Skip to content

Commit a6d06b7

Browse files
nathanchancenathanchance
authored
Merge pull request #907 from nathanchance/hardening-plus-full-lto
Add a hardening.config plus full LTO build for arm64 and x86_64
2 parents b6de790 + 9963f9c commit a6d06b7

29 files changed

Lines changed: 986 additions & 0 deletions

‎.github/workflows/mainline-clang-20.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,35 @@ jobs:
581581
name: boot_utils_json_defconfigs
582582
- name: Check Build and Boot Logs
583583
run: scripts/check-logs.py
584+
_6c8c4b213e110c4f08eb7e085634e324:
585+
runs-on: ubuntu-latest
586+
needs:
587+
- kick_tuxsuite_defconfigs
588+
- check_cache
589+
- check_patches
590+
name: ARCH=arm64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=20 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
591+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
592+
env:
593+
ARCH: arm64
594+
LLVM_VERSION: 20
595+
BOOT: 1
596+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
597+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
598+
container:
599+
image: ghcr.io/clangbuiltlinux/qemu
600+
options: --ipc=host
601+
steps:
602+
- uses: actions/checkout@v4
603+
with:
604+
submodules: true
605+
- uses: actions/download-artifact@v4
606+
with:
607+
name: output_artifact_defconfigs
608+
- uses: actions/download-artifact@v4
609+
with:
610+
name: boot_utils_json_defconfigs
611+
- name: Check Build and Boot Logs
612+
run: scripts/check-logs.py
584613
_00d242509831af2449f3ce0f1af4ca66:
585614
runs-on: ubuntu-latest
586615
needs:
@@ -1306,6 +1335,35 @@ jobs:
13061335
name: boot_utils_json_defconfigs
13071336
- name: Check Build and Boot Logs
13081337
run: scripts/check-logs.py
1338+
_aff202b84840ac29363c42ea5d6f640b:
1339+
runs-on: ubuntu-latest
1340+
needs:
1341+
- kick_tuxsuite_defconfigs
1342+
- check_cache
1343+
- check_patches
1344+
name: ARCH=x86_64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=20 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1345+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
1346+
env:
1347+
ARCH: x86_64
1348+
LLVM_VERSION: 20
1349+
BOOT: 1
1350+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1351+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
1352+
container:
1353+
image: ghcr.io/clangbuiltlinux/qemu
1354+
options: --ipc=host
1355+
steps:
1356+
- uses: actions/checkout@v4
1357+
with:
1358+
submodules: true
1359+
- uses: actions/download-artifact@v4
1360+
with:
1361+
name: output_artifact_defconfigs
1362+
- uses: actions/download-artifact@v4
1363+
with:
1364+
name: boot_utils_json_defconfigs
1365+
- name: Check Build and Boot Logs
1366+
run: scripts/check-logs.py
13091367
kick_tuxsuite_distribution_configs:
13101368
name: TuxSuite (distribution_configs)
13111369
runs-on: ubuntu-latest

‎.github/workflows/mainline-clang-21.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,35 @@ jobs:
581581
name: boot_utils_json_defconfigs
582582
- name: Check Build and Boot Logs
583583
run: scripts/check-logs.py
584+
_46a733d8adba10273b69bc3b88b63559:
585+
runs-on: ubuntu-latest
586+
needs:
587+
- kick_tuxsuite_defconfigs
588+
- check_cache
589+
- check_patches
590+
name: ARCH=arm64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=21 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
591+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
592+
env:
593+
ARCH: arm64
594+
LLVM_VERSION: 21
595+
BOOT: 1
596+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
597+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
598+
container:
599+
image: ghcr.io/clangbuiltlinux/qemu
600+
options: --ipc=host
601+
steps:
602+
- uses: actions/checkout@v4
603+
with:
604+
submodules: true
605+
- uses: actions/download-artifact@v4
606+
with:
607+
name: output_artifact_defconfigs
608+
- uses: actions/download-artifact@v4
609+
with:
610+
name: boot_utils_json_defconfigs
611+
- name: Check Build and Boot Logs
612+
run: scripts/check-logs.py
584613
_93066baf4ecd4154cb7a2ff93c753072:
585614
runs-on: ubuntu-latest
586615
needs:
@@ -1306,6 +1335,35 @@ jobs:
13061335
name: boot_utils_json_defconfigs
13071336
- name: Check Build and Boot Logs
13081337
run: scripts/check-logs.py
1338+
_67e8fe884ec9d35f324ce890089bdc28:
1339+
runs-on: ubuntu-latest
1340+
needs:
1341+
- kick_tuxsuite_defconfigs
1342+
- check_cache
1343+
- check_patches
1344+
name: ARCH=x86_64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=21 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1345+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
1346+
env:
1347+
ARCH: x86_64
1348+
LLVM_VERSION: 21
1349+
BOOT: 1
1350+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1351+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
1352+
container:
1353+
image: ghcr.io/clangbuiltlinux/qemu
1354+
options: --ipc=host
1355+
steps:
1356+
- uses: actions/checkout@v4
1357+
with:
1358+
submodules: true
1359+
- uses: actions/download-artifact@v4
1360+
with:
1361+
name: output_artifact_defconfigs
1362+
- uses: actions/download-artifact@v4
1363+
with:
1364+
name: boot_utils_json_defconfigs
1365+
- name: Check Build and Boot Logs
1366+
run: scripts/check-logs.py
13091367
kick_tuxsuite_distribution_configs:
13101368
name: TuxSuite (distribution_configs)
13111369
runs-on: ubuntu-latest

‎.github/workflows/mainline-clang-22.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,35 @@ jobs:
581581
name: boot_utils_json_defconfigs
582582
- name: Check Build and Boot Logs
583583
run: scripts/check-logs.py
584+
_9419aeb0390f286e913033e6d5e1b94c:
585+
runs-on: ubuntu-latest
586+
needs:
587+
- kick_tuxsuite_defconfigs
588+
- check_cache
589+
- check_patches
590+
name: ARCH=arm64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=22 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
591+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
592+
env:
593+
ARCH: arm64
594+
LLVM_VERSION: 22
595+
BOOT: 1
596+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
597+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
598+
container:
599+
image: ghcr.io/clangbuiltlinux/qemu
600+
options: --ipc=host
601+
steps:
602+
- uses: actions/checkout@v4
603+
with:
604+
submodules: true
605+
- uses: actions/download-artifact@v4
606+
with:
607+
name: output_artifact_defconfigs
608+
- uses: actions/download-artifact@v4
609+
with:
610+
name: boot_utils_json_defconfigs
611+
- name: Check Build and Boot Logs
612+
run: scripts/check-logs.py
584613
_eb1f58b7f6bc741372ffd034a1d14cf8:
585614
runs-on: ubuntu-latest
586615
needs:
@@ -1306,6 +1335,35 @@ jobs:
13061335
name: boot_utils_json_defconfigs
13071336
- name: Check Build and Boot Logs
13081337
run: scripts/check-logs.py
1338+
_ee4efeeb54c16545491955e4305875d2:
1339+
runs-on: ubuntu-latest
1340+
needs:
1341+
- kick_tuxsuite_defconfigs
1342+
- check_cache
1343+
- check_patches
1344+
name: ARCH=x86_64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=22 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1345+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
1346+
env:
1347+
ARCH: x86_64
1348+
LLVM_VERSION: 22
1349+
BOOT: 1
1350+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1351+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
1352+
container:
1353+
image: ghcr.io/clangbuiltlinux/qemu
1354+
options: --ipc=host
1355+
steps:
1356+
- uses: actions/checkout@v4
1357+
with:
1358+
submodules: true
1359+
- uses: actions/download-artifact@v4
1360+
with:
1361+
name: output_artifact_defconfigs
1362+
- uses: actions/download-artifact@v4
1363+
with:
1364+
name: boot_utils_json_defconfigs
1365+
- name: Check Build and Boot Logs
1366+
run: scripts/check-logs.py
13091367
kick_tuxsuite_distribution_configs:
13101368
name: TuxSuite (distribution_configs)
13111369
runs-on: ubuntu-latest

‎.github/workflows/mainline-clang-23.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,35 @@ jobs:
581581
name: boot_utils_json_defconfigs
582582
- name: Check Build and Boot Logs
583583
run: scripts/check-logs.py
584+
_62b31cbd228c79c78471af50411b0f51:
585+
runs-on: ubuntu-latest
586+
needs:
587+
- kick_tuxsuite_defconfigs
588+
- check_cache
589+
- check_patches
590+
name: ARCH=arm64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=23 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
591+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
592+
env:
593+
ARCH: arm64
594+
LLVM_VERSION: 23
595+
BOOT: 1
596+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
597+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
598+
container:
599+
image: ghcr.io/clangbuiltlinux/qemu
600+
options: --ipc=host
601+
steps:
602+
- uses: actions/checkout@v4
603+
with:
604+
submodules: true
605+
- uses: actions/download-artifact@v4
606+
with:
607+
name: output_artifact_defconfigs
608+
- uses: actions/download-artifact@v4
609+
with:
610+
name: boot_utils_json_defconfigs
611+
- name: Check Build and Boot Logs
612+
run: scripts/check-logs.py
584613
_b33f45999dde0d55df4cf3ec1e8ed032:
585614
runs-on: ubuntu-latest
586615
needs:
@@ -1306,6 +1335,35 @@ jobs:
13061335
name: boot_utils_json_defconfigs
13071336
- name: Check Build and Boot Logs
13081337
run: scripts/check-logs.py
1338+
_d87aa011a45011e76ad925cf2f82fd67:
1339+
runs-on: ubuntu-latest
1340+
needs:
1341+
- kick_tuxsuite_defconfigs
1342+
- check_cache
1343+
- check_patches
1344+
name: ARCH=x86_64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=23 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1345+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
1346+
env:
1347+
ARCH: x86_64
1348+
LLVM_VERSION: 23
1349+
BOOT: 1
1350+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1351+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
1352+
container:
1353+
image: ghcr.io/clangbuiltlinux/qemu
1354+
options: --ipc=host
1355+
steps:
1356+
- uses: actions/checkout@v4
1357+
with:
1358+
submodules: true
1359+
- uses: actions/download-artifact@v4
1360+
with:
1361+
name: output_artifact_defconfigs
1362+
- uses: actions/download-artifact@v4
1363+
with:
1364+
name: boot_utils_json_defconfigs
1365+
- name: Check Build and Boot Logs
1366+
run: scripts/check-logs.py
13091367
kick_tuxsuite_distribution_configs:
13101368
name: TuxSuite (distribution_configs)
13111369
runs-on: ubuntu-latest

‎.github/workflows/next-clang-20.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,35 @@ jobs:
581581
name: boot_utils_json_defconfigs
582582
- name: Check Build and Boot Logs
583583
run: scripts/check-logs.py
584+
_6c8c4b213e110c4f08eb7e085634e324:
585+
runs-on: ubuntu-latest
586+
needs:
587+
- kick_tuxsuite_defconfigs
588+
- check_cache
589+
- check_patches
590+
name: ARCH=arm64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=20 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
591+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
592+
env:
593+
ARCH: arm64
594+
LLVM_VERSION: 20
595+
BOOT: 1
596+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
597+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
598+
container:
599+
image: ghcr.io/clangbuiltlinux/qemu
600+
options: --ipc=host
601+
steps:
602+
- uses: actions/checkout@v4
603+
with:
604+
submodules: true
605+
- uses: actions/download-artifact@v4
606+
with:
607+
name: output_artifact_defconfigs
608+
- uses: actions/download-artifact@v4
609+
with:
610+
name: boot_utils_json_defconfigs
611+
- name: Check Build and Boot Logs
612+
run: scripts/check-logs.py
584613
_00d242509831af2449f3ce0f1af4ca66:
585614
runs-on: ubuntu-latest
586615
needs:
@@ -1306,6 +1335,35 @@ jobs:
13061335
name: boot_utils_json_defconfigs
13071336
- name: Check Build and Boot Logs
13081337
run: scripts/check-logs.py
1338+
_aff202b84840ac29363c42ea5d6f640b:
1339+
runs-on: ubuntu-latest
1340+
needs:
1341+
- kick_tuxsuite_defconfigs
1342+
- check_cache
1343+
- check_patches
1344+
name: ARCH=x86_64 LLVM=1 LLVM_IAS=1 LLVM_VERSION=20 defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1345+
if: ${{ needs.check_cache.outputs.status != 'pass' }}
1346+
env:
1347+
ARCH: x86_64
1348+
LLVM_VERSION: 20
1349+
BOOT: 1
1350+
CONFIG: defconfig+hardening.config+CONFIG_LTO_CLANG_FULL=y
1351+
REPO_SCOPED_PAT: ${{ secrets.REPO_SCOPED_PAT }}
1352+
container:
1353+
image: ghcr.io/clangbuiltlinux/qemu
1354+
options: --ipc=host
1355+
steps:
1356+
- uses: actions/checkout@v4
1357+
with:
1358+
submodules: true
1359+
- uses: actions/download-artifact@v4
1360+
with:
1361+
name: output_artifact_defconfigs
1362+
- uses: actions/download-artifact@v4
1363+
with:
1364+
name: boot_utils_json_defconfigs
1365+
- name: Check Build and Boot Logs
1366+
run: scripts/check-logs.py
13091367
_f437c8b1a07cf6191adb631b0b73eb0b:
13101368
runs-on: ubuntu-latest
13111369
needs:

0 commit comments

Comments
 (0)