The kernel shipped image-only: install.sh installed just linux-image-bbrv3,
which pulled no headers, so DKMS (zfs-dkms) had no build tree and never built
zfs.ko for the new kernel. On a ZFS-on-root box that left zfs out of the
initramfs -> root could not be mounted -> the machine failed to boot
(hit live on baguette; maple/wunder are ext4-root so they booted but ran
docker on an unimported, empty rpool).
Permanent fix:
- build-meta-package.sh now also builds a linux-headers-bbrv3 meta (amd64) and
makes linux-image-bbrv3 Depend on it, so headers always install in the same
apt transaction as the kernel and DKMS rebuilds on every upgrade (mirrors
Debian's linux-image-amd64 / linux-headers-amd64 pair). arm64 ships no headers
(nokernelheaders cross build), so the dep and meta are amd64-only.
- build.yml derives the headers package name and passes it to the meta builder.
- registry-has-all.sh counts the headers meta as part of a complete publish.
- install.sh installs linux-headers-bbrv3 alongside the image (latest path) and
the matching versioned headers in the specific-version path.
Also bundles pre-existing WIP: docs/README notes on the two-stage (Cloudflare
edge + origin nginx) upload body-limit, and setup_apt_source key-download
HTTP-status error handling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- ccache: enable depend mode (skip the preprocessor on ~75k compiler
calls) and add BASEDIR/NOHASHDIR/SLOPPINESS as insurance against false
misses from build-path or build-macro churn. ccache -s already shows
99.99% direct hits, so this trims per-call overhead, not a broken
cache. MAXSIZE stays 8G (only ~1G used).
- deps: drop dwarves + libdw-dev. pahole only runs with
CONFIG_DEBUG_INFO_BTF, but the build forces DEBUG_INFO_NONE, so they
were never used.
- config: disable MODULE_COMPRESS/MODULE_DECOMPRESS for both arches.
arm64 alone shipped zstd module compression, running a zstd pass over
~8000 .ko every build for no gain (the .deb is already compressed by
KDEB_COMPRESS); x86_64 never did. Keeps the two arches in sync.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2G is tight when caching objects across kernel-version transitions (the cache holds more than one X.Y.Z at a time); 8G keeps older objects from being evicted prematurely. ccache only stores what a build produces, so this raises the cap, not the per-run size.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
actions/cache's post-save is gated by post-if: success(), so the failing publish step discarded the compile cache on every run — each build started cold. Split into actions/cache/restore + actions/cache/save, with the save placed right after the build and gated on !cancelled(), so the valid compiler cache is persisted whether or not publish (or any later step) fails. Skips only on cancellation, to avoid bloating the cache with half-built runs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Actions runner is overseas, so git.chilldove.com resolves to Cloudflare anycast. Cloudflare free/pro rejects request bodies over 100MB with HTTP 413 at the edge, and the linux-image .deb exceeds 100MB, so every publish failed. The Gitea origin itself accepts the upload (verified to >=110MB); only the CDN edge rejects it.
Pin the publish curl to the registry origin via curl --resolve, sourced from the new PKG_ORIGIN_IP repo variable (no IP baked into git; SNI/Host stay git.chilldove.com so TLS and package routing are unchanged). Document the prerequisite in README and the migration spec.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Install ccache and wrap the native + arm64 cross compilers via
/usr/lib/ccache symlinks on PATH; persist CCACHE_DIR / PATH across steps
through $GITHUB_ENV / $GITHUB_PATH.
- Restore and save ~/.ccache with actions/cache@v4, keyed by arch + kernel
version with a unique per-run suffix to force a save; restore-keys warm-start
from a prior build of the same arch (including across point releases).
- Print `ccache -s` after the build. Deliberately do not cache out/ (freshly
built packages) or the re-cloned kernel source.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The secrets context is not available to workflow-level env, so
`PKG_TOKEN: ${{ secrets.PKG_TOKEN }}` there resolved to empty and the publish
step's guard failed. Declare it in the preflight and build job env blocks
instead, where the secrets context is available.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Cron moved to 20:00 UTC (= 04:00 Asia/Shanghai); Actions cron is UTC.
- Add scripts/registry-has-all.sh: a (version, arch) counts as published only
when the kernel image, the meta-package at that EXACT version, bbrv3-config,
and (amd64) the headers are all present. A partial previous upload now
rebuilds instead of being treated as done.
- Use it in all three registry checks: preflight, per-arch pre-build, and the
pre-publish recheck.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Publish .deb packages to Gitea's built-in Debian registry (apt source)
instead of Releases; CI uploads to pool/stable/main and stops creating
Releases. One apt source line serves amd64 and arm64.
- Add linux-image-bbrv3 meta-package so `apt upgrade` tracks the latest
stable kernel while older kernels stay installed for fallback. Its
dependency is the actual built image package name (immune to localversion
drift).
- Add bbrv3-config package shipping the BBR+CAKE+ECN sysctl drop-in as a
conffile (applied via postinst), replacing the installer's sysctl write.
- Rewrite install.sh to add the apt source + signing key and install the
meta package; keep the OS-version gate, status check and uninstall menu,
plus an apt-mark hold escape hatch.
- select-stable-kernel.sh: pick the highest stable point release whose
series is below mainline and has a matching BBRv3 patch, so a freshly-cut
series (latest stable == mainline, e.g. 7.1) is not built. Currently 7.0.12.
- Exclude linux-libc-dev (clashes with the distro's headers) and drop the
"by Joey" MODULE_DESCRIPTION step and release branding.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Strip the project down to installing the BBRv3 kernel and nothing else, and
ship a single standard kernel (x86_64 + arm64, latest stable).
- install.sh: 1413 -> ~490 lines. Menu reduced to install latest / install
specific / status / uninstall. Removed all qdisc/TCP-tuning/speedtest/
smart-bandwidth/"madness"/clear-config features, the security (Dirty-Frag)
mitigations, the profile (standard/max) selection, and the self-installing
`b` quick command. Map dep command->package (sysctl->procps, awk->gawk) and
abort clearly when a hard dependency is missing.
- Default network stack: on install write /etc/sysctl.d/99-bbrv3.conf with
net.core.default_qdisc=cake, net.ipv4.tcp_congestion_control=bbr,
net.ipv4.tcp_ecn=1 (CAKE has no compile-time default-qdisc option, so it is
set via sysctl); uninstall removes the drop-in.
- prepare-kernel-config.sh: build sch_cake in (=y) so cake works at boot; drop
the now-dead build-configs/ output.
- build.yml: matrix is just x86_64 + arm64 standard; tags are <arch>-<version>;
removed the max profile/steps and the update-config-baseline auto-commit job;
releases carry only the kernel .deb assets.
- Remove cve_2026_31431_detector.py and the two max-profile helper scripts.
- README rewritten to the 4-action, kernel-only scope.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up fixes from adversarial verification of the Gitea adaptation:
- build.yml: arm64 `bindeb-pkg` cross build aborted on the linux-headers
package because CONFIG_MODULE_SIG_FORMAT=y makes it cross-compile
scripts/sign-file, which needs arm64 OpenSSL dev headers that aren't
installed. Pass DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders on
the arm64 make line (the maintainers' documented remedy) so the arm64
release publishes an image package without the unbuildable headers deb.
- install.sh: api_get used `curl -fsSL`, which discards the HTTP error body,
so Gitea's {"message":...} never reached check_release_api_response and the
token/permission hint was dead on 401/403/404. Drop -f (keep -sSL) so the
error JSON is surfaced; network-layer failures still exit non-zero.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Retarget the build pipeline and installer from GitHub to the
git.chilldove.com Gitea instance (icePigeon/linux-kernel-bbrv3).
- build.yml: replace gh CLI release checks and softprops/action-gh-release
with Gitea REST API calls (curl); drop the GitHub-only delete-workflow-runs
cleanup job; authenticate via the auto-injected GITEA_TOKEN.
- Avoid actions/upload-artifact@v4 / download-artifact@v4 (they abort on
Gitea as GHES): pass the config baseline between jobs via Gitea release
assets instead of artifacts, and drop the redundant deb/marker artifacts.
- Cross-compile arm64 on the single x86_64 runner
(CROSS_COMPILE=aarch64-linux-gnu-, gcc-aarch64-linux-gnu); thread
CROSS_COMPILE through prepare-kernel-config.sh olddefconfig.
- install.sh: fetch releases from the Gitea API, self-update and CVE
detector from Gitea raw URLs, token-authenticated asset downloads,
paginate the release list; keep GITHUB_TOKEN/GH_TOKEN as fallbacks.
- README.md: point install/download URLs at Gitea, reword GitHub -> Gitea,
remove the GitHub-only Star History widget.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rename the kernel LOCALVERSION used by the build from
-joeyblog-bbrv3 / -joeyblog-bbrv3-max to -bbrv3 / -bbrv3-max, so the
produced uname strings and .deb package names no longer carry the
custom brand. Standard vs max kernels stay distinguishable.
- .github/workflows/build.yml: matrix localversion for all four jobs
- scripts/build-bbrv3-max-kernel.sh: LOCALVERSION for local max builds
- install.sh: update detection, profile matching, expected-uname and
uninstall logic to key off -bbrv3 / -bbrv3-max instead of joeyblog
- README.md: describe uninstall by the new package-name suffixes
Runtime config paths (e.g. /etc/sysctl.d/99-joeyblog.conf) and author
attribution are unchanged; they are not kernel names.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvXBX9hm6GzStHUMDZzDoZ
Claude