Skip to content

fix(ci): use edera's forked ccache with .incbin fix #234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bleggett merged 1 commit into from
Aug 5, 2026
+11 −4
Merged

fix(ci): use edera's forked ccache with .incbin fix #234

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions Dockerfile.buildenv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
# update silently turns a build into a 100% cache miss. The image is rebuilt on
# a schedule (see .github/workflows/buildenv.yml); the kernel Dockerfile pins
# it by digest and dependabot proposes bumps as reviewable PRs.

FROM debian:bookworm@sha256:9344f8b8992482f80cba753f323adeaf17690076c095ccff6cc9536be98185dc

RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
Expand All @@ -21,9 +22,15 @@ RUN if [ "${TARGETARCH}" = "amd64" ]; then \
RUN if [ "${TARGETARCH}" = "arm64" ]; then \
apt-get update && apt-get install -y linux-headers-arm64 g++-x86-64-linux-gnu gcc-x86-64-linux-gnu && rm -rf /var/lib/apt/lists/*; fi

ARG SCCACHE_VERSION=0.16.0
ARG SCCACHE_SHA256_AMD64=aec995a83ad3dff3d14b6314e08858b7b73d35ca85a5bcf3d3a9ec07dee35588
ARG SCCACHE_SHA256_ARM64=f73a5c39f96bb6ebb89cc7915cf182260d4cbf30765322c5e793d0fe8bd80784
# Use the edera fork, specifically because upstream serves a stale cached object
# for any translation unit using the assembler's `.incbin` or `.include`, because
# the file those name is read by the assembler and so never appears in the
# preprocessor output sccache hashes. That silently gave us kernels whose modules
# were signed with a key absent from their own builtin keyring, which is (pardon
# my french) a fucking nasty bug.
ARG SCCACHE_VERSION=0.16.0-edera3
ARG SCCACHE_SHA256_AMD64=06b5d11b457d0bc138736b29bee249ed048b1babd3d8fc8406231749a883a522
ARG SCCACHE_SHA256_ARM64=b39e2e72082dfb9ea93694ee5b4cea9ccc57a74cae5147afed130eb966108c94
# The wrappers must reference the real compiler by absolute path: /usr/lib/sccache
# is first in PATH, so a bare compiler name would resolve back to the wrapper
# itself and recurse.
Expand All @@ -33,7 +40,7 @@ RUN case "${TARGETARCH}" in \
*) echo "unsupported TARGETARCH ${TARGETARCH}" >&2; exit 1 ;; \
esac && \
SCCACHE_DIST="sccache-v${SCCACHE_VERSION}-${SCCACHE_ARCH}-unknown-linux-musl" && \
curl -Lf -o /tmp/sccache.tar.gz "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/${SCCACHE_DIST}.tar.gz" && \
curl -Lf -o /tmp/sccache.tar.gz "https://github.com/edera-dev/sccache/releases/download/v${SCCACHE_VERSION}/${SCCACHE_DIST}.tar.gz" && \
echo "${SCCACHE_SHA256} /tmp/sccache.tar.gz" | sha256sum -c - && \
tar -xz -C /tmp -f /tmp/sccache.tar.gz && \
install -m 0755 "/tmp/${SCCACHE_DIST}/sccache" /usr/local/bin/sccache && \
Expand Down
Loading