Resolving the kernel debug symbols vs signing problem

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.kernel, linux.debian.devel.release
Subject	Resolving the kernel debug symbols vs signing problem
Date	2017-04-07 21:20 +0200
Message-ID	<ttHAl-3g5-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

When implementing signed kernel packages, I wanted to make the signed
image packages (built from linux-signed) take un-suffixed names so that
existing procedures to install specific kernel versions would pick the
signed packages, and users would be discouraged from installing
unsigned packages.

This has interacted poorly with dak's handling of 'auto-built' debug
symbol packages, as those are built by src:linux but don't include the
'-unsigned' suffix in their names.  The debug symbol packages are added
to the overrides file but are later automatically pruned, so that
uploads that don't add new binary packages may still require NEW
processing.  I think this has to be solved before the stable release.

Therefore I intend to rename the binary packages as follows with the
next uploads to unstable:

- src:linux builds linux-image packages without a name suffix
- src:linux-signed builds linux-image packages with a '-signed' suffix
- src:linux-latest builds linux-image meta-packages that depend on the
  '-signed' package where available

One alternative could be to build duplicate debug symbol packages in
src:linux and src:linux-signed, but that's a big waste of archive space
and requires a maintainer to upload the debug symbol packages for one
architecture (over 500 MiB per flavour) whenever there's an ABI bump.

Please let me know if you have a preference or an alternate solution.

(Also, if dak will not be signing packages in time for stretch,
src:linux-signed must be removed from testing and the other packages
changed accordingly.  I *will* *not* personally sign kernels for a
stable release.)

Ben.

-- 
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by
stupidity.

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Resolving the kernel debug symbols vs signing problem Ben Hutchings <ben@decadent.org.uk> - 2017-04-07 21:20 +0200
  Re: Resolving the kernel debug symbols vs signing problem Niels Thykier <niels@thykier.net> - 2017-04-12 10:00 +0200
    Re: Resolving the kernel debug symbols vs signing problem Ben Hutchings <ben@decadent.org.uk> - 2017-04-12 18:50 +0200
      Re: Resolving the kernel debug symbols vs signing problem Niels Thykier <niels@thykier.net> - 2017-04-13 11:20 +0200
        Re: Resolving the kernel debug symbols vs signing problem Ben Hutchings <ben@decadent.org.uk> - 2017-04-16 20:40 +0200

csiph-web