Export generated kernel configs

.github/workflows/build.yml

@@ -121,180 +121,14 @@ jobs:
         timeout-minutes: 8
         working-directory: ./kernel/linux
         run: |
-          set -euxo pipefail
+          bash "$GITHUB_WORKSPACE/scripts/prepare-kernel-config.sh" "${{ matrix.arch }}"
-          run_olddefconfig() {
-            if [ "${{ matrix.arch }}" = "arm64" ]; then
-              timeout 300 make ARCH=arm64 olddefconfig < /dev/null
-            else
-              timeout 300 make olddefconfig < /dev/null
-            fi
-          }
 
-          if [ "${{ matrix.arch }}" = "arm64" ]; then
+      - name: 上传最终配置文件
-            cp "$GITHUB_WORKSPACE/arm64.config" .config
+        if: env.BUILD_NEEDED == 'true'
-          else
+        uses: actions/upload-artifact@v4
-            cp "$GITHUB_WORKSPACE/x86-64.config" .config
+        with:
-          fi
+          name: config-${{ matrix.arch }}-${{ env.KERNEL_VERSION }}
-
+          path: ./build-configs/${{ matrix.arch }}*.config
-          scripts/config --disable SYSTEM_TRUSTED_KEYS
-          scripts/config --disable SYSTEM_REVOCATION_KEYS
-          scripts/config --enable TCP_CONG_BBR
-          scripts/config --disable DEFAULT_CUBIC
-          scripts/config --enable DEFAULT_BBR
-          scripts/config --set-str DEFAULT_TCP_CONG bbr
-          scripts/config --enable NET_SCH_DEFAULT
-          scripts/config --enable NET_SCH_FQ
-          scripts/config --disable DEFAULT_FQ_CODEL
-          scripts/config --disable DEFAULT_PFIFO_FAST
-          scripts/config --enable DEFAULT_FQ
-          scripts/config --set-str DEFAULT_NET_SCH fq
-          scripts/config --module NETFILTER_XTABLES
-          scripts/config --enable NETFILTER_XTABLES_LEGACY
-          scripts/config --module IP_NF_IPTABLES_LEGACY
-          scripts/config --module IP_NF_FILTER
-          scripts/config --module IP_NF_NAT
-          scripts/config --module IP_NF_TARGET_MASQUERADE
-          scripts/config --module IP_NF_MANGLE
-          scripts/config --module IP_NF_RAW
-          scripts/config --module IP6_NF_IPTABLES_LEGACY
-          scripts/config --module IP6_NF_FILTER
-          scripts/config --module IP6_NF_NAT
-          scripts/config --module IP6_NF_MANGLE
-          scripts/config --module IP6_NF_RAW
-          # Avoid generating kernel debug info and linux-image-*-dbg packages.
-          scripts/config --disable DEBUG_INFO
-          scripts/config --enable DEBUG_INFO_NONE
-          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
-          scripts/config --disable DEBUG_INFO_DWARF4
-          scripts/config --disable DEBUG_INFO_DWARF5
-          scripts/config --disable DEBUG_INFO_REDUCED
-          scripts/config --disable DEBUG_INFO_COMPRESSED
-          scripts/config --disable DEBUG_INFO_SPLIT
-          scripts/config --disable DEBUG_INFO_BTF
-          scripts/config --disable DEBUG_INFO_BTF_MODULES
-          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
-          # Mitigation for Dirty Frag attack surface.
-          scripts/config --disable AFS_FS
-          scripts/config --disable XFRM_ESP
-          scripts/config --disable INET_ESP
-          scripts/config --disable INET6_ESP
-          scripts/config --disable AF_RXRPC
-          scripts/config --disable RXKAD
-          
-          run_olddefconfig
-
-          scripts/config --disable AFS_FS
-          scripts/config --disable XFRM_ESP
-          scripts/config --disable INET_ESP
-          scripts/config --disable INET6_ESP
-          scripts/config --disable AF_RXRPC
-          scripts/config --disable RXKAD
-          scripts/config --enable TCP_CONG_BBR
-          scripts/config --disable DEFAULT_CUBIC
-          scripts/config --enable DEFAULT_BBR
-          scripts/config --set-str DEFAULT_TCP_CONG bbr
-          scripts/config --enable NET_SCH_DEFAULT
-          scripts/config --enable NET_SCH_FQ
-          scripts/config --disable DEFAULT_FQ_CODEL
-          scripts/config --disable DEFAULT_PFIFO_FAST
-          scripts/config --enable DEFAULT_FQ
-          scripts/config --set-str DEFAULT_NET_SCH fq
-          scripts/config --module NETFILTER_XTABLES
-          scripts/config --enable NETFILTER_XTABLES_LEGACY
-          scripts/config --module IP_NF_IPTABLES_LEGACY
-          scripts/config --module IP_NF_FILTER
-          scripts/config --module IP_NF_NAT
-          scripts/config --module IP_NF_TARGET_MASQUERADE
-          scripts/config --module IP_NF_MANGLE
-          scripts/config --module IP_NF_RAW
-          scripts/config --module IP6_NF_IPTABLES_LEGACY
-          scripts/config --module IP6_NF_FILTER
-          scripts/config --module IP6_NF_NAT
-          scripts/config --module IP6_NF_MANGLE
-          scripts/config --module IP6_NF_RAW
-          scripts/config --disable DEBUG_INFO
-          scripts/config --enable DEBUG_INFO_NONE
-          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
-          scripts/config --disable DEBUG_INFO_DWARF4
-          scripts/config --disable DEBUG_INFO_DWARF5
-          scripts/config --disable DEBUG_INFO_REDUCED
-          scripts/config --disable DEBUG_INFO_COMPRESSED
-          scripts/config --disable DEBUG_INFO_SPLIT
-          scripts/config --disable DEBUG_INFO_BTF
-          scripts/config --disable DEBUG_INFO_BTF_MODULES
-          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
-
-          run_olddefconfig
-
-          if grep -q '^CONFIG_XFRM_ESP=' .config; then
-            echo "ERROR: CONFIG_XFRM_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_INET_ESP=' .config; then
-            echo "ERROR: CONFIG_INET_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_INET6_ESP=' .config; then
-            echo "ERROR: CONFIG_INET6_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_AF_RXRPC=' .config; then
-            echo "ERROR: CONFIG_AF_RXRPC is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_DEBUG_INFO=' .config; then
-            echo "ERROR: CONFIG_DEBUG_INFO is enabled; refusing to build debug kernel packages."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_TCP_CONG_BBR=y' .config; then
-            echo "ERROR: CONFIG_TCP_CONG_BBR is not built in."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_BBR=y' .config; then
-            echo "ERROR: CONFIG_DEFAULT_BBR is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_TCP_CONG="bbr"' .config; then
-            echo "ERROR: CONFIG_DEFAULT_TCP_CONG is not bbr."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NET_SCH_FQ=y' .config; then
-            echo "ERROR: CONFIG_NET_SCH_FQ is not built in."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NET_SCH_DEFAULT=y' .config; then
-            echo "ERROR: CONFIG_NET_SCH_DEFAULT is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_FQ=y' .config; then
-            echo "ERROR: CONFIG_DEFAULT_FQ is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_NET_SCH="fq"' .config; then
-            echo "ERROR: CONFIG_DEFAULT_NET_SCH is not fq."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NETFILTER_XTABLES_LEGACY=y' .config; then
-            echo "ERROR: CONFIG_NETFILTER_XTABLES_LEGACY is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_IPTABLES_LEGACY=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_IPTABLES_LEGACY is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_NAT=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_NAT is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_FILTER=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_FILTER is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_TARGET_MASQUERADE=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_TARGET_MASQUERADE is not module-enabled."
-            exit 1
-          fi
-          grep -E 'CONFIG_(DEBUG_INFO_NONE|TCP_CONG_BBR|DEFAULT_BBR|DEFAULT_TCP_CONG|NET_SCH_DEFAULT|NET_SCH_FQ|DEFAULT_FQ|DEFAULT_NET_SCH|NETFILTER_XTABLES_LEGACY|IP_NF_IPTABLES_LEGACY|IP_NF_NAT|IP_NF_FILTER|IP_NF_TARGET_MASQUERADE|IP6_NF_IPTABLES_LEGACY|IP6_NF_NAT|IP6_NF_FILTER)=' .config
 
       - name: 构建内核 Debian 包
         if: env.BUILD_NEEDED == 'true'
@@ -316,14 +150,6 @@ jobs:
           fi
           find ./kernel -maxdepth 1 -name 'linux-*.deb' -print | sort
 
-      - name: 上传配置文件
-        if: env.BUILD_NEEDED == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-${{ matrix.arch }}
-          path: ./kernel/linux/.config
-          include-hidden-files: true
-
       - name: 上传 deb 包
         if: env.BUILD_NEEDED == 'true'
         uses: actions/upload-artifact@v4
@@ -336,5 +162,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ matrix.arch }}-${{ env.KERNEL_VERSION }}
-          files: ./kernel/linux-*.deb
+          files: |
+            ./kernel/linux-*.deb
+            ./build-configs/${{ matrix.arch }}-${{ env.KERNEL_VERSION }}.config
           body: "带有 BBRv3 的最新内核，适用于 ${{ matrix.arch }} 架构。Compiled & Optimized by Joey."

scripts/prepare-kernel-config.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+arch="${1:?usage: prepare-kernel-config.sh <x86_64|arm64>}"
+
+run_olddefconfig() {
+  if [ "$arch" = "arm64" ]; then
+    timeout 300 make ARCH=arm64 olddefconfig < /dev/null
+  else
+    timeout 300 make olddefconfig < /dev/null
+  fi
+}
+
+apply_policy_config() {
+  scripts/config --disable SYSTEM_TRUSTED_KEYS
+  scripts/config --disable SYSTEM_REVOCATION_KEYS
+
+  scripts/config --enable TCP_CONG_BBR
+  scripts/config --disable DEFAULT_CUBIC
+  scripts/config --enable DEFAULT_BBR
+  scripts/config --set-str DEFAULT_TCP_CONG bbr
+
+  scripts/config --enable NET_SCH_DEFAULT
+  scripts/config --enable NET_SCH_FQ
+  scripts/config --disable DEFAULT_FQ_CODEL
+  scripts/config --disable DEFAULT_PFIFO_FAST
+  scripts/config --enable DEFAULT_FQ
+  scripts/config --set-str DEFAULT_NET_SCH fq
+
+  scripts/config --module NETFILTER_XTABLES
+  scripts/config --enable NETFILTER_XTABLES_LEGACY
+  scripts/config --module IP_NF_IPTABLES_LEGACY
+  scripts/config --module IP_NF_FILTER
+  scripts/config --module IP_NF_NAT
+  scripts/config --module IP_NF_TARGET_MASQUERADE
+  scripts/config --module IP_NF_MANGLE
+  scripts/config --module IP_NF_RAW
+  scripts/config --module IP6_NF_IPTABLES_LEGACY
+  scripts/config --module IP6_NF_FILTER
+  scripts/config --module IP6_NF_NAT
+  scripts/config --module IP6_NF_MANGLE
+  scripts/config --module IP6_NF_RAW
+
+  scripts/config --disable DEBUG_INFO
+  scripts/config --enable DEBUG_INFO_NONE
+  scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
+  scripts/config --disable DEBUG_INFO_DWARF4
+  scripts/config --disable DEBUG_INFO_DWARF5
+  scripts/config --disable DEBUG_INFO_REDUCED
+  scripts/config --disable DEBUG_INFO_COMPRESSED
+  scripts/config --disable DEBUG_INFO_SPLIT
+  scripts/config --disable DEBUG_INFO_BTF
+  scripts/config --disable DEBUG_INFO_BTF_MODULES
+  scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
+
+  scripts/config --disable AFS_FS
+  scripts/config --disable XFRM_ESP
+  scripts/config --disable INET_ESP
+  scripts/config --disable INET6_ESP
+  scripts/config --disable AF_RXRPC
+  scripts/config --disable RXKAD
+}
+
+require_config_line() {
+  local line="$1"
+  local message="$2"
+  if ! grep -q "^${line}$" .config; then
+    echo "ERROR: $message"
+    exit 1
+  fi
+}
+
+reject_enabled_config() {
+  local symbol="$1"
+  if grep -q "^${symbol}=" .config; then
+    echo "ERROR: ${symbol} is enabled; refusing to continue."
+    exit 1
+  fi
+}
+
+validate_config() {
+  reject_enabled_config CONFIG_XFRM_ESP
+  reject_enabled_config CONFIG_INET_ESP
+  reject_enabled_config CONFIG_INET6_ESP
+  reject_enabled_config CONFIG_AF_RXRPC
+  reject_enabled_config CONFIG_DEBUG_INFO
+
+  require_config_line 'CONFIG_TCP_CONG_BBR=y' 'CONFIG_TCP_CONG_BBR is not built in.'
+  require_config_line 'CONFIG_DEFAULT_BBR=y' 'CONFIG_DEFAULT_BBR is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_TCP_CONG="bbr"' 'CONFIG_DEFAULT_TCP_CONG is not bbr.'
+  require_config_line 'CONFIG_NET_SCH_FQ=y' 'CONFIG_NET_SCH_FQ is not built in.'
+  require_config_line 'CONFIG_NET_SCH_DEFAULT=y' 'CONFIG_NET_SCH_DEFAULT is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_FQ=y' 'CONFIG_DEFAULT_FQ is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_NET_SCH="fq"' 'CONFIG_DEFAULT_NET_SCH is not fq.'
+  require_config_line 'CONFIG_NETFILTER_XTABLES_LEGACY=y' 'CONFIG_NETFILTER_XTABLES_LEGACY is not enabled.'
+  require_config_line 'CONFIG_IP_NF_IPTABLES_LEGACY=m' 'CONFIG_IP_NF_IPTABLES_LEGACY is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_NAT=m' 'CONFIG_IP_NF_NAT is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_FILTER=m' 'CONFIG_IP_NF_FILTER is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_TARGET_MASQUERADE=m' 'CONFIG_IP_NF_TARGET_MASQUERADE is not module-enabled.'
+
+  grep -E 'CONFIG_(DEBUG_INFO_NONE|TCP_CONG_BBR|DEFAULT_BBR|DEFAULT_TCP_CONG|NET_SCH_DEFAULT|NET_SCH_FQ|DEFAULT_FQ|DEFAULT_NET_SCH|NETFILTER_XTABLES_LEGACY|IP_NF_IPTABLES_LEGACY|IP_NF_NAT|IP_NF_FILTER|IP_NF_TARGET_MASQUERADE|IP6_NF_IPTABLES_LEGACY|IP6_NF_NAT|IP6_NF_FILTER)=' .config
+}
+
+case "$arch" in
+  arm64)
+    cp "$GITHUB_WORKSPACE/arm64.config" .config
+    ;;
+  x86_64)
+    cp "$GITHUB_WORKSPACE/x86-64.config" .config
+    ;;
+  *)
+    echo "ERROR: unsupported arch: $arch"
+    exit 1
+    ;;
+esac
+
+apply_policy_config
+run_olddefconfig
+apply_policy_config
+run_olddefconfig
+validate_config
+
+mkdir -p "$GITHUB_WORKSPACE/build-configs"
+cp .config "$GITHUB_WORKSPACE/build-configs/${arch}.config"
+cp .config "$GITHUB_WORKSPACE/build-configs/${arch}-${KERNEL_VERSION}.config"