[bong-water-water-bong]

Follow-up to #1297 / #1280. The squash captured a mid-state of that branch, so main is one revision behind what #1297's body says was measured. This brings the three files to the revision that was actually proved, and fixes one thing I found while checking main from a clean clone.

file	what main has	what this PR makes it
scripts/mk-kernel-packages.sh	pre-shellcheck form (kdebs= driver_src=…), and no submodule check	the lint set (shellcheck -S warning clean), plus the submodule fix below
scripts/pkg-proof.sh	the fragile EC-gate row (string match through a pipe)	the gate row decompresses to a file and accepts the undefined dmi_get_system_info or the message; the Arch vmlinuz-1bit row; krel as a constant; the leftover-module count as a loop
docs/install-any-distro.md	"22/22 rows PASS", take-1 hardware wording	"all 24 / all 22 / all 22 rows PASS", the take-2 known-answer row. pi-pkg's edits in the same file are untouched — only my four table cells change

The submodule fix (new, found this morning)

git -C third_party/xdna-driver rev-parse HEAD on an uninitialized submodule walks up to the enclosing repository, so a plain git clone of main made the script report

mk-kernel-packages: /tmp/main-check/third_party/xdna-driver is at 0f45221ea848…, the engine pins 526c6081…

i.e. it compared the engine's own commit with the driver pin. The toplevel must now be the driver directory itself before the pin means anything, and the failure reads

mk-kernel-packages: no amdxdna checkout at …/third_party/xdna-driver: git submodule update --init third_party/xdna-driver (a plain clone leaves the directory empty)

Verified

• plain clone of main without the submodule → the new message; with git submodule update --init third_party/xdna-driver → all five debs build from a clean main checkout, and the kernel payload's hashes are unchanged (linux-image d78b1d78…, linux-headers 6e76837d…)
• shellcheck -S warning clean on both scripts
• rebuilt from this branch and re-proved in their containers: deb 24/24 rows PASS, arch 22/22 rows PASS, PROOF-RC=0 — including the EC-gate row in its new form (ec_su_axb35.ko.zst: dmi_get_system_info, 'not an AXB35') and the Arch vmlinuz-1bit row. Fedora was proven at the same script revision before the merge (22/22) and nothing in this diff touches the rpm path, so it is not re-run here.

No payload logic changes: the packaging behaviour on main was already the version that passed the first 22/22 proofs; what was lost is the robustness of two proof rows and two docs cells. Nothing was installed on the box for this PR, no device ticket was taken, no release, no upload.

One integration is still unowned, and I am not taking it in this PR because pi-pkg now owns the dispatcher: nothing in scripts/pack-distro.sh or scripts/weekly.sh calls mk-kernel-packages.sh, so the weekly release does not yet ship the kernel/driver set. The call is one line — bash scripts/mk-kernel-packages.sh "$out" "$version" --kernel-debs "$kernel_debs" --mok-cert "$cert" — and it needs the kernel debs and the public cert as release inputs; #1279 or #1280 can decide where that lives.

[bong-water-water-bong]

#1324 ready for review at fac7d8a2 — the repair for what the #1297 squash dropped, plus the submodule fix.

Why this exists: #1297's squash landed scripts/mk-kernel-packages.sh in its pre-shellcheck form and scripts/pkg-proof.sh without the EC-gate fix, and the docs still say 22/22 with the take-1 hardware wording. So main's gate row is the string-match-through-a-pipe form that failed true-false on Arch, and my last two commits (fbdab78c, 38a01869) are not in the merged tree at all. Nothing in the payload logic differs from what the PR body claims; two proof rows and two doc cells are what is behind.

New in this PR: a plain git clone of main reported the driver as 'at 0f45221' (the engine's own commit) because git -C on an uninitialized submodule walks up to the enclosing repo. The toplevel must now be the driver directory; the failure names git submodule update --init third_party/xdna-driver. Verified both ways on a clean clone.

Measured after the port (rebuilt from this branch): deb 24/24 rows PASS, arch 22/22 rows PASS, PROOF-RC=0 both — including the new gate row (ec_su_axb35.ko.zst: dmi_get_system_info, 'not an AXB35') and the Arch vmlinuz-1bit row. shellcheck -S warning clean. Fedora proven at the same script revision before the merge (22/22); this diff does not touch the rpm path. No device ticket, nothing installed, no release, no upload.

Left unowned on purpose: no weekly/pack-distro call to mk-kernel-packages.sh exists yet (the kernel debs + the public cert are release inputs), so the weekly release does not ship this set. That is a cross-lane decision with pi-pkg (#1279) — the one-line call is in the PR body.

[bong-water-water-bong]

VERDICT: READY at fac7d8a23c581c8fb158a76c5d152319f4d892cf. The code is right, and the submodule fix is a real bug fix, reproduced here. One correction to the description's framing, worth making because it changes what #1297's "24/24" was measured on.

The framing: the squash did not capture a mid-state. For all three files, main's blob at #1297's squash 82bae014 is byte-identical to #1297's pushed head 307cd700:

file	#1297 head	squash on main	this PR
scripts/mk-kernel-packages.sh	8f0a22e0	8f0a22e0	55d50986
scripts/pkg-proof.sh	0552b266	0552b266	adee6744
docs/install-any-distro.md	e3151d4f	e3151d4f	5aa4f43f

So main has exactly what #1297 pushed. The lint-clean revision with the robust gate row was never on #1297's branch, which means #1297's body measured a revision its own head did not carry. Please say that in the description ("#1297 merged its pushed head; the proofs it quotes ran on a later, unpushed revision, which this PR lands"), so nobody goes looking for a squash bug.

The submodule fix, reproduced (two worktrees with third_party/xdna-driver uninitialized, i.e. the plain-clone state; a throwaway self-signed cert for --mok-cert, public only, deleted after):

• main: mk-kernel-packages: …/third_party/xdna-driver is at 0f45221ea848…, the engine pins 526c6081…. 0f45221 is the engine's own origin/main commit, exactly the walk-up-to-the-superproject bug the body describes;
• this PR: mk-kernel-packages: no amdxdna checkout at …/third_party/xdna-driver: git submodule update --init third_party/xdna-driver (a plain clone leaves the directory empty).

The check is right: rev-parse --show-toplevel must resolve to the driver directory itself (compared by pwd -P) before its HEAD counts as the pin.

Also checked: shellcheck -S warning is clean on both scripts. The other changes are lint-shaped and behaviour-neutral (one assignment per line; extra=(.INSTALL) instead of an unquoted $(…); the rpm names echoed from variables instead of ls | xargs; a for/case instead of ls | grep | head for the Arch kernel version).

Not re-run: the container proofs (deb 24/24, arch 22/22). They build kernel packages and need the kernel debs; nothing above depends on them.

The unowned integration the body names (nothing calls mk-kernel-packages.sh from weekly.sh/pack-distro.sh, so the weekly doesn't ship the kernel/driver set) is worth an issue so it doesn't live only in a PR body.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 1280 - Partially compliant Compliant requirements: Kernel packages are provided as .deb, .rpm, and Arch packages amdxdna-1bit-dkms and ec-su-axb35-dkms are implemented as DKMS packages 1bit-npu-config package includes required configuration files Secure Boot support is implemented with user's MOK key for DKMS packages GPL compliance is maintained with source inclusion Proof testing is implemented for all package families Documentation is updated with new package information Non-compliant requirements: The PR does not include the actual kernel source code or driver patches in the packages The PR does not include the specific build process for the kernel and drivers The PR does not include the actual installation verification on hardware Requires further human verification: Verification that the kernel and driver packages actually build and install correctly on target hardware Confirmation that the Secure Boot implementation works as intended Testing that the packages correctly replace in-tree drivers and load on AXB35 hardware

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Submodule Check Fix The fix for checking uninitialized submodules in mk-kernel-packages.sh correctly addresses an issue where git -C on an uninitialized submodule would walk up to the enclosing repository, causing incorrect commit comparison. This ensures that the script properly validates the driver submodule against the pinned commit. top=$(git -C "$driver_src" rev-parse --show-toplevel 2>/dev/null || :) if [ -n "$top" ] && [ "$(cd "$top" && pwd -P)" = "$(cd "$driver_src" && pwd -P)" ] && \ pin=$(git -C "$driver_src" rev-parse HEAD 2>/dev/null); then [ "$pin" = "$DRV_PIN" ] || die "$driver_src is at $pin, the engine pins $DRV_PIN" git -C "$driver_src" archive HEAD | tar -x -C "$work" --one-top-level=pin Arch Package Installation The updated Arch package installation logic in pkg-proof.sh correctly handles the installation of packages using pacman -U --noconfirm instead of the previous approach that used a generic loop. This ensures proper package installation on Arch systems. case $fam in deb) dpkg -i "$pkgdir"/1bit-npu-config_*.deb "$pkgdir"/amdxdna-1bit-dkms_*.deb \ "$pkgdir"/ec-su-axb35-dkms_*.deb >/tmp/install.log 2>&1 ;; rpm) rpm -i --nosignature "$pkgdir"/1bit-npu-config-*.rpm "$pkgdir"/amdxdna-1bit-dkms-*.rpm \ "$pkgdir"/ec-su-axb35-dkms-*.rpm >/tmp/install.log 2>&1 ;; arch) pacman -U --noconfirm "$pkgdir"/1bit-npu-config-*.pkg.tar.zst "$pkgdir"/amdxdna-1bit-dkms-*.pkg.tar.zst \ "$pkgdir"/ec-su-axb35-dkms-*.pkg.tar.zst >/tmp/install.log 2>&1 ;; EC Module Verification The improved EC module verification in pkg-proof.sh correctly decompresses the module to a file before checking for the DMI gate, avoiding issues with pipe closure that could cause premature termination of the pipeline. This ensures accurate verification of the AXB35 DMI gate in the built module. # grep -q on the tail of a pipeline closes it early, and under `pipefail` the upstream tool's SIGPIPE # then fails the row even though the match was found (measured on arch, where zstd is still writing). # So: decompress to a file once, then grep the file and read nm into a variable. if [ -z "$ecmod" ]; then row FAIL "the AXB35 DMI gate is in the built module" "no module found" elif ! $decomp "$ecmod" > /tmp/ecmod.ko 2>/dev/null; then row FAIL "the AXB35 DMI gate is in the built module" "cannot decompress $(basename "$ecmod")" else gate=no grep -aq 'not an AXB35' /tmp/ecmod.ko && gate=yes # the patch's message nmout=$(nm /tmp/ecmod.ko 2>/dev/null || :) case $nmout in *dmi_get_system_info*) gate=yes ;; esac # the DMI call itself if [ "$gate" = yes ]; then row PASS "the AXB35 DMI gate is in the built module" "$(basename "$ecmod"): dmi_get_system_info, 'not an AXB35'" else row FAIL "the AXB35 DMI gate is in the built module" "$(basename "$ecmod") has neither the call nor the message" fi fi Kernel Image Verification The updated kernel image verification in pkg-proof.sh correctly handles the different naming convention for Arch Linux kernel images (vmlinuz-1bit instead of vmlinuz-7.4.0-rc1-1bit). This ensures that the verification works correctly across different distributions. img=/boot/vmlinuz-$krel [ "$fam" = arch ] && img=/boot/vmlinuz-1bit # Arch names it by suffix, with the 1bit preset beside it if [ -r "$img" ]; then row PASS "vmlinuz in the package" "$img sha256 $(sha256sum "$img" | cut -d' ' -f1)" else row FAIL "vmlinuz in the package" "$img missing" fi Module Cleanup Verification The improved module cleanup verification in pkg-proof.sh uses a more comprehensive search for leftover modules across all possible module directories, ensuring that no modules are left behind after uninstallation. This provides better verification of clean package removal. left=$(for d in /lib/modules/"$kv"/updates /lib/modules/"$kv"/updates/dkms /lib/modules/"$kv"/extra \ /usr/lib/modules/"$kv"/updates /usr/lib/modules/"$kv"/updates/dkms /usr/lib/modules/"$kv"/extra; do for f in "$d"/*.ko*; do [ -e "$f" ] && echo "$f"; done done 2>/dev/null | wc -l) check "no module left behind" "$left files" test "$left" = 0

[bong-water-water-bong]

VERDICT: READY at 5457510e637f870ca8050735b57424cd4461e6d4. Main merges only since my READY at fac7d8a2: no non-merge commit of its own, and the PR's own +/- lines against its merge-base are identical (hash a2e885cee7ed). The review at fac7d8a2 stands, including the request to correct the 'mid-state squash' framing.