spec: relax UKI systemd requirement to 252-31 on RHEL - #1464

Closed

bmastbergen wants to merge 107 commits into

ciq-6.18.y-uki-fix

Commits on Jul 19, 2026

Add CIQ configs

bmastbergen
authored and
github-actions[bot]
committed
df8a987
Add initial CIQ config tweaks

bmastbergen
authored and
github-actions[bot]
committed
fc95ba1
github actions: Make Builds on Merge Request Work

PlaidCat
authored and
github-actions[bot]
committed
6d98822
arm64: add kernel config option to lock down when in Secure Boot mode

Linn Crosetto
authored and
github-actions[bot]
committed
f488044
efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode

dhowells
authored and
github-actions[bot]
committed
791ab43
efi: Lock down the kernel if booted in secure boot mode

bwhacks
authored and
github-actions[bot]
committed
3f27e8e
mtd: phram,slram: Disable when the kernel is locked down

bwhacks
authored and
github-actions[bot]
committed
027894e

Commits on Jul 20, 2026

Add efi_status_to_str() and rework efi_status_to_err().

vathpela
authored and
bmastbergen
committed
7cd4b23
[CIQ] v6.18.3 - rebased configs

github-actions[bot]
authored and
bmastbergen
committed
d968f27
[CIQ] v6.18.7 - rebased configs

github-actions[bot]
authored and
bmastbergen
committed
aa40717
[CIQ] v6.18.9 - rebased configs

github-actions[bot]
authored and
bmastbergen
committed
f3c740e
[CIQ] v6.18.14 - rebased configs

github-actions[bot]
authored and
bmastbergen
committed
4027f35
[CIQ] v6.18.17 - rebased configs

github-actions[bot]
authored and
bmastbergen
committed
fb836b6
configs: Enable INTEL_TDX_HOST for x86_64 configs
bmastbergen
committed
52aac81
Import initial dist-git for 6.18.19
bmastbergen
committed
ef3e79c
kernel.spec: Fix buildid and pkgrelease
bmastbergen
committed
93bc514
Remove gating.yaml
bmastbergen
committed
413b6d3
Update sbat templates
bmastbergen
committed
7cd503b
Ensure all qdiscs are in modules-core
bmastbergen
committed
1b9604b
Remove modules-rt-kvm references
bmastbergen
committed
7dcecbf
Set buildid to .1
bmastbergen
committed
95bd395
rocky: generalize rule for kunit and test kmod placement
bmastbergen
committed
6c7838e
Rename package to kernel-clk6.18
bmastbergen
committed
af650c0
Remove gemini switch
bmastbergen
committed
4df54ca
Add Provides/Conflicts for non-parallel installable kernel-* packages
bmastbergen
committed
4ddf0b7
Rename tool packages with pkg_suffix and add Provides/Conflicts
bmastbergen
committed
f039ce0
Use gzip for symvers compression to match upstream

authored and
bmastbergen
committed
e2529e5
Add +clk6.18 suffix to kernel version string (uname -r)

authored and
bmastbergen
committed
ba31026
Add kernel-clk6.18-default package to set default kernel
bmastbergen
committed
5987852
Consolidate spec version defines and prevent CLK kernel from hijacking boot default

authored and
bmastbergen
committed
36b4d54
Rework -default package and clean up tool subpackage naming

authored and
bmastbergen
committed
8edb5e1
Bundle bindgen-cli from source for Rocky 9.6 builds

authored and
bmastbergen
committed
42c6276
[CIQ] v6.18.20 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
9da6042
[CIQ] v6.18.21 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
e2d7b6b
github actions: Inherit the Kernel CI Automated workflow from main
bmastbergen
committed
1395c98
spec: Skip certificate setup for noarch builds
bmastbergen
committed
e142e72
Update spec for ciq_kernel-6.18.21-2
bmastbergen
committed
16b79ea
github actions: Use trigger for kernelCI
bmastbergen
committed
9fa523d
github actions: Trigger kernelCI on ciq-6.18.y-next branches
bmastbergen
committed
9f7a5e5
[CIQ] v6.18.22 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
fce2440
spec: Fix posttrans script to handle noarch package expansion
bmastbergen
committed
7517092
[CIQ] ciq_kernel-6.18.22-2 - updated spec
bmastbergen
committed
949586a
spec: update branding in package descriptions and log messages
bmastbergen
committed
c61a8c2
github actions: add RPM build workflow for x86_64 and aarch64
bmastbergen
committed
dabbbf5
configs: enable legacy iptables/ip6tables support for all architectures
bmastbergen
committed
8e37826
Add generic kernel Provides to spec
bmastbergen
committed
5b53d48
Add generic kernel-headers and kernel-devel Provides to spec
bmastbergen
committed
d6306f9
bundle_bindgen: add set -e, curl --fail, and SHA256 verification
bmastbergen
committed
45b8ab9
[CIQ] v6.18.27 - rebased configs
bmastbergen
committed
b4b18c4
[CIQ] v6.18.27 - updated spec
bmastbergen
committed
0466f89
generate_tarball: Also strip leading v from tags
bmastbergen
committed
a87bdfa
[CIQ] v6.18.28 - updated spec
bmastbergen
committed
df0014b
[CIQ] ciq_kernel-6.18.28-2 - updated spec
bmastbergen
committed
d571864
[CIQ] v6.18.31 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
4c031ac
[CIQ] v6.18.33 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
eb4d3ad
bundle_bindgen: add User-Agent header to crates.io request
bmastbergen
committed
3708e47
[CIQ] ciq_kernel-6.18.33-2 - updated spec
bmastbergen
committed
032fdab
kernel-clk6.18: require ciq-kmod and ship %clk_version macro file

josephtate
authored and
bmastbergen
committed
f839e74
random: Add hook to override device reads and getrandom(2)

jallisonciq
authored and
bmastbergen
committed
46580ba
crypto: rng - Override drivers/char/random in FIPS mode

jallisonciq
authored and
bmastbergen
committed
6f1cd2b
not upstream: Disable vdso getrandom when FIPS is enabled

jallisonciq
authored and
bmastbergen
committed
2fa1d41
crypto: ecdh - implement FIPS PCT

jallisonciq
authored and
bmastbergen
committed
770d204
crypto: essiv - Zeroize keys on exit in essiv_aead_setkey()

jason-rodri
authored and
bmastbergen
committed
7edac07
crypto: drbg - Align buffers to at least a cache line

kerneltoast
authored and
bmastbergen
committed
36bff85
mm/gup: introduce pin_user_pages_fast_only()

kerneltoast
authored and
bmastbergen
committed
a61a73e
crypto: rng - Convert crypto_default_rng_refcnt into an unsigned int

kerneltoast
authored and
bmastbergen
committed
0a9abf0
crypto: rng - Fix priority inversions due to mutex locks

kerneltoast
authored and
bmastbergen
committed
e265992
crypto: rng - Implement fast per-CPU DRBG instances

kerneltoast
authored and
bmastbergen
committed
0e77146
lib/crypto: Add FIPS self-tests for SHA-1 and SHA-2

Eric Biggers
authored and
bmastbergen
committed
04c11bc
byteorder: Add le64_to_cpu_array() and cpu_to_le64_array()

Eric Biggers
authored and
bmastbergen
committed
7615194
lib/crypto: blake2b: Add BLAKE2b library functions

jallisonciq
authored and
bmastbergen
committed
ec40058
btrfs: switch to library APIs for checksums

jallisonciq
authored and
bmastbergen
committed
583efd4
crypto: testmgr - block Crypto API xxhash64 in FIPS mode

jallisonciq
authored and
bmastbergen
committed
4ae4781
When in fips mode, self-test errors must panic.

jallisonciq
authored and
bmastbergen
committed
dcbc10a
When in fips mode, self-test errors must panic.

jallisonciq
authored and
bmastbergen
committed
4395abd
Change CONFIG_CRYPTO_JITTERENTROPY_OSR from 1 to 3 in all configs.

jallisonciq
authored and
bmastbergen
committed
5264c8e
dh_compute_value misses the check SP800-56Arev3, 5.6.2.1.4 which is typically implemented after dh_is_pubkey_valid.

jallisonciq
authored and
bmastbergen
committed
232d7ac
In crypto_kdf108_ctr_generate() there is no minimum length check for the digest to be generated - it must be at least 112 bits.

jallisonciq
authored and
bmastbergen
committed
1bb6473
Add fips_approved flag to SHA1 and HMAC-SHA1 structs.

jallisonciq
authored and
bmastbergen
committed
f3b31ac
Add fips_approved flag to SHA224 and HMAC-SHA224 structs.

jallisonciq
authored and
bmastbergen
committed
1ed08b1
Add fips_approved flag to SHA256 and HMAC-SHA256 structs.

jallisonciq
authored and
bmastbergen
committed
784a05a
Add fips_approved flag to SHA384 and HMAC-SHA384 structs.

jallisonciq
authored and
bmastbergen
committed
1f50070
Add fips_approved flag to SHA512 and HMAC-SHA512 structs.

jallisonciq
authored and
bmastbergen
committed
40b217e
Add fips_approved indicator to struct crypto_aes_ctx.

jallisonciq
authored and
bmastbergen
committed
13eecd0
Add CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y, CONFIG_CRYPTO_FIPS_VERSION="ciq.6.18.20260531"

jallisonciq
authored and
bmastbergen
committed
0219bd0
Unset CRYPTO_JITTERENTROPY_MEMSIZE_2, set CRYPTO_JITTERENTROPY_MEMSIZE_128.

jallisonciq
authored and
bmastbergen
committed
51cd9fe
github actions: Add FIPS protected directory check for PRs
bmastbergen
committed
602d0c4
Restore CRYPTO_TFM_FIPS_COMPLIANCE flag as an indicator to differentiate between internal and external IV generation when AES-GCM

jallisonciq
authored and
bmastbergen
committed
a2b58e5
[CIQ] v6.18.35 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
ea1b2f7
[CIQ] ciq_kernel-6.18.35-2 - updated spec
bmastbergen
committed
a3176a0
github-actions: extend trigger glob to match suffix branches

shreeya-patel98
authored and
bmastbergen
committed
60a514b
crypto: Kconfig - Make CRYPTO_FIPS depend on the DRBG being built-in

kerneltoast
authored and
bmastbergen
committed
3cf1729
random: Restrict extrng registration to init time

kerneltoast
authored and
bmastbergen
committed
32f7573
crypto: rng - Only allow the DRBG to register as "stdrng" in FIPS mode

kerneltoast
authored and
bmastbergen
committed
a254668
crypto: rng - Fix tabs vs spaces in the per-CPU DRBG code

kerneltoast
authored and
bmastbergen
committed
d12d469
crypto: rng - Make the per-CPU DRBG instances permanent

kerneltoast
authored and
bmastbergen
committed
1cc3f9e
crypto: rng - Skip leading zero-length iovec segments

kerneltoast
authored and
bmastbergen
committed
295c3f2
crypto: rng - Fix spurious EFAULT when the destination PTE is zapped

kerneltoast
authored and
bmastbergen
committed
de10060
Revert "mm/gup: reintroduce pin_user_pages_fast_only()"

kerneltoast
authored and
bmastbergen
committed
bd58c61
[CIQ] ciq_kernel-6.18.35-3 - updated spec
bmastbergen
committed
e92c310
[CIQ] v6.18.36 - rebased configs
bmastbergen
committed
6a25116
[CIQ] v6.18.36 - updated spec
bmastbergen
committed
0ba5e1e
[CIQ] v6.18.38 - updated spec

github-actions[bot]
authored and
bmastbergen
committed
d9c2725
Add x86_64 minimal kernel variant to spec
bmastbergen
committed
e5b8b81
[CIQ] ciq_kernel-6.18.38-2 - updated spec
bmastbergen
committed
8de31e6
[CIQ] v6.18.39 - updated spec
bmastbergen
committed
ceb41d6

Commits on Jul 22, 2026

spec: relax UKI systemd requirement to 252-31 on RHEL
bmastbergen
committed
f484943