17:47:24 +0800 Subject: [PATCH 1/2] ci: inject DTB capsule certificates from GitHub Secrets Add step to inject FMPCERT, FMPROOT, and FMPSUB certificates from GitHub Secrets into debian.qcom/certs/ during kernel build. Certificates are stored as base64-encoded strings in Secrets and decoded during injection. This enables DTB capsule package generation with proper signing. Signed-off-by: Guanquan Tian --- .github/workflows/build-kernel.yml | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-kernel.yml b/.github/workflows/build-kernel.yml index 829abe35e4b21..4d5c0b91316ac 100644 --- a/.github/workflows/build-kernel.yml +++ b/.github/workflows/build-kernel.yml @@ -304,7 +304,26 @@ jobs: docker image ls # ----------------------------------------------------------------------- - # 7. Build kernel packages inside the suite-matched container + # 7. Inject DTB capsule certificates from GitHub Secrets + # Certificates are stored as base64-encoded strings in Secrets and + # decoded during injection into debian.qcom/certs/ for use during build + # ----------------------------------------------------------------------- + - name: Inject DTB capsule certificates + env: + FMPCERT: ${{ secrets.FMPCERT }} + FMPROOT: ${{ secrets.FMPROOT }} + FMPSUB: ${{ secrets.FMPSUB }} + run: | + set +x + mkdir -p kernel-src/debian.qcom/certs + echo "$FMPCERT" | base64 -d > kernel-src/debian.qcom/certs/QcFMPCert.pem + echo "$FMPROOT" | base64 -d > kernel-src/debian.qcom/certs/QcFMPRoot.pub.pem + echo "$FMPSUB" | base64 -d > kernel-src/debian.qcom/certs/QcFMPSub.pub.pem + chmod 600 kernel-src/debian.qcom/certs/*.pem + set -x + + # ----------------------------------------------------------------------- + # 8. Build kernel packages inside the suite-matched container # The workspace is bind-mounted so output .deb files land on the host. # ----------------------------------------------------------------------- - name: Build kernel packages (ghcr.io/qualcomm-linux/pkg-builder:${{ inputs.suite || 'resolute-qcom' }}) @@ -400,7 +419,7 @@ jobs: ' # ----------------------------------------------------------------------- - # 8. Collect output packages + # 9. Collect output packages # The Ubuntu kernel build drops .deb files one level above the # source tree (i.e. in GITHUB_WORKSPACE, not inside kernel-src/). # qcom-rt flavour packages are split into output/rt/ so consumers can @@ -448,7 +467,7 @@ jobs: fi # ----------------------------------------------------------------------- - # 9. Upload to S3 (lecore-production runner only) + # 10. Upload to S3 (lecore-production runner only) # Skipped when skip_s3 is set (premerge-pr.yml build-only checks). # Destination prefix is the caller-supplied s3_prefix input, not # inferred from github.event_name: a reusable workflow inherits the @@ -463,7 +482,7 @@ jobs: destination: ${{ env.ORG_NAME }}/pkg/${{ inputs.s3_prefix || 'temp' }}/${{ env.REPO_NAME }}/${{ github.run_id }}-${{ github.run_attempt }}/ # ----------------------------------------------------------------------- - # 10. Summary + # 11. Summary # ----------------------------------------------------------------------- - name: Print summary if: always() From ab8555500e3a75f67bd2822c54c6263ef7e5b612 Mon Sep 17 00:00:00 2001 From: Guanquan Tian Date: Tue, 8 Sep 2026 17:47:51 +0800 Subject: [PATCH 2/2] ci(build-kernel): resolve build-dep against local debian/control Move apt-get build-dep call after "debian/rules clean" generates the real debian/control. This ensures qcom-specific Build-Depends (u-boot-tools, device-tree-compiler) are installed instead of resolving against the archive's generic "linux" source package. Signed-off-by: Guanquan Tian --- .github/workflows/build-kernel.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-kernel.yml b/.github/workflows/build-kernel.yml index 4d5c0b91316ac..02c98fab3dd5f 100644 --- a/.github/workflows/build-kernel.yml +++ b/.github/workflows/build-kernel.yml @@ -363,7 +363,6 @@ jobs: # pkg-builder:noble is Ubuntu 24.04 which uses DEB822 format. sed -i "s/^Types: deb$/Types: deb deb-src/" /etc/apt/sources.list.d/ubuntu.sources apt-get update -qq - apt-get build-dep -y linux cd kernel-src/ echo "debian/debian.env: $(cat debian/debian.env 2>/dev/null || echo NOT FOUND)" @@ -400,6 +399,10 @@ jobs: echo "Safety net: created debian/changelog → debian.master/changelog" fi + # Resolve against the local debian/control just generated by "clean". + echo "=== Installing build dependencies from debian/control ===" + apt-get build-dep -y ./ + echo "=== Starting: fakeroot debian/rules ${TARGET} (jobs=${JOBS}) ===" export DEB_BUILD_OPTIONS="parallel=${JOBS} nocheck" # do_skip_checks=true skips the config policy check that requires