Skip to content

Ubuntu noble #693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stackunderfl0w wants to merge 3 commits into
base: ubuntu-noble
Choose a base branch
from
Open

Ubuntu noble #693

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62294ce
fix: Remove libgcrypt20-hmac from FIPS_PKGS
stackunderfl0w Jul 10, 2026
be65647
fix: FIPS kernel version for noble
stackunderfl0w Jul 10, 2026
1ed694c
fix: Update FIPS spec package lists for noble
stackunderfl0w Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
fips-initramfs
kcapi-tools
libgcrypt20-hmac:amd64
libkcapi1:amd64
linux-aws-fips
linux-aws-fips-headers-5.15
linux-headers-5.15-aws-fips
linux-aws-fips-headers-6.8
linux-headers-6.8-aws-fips
linux-headers-aws-fips
linux-image-5.15-aws-fips
linux-image-6.8-aws-fips
linux-image-aws-fips
linux-image-hmac-5.15-aws-fips
linux-modules-5.15-aws-fips
linux-image-hmac-6.8-aws-fips
linux-modules-6.8-aws-fips
microcode-initrd
openssl-fips-module-3:amd64
13 changes: 6 additions & 7 deletions bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
fips-initramfs
kcapi-tools
libgcrypt20-hmac:amd64
libkcapi1:amd64
linux-fips
linux-fips-headers-5.15
linux-headers-5.15-fips
linux-fips-headers-6.8
linux-headers-6.8-fips
linux-headers-fips
linux-image-5.15-fips
linux-image-6.8-fips
linux-image-fips
linux-image-hmac-5.15-fips
linux-modules-5.15-fips
linux-modules-extra-5.15-fips
linux-image-hmac-6.8-fips
linux-modules-6.8-fips
linux-modules-extra-6.8-fips
openssl-fips-module-3:amd64
4 changes: 2 additions & 2 deletions bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ libfribidi0:amd64
libfuse3-3:amd64
libgcc-13-dev:amd64
libgcc-s1:amd64
libgcrypt20-dev
libgcrypt20-dev:amd64
libgcrypt20:amd64
libgdbm-compat4t64:amd64
libgdbm6t64:amd64
Expand All @@ -209,7 +209,7 @@ libglib2.0-data
libgmp10:amd64
libgnutls30t64:amd64
libgomp1:amd64
libgpg-error-dev
libgpg-error-dev:amd64
libgpg-error0:amd64
libgprofng0:amd64
libgssapi-krb5-2:amd64
Expand Down
5 changes: 2 additions & 3 deletions stemcell_builder/lib/prelude_apply.bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,8 @@ function update_kernel_static_libraries {
sed -i "s/__KERNEL_VERSION__/$kernel_version/g" $chroot/var/vcap/bosh/etc/static_libraries_list

# since kernel 6.5 the objtool/libsubcmd.a has been moved to objtool/libsubcmd/libsubcmd.a
# fips still uses the 5.9 kernel, so we need to rewrite the static_libraries_list file to the old path
# TODO: puting a todo tag here as this could probably be removed in the future if the kernel version gets bumped
if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then
# older fips kernels (5.x) used the old path, so rewrite only for those
if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then
sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list
Comment on lines +62 to 64

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate file =="
git ls-files | grep -F 'stemcell_builder/lib/prelude_apply.bash' || true

echo "== relevant lines =="
if [ -f stemcell_builder/lib/prelude_apply.bash ]; then
  nl -ba stemcell_builder/lib/prelude_apply.bash | sed -n '1,120p'
fi

echo "== usages of major_kernel_version =="
rg -n "major_kernel_version|update_kernel_static_libraries|stemcell_operating_system_variant" stemcell_builder || true

echo "== local shell comparison behavior probe =="
python3 - <<'PY'
from pathlib import Path
p = Path("stemcell_builder/lib/prelude_apply.bash")
text = p.read_text() if p.exists() else ""
if "update_kernel_static_libraries" in text:
    print("found target function in stemcell_builder/lib/prelude_apply.bash")
PY

printf '%s\n' '[[ "5.15" < "6.0" ]]='  && ( [[ "5.15" < "6.0" ]] && true || false )
printf '%s\n' '[[ "6.8" < "6.0" ]]='  && ( [[ "6.8" < "6.0" ]] && true || false )
printf '%s\n' '[[ "10.0" < "6.0" ]]=' && ( [[ "10.0" < "6.0" ]] && true || false )
printf '%s\n' 'lexical ordering: "10.0" < "6.0"? '
[[ "10.0" < "6.0" ]] && printf '%s\n' 'true' || printf '%s\n' 'false'

Repository: cloudfoundry/bosh-linux-stemcell-builder

Length of output: 297

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant lines =="
awk '{printf "%6d\t%s\n", NR, $0}' stemcell_builder/lib/prelude_apply.bash | sed -n '45,80p'

echo "== usages of major_kernel_version/usages =="
rg -n "major_kernel_version|update_kernel_static_libraries|stemcell_operating_system_variant" stemcell_builder || true

echo "== local shell lexical comparison behavior probe =="
set +e
( [[ "5.15" < "6.0" ]] && printf '%s\n' '5.15<6.0 true' ) || printf '%s\n' '5.15<6.0 false'
( [[ "6.8" < "6.0" ]] && printf '%s\n' '6.8<6.0 true' ) || printf '%s\n' '6.8<6.0 false'
( [[ "10.0" < "6.0" ]] && printf '%s\n' '10.0<6.0 true' ) || printf '%s\n' '10.0<6.0 false'
set -e

Repository: cloudfoundry/bosh-linux-stemcell-builder

Length of output: 2397

Compare the numeric kernel major version, not dotted strings.

Context

The current condition uses lexical ordering, where 10.0 would be sorted below 6.0 and rerun the FIPS static-library rewrite for kernels that should keep the newer path. Compare the first component instead.

Proposed fix 
 function update_kernel_static_libraries {
   kernel_suffix=${1}
   major_kernel_version=${2}
+  kernel_major=${major_kernel_version%%.*}

   suffix=$kernel_suffix
   ...
-  if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then
+  if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# older fips kernels (5.x) used the old path, so rewrite only for those
if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then
sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list
# older fips kernels (5.x) used the old path, so rewrite only for those
kernel_major=${major_kernel_version%%.*}
if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then
sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list
🧰 Tools
🪛 Shellcheck (0.11.0)

[warning] 63-63: stemcell_operating_system_variant is referenced but not assigned.

(SC2154)

[error] 63-63: Decimals are not supported. Either use integers only, or use bc or awk to compare.

(SC2072)

[info] 64-64: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@stemcell_builder/lib/prelude_apply.bash` around lines 62 - 64, Update the
condition in the FIPS rewrite block to extract and numerically compare the
kernel’s major component against 6, rather than comparing dotted version strings
lexically. Preserve the existing rewrite behavior only for FIPS kernels with a
numeric major version below 6.

Source: Linters/SAST tools

@a-hassanin a-hassanin Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stackunderfl0w can you please check this.

fi
}
2 changes: 1 addition & 1 deletion stemcell_builder/stages/base_fips_apt/apply.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ source $base_dir/lib/prelude_bosh.bash
mount --bind /sys "$chroot/sys"
add_on_exit "umount $chroot/sys"

FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-hmac libgcrypt20-dev"
FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-dev"

mock_grub_probe
ua_attach
Expand Down
2 changes: 1 addition & 1 deletion stemcell_builder/stages/static_libraries_config/apply.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then
# TODO use iaas specific kernel
# kernel_suffix="-${stemcell_infrastructure}-fips"
kernel_suffix="-fips"
major_kernel_version="5.15"
major_kernel_version="6.8"
fi

update_kernel_static_libraries ${kernel_suffix} ${major_kernel_version}
Loading