chris/comodore-iec-emu
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 4 Wiki Activity

Add 1:6.18.34-1+rpt1 kernel support #1

Merged
chris merged 3 commits from chris-patch-1 into master 2026-06-19 21:17:50 +02:00
Conversation 0 Commits 3 Files Changed 4 +17 -1
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit de2fb56a59 - Show all commits

7
docs/kernel-notes.md
View File

@ -182,6 +182,13 @@ only its own latest kernel, so a trixie-era version against a `bookworm` base
fails with `Version '…' was not found`. Find the Pi's suite with
`. /etc/os-release; echo "$VERSION_CODENAME"` (or `lsb_release -cs`).
**trixie SHA1 caveat.** On trixie, apt verifies signatures with Sequoia (`sqv`),
whose crypto policy rejects SHA1 since 2026-02-01. The raspberrypi archive key's
binding self-signature is SHA1, so trixie's apt rejects the repo as *"not
signed"* (`Policy rejected … SHA1 is not considered secure …`). The Dockerfile
works around this by marking the raspberrypi repo `trusted=yes` **only when
`DEBIAN_SUITE=trixie`**; bookworm (gpgv) keeps full signature verification.
**Find the exact values for *your* Pi** — run this on the Pi (e.g. over SSH); it
prints the two lines ready to copy into the `build-in-docker.sh` invocation:

11
kernel/Dockerfile
View File

@ -27,11 +27,20 @@ FROM --platform=linux/arm64 debian:${DEBIAN_SUITE}
ARG DEBIAN_SUITE=bookworm
# The raspberrypi kernel/headers live in the raspberrypi.com archive, not Debian.
#
# On trixie, apt verifies signatures with Sequoia (sqv), whose crypto policy
# rejects SHA1 since 2026-02-01. The raspberrypi archive key's binding
# self-signature is SHA1, so trixie's apt refuses the repo as "not signed"
# (bookworm's gpgv doesn't enforce this). We mark the repo trusted=yes *only on
# trixie* to bypass that check; bookworm keeps full signature verification. The
# key is still fetched over HTTPS and pinned via signed-by where it is honoured.
RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates curl gnupg \
&& curl -fsSL https://archive.raspberrypi.com/debian/raspberrypi.gpg.key \
| gpg --dearmor -o /usr/share/keyrings/raspberrypi-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \
&& opts="signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg" \
&& if [ "$DEBIAN_SUITE" = "trixie" ]; then opts="$opts trusted=yes"; fi \
&& echo "deb [$opts] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \
> /etc/apt/sources.list.d/raspi.list \
&& rm -rf /var/lib/apt/lists/*