Stage 06 and the acceptance refuse an executable file build/config/image-programs.txt does not name

.github/workflows/ci.yml

@@ -344,8 +344,11 @@ jobs:
           ./tools/fetch-sources.sh --list \
             | awk '$1 == "linux" || $1 == "linux-hardened" || $1 == "kernel-hardening-checker" {print $3}' \
             | while read -r u; do
-                echo "fetching $(basename "$u")"
-                curl -fL --no-progress-meter -o "sources/$(basename "$u")" "$u"
+                f="$(basename "$u")"
+                echo "fetching $f"
+                curl -fL --no-progress-meter -o "sources/$f" "$u"
+                # Before anything unpacks it: resolving the config runs the kernel tree's own make and scripts.
+                awk -v f="$f" '$2 == f' sources.lock | (cd sources && sha256sum --check --strict -)
               done
           ./tools/validate-kernel-config.sh
           ./tools/validate-kernel-config.sh --hardened

.github/workflows/distro.yml

@@ -244,10 +244,17 @@ jobs:
         run: |
           want="$(sed -n 's/.*  rustc-\([0-9.]*\)-x86_64-unknown-linux-gnu\.tar\.xz$/\1/p' build/config/rust.lock)"
           rustc --version | grep -qF "rustc ${want} " || { echo "refusing to build what ships with $(rustc --version); the pin is ${want}"; exit 1; }
+          # The checkout's, cargo's and the target directory's paths would land in panic
+          # locations, which then differ between two builds of one tree.
+          home="${CARGO_HOME:-$HOME/.cargo}"
+          export RUSTFLAGS="--remap-path-prefix=${GITHUB_WORKSPACE}=/kryptik --remap-path-prefix=${home}=/cargo --remap-path-prefix=${CARGO_TARGET_DIR}=/target"
           (cd compartments/kryptikd && cargo build --locked --release --target x86_64-unknown-linux-musl)
           (cd compositor && cargo build --locked --release --target x86_64-unknown-linux-musl -p wlproxy --bin kryptik-wlproxy)
           cp /mnt/kryptik/cargo/x86_64-unknown-linux-musl/release/kryptikd /mnt/kryptik/kryptikd-musl
           cp /mnt/kryptik/cargo/x86_64-unknown-linux-musl/release/kryptik-wlproxy /mnt/kryptik/kryptik-wlproxy-musl
+          for b in /mnt/kryptik/kryptikd-musl /mnt/kryptik/kryptik-wlproxy-musl; do
+            ! grep -aqF -e "$GITHUB_WORKSPACE" -e "$home" -e "$CARGO_TARGET_DIR" "$b" || { echo "$b names a path of this build"; exit 1; }
+          done
           file /mnt/kryptik/kryptikd-musl /mnt/kryptik/kryptik-wlproxy-musl
           # The licence texts build/licences ships for what they link.
           tools/check-rust-licences.sh /mnt/kryptik/rust-dist

Makefile

@@ -25,6 +25,13 @@ KRYPTIK_JOBS    ?=
 KRYPTIK_STALE   ?= refuse
 # Stamped into /etc/os-release; --dirty so an image never claims a clean tree.
 KRYPTIK_BUILD_COMMIT ?= $(shell git -C "$(ROOT)" describe --always --dirty --abbrev=40 2>/dev/null || echo unknown)
+# The time every timestamp the build writes is set or clamped to: the commit's (docs/design/reproducible-builds.md).
+# Without .git, as in the source bundle, the Makefile's time is the commit's: git archive stamps every member with it.
+SOURCE_DATE_EPOCH ?= $(shell git -C "$(ROOT)" log -1 --format=%ct 2>/dev/null || stat -c %Y "$(ROOT)/Makefile" 2>/dev/null)
+# Never exported empty: GCC refuses a SOURCE_DATE_EPOCH that is not a number.
+ifneq ($(SOURCE_DATE_EPOCH),)
+export SOURCE_DATE_EPOCH
+endif
 # kryptikd and kryptik-wlproxy are static Rust binaries built outside the
 # chroot and installed by stage 04.
 KRYPTIK_KRYPTIKD_BIN ?=
@@ -71,6 +78,7 @@ CHROOT_ENV := KRYPTIK_ROOT="$(ROOT)" \
               KRYPTIK_JOBS="$(KRYPTIK_JOBS)" \
               KRYPTIK_STALE="$(KRYPTIK_STALE)" \
               KRYPTIK_BUILD_COMMIT="$(KRYPTIK_BUILD_COMMIT)" \
+              $(if $(SOURCE_DATE_EPOCH),SOURCE_DATE_EPOCH="$(SOURCE_DATE_EPOCH)") \
               KRYPTIK_KRYPTIKD_BIN="$(KRYPTIK_KRYPTIKD_BIN)" \
               KRYPTIK_WLPROXY_BIN="$(KRYPTIK_WLPROXY_BIN)" \
               TERM="$(TERM)" \
@@ -414,12 +422,12 @@ smoke-userspace:
 # --- build output -----------------------------------------------------------
 
 # Reads the ELF headers of what stage 04 installed: a package can ignore the
-# hardening flags without failing its build.
+# hardening flags without failing its build. Stage 06 strips what ships, not the sysroot.
 audit-artifacts:
-	@"$(TOOLS)"/check-artifact-hardening.sh "$(KRYPTIK_WORK)/sysroot"
+	@"$(TOOLS)"/check-artifact-hardening.sh "$(KRYPTIK_WORK)/sysroot" --unstripped
 
 audit-artifacts-strict:
-	@"$(TOOLS)"/check-artifact-hardening.sh "$(KRYPTIK_WORK)/sysroot" --strict
+	@"$(TOOLS)"/check-artifact-hardening.sh "$(KRYPTIK_WORK)/sysroot" --unstripped --strict
 
 # A record of the tree and of what produced it.
 manifest:

README.md

@@ -105,24 +105,29 @@ the firmware from the pinned linux-firmware release
 
 - **Storage:** NVMe (including Intel VMD), AHCI and PIIX SATA, eMMC and SD on
   SDHCI, LSI MegaRAID and MPT3 SAS, HPE Smart Array, USB mass storage and UAS,
-  virtio, VMware PVSCSI, Hyper-V.
+  virtio, VMware PVSCSI, Hyper-V. The disk Kryptik installs to needs 512-byte
+  logical sectors: 512e is fine, and a 4Kn disk is refused.
 - **Wired network:** Intel e1000/e1000e, igb, igc, ixgbe, i40e; Broadcom tg3
   and bnxt; Realtek r8169; Aquantia AQtion; Mellanox ConnectX-4 and later;
   USB adapters (AX88179, RTL8152); virtio, VMware vmxnet3, Hyper-V.
 - **Wi-Fi:** Intel from the 7260 on; Qualcomm QCA6174, QCA9377, QCA6390,
-  WCN6855, WCN7850; MediaTek MT7921, MT7922, MT7925; Realtek rtw88, rtw89 and
-  rtl8xxxu; Broadcom over PCIe. The net zone owns the radio
+  WCN6855, QCA2066, QCA6698AQ, WCN7850; MediaTek MT7920, MT7921, MT7922,
+  MT7925; Realtek rtw88, rtw89 and rtl8xxxu (not its RTL8188CU and RTL8192CU
+  sticks); Broadcom over PCIe. The net zone owns the radio
   ([net zone design](docs/design/net-zone.md)). No Bluetooth.
 - **Display:** the firmware framebuffer (simpledrm) everywhere; Intel (i915,
-  xe) and AMD (amdgpu) with their firmware; ASPEED and Matrox server BMCs;
-  virtio-gpu, VMware SVGA, Hyper-V. NVIDIA machines use the firmware
-  framebuffer. The compositor renders with pixman, so no GPU acceleration is
-  needed.
+  xe) and AMD from GCN 3 on (amdgpu) with their firmware; ASPEED and Matrox
+  server BMCs; virtio-gpu, VMware SVGA, Hyper-V. NVIDIA machines, and AMD's
+  GCN 1 and 2 parts, use the firmware framebuffer. The compositor renders
+  with pixman, so no GPU acceleration is needed.
 - **Input:** USB HID, PS/2, I2C touchpads and touchscreens on Intel and AMD
   laptops, VMware and Hyper-V input.
 
-CPU microcode for Intel and AMD is built into the signed kernel. Hyper-V
-trusts only Microsoft's keys, so run Kryptik there with Secure Boot off.
+CPU microcode for Intel and AMD is built into the signed kernel. On a Zen 5
+processor, and a few EPYC models, the kernel loads it only once the machine's
+firmware has AMD's 2025 microcode-signature fix
+([user guide](docs/user-guide.md#1-boot-the-medium)). Hyper-V trusts only
+Microsoft's keys, so run Kryptik there with Secure Boot off.
 
 A machine outside that list boots a kernel that cannot find its disk or its
 network. Adding a driver is one line in the fragment, a firmware file one line

build/config/artifact-accepted.txt

@@ -20,3 +20,93 @@ RPATH   usr/lib/libcc1.so.*          /usr/lib/../lib     # libtool, in GCC's bui
 RPATH   usr/lib/gcc/*/*/plugin/libc[cp]1plugin.so.*  /usr/lib/../lib   # the same
 RPATH   usr/lib/libskarnet.so.*      /usr/lib            # skalibs' own link line
 RPATH   usr/lib/perl5/*/auto/Time/HiRes/HiRes.so  /usr/lib   # Time::HiRes, linking librt
+
+# No canary anywhere in the object's code. -fstack-protector-strong (in CFLAGS, and GCC's default
+# here) guards only functions with a local array or an address-taken local; these have none.
+NO-SSP  usr/bin/bzip2recover        # no function with a local array or an address-taken local
+NO-SSP  usr/bin/exch                # the same
+NO-SSP  usr/bin/getconf             # the same
+NO-SSP  usr/libexec/getconf/*       # getconf again, under the names of the specifications it reports
+NO-SSP  usr/bin/rev                 # no function with a local array or an address-taken local
+NO-SSP  usr/bin/s6-linux-init-nuke  # the same
+NO-SSP  usr/lib/bash/basename       # the same
+NO-SSP  usr/lib/bash/csv            # the same
+NO-SSP  usr/lib/bash/dirname        # the same
+NO-SSP  usr/lib/bash/dsv            # the same
+NO-SSP  usr/lib/bash/getconf        # the same
+NO-SSP  usr/lib/bash/head           # the same
+NO-SSP  usr/lib/bash/logname        # the same
+NO-SSP  usr/lib/bash/mkfifo         # the same
+NO-SSP  usr/lib/bash/mypid          # the same
+NO-SSP  usr/lib/bash/printenv       # the same
+NO-SSP  usr/lib/bash/push           # the same
+NO-SSP  usr/lib/bash/rmdir          # the same
+NO-SSP  usr/lib/bash/sync           # the same
+NO-SSP  usr/lib/bash/tee            # the same
+NO-SSP  usr/lib/bash/truefalse      # the same
+NO-SSP  usr/lib/bash/tty            # the same
+NO-SSP  usr/lib/bash/unlink         # the same
+NO-SSP  usr/lib/bash/whoami         # the same
+NO-SSP  usr/lib/gawk/revtwoway.so   # the same
+NO-SSP  usr/libexec/awk/grcat       # the same
+NO-SSP  usr/libexec/awk/pwcat       # the same
+NO-SSP  usr/lib/libfl.so.2.*        # the same
+NO-SSP  usr/lib/libmvec.so.1        # the same
+NO-SSP  usr/lib/libpanelw.so.6.*    # the same
+NO-SSP  usr/lib/libwayland-egl.so.1.*  # the same
+NO-SSP  usr/lib/gconv/libCNS.so     # glibc's conversion tables, with no function that takes a buffer
+NO-SSP  usr/lib/gconv/libGB.so      # the same
+NO-SSP  usr/lib/gconv/libISOIR165.so  # the same
+NO-SSP  usr/lib/gconv/libJIS.so     # the same
+NO-SSP  usr/lib/gconv/libJISX0213.so  # the same
+NO-SSP  usr/lib/gconv/libKSC.so     # the same
+NO-SSP  usr/lib/perl5/*/auto/Devel/Peek/Peek.so          # no function with a local array or an address-taken local
+NO-SSP  usr/lib/perl5/*/auto/Encode/Byte/Byte.so         # Encode's conversion tables, with no function that takes a buffer
+NO-SSP  usr/lib/perl5/*/auto/Encode/CN/CN.so             # the same
+NO-SSP  usr/lib/perl5/*/auto/Encode/EBCDIC/EBCDIC.so     # the same
+NO-SSP  usr/lib/perl5/*/auto/Encode/JP/JP.so             # the same
+NO-SSP  usr/lib/perl5/*/auto/Encode/KR/KR.so             # the same
+NO-SSP  usr/lib/perl5/*/auto/Encode/Symbol/Symbol.so     # the same
+NO-SSP  usr/lib/perl5/*/auto/Encode/TW/TW.so             # the same
+NO-SSP  usr/lib/perl5/*/auto/Fcntl/Fcntl.so              # no function with a local array or an address-taken local
+NO-SSP  usr/lib/perl5/*/auto/File/DosGlob/DosGlob.so     # the same
+NO-SSP  usr/lib/perl5/*/auto/Filter/Util/Call/Call.so    # the same
+NO-SSP  usr/lib/perl5/*/auto/I18N/Langinfo/Langinfo.so   # the same
+NO-SSP  usr/lib/python3.*/lib-dynload/_contextvars.cpython-*.so          # the same
+NO-SSP  usr/lib/python3.*/lib-dynload/_heapq.cpython-*.so                # the same
+NO-SSP  usr/lib/python3.*/lib-dynload/_statistics.cpython-*.so           # the same
+NO-SSP  usr/sbin/accessdb           # the same
+NO-SSP  usr/sbin/findfs             # the same
+NO-SSP  usr/sbin/nologin            # the same
+NO-SSP  usr/sbin/pivot_root         # the same
+NO-SSP  usr/bin/perl                # its main() hands everything to libperl, which carries the canaries
+NO-SSP  usr/bin/perl5.*             # the same
+NO-SSP  usr/bin/python3.*           # its main() hands everything to libpython, which carries the canaries
+NO-SSP  usr/lib/libpython3.so       # the stable-ABI library forwards to libpython and has no code of its own
+NO-SSP  usr/lib/engines-3/capi.so   # OpenSSL's CAPI engine wraps a Windows API: on Linux it builds empty
+NO-SSP  usr/lib/libanl.so.1         # glibc 2.34 moved this library's code into libc, leaving an empty stub
+NO-SSP  usr/lib/libdl.so.2          # the same
+NO-SSP  usr/lib/libpthread.so.0     # the same
+NO-SSP  usr/lib/librt.so.1          # the same
+NO-SSP  usr/lib/libutil.so.1        # the same
+NO-SSP  usr/lib/libnss_dns.so.2     # the same
+NO-SSP  usr/lib/libnss_files.so.2   # the same
+NO-SSP  usr/lib/ld-linux-x86-64.so.2  # glibc builds the loader without the stack protector: the loader sets up the guard
+NO-SSP  usr/lib/libgcc_s.so.1       # GCC builds libgcc with -fno-stack-protector: it runs beneath any stack guard
+NO-SSP  usr/bin/kryptikd            # Rust: stable rustc has no stack protector, and safe Rust checks every index
+NO-SSP  usr/bin/kryptik-wlproxy     # the same
+
+# Imports of calls that _FORTIFY_SOURCE=2 or 3 always turns into _chk ones.
+NO-FORTIFY  usr/bin/pldd            # glibc builds elf/, dlfcn/, csu/ and debug/ without FORTIFY (Makeconfig's do-fortify): the loader's bootstrap and the checks themselves
+NO-FORTIFY  usr/bin/sprof           # the same: elf/
+NO-FORTIFY  usr/lib/audit/sotruss-lib.so  # the same: elf/
+NO-FORTIFY  usr/bin/pcprofiledump   # the same: debug/
+NO-FORTIFY  usr/bin/gawk            # passes fprintf as its printing function (print_vars, pp_string_fp, the debugger's print_func)
+NO-FORTIFY  usr/bin/gawk-*          # the same
+NO-FORTIFY  usr/bin/msg*            # gettext's bundled libxml, linked into each tool, keeps fprintf as its error channel
+NO-FORTIFY  usr/bin/xgettext        # the same
+NO-FORTIFY  usr/lib/gettext/cldr-plurals  # the same
+NO-FORTIFY  usr/bin/objdump         # passes fprintf as the disassembler's print function (fprintf_func)
+NO-FORTIFY  usr/lib/libbfd-*.so     # passes fprintf as the print callback of its error output (_bfd_doprnt)
+NO-FORTIFY  usr/lib/libgmp.so.*     # gmp_printf's output tables hold vfprintf and obstack_vprintf
+NO-FORTIFY  usr/bin/bison           # one plain fprintf import beside its fortified calls, from code not yet found: no fprintf taken as a value in bison's tree

build/config/firmware-accepted.txt

@@ -0,0 +1,39 @@
+# Firmware a shipped module names (MODULE_FIRMWARE) that linux-firmware has and the image leaves
+# out; tools/check-firmware-requested.sh fails on any other, and on an entry that matches none.
+#   PATTERN   # why (a glob over linux-firmware's names)
+
+# ath10k asks for its newest API file first, and that one ships.
+ath10k/QCA6174/hw3.0/firmware-4.bin   # firmware-6 ships
+ath10k/QCA9377/hw1.0/firmware-5.bin   # firmware-6 ships
+
+# Access point and add-in card chips: the list carries the laptop parts (ADR-012).
+ath10k/QCA988X/*        # QCA9880 and QCA9882
+ath10k/QCA9887/*        # an access point part
+ath11k/QCN9074/*        # an access point part
+
+# A variant directory is read only when a devicetree names it, and an x86 machine has none.
+ath11k/*/nfa765/*       # ath11k_core_create_firmware_path: firmware-name, or three Qualcomm Arm boards
+
+# rtl8xxxu lists the 8192CU's ids only under RTL8XXXU_UNTESTED, which this kernel leaves unset.
+rtlwifi/rtl8192cufw_*   # no 8192CU stick binds
+
+# e100 runs a D101M or D101S without its microcode, which only adds receive bundling (CPUSaver).
+e100/d101[ms]_ucode.bin # optional
+
+# amdgpu binds no CIK part without DRM_AMDGPU_CIK, but code it shares with Topaz and with later
+# parts' power management names Bonaire's and Hawaii's files (gmc_v7_0.c, smumgr.c).
+amdgpu/bonaire_*        # CIK
+amdgpu/hawaii_*         # CIK
+
+# Instinct accelerators compute and have no display; without KFD (HSA_AMD) nothing here uses one.
+amdgpu/aldebaran_*      # Instinct
+amdgpu/arcturus_*       # Instinct
+amdgpu/gc_9_4_[34]_*    # Instinct
+amdgpu/gc_9_5_0_*       # Instinct
+amdgpu/psp_13_0_6_*     # Instinct
+amdgpu/psp_13_0_12_*    # Instinct
+amdgpu/psp_13_0_14_*    # Instinct
+amdgpu/sdma_4_4_[245].bin  # Instinct
+amdgpu/smu_13_0_6.bin   # Instinct
+amdgpu/smu_13_0_14.bin  # Instinct
+amdgpu/vcn_4_0_3.bin    # Instinct