The secrets context is not available to workflow-level env, so
`PKG_TOKEN: ${{ secrets.PKG_TOKEN }}` there resolved to empty and the publish
step's guard failed. Declare it in the preflight and build job env blocks
instead, where the secrets context is available.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Cron moved to 20:00 UTC (= 04:00 Asia/Shanghai); Actions cron is UTC.
- Add scripts/registry-has-all.sh: a (version, arch) counts as published only
when the kernel image, the meta-package at that EXACT version, bbrv3-config,
and (amd64) the headers are all present. A partial previous upload now
rebuilds instead of being treated as done.
- Use it in all three registry checks: preflight, per-arch pre-build, and the
pre-publish recheck.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Publish .deb packages to Gitea's built-in Debian registry (apt source)
instead of Releases; CI uploads to pool/stable/main and stops creating
Releases. One apt source line serves amd64 and arm64.
- Add linux-image-bbrv3 meta-package so `apt upgrade` tracks the latest
stable kernel while older kernels stay installed for fallback. Its
dependency is the actual built image package name (immune to localversion
drift).
- Add bbrv3-config package shipping the BBR+CAKE+ECN sysctl drop-in as a
conffile (applied via postinst), replacing the installer's sysctl write.
- Rewrite install.sh to add the apt source + signing key and install the
meta package; keep the OS-version gate, status check and uninstall menu,
plus an apt-mark hold escape hatch.
- select-stable-kernel.sh: pick the highest stable point release whose
series is below mainline and has a matching BBRv3 patch, so a freshly-cut
series (latest stable == mainline, e.g. 7.1) is not built. Currently 7.0.12.
- Exclude linux-libc-dev (clashes with the distro's headers) and drop the
"by Joey" MODULE_DESCRIPTION step and release branding.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Strip the project down to installing the BBRv3 kernel and nothing else, and
ship a single standard kernel (x86_64 + arm64, latest stable).
- install.sh: 1413 -> ~490 lines. Menu reduced to install latest / install
specific / status / uninstall. Removed all qdisc/TCP-tuning/speedtest/
smart-bandwidth/"madness"/clear-config features, the security (Dirty-Frag)
mitigations, the profile (standard/max) selection, and the self-installing
`b` quick command. Map dep command->package (sysctl->procps, awk->gawk) and
abort clearly when a hard dependency is missing.
- Default network stack: on install write /etc/sysctl.d/99-bbrv3.conf with
net.core.default_qdisc=cake, net.ipv4.tcp_congestion_control=bbr,
net.ipv4.tcp_ecn=1 (CAKE has no compile-time default-qdisc option, so it is
set via sysctl); uninstall removes the drop-in.
- prepare-kernel-config.sh: build sch_cake in (=y) so cake works at boot; drop
the now-dead build-configs/ output.
- build.yml: matrix is just x86_64 + arm64 standard; tags are <arch>-<version>;
removed the max profile/steps and the update-config-baseline auto-commit job;
releases carry only the kernel .deb assets.
- Remove cve_2026_31431_detector.py and the two max-profile helper scripts.
- README rewritten to the 4-action, kernel-only scope.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up fixes from adversarial verification of the Gitea adaptation:
- build.yml: arm64 `bindeb-pkg` cross build aborted on the linux-headers
package because CONFIG_MODULE_SIG_FORMAT=y makes it cross-compile
scripts/sign-file, which needs arm64 OpenSSL dev headers that aren't
installed. Pass DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders on
the arm64 make line (the maintainers' documented remedy) so the arm64
release publishes an image package without the unbuildable headers deb.
- install.sh: api_get used `curl -fsSL`, which discards the HTTP error body,
so Gitea's {"message":...} never reached check_release_api_response and the
token/permission hint was dead on 401/403/404. Drop -f (keep -sSL) so the
error JSON is surfaced; network-layer failures still exit non-zero.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Retarget the build pipeline and installer from GitHub to the
git.chilldove.com Gitea instance (icePigeon/linux-kernel-bbrv3).
- build.yml: replace gh CLI release checks and softprops/action-gh-release
with Gitea REST API calls (curl); drop the GitHub-only delete-workflow-runs
cleanup job; authenticate via the auto-injected GITEA_TOKEN.
- Avoid actions/upload-artifact@v4 / download-artifact@v4 (they abort on
Gitea as GHES): pass the config baseline between jobs via Gitea release
assets instead of artifacts, and drop the redundant deb/marker artifacts.
- Cross-compile arm64 on the single x86_64 runner
(CROSS_COMPILE=aarch64-linux-gnu-, gcc-aarch64-linux-gnu); thread
CROSS_COMPILE through prepare-kernel-config.sh olddefconfig.
- install.sh: fetch releases from the Gitea API, self-update and CVE
detector from Gitea raw URLs, token-authenticated asset downloads,
paginate the release list; keep GITHUB_TOKEN/GH_TOKEN as fallbacks.
- README.md: point install/download URLs at Gitea, reword GitHub -> Gitea,
remove the GitHub-only Star History widget.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rename the kernel LOCALVERSION used by the build from
-joeyblog-bbrv3 / -joeyblog-bbrv3-max to -bbrv3 / -bbrv3-max, so the
produced uname strings and .deb package names no longer carry the
custom brand. Standard vs max kernels stay distinguishable.
- .github/workflows/build.yml: matrix localversion for all four jobs
- scripts/build-bbrv3-max-kernel.sh: LOCALVERSION for local max builds
- install.sh: update detection, profile matching, expected-uname and
uninstall logic to key off -bbrv3 / -bbrv3-max instead of joeyblog
- README.md: describe uninstall by the new package-name suffixes
Runtime config paths (e.g. /etc/sysctl.d/99-joeyblog.conf) and author
attribution are unchanged; they are not kernel names.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvXBX9hm6GzStHUMDZzDoZ
Claude