Ubuntu noble#693
Conversation
The noble fips-updates pocket does not ship libgcrypt20-hmac.
Noble FIPS uses kernel 6.8, not 5.15. The hardcoded major_kernel_version caused the find for linux-headers-5.15.*-fips to return nothing and fail the build. Also guard the objtool path rewrite so it only applies to pre-6.0 kernels, since noble FIPS (6.8) uses the new objtool/libsubcmd path.
Update dpkg-list-ubuntu-aws-fips.txt and dpkg-list-ubuntu-fips.txt to expect 6.8 kernel packages instead of 5.15. Fix arch suffixes on libgcrypt20-dev and libgpg-error-dev in dpkg-list-ubuntu.txt to match dpkg --get-selections output on noble.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@stemcell_builder/lib/prelude_apply.bash`:
- Around line 62-64: Update the condition in the FIPS rewrite block to extract
and numerically compare the kernel’s major component against 6, rather than
comparing dotted version strings lexically. Preserve the existing rewrite
behavior only for FIPS kernels with a numeric major version below 6.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c463db26-48c1-4972-a4a2-9432c8701aba
📒 Files selected for processing (6)
bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txtbosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txtbosh-stemcell/spec/assets/dpkg-list-ubuntu.txtstemcell_builder/lib/prelude_apply.bashstemcell_builder/stages/base_fips_apt/apply.shstemcell_builder/stages/static_libraries_config/apply.sh
| # older fips kernels (5.x) used the old path, so rewrite only for those | ||
| if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then | ||
| sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
git ls-files | grep -F 'stemcell_builder/lib/prelude_apply.bash' || true
echo "== relevant lines =="
if [ -f stemcell_builder/lib/prelude_apply.bash ]; then
nl -ba stemcell_builder/lib/prelude_apply.bash | sed -n '1,120p'
fi
echo "== usages of major_kernel_version =="
rg -n "major_kernel_version|update_kernel_static_libraries|stemcell_operating_system_variant" stemcell_builder || true
echo "== local shell comparison behavior probe =="
python3 - <<'PY'
from pathlib import Path
p = Path("stemcell_builder/lib/prelude_apply.bash")
text = p.read_text() if p.exists() else ""
if "update_kernel_static_libraries" in text:
print("found target function in stemcell_builder/lib/prelude_apply.bash")
PY
printf '%s\n' '[[ "5.15" < "6.0" ]]=' && ( [[ "5.15" < "6.0" ]] && true || false )
printf '%s\n' '[[ "6.8" < "6.0" ]]=' && ( [[ "6.8" < "6.0" ]] && true || false )
printf '%s\n' '[[ "10.0" < "6.0" ]]=' && ( [[ "10.0" < "6.0" ]] && true || false )
printf '%s\n' 'lexical ordering: "10.0" < "6.0"? '
[[ "10.0" < "6.0" ]] && printf '%s\n' 'true' || printf '%s\n' 'false'Repository: cloudfoundry/bosh-linux-stemcell-builder
Length of output: 297
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== relevant lines =="
awk '{printf "%6d\t%s\n", NR, $0}' stemcell_builder/lib/prelude_apply.bash | sed -n '45,80p'
echo "== usages of major_kernel_version/usages =="
rg -n "major_kernel_version|update_kernel_static_libraries|stemcell_operating_system_variant" stemcell_builder || true
echo "== local shell lexical comparison behavior probe =="
set +e
( [[ "5.15" < "6.0" ]] && printf '%s\n' '5.15<6.0 true' ) || printf '%s\n' '5.15<6.0 false'
( [[ "6.8" < "6.0" ]] && printf '%s\n' '6.8<6.0 true' ) || printf '%s\n' '6.8<6.0 false'
( [[ "10.0" < "6.0" ]] && printf '%s\n' '10.0<6.0 true' ) || printf '%s\n' '10.0<6.0 false'
set -eRepository: cloudfoundry/bosh-linux-stemcell-builder
Length of output: 2397
Compare the numeric kernel major version, not dotted strings.
Context
The current condition uses lexical ordering, where 10.0 would be sorted below 6.0 and rerun the FIPS static-library rewrite for kernels that should keep the newer path. Compare the first component instead.
Proposed fix
function update_kernel_static_libraries {
kernel_suffix=${1}
major_kernel_version=${2}
+ kernel_major=${major_kernel_version%%.*}
suffix=$kernel_suffix
...
- if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then
+ if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # older fips kernels (5.x) used the old path, so rewrite only for those | |
| if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then | |
| sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list | |
| # older fips kernels (5.x) used the old path, so rewrite only for those | |
| kernel_major=${major_kernel_version%%.*} | |
| if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then | |
| sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list |
🧰 Tools
🪛 Shellcheck (0.11.0)
[warning] 63-63: stemcell_operating_system_variant is referenced but not assigned.
(SC2154)
[error] 63-63: Decimals are not supported. Either use integers only, or use bc or awk to compare.
(SC2072)
[info] 64-64: Double quote to prevent globbing and word splitting.
(SC2086)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@stemcell_builder/lib/prelude_apply.bash` around lines 62 - 64, Update the
condition in the FIPS rewrite block to extract and numerically compare the
kernel’s major component against 6, rather than comparing dotted version strings
lexically. Preserve the existing rewrite behavior only for FIPS kernels with a
numeric major version below 6.
Source: Linters/SAST tools
There was a problem hiding this comment.
@stackunderfl0w can you please check this.
github-project-automation
Bot
moved this from Inbox
to Waiting for Changes | Open for Contribution
in Foundational Infrastructure Working Group
3 participants
Update package lists and kernel versions to match release Ubuntu Noble Fips images.
The current specs hardcode the packages and kernel verions used by Jammy Fips, including the now entirely removed libgcrypt20-hmac.
Current config has been tested to build working Noble FIPS images, though full BOSH deployments currently require pending, out-of-tree changes to credhub-release and uaa-release. Their pre-start keystore generation is incompatible with the stricter PKCS#12 requirements enforced by OpenSSL 3.0’s FIPS provider.