BFE EngineeringandClaude Fable 5
973a414f07
- build-kernel.sh fragment assertion: survives a missing trailing newline (the read footgun, reproduced) and treats an absent symbol on a disable line as FATAL, symmetric with the enable arm. - fetch-kernel-tarball.sh checks the pin before downloading; both fetchers add --retry-connrefused. - mkimage rejects '.'/'..' state keys. - ui-shot: VM liveness checked before every QMP call, console.log preserved as evidence on every failure path, repaint deadline widened to 90s with the contended-runner rationale documented. - rs485-bridge: overflow discards back off one gap and rate-limit their log line, mirroring the accept-loop fix; clippy nit fixed. - .gitignore ignores *.elf/*.map so the untracked artifacts cannot silently return; CI shellcheck glob now covers build/ and the rootfs boot scripts (directives added for the deliberate in-guest source paths). - Docs: NPU parity row matches its sibling verification docs; line-pinned audit cross-references unpinned; CROSS_COMPILE documented in the build header; payload README lists warden-ui; ci-cd tense settled. Verified: guards negative-tested (bad state keys, no-newline fragment); boot smoke, portal scenario, ui-shot all PASS; 53 tests green; shellcheck clean across the widened glob; clippy zero. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Fetch (with retries) and sha256-verify the pristine kernel tarball into $1.
|
|
# Single source of truth for the URL + verification used by build-kernel.sh
|
|
# and both CI jobs (patches-apply, kernel-build) — a KVER bump edits this file
|
|
# and build-kernel.sh only. FAILS CLOSED: a missing pin refuses to proceed.
|
|
#
|
|
# Usage: fetch-kernel-tarball.sh <destination-path>
|
|
set -euo pipefail
|
|
|
|
KVER=6.18.46
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # build/
|
|
SHA_FILE="$HERE/linux-$KVER.tar.xz.sha256"
|
|
URL="https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-$KVER.tar.xz"
|
|
|
|
TB="${1:?usage: fetch-kernel-tarball.sh <destination-path>}"
|
|
|
|
# Pin first: a forgotten pin on a KVER bump should refuse BEFORE burning a
|
|
# 140MB download it will then reject anyway.
|
|
[ -f "$SHA_FILE" ] || {
|
|
echo "FATAL: no pinned sha256 for linux-$KVER (expected $SHA_FILE) — refusing an unverified tarball" >&2
|
|
exit 1
|
|
}
|
|
if [ ! -f "$TB" ]; then
|
|
echo "== downloading $URL"
|
|
curl --retry 3 --retry-delay 5 --retry-connrefused -fSL "$URL" -o "$TB"
|
|
fi
|
|
want="$(cat "$SHA_FILE")"
|
|
got="$(sha256sum "$TB" | awk '{print $1}')"
|
|
[ "$want" = "$got" ] || { echo "FATAL: tarball sha256 mismatch: want $want got $got" >&2; exit 1; }
|
|
echo "== tarball sha256 verified: $TB"
|