Repository navigation
The fourth batch: the security bump (Firefox 153.6, ca-bundle), console and prompt fixes, pin reviews - #656
Merged
Merged
Conversation
The prompt waits for ever, as it must: a passphrase is not to be hurried. But a keyboard whose driver is a module types nothing before eudev runs, and the prompt then sits there with no sign of why. ask gains -h HSECS HINT: the hint is told once on every console when HSECS pass with no answer, and the readers keep reading, so what was typed before it stays in the answer. sysinit tells, after a minute, that a plain USB keyboard types the passphrase. The ask fixture gains two cases: the hint comes once, and a half-typed answer survives it; an answer in time brings no hint.
…he mixer
A codec's parser asks for the control layer that drives the mute and
microphone-mute lights with request_module("snd-ctl-led") (snd_ctl_led_request,
sound/core/control.c), which STATIC_USERMODEHELPER turns away. So on every
laptop whose codec fixup wires those lights (HP's among them, through codec
coefficients), the hda::mute and hda::micmute LEDs never followed the mixer.
sound.conf now loads snd-ctl-led with the codec drivers, ahead of the
controller. It is built already: the Conexant, Senarytech and IDT codec
drivers select SND_HDA_GENERIC_LEDS, through which SND_HDA_GENERIC selects
SND_CTL_LED. Stage 05 fails a build that no longer makes it, as sound.conf
would then name a module that is not there. Its both-ways codec check reads
only snd-hda-codec-* names, so it needs no change.
The mixer kept every card's switches on and muted in software, so the mute and microphone-mute lights a laptop wires to those switches, through snd-ctl-led, never changed: the mute key and the microphone key act on the mixer alone. Now a card's outputs (Master, PCM, Speaker and the rest the mixer already sets to unity) are switched off while the master is muted, and its inputs (Capture, Mic, Headset) while no zone holds the microphone. The lights then say whether sound plays and whether a zone may record, and a card nothing may record from captures nothing. Every card is set at the mixer's start, at each master mute and each grant or revoke, and a card when it opens. soundprobe gains `switches CARD`, run in zone 0, and the sound suite checks with it that card 0's outputs go off and on with the mute, and its inputs, where it has any, with a grant and its revoke.
…ry amplifier's ACPI ID The note said every AMD laptop has its built-in microphones on the audio coprocessor. HP's business models put them on the codec's digital microphone input instead: the EliteBook 8 G1a's and 845 G9's kernel logs show the ALC245 with "Internal Mic=0x12" and no coprocessor microphone card, while the OMEN and Victus boards the kernel lists for coprocessor microphones show only the jack's. The bullet says both, without claiming a laptop that has not run Kryptik. Its way to tell a machine's kinds named only CSC3551 and TIAS2781, so a CS35L54 laptop read as having none. It now names CSC3554, CSC3556 and CSC3557 (6.18's alc269.c and serial-multi-instantiate.c) and TXNW2781, and how the codec shows its microphones: pin 0x12's default.
…multi-instantiate.c:412-413)
They named only Intel's IPU6 cameras, so the owner of a laptop whose camera sits behind AMD's ISP4, HP's ZBook Ultra G1a among them, would expect it to work as a USB camera does. Its capture driver came in Linux 7.2 (VIDEO_AMD_ISP4_CAPTURE); Kryptik builds 6.18, with DRM_AMD_ISP off, no platform cameras in the media filter, and amdgpu/isp_* left out of firmware.list. camera.md's MIPI section says what it would take, and that its one capture node would fit a grant as a USB camera's does. "Ryzen AI Max", not "Ryzen AI": the Ryzen AI 300 laptops, the ZBook 8 G1ak among them, have USB cameras.
It said "the TPM as an entropy source" without condition. In 6.18, tpm_crb sets TPM_CHIP_FLAG_HWRNG_DISABLED on every AMD firmware TPM that is not Pluton (tpm_crb.c:887-892, AMD's PA-410), and tpm_add_hwrng then registers nothing (tpm-chip.c:536-556). A discrete TPM, as tpm_tis drives, and Pluton keep their hwrng.
…the parsers builds both The weekly run of 2026-10-25 (40178127805) failed before fuzzing: broker_request.rs matches every broker::Request, and the `stick` request the USB stick grant added on 2026-10-13 had no arm, so the target no longer compiled. `stick` takes no argument, as `version` does, so it joins that arm. Nothing built the targets between weekly runs, which is how the break went unseen for twelve days. A pull request that touches kryptikd's sources, wlproxy or the fuzz crates now runs `cargo fuzz build` for both, on the same pinned nightly, without fuzzing.
…which TPMs feed the pool defconfig makes the userspace governor the default, which holds a processor that amd-pstate and intel_pstate do not drive at whatever clock the firmware left it. schedutil follows the load; amd-pstate's active mode, which its default already gives, is held by a fragment line too. On AMD, 6.18 turns a firmware TPM's hwrng off (PA-410), so only a discrete TPM or Pluton feeds the entropy pool there.
iana-etc 20261022 is IANA's port numbers refreshed: data, fine. patch 2.8.1 fixes CVE-2026-115207, a reversed file deletion recreating the file out of tree, and /usr/bin/patch ships in the image: held. python 3.12.16 has ssl distrust the compromised eMudhra intermediates, and the net zone's update fetcher uses ssl over a bundle that still holds the emSign roots: held, to move with ca-bundle. Both bumps rebuild the images, as their steps come before IMAGES_BASE.
# Conflicts: # build/stages/05-kernel.sh
…takes, and what to do when a machine fails - releases.md: a build of main is a green Distro run's kryptik-release artifact, kept 14 days, uncompressed and a development build; a release built from nothing takes about six and a half hours, not three. audit-scope.md: a cold run, about six. - README: the Get it section points at it. - user-guide.md: what to record when a machine fails (a photo, the firmware's version, kryptik-hwreport); the firmware entry of a system the install replaced may still come first; moving off a development build is a reinstall that destroys the state partition.
…console is the screen's console=ttyS0 comes last on the compiled command line for the VMs' serial logs. On most laptops no UART answers behind ttyS0, the kernel registers the console anyway, and every write to /dev/console fails: init's own lines, boot-success's notices and shutdown's progress reach nothing. sysinit now unregisters a ttyS console whose port is type 0 (PORT_UNKNOWN) through its sysfs console switch; the kernel then hands /dev/console to tty0. A port with a UART, as every VM's 16550A, is kept. tools/tests/console-dead-port.sh runs the loop on a stand-in sysfs.
…x held cmake 4.4.5 (and Kitware's binary of it) is 19 commits of build fixes, and cmake never reaches the image. lvm2 2.03.44's device-mapper 1.02.218 holds no security fix; its dmeventd fix is in a part not built. node 24.22.2 adds V8 backports with no CVE, and node stays a build-only layer held for 24.22.1. firefox 153.6.0 is MFSA 2026-120's 95 highs with sandbox escapes among them: held, the bump queued with the browser image's rebuild.
…e.js 24.22.2, Python 3.12.16 and patch 2.8.1 Each was held in tools/pin-reviews.tsv for a fix that reaches Kryptik, and the bundle and Firefox each rebuild every image, so they move in one build: - the CA bundle 2026-10-20 leaves out the three emSign roots of the eMudhra compromise, which the net zone's TLS and every OpenSSL program still trusted; - Firefox ESR 153.6.0, after 153.5.1's built-in OneCRL entries for the same intermediates; its four GCC patches apply unchanged, and their directory follows the version; - Node.js 24.22.2, which only the browser's build runs, signed now by Antoine du Hamel, whom nodejs/node's README lists as a releaser: his key replaces Richard Lau's, who signed 24.22.0; - Python 3.12.16, whose ssl module carries the eMudhra distrust and which update-fetch.py runs in the net zone; - patch 2.8.1, which the image ships. Every hash is the publisher's own: curl.se's .sha256, the SHA256SUMS that Mozilla's key signs, and the SHASUMS256.txt Node's releaser signs, each checked here, and the Python and patch tarballs hashed after their signatures checked against the keys already pinned for them.
…ax's MIPI camera as not covered
… request again, and PRs build both targets
…edutil; the TPM comment says which TPMs feed the pool
… drops the console= ttyS0, so /dev/console is the screen's
…t to do when no key reaches it
…er: snd-ctl-led loads, and a card's switches follow the master's mute and the microphone's grant
…main comes from, how long a cold build takes, and what to do when a machine fails
…ps' microphones are, and every amplifier's ACPI ID
…6.0, Node 24.22.2, Python 3.12.16 and patch 2.8.1
… release reviewed ca-bundle 2026-10-20, firefox 153.6.0, node 24.22.2, patch 2.8.1 and python 3.12.16 are pinned at upstream's newest, and a pin that has caught up has no row.
This was referenced Oct 29, 2026
DevomB
marked this pull request as ready for review
October 29, 2026 19:05
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fourth batch, on #641's head (zbook-batch-3 7c90ded). It lands after #641:
Each was read by someone other than its author. Testing on physical hardware is planned for October 2026.
Draft: it lands on main by fast-forward after #641, once its Distro run is green.