Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #93783

TUXEDO getting involved with the Debian kernel team

Show all headers | View raw

Hello there,

I'm Werner from TUXEDO Computers and my colleague Max and I got to talk to 
Mechthilde at FrOSCon this weekend, who strongly advised me to to write the 
kernel team. I hope I found the right mailing list.

As you might already know: TUXEDO wants to use Debian as the base for our TUXEDO 
OS distro in the near future. Max did a Talk at FrOSCon explaining it in detail 
(sadly only in German): 
https://programm.froscon.org/froscon2026/talk/f467703e-39ea-41e0-bd66-f98efe4375d1/

I'm tasked with building packing the kernel.

To have full support for the newest devices we are selling, we currently need 
the newest Kernel 7.1.x + 2 Patches that are currently not upstream and TBH are 
somewhat dirty fixes that need more attention before they can go upstream. 
Besides my best efforts to upstream as soon as possible, this situation will 
always occur from time to time, so there is no way around it for us to build our 
own kernel fork where we can apply patches on our own.

My current effort to do this is based on the readme files in the Debian Linux 
repo and analyzing the config directory in there to build a "-tuxedo" featureset 
alongside the "-cloud" and "-rt" one with the patches added in there: 
https://gitlab.com/tuxedocomputers/development/packages/linux/-/tree/tuxedo-debian?ref_type=heads 
(relevant part is the patches-tuxedo folder and the new featureset in the 
defines.toml in the config folder)

But I'm not quite happy with the result yet:

- When I build this, I also always build the other featuresets including base 
featureset, which
- are then also included in the dsc and source tar and
- when I want to sign it for secure boot i also have to install these other 
featuresets and can not just sign the "-tuxedo" one.
- To sign the kernel with our self signed secure boot key (we not yet have our 
own shim bootloader, so we are using the MOK function of shim to include our 
self signed certificate) I patched USB-stick HSM support in the debian-test-sign 
script from the kernel-team repo.

I hope you could help me to find a recommended more "Debian way" to do all of this:

- How to I best add a new featureset with new patches ans slightly altered 
config and
- only build that to be installed alongside the not rebuild base, -rt, and 
-cloud featuresets.
- How do I properly sign that kernel using a HSM USB-stick?
- How can I best contribute back to Debian besides pushing TUXEDO developed 
patches as soon as possible to upstream so that all distros including Debian 
gain easy and automatic access to them?

Best regards

Werner

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

TUXEDO getting involved with the Debian kernel team Werner Sembach <wse@tuxedocomputers.com> - 2026-08-19 00:30 +0200
  Re: TUXEDO getting involved with the Debian kernel team Bastian Blank <waldi@debian.org> - 2026-09-04 13:40 +0200
    Re: TUXEDO getting involved with the Debian kernel team Werner Sembach <wse@tuxedocomputers.com> - 2026-09-04 21:10 +0200
    Re: TUXEDO getting involved with the Debian kernel team Werner Sembach <wse@tuxedocomputers.com> - 2026-10-01 14:40 +0200
      Re: TUXEDO getting involved with the Debian kernel team Werner Sembach <wse@tuxedocomputers.com> - 2026-10-01 14:40 +0200

csiph-web