main/postmarketos-base-ui: show EOL message

[ci:skip-build]: already built successfully in CI

(cherry picked from commit 1a5e394074)

.ci/apkbuild-lint.sh

@@ -1,12 +1,22 @@
 #!/bin/sh -e
 # Description: run apkbuild-lint on modified APKBUILDs
-# Options: with-dot-git
+# Options: native
+# Use 'native' because it requires git commit history.
 # https://postmarketos.org/pmb-ci
 
 if [ "$(id -u)" = 0 ]; then
 	set -x
-	apk add atools git python3
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
+	wget "https://gitlab.com/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
+	sh ./install_pmbootstrap.sh
+	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
 fi
 
+# Wrap pmbootstrap to use this repository for --aports
+pmaports="$(cd "$(dirname "$0")"/..; pwd -P)"
+_pmbootstrap="$(command -v pmbootstrap)"
+pmbootstrap() {
+	"$_pmbootstrap" --aports="$pmaports" "$@"
+}
+
 .ci/lib/apkbuild_linting.py
+

.ci/autoupdate.sh

@@ -1,106 +0,0 @@
-#!/bin/sh -e
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	apk add git openssh-keygen grep curl
-	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
-	sh ./install_pmbootstrap.sh
-	exec su "${TESTUSER:-pmos}" -c "sh -e $0 $*"
-fi
-
-git config --global --add safe.directory "$CI_PROJECT_DIR"
-git config --global user.name "postmarketOS CI"
-# The username for the bot associated with the access token
-# e.g. project_226_bot_bfa19b84bf7f559c8ff7438a01fd29b9
-git config --global user.email "$PMAPORTS_TOKEN_BOT@noreply.gitlab.postmarketos.org"
-
-# Configure SSH key for signing
-mkdir -p ~/.ssh
-cp "$PMAPORTS_SSH_KEY" ~/.ssh/pmaports
-chmod 600 ~/.ssh/pmaports
-# Generate public key from private
-ssh-keygen -t ecdsa -f ~/.ssh/pmaports -y > ~/.ssh/pmaports.pub
-
-git config --global gpg.format ssh
-git config --global user.signingkey ~/.ssh/pmaports.pub
-
-export PYTHONUNBUFFERED=1
-
-PKGS="$1"
-if [ -z "$PKGS" ]; then
-	echo "Usage: $0 <packages>"
-	exit 1
-fi
-echo "Checking for new versions of packages: $PKGS"
-
-update_linux_next() {
-	# Check for the latest -next tag
-	local latest
-	local pkgver
-	local new_pkgver
-
-	# Get the current version
-	# shellcheck source=/dev/null
-	pkgver=$(. device/testing/linux-next/APKBUILD; echo "$pkgver")
-
-	curl -s https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/refs/tags/ | grep -oE "<a href='.*'>(.*)</a>.*\.tar\.gz</a>" | awk -F'[<>]' '{print $3}' > /tmp/tags
-
-	latest=$(grep -v "v" < /tmp/tags | head -n1)
-	if [ -z "$latest" ]; then
-		echo "Failed to get the latest -next tag"
-		exit 1
-	fi
-	echo "Latest -next tag: $latest"
-
-	new_pkgver=$(grep "v" < /tmp/tags | head -n1)
-	if [ -z "$new_pkgver" ]; then
-		echo "Failed to get the latest mainline tag from atom feed, reusing current pkgver"
-		new_pkgver="${pkgver%_git*}"
-	else
-		echo "Latest mainline tag: $new_pkgver"
-		# new_pkgver is like 'v6.9-rc1' but we want '6.9'
-		new_pkgver=$(echo "$new_pkgver" | sed -e 's/^v//' -e 's/-.*//')
-	fi
-
-	new_pkgver="${new_pkgver}_git${latest#*-}"
-
-	if [ "$pkgver" = "$new_pkgver" ]; then
-		echo "No new version of linux-next"
-		exit 0
-	fi
-
-	echo "Updating linux-next from $pkgver to $new_pkgver..."
-	sed -i -e "s/pkgver=$pkgver/pkgver=$new_pkgver/" device/testing/linux-next/APKBUILD
-	sed -i -e "s/^pkgrel=.*/pkgrel=0/" device/testing/linux-next/APKBUILD
-
-	# Update the checksums
-	pmbootstrap checksum linux-next
-
-	# Ensure it builds
-	pmbootstrap --details-to-stdout build linux-next
-
-	# Commit
-	git add device/testing/linux-next/APKBUILD
-	git commit -S -m "linux-next: upgrade to $latest"
-}
-
-# For testing
-#git remote add gitlab https://pmos-ci:"$PMAPORTS_PUSH_TOKEN"@gitlab.postmarketos.org/postmarketOS/pmaports-autoupdate-test.git
-
-git remote add gitlab https://pmos-ci:"$PMAPORTS_PUSH_TOKEN"@gitlab.postmarketos.org/postmarketOS/pmaports.git
-git fetch gitlab
-git checkout --track gitlab/master
-
-for pkg in $PKGS; do
-	case "$pkg" in
-		linux-next)
-			update_linux_next
-			;;
-		*)
-			echo "Unknown package: $pkg"
-			exit 1
-			;;
-	esac
-done
-
-git push

.ci/build-armhf.sh

@@ -1 +0,0 @@
-lib/build_changed_aports.sh

.ci/build-docs.sh

@@ -1,20 +0,0 @@
-#!/bin/sh -e
-# Copyright 2025 Pablo Correa Gomez
-# SPDX-License-Identifier: GPL-3.0-or-later
-# Description: create documentation with antora
-# Options: with-dot-git
-# Artifacts: build/site
-# https://postmarketos.org/pmb-ci
-
-
-# Install dependencies
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	apk -q add py3-pip make git
-	apk add dint --allow-untrusted --repository=https://mirror.postmarketos.org/postmarketos/master
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
-fi
-
-cd docs/
-make venv
-make

.ci/build-jobs.yaml.j2

@@ -1,141 +0,0 @@
-image: registry.alpinelinux.org/img/alpine:latest
-stages:
-  - build
-  - hardware tests
-
-variables:
-  CI_TRON_TEMPLATE_PROJECT: &ci-tron-template-project postmarketOS/ci-common
-  CI_TRON_JOB_TEMPLATE_PROJECT_URL: $CI_SERVER_URL/$CI_TRON_TEMPLATE_PROJECT
-  CI_TRON_JOB_TEMPLATE_COMMIT: &ci-tron-template-commit 1c70e34b7a610cda1d7f048f6b50ca9c10f52995
-
-include:
-  - project: *ci-tron-template-project
-    ref: *ci-tron-template-commit
-    file: '/ci-tron/common.yml'
-
-workflow:
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "parent_pipeline"
-
-.build:
-  # Create jobs, but do not run them unless this is
-  # overriden in jobs that extend it
-  stage: build
-  interruptible: true
-  before_script:
-    # upgrade is mostly needed for "qemu" runners that run edge based on a VM
-    # The other build jobs run natively in docker on latest alpine stable and
-    # those should always have whatever we need
-    - apk upgrade -U
-    - .ci/lib/gitlab_prepare_ci.sh
-  after_script:
-    - cp -r /home/pmos/.local/var/pmbootstrap/packages/ packages/ || true
-    - mkdir -p keys
-    - cp /home/pmos/.local/var/pmbootstrap/config_apk_keys/pmos@local*.pub keys/ || true
-    - .ci/lib/move_logs.sh $CI_PROJECT_DIR
-  artifacts:
-    expire_in: 1 week
-    paths:
-      - packages/
-      - keys/
-  timeout: 10 h
-
-build:
-  extends: .build
-  parallel:
-    matrix:
-{% for arch in archs %}
-      - ARCH: {{ arch }}
-        TAG: {{ archtag[arch] }}
-{% endfor %}
-{% if archs|length == 0 %}
-      - ARCH: placeholder
-        TAG: shared
-{% endif %}
-  tags:
-    - $TAG
-  script:
-# Needed because gitlab fails if no jobs are ran:
-#  - https://gitlab.com/gitlab-org/gitlab/-/issues/368248
-{% if archs|length == 0 %}
-    - 'true'
-{% else %}
-    - .ci/build-$ARCH.sh
-{% endif %}
-
-# Hardware testing
-
-# Define here all the gitlab-ci snippets that could be common between the
-# different packages
-
-# Extends from this job if the target device needs a kernel and initramfs to
-# boot. This will not work if your device uses boot images.
-.device-boot-flow-separate-artifacts:
-  variables:
-    CI_TRON_KERNEL__URL: "glartifact://${CI_TRON__PMB_BUILD_JOB}/${CI_TRON__PMB_EXPORT_PATH}/vmlinuz"
-    CI_TRON_INITRAMFS__INITRAMFS__URL: "glartifact://${CI_TRON__PMB_BUILD_JOB}/${CI_TRON__PMB_EXPORT_PATH}/initramfs"
-
-# Extends from this job if the target device boots using fastboot and boot images
-.device-boot-flow-fastboot-image:
-  variables:
-    CI_TRON_FASTBOOT__BOOT_IMAGE__URL: "glartifact://${CI_TRON__PMB_BUILD_JOB}/${CI_TRON__PMB_EXPORT_PATH}/boot.img"
-
-# Include all the devices that need and can to be tested
-
-{% for device in devices_under_test %}
-prepare-{{ device.name }}:
-  stage: hardware tests
-  extends:
-    .pmos-ci-tron-build-boot-artifacts
-  {%- if device.has_kernel_variants %}
-  # Build all the boot artifacts for all the supported kernel variants in
-  # different jobs, but hide them behind a single job name so as not to pollute
-  # the pipeline.
-  parallel:
-    matrix:
-      - KERNEL_VARIANT:
-      {%- for kernel in device.kernel_variants %}
-        - {{ kernel }}
-      {%- endfor %}
-  {%- endif %}
-  needs:
-    - job: "build"
-      parallel:
-        matrix:
-          - ARCH: "{{ device.arch }}"
-            TAG: "{{ archtag[device.arch] }}"
-  variables:
-    DEVICE_NAME: {{ device.name }}
-    # NOTE: All the packages that may influence testing should have an
-    # `install-if postmarketos-mkinitfs-hook-ci`, so no need to add them here
-    INSTALL_PACKAGES: {{ device.pkgname }} {% if device.has_kernel_variants %}{{ device.pkgname }}-kernel-${KERNEL_VARIANT} {% endif %}postmarketos-mkinitfs-hook-ci
-
-.test-{{ device.name }}:
-  stage: hardware tests
-  {%- if device.has_kernel_variants %}
-  # Test all the kernels in different jobs, but hide them behind a single
-  # job name so as not to pollute the pipeline.
-  parallel:
-    matrix:
-      - KERNEL_VARIANT:
-      {%- for kernel in device.kernel_variants %}
-        - {{ kernel }}
-      {%- endfor %}
-  {%- endif %}
-  dependencies: []
-  needs:
-    - job: 'prepare-{{ device.name }}'
-      artifacts: false
-      {%- if device.has_kernel_variants %}
-      parallel:
-        matrix:
-          - KERNEL_VARIANT: $[[ matrix.KERNEL_VARIANT ]]
-      {%- endif %}
-  variables:
-    CI_TRON__PMB_BUILD_JOB: "prepare-{{ device.name }}{% if device.has_kernel_variants %}: [$KERNEL_VARIANT]{% endif %}"
-
-# Include the gitlab ci yml fragment, as found in
-# `device/$category/device-$devicename/gitlab-ci.yml.j2` which defines the jobs
-{{ device.gitlab_ci_fragment }}
-
-{% endfor %}

.ci/build-loongarch64.sh

@@ -1 +0,0 @@
-lib/build_changed_aports.sh

.ci/build-ppc64le.sh

@@ -1 +0,0 @@
-lib/build_changed_aports.sh

.ci/build-riscv64.sh

@@ -1 +0,0 @@
-lib/build_changed_aports.sh

.ci/build-x86.sh

@@ -1 +0,0 @@
-lib/build_changed_aports.sh

.ci/check-changed-versions.sh

@@ -1,20 +0,0 @@
-#!/bin/sh -e
-# Copyright 2023 Oliver Smith
-# SPDX-License-Identifier: GPL-3.0-or-later
-# Description: check pkgver/pkgrel bumps, amount of changed pkgs etc
-# Options: native
-# Use 'native' because it requires running pmbootstrap.
-# https://postmarketos.org/pmb-ci
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	# In .gitlab-ci.yml currently .ci/pytest.sh runs before this and
-	# already downloads and runs install_pmbootstrap.sh.
-	if ! [ -e install_pmbootstrap.sh ]; then
-		wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
-		sh ./install_pmbootstrap.sh
-	fi
-	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
-fi
-
-.ci/lib/check_changed_versions.py

.ci/commits.sh

@@ -0,0 +1,20 @@
+#!/bin/sh -e
+# Copyright 2023 Oliver Smith
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Description: check pkgver/pkgrel bumps, amount of changed pkgs etc
+# Options: native
+# Use 'native' because it requires git commit history.
+# https://postmarketos.org/pmb-ci
+
+if [ "$(id -u)" = 0 ]; then
+	set -x
+	# In .gitlab-ci.yml currently .ci/pytest.sh runs before this and
+	# already downloads and runs install_pmbootstrap.sh.
+	if ! [ -e install_pmbootstrap.sh ]; then
+		wget "https://gitlab.com/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
+		sh ./install_pmbootstrap.sh
+	fi
+	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
+fi
+
+.ci/lib/check_changed_aports_versions.py

.ci/dint.sh

@@ -1,13 +0,0 @@
-#!/bin/sh -e
-# Description: Validate and lint deviceinfo files
-# Options: with-dot-git
-# https://postmarketos.org/pmb-ci
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	apk add git python3
-	apk add dint --allow-untrusted --repository=https://mirror.postmarketos.org/postmarketos/master
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
-fi
-
-.ci/lib/deviceinfo_linting.py

.ci/flake8.sh

@@ -0,0 +1,14 @@
+#!/bin/sh -e
+# Description: lint CI related python scripts/tests
+# https://postmarketos.org/pmb-ci
+
+if [ "$(id -u)" = 0 ]; then
+	set -x
+	apk -q add py3-flake8
+	exec su "${TESTUSER:-build}" -c "sh -e $0"
+fi
+
+set -x
+
+# shellcheck disable=SC2046
+flake8 --ignore E501,F401,E722,W504,W605 $(find .ci -name '*.py')

.ci/grep.sh

@@ -2,11 +2,9 @@
 # Description: check various bad patterns with grep
 # https://postmarketos.org/pmb-ci
 
-exit_code=0
-
 if [ "$(id -u)" = 0 ]; then
 	set -x
-	apk -q add git grep
+	apk -q add grep
 	exec su "${TESTUSER:-build}" -c "sh -e $0"
 fi
 
@@ -14,7 +12,7 @@ fi
 if grep -qr '(CHANGEME!)' -- *; then
 	echo "ERROR: Please replace '(CHANGEME!)' in the following files:"
 	grep --color=always -r '(CHANGEME!)' -- *
-	exit_code=1
+	exit 1
 fi
 
 # DTBs installed to /usr/share/db
@@ -25,7 +23,7 @@ if grep -qr 'INSTALL_DTBS_PATH="$pkgdir"/usr/share/dtb' device/; then
 	echo 'ERROR: Files that need fixing:'
 	# shellcheck disable=SC2016
 	grep --color=always -r 'INSTALL_DTBS_PATH="$pkgdir"/usr/share/dtb' device/
-	exit_code=1
+	exit 1
 fi
 
 
@@ -33,113 +31,10 @@ fi
 if grep -qr '/etc/postmarketos-mkinitfs' -- *; then
 	echo "ERROR: Please replace '/etc/postmarketos-mkinitfs' with '/usr/share/mkinitfs' in the following files:"
 	grep --color=always -r '/etc/postmarketos-mkinitfs' -- *
-	exit_code=1
+	exit 1
 fi
 if grep -qr '/usr/share/postmarketos-mkinitfs' -- *; then
 	echo "ERROR: Please replace '/usr/share/postmarketos-mkinitfs' with '/usr/share/mkinitfs' in the following files:"
 	grep --color=always -r '/usr/share/postmarketos-mkinitfs' -- *
-	exit_code=1
+	exit 1
 fi
-
-# Direct sourcing of deviceinfo
-if grep --exclude='source_deviceinfo' -qEr 'source /etc/deviceinfo|\. /etc/deviceinfo' -- *; then
-	echo 'ERROR: Please source the source_deviceinfo script instead of sourcing deviceinfo directly!'
-	grep --color=always --exclude='rootfs-usr-share-misc-source_deviceinfo' -Er 'source /etc/deviceinfo|\. /etc/deviceinfo' -- *
-	exit_code=1
-fi
-
-# Removed deviceinfo variable
-if grep -qr 'deviceinfo_modules_initfs' -- *; then
-	echo 'ERROR: deviceinfo_modules_initfs variable has been removed. Use "modules-initfs" file instead.'
-	grep --color=always -r 'deviceinfo_modules_initfs' -- *
-	exit_code=1
-fi
-
-POSTMARKETOS_WALLPAPER_PATH='/usr/share/wallpapers/postmarketos.jpg'
-# The excluded devices are "grandfathered in". New devices should not be added here.
-# See https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/2529
-if grep -qr $POSTMARKETOS_WALLPAPER_PATH \
-	--exclude-dir='device-pine64-pinetab' \
-	--exclude-dir='device-oneplus-kebab' \
-	--exclude-dir='device-xiaomi-willow' \
-	-- device; then
-	echo "ERROR: Please don't include configuration files that set the default wallpaper in device-specific packages!"
-	grep --color=always -r $POSTMARKETOS_WALLPAPER_PATH \
-		--exclude-dir='device-pine64-pinetab' \
-		--exclude-dir='device-oneplus-kebab' \
-		--exclude-dir='device-xiaomi-willow' \
-		-- device
-	exit_code=1
-fi
-
-OPENRC_SERVICE_FILES=$(find . -name '*.initd')
-# shellcheck disable=SC2086
-if grep -q 'before wpa_supplicant' $OPENRC_SERVICE_FILES; then
-	echo "ERROR: Please use 'before wlan' in OpenRC service files! This ensures compatibility with both wpa_supplicant and iwd."
-	grep --color=always 'before wpa_supplicant' $OPENRC_SERVICE_FILES
-	exit_code=1
-fi
-
-if grep -qEr 'PMOS_NO_OUTPUT_REDIRECT' -- *; then
-	echo "ERROR: PMOS_NO_OUTPUT_REDIRECT is deprecated and doesn't do anything."
-	echo "Please remove it from the following files:"
-	grep --color=always -Er 'PMOS_NO_OUTPUT_REDIRECT' -- *
-	exit_code=1
-fi
-
-if grep -qEr '^deviceinfo_kernel_cmdline.*[\"\s]console=null' -- device/; then
-	echo "ERROR: Do not use console=null in the kernel command line."
-	echo "Use these params to quiet console on boot: quiet loglevel=2"
-	echo "For more information, see: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/2989"
-	exit_code=1
-fi
-
-# Disallow installation of files to /etc/modules-load.d and /etc/modprobe.d
-if grep -qr '/etc/modules-load.d' --exclude-dir='device-samsung-golden-downstream' -- *; then
-	echo "ERROR: Please replace '/etc/modules-load.d' with '/usr/lib/modules-load.d' in the following files:"
-	grep --color=always -r '/etc/modules-load.d' --exclude-dir='device-samsung-golden-downstream' -- *
-	exit_code=1
-fi
-# n900 is excluded because the string is in a comment linking to a repo.
-# No other non-archived devices should be excluded.
-if grep -qr '/etc/modprobe.d' --exclude-dir='archived' \
-		--exclude-dir='device-nokia-n900' -- *; then
-			echo "ERROR: Please replace '/etc/modprobe.d' with '/usr/lib/modprobe.d' in the following files:"
-			grep --color=always -r '/etc/modprobe.d' --exclude-dir='device-nokia-n900' \
-				--exclude-dir='archived' -- *
-	exit_code=1
-fi
-
-# Disallow maintainer comments.
-if grep -qr '# Maintainer:' -- *; then
-	echo 'ERROR: Please use maintainer variables of the form maintainer="..." instead of maintainer comments of the form # Maintainer: ...'
-	grep --color=always -r '# Maintainer:' -- *
-	exit_code=1
-fi
-
-if [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
-	# Find all moved or new kernel APKBUILDs in main, community or testing
-	MOVED_OR_NEW_MAINLINE_KERNEL_PACKAGES=$(git show --pretty="" --name-only --diff-filter=AR "$CI_MERGE_REQUEST_DIFF_BASE_SHA"..HEAD | grep "device/\(main\|community\|testing\)/linux-.*/APKBUILD" || true)
-
-	if [ -n "$MOVED_OR_NEW_MAINLINE_KERNEL_PACKAGES" ]; then
-		if [ -n "$(grep -L LLVM=1 $MOVED_OR_NEW_MAINLINE_KERNEL_PACKAGES || true)" ]; then
-			echo "ERROR: An added or moved close-to-mainline kernel package is not being built with LLVM."
-			echo "See https://postmarketos.org/edge/2025/11/11/kernels-llvm/ for more details"
-			grep --color=always -L LLVM=1 $MOVED_OR_NEW_MAINLINE_KERNEL_PACKAGES
-			exit_code=1
-		fi
-	fi
-
-	# Disallow adding packages without a maintainer set
-	NEW_APKBUILDS=$(git show --pretty="" --name-only --diff-filter=A "$CI_MERGE_REQUEST_DIFF_BASE_SHA"..HEAD | grep APKBUILD || true)
-
-	if [ -n "$NEW_APKBUILDS" ]; then
-		if [ -n "$(grep -L '^maintainer="[^"]\+"$' $NEW_APKBUILDS || true)" ]; then
-			echo "ERROR: A new package does not have a maintainer set."
-			grep --color=always -L '^maintainer="[^"]\+"$' $NEW_APKBUILDS
-			exit_code=1
-		fi
-	fi
-fi
-
-exit "$exit_code"

.ci/kconfig.sh

@@ -6,11 +6,11 @@
 
 if [ "$(id -u)" = 0 ]; then
 	set -x
-	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
+	wget "https://gitlab.com/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
 	sh ./install_pmbootstrap.sh
 	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
 fi
 
 export PYTHONUNBUFFERED=1
 
-.ci/lib/kconfig.py
+.ci/lib/check_changed_kernels.py

.ci/lib/add_pmbootstrap_to_import_path

@@ -0,0 +1 @@
+../testcases/add_pmbootstrap_to_import_path

.ci/lib/apkbuild_linting.py

@@ -2,62 +2,30 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import common
-import os
+import os.path
 import sys
-import subprocess
-import tomllib
-
-
-custom_valid_options = [
-    "!pmb:crossdirect",
-    "!pmb:kconfigcheck",
-    "pmb:cross-native",
-    "pmb:cross-native2",
-    "pmb:drm",
-    "pmb:generic-kernel",
-    "pmb:strict",
-    "pmb:systemd",
-    "pmb:systemd-never",
-]
-
-
-def get_kconfigcheck_categories() -> list [str]:
-    with open("kconfigcheck.toml", "rb") as kconfigcheck_config:
-        kconfigcheck_data = tomllib.load(kconfigcheck_config)
-
-    kconfigcheck_categories = []
-
-    for category_name in kconfigcheck_data:
-        if category_name == "aliases":
-            for alias_name in kconfigcheck_data["aliases"]:
-                kconfigcheck_categories.append(f"pmb:kconfigcheck-{alias_name}")
-        else:
-            kconfigcheck_categories.append(category_name)
-
-    return [item.replace("category:", "pmb:kconfigcheck-") for item in kconfigcheck_categories]
-
 
 if __name__ == "__main__":
-    kconfigcheck_categories = get_kconfigcheck_categories()
-    custom_valid_options += kconfigcheck_categories
-    os.environ["CUSTOM_VALID_OPTIONS"] = " ".join(custom_valid_options)
-
-    apkbuilds = {file for file in common.get_changed_files()
+    common.add_upstream_git_remote()
+    apkbuilds = {file for file in common.get_changed_files(removed=False)
                  if os.path.basename(file) == "APKBUILD"}
     if len(apkbuilds) < 1:
         print("No APKBUILDs to lint")
         sys.exit(0)
 
-    apkbuilds_filtered = []
+    packages = []
     for apkbuild in apkbuilds:
         if apkbuild.startswith("temp/") or apkbuild.startswith("cross/"):
             print(f"NOTE: Skipping linting of {apkbuild}")
             continue
-        apkbuilds_filtered.append(apkbuild)
-    if len(apkbuilds_filtered) < 1:
+        packages.append(os.path.basename(os.path.dirname(apkbuild)))
+    if len(packages) < 1:
         print("No APKBUILDs to lint")
         sys.exit(0)
-    try:
-        subprocess.run(["apkbuild-lint", *apkbuilds_filtered], text=True, check=True)
-    except subprocess.CalledProcessError as exception:
-        sys.exit(exception.returncode)
+
+    result = common.run_pmbootstrap(["-q", "lint"] + packages, output_return=True)
+
+    if len(result) > 0:
+        print("Linting issues found:")
+        print(result)
+        sys.exit(1)

.ci/lib/build_changed_aports.py

@@ -2,31 +2,41 @@
 # Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 import sys
-import os
-import pathlib
 
 # Same dir
 import common
 
 # pmbootstrap
-import pmb.core
+import add_pmbootstrap_to_import_path
 import pmb.parse
 import pmb.parse._apkbuild
 import pmb.helpers.pmaports
-from pmb.core.context import get_context
 
 
 def build_strict(packages, arch):
     common.run_pmbootstrap(["build_init"])
-    # We set the timeout to 1 hour because linking the Linux kernel with
-    # ThinLTO on our aarch64 runners takes slightly over 30 minutes
-    common.run_pmbootstrap(["--details-to-stdout", "--no-ccache",
-                            "--timeout", "3600",
-                            "build",
+    common.run_pmbootstrap(["--details-to-stdout", "--no-ccache", "build",
                             "--strict", "--force",
                             "--arch", arch, ] + list(packages))
 
 
+def verify_checksums(packages, arch):
+    # Only do this with one build-{arch} job
+    arch_verify = "x86_64"
+    if arch != arch_verify:
+        print(f"NOTE: doing checksum verification in build-{arch_verify} job,"
+              " not here.")
+        return
+
+    if len(packages) == 0:
+        print("no packages changed, not doing any checksums verification")
+        return
+
+    common.run_pmbootstrap(["build_init"])
+    common.run_pmbootstrap(["--details-to-stdout", "checksum", "--verify"] +
+                           list(packages))
+
+
 if __name__ == "__main__":
     # Architecture to build for (as in build-{arch})
     if len(sys.argv) != 2:
@@ -35,38 +45,29 @@ if __name__ == "__main__":
     arch = sys.argv[1]
 
     # Get and print modified packages
-    packages = common.get_changed_packages(skip_archived=True)
+    common.add_upstream_git_remote()
+    packages = common.get_changed_packages()
 
-    # Load context
-    sys.argv = ["pmbootstrap.py", "chroot"]
+    # Package count sanity check
+    common.get_changed_packages_sanity_check(len(packages))
+
+    # [ci:skip-build]: verify checksums and stop
+    verify_only = common.commit_message_has_string("[ci:skip-build]")
+    if verify_only:
+        print("WARNING: not building changed packages ([ci:skip-build])!")
+        print("verifying checksums: " + ", ".join(packages))
+        verify_checksums(packages, arch)
+        sys.exit(0)
+
+    # Prepare "args" to use pmbootstrap code
+    sys.argv = ["pmbootstrap", "chroot"]
     args = pmb.parse.arguments()
-    context = get_context()
 
-    # Get set of all buildable packages for the enabled repos, for skipping unbuildable
-    # aports later. We might be given a changed aport from e.g. extra-repos/systemd when
-    # that repo is not enabled
-    buildable_pkgs = set()
-    for path in pmb.core.pkgrepo.pkgrepo_iter_package_dirs():
-        buildable_pkgs.add(os.path.basename(path))
-
-    # To store a list of packages from extra-repos/systemd for special handling later:
-    systemd_pkgs = list()
-
-    # Filter out packages that either:
-    #  1. can't be built for given arch
-    #  2. are not found in enabled repos
+    # Filter out packages that can't be built for given arch
     # (Iterate over copy of packages, because we modify it in this loop)
     for package in packages.copy():
-        if package not in buildable_pkgs:
-            print(f"{package}: not in any available repos, skipping")
-            packages.remove(package)
-            # FIXME: this should probably be more generic, if other repos are added later?
-            # This just tosses the package into the list of packages to try building later w/ systemd enabled, and assumes it'll be found there.
-            systemd_pkgs.append(package)
-            continue
-
-        apkbuild_path = pmb.helpers.pmaports.find(package)
-        apkbuild = pmb.parse._apkbuild.apkbuild(pathlib.Path(apkbuild_path, "APKBUILD"))
+        apkbuild_path = pmb.helpers.pmaports.find(args, package)
+        apkbuild = pmb.parse._apkbuild.apkbuild(f"{apkbuild_path}/APKBUILD")
 
         if not pmb.helpers.pmaports.check_arches(apkbuild["arch"], arch):
             print(f"{package}: not enabled for {arch}, skipping")
@@ -77,29 +78,6 @@ if __name__ == "__main__":
         print(f"no packages changed, which can be built for {arch}")
         sys.exit(0)
 
+    # Build packages
+    print(f"building in strict mode for {arch}: {', '.join(packages)}")
     build_strict(packages, arch)
-
-    # Build packages in extra-repos/systemd
-    # FIXME: this should probably be more generic, if other repos are added later?
-    if systemd_pkgs:
-        common.run_pmbootstrap(["config", "systemd", "always"])
-        # To fix the ERROR: Chroot 'native' is for the 'edge' channel, but you are on the
-        # 'systemd-edge' channel. Run 'pmbootstrap zap' to delete your chroots and try again.
-        # To do this automatically, run 'pmbootstrap config auto_zap_misconfigured_chroots yes'.
-        common.run_pmbootstrap(["config", "auto_zap_misconfigured_chroots", "yes"])
-
-        # filter out packages that can't be built for arch
-        # (Iterate over copy of `systemd_pkgs`, because we modify it in this loop)
-        for package in systemd_pkgs.copy():
-            apkbuild_path = pmb.helpers.pmaports.find(package, True, True, with_extra_repos="enabled")
-            apkbuild = pmb.parse._apkbuild.apkbuild(pathlib.Path(apkbuild_path, "APKBUILD"))
-            if not pmb.helpers.pmaports.check_arches(apkbuild["arch"], arch):
-                print(f"(extra-repos/systemd) {package}: not enabled for {arch}, skipping")
-                systemd_pkgs.remove(package)
-
-        # No packages: skip build
-        if len(systemd_pkgs) == 0:
-            print(f"no packages changed, which can be built for {arch}")
-            sys.exit(0)
-
-        build_strict(systemd_pkgs, arch)

.ci/lib/build_changed_aports.sh

@@ -1,12 +1,11 @@
 #!/bin/sh -e
 # Description: build modified packages for this architecture
 # Options: native slow
-# Use 'native' because it requires running pmbootstrap.
 # https://postmarketos.org/pmb-ci
 
 if [ "$(id -u)" = 0 ]; then
 	set -x
-	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
+	wget "https://gitlab.com/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
 	sh ./install_pmbootstrap.sh
 	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
 fi

.ci/lib/check_changed_aports_versions.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+# Copyright 2021 Oliver Smith
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import glob
+import tempfile
+import sys
+import subprocess
+
+# Same dir
+import common
+
+# pmbootstrap
+import add_pmbootstrap_to_import_path  # noqa
+import pmb.parse
+import pmb.parse.version
+import pmb.helpers.logging
+
+
+def get_package_version(args, package, revision, check=True):
+    # Redirect stderr to /dev/null, so git doesn't complain about files not
+    # existing in upstream branch for new packages
+    stderr = None
+    if not check:
+        stderr = subprocess.DEVNULL
+
+    # Run something like "git show upstream/master:main/hello-world/APKBUILD"
+    pmaports_dir = common.get_pmaports_dir()
+    pattern = pmaports_dir + "/**/" + package + "/APKBUILD"
+    path = glob.glob(pattern, recursive=True)[0][len(pmaports_dir + "/"):]
+    apkbuild_content = common.run_git(["show", revision + ":" + path], check,
+                                      stderr)
+    if not apkbuild_content:
+        return None
+
+    # Save APKBUILD to a temporary path and parse it from there. (Not the best
+    # way to do things, but good enough for this CI script.)
+    with tempfile.TemporaryDirectory() as tempdir:
+        with open(tempdir + "/APKBUILD", "w", encoding="utf-8") as handle:
+            handle.write(apkbuild_content)
+        parsed = pmb.parse.apkbuild(tempdir + "/APKBUILD", False, False)
+
+    return parsed["pkgver"] + "-r" + parsed["pkgrel"]
+
+
+def version_compare_operator(result):
+    """ :param result: return value from pmb.parse.version.compare() """
+    if result == -1:
+        return "<"
+    elif result == 0:
+        return "=="
+    elif result == 1:
+        return ">"
+
+    raise RuntimeError("Unexpected version_compare_operator input: " + result)
+
+
+def exit_with_error_message():
+    branch = common.get_upstream_branch()
+    print()
+    print("ERROR: Modified package(s) don't have an increased version or a")
+    print("new package has a nonzero pkgrel!")
+    print()
+    print("This can happen if you added a new package with a nonzero")
+    print("pkgrel, or if you did not change the pkgver/pkgrel")
+    print("variables in the APKBUILDs. Or you did change them, but the")
+    print(f"packages have been updated in the official '{branch}' branch, and")
+    print("now your versions are not higher anymore.")
+    print()
+    print("Your options:")
+    print("a) If you made changes to the packages, and did not increase the")
+    print("   pkgrel/pkgver: increase them now, and force push your branch.")
+    print("   => https://postmarketos.org/howto-bump-pkgrel-pkgver")
+    print("b) If you had already increased the package versions, rebase on")
+    print(f"   '{branch}', increase the versions again and then force push:")
+    print("   => https://postmarketos.org/rebase")
+    print("c) If you made a change, that does not require rebuilding the")
+    print("   packages, such as only changing the arch=... line: you can")
+    print("   disable this check by adding '[ci:skip-vercheck]' to the")
+    print("   latest commit message, then force push.")
+    print()
+    print("Thank you and sorry for the inconvenience.")
+    exit(1)
+
+
+def check_versions(args, packages):
+    error = False
+
+    # Get relevant commits: compare HEAD against upstream branch or HEAD~1
+    # (the latter if this CI check is running on upstream branch). Note that
+    # for the common.get_changed_files() code, we don't check against
+    # upstream branch HEAD, but against the latest common ancestor. This is not
+    # desired here, since we already know what packages changed, and really
+    # want to check if the version was increased towards *current* upstream
+    # branch HEAD.
+    commit = f"upstream/{common.get_upstream_branch()}"
+    if common.run_git(["rev-parse", "HEAD"]) == common.run_git(["rev-parse",
+                                                                commit]):
+        print(f"NOTE: {commit} is on same commit as HEAD, comparing"
+              " HEAD against HEAD~1.")
+        commit = "HEAD~1"
+
+    for package in packages:
+        # Get versions, skip new packages
+        head = get_package_version(args, package, "HEAD")
+        upstream = get_package_version(args, package, commit, False)
+        if not upstream:
+            if head.rpartition('r')[2] != "0":
+                print(f"- {package}: {head} (HEAD) (new package) [ERROR]")
+                error = True
+            else:
+                print(f"- {package}: {head} (HEAD) (new package)")
+            continue
+
+        # Compare head and upstream versions
+        result = pmb.parse.version.compare(head, upstream)
+        if result != 1:
+            error = True
+
+        # Print result line ("- hello-world: 1-r2 (HEAD) > 1-r1 (HEAD~1)")
+        formatstr = "- {}: {} (HEAD) {} {} ({})"
+        if result != 1:
+            formatstr += " [ERROR]"
+        operator = version_compare_operator(result)
+        print(formatstr.format(package, head, operator, upstream, commit))
+
+    if error:
+        exit_with_error_message()
+
+
+if __name__ == "__main__":
+    # Get and print modified packages
+    common.add_upstream_git_remote()
+    packages = common.get_changed_packages()
+    print(f"Changed packages: {packages}")
+
+    # Verify modified package count
+    common.get_changed_packages_sanity_check(len(packages))
+    if len(packages) == 0:
+        print("no aports changed in this branch")
+        exit(0)
+
+    # Potentially skip this check
+    if common.commit_message_has_string("[ci:skip-vercheck]"):
+        print("WARNING: not checking for changed package versions"
+              " ([ci:skip-vercheck])!")
+        exit(0)
+
+    # Initialize args (so we can use pmbootstrap's APKBUILD parsing)
+    sys.argv = ["pmbootstrap.py", "chroot"]
+    args = pmb.parse.arguments()
+    pmb.helpers.logging.init(args)
+
+    # Verify package versions
+    print("checking changed package versions...")
+    check_versions(args, packages)

.ci/lib/check_changed_kernels.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+# Copyright 2023 Oliver Smith
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import glob
+import tempfile
+import sys
+import subprocess
+
+# Same dir
+import common
+
+# pmbootstrap
+import add_pmbootstrap_to_import_path  # noqa
+import pmb.parse
+import pmb.helpers.logging
+
+
+def check_kconfig(args, pkgnames):
+    last_failed = None
+    for i in range(len(pkgnames)):
+        pkgname = pkgnames[i]
+        print(f"  ({i+1}/{len(pkgnames)}) {pkgname}")
+
+        apkbuild_path = pmb.helpers.pmaports.find(args, pkgname)
+        apkbuild = pmb.parse._apkbuild.apkbuild(f"{apkbuild_path}/APKBUILD")
+
+        options = []
+
+        for opt in apkbuild["options"]:
+            if "pmb:kconfigcheck" in opt:
+                options += [opt]
+
+        if len(options):
+            options.sort()
+            print(f'options="{" ".join(options)}"')
+
+        if "!pmb:kconfigcheck" in apkbuild["options"]:
+            print("skipped (!pmb:kconfigcheck)")
+            continue
+
+        if not pmb.parse.kconfig.check(args, pkgname, details=True):
+            last_failed = pkgname
+
+    return last_failed
+
+
+def show_error(last_failed):
+    print("")
+    print("Please adjust your kernel config. This is required for getting your"
+          " patch merged.")
+    print("")
+    print("Edit your kernel config:")
+    print(f"  pmbootstrap kconfig edit {last_failed}")
+    print("")
+    print("Test this kernel config again:")
+    print(f"  pmbootstrap kconfig check {last_failed}")
+    print("")
+    print("Run this check again (on all kernels you modified):")
+    print("  pmbootstrap ci kconfig")
+    print("")
+
+
+if __name__ == "__main__":
+    common.add_upstream_git_remote()
+    pkgnames = common.get_changed_kernels()
+    print(f"Changed kernels: {pkgnames}")
+
+    if len(pkgnames) == 0:
+        print("No kernels changed in this branch")
+        exit(0)
+
+    # Initialize args (so we can use pmbootstrap's kconfig parsing)
+    sys.argv = ["pmbootstrap", "kconfig", "check"]
+    args = pmb.parse.arguments()
+    pmb.helpers.logging.init(args)
+
+    print("Running kconfig check on changed kernels...")
+    last_failed = check_kconfig(args, pkgnames)
+
+    if last_failed:
+        show_error(last_failed)
+        exit(1)

.ci/lib/check_changed_versions.py

@@ -1,212 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2021 Oliver Smith
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-import glob
-import pathlib
-import tempfile
-import sys
-import subprocess
-
-# Same dir
-import common
-
-# pmbootstrap
-import pmb.parse
-import pmb.parse.version
-import pmb.helpers.logging
-from pmb.core.context import get_context
-
-def get_package_contents(package, revision, check=True):
-    # Redirect stderr to /dev/null, so git doesn't complain about files not
-    # existing in upstream branch for new packages
-    stderr = None
-    if not check:
-        stderr = subprocess.DEVNULL
-
-    # Run something like "git show upstream/master:main/hello-world/APKBUILD"
-    pmaports_dir = common.get_pmaports_dir()
-    pattern = pmaports_dir + "/**/" + package + "/APKBUILD"
-    path = glob.glob(pattern, recursive=True)[0][len(pmaports_dir + "/"):]
-    apkbuild_content = common.run_git(["show", revision + ":" + path], check,
-                                      stderr)
-    if not apkbuild_content:
-        return None
-
-    # Save APKBUILD to a temporary path and parse it from there. (Not the best
-    # way to do things, but good enough for this CI script.)
-    with tempfile.TemporaryDirectory() as tempdir:
-        with open(tempdir + "/APKBUILD", "w", encoding="utf-8") as handle:
-            handle.write(apkbuild_content)
-        parsed = pmb.parse.apkbuild(pathlib.Path(tempdir, "APKBUILD"),
-                                    False, False)
-
-    return parsed
-
-
-def get_package_version(package, revision, check=True):
-    """ returns version in the format "{pkgver}-r{pkgrel}", or None if no
-        matching package is found """
-    parsed = get_package_contents(package, revision, check)
-    if parsed is None:
-        return None
-    return parsed["pkgver"] + "-r" + parsed["pkgrel"]
-
-
-def version_compare_operator(result):
-    """ :param result: return value from pmb.parse.version.compare() """
-    if result == -1:
-        return "<"
-    elif result == 0:
-        return "=="
-    elif result == 1:
-        return ">"
-
-    raise RuntimeError("Unexpected version_compare_operator input: " + result)
-
-
-def exit_with_error_message():
-    branch = common.get_upstream_branch()
-    print()
-    print("ERROR: Modified package(s) don't have an increased version or a")
-    print("new package has a nonzero pkgrel!")
-    print()
-    print("This can happen if you added a new package with a nonzero")
-    print("pkgrel, or if you did not change the pkgver/pkgrel")
-    print("variables in the APKBUILDs. Or you did change them, but the")
-    print(f"packages have been updated in the official '{branch}' branch, and")
-    print("now your versions are not higher anymore.")
-    print()
-    print("Your options:")
-    print("a) If you made changes to the packages, and did not increase the")
-    print("   pkgrel/pkgver: increase them now, and force push your branch.")
-    print("   => https://postmarketos.org/howto-bump-pkgrel-pkgver")
-    print("b) If you had already increased the package versions, rebase on")
-    print(f"   '{branch}', increase the versions again and then force push:")
-    print("   => https://postmarketos.org/rebase")
-    print("c) If you made a change, that does not require rebuilding the")
-    print("   packages, such as only changing the arch=... line: you can")
-    print("   disable this check by adding '[ci:skip-vercheck]' to the")
-    print("   latest commit message, then force push.")
-    print()
-    print("Thank you and sorry for the inconvenience.")
-    exit(1)
-
-
-def check_versions(packages):
-    error = False
-
-    # Get relevant commits: compare HEAD against upstream branch or HEAD~1
-    # (the latter if this CI check is running on upstream branch). Note that
-    # for the common.get_changed_files() code, we don't check against
-    # upstream branch HEAD, but against the latest common ancestor. This is not
-    # desired here, since we already know what packages changed, and really
-    # want to check if the version was increased towards *current* upstream
-    # branch HEAD.
-    common.run_git(["remote", "add", "upstream",
-             "https://gitlab.postmarketos.org/postmarketOS/pmaports.git"], False)
-    common.run_git(["fetch", "-q", "upstream"])
-    commit = f"upstream/{common.get_upstream_branch()}"
-    if common.run_git(["rev-parse", "HEAD"]) == common.run_git(["rev-parse",
-                                                                commit]):
-        print(f"NOTE: {commit} is on same commit as HEAD, comparing"
-              " HEAD against HEAD~1.")
-        commit = "HEAD~1"
-
-    # Exclude linux-next from pkgrel checks, as it is updated automatically.
-    #
-    # Without this, .ci/commits.sh complains about the following:
-    # ERROR: Modified package(s) don't have an increased version or a new
-    #        package has a nonzero pkgrel!
-    if "linux-next" in packages:
-        packages.remove("linux-next")
-
-    for package in packages:
-        # Get versions, skip new packages
-        head = get_package_version(package, "HEAD")
-        upstream = get_package_version(package, commit, False)
-        if not upstream:
-            if head.rpartition('r')[2] != "0":
-                print(f"- {package}: {head} (HEAD) (new package) [ERROR]")
-                error = True
-            else:
-                print(f"- {package}: {head} (HEAD) (new package)")
-            continue
-
-        # Check pkgver follows expected format for device packages
-        pkgver = head.rpartition('-r')[0]
-        if package.startswith('device-') and not pkgver.isdigit():
-            print(f" - {package}: invalid pkgver \"{pkgver}\""
-                  "See: https://wiki.postmarketos.org/wiki/Packaging#device_packages_and_other_packages_without_sources")
-            error = True
-
-        # Additional checks for device packages
-        if package.startswith('device-'):
-            head_parsed = get_package_contents(package, "HEAD", False)
-            upstream_parsed = get_package_contents(package, commit, False)
-
-            # checksums did not change
-            if head_parsed["sha512sums"] == upstream_parsed["sha512sums"]:
-                # Check that pkgver did not change
-                if head_parsed["pkgver"] != upstream_parsed["pkgver"]:
-                    print(f" - {package}: pkgver should not change when package source checksums did not change."
-                          "See: https://wiki.postmarketos.org/wiki/Packaging#device_packages_and_other_packages_without_sources")
-                    error = True
-                # We do not check for a bumped pkgrel, because not everything
-                # needs it, e.g: pmb_recommends
-            # checksums changed
-            else:
-                # Check that pkgrel was reset to 0
-                if head_parsed["pkgrel"] != "0":
-                    print(f" - {package}: pkgrel should be 0 when package source checksums change."
-                          "See: https://wiki.postmarketos.org/wiki/Packaging#device_packages_and_other_packages_without_sources")
-                    error = True
-                # Check that pkgver was changed
-                if head_parsed["pkgver"] == upstream_parsed["pkgver"]:
-                    print(f" - {package}: pkgver should change when package source checksums change."
-                          "See: https://wiki.postmarketos.org/wiki/Packaging#device_packages_and_other_packages_without_sources")
-                    error = True
-
-        # Compare head and upstream versions
-        result = pmb.parse.version.compare(head, upstream)
-        if result != 1:
-            error = True
-
-        # Print result line ("- hello-world: 1-r2 (HEAD) > 1-r1 (HEAD~1)")
-        formatstr = "- {}: {} (HEAD) {} {} ({})"
-        if result != 1:
-            formatstr += " [ERROR]"
-        operator = version_compare_operator(result)
-        print(formatstr.format(package, head, operator, upstream, commit))
-
-    if error:
-        exit_with_error_message()
-
-
-if __name__ == "__main__":
-    # Get and print modified packages
-    packages = common.get_changed_packages()
-    if len(packages) == 0:
-        print("no aports changed in this branch")
-        exit(0)
-
-    print(f"Changed packages: {packages}")
-
-    # Potentially skip this check
-    if common.commit_message_has_string("[ci:skip-vercheck]"):
-        print("WARNING: not checking for changed package versions"
-              " ([ci:skip-vercheck])!")
-        exit(0)
-
-    # Initialize args (so we can use pmbootstrap's APKBUILD parsing)
-    sys.argv = ["pmbootstrap.py", "chroot"]
-    args = pmb.parse.arguments()
-    context = get_context()
-
-    # pmb.helpers.logging.init(args)
-    pmb.helpers.logging.init(context.log, args.verbose, context.details_to_stdout)
-
-
-    # Verify package versions
-    print("checking changed package versions...")
-    check_versions(packages)

.ci/lib/check_devices_in_wiki.py

@@ -2,20 +2,20 @@
 # Copyright 2023 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from pathlib import Path
 import argparse
+import glob
+import os
 import sys
 import urllib.request
 
-# Same dir
-import common
 
-def get_devices() -> list[str]:
+def get_devices():
     """:returns: list of all devices"""
     ret = []
-    pmaports = Path(__file__).resolve().parents[2]
-    for path in pmaports.glob("device/*/device-*/"):
-        device = path.name.split("device-", 1)[1]
+    pmaports = (os.path.realpath(os.path.join(os.path.dirname(__file__) +
+                "/../..")))
+    for path in glob.glob(pmaports + "/device/*/device-*/"):
+        device = os.path.dirname(path).split("device-", 1)[1]
 
         # -downstream suffix is used when packaging the downstream kernel for
         # devices that have a working mainline kernel. Those are usually
@@ -28,7 +28,7 @@ def get_devices() -> list[str]:
     return sorted(ret)
 
 
-def get_wiki_devices_html(path: Path | None) -> dict[str, str]:
+def get_wiki_devices_html(path):
     """:param path: to a local file with the saved content of the devices wiki
                     page or None to download a fresh copy
        :returns: HTML of the page, split into booting and not booting:
@@ -41,9 +41,8 @@ def get_wiki_devices_html(path: Path | None) -> dict[str, str]:
             content = handle.read()
     else:
         # Download wiki page
-        url = "https://wiki.postmarketos.org/wiki/Devices"
-        with urllib.request.urlopen(url) as f:
-            content = f.read().decode("utf-8")
+        url = "http://wiki.postmarketos.org/wiki/Devices"
+        content = urllib.request.urlopen(url).read().decode("utf-8")
 
     # Split into booting and not booting
     split = content.split("<span class=\"mw-headline\" id=\"Non-booting_devices\">")
@@ -54,16 +53,14 @@ def get_wiki_devices_html(path: Path | None) -> dict[str, str]:
     return {"booting": split[0], "not_booting": split[1]}
 
 
-def get_wiki_renamed_devices_html() -> str:
+def get_wiki_renamed_devices_html():
     """:returns: HTML of the page"""
     # Download wiki page
-    url = "https://wiki.postmarketos.org/wiki/Renamed_Devices"
-    with urllib.request.urlopen(url) as f:
-        res: bytes = f.read()
-        return res.decode("utf-8")
+    url = "http://wiki.postmarketos.org/wiki/Renamed_Devices"
+    return urllib.request.urlopen(url).read().decode("utf-8")
 
 
-def check_device(device: str, html: dict[str, str], is_booting: bool) -> bool:
+def check_device(device, html, is_booting):
     """:param is_booting: require the device to be in the booting section, not
                           just anywhere in the page (i.e. in the not booting
                           table).
@@ -85,7 +82,7 @@ def check_device(device: str, html: dict[str, str], is_booting: bool) -> bool:
     return False
 
 
-def main() -> int:
+def main():
     # Parse arguments
     parser = argparse.ArgumentParser()
     parser.add_argument("--booting", help="devices must be in the upper table,"
@@ -95,31 +92,21 @@ def main() -> int:
                         action="store_true")
     parser.add_argument("--path", help="instead of downloading the devices"
                         " page from the wiki, use a local HTML file",
-                        type=Path, default=None)
-    parser.add_argument("--all", help="check all devices (default: check only"
-                        " devices changed from branch point)",
-                        action="store_true")
+                        default=None)
     args = parser.parse_args()
 
+    # Check all devices
     html = get_wiki_devices_html(args.path)
     html["renamed"] = get_wiki_renamed_devices_html()
     error = False
-    devices = []
-    if args.all:
-        devices = get_devices()
-    else:
-        devices = common.get_changed_devices(skip_archived=True)
-        # remove 'device-' prefix
-        devices = [d[7:] for d in devices]
-        devices = [d.removesuffix("-downstream") for d in devices]
-    for device in devices:
+    for device in get_devices():
         if not check_device(device, html, args.booting):
             error = True
 
     # Ask to adjust the wiki
     if error:
         print("*** Wiki check failed!")
-        print("Thank you for porting postmarketOS to a new device! \\o/")
+        print("Thank you for porting postmarketOS to a new device! \o/")
         print("")
         print("Now it's time to add some documentation:")
         print("1) Create a device specific wiki page as described here:")
@@ -139,8 +126,8 @@ def main() -> int:
         print("wiki as well and make sure to add it here:")
         print("https://postmarketos.org/renamed")
         return 1
-
-    print("*** Wiki check successful!")
+    else:
+        print("*** Wiki check successful!")
     return 0
 
 

.ci/lib/common.py

@@ -7,12 +7,19 @@
 import configparser
 import os
 import subprocess
-from functools import cache
+import sys
+
+
+cache = {}
 
 
-@cache
 def get_pmaports_dir():
-    return os.path.realpath(os.path.join(os.path.dirname(__file__) + "/../.."))
+    global cache
+    if "pmaports_dir" in cache:
+        return cache["pmaports_dir"]
+    ret = os.path.realpath(os.path.join(os.path.dirname(__file__) + "/../.."))
+    cache["pmaports_dir"] = ret
+    return ret
 
 
 def run_git(parameters, check=True, stderr=None):
@@ -26,35 +33,35 @@ def run_git(parameters, check=True, stderr=None):
         return None
 
 
+def add_upstream_git_remote():
+    """ Add a remote pointing to postmarketOS/pmaports. """
+    run_git(["remote", "add", "upstream",
+             "https://gitlab.com/postmarketOS/pmaports.git"], False)
+    run_git(["fetch", "-q", "upstream"])
+
+
 def commit_message_has_string(needle):
-    base_commit = get_base_commit()
-
-    return needle in run_git(["log", "--pretty=format:%B", f"{base_commit}..HEAD"])
+    return needle in run_git(["show", "-s", "--format=full", "HEAD"])
 
 
-def all_committed_by_merge_bot():
-    base_commit = get_base_commit()
-    commit_emails = run_git(["log", "--pretty=format:%ce", f"{base_commit}..HEAD"]).splitlines()
-    bot_email = os.getenv("PMOS_MERGE_BOT_EMAIL", "merge-bot@postmarketos.org")
-    return all(bot_email == ce for ce in commit_emails)
-
-
-def run_pmbootstrap(parameters):
+def run_pmbootstrap(parameters, output_return=False):
     """ Run pmbootstrap with the pmaports dir as --aports """
     cmd = ["pmbootstrap", "--aports", get_pmaports_dir()] + parameters
-    subprocess.run(cmd, universal_newlines=True, check=True)
+    stdout = subprocess.PIPE if output_return else None
+    result = subprocess.run(cmd, stdout=stdout, universal_newlines=True)
+    result.check_returncode()
+    if output_return:
+        return result.stdout
 
 
-@cache
 def get_upstream_branch():
     """ Use pmaports.cfg from current branch (e.g. "v20.05_fix-ci") and
         channels.cfg from master to retrieve the upstream branch.
 
         :returns: branch name, e.g. "v20.05" """
-
-    # Prefer gitlab CI target branch name if it's set (i.e. running in gitlab CI)
-    if target_branch := os.environ.get("CI_MERGE_REQUEST_TARGET_BRANCH_NAME"):
-        return target_branch
+    global cache
+    if "upstream_branch" in cache:
+        return cache["upstream_branch"]
 
     # Get channel (e.g. "stable") from pmaports.cfg
     # https://postmarketos.org/pmaports.cfg
@@ -73,28 +80,22 @@ def get_upstream_branch():
         " This appears to be an old branch, consider recreating your change" \
         " on top of master."
 
-    return channels_cfg[channel]["branch_pmaports"]
+    ret = channels_cfg[channel]["branch_pmaports"]
+    cache["upstream_branch"] = ret
+    return ret
 
 
-@cache
-def get_base_commit() -> str:
-    """Get the base commit that can be compared with HEAD to get all commits in the
-    given branch/merge request."""
-
-    commit = os.getenv("CI_MERGE_REQUEST_DIFF_BASE_SHA")
-    if commit is not None:
-        return commit
-
-    # Add a remote pointing to postmarketOS/pmaports
-    run_git(["remote", "add", "upstream",
-             "https://gitlab.postmarketos.org/postmarketOS/pmaports.git"], False)
-    run_git(["fetch", "-q", "upstream"])
-
+def get_changed_files(removed=True):
+    """ Get all changed files and print them, as well as the branch and the
+        commit that was used for the diff.
+        :param removed: also return removed files (default: True)
+        :returns: set of changed files
+    """
     branch_upstream = f"upstream/{get_upstream_branch()}"
     commit_head = run_git(["rev-parse", "HEAD"])[:-1]
     commit_upstream = run_git(["rev-parse", branch_upstream])[:-1]
     print("commit HEAD: " + commit_head)
-    print(f"commit {branch_upstream}: {commit_upstream}")
+    print(f"commit {branch_upstream}: f{commit_upstream}")
 
     # Check if we are HEAD on the upstream branch
     if commit_head == commit_upstream:
@@ -105,17 +106,6 @@ def get_base_commit() -> str:
         commit = run_git(["merge-base", branch_upstream, "HEAD"])[:-1]
     print("comparing HEAD with: " + commit)
 
-    return commit
-
-
-def get_changed_files(removed=False):
-    """ Get all changed files and print them, as well as the branch and the
-        commit that was used for the diff.
-        :param removed: also return removed files (default: True)
-        :returns: set of changed files
-    """
-    commit = get_base_commit()
-
     # Changed files
     ret = set()
     print("changed file(s):")
@@ -131,22 +121,49 @@ def get_changed_files(removed=False):
     return ret
 
 
-def get_changed_packages(skip_archived: bool = False):
+def get_changed_packages_sanity_check(count):
+    for mark in ["[ci:ignore-count]", "[ci:skip-build]"]:
+        if commit_message_has_string(mark):
+            print("NOTE: package count sanity check skipped (" + mark + ").")
+            return
+    if count <= 10:
+        return
+
+    branch = get_upstream_branch()
+    print()
+    print("ERROR: Too many packages have changed!")
+    print()
+    print("This is a sanity check, so we don't end up building packages that")
+    print("have not been modified. CI won't run for more than one hour")
+    print("anyway.")
+    print()
+    print("Your options:")
+    print("a) If you *did not* modify everything listed above, then rebase")
+    print(f"   your branch on the official postmarketOS/pmaports.git {branch}")
+    print("   branch. Feel free to ask in the chat for help if you need any.")
+    print("b) If you *did* modify all these packages, and you assume that")
+    print("   they will build within one hour: skip this sanity check by")
+    print("   adding '[ci:ignore-count]' to the commit message (then force")
+    print("   push).")
+    print("c) If you *did* modify all these packages, and you are sure that")
+    print("   they won't build in time, please add '[ci:skip-build]' to the")
+    print("   commit message (then force push). Make sure that all packages")
+    print("   build with 'pmbootstrap build --strict'!")
+    print()
+    print("Thank you and sorry for the inconvenience.")
+
+    sys.exit(1)
+
+
+def get_changed_packages():
     ret = set()
-    for file in get_changed_files(removed=True):
+    for file in get_changed_files():
         dirname, filename = os.path.split(file)
 
         # Skip files:
         # * in the root dir of pmaports (e.g. README.md)
         # * path with a dot (e.g. .ci/, device/.shared-patches/)
-        # * documentation
-        if (
-                not dirname
-                or file.startswith(".")
-                or "/." in file
-                or skip_archived and dirname.startswith("device/archived")
-                or dirname == "docs"
-        ):
+        if not dirname or file.startswith(".") or "/." in file:
             continue
 
         if filename != "APKBUILD":
@@ -175,16 +192,9 @@ def get_changed_packages(skip_archived: bool = False):
     return ret
 
 
-def get_changed_kernels(skip_archived: bool = False):
+def get_changed_kernels():
     ret = []
-    for pkgname in get_changed_packages(skip_archived):
+    for pkgname in get_changed_packages():
         if pkgname.startswith("linux-"):
             ret += [pkgname]
     return ret
-
-def get_changed_devices(skip_archived: bool = False):
-    ret = []
-    for pkgname in get_changed_packages(skip_archived):
-        if pkgname.startswith("device-"):
-            ret += [pkgname]
-    return ret

.ci/lib/deviceinfo_linting.py

@@ -1,21 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2025 Stefan Hansson
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-import common
-import os.path
-import subprocess
-import sys
-
-if __name__ == "__main__":
-    if common.commit_message_has_string("[ci:skip-dint]"):
-        print("WARNING: not linting deviceinfo files ([ci:skip-dint])")
-        exit(0)
-    # only lint deviceinfo files in the devices repo
-    deviceinfo_files = {file for file in common.get_changed_files()
-                        if os.path.basename(file) == "deviceinfo" and file.startswith("device/")}
-
-    try:
-        subprocess.run(["dint", "check", *deviceinfo_files], text=True, check=True)
-    except subprocess.CalledProcessError as exception:
-        sys.exit(exception.returncode)

.ci/lib/generate_build_jobs.py

@@ -1,223 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2025 Pablo Correa Gomez
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-import argparse
-from functools import cached_property
-from pathlib import Path
-from typing import Self
-import sys
-import traceback
-
-from jinja2 import Template
-import pmb.parse
-from pmb.parse.deviceinfo import Deviceinfo
-from pmb.types import Apkbuild
-import pmb.helpers.devices
-import pmb.helpers.logging
-import pmb.helpers.package
-from pmb.core.arch import Arch
-
-# Same dir
-import common
-
-
-class Device:
-    def __init__(self, codename: str):
-        self.codename = codename
-        self.full_path = pmb.helpers.devices.find_path(codename)
-
-    def __repr__(self):
-        return f"Device({self.codename})"
-
-    @property
-    def name(self):
-        return self.full_path.name.removeprefix("device-")
-
-    @cached_property
-    def gitlab_ci_fragment(self) -> str | None:
-        fragment_path = self.full_path / "gitlab-ci.yml.j2"
-        try:
-            fragment_tmpl = fragment_path.read_text()
-        except Exception:
-            return None
-
-        return Template(fragment_tmpl).render(device=self)
-
-    @cached_property
-    def pmaports_path(self) -> Path:
-        # Find the root of pmaports
-        pmaports_root = self.full_path.parent
-        while (not (pmaports_root / "pmaports.cfg").exists() and
-               pmaports_root != pmaports_root.root):
-            pmaports_root = pmaports_root.parent
-        assert pmaports_root != pmaports_root.root
-
-        return self.full_path.relative_to(pmaports_root)
-
-    @cached_property
-    def apkbuild(self) -> Apkbuild:
-        return pmb.parse.apkbuild(self.full_path)
-
-    @property
-    def pkgname(self) -> str:
-        return self.apkbuild['pkgname']
-
-    @property
-    def arch(self) -> Arch:
-        return Arch(self.apkbuild['arch'][0])
-
-    @property
-    def testing_dependencies(self) -> set[str]:
-        # TODO: Source this from the APKBUILD
-        return {"postmarketos-mkinitfs-hook-ci"}
-
-    @cached_property
-    def package_dependencies(self) -> set[str]:
-        # HACK: Work around a bug in depends_recurse which prevents listing all the dependencies
-        # Bug: https://gitlab.postmarketos.org/postmarketOS/pmbootstrap/-/issues/2623
-        return {"postmarketos-initramfs"}
-        # return pmb.helpers.package.depends_recurse(pkgname=self.pkgname,
-        #                                            arch=self.arch)
-
-    @cached_property
-    def dependencies(self) -> set[str]:
-        return self.package_dependencies | self.testing_dependencies
-
-    @cached_property
-    def kernel_variants(self) -> list[str]:
-        kernels = []
-
-        subpackage_prefix = f"device-{self.codename}-kernel-"
-        for subpkgname in self.apkbuild.get('subpackages', []):
-            if not subpkgname.startswith(subpackage_prefix):
-                continue
-            kernel_name = subpkgname.removeprefix(subpackage_prefix)
-
-            # Ignore `none` kernels as they are not bootable
-            if kernel_name != "none":
-                kernels.append(kernel_name)
-
-        return kernels
-
-    @cached_property
-    def deviceinfo(self) -> dict[str, Deviceinfo] | Deviceinfo:
-        # NOTE: deviceinfo files that have different values per kernel are
-        # currently unsupported due to a gitlab-ci issue which prevents us
-        # from having a per-kernel list of variables that would be selected
-        # using `.extends`:
-        # https://gitlab.com/gitlab-org/gitlab/-/issues/299423
-        return Deviceinfo(self.full_path / "deviceinfo", None)
-
-    @property
-    def has_kernel_variants(self):
-        return len(self.kernel_variants) > 0
-
-    @classmethod
-    def supported_devices(cls) -> dict[Path, Self]:
-        # NOTE: Not sure I like relying on pmboostrap just to avoid listing
-        # devices ourselves, but since we need it to parse the APKBUILD, then
-        # let's avoid duplicating the logic?
-        supported_devices = {}
-        for vendor in pmb.helpers.devices.list_vendors():
-            for device in pmb.helpers.devices.list_codenames(vendor):
-                try:
-                    dev = cls(device.codename)
-
-                    # Ignore devices that do not have a gitlab ci fragment,
-                    # since adding that fragment is how we mark them as DUTs
-                    if not dev.gitlab_ci_fragment:
-                        continue
-
-                    supported_devices[dev.pmaports_path] = dev
-                except Exception:
-                    traceback.print_exc()
-        return supported_devices
-
-
-class ArchTagSet(set):
-    def update(self, iterable):
-        supported_arches = Arch.supported_binary()
-        # This ignores things like !armv7, that could be a follow-up optimization
-        if 'noarch' in iterable or 'all' in iterable:
-            iterable = [arch for arch in supported_arches]
-        super().update([Arch(arch) for arch in iterable if Arch(arch) in supported_arches])
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(
-        formatter_class=argparse.ArgumentDefaultsHelpFormatter,
-    )
-    parser.add_argument("--template", default=".ci/build-jobs.yaml.j2", help="Jinja2 input template")
-    parser.add_argument("--output", default=".ci/build-jobs.yaml", help="output pipeline")
-    args = parser.parse_args()
-
-    # pmb logging has to be initialized for later pmb commands to work, setting
-    # to /dev/null since we don't care about the output. Later this could
-    # be changed to a file and added as a CI artifact if we need to debug
-    # something.
-    pmb.logging.init(Path("/dev/null"), False)
-
-    # Load context
-    sys.argv = ["pmbootstrap.py", "chroot"]
-    _ = pmb.parse.arguments()
-
-    # Get the list of supported devices
-    supported_devices = Device.supported_devices()
-    print(f"Supported devices: {[d for d in supported_devices.values()]}")
-
-    archs = ArchTagSet()
-    devices_under_test = set()
-    packages_modified = set()
-    # Get and print modified packages
-    for file in common.get_changed_files():
-        path = Path(file)
-
-        # Check if the modified's file parent folder is one of a supported dev
-        if device := supported_devices.get(path.parent):
-            devices_under_test.add(device)
-
-        if path.name != "APKBUILD":
-            continue
-        apkbuild = pmb.parse.apkbuild(path)
-        packages_modified.add(apkbuild['pkgname'])
-        archs.update(apkbuild["arch"])
-
-        # Add all the devices found in CI that depend on the package that got
-        # modified
-        for device in supported_devices.values():
-            if apkbuild['pkgname'] in device.dependencies:
-                devices_under_test.add(device)
-
-    skip = False
-    if common.commit_message_has_string("[ci:skip-build]"):
-        print("User requested skipping build, skipping build")
-        skip = True
-    if common.all_committed_by_merge_bot():
-        print("All commits in branch committed by merge bot, skipping build")
-        skip = True
-    if skip:
-        archs = ArchTagSet()
-        devices_under_test = set()
-
-    print(f"Architectures to build: {archs}")
-    print(f"Devices under test: {devices_under_test}")
-
-    with open(args.template) as f:
-        rendered = Template(f.read()).render(
-            archs=archs,
-            devices_under_test=devices_under_test,
-            packages_modified=packages_modified,
-            archtag={
-                Arch.x86_64: "shared",
-                Arch.x86: "shared",
-                Arch.aarch64: "arm64",
-                Arch.armv7: "qemu",
-                Arch.armhf: "qemu",
-                Arch.riscv64: "qemu",
-                Arch.ppc64le: "ppc64le",
-                Arch.loongarch64: "loongarch64",
-            },
-        )
-        with open(args.output, "w") as fw:
-            fw.write(rendered)

.ci/lib/kconfig.py

@@ -1,96 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2024 Oliver Smith
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-import subprocess
-
-# Same dir
-import common
-
-
-def check_kconfig(pkgnames):
-    last_failed = None
-    for i in range(len(pkgnames)):
-        pkgname = pkgnames[i]
-        print(f"  ({i+1}/{len(pkgnames)}) {pkgname}")
-
-        p = subprocess.run(["pmbootstrap", "kconfig", "check", "--keep-going", pkgname],
-                           check=False)
-
-        if p.returncode:
-            last_failed = pkgname
-
-    return last_failed
-
-
-def check_kconfig_all():
-    p = subprocess.run(["pmbootstrap", "kconfig", "check", "--keep-going"], check=False)
-    return p.returncode == 0
-
-
-def show_error(last_failed):
-    print("")
-    print("---")
-    print("")
-    print("Please adjust your kernel config. This is required for getting your"
-          " patch merged.")
-    print("")
-    print("Edit your kernel config:")
-    print(f"  pmbootstrap kconfig edit {last_failed}")
-    print("")
-    print("Test this kernel config again:")
-    print(f"  pmbootstrap kconfig check {last_failed}")
-    print("")
-    print("Run this check again (on all kernels you modified):")
-    print("  pmbootstrap ci kconfig")
-    print("")
-    print("---")
-    print("")
-
-
-def show_error_all():
-    print("")
-    print("---")
-    print("")
-    print("Please adjust the failed kernel configs. This is required for")
-    print("getting your patch merged.")
-    print("")
-    print("If a kernel in the testing category failed, and fixing is too much")
-    print("effort, remove 'pmb:kconfigcheck-community' from the APKBUILD.")
-    print("")
-    print("Edit a kernel config:")
-    print("  pmbootstrap kconfig edit <PACKAGE NAME>")
-    print("")
-    print("Test a specific kernel config again:")
-    print("  pmbootstrap kconfig check <PACKAGE NAME>")
-    print("")
-    print("Run this check again (on all kernels you modified):")
-    print("  pmbootstrap ci kconfig")
-    print("")
-    print("---")
-    print("")
-
-
-if __name__ == "__main__":
-    if "kconfigcheck.toml" in common.get_changed_files():
-        print("kconfigcheck.toml changed -> checking all kernels")
-        if not check_kconfig_all():
-            show_error_all()
-            exit(1)
-        exit(0)
-
-    pkgnames = common.get_changed_kernels(skip_archived=True)
-    print(f"Changed kernels: {pkgnames}")
-
-    if len(pkgnames) == 0:
-        print("No kernels changed in this branch")
-        exit(0)
-    elif common.commit_message_has_string("[ci:skip-kconfigcheck]"):
-        print("WARNING: not checking kernel configs ([ci:skip-kconfigcheck])")
-        exit(0)
-
-    last_failed = check_kconfig(pkgnames)
-
-    if last_failed:
-        show_error(last_failed)
-        exit(1)

.ci/lib/testlib.sh

@@ -1,283 +0,0 @@
-#!/bin/sh
-# Unit testing framework for shell scripts
-# Invoke with the path to a tests/ subdir of a package and the
-# package name as arguments. Or source it with the following
-# variables set:
-# * results_dir - second argument to the test script
-
-set -e
-
-# Colors :D
-RED="\e[31m"
-GREEN="\e[32m"
-YELLOW="\e[33m"
-BLUE="\e[34m"
-BOLDBLUE="\e[1;34m"
-RESET="\e[0m"
-
-testlib_path="$(realpath "$0")"
-
-_test_assert_failed=""
-_test_testn=1
-_test_passedn=0
-_test_failedn=0
-_test_current_test=""
-_test_statefile="$(mktemp)"
-_test_original_pwd=""
-_test_temp_root=""
-# Set by each test
-results_dir="${results_dir:-}"
-
-test_log() {
-	# ash supports echo -e
-	# shellcheck disable=SC3037
-	echo -e "$*" >&2
-}
-
-test_info() {
-	# shellcheck disable=SC3037
-	echo -e "${BLUE}$*${RESET}" >&2
-}
-
-test_debug() {
-	# shellcheck disable=SC3037
-	echo -e "${YELLOW}$*${RESET}" >&2
-}
-
-create_test_root() {
-	_test_original_pwd="$(pwd)"
-	_test_temp_root="$(mktemp -d)"
-	cd "$_test_temp_root"
-}
-
-cleanup_test_root() {
-	if [ -n "$_test_original_pwd" ]; then
-		cd "$_test_original_pwd"
-	fi
-	if [ -n "$_test_temp_root" ] && [ -d "$_test_temp_root" ]; then
-		rm -rf "$_test_temp_root"
-	fi
-	_test_original_pwd=""
-	_test_temp_root=""
-}
-
-assert_strequal() {
-	# $1: first string
-	# $2: second string
-	if [ -z "$1" ] || [ -z "$2" ]; then
-		test_log "ERROR: assert_equal: not enough arguments given"
-		exit 1
-	fi
-	if [ "$1" != "$2" ]; then
-		_test_assert_failed="$1 != $2"
-		test_log "    ❌ $_test_assert_failed"
-		return
-	fi
-	test_log "    ✅ $1 == $2"
-}
-
-assert_equal() {
-	# $1: name of variable
-	# $2: value to compare
-	if [ -z "$1" ] || [ -z "$2" ]; then
-		test_log "ERROR: assert_equal: not enough arguments given"
-		exit 1
-	fi
-	val="$(eval echo "\$$1")"
-	if [ "$val" != "$2" ]; then
-		_test_assert_failed="\$$1 != $2 (got $val)"
-		test_log "    ❌ $_test_assert_failed"
-		return
-	fi
-	test_log "    ✅ \$$1 == $2"
-}
-
-assert_unset() {
-	if [ -z "$1" ]; then
-		test_log "ERROR: assert_unset: not enough arguments given"
-		exit 1
-	fi
-	val="$(eval echo \$"$1")"
-	if [ -n "$val" ]; then
-		_test_assert_failed="\$$1 should be unset (has value '$val')"
-		test_log "    ❌ $_test_assert_failed"
-		return
-	fi
-	test_log "    ✅ \$$1 is unset"
-}
-
-assert_exists() {
-	# $1: filename to test
-	if [ -z "$1" ]; then
-		test_log "ERROR: assert_exists: not enough arguments given"
-		exit 1
-	fi
-	if ! [ -e "$1" ]; then
-		_test_assert_failed="\$$1 should exist but does not"
-		test_log "    ❌ $_test_assert_failed"
-		return
-	fi
-	test_log "    ✅ \$$1 exists"
-}
-
-assert_not_exists() {
-	if [ -z "$1" ]; then
-		test_log "ERROR: assert_not_exists: not enough arguments given"
-		exit 1
-	fi
-	if [ -e "$1" ]; then
-		_test_assert_failed="\$$1 should NOT exist but does"
-		test_log "    ❌ $_test_assert_failed"
-		return
-	fi
-	test_log "    ✅ \$$1 does not exist"
-}
-
-assert_contains() {
-	# $1: string to search in
-	# $2: substring to find
-	if [ -z "$1" ] || [ -z "$2" ]; then
-		test_log "ERROR: assert_contains: not enough arguments given"
-		exit 1
-	fi
-	case "$1" in
-		*"$2"*)
-			test_log "    ✅ '$2' found in '$1'"
-			;;
-		*)
-			_test_assert_failed="'$2' not found in '$1'"
-			test_log "    ❌ $_test_assert_failed"
-			return
-			;;
-	esac
-}
-
-assert_not_contains() {
-	# $1: string to search in
-	# $2: substring that should not be found
-	if [ -z "$1" ] || [ -z "$2" ]; then
-		test_log "ERROR: assert_not_contains: not enough arguments given"
-		exit 1
-	fi
-	case "$1" in
-		*"$2"*)
-			_test_assert_failed="'$2' found in '$1' but should not be"
-			test_log "    ❌ $_test_assert_failed"
-			return
-			;;
-		*)
-			test_log "    ✅ '$2' not found in '$1'"
-			;;
-	esac
-}
-
-# Log some expression and evaluate it
-logeval() {
-	eval "$*"
-	test_log "${YELLOW}+ $*${RESET}"
-}
-
-# Start a test. Shell scripts involved in the test should be sourced AFTER calling this function!
-start_test() {
-	if [ -n "$_test_current_test" ]; then
-		test_log "ERROR: multiple calls to start_test without calling end_test first!"
-		test_log "Current test: $_test_current_test"
-		exit 1
-	fi
-	test_log "==> Test $_test_testn: $1"
-	_test_current_test="$1"
-	set > "$_test_statefile"
-}
-
-# End a test and reset the environment.
-end_test() {
-	local msg
-	local save_assert_failed
-
-	# Restore environment
-	save_assert_failed="$_test_assert_failed"
-
-	# Splitting is intentional
-	# shellcheck disable=SC2046
-	unset $(set | grep "='" | cut -d= -f1 | grep -vE "(PATH|IFS|TERM|LANG|HOME|PWD|SHELL|USER|save_assert_failed|_test_statefile)" )
-
-	# shellcheck disable=SC1090
-	. "$_test_statefile"
-	_test_assert_failed="$save_assert_failed"
-
-	if [ -n "$_test_assert_failed" ]; then
-		msg="${RED}Failed! ❌ ${_test_assert_failed}${RESET}"
-		echo "Test $_test_testn: $_test_assert_failed" >> "$results_dir/failed"
-		_test_failedn=$((_test_failedn+1))
-		echo "$_test_failedn" > "$results_dir/failedn"
-		unset _test_assert_failed
-	else
-		msg="${GREEN}Passed!${RESET}"
-		_test_passedn=$((_test_passedn+1))
-		echo "$_test_passedn" > "$results_dir/passedn"
-	fi
-	test_log "<== Test $_test_testn: $msg $_test_current_test\n"
-	_test_testn=$((_test_testn+1))
-	_test_current_test=""
-}
-
-# Call at the end of each testsuite shell script
-end_testsuite() {
-	if [ -n "$_test_current_test" ]; then
-		test_log "${RED}ERROR: end_testsuite called without calling end_test first!${RESET}"
-		test_log "${RED}Current test: $_test_current_test${RESET}"
-		exit 1
-	fi
-	if [ -f "$results_dir/failed" ]; then
-		exit 1
-	fi
-
-	exit 0
-}
-
-run_tests() {
-	local failed test_results_base
-	local test name total passedn failedn t_passed t_failed
-
-	test_results_base="$(mktemp -d)"
-	test_log "Running tests for $2"
-
-	# FIXME: yeah this isn't quite the best way to iterate the files
-	# shellcheck disable=SC2010
-	for name in $(ls "$1" | grep "\.sh$"); do
-		test="$1/$name"
-		mkdir "$test_results_base/$name"
-		echo 0 > "$test_results_base/$name/passedn"
-		echo 0 > "$test_results_base/$name/failedn"
-		test_log
-		test_log "${BOLDBLUE}# Test suite ${name}${RESET}"
-		$test "$testlib_path" "$test_results_base/$name" || failed="$failed $name"
-		t_passed=$(cat "$test_results_base/$name/passedn")
-		t_failed=$(cat "$test_results_base/$name/failedn")
-		passedn=$((passedn+t_passed))
-		failedn=$((failedn+t_failed))
-		total=$((total+t_passed+t_failed))
-	done
-	if [ -n "$failed" ]; then
-		test_log
-		test_log "Some tests failed:"
-		for test in $failed; do
-			test_log "❌ $test"
-			test_log "    ${RED}$(cat "$test_results_base/$test/failed")${RESET}"
-		done
-	fi
-
-	if [ $passedn -lt $total ]; then
-		test_log "[${RED}$passedn/$total tests passed${RESET}]"
-	else
-		test_log "[${GREEN}$passedn/$total tests passed!${RESET}]"
-	fi
-	test_log
-
-	if [ -n "$failed" ]; then exit 1; else exit 0; fi
-}
-
-# FIXME: probably not the best way to determine if this was sourced
-if [ $# -gt 0 ]; then
-	run_tests "$1" "$2"
-fi

.ci/lib/verify_checksums.py

@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2025 Pablo Correa Gomez
-# SPDX-License-Identifier: GPL-3.0-or-later
-import os
-import sys
-
-# Same dir
-import common
-
-# pmbootstrap
-import pmb.core
-from pmb.core.context import get_context
-
-
-def verify_checksums(packages):
-    if len(packages) == 0:
-        print("no packages changed, not doing any checksums verification")
-        return
-
-    print("verifying checksums: " + ", ".join(packages))
-    common.run_pmbootstrap(["build_init"])
-    common.run_pmbootstrap(["--details-to-stdout", "checksum", "--verify"] +
-                           list(packages))
-
-
-if __name__ == "__main__":
-    # Get and print modified packages
-    packages = common.get_changed_packages()
-
-    # Load context
-    sys.argv = ["pmbootstrap.py", "chroot"]
-    args = pmb.parse.arguments()
-    context = get_context()
-
-    # Get set of all buildable packages for the enabled repos, for skipping unbuildable
-    # aports later. We might be given a changed aport from e.g. extra-repos/systemd when
-    # that repo is not enabled
-    buildable_pkgs = set()
-    for path in pmb.core.pkgrepo.pkgrepo_iter_package_dirs():
-        buildable_pkgs.add(os.path.basename(path))
-
-    # To store a list of packages from extra-repos/systemd for special handling
-    #  later:
-    systemd_pkgs = list()
-
-    # Filter out packages are not found in enabled repos
-    # (Iterate over copy of packages, because we modify it in this loop)
-    for package in packages.copy():
-        if package not in buildable_pkgs:
-            print(f"{package}: not in current repo, skipping")
-            packages.remove(package)
-            # FIXME: this should probably be more generic, if other repos are added
-            #  later?
-            # This just tosses the package into the list of packages to try
-            # building later w/ systemd enabled, and assumes it'll be found
-            # there.
-            print(f"{package}: adding to list of packages to check in systemd repo")
-            systemd_pkgs.append(package)
-            continue
-
-    # No packages: skip build
-    if len(packages) == 0:
-        print("no packages to check for the current repo")
-    else:
-       verify_checksums(packages)
-
-    # FIXME: this should probably be more generic, if other repos are added later?
-    if systemd_pkgs:
-        common.run_pmbootstrap(["config", "systemd", "always"])
-        # To fix the ERROR: Chroot 'native' is for the 'edge' channel, but you are on the
-        # 'systemd-edge' channel. Run 'pmbootstrap zap' to delete your chroots and try again.
-        # To do this automatically, run 'pmbootstrap config auto_zap_misconfigured_chroots yes'.
-        common.run_pmbootstrap(["config", "auto_zap_misconfigured_chroots", "yes"])
-
-        # No packages: skip build
-        if len(systemd_pkgs) == 0:
-            print("no packages to check for the systemd repo")
-
-        else:
-            verify_checksums(systemd_pkgs)

.ci/mypy.sh

@@ -1,16 +0,0 @@
-#!/bin/sh -e
-# Description: static type checking for python scripts
-# https://postmarketos.org/pmb-ci
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	apk -q add py3-argcomplete py3-pip py3-pytest
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
-fi
-
-set -x
-
-pip install --break-system-packages --no-warn-script-location mypy
-# Need to change directory for pyproject.toml to be picked up.
-cd .ci
-python -m mypy .

.ci/pyproject.toml

@@ -1,2 +0,0 @@
-[tool.mypy]
-disable_error_code = ["import-not-found"]

.ci/pytest.sh

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 # Description: lint with various python tests
 # Options: native
-# Use 'native' because it requires running pmbootstrap.
+# Use 'native' because it requires pmbootstrap.
 # https://postmarketos.org/pmb-ci
 
 if [ "$(id -u)" = 0 ]; then
 	set -x
-	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
+	wget "https://gitlab.com/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
 	sh ./install_pmbootstrap.sh pytest
 	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
 fi
@@ -19,14 +19,29 @@ if [ -z "$(command -v pytest)" ]; then
 	exit 1
 fi
 
+# Wrap pmbootstrap to use this repository for --aports
 pmaports="$(cd "$(dirname "$0")"/..; pwd -P)"
+_pmbootstrap="$(command -v pmbootstrap)"
+pmbootstrap() {
+	"$_pmbootstrap" --aports="$pmaports" "$@"
+}
+
 # Make sure that the work folder format is up to date, and that there are no
 # mounts from aborted test cases (pmbootstrap#1595)
 pmbootstrap work_migrate
-pmbootstrap config aports "$pmaports"
 pmbootstrap -q shutdown
 
-# Needed to import "common"
-export PYTHONPATH="$PYTHONPATH:.ci/lib"
+# Make sure we have a valid device (pmbootstrap#1128)
+device="$(pmbootstrap config device)"
+deviceinfo="$pmaports/device/*/device-$device/deviceinfo"
+# shellcheck disable=SC2086
+if ! [ -e $deviceinfo ]; then
+	echo "ERROR: Could not find deviceinfo file for selected device '$device'."
+	echo "Expected path: $deviceinfo"
+	echo "Maybe you have switched to a branch where your device does not exist?"
+	echo "Use 'pmbootstrap config device qemu-amd64' to switch to a valid device."
+	exit 1
+fi
+
 # Run testcases
-pytest -vv --tb=native "$pmaports/.ci/testcases" "$@"
+pytest -vv -x --tb=native "$pmaports/.ci/testcases" "$@"

.ci/ruff.sh

@@ -1,14 +0,0 @@
-#!/bin/sh -e
-# Description: lint CI related python scripts/tests
-# https://postmarketos.org/pmb-ci
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	apk -q add ruff
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
-fi
-
-set -x
-
-# shellcheck disable=SC2046
-ruff check $(find .ci -name '*.py')

.ci/shellcheck.sh

@@ -15,18 +15,20 @@ fi
 # Shell: shellcheck
 sh_files="
 	./main/mdss-fb-init-hack/mdss-fb-init-hack.sh
-	./main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh
+	./main/osk-sdl/unlock.sh
+	./main/postmarketos-base/rootfs-usr-lib-firmwareload.sh
+	./main/postmarketos-base-ui/rootfs-etc-NetworkManager-dispatcher.d-99-dns-filter.sh
+	./main/postmarketos-base-ui/rootfs-etc-NetworkManager-dispatcher.d-85-tethering
 	./main/postmarketos-installkernel/installkernel-pmos
 	./main/postmarketos-initramfs/init.sh
 	./main/postmarketos-initramfs/init_functions.sh
+	./main/postmarketos-mkinitfs-hook-debug-shell/20-debug-shell.sh
 	./main/postmarketos-mkinitfs-hook-netboot/netboot.sh
-	./main/postmarketos-ui-os-installer/rootfs-usr-bin-pmos_setup.sh
-	./main/postmarketos-usb-moded/rootfs-usr-lib-systemd-system-generators-umtprd-config-generator
+	./main/postmarketos-update-kernel/update-kernel.sh
 	./main/ttyescape/*.post-install
 	./main/unl0kr/unlock.sh
-	./device/community/soc-qcom/call_audio_idle_suspend_workaround.sh
-	./device/testing/device-apple-mac-aarch64/*.sh
-	./extra-repos/systemd/postmarketos-base-systemd/rootfs-usr-libexec-systemd-apk-trigger
+	./main/msm-firmware-loader/*.post-install
+	./device/community/soc-qcom-sdm845/call_audio_idle_suspend_workaround.sh
 
 	$(find . -path './main/postmarketos-ui-*/*.sh')
 	$(find . -path './main/postmarketos-ui-*/*.pre-install')
@@ -38,13 +40,13 @@ sh_files="
 
 	$(find . -name '*.trigger')
 	$(find . -path './main/devicepkg-dev/*.sh')
+	$(find . -path './main/postmarketos-mvcfg/*.sh')
 
 	$(find . -path './.ci/**.sh')
-	$(find . -path '**/tests/*.sh')
 "
 
 for file in $sh_files; do
 	echo "Test with shellcheck: $file"
 	cd "$DIR/$(dirname "$file")"
-	shellcheck -S warning -e SC1008 -e SC3043 -x "$(basename "$file")"
+	shellcheck -e SC1008 -x "$(basename "$file")"
 done

.ci/testcases/add_pmbootstrap_to_import_path/__init__.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+# Copyright 2021 Oliver Smith
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import shutil
+import sys
+import os
+import importlib
+import importlib.util
+from distutils.sysconfig import get_python_lib
+
+
+def path_pmbootstrap():
+    """ Find the pmbootstrap installation folder, so we can import the Python
+        code from there.
+        returns: pmbootstrap installation folder
+    """
+    # This variable is set by pmbootstrap 1.52 and later
+    # If it's undefined, try to find 'pmbootstrap' in path
+    bin = os.environ.get("PMBOOTSTRAP_CMD") or shutil.which("pmbootstrap")
+
+    if not bin:
+        print("ERROR: 'pmbootstrap' not found in $PATH")
+        sys.exit(1)
+
+    # Resolve the symlink and verify the folder
+    dir = os.path.dirname(os.path.realpath(bin))
+    if os.path.exists(dir + "/pmb/__init__.py"):
+        return dir
+
+    dir = get_python_lib()
+    if os.path.exists(dir + "/pmb/__init__.py"):
+        return dir
+
+    # Symlink not set up properly
+    print("ERROR: 'pmbootstrap' is not a symlink to pmbootstrap.py")
+    sys.exit(1)
+
+
+# Check if pmb module can be imported
+if importlib.util.find_spec("pmb") is None:
+    # Add pmbootstrap dir to import path
+    sys.path.append(os.path.realpath(path_pmbootstrap()))

.ci/testcases/conftest.py

@@ -2,31 +2,24 @@
 # Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from pathlib import Path
+import add_pmbootstrap_to_import_path
 import pmb.parse
-from pmb.helpers.args import init as init_args
-from pmb.types import PmbArgs
-import pmb.config
 import pytest
+import sys
 import os
 
-@pytest.fixture(scope="session", autouse=True)
+
+@pytest.fixture
 def args(request):
     # Initialize args
-    pmaports = Path(os.path.realpath(f"{os.path.dirname(__file__)}/../.."))
-    args = PmbArgs()
-    args.aports = [pmaports]
-    args.config = pmb.config.defaults["config"]
-    args.timeout = 900
-    args.details_to_stdout = False
-    args.quiet = False
-    args.verbose = True
-    args.offline = False
-    args.action = "init"
-    args.cross = False
-    args.ccache = False
-    args.log = None
+    pmaports = os.path.realpath(f"{os.path.dirname(__file__)}/../..")
+    sys.argv = ["pmbootstrap",
+                "--aports", pmaports,
+                "--log", "$WORK/log_testsuite_pmaports.txt"
+                "chroot"]
+    args = pmb.parse.arguments()
 
-    init_args(args)
+    # Initialize logging
+    pmb.helpers.logging.init(args)
     request.addfinalizer(pmb.helpers.logging.logfd.close)
     return args

.ci/testcases/test_device.py

@@ -1,18 +1,15 @@
 #!/usr/bin/env python3
-# Copyright 2024 Oliver Smith
+# Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+import glob
+import pytest
+import sys
+import os
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
 import pmb.parse._apkbuild
-from pmb.core.pkgrepo import pkgrepo_default_path, pkgrepo_iglob
-from pmb.core.arch import Arch
-
-# Don't complain if these nicknames are the only maintainers of an APKBUILD,
-# because they are actually a group of people
-gitlab_groups = [
-    "@sdm845-mainline",
-]
 
 
 def device_dependency_check(apkbuild, path):
@@ -20,16 +17,24 @@ def device_dependency_check(apkbuild, path):
         (e.g. because it should be in a subpackage instead). """
 
     for depend in apkbuild["depends"]:
+        if depend == "linux-firmware-none":
+            continue
+        if (depend.startswith("firmware-") or
+                depend.startswith("linux-firmware")):
+            raise RuntimeError("Firmware package '" + depend + "' found in"
+                               " depends of " + path + ". These go into"
+                               " subpackages now, see"
+                               " <https://postmarketos.org/devicepkg>.")
         if depend == "mesa-dri-gallium":
             raise RuntimeError(f"{path}: mesa-dri-gallium shouldn't be in"
                                " depends anymore (see pmaports!3478)")
 
 
-def test_aports_device():
+def test_aports_device(args):
     """
     Various tests performed on the /device/*/device-* aports.
     """
-    for path in pkgrepo_iglob("device/*/device-*/APKBUILD"):
+    for path in glob.iglob(args.aports + "/device/*/device-*/APKBUILD"):
         apkbuild = pmb.parse.apkbuild(path)
 
         # Depends: Require "postmarketos-base"
@@ -38,35 +43,44 @@ def test_aports_device():
             if "postmarketos-base" == dependency or "postmarketos-base>" in dependency:
                 depend_flag = True
         if not depend_flag:
-            raise RuntimeError(f"Missing 'postmarketos-base' in depends of {path}")
+            raise RuntimeError("Missing 'postmarketos-base' in depends of " +
+                               path)
 
-        # Depends: Must not have specific packages
+        # Depends: Must not have firmware packages
         for depend in apkbuild["depends"]:
             device_dependency_check(apkbuild, path)
 
         # Architecture
         device = apkbuild["pkgname"][len("device-"):]
-        deviceinfo = pmb.parse.deviceinfo(device)
-        if Arch.from_str("".join(apkbuild["arch"])) != deviceinfo.arch:
-            raise RuntimeError("wrong architecture, please change to arch=\""
-                               f"{deviceinfo.arch}\": {path}")
+        deviceinfo = pmb.parse.deviceinfo(args, device)
+        if "".join(apkbuild["arch"]) != deviceinfo["arch"]:
+            raise RuntimeError("wrong architecture, please change to arch=\"" +
+                               deviceinfo["arch"] + "\": " + path)
         if "!archcheck" not in apkbuild["options"]:
-            raise RuntimeError(f"!archcheck missing in options= line: {path}")
+            raise RuntimeError("!archcheck missing in options= line: " + path)
+
+        if deviceinfo["flash_kernel_on_update"] == "true" \
+                and "postmarketos-update-kernel" not in apkbuild["depends"]:
+            raise RuntimeError(
+                "Deviceinfo indicates this device supports automatic kernel"
+                " flashing on update, but doesn't depend on"
+                " 'postmarketos-update-kernel'. Please add the missing"
+                " dependency.")
 
 
-def test_aports_device_kernel():
+def test_aports_device_kernel(args):
     """
     Verify the kernels specified in the device packages:
     * Kernel must not be in depends when kernels are in subpackages
     * Check if only one kernel is defined in depends
     """
-    aports = pkgrepo_default_path()
+
     # Iterate over device aports
-    for path in aports.glob("device/*/device-*/APKBUILD"):
+    for path in glob.glob(args.aports + "/device/*/device-*/APKBUILD"):
         # Parse apkbuild and kernels from subpackages
         apkbuild = pmb.parse.apkbuild(path)
         device = apkbuild["pkgname"][len("device-"):]
-        kernels_subpackages = pmb.parse._apkbuild.kernels(device)
+        kernels_subpackages = pmb.parse._apkbuild.kernels(args, device)
 
         # Parse kernels from depends
         kernels_depends = []
@@ -77,50 +91,48 @@ def test_aports_device_kernel():
 
             # Kernel in subpackages *and* depends
             if kernels_subpackages:
-                raise RuntimeError(f"Kernel package '{depend}' needs to"
+                raise RuntimeError("Kernel package '" + depend + "' needs to"
                                    " be removed when using kernel" +
-                                   f" subpackages: {path}")
+                                   " subpackages: " + path)
 
         # No kernel
         if not kernels_depends and not kernels_subpackages:
             raise RuntimeError("Device doesn't have a kernel in depends or"
-                               f" subpackages: {path}")
+                               " subpackages: " + path)
 
         # Multiple kernels in depends
         if len(kernels_depends) > 1:
             raise RuntimeError("Please use kernel subpackages instead of"
                                " multiple kernels in depends (see"
-                               f" <https://postmarketos.org/devicepkg>): {path}")
+                               " <https://postmarketos.org/devicepkg>): " +
+                               path)
 
 
-# @pytest.mark.xfail # Not all aports have been updated yet
-def test_aports_maintained():
+def test_aports_maintained(args):
     """
     Ensure that aports in /device/{main,community} have "Maintainer:" and
     "Co-Maintainer:" (only required for main) listed in their APKBUILDs.
     """
-
-    for path in pkgrepo_iglob("device/main/*/APKBUILD"):
-        if 'firmware-' in path.parent.name:
+    for path in glob.iglob(f"{args.aports}/device/main/*/APKBUILD"):
+        if '/firmware-' in path:
             continue
         maintainers = pmb.parse._apkbuild.maintainers(path)
         assert maintainers and len(maintainers) >= 2, \
             f"{path} in main needs at least 1 Maintainer and 1 Co-Maintainer"
 
-    for path in pkgrepo_iglob("device/community/*/APKBUILD"):
-        if 'firmware-' in path.parent.name:
+    for path in glob.iglob(f"{args.aports}/device/community/*/APKBUILD"):
+        if '/firmware-' in path:
             continue
         maintainers = pmb.parse._apkbuild.maintainers(path)
         assert maintainers, f"{path} in community needs at least 1 Maintainer"
 
 
-def test_aports_archived():
+def test_aports_unmaintained(args):
     """
-    Ensure that aports in /device/archived have an "Archived:" comment
-    that describes why the aport is archived.
+    Ensure that aports in /device/unmaintained have an "Unmaintained:" comment
+    that describes why the aport is unmaintained.
     """
-
-    for path in pkgrepo_iglob("device/archived/*/APKBUILD"):
-        archived = pmb.parse._apkbuild.archived(path)
-        assert archived, f"{path} should have an Archived: " +\
-            "comment that describes why the package is archived"
+    for path in glob.iglob(f"{args.aports}/device/unmaintained/*/APKBUILD"):
+        unmaintained = pmb.parse._apkbuild.unmaintained(path)
+        assert unmaintained, f"{path} should have an Unmaintained: " +\
+            "comment that describes why the package is unmaintained"

.ci/testcases/test_deviceinfo.py

@@ -2,49 +2,78 @@
 # Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+import glob
+import os
+import pytest
 import re
+import sys
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
-from pmb.core.pkgrepo import pkgrepo_iglob
 
 
-def test_deviceinfo():
+def deviceinfo_obsolete(info):
+    """
+    Test for obsolete options used in the deviceinfo file. They must still be
+    defined in pmbootstrap's config/__init__.py.
+    """
+    obsolete_options = [
+        "usb_rndis_function",
+        "weston_pixman_type",
+    ]
+    for option in obsolete_options:
+        if option in info and info[option]:
+            raise RuntimeError(f"option {option} is obsolete, please rename"
+                               " or remove it (see reasons for removal of at"
+                               " https://postmarketos.org/deviceinfo)")
+
+
+def test_deviceinfo(args):
     """
     Parse all deviceinfo files successfully and run checks on the parsed data.
     """
     # Iterate over all devices
     last_exception = None
     count = 0
-    pattern = re.compile("^deviceinfo_[a-zA-Z0-9_]*=\".*\"(\\s*# .*)?$")
+    pattern = re.compile("^deviceinfo_[a-zA-Z0-9_]*=\".*\"$")
 
-    for folder in pkgrepo_iglob("device/*/device-*"):
-        device = folder.name.split("-", 1)[1]
+    for folder in glob.glob(args.aports + "/device/*/device-*"):
+        device = folder[len(args.aports):].split("-", 1)[1]
 
-        f = open(folder / "deviceinfo")
+        f = open(folder[len(args.aports):][1:] + "/deviceinfo")
         lines = f.read().split("\n")
         f.close()
 
         try:
             for line in lines:
+                # Require space after # for comments
+                if line.startswith("#") and not line.startswith("# "):
+                    raise RuntimeError("Comment style: please change '#' to"
+                                       f" '# ': {line}")
+
                 # Skip empty lines and comments
                 if not line or line.startswith("# "):
                     continue
 
+                # Variable can not be empty
+                if '=""' in line:
+                    raise RuntimeError("Please remove the empty variable: " + line)
+
                 # Check line against regex (can't use multiple lines etc.)
                 if not pattern.match(line) or line.endswith("\\\""):
                     raise RuntimeError("Line looks invalid, maybe missing"
-                                       " quotes/multi-line string/malformed"
-                                       f" inline comment? {line}")
+                                       " quotes/multi-line string/comment next"
+                                       f" to line instead of above? {line}")
 
             # Successful deviceinfo parsing / obsolete options
-            info = pmb.parse.deviceinfo(device)
+            info = pmb.parse.deviceinfo(args, device)
+            deviceinfo_obsolete(info)
 
             # deviceinfo_name must start with manufacturer
-            name = info.name
-            manufacturer = info.manufacturer
+            name = info["name"]
+            manufacturer = info["manufacturer"]
             if not name.startswith(manufacturer) and \
-                    not name.startswith("Google") and \
-                    not name.startswith("Jolla"):
+                    not name.startswith("Google"):
                 raise RuntimeError("Please add the manufacturer in front of"
                                    " the deviceinfo_name, e.g.: '" +
                                    manufacturer + " " + name + "'")

.ci/testcases/test_directory_structure.py

@@ -6,12 +6,10 @@ import stat
 
 expected_directories = [
     "cross",
-    "device/archived",
     "device/community",
-    "device/downstream",
     "device/main",
     "device/testing",
-    "extra-repos/systemd",
+    "device/unmaintained",
     "main",
     "modem",
     "non-free",
@@ -30,9 +28,9 @@ def test_directories():
 
 
 # Ensure no file in pmaports are executable.
-# see https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/593.
+# see https://gitlab.com/postmarketOS/pmaports/-/issues/593.
 def test_executable_files():
-    for file in glob.iglob("[!temp]**/**/*", recursive=True):
+    for file in glob.iglob("**/*", recursive=True):
         if os.path.isdir(file) or os.path.islink(file):
             continue
             # still check other less common inode types
@@ -46,20 +44,20 @@ def test_executable_files():
                                "m0755` or a variation thereof.")
 
 
-# Make sure files belong to a package (below a directory with APKBUILD)
+# Make sure files are either:
+#  - in root directory (README.md)
+#  - hidden (.ci/, device/.shared-patches/)
+#  - or belong to a package (below a directory with APKBUILD)
 def test_files_belong_to_package():
     # Walk directories and set package_dir when we find an APKBUILD
     # This allows matching files in subdirectories to the package directory.
     package_dir = None
     for dirpath, dirs, files in os.walk("."):
-        # Skip "hidden" directories (.ci/, device/.shared-patches/)
+        # Skip "hidden" directories
         dirs[:] = [d for d in dirs if not d.startswith(".")]
-        # Ignore files in root directory (README.md)
+        # Ignore files in root directory
         if dirpath == '.':
             continue
-        # Ignore files under docs/
-        if dirpath.startswith('./docs'):
-            continue
 
         # Switched to another directory?
         if package_dir and not dirpath.startswith(package_dir + os.sep):
@@ -70,9 +68,5 @@ def test_files_belong_to_package():
                 "both contain an APKBUILD"
             package_dir = dirpath
 
-        # Skip specific ".gitlab-ci.yml" files outside of usual structure
-        if dirpath in ["./cross"]:
-            files[:] = [f for f in files if f != ".gitlab-ci.yml"]
-
         assert not files or package_dir, "Found files that do not belong to any package: " \
             f"{dirpath}/{files}"

.ci/testcases/test_firmware.py

@@ -2,13 +2,14 @@
 # Copyright 2021 Johannes Marbach
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+import glob
 import os
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
-from pmb.core.pkgrepo import pkgrepo_iglob
 
 
-def test_aports_firmware():
+def test_aports_firmware(args):
     """
     Various tests performed on the /**/firmware-* aports.
     """
@@ -23,12 +24,11 @@ def test_aports_firmware():
         "firmware-samsung-maguro",  # Depends on firmware-aosp-broadcom-wlan
         "firmware-xiaomi-ferrari",  # Depends on soc-qcom-msm8916
         "firmware-xiaomi-willow",  # Doesn't build, source link is dead (pma#1212)
-        "firmware-samsung-i9105p", # Depends on firmware-aosp-broadcom-wlan
     ]
 
-    for path in pkgrepo_iglob("**/firmware-*/APKBUILD", recursive=True):
+    for path in glob.iglob(f"{args.aports}/**/firmware-*/APKBUILD", recursive=True):
         apkbuild = pmb.parse.apkbuild(path)
-        aport_name = os.path.basename(path.parent)
+        aport_name = os.path.basename(os.path.dirname(path))
 
         if aport_name not in excluded:
             if "pmb:cross-native" not in apkbuild["options"]:

.ci/testcases/test_framework_versions.py

@@ -6,14 +6,18 @@
     version in all packages. We scan all packages, categorize them by URL
     and then compare the versions of all packages in each category. """
 
+import glob
 import logging
+import os
+import pytest
+import sys
 
+import add_pmbootstrap_to_import_path
 import pmb.config
 import pmb.parse
-from pmb.core.pkgrepo import pkgrepo_iter_package_dirs
 
 
-def get_categorized_packages():
+def get_categorized_packages(args):
     """
     Parse all aports and categorize them.
 
@@ -24,7 +28,7 @@ def get_categorized_packages():
     """
     ret = {}
 
-    for path in pkgrepo_iter_package_dirs():
+    for path in glob.glob(args.aports + "/*/*/APKBUILD"):
         # Parse APKBUILD
         apkbuild = pmb.parse.apkbuild(path)
         url = apkbuild["url"]
@@ -105,10 +109,10 @@ def check_categories(categories):
     return ret
 
 
-def test_framework_versions():
+def test_framework_versions(args):
     """
     Make sure that packages of the same framework have the same version.
     """
-    categories = get_categorized_packages()
+    categories = get_categorized_packages(args)
     if not check_categories(categories):
         raise RuntimeError("Framework version check failed!")

.ci/testcases/test_kernel.py

@@ -2,25 +2,24 @@
 # Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+import glob
+import pytest
+import sys
 import os
-import re
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
-from pmb.core.pkgrepo import pkgrepo_iglob, pkgrepo_relative_path
 
 
-def test_aports_kernel():
+def test_aports_kernel(args):
     """
     Various tests performed on the /**/linux-* aports.
     """
 
-    for path in pkgrepo_iglob("**/linux-*/APKBUILD", recursive=True):
+    for path in glob.iglob(f"{args.aports}/**/linux-*/APKBUILD", recursive=True):
         apkbuild = pmb.parse.apkbuild(path)
         aport_name = os.path.basename(os.path.dirname(path))
 
-        if aport_name == "linux-pam-pmos":
-            continue  # This package isn't a linux kernel!
-
         if "pmb:cross-native" not in apkbuild["options"]:
             raise RuntimeError(f"{aport_name}: \"pmb:cross-native\" missing in"
                                " options= line")
@@ -36,15 +35,8 @@ def test_aports_kernel():
                                    " automatically.")
 
         # check some options only for main and community devices
-        _, relpath = pkgrepo_relative_path(path)
-        for part in ["main", "community"]:
-            if part in relpath.parts:
+        for dir in ["main", "device/main", "device/community"]:
+            if path.startswith(f"{args.aports}/{dir}"):
                 if "pmb:kconfigcheck-community" not in apkbuild["options"]:
                     raise RuntimeError(f"{aport_name}: \"pmb:kconfigcheck-community\" missing in"
                                        " options= line, required for all community/main devices.")
-
-        # check for postmarketos-installkernel in makedepends when installing kernel with make
-        if bool(re.search("make z?install", path.read_text(encoding="utf-8"))):
-            if "postmarketos-installkernel" not in apkbuild["makedepends"]:
-                raise RuntimeError(f"{aport_name}: \"postmarketos-installkernel\" missing in"
-                                   " makedepends, required when using make install/zinstall.")

.ci/testcases/test_provides.py

@@ -1,12 +1,15 @@
 #!/usr/bin/env python3
 # Copyright 2023 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
+import glob
 import logging
-import re
+import os
+import pytest
+import sys
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
 import pmb.parse._apkbuild
-from pmb.core.pkgrepo import pkgrepo_iter_package_dirs, pkgrepo_relative_path
 
 
 def apkbuild_check_provides(path, apkbuild, version, pkgname, subpkgname=None):
@@ -40,40 +43,35 @@ def apkbuild_check_provides(path, apkbuild, version, pkgname, subpkgname=None):
         # already replaces the variables, so we check against the inserted
         # values here.
         if not provide.endswith(f"={version}"):
-            # Valid version strings, per the APKBUILD reference, are fine. This regex
-            # attempts to detect those.
-            pattern = r'^\d+(\.\d+)*[a-z]?(_(?:alpha|beta|pre|rc|cvs|svn|git|hg|p)\d*)*-r\d+$'
-            [provide_no_ver, provide_ver] = provide.split("=", 1)
-            if not re.match(pattern, provide_ver):
-                error = f"error in , provide_ver{path}:\n"
-                if subpkgname:
-                    error += f"in subpackage:\n  {subpkgname}\n"
-                else:
-                    error += f"in package:\n  {pkgname}\n"
-                error += f"broken provides entry:\n  {provide_no_ver}\n"
-                error += "\n"
-                error += "This provides entry needs to be changed to"
-                error += f" '{provide_no_ver}=$pkgver-r$pkgrel'"
-                error += " (do not replace the variables, without '').\n"
-                error += "\n"
-                error += "If you know what you are doing and didn't add the"
-                error += " version on purpose, you also need to set a"
-                error += " provider_priority (pma#1766).\n"
-                error += "Reference:"
-                error += " https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#provides"
-                error += f"\nVERSION: {provide_no_ver}"
-                ret += [error]
+            provide_no_ver = provide.split("=", 1)[0]
+
+            error = f"error in {path}:\n"
+            if subpkgname:
+                error += f"in subpackage:\n  {subpkgname}\n"
+            else:
+                error += f"in package:\n  {pkgname}\n"
+            error += f"broken provides entry:\n  {provide_no_ver}\n"
+            error += "\n"
+            error += "This provides entry needs to be changed to"
+            error += f" '{provide_no_ver}=$pkgver-r$pkgrel'"
+            error += " (do not replace the variables, without '').\n"
+            error += "\n"
+            error += "If you know what you are doing and didn't add the"
+            error += " version on purpose, you also need to set a"
+            error += " provider_priority (pma#1766).\n"
+            error += "Reference:"
+            error += " https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#provides"
+            ret += [error]
     return ret
 
 
-def test_provides():
+def test_provides(args):
     errors = []
-    for path in pkgrepo_iter_package_dirs():
-        path = path / "APKBUILD"
+    for path in glob.iglob(f"{args.aports}/**/APKBUILD", recursive=True):
         apkbuild = pmb.parse.apkbuild(path)
         pkgname = apkbuild["pkgname"]
         version = f"{apkbuild['pkgver']}-r{apkbuild['pkgrel']}"
-        _, path_rel = pkgrepo_relative_path(path)
+        path_rel = os.path.relpath(path, args.aports)
         errors += apkbuild_check_provides(path_rel, apkbuild, version, pkgname)
 
         for subpkg, subpkg_data in apkbuild["subpackages"].items():

.ci/testcases/test_source.py

@@ -6,15 +6,17 @@
 import glob
 import logging
 import os
+import pytest
+import sys
 
+import add_pmbootstrap_to_import_path
 import pmb.parse
 import pmb.parse._apkbuild
 import pmb.parse.apkindex
 import pmb.helpers.repo
-from pmb.core.pkgrepo import pkgrepo_iter_package_dirs, pkgrepo_relative_path
 
 
-def parse_source_from_checksums(apkbuild_path):
+def parse_source_from_checksums(args, apkbuild_path):
     """
     Read the APKBUILD file and parse source files from the checksums at the
     bottom. This has always the same format, even if $source is built with hard
@@ -62,20 +64,17 @@ def parse_source_from_checksums(apkbuild_path):
     return ret
 
 
-def test_aports_unreferenced_files():
+def test_aports_unreferenced_files(args):
     """
     Raise an error if an unreferenced file is found
     """
-    for apkbuild_path in pkgrepo_iter_package_dirs():
+    for apkbuild_path in glob.iglob(args.aports + "/**/APKBUILD", recursive=True):
         # pmbootstrap parser has some issues with complicated APKBUILDs, skip those.
-        _, relpath = pkgrepo_relative_path(apkbuild_path)
-        if relpath.parts[0] == "cross":
+        if apkbuild_path.startswith(args.aports + "/cross/"):
             continue
 
-        apkbuild_path = apkbuild_path / "APKBUILD"
-
         apkbuild = pmb.parse.apkbuild(apkbuild_path)
-        sources_chk = parse_source_from_checksums(apkbuild_path)
+        sources_chk = parse_source_from_checksums(args, apkbuild_path)
 
         # Collect files from subpackages
         subpackage_installs = []
@@ -96,21 +95,17 @@ def test_aports_unreferenced_files():
         for file in glob.iglob(dirname + "/**", recursive=True):
             rel_file_path = os.path.relpath(file, dirname)
             # Skip APKBUILDs and directories
-            if rel_file_path in ["APKBUILD", "gitlab-ci.yml.j2"] or os.path.isdir(file):
-                continue
-            # Skip kernel fragments in linux-* packages
-            if os.path.basename(rel_file_path).endswith(".config") and apkbuild["pkgname"].startswith("linux-"):
+            if rel_file_path == "APKBUILD" or os.path.isdir(file):
                 continue
 
             if os.path.basename(rel_file_path) not in sources_chk \
                     and rel_file_path not in apkbuild["install"] \
                     and rel_file_path not in subpackage_installs \
-                    and rel_file_path not in trigger_sources \
-                    and not rel_file_path.startswith("tests/"):
+                    and rel_file_path not in trigger_sources:
                 raise RuntimeError(f"{apkbuild_path}: found unreferenced file: {rel_file_path}")
 
 
-def test_distfiles_conflict():
+def test_distfiles_conflict(args):
     """
     Make sure that each filename mentioned in any source= of any APKBUILD
     always has the same checksum. This is important because apk caches
@@ -120,11 +115,10 @@ def test_distfiles_conflict():
     with a checksum error.
     """
     source_all = {}
-    for apkbuild_path in pkgrepo_iter_package_dirs():
-        apkbuild_path = apkbuild_path / "APKBUILD"
-        source = parse_source_from_checksums(apkbuild_path)
+    for apkbuild_path in glob.iglob(f"{args.aports}/**/APKBUILD", recursive=True):
+        source = parse_source_from_checksums(args, apkbuild_path)
         dir_path = os.path.dirname(apkbuild_path)
-        _, apkbuild_rel = pkgrepo_relative_path(apkbuild_path)
+        apkbuild_rel = os.path.relpath(apkbuild_path, args.aports)
         for filename, checksum in source.items():
             # Files bundled with the APKBUILD don't get copied to the distfiles
             # cache, so not relevant for this check. Use glob.glob here and not

.ci/testcases/test_systemd.py

@@ -1,25 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2025 Oliver Smith
-# SPDX-License-Identifier: GPL-3.0-or-later
-import logging
-import os
-
-import pmb.parse
-from pmb.core.context import get_context
-from pathlib import Path
-
-
-def test_systemd_stage0_version():
-    """Ensure systemd-stage0 and systemd have the same pkgver."""
-    # Don't clutter output with verbose APKBUILD parsing messages
-    logging.getLogger().setLevel(logging.DEBUG)
-
-    config = get_context().config
-    pma_systemd = os.path.join(config.aports[0], "extra-repos/systemd")
-
-    sd0 = pmb.parse.apkbuild(Path(os.path.join(pma_systemd, "systemd-stage0/APKBUILD")))
-    sd1 = pmb.parse.apkbuild(Path(os.path.join(pma_systemd, "systemd/APKBUILD")))
-
-    assert sd0["pkgver"] == sd1["pkgver"], (
-        f"systemd-stage0 pkgver ({sd0['pkgver']}) doesn't match systemd pkgver ({sd1['pkgver']})!"
-    )

.ci/testcases/test_ui.py

@@ -2,36 +2,32 @@
 # Copyright 2021 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from pathlib import Path
+import glob
+import pytest
+import sys
+import os
 
-import common
+import add_pmbootstrap_to_import_path
 import pmb.parse
 
 
-def test_aports_ui():
+def test_aports_ui(args):
     """
     Raise an error if package in _pmb_recommends is not found
     """
-    pmaports_cfg = pmb.config.pmaports.read_config()
+    pmaports_cfg = pmb.config.pmaports.read_config(args)
+
     for arch in pmaports_cfg["supported_arches"].split(","):
-        for path in common.get_changed_files():
-            path = Path(path)
-
-            if path.name != "APKBUILD":
-                continue
-            if not path.parent.name.startswith("postmarketos-ui"):
-                continue
-
+        for path in glob.iglob(args.aports + "/main/postmarketos-ui-*/APKBUILD"):
             apkbuild = pmb.parse.apkbuild(path)
             # Skip if arch isn't enabled
-            if not pmb.helpers.package.check_arch(apkbuild["pkgname"], arch, False):
+            if not pmb.helpers.package.check_arch(args, apkbuild["pkgname"], arch, False):
                 continue
 
             for package in apkbuild["_pmb_recommends"]:
-                depend = pmb.helpers.package.get(
-                    package, arch, must_exist=False, try_other_arches=False
-                )
-                if depend is None:
+                depend = pmb.helpers.package.get(args, package,
+                                                 arch, must_exist=False)
+                if depend is None or not pmb.helpers.package.check_arch(args, package, arch):
                     raise RuntimeError(f"{path}: package '{package}' from"
                                        f" _pmb_recommends not found for arch '{arch}'")
 
@@ -39,9 +35,8 @@ def test_aports_ui():
             if f"{apkbuild['pkgname']}-extras" in apkbuild["subpackages"]:
                 apkbuild = apkbuild["subpackages"][f"{apkbuild['pkgname']}-extras"]
                 for package in apkbuild["_pmb_recommends"]:
-                    depend = pmb.helpers.package.get(
-                        package, arch, must_exist=False, try_other_arches=False
-                    )
-                    if depend is None:
+                    depend = pmb.helpers.package.get(args, package,
+                                                     arch, must_exist=False)
+                    if depend is None or not pmb.helpers.package.check_arch(args, package, arch):
                         raise RuntimeError(f"{path}: package '{package}' from _pmb_recommends "
                                            f"of -extras subpackage is not found for arch '{arch}'")

.ci/unit-tests.sh

@@ -1,19 +0,0 @@
-#!/bin/sh -e
-# Description: run unit-tests for packages
-# https://postmarketos.org/pmb-ci
-#
-# This script only exists to allow running unit-tests locally.
-# In actual CI the package tests/ subdir has it's own YAML
-# fine defining a job which calls testlib for that package.
-# This way we can run all the package unit-tests locally but
-# have them be individual jobs in GitLab.
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	exec su "${TESTUSER:-build}" -c "sh -e $0"
-fi
-
-find . -type d -name "tests" | while read -r testdir; do
-	pkg="$(basename "$(dirname "$testdir")")"
-	.ci/lib/testlib.sh "$testdir" "$pkg"
-done

.ci/verify-checksums.sh

@@ -1,16 +0,0 @@
-#!/bin/sh -e
-# Description: verify checksums of modified packages
-# Options: native
-# Use 'native' because it requires running pmbootstrap.
-# https://postmarketos.org/pmb-ci
-
-if [ "$(id -u)" = 0 ]; then
-	set -x
-	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
-	sh ./install_pmbootstrap.sh
-	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
-fi
-
-export PYTHONUNBUFFERED=1
-
-.ci/lib/verify_checksums.py

.ci/wiki.sh

@@ -7,11 +7,9 @@
 if [ "$(id -u)" = 0 ]; then
 	set -x
 	apk -q add \
-		git \
 		python3
 	exec su "${TESTUSER:-build}" -c "sh -e $0"
 fi
 
 set -x
-# shellcheck disable=SC2068
-.ci/lib/check_devices_in_wiki.py --booting $@
+.ci/lib/check_devices_in_wiki.py --booting

.ecrc

@@ -1,4 +1,3 @@
 {
-  "SpacesAftertabs": true,
-  "Exclude": ["temp"]
+  "SpacesAftertabs": true
 }

.editorconfig

@@ -7,20 +7,8 @@
 # Top-most EditorConfig file.
 root = true
 
-[{**.{ini,sh,rules,nft},**/APKBUILD,CODEOWNERS}]
+[{**.{md,ini,sh,rules,nft},**/APKBUILD}]
 indent_style = tab
 end_of_line = lf
 trim_trailing_whitespace = true
 insert_final_newline = true
-
-[**.md]
-# No indent_size since space size has meaning in markdown
-indent_style = space
-end_of_line = lf
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-# Forked from Alpine
-[extra-repos/systemd/networkmanager/networkmanager.rules]
-indent_style = space
-indent_size = 4

.githooks/pre-commit

@@ -5,6 +5,10 @@
 #
 set -eu
 
+# Maximal allowed size (in bytes) of a file.
+FILE_SIZE_LIMIT=262144  # 256 kiB
+
+
 if ! command -v sha512sum >/dev/null; then
 	# macOS / BSDs (?) don't have sha512sum, but shasum.
 	alias sha512sum='shasum -a 512'
@@ -61,7 +65,7 @@ is_symlink() {
 # available in git tree and checksums are correct.
 check_local_sources() {
 	local apkbuild="$1"
-	local startdir="$2"
+	local startdir="${apkbuild%/*}"
 	local status=0
 	local checksum_act checksum_exp content filename line sources
 
@@ -91,17 +95,25 @@ check_local_sources() {
 	return $status
 }
 
-cleanup() {
-  [ -f "$_staged" ] && rm "$_staged"
+# Checks if the file ($1) being committed is not bigger than FILE_SIZE_LIMIT.
+check_file_size() {
+	local path="$1"
+	local size
+
+	size=$(git cat-file -s ":$path")
+	if [ $size -gt $FILE_SIZE_LIMIT ]; then
+		local size_kb=$(( size / 1024 ))
+
+		error "file \"$path\" is quite big ($(( size / 1024 )) kiB), better put a remote url in source="
+		return 1
+	fi
 }
 
-trap cleanup EXIT
 
 for apkbuild in $(changed_files '**/APKBUILD'); do
-	_staged="$(mktemp)"
-	git show ":$apkbuild" >"$_staged"
-	check_local_sources "$_staged" "${apkbuild%/*}"
-	cleanup
+	check_local_sources "$apkbuild"
 done
 
-trap - EXIT
+for path in $(changed_files); do
+	check_file_size "$path"
+done

.githooks/prepare-commit-msg

@@ -37,36 +37,13 @@ prepend_msg() {
 [ -z "$SOURCE" ] || exit 0
 
 lcp=$(git diff-index --name-only --cached HEAD | longest_common_prefix)
-prefix=""
 
 case "$lcp" in
-	extra-repos/systemd/systemd/*)
-		prefix="systemd"
-		;;
-	extra-repos/systemd/*)
-		prefix="systemd/$(echo "$lcp" | cut -d/ -f3)"
-		;;
-	device/*/*)
-		prefix="$(echo "$lcp" | cut -d/ -f3)"
-		;;
-	docs/*.adoc)
-		prefix="docs/$(basename $lcp .adoc)"
-		;;
-	docs/*)
-		prefix="docs"
-		;;
-	device/*)
-		# Multiple packages touched for same device category. More
-		# logic could be added to detect if they all belong to same
-		# device.
-		;;
-	[^.]*/*)
-		prefix="$(echo "$lcp" | cut -d/ -f1-2)"
-		;;
+	device/*/*) prepend_msg "$(echo "$lcp" | cut -d/ -f3): ";;
+	# Multiple packages touched for same device category
+	# More logic could be added to detect if they all belong to same device
+	device/*)  ;;
+	[^.]*/*) prepend_msg "$(echo "$lcp" | cut -d/ -f1-2): ";;
 esac
 
-if [ -n "$prefix" ]; then
-	prepend_msg "$prefix: "
-fi
-
 exit 0

.gitignore

@@ -65,9 +65,8 @@ instance/
 # Scrapy stuff:
 .scrapy
 
-# Documentation
-public
-docs/deviceinfo-reference.md
+# Sphinx documentation
+docs/_build/
 
 # PyBuilder
 target/
@@ -119,6 +118,3 @@ ENV/
 
 # Allow having untracked packages in aports using a custom-something directory
 /custom-*/
-
-# child pipeline
-.ci/build-jobs.yaml

.gitlab-ci.yml

@@ -6,79 +6,56 @@ after_script:
   - .ci/lib/move_logs.sh $CI_PROJECT_DIR
 stages:
   - lint
-  - prepare
   - build
-  - autoupdate
-  - test
-  - deploy
-variables:
-  # Default of 20 is pretty small, sometimes MRs have >20 commits in them. 100
-  # seems like a reasonable balance. If this is too low, git merge-base (from ci/
-  # common.py) can fail
-  GIT_DEPTH: 100
-  # So that anything that runs install_pmbootstrap and tries to import pmb module
-  # can find it.
-  PYTHONPATH: "/tmp/pmbootstrap"
 
-# This defines the rules for when a pipeline should run.
-workflow:
-  rules:
-    # Run for merge requests
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    # Some things have to run in the default branch
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    # Run scheduled pipeline for autoupdate or manually triggered pipeline
-    - if: $CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web"
-
-# Some packages have their own yaml files defining tests. All of these should contain
-# only jobs which extend the .package-test job!
-include: "**/.gitlab-ci.yml"
+# defaults for "only"
+# We need to run the CI jobs in a "merge request specific context", if CI is
+# running in a merge request. Otherwise the environment variable that holds the
+# merge request ID is not available. This means, we must set the "only"
+# variable accordingly - and if we only do it for one job, all other jobs will
+# not get executed. So have the defaults here, and use them in all jobs that
+# should run on both the master branch, and in merge requests.
+# https://docs.gitlab.com/ee/ci/merge_request_pipelines/index.html#excluding-certain-jobs
+.only-default: &only-default
+  only:
+    - v23.06
+    - merge_requests
+    - tags
 
 # device documentation
 wiki:
   stage: lint
-  rules:
-    - if: &mr_rule $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        - .ci/**/*
-        - .ci/build-jobs.yaml.j2
-        - .gitlab-ci.yml
-        - device/*/device-*/*
+  <<: *only-default
+  only:
+    refs:
+      - merge_requests
+    changes:
+      - device/*/device-*/*
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/wiki.sh
 
 # testcases linting
-ruff:
+flake8:
   stage: lint
-  rules:
-    - if: *mr_rule
-      changes:
-        - .ci/*
-        - .ci/*/*
-        - .ci/build-jobs.yaml.j2
-        - .gitlab-ci.yml
+  <<: *only-default
+  only:
+    refs:
+      - merge_requests
+    changes:
+      - .ci/*
+      - .ci/*/*
+  before_script:
+    - apk -q add py-flake8
   script:
     - .ci/lib/gitlab_prepare_ci.sh
-    - .ci/ruff.sh
-
-# testcases typechecking
-mypy:
-  stage: lint
-  rules:
-    - if: *mr_rule
-      changes:
-        - .ci/**/*
-        - .gitlab-ci.yml
-  script:
-    - .ci/lib/gitlab_prepare_ci.sh
-    - .ci/mypy.sh
+    - .ci/flake8.sh
 
 # shellcheck and various grep checks
 shellcheck-grep:
   stage: lint
-  rules:
-    - if: *mr_rule
+  <<: *only-default
+  image: alpine:edge
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/shellcheck.sh
@@ -86,8 +63,8 @@ shellcheck-grep:
 
 editor-config:
   stage: lint
-  rules:
-    - if: *mr_rule
+  <<: *only-default
+  image: alpine:edge
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/ec.sh
@@ -95,12 +72,11 @@ editor-config:
 # aports checks (generic)
 pytest-commits:
   stage: lint
-  rules:
-    - if: *mr_rule
+  <<: *only-default
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/pytest.sh
-    - .ci/check-changed-versions.sh
+    - .ci/commits.sh
   artifacts:
     when: on_failure
     paths:
@@ -112,157 +88,64 @@ pytest-commits:
 # APKBUILD linting
 aport-lint:
   stage: lint
-  rules:
-    - if: *mr_rule
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/apkbuild-lint.sh
+  only:
+    - merge_requests
   allow_failure: true
 
-# deviceinfo linting
-dint:
-  stage: lint
-  rules:
-    - if: *mr_rule
-      changes:
-        - .ci/**/*
-        - .gitlab-ci.yml
-        - device/*/device-*/deviceinfo
-  script:
-    - .ci/lib/gitlab_prepare_ci.sh
-    - .ci/dint.sh
-  allow_failure:
-    exit_codes:
-      - 2  # returned by dint on non-fatal warning
-
 # kernel kconfig check
 kernel-kconfig:
   stage: lint
-  rules:
-    - if: *mr_rule
-      changes:
-        - kconfigcheck.toml
-      allow_failure: true
-    - if: *mr_rule
-      changes:
-        - device/*/linux-*/config-*
+  only:
+    refs:
+      - v23.06
+      - merge_requests
+    changes:
+      - device/*/linux-*/config-*
+      - main/linux-*/config-*
   script:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/kconfig.sh
 
-# Verify checksums
-verify-checksums:
-  stage: lint
-  rules:
-    - if: *mr_rule
-  script:
-    - .ci/lib/gitlab_prepare_ci.sh
-    - .ci/verify-checksums.sh
-
 # MR settings
 # (Checks for "Allow commits from members who can merge to the target branch")
 mr-settings:
   stage: lint
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  only:
+    - merge_requests
   before_script:
     - apk -q add python3
   script:
-    - wget -q "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/check_mr_settings.py"
+    - wget -q "https://gitlab.com/postmarketOS/ci-common/-/raw/master/check_mr_settings.py"
     - python3 ./check_mr_settings.py
 
-# Calculate build of changed aports using a dynamic downstream pipelines:
-# https://docs.gitlab.com/ci/pipelines/downstream_pipelines/#dynamic-child-pipelines
-# For those to work, we need two jobs:
-# * First one (this one) that generates a valid yaml file with the job yaml as
-#   an artifact
-# * Second one (build-jobs) that has a "trigger" key with the yaml file from
-#   which to trigger pipelines
-# To avoid reworking the whole CI file, for now we are re-using this same file
-# to trigger the downstream pipeline. In that case, $CI_PIPELINE_SOURCE will
-# be set to "parent_pipeline", and only the jobs that extend .build will run
-generate-build-jobs:
-  stage: prepare
+# build changed aports
+.build:
+  stage: build
+  <<: *only-default
   before_script:
     - .ci/lib/gitlab_prepare_ci.sh
-  needs: []
-  script:
-    - wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
-    - sh ./install_pmbootstrap.sh py3-jinja2
-
-    # HACK: Make the pmb library happy to use the currently-cloned pmaports repo
-    - mkdir -p /root/.local/var/pmbootstrap/cache_git/ && ln -s $PWD /root/.local/var/pmbootstrap/cache_git/pmaports
-
-    - .ci/lib/generate_build_jobs.py
-
-  artifacts:
-    paths:
-      - .ci/build-jobs.yaml
-  rules:
-    - if: *mr_rule
-
-build-jobs:
-  stage: build
-  trigger:
-    include:
-      - artifact: .ci/build-jobs.yaml
-        job: generate-build-jobs
-    strategy: depend
-    forward:
-      # So that we don't have to duplicate GIT_DEPTH
-      pipeline_variables: true
-  rules:
-    - if: *mr_rule
-
-build-docs:
-  stage: build
-  before_script:
-    - adduser -D build
-  script:
-    - .ci/build-docs.sh
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        - .ci/build-docs.sh
-        - deviceinfo_schema.toml
-        - docs/**
-
-deploy-docs:
-  stage: deploy
-  trigger:
-    project: postmarketOS/docs.postmarketos.org
-    strategy: depend
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_NAMESPACE == "postmarketOS"
-      changes:
-        - deviceinfo_schema.toml
-        - docs/**
-    - if: $CI_PIPELINE_SOURCE == "schedule"
-      when: never
-
-auto-update:
-  stage: autoupdate
-  rules:
-    # This variable is set in the scheduled pipeline configuration. It should be a space separated list of
-    # package names to update.
-    - if: $AUTOUPDATE_PACKAGES != null && $CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web"
-  before_script:
-    - .ci/lib/gitlab_prepare_ci.sh
-  script:
-    - .ci/autoupdate.sh "$AUTOUPDATE_PACKAGES"
   after_script:
-    - .ci/lib/move_logs.sh $CI_PROJECT_DIR
+    - cp -r /home/pmos/.local/var/pmbootstrap/packages/ packages/ || true
   artifacts:
-    when: on_failure
+    expire_in: 1 week
     paths:
-      - log.txt
-      - log_testsuite_pmaports.txt
-      - pmbootstrap.cfg
+      - packages/
+  timeout: 10 h
 
-# Template for package test jobs defined per-package
-.package-test:
-  stage: test
-  rules:
-    - if: *mr_rule
-  before_script:
-    - .ci/lib/gitlab_prepare_ci.sh
+build-x86_64:
+  extends: .build
+  script:
+    - .ci/build-x86_64.sh
+
+build-aarch64:
+  extends: .build
+  script:
+    - .ci/build-aarch64.sh
+
+build-armv7:
+  extends: .build
+  script:
+    - .ci/build-armv7.sh

.gitlab/issue_templates/Change_Kernel_Config.md

@@ -1,31 +0,0 @@
-<!-- Use this template to kick off the discussion for changing one or more
-     related kernel config options.
--->
-
-### Read the fine manual, please :)
-
-- [ ] I have read https://postmarketos.org/kconfig-adjust-multiple
-
-### What benefit does the change have?
-
-### Which option(s) would you like to change?
-
-<!-- Make sure to specify if you would like to enable/disable/set a value. -->
-
-### Did you already test that this works as expected?
-
-<!-- Not required, but recommended. If you did test it, please list which
-     device you have tested it with. -->
-
-### For which kernel configs would you do the change?
-
-<!-- If it makes sense, we encourage to adjust all kernels used by devices in
-     the main and community categories, so devices behave consistently. -->
-
-- [ ] all in main and community
-- [ ] certain SoC(s):
-- [ ] other (please specify):
-
-
-<!-- leave this, so it applies the correct label in gitlab -->
-/label ~"change-kernel-config"

.gitlab/issue_templates/Default.md

@@ -1,12 +1,6 @@
 <!--
 	Thank you for using postmarketOS! In order to speed up process of resolving your issue,
-	we would like you to fill in the following form.
-
-	*** NOTE FOR CONFIDENTIAL ISSUES: ***
-	A lot of people can read confidential pmaports issues! If you want to
-	submit something that only the postmarketOS Core Team can see, write to
-		team@postmarketos.org
-	instead of opening an issue here!
+	we would like you to fill in the following :
 -->
 ### Describe your issue
 #### What's the expected behaviour?
@@ -27,21 +21,16 @@
 	Replace space inside `[ ]` with `x` to fill the checkbox
 -->
 * [ ] edge (`master` branch)
-* [ ] `v25.12`
+* [ ] `v22.12`
 
 * [ ] I confirm that the issue still is present after running `sudo apk upgrade -a`
 
 ### On what environment did you encounter the issue?
 #### Environments
-* [ ] COSMIC
-* [ ] GNOME Shell on Mobile
 * [ ] Phosh
 * [ ] Plasma Mobile
 * [ ] Sxmo (Wayland/Sway) **Please post the output of `sxmo_version.sh`**
 * [ ] Other: **Please fill out**
-### Which init system are you using?
-* [ ] OpenRC
-* [ ] systemd
 ### How did you get postmarketOS image?
 * [ ] from https://images.postmarketos.org
 * [ ] I built it using pmbootstrap
@@ -54,13 +43,4 @@
 -->
 
 ### Additional information
-<!--
-	logs, etc. -- make use <details> for long listings
-
-	If your device displays an error message on boot or drops to the debug
-	shell, attaching it to your PC with a USB cable may show a removable USB
-	drive. You can drag and drop the .tar.gz file or otherwise upload it
-	here.
-
-	Refer to the README file on the device for more information.
--->
+<!-- logs, etc. -- make use <details> for long listings -->

.gitlab/issue_templates/Maintainership_status_of_package.md

@@ -1,11 +0,0 @@
-<!-- Use this template to kick off the discussion for a package with (presumably)
-     inactive maintainers and the future for the maintainership of the package.
--->
-
-### Information
-
-* Package name:
-* Maintainers of the package:
-* MR that had no maintainer response, if applicable:
-
-/label ~maintainership-status

.mailmap

@@ -1,5 +0,0 @@
-Casey Connolly <casey.connolly@linaro.org> <caleb.connolly@linaro.org>
-Casey Connolly <kcxt@postmarketos.org> <caleb@postmarketos.org>
-Achill Gilgenast <achill@achill.org> <fossdd@pwned.life>
-Aelin <aelin@postmarketos.org> <adrian@postmarketos.org>
-Aelin <aelin@postmarketos.org> <adrian@travitia.xyz>

.mrhlpr.json

@@ -0,0 +1,14 @@
+{
+    "subject_format": {
+        "pass": [
+            "^(([a-z]+\\/[a-z\\-0-9*{}]+),?)+: [A-Za-z\\/\\-0-9*{}\\(\\)\\.,_&:=' ]+( \\(MR \\d+\\)|)$",
+            "^CI: [a-z-0-9*{}\\(\\)\\.,_ ][A-Za-z\\/\\-0-9*{}\\(\\)\\.,_ ]+( \\(MR \\d+\\)|)$",
+            "^mrhlpr.json: [a-z-0-9*{}\\(\\)\\.,_ ][A-Za-z\\/\\-0-9*{}\\(\\)\\.,_ ]+( \\(MR \\d+\\)|)$",
+            "^pmaports.cfg: [a-z-0-9*{}\\(\\)\\.,_ ][A-Za-z\\/\\-0-9*{}\\(\\)\\.,_ ]+( \\(MR \\d+\\)|)$"
+        ],
+        "unknown": [
+            "^[a-z-0-9_.*{}\\/]+: [a-z-0-9*{}\\(\\)\\.,_ ][A-Za-z\\/\\-0-9*{}\\(\\)\\.,_ ]+( \\(MR \\d+\\)|)$"
+        ]
+    }
+}
+

.well-known/funding-manifest-urls

@@ -1 +0,0 @@
-https://postmarketos.org/funding.json

CODEOWNERS

@@ -0,0 +1,88 @@
+# https://docs.gitlab.com/ee/user/project/code_owners.html
+
+device/*/*-htc-golfu/				@Newbyte
+device/*/*-pine64-pinephone/			@craftyguy @milesalan @bshah @proycon @anjandev @StacyHarper
+device/*/*-htc-m8qlul/				@Newbyte
+device/*/*-purism-librem5/			@craftyguy @bshah
+device/*/device-lg-judyln/			@Newbyte
+device/*/device-samsung-m0/			@Newbyte
+device/*/linux-postmarketos-exynos4/		@Newbyte
+device/*/linux-postmarketos-msm8939/		@Newbyte
+device/*/linux-postmarketos-stericsson/		@Newbyte
+device/*/*-qcom-sdm845/				@sdm845-mainline
+device/*/*-xiaomi-berrylium/ 			@joelselvaraj
+device/*/device-oneplus-enchilada/		@calebccff
+device/*/device-oneplus-fajita/			@calebccff
+device/*/firmware-oneplus-sdm845/		@calebccff
+device/*/device-shift-axolotl/			@amartinz @calebccff @dylanvanassche
+device/*/*-lenovo-a6010/			@jenneron
+device/*/*-lenovo-a6000/			@jenneron
+device/*/device-microsoft-surface-rt/		@jenneron
+device/*/device-google-fennel/			@jenneron
+device/*/device-google-veyron-minnie/		@jenneron
+device/*/device-google-burnet/			@jenneron
+device/*/device-google-elm/			@jenneron
+device/*/device-google-nyan-big/		@jenneron
+device/*/device-google-peach-pi/		@jenneron
+device/*/device-google-veyron-speedy/		@jenneron
+device/*/linux-google-veyron/			@jenneron
+device/*/u-boot-peach-pi/			@jenneron
+device/*/device-google-cozmo/			@jenneron
+device/*/u-boot-veyron-speedy/			@jenneron
+device/*/device-google-juniper/			@jenneron @binarycraft
+device/*/u-boot-peach-pit/			@jenneron
+device/*/device-google-damu/			@jenneron
+device/*/u-boot-nyan-4gb/			@jenneron
+device/*/device-google-kenzo/			@jenneron
+device/*/device-google-kodama/			@jenneron
+device/*/u-boot-snow/				@jenneron
+device/*/device-google-kevin/			@jenneron
+device/*/linux-postmarketos-exynos5/		@jenneron @Grimler
+device/*/device-google-krane/			@jenneron
+device/*/soc-mediatek-mt8183/			@jenneron
+device/*/u-boot-veyron-minnie/			@jenneron
+device/*/device-google-fennel14/		@jenneron
+device/*/linux-google-nyan/			@jenneron
+device/*/device-google-willow/			@jenneron
+device/*/linux-postmarketos-mediatek-mt8173/	@jenneron
+device/*/linux-postmarketos-mediatek-mt8183/	@jenneron @binarycraft
+device/*/device-google-nyan-blaze/		@jenneron
+device/*/firmware-powervr-gx6250/		@jenneron
+device/*/device-google-hana/			@jenneron
+device/*/device-google-snow/			@jenneron
+device/*/device-google-kappa/			@jenneron
+device/*/u-boot-nyan-2gb/			@jenneron
+device/*/device-google-veyron-jerry/		@jenneron
+device/*/device-google-kakadu/			@jenneron
+device/*/firmware-google-veyron-brcm/		@jenneron
+device/*/device-google-peach-pit/		@jenneron
+device/*/device-lg-judyp/			@jenneron
+device/*/device-asus-tf201/			@clamor95
+device/*/device-asus-tf300t/			@clamor95
+device/*/device-asus-tf300tg/			@clamor95
+device/*/device-asus-tf700t/			@clamor95
+device/*/device-lg-p895/			@clamor95
+device/*/firmware-asus-transformer/		@clamor95 @jenneron
+device/*/firmware-lg-x3/			@clamor95
+device/*/linux-postmarketos-grate/		@clamor95 @jenneron
+device/*/device-samsung-chagallwifi		@Grimler
+device/*/device-odroid-xu4			@Grimler
+device/*/device-samsung-klimtlte		@Grimler
+device/*/linux-samsung-klimtlte			@Grimler
+device/*/firmware-odroid-xu4			@Grimler
+device/*/linux-samsung-chagallwifi		@Grimler
+device/*/device-huawei-plank			@gtrxAC
+device/*/linux-huawei-plank			@gtrxAC
+
+main/postmarketos-update-depthcharge-kernel/	@jenneron
+main/osk-sdl/					@craftyguy
+main/postmarketos-ui-plasma-mobile/ 		@bshah
+main/ttyescape					@calebccff
+temp/u-boot-librem5/				@craftyguy @bshah
+temp/alsa-ucm-conf-google-kukui/		@jenneron @binarycraft
+temp/alsa-ucm-conf-google-gru/			@jenneron
+device/*/*-videostrong-kii-pro/                 @vitali64yt
+device/*/*-amlogic-s905*                        @vitali64yt
+device/*/linux-postmarketos-amlogic/            @vitali64yt @exkc
+
+# vim: ts=8 sw=4 et

COMMITSTYLE.md

@@ -31,29 +31,16 @@ subfolders of the device directory. As such, commits changing
 packages inside of the device directory should omit the directory
 prefix, for example:
 
-    device-pine64-pinephone: description of change
+	device-pine64-pinephone: description of change
 
 Or:
 
-    soc-qcom-msm8996: description of change
+	soc-qcom-msm8996: description of change
 
 If the commit only makes device-specific changes, the
 commit title can opt to use the following format:
 
-    manufacturer-codename: description of change
-
-### Changes to packages inside of the systemd directory
-
-We also shorten the prefixes for packages in `extra-repos/systemd`.
-When the `systemd` package itself gets changed, use `systemd: ` as
-prefix. For example:
-
-    systemd: add triggers for reloading/restarting services
-
-When another package inside the systemd directory gets changed, use
-`systemd/$pkgname: ` as prefix. For example:
-
-    systemd/cups: restart on upgrade
+	manufacturer-codename: description of change
 
 ### Moving devices between categories
 
@@ -61,11 +48,11 @@ As we do not include directory prefixes in device-related commits,
 Alpine's commit style for moving packages does not apply. Instead,
 we do the following:
 
-    manufacturer-codename: move from category to category
+	manufacturer-codename: move from category to category
 
 For example:
 
-    samsung-m0: move from testing to community
+	samsung-m0: move from testing to community
 
 ## Additions
 

README.md

@@ -1,23 +1,9 @@
-# postmarketOS aports repository
-
-This repository contains the APKBUILD files for postmarketOS-specific packages, along with the required patches and scripts, if any.
-
-There are many more packages defined in the [Alpine Linux aports](https://gitlab.alpinelinux.org/alpine/aports/) on which these packages depend.
+# postmarketOS aports
 
 Helpful resources:
 * [How to create a package](https://wiki.postmarketos.org/wiki/Create_a_package)
 * [APKBUILD reference](https://wiki.alpinelinux.org/wiki/APKBUILD_Reference)
-* [pmaports commit style](./COMMITSTYLE.md)
-* [Review and merging guidelines](./docs/modules/ROOT/pages/merging-rules.adoc)
 * [Alpine Linux aports](https://gitlab.alpinelinux.org/alpine/aports/)
 * [Alpine Linux package search](https://pkgs.alpinelinux.org/packages)
 * [postmarketOS package search](https://pkgs.postmarketos.org/packages)
-
-## Git Hooks
-
-You can find some useful git hooks in the `.githooks` directory.
-To use them, run the following command after cloning this repository:
-
-```sh
-git config --local core.hooksPath .githooks
-```
+* [postmarketOS commit style](./COMMITSTYLE.md)

channels.cfg

@@ -1,81 +0,0 @@
-# Reference: https://postmarketos.org/channels.cfg
-[channels.cfg]
-recommended=edge
-
-[edge]
-description=Rolling release / Most devices / Occasional breakage: https://postmarketos.org/edge
-branch_pmaports=main
-branch_aports=master
-mirrordir_alpine=edge
-
-[v25.12]
-description=Latest release / Recommended for best stability
-branch_pmaports=v25.12
-branch_aports=3.23-stable
-mirrordir_alpine=v3.23
-
-[v25.06]
-description=Old release (unsupported)
-branch_pmaports=v25.06
-branch_aports=3.22-stable
-mirrordir_alpine=v3.22
-
-[v24.12]
-description=Old release (unsupported)
-branch_pmaports=v24.12
-branch_aports=3.21-stable
-mirrordir_alpine=v3.21
-
-[v24.06]
-description=Old release (unsupported)
-branch_pmaports=v24.06
-branch_aports=3.20-stable
-mirrordir_alpine=v3.20
-
-[v23.12]
-description=Old release (unsupported)
-branch_pmaports=v23.12
-branch_aports=3.19-stable
-mirrordir_alpine=v3.19
-
-[v23.06]
-description=Old release (unsupported)
-branch_pmaports=v23.06
-branch_aports=3.18-stable
-mirrordir_alpine=v3.18
-
-[v22.12]
-description=Old release (unsupported)
-branch_pmaports=v22.12
-branch_aports=3.17-stable
-mirrordir_alpine=v3.17
-
-[v22.06]
-description=Old release (unsupported)
-branch_pmaports=v22.06
-branch_aports=3.16-stable
-mirrordir_alpine=v3.16
-
-[v21.12]
-description=Old release (unsupported)
-branch_pmaports=v21.12
-branch_aports=3.15-stable
-mirrordir_alpine=v3.15
-
-[v21.06]
-description=Old release (unsupported)
-branch_pmaports=v21.06
-branch_aports=3.14-stable
-mirrordir_alpine=v3.14
-
-[v21.03]
-description=Old release (unsupported)
-branch_pmaports=v21.03
-branch_aports=3.13-stable
-mirrordir_alpine=v3.13
-
-[v20.05]
-description=Old release (unsupported)
-branch_pmaports=v20.05
-branch_aports=3.12-stable
-mirrordir_alpine=v3.12

cross/.gitlab-ci.yml

@@ -1,21 +0,0 @@
-cross-gcc-tests:
-  extends: .package-test
-  tags: [qemu]
-  before_script:
-    - wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/main/install_pmbootstrap.sh"
-    - sh ./install_pmbootstrap.sh
-  script:
-    - su pmos -c "pmbootstrap build gcc-aarch64"
-    - su pmos -c "pmbootstrap build --arch=aarch64 hello-world --force"
-    - su pmos -c "pmbootstrap build --arch=aarch64 iskey --force"
-    - su pmos -c "pmbootstrap build --arch=aarch64 pbsplash --force"
-    - su pmos -c "pmbootstrap build --arch=aarch64 gcc-x86_64"
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        - cross/gcc-x86_64/APKBUILD
-  artifacts:
-    when: always
-    paths:
-      - log.txt
-    expire_in: 1 week

cross/arch-bin-masquerade/APKBUILD

@@ -4,7 +4,7 @@
 # armhf chroot to /usr/bin/gcc. That way compilation works fine, even
 # when distcc gets the absolute path to the compiler passed (ccache does
 # that).
-maintainer=""
+
 pkgname=arch-bin-masquerade
 pkgver=2
 pkgrel=0

cross/binutils-aarch64/0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch

@@ -0,0 +1,55 @@
+From bbf05b742fde518fb97c789b043fe0d3aaf549f0 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Tue, 21 Sep 2021 14:53:13 +0000
+Subject: [PATCH] Revert "PR25882, .gnu.attributes are not checked for shared
+ libraries"
+
+This revert is needed to avoid wrongly tagging objects with the incompatible
+IBM long double ABI, which is not supported by musl and will result in
+linking errors if used.
+
+This reverts commit a8acd6eeb6dc2cc5460ece90f90ebe36b56b20ba.
+---
+ bfd/elf32-tic6x.c |  3 ---
+ ld/ldlang.c       | 10 ++++------
+ 2 files changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/bfd/elf32-tic6x.c b/bfd/elf32-tic6x.c
+index 5754f3cb860..3ad1d612749 100644
+--- a/bfd/elf32-tic6x.c
++++ b/bfd/elf32-tic6x.c
+@@ -3735,9 +3735,6 @@ elf32_tic6x_merge_attributes (bfd *ibfd, struct bfd_link_info *info)
+ 
+ 	case Tag_ABI_PIC:
+ 	case Tag_ABI_PID:
+-	  /* Don't transfer these tags from dynamic objects.  */
+-	  if ((ibfd->flags & DYNAMIC) != 0)
+-	    continue;
+ 	  if (out_attr[i].i > in_attr[i].i)
+ 	    out_attr[i].i = in_attr[i].i;
+ 	  break;
+diff --git a/ld/ldlang.c b/ld/ldlang.c
+index 37b64c89ee1..f13beaef9d9 100644
+--- a/ld/ldlang.c
++++ b/ld/ldlang.c
+@@ -7071,13 +7071,11 @@ lang_check (void)
+ 		   bfd_printable_name (input_bfd), input_bfd,
+ 		   bfd_printable_name (link_info.output_bfd));
+ 	}
+-
+-      /* If the input bfd has no contents, it shouldn't set the
+-	 private data of the output bfd.  */
+-      else if (!file->flags.just_syms
+-	       && ((input_bfd->flags & DYNAMIC) != 0
+-		   || bfd_count_sections (input_bfd) != 0))
++      else if (bfd_count_sections (input_bfd))
+ 	{
++	  /* If the input bfd has no contents, it shouldn't set the
++	     private data of the output bfd.  */
++
+ 	  bfd_error_handler_type pfn = NULL;
+ 
+ 	  /* If we aren't supposed to warn about mismatched input
+-- 
+2.33.0
+

cross/binutils-aarch64/APKBUILD

@@ -0,0 +1,139 @@
+# Automatically generated aport, do not edit!
+# Generator: pmbootstrap aportgen binutils-aarch64
+# Based on: main/binutils
+
+
+CTARGET_ARCH=aarch64
+CTARGET="$(arch_to_hostspec $CTARGET_ARCH)"
+
+pkgname=binutils-aarch64
+pkgver=2.40
+pkgrel=7
+pkgdesc="Tools necessary to build programs for aarch64 targets"
+url="https://www.gnu.org/software/binutils/"
+makedepends_build="bison flex texinfo"
+makedepends_host="zlib-dev jansson-dev zstd-dev"
+makedepends="$makedepends_build $makedepends_host"
+arch="x86_64"
+license="GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
+subpackages="binutils-dev binutils-doc"
+source="https://ftp.gnu.org/gnu/binutils/binutils-$pkgver.tar.xz
+	0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch
+	CVE-2023-1972.patch
+	binutils-ld-fix-static-linking.patch
+	"
+builddir="$srcdir/binutils-$pkgver"
+
+if [ "$CHOST" = "$CBUILD" ] && [ "$CBUILD" = "$CTARGET" ] && [ "$CTARGET_ARCH" != "riscv64" ]; then
+	subpackages="$subpackages binutils-gold"
+fi
+
+if [ "$CHOST" != "$CTARGET" ]; then
+	pkgname="binutils-$CTARGET_ARCH"
+	subpackages=""
+	sonameprefix="binutils:"
+fi
+
+# secfixes:
+#   2.40-r7:
+#     - CVE-2023-1972
+#   2.40-r0:
+#     - CVE-2023-1579
+#   2.39-r2:
+#     - CVE-2022-38533
+#   2.39-r0:
+#     - CVE-2022-38126
+#   2.35.2-r1:
+#     - CVE-2021-3487
+#   2.32-r0:
+#     - CVE-2018-19931
+#     - CVE-2018-19932
+#     - CVE-2018-20002
+#     - CVE-2018-20712
+#   2.28-r1:
+#     - CVE-2017-7614
+
+build() {
+	local _sysroot=/
+	local _cross_configure="--enable-install-libiberty --enable-shared"
+	local _arch_configure=""
+	local _gold_configure="--disable-gold"
+	local _plugin_configure="--enable-plugins"
+
+	if [ "$CHOST" != "$CTARGET" ]; then
+		_sysroot="$CBUILDROOT"
+		_cross_configure="--disable-install-libiberty"
+		_plugin_configure="--disable-plugins"
+	fi
+
+	if [ "$CHOST" = "$CBUILD" ] && [ "$CBUILD" = "$CTARGET" ] && [ "$CTARGET_ARCH" != "riscv64" ]; then
+		_gold_configure="--enable-gold"
+	fi
+
+	if [ "$CTARGET_ARCH" = "x86_64" ]; then
+		_arch_configure="--enable-targets=x86_64-pep"
+	fi
+
+	if [ "$CTARGET_ARCH" = "riscv64" ]; then
+		_gold_configure="--disable-gold"
+	fi
+
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--target=$CTARGET \
+		--with-build-sysroot="$CBUILDROOT" \
+		--with-sysroot=$_sysroot \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--disable-multilib \
+		--disable-gprofng \
+		--enable-ld=default \
+		$_gold_configure \
+		--enable-64-bit-bfd \
+		$_plugin_configure \
+		--enable-relro \
+		--enable-deterministic-archives \
+		--enable-default-execstack=no \
+		$_cross_configure \
+		$_arch_configure \
+		--enable-default-hash-style=gnu \
+		--with-pic \
+		--disable-werror \
+		--disable-nls \
+		--with-mmap \
+		--with-system-zlib
+	make
+}
+
+package() {
+	make install DESTDIR="$pkgdir"
+	if [ -d "$pkgdir"/usr/lib64 ]; then
+		mv "$pkgdir"/usr/lib64/* "$pkgdir"/usr/lib/
+		rmdir "$pkgdir"/usr/lib64
+	fi
+	if [ "$CHOST" != "$CTARGET" ]; then
+		# creating cross tools: remove any files that would conflict
+		# with the native tools, or other cross tools
+		rm -r "${pkgdir:?}"/usr/share
+		rm -f "$pkgdir"/usr/lib/libiberty.a
+		rm -r "${pkgdir:?}"/usr/lib/bfd-plugins
+	fi
+}
+
+gold() {
+	pkgdesc="GNU binutils - gold linker"
+
+	if [ -e "$pkgdir"/usr/bin/ld.gold ]; then
+		amove usr/bin/ld.gold
+	fi
+	amove usr/$CTARGET/bin/ld.gold
+}
+
+sha512sums="
+a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925  binutils-2.40.tar.xz
+70ec22bd72ef6dddecfd970613387dd4a8cdc8730dd3cbf03d5a0c3a7c4d839383167bb06dad21bf7c235329fd44b5dc4aefe762f68544f17155cf002bf1be4a  0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch
+b434e126c4c3f70c02b0a5597a0d75a4ea99b1498552c2d0676005ac0ae171c56cf07a6f6e2faa1381f1f4d4a37043a07d177dd4912f09b61109f103853594b2  CVE-2023-1972.patch
+ecee33b0e435aa704af1c334e560f201638ff79e199aa11ed78a72f7c9b46f85fbb227af5748e735fd681d1965fcc42ac81b0c8824e540430ce0c706c81e8b49  binutils-ld-fix-static-linking.patch
+"

cross/binutils-aarch64/CVE-2023-1972.patch

@@ -0,0 +1,37 @@
+Patch-Source: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57;hp=f2f9bde5cde7ff34ed0a4c4682a211d402aa1086
+https://sourceware.org/bugzilla/show_bug.cgi?id=30285
+--
+From: Nick Clifton <nickc@redhat.com>
+Date: Thu, 30 Mar 2023 09:10:09 +0000 (+0100)
+Subject: Fix an illegal memory access when an accessing a zer0-lengthverdef table.
+X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57;hp=f2f9bde5cde7ff34ed0a4c4682a211d402aa1086
+
+Fix an illegal memory access when an accessing a zer0-lengthverdef table.
+
+  PR 30285
+  * elf.c (_bfd_elf_slurp_version_tables): Fail if no version definitions are allocated.
+---
+
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
++
++      if (amt == 0)
++	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
++      if (amt == 0)
++	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;

cross/binutils-aarch64/binutils-ld-fix-static-linking.patch

@@ -0,0 +1,46 @@
+This fixes static linking for our hardened toolchain
+diff --git a/ld/scripttempl/elf.sc b/ld/scripttempl/elf.sc
+index e8126cb..9532bfb 100644
+--- a/ld/scripttempl/elf.sc
++++ b/ld/scripttempl/elf.sc
+@@ -235,8 +235,8 @@ test "${LARGE_SECTIONS}" = "yes" && LARGE_SECTIONS="
+ if test "${ENABLE_INITFINI_ARRAY}" = "yes"; then
+   SORT_INIT_ARRAY="KEEP (*(SORT_BY_INIT_PRIORITY(.init_array.*) SORT_BY_INIT_PRIORITY(.ctors.*)))"
+   SORT_FINI_ARRAY="KEEP (*(SORT_BY_INIT_PRIORITY(.fini_array.*) SORT_BY_INIT_PRIORITY(.dtors.*)))"
+-  CTORS_IN_INIT_ARRAY="EXCLUDE_FILE (*crtbegin.o *crtbegin?.o *crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .ctors"
+-  DTORS_IN_FINI_ARRAY="EXCLUDE_FILE (*crtbegin.o *crtbegin?.o *crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .dtors"
++  CTORS_IN_INIT_ARRAY="EXCLUDE_FILE (*crtbegin*.o *crtend*.o $OTHER_EXCLUDE_FILES) .ctors"
++  DTORS_IN_FINI_ARRAY="EXCLUDE_FILE (*crtbegin*.o *crtend*.o $OTHER_EXCLUDE_FILES) .dtors"
+ else
+   SORT_INIT_ARRAY="KEEP (*(SORT(.init_array.*)))"
+   SORT_FINI_ARRAY="KEEP (*(SORT(.fini_array.*)))"
+@@ -270,15 +270,14 @@ CTOR=".ctors        ${CONSTRUCTING-0} :
+        doesn't matter which directory crtbegin.o
+        is in.  */
+ 
+-    KEEP (*crtbegin.o(.ctors))
+-    KEEP (*crtbegin?.o(.ctors))
++    KEEP (*crtbegin*.o(.ctors))
+ 
+     /* We don't want to include the .ctor section from
+        the crtend.o file until after the sorted ctors.
+        The .ctor section from the crtend file contains the
+        end of ctors marker and it must be last */
+ 
+-    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .ctors))
++    KEEP (*(EXCLUDE_FILE (*crtend*.o $OTHER_EXCLUDE_FILES) .ctors))
+     KEEP (*(SORT(.ctors.*)))
+     KEEP (*(.ctors))
+     ${CONSTRUCTING+${CTOR_END}}
+@@ -286,9 +285,8 @@ CTOR=".ctors        ${CONSTRUCTING-0} :
+ DTOR=".dtors        ${CONSTRUCTING-0} :
+   {
+     ${CONSTRUCTING+${DTOR_START}}
+-    KEEP (*crtbegin.o(.dtors))
+-    KEEP (*crtbegin?.o(.dtors))
+-    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .dtors))
++    KEEP (*crtbegin*.o(.dtors))
++    KEEP (*(EXCLUDE_FILE (*crtend*.o $OTHER_EXCLUDE_FILES) .dtors))
+     KEEP (*(SORT(.dtors.*)))
+     KEEP (*(.dtors))
+     ${CONSTRUCTING+${DTOR_END}}

cross/binutils-armv7/0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch

@@ -0,0 +1,55 @@
+From bbf05b742fde518fb97c789b043fe0d3aaf549f0 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Tue, 21 Sep 2021 14:53:13 +0000
+Subject: [PATCH] Revert "PR25882, .gnu.attributes are not checked for shared
+ libraries"
+
+This revert is needed to avoid wrongly tagging objects with the incompatible
+IBM long double ABI, which is not supported by musl and will result in
+linking errors if used.
+
+This reverts commit a8acd6eeb6dc2cc5460ece90f90ebe36b56b20ba.
+---
+ bfd/elf32-tic6x.c |  3 ---
+ ld/ldlang.c       | 10 ++++------
+ 2 files changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/bfd/elf32-tic6x.c b/bfd/elf32-tic6x.c
+index 5754f3cb860..3ad1d612749 100644
+--- a/bfd/elf32-tic6x.c
++++ b/bfd/elf32-tic6x.c
+@@ -3735,9 +3735,6 @@ elf32_tic6x_merge_attributes (bfd *ibfd, struct bfd_link_info *info)
+ 
+ 	case Tag_ABI_PIC:
+ 	case Tag_ABI_PID:
+-	  /* Don't transfer these tags from dynamic objects.  */
+-	  if ((ibfd->flags & DYNAMIC) != 0)
+-	    continue;
+ 	  if (out_attr[i].i > in_attr[i].i)
+ 	    out_attr[i].i = in_attr[i].i;
+ 	  break;
+diff --git a/ld/ldlang.c b/ld/ldlang.c
+index 37b64c89ee1..f13beaef9d9 100644
+--- a/ld/ldlang.c
++++ b/ld/ldlang.c
+@@ -7071,13 +7071,11 @@ lang_check (void)
+ 		   bfd_printable_name (input_bfd), input_bfd,
+ 		   bfd_printable_name (link_info.output_bfd));
+ 	}
+-
+-      /* If the input bfd has no contents, it shouldn't set the
+-	 private data of the output bfd.  */
+-      else if (!file->flags.just_syms
+-	       && ((input_bfd->flags & DYNAMIC) != 0
+-		   || bfd_count_sections (input_bfd) != 0))
++      else if (bfd_count_sections (input_bfd))
+ 	{
++	  /* If the input bfd has no contents, it shouldn't set the
++	     private data of the output bfd.  */
++
+ 	  bfd_error_handler_type pfn = NULL;
+ 
+ 	  /* If we aren't supposed to warn about mismatched input
+-- 
+2.33.0
+

cross/binutils-armv7/APKBUILD

@@ -0,0 +1,139 @@
+# Automatically generated aport, do not edit!
+# Generator: pmbootstrap aportgen binutils-armv7
+# Based on: main/binutils
+
+
+CTARGET_ARCH=armv7
+CTARGET="$(arch_to_hostspec $CTARGET_ARCH)"
+
+pkgname=binutils-armv7
+pkgver=2.40
+pkgrel=7
+pkgdesc="Tools necessary to build programs for armv7 targets"
+url="https://www.gnu.org/software/binutils/"
+makedepends_build="bison flex texinfo"
+makedepends_host="zlib-dev jansson-dev zstd-dev"
+makedepends="$makedepends_build $makedepends_host"
+arch="x86_64"
+license="GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
+subpackages="binutils-dev binutils-doc"
+source="https://ftp.gnu.org/gnu/binutils/binutils-$pkgver.tar.xz
+	0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch
+	CVE-2023-1972.patch
+	binutils-ld-fix-static-linking.patch
+	"
+builddir="$srcdir/binutils-$pkgver"
+
+if [ "$CHOST" = "$CBUILD" ] && [ "$CBUILD" = "$CTARGET" ] && [ "$CTARGET_ARCH" != "riscv64" ]; then
+	subpackages="$subpackages binutils-gold"
+fi
+
+if [ "$CHOST" != "$CTARGET" ]; then
+	pkgname="binutils-$CTARGET_ARCH"
+	subpackages=""
+	sonameprefix="binutils:"
+fi
+
+# secfixes:
+#   2.40-r7:
+#     - CVE-2023-1972
+#   2.40-r0:
+#     - CVE-2023-1579
+#   2.39-r2:
+#     - CVE-2022-38533
+#   2.39-r0:
+#     - CVE-2022-38126
+#   2.35.2-r1:
+#     - CVE-2021-3487
+#   2.32-r0:
+#     - CVE-2018-19931
+#     - CVE-2018-19932
+#     - CVE-2018-20002
+#     - CVE-2018-20712
+#   2.28-r1:
+#     - CVE-2017-7614
+
+build() {
+	local _sysroot=/
+	local _cross_configure="--enable-install-libiberty --enable-shared"
+	local _arch_configure=""
+	local _gold_configure="--disable-gold"
+	local _plugin_configure="--enable-plugins"
+
+	if [ "$CHOST" != "$CTARGET" ]; then
+		_sysroot="$CBUILDROOT"
+		_cross_configure="--disable-install-libiberty"
+		_plugin_configure="--disable-plugins"
+	fi
+
+	if [ "$CHOST" = "$CBUILD" ] && [ "$CBUILD" = "$CTARGET" ] && [ "$CTARGET_ARCH" != "riscv64" ]; then
+		_gold_configure="--enable-gold"
+	fi
+
+	if [ "$CTARGET_ARCH" = "x86_64" ]; then
+		_arch_configure="--enable-targets=x86_64-pep"
+	fi
+
+	if [ "$CTARGET_ARCH" = "riscv64" ]; then
+		_gold_configure="--disable-gold"
+	fi
+
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--target=$CTARGET \
+		--with-build-sysroot="$CBUILDROOT" \
+		--with-sysroot=$_sysroot \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--disable-multilib \
+		--disable-gprofng \
+		--enable-ld=default \
+		$_gold_configure \
+		--enable-64-bit-bfd \
+		$_plugin_configure \
+		--enable-relro \
+		--enable-deterministic-archives \
+		--enable-default-execstack=no \
+		$_cross_configure \
+		$_arch_configure \
+		--enable-default-hash-style=gnu \
+		--with-pic \
+		--disable-werror \
+		--disable-nls \
+		--with-mmap \
+		--with-system-zlib
+	make
+}
+
+package() {
+	make install DESTDIR="$pkgdir"
+	if [ -d "$pkgdir"/usr/lib64 ]; then
+		mv "$pkgdir"/usr/lib64/* "$pkgdir"/usr/lib/
+		rmdir "$pkgdir"/usr/lib64
+	fi
+	if [ "$CHOST" != "$CTARGET" ]; then
+		# creating cross tools: remove any files that would conflict
+		# with the native tools, or other cross tools
+		rm -r "${pkgdir:?}"/usr/share
+		rm -f "$pkgdir"/usr/lib/libiberty.a
+		rm -r "${pkgdir:?}"/usr/lib/bfd-plugins
+	fi
+}
+
+gold() {
+	pkgdesc="GNU binutils - gold linker"
+
+	if [ -e "$pkgdir"/usr/bin/ld.gold ]; then
+		amove usr/bin/ld.gold
+	fi
+	amove usr/$CTARGET/bin/ld.gold
+}
+
+sha512sums="
+a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925  binutils-2.40.tar.xz
+70ec22bd72ef6dddecfd970613387dd4a8cdc8730dd3cbf03d5a0c3a7c4d839383167bb06dad21bf7c235329fd44b5dc4aefe762f68544f17155cf002bf1be4a  0001-Revert-PR25882-.gnu.attributes-are-not-checked-for-s.patch
+b434e126c4c3f70c02b0a5597a0d75a4ea99b1498552c2d0676005ac0ae171c56cf07a6f6e2faa1381f1f4d4a37043a07d177dd4912f09b61109f103853594b2  CVE-2023-1972.patch
+ecee33b0e435aa704af1c334e560f201638ff79e199aa11ed78a72f7c9b46f85fbb227af5748e735fd681d1965fcc42ac81b0c8824e540430ce0c706c81e8b49  binutils-ld-fix-static-linking.patch
+"

cross/binutils-armv7/CVE-2023-1972.patch

@@ -0,0 +1,37 @@
+Patch-Source: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57;hp=f2f9bde5cde7ff34ed0a4c4682a211d402aa1086
+https://sourceware.org/bugzilla/show_bug.cgi?id=30285
+--
+From: Nick Clifton <nickc@redhat.com>
+Date: Thu, 30 Mar 2023 09:10:09 +0000 (+0100)
+Subject: Fix an illegal memory access when an accessing a zer0-lengthverdef table.
+X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57;hp=f2f9bde5cde7ff34ed0a4c4682a211d402aa1086
+
+Fix an illegal memory access when an accessing a zer0-lengthverdef table.
+
+  PR 30285
+  * elf.c (_bfd_elf_slurp_version_tables): Fail if no version definitions are allocated.
+---
+
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
++
++      if (amt == 0)
++	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
++      if (amt == 0)
++	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;

cross/binutils-armv7/binutils-ld-fix-static-linking.patch

@@ -0,0 +1,46 @@
+This fixes static linking for our hardened toolchain
+diff --git a/ld/scripttempl/elf.sc b/ld/scripttempl/elf.sc
+index e8126cb..9532bfb 100644
+--- a/ld/scripttempl/elf.sc
++++ b/ld/scripttempl/elf.sc
+@@ -235,8 +235,8 @@ test "${LARGE_SECTIONS}" = "yes" && LARGE_SECTIONS="
+ if test "${ENABLE_INITFINI_ARRAY}" = "yes"; then
+   SORT_INIT_ARRAY="KEEP (*(SORT_BY_INIT_PRIORITY(.init_array.*) SORT_BY_INIT_PRIORITY(.ctors.*)))"
+   SORT_FINI_ARRAY="KEEP (*(SORT_BY_INIT_PRIORITY(.fini_array.*) SORT_BY_INIT_PRIORITY(.dtors.*)))"
+-  CTORS_IN_INIT_ARRAY="EXCLUDE_FILE (*crtbegin.o *crtbegin?.o *crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .ctors"
+-  DTORS_IN_FINI_ARRAY="EXCLUDE_FILE (*crtbegin.o *crtbegin?.o *crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .dtors"
++  CTORS_IN_INIT_ARRAY="EXCLUDE_FILE (*crtbegin*.o *crtend*.o $OTHER_EXCLUDE_FILES) .ctors"
++  DTORS_IN_FINI_ARRAY="EXCLUDE_FILE (*crtbegin*.o *crtend*.o $OTHER_EXCLUDE_FILES) .dtors"
+ else
+   SORT_INIT_ARRAY="KEEP (*(SORT(.init_array.*)))"
+   SORT_FINI_ARRAY="KEEP (*(SORT(.fini_array.*)))"
+@@ -270,15 +270,14 @@ CTOR=".ctors        ${CONSTRUCTING-0} :
+        doesn't matter which directory crtbegin.o
+        is in.  */
+ 
+-    KEEP (*crtbegin.o(.ctors))
+-    KEEP (*crtbegin?.o(.ctors))
++    KEEP (*crtbegin*.o(.ctors))
+ 
+     /* We don't want to include the .ctor section from
+        the crtend.o file until after the sorted ctors.
+        The .ctor section from the crtend file contains the
+        end of ctors marker and it must be last */
+ 
+-    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .ctors))
++    KEEP (*(EXCLUDE_FILE (*crtend*.o $OTHER_EXCLUDE_FILES) .ctors))
+     KEEP (*(SORT(.ctors.*)))
+     KEEP (*(.ctors))
+     ${CONSTRUCTING+${CTOR_END}}
+@@ -286,9 +285,8 @@ CTOR=".ctors        ${CONSTRUCTING-0} :
+ DTOR=".dtors        ${CONSTRUCTING-0} :
+   {
+     ${CONSTRUCTING+${DTOR_START}}
+-    KEEP (*crtbegin.o(.dtors))
+-    KEEP (*crtbegin?.o(.dtors))
+-    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o $OTHER_EXCLUDE_FILES) .dtors))
++    KEEP (*crtbegin*.o(.dtors))
++    KEEP (*(EXCLUDE_FILE (*crtend*.o $OTHER_EXCLUDE_FILES) .dtors))
+     KEEP (*(SORT(.dtors.*)))
+     KEEP (*(.dtors))
+     ${CONSTRUCTING+${DTOR_END}}

cross/busybox-static-aarch64/APKBUILD

@@ -0,0 +1,36 @@
+# Automatically generated aport, do not edit!
+# Generator: pmbootstrap aportgen busybox-static-aarch64
+
+# Stub for apkbuild-lint
+if [ -z "$(type -t arch_to_hostspec)" ]; then
+	arch_to_hostspec() { :; }
+fi
+
+pkgname=busybox-static-aarch64
+pkgver=1.36.1
+pkgrel=5
+
+_arch="aarch64"
+_mirror="http://dl-4.alpinelinux.org/alpine/"
+
+url="http://busybox.net"
+license="GPL2"
+arch="x86_64"
+options="!check !strip"
+pkgdesc="Statically linked Busybox for $_arch"
+_target="$(arch_to_hostspec $_arch)"
+
+source="
+	busybox-static-$pkgver-r$pkgrel-$_arch-v3.18.apk::$_mirror/v3.18/main/$_arch/busybox-static-$pkgver-r$pkgrel.apk
+"
+
+package() {
+	mkdir -p "$pkgdir/usr/$_target"
+	cd "$pkgdir/usr/$_target"
+	tar -xf $srcdir/busybox-static-$pkgver-r$pkgrel-$_arch-v3.18.apk
+	rm .PKGINFO .SIGN.*
+}
+
+sha512sums="
+78b4d14db0bf72c7c9f8262a59010102a208cd0189ae5ee2d622f56bbdfadea2f1976421301c62b326f94f9ea41812d5b1c938a5d71376631e634d30bc03ff4d  busybox-static-1.36.1-r5-aarch64-v3.18.apk
+"

cross/busybox-static-armv7/APKBUILD

@@ -0,0 +1,36 @@
+# Automatically generated aport, do not edit!
+# Generator: pmbootstrap aportgen busybox-static-armv7
+
+# Stub for apkbuild-lint
+if [ -z "$(type -t arch_to_hostspec)" ]; then
+	arch_to_hostspec() { :; }
+fi
+
+pkgname=busybox-static-armv7
+pkgver=1.36.1
+pkgrel=5
+
+_arch="armv7"
+_mirror="http://dl-4.alpinelinux.org/alpine/"
+
+url="http://busybox.net"
+license="GPL2"
+arch="x86_64"
+options="!check !strip"
+pkgdesc="Statically linked Busybox for $_arch"
+_target="$(arch_to_hostspec $_arch)"
+
+source="
+	busybox-static-$pkgver-r$pkgrel-$_arch-v3.18.apk::$_mirror/v3.18/main/$_arch/busybox-static-$pkgver-r$pkgrel.apk
+"
+
+package() {
+	mkdir -p "$pkgdir/usr/$_target"
+	cd "$pkgdir/usr/$_target"
+	tar -xf $srcdir/busybox-static-$pkgver-r$pkgrel-$_arch-v3.18.apk
+	rm .PKGINFO .SIGN.*
+}
+
+sha512sums="
+1ef39e3714860276cf5a61cfd51eee3f377f7819f3b3a9d653863edce9b43bd3b33e0a25f8e743b3ae9f442008f7960ad1574abb375168eab82e48f05204dd53  busybox-static-1.36.1-r5-armv7-v3.18.apk
+"

cross/ccache-cross-symlinks/APKBUILD

@@ -2,10 +2,10 @@
 # compiling packages in the native chroot (e.g. kernel packages), the
 # cross-compiler does not get called directly, but wrapped through
 # ccache, which can then cache the results.
-maintainer=""
+
 pkgname=ccache-cross-symlinks
 pkgver=3
-pkgrel=3
+pkgrel=0
 pkgdesc="Enable ccache for cross-compilers with symlinks"
 url="https://ccache.samba.org/"
 arch="noarch"
@@ -15,7 +15,7 @@ options="!check"
 
 package() {
 	# Keep in sync with pmb.config.build_device_architectures
-	local _archs="armhf armv7 aarch64 x86_64 x86 riscv64 ppc64le loongarch64"
+	local _archs="armhf armv7 aarch64 x86_64 x86"
 
 	local _bins="c++ cc cpp g++ gcc clang clang++"
 	mkdir -p "$pkgdir/usr/lib/ccache/bin"

cross/crossdirect/APKBUILD

@@ -1,5 +1,3 @@
-# https://docs.postmarketos.org/pmbootstrap/cross_compiling.html
-#
 # Wrapper for the "crossdirect" compilation method.
 # pmbootstrap mounts the native chroot in the foreign arch (e.g. armhf) chroot
 # as /native. This package gets installed into the native chroot, and creates
@@ -11,33 +9,26 @@
 # -> /native/usr/bin/rustc --target=armv6-alpine-linux-musleabihf ...
 #
 # When building packages in the armhf chroot, PATH will get prepended with
-# "/native/usr/lib/crossdirect/armhf". The end game is of course invoking
-# programs such as cross compilers and archivers from the native chroot,
-# running at native speed, whenever they get called from the foreign arch
-# chroot. See crossdirect.c for implementation details of the C version (llvm,
-# fakeroot, rpath). The rust version and redirect for archivers are implemented
-# as simple shell wrappers.
-maintainer="Oliver Smith <ollieparanoid@postmarketos.org>"
+# "/native/usr/lib/crossdirect/armhf". The end game is of course invoking the
+# cross compiler from the native chroot, running at native speed, whenever
+# calling the compiler from the foreign arch chroot. See crossdirect.c for
+# implementation details of the C version (llvm, fakeroot, rpath). The rust
+# version is implemented as simple shell wrappers.
+
 pkgname=crossdirect
-pkgver=5.3.1
-pkgrel=1
-pkgdesc="Wrappers to launch native programs (e.g. cross compilers) in foreign chroots"
+pkgver=5
+pkgrel=0
+pkgdesc="Wrappers to launch native cross compilers in foreign chroots"
 url="https://postmarketOS.org"
 arch="all"
 license="MIT"
 options="!check"
-source="
-	cargo.sh
-	crossdirect.c
-	exec_native.sh
-	rust-qemu-linker.sh
-	rustc.sh
-"
+source="cargo.sh crossdirect.c rustc.sh rust-qemu-linker.sh"
 
 build() {
 	cd "$srcdir"
 	# Architectures and binaries
-	_archs="x86_64 armhf armv7 aarch64 loongarch64 ppc64le riscv64"
+	_archs="x86_64 armhf armv7 aarch64"
 	for _arch in $_archs; do
 		[ "$_arch" == "$CARCH" ] && continue
 		_hostspec="$(arch_to_hostspec $_arch)"
@@ -54,38 +45,8 @@ build() {
 
 package() {
 	# Architectures and binaries
-	_archs="
-		aarch64
-		armhf
-		armv7
-		loongarch64
-		ppc64le
-		riscv64
-		x86_64
-	"
-	_bin_compilers="
-		c++
-		cc
-		clang
-		clang++
-		cpp
-		g++
-		gcc
-	"
-	_bin_archivers="
-		bzip2
-		gunzip
-		gzip
-		lzip
-		lzma
-		lzop
-		pigz
-		unlzma
-		unpigz
-		unxz
-		unzip
-		xz
-	"
+	_archs="x86_64 armhf armv7 aarch64"
+	_bins="c++ cc cpp g++ gcc clang clang++"
 
 	# Rust wrappers
 	install -Dm755 "$srcdir/rust-qemu-linker.sh" \
@@ -93,9 +54,6 @@ package() {
 	install -Dm755 "$srcdir/cargo.sh" "$pkgdir/usr/lib/crossdirect/cargo.sh"
 	install -Dm755 "$srcdir/rustc.sh" "$pkgdir/usr/lib/crossdirect/rustc.sh"
 
-	# For archivers
-	install -Dm755 "$srcdir/exec_native.sh" -t "$pkgdir/usr/lib/crossdirect/"
-
 	# Iterate over architectures
 	for _arch in $_archs; do
 		[ "$_arch" == "$CARCH" ] && continue
@@ -109,26 +67,18 @@ package() {
 		cp "$srcdir/crossdirect-$_arch" "./"
 
 		# GCC: create compiler symlinks
-		for _bin in $_bin_compilers; do
+		for _bin in $_bins; do
 			ln -s "crossdirect-$_arch" "$_bin"
 			ln -s "crossdirect-$_arch" "$_hostspec-$_bin"
 		done
 
-		# Archivers
-		for _bin in $_bin_archivers; do
-			ln -s ../exec_native.sh "$_bin"
-		done
-
-		# Rust
 		ln -s ../cargo.sh cargo
 		ln -s ../rustc.sh rustc
 	done
 }
-
 sha512sums="
 0f4b48f250425dc57f63955fc8b38477d23db793bee367c3fbe03c3d2a559ba576434d07518310db4cae9d90d501af4051b80038b10fae94b980e537fc9374ad  cargo.sh
-b2e602b7fc95ed403d29f0d754879d5f773c39ee33e726bb10cff17b3c088406dac84f2ca6d8ad563c64370007d98af805d6ee9cd4a06fe3d4c61c0cb90c5c0c  crossdirect.c
-73e2b5d2d8ef7c6002b3a787d14945586991493b8d81f59e5c0beda0d3b290543e1fdc6f288da726c5dd121c0861d2a894410b7b749a537df0df5b409e102330  exec_native.sh
+500107e5aff8b34e74b54982ebcd447fc41bc8283956d506561b031a055cb30ec12698047c2604918b4b6d8560fe03db427a63dff2b83c907e8494b7f5233f29  crossdirect.c
+2c41410a9ef2dab31403545e55e2464f2ee4e7056ffbcd3bc5810d582311801496b88d55307f17ce6acf766e9c867d30d05f2b0d8d46bf77a5e8f0495d6bc24e  rustc.sh
 ea9bf8db3810d03d0a7395057f3d6e57f7127d87c55deaedc171c255288f5f3cc6fbcc680a5a1b92786cf573875d5dc22521173799fe2639acc97d0715ff905b  rust-qemu-linker.sh
-de2aa6929bbff5db9132673e667f4525b333d062cb1f7a0597dd924de9e5c7215a9f8e2e6263b6fb5ace06f2c4b64f4ebfd0ede9b78add07c2cd08ec8613e98f  rustc.sh
 "

cross/crossdirect/crossdirect.c

@@ -43,8 +43,9 @@
 
 void exit_userfriendly()
 {
-	fprintf(stderr, "Please report this at: https://gitlab.postmarketos.org/postmarketOS/pmaports/issues\n");
-	fprintf(stderr, "As a workaround, you can compile without crossdirect with options=\"!pmb:crossdirect\".\n");
+	fprintf(stderr, "Please report this at: https://gitlab.com/postmarketOS/pmaports/issues\n");
+	fprintf(stderr, "As a workaround, you can compile without crossdirect.\n");
+	fprintf(stderr, "See 'pmbootstrap -h' for related options.\n");
 	exit(1);
 }
 
@@ -117,17 +118,11 @@ int main(int argc, char **argv)
 		NULL };
 	char *ldPreload = getenv("LD_PRELOAD");
 	if (ldPreload) {
-		if (strstr(ldPreload, "libfakeroot.so")) {
-			fprintf(stderr, "============================================================================================\n");
-			fprintf(stderr, "ERROR: crossdirect was called with: LD_PRELOAD=%s\n", ldPreload);
-			fprintf(stderr, "This means your package tried to run a compiler during package().\n");
-			fprintf(stderr, "This is not supported by crossdirect, and usually not a good idea.\n");
-			fprintf(stderr, "* Try to fix your APKBUILD so it does not run the compiler during package(), only in build()\n");
-			fprintf(stderr, "  * If you're using 'meson install', try to add '--no-rebuild'\n");
-			fprintf(stderr, "* If this is not possible, you can work around it by setting options=\"!pmb:crossdirect\"\n");
-			fprintf(stderr, "  (compilation will be slower!)\n");
-			fprintf(stderr, "============================================================================================\n");
-			exit(1);
+		if (strcmp(ldPreload, "/usr/lib/libfakeroot.so") == 0) {
+			env[0] = "LD_PRELOAD=/native/usr/lib/libfakeroot.so";
+		} else {
+			fprintf(stderr, "ERROR: crossdirect: can't handle LD_PRELOAD: %s\n", ldPreload);
+			exit_userfriendly();
 		}
 	}
 

cross/crossdirect/exec_native.sh

@@ -1,27 +0,0 @@
-#!/bin/sh -e
-# Execute the binary from the native chroot if it is installed there. This is
-# done for archiver tools such as unxz, so they don't need to go through QEMU.
-BASENAME="$(basename "$0")"
-
-if [ -n "$LD_PRELOAD" ]; then
-	# The archiver tool gets called during package(), which abuild runs
-	# with libfakeroot.so. Some packages do this, like bootchart2, which
-	# compresses man pages in its "make install". We can't run the native
-	# binary here due to the LD_PRELOAD, so run the foreign arch one.
-	export PATH="/usr/bin:/usr/sbin:/sbin:/bin"
-	exec "$BASENAME" "$@"
-fi
-
-# Try /native first, then the foreign arch paths. Never try
-# /native/usr/lib/crossdirect as this would result in a loop.
-UNWRAPPED_PATH="/native/usr/bin:/native/usr/sbin:/native/sbin:/native/bin:/usr/bin:/usr/sbin:/sbin:/bin"
-UNWRAPPED_BIN="$(PATH="$UNWRAPPED_PATH" command -v "$BASENAME")"
-
-case "$UNWRAPPED_BIN" in
-	/native/*)
-		export LD_LIBRARY_PATH="/native/usr/lib:/native/lib"
-		export PATH="$UNWRAPPED_PATH"
-		;;
-esac
-
-exec "$UNWRAPPED_BIN" "$@"

cross/crossdirect/rustc.sh

@@ -5,15 +5,8 @@ if [ -n "$CROSSDIRECT_DEBUG" ]; then
 fi
 
 # return the correct host architecture when cargo requests it
-if [ "$*" = "-vV" ] || [ "$*" = "-V" ]; then
-	exec /usr/bin/rustc "$*"
-fi
-
-# pmbootstrap installs sccache when building a rust program, unless --no-ccache
-# is set. In that case it also sets CCACHE_DISABLE.
-SCCACHE=/native/usr/bin/sccache
-if ! [ -e "$SCCACHE" ] || [ -n "$CCACHE_DISABLE" ]; then
-	SCCACHE=""
+if [ "$*" = "-vV" ]; then
+	exec /usr/bin/rustc -vV
 fi
 
 # We expect the right target to be set in the arguments if compiling for the
@@ -21,17 +14,12 @@ fi
 # automatically. If no target is provided, this is probably a macro or a
 # build script, so it should be compiled for the native architecture.
 if echo "$*" | grep -qFe "--target"; then
-	# Not using sccache when building for foreign architecture, as it
-	# doesn't cache the output with "Non-cacheable reasons: --sysroot"
-	LD_LIBRARY_PATH=/native/lib:/native/usr/lib \
-		/native/usr/bin/rustc \
+	LD_LIBRARY_PATH=/native/lib:/native/usr/lib /native/usr/bin/rustc \
 		-Clinker=/native/usr/lib/crossdirect/rust-qemu-linker \
 		--sysroot=/usr \
 		"$@"
 else
-	PATH=/native/usr/bin:/native/bin \
-	LD_LIBRARY_PATH=/native/lib:/native/usr/lib \
-		$SCCACHE \
+	PATH=/native/usr/bin:/native/bin LD_LIBRARY_PATH=/native/lib:/native/usr/lib \
 		/native/usr/bin/rustc \
 		-Clink-arg=-Wl,-rpath,/native/lib:/native/usr/lib \
 		"$@"

cross/gcc-aarch64/0001-LoongArch-Only-allow-valid-binary-op-when-optimize-c.patch

@@ -1,130 +0,0 @@
-From 824eae920f0f64dd7687c969a2436b129161fdc9 Mon Sep 17 00:00:00 2001
-From: Jinyang He <hejinyang@loongson.cn>
-Date: Wed, 29 Oct 2025 16:07:35 +0800
-Subject: [PATCH] LoongArch: Only allow valid binary op when optimize
- conditional move
-
-It is wrong that optimize from `if (cond) dest op= 1 << shift` to
-`dest op= (cond ? 1 : 0) << shift` when `dest op 0 != dest`.
-Like `and`, `mul` or `div`.
-And in this optimization `mul` and `div` is optimized to shift.
-
-gcc/ChangeLog:
-
-	* config/loongarch/loongarch.cc
-	(loongarch_expand_conditional_move): Only allow valid binary
-	op when optimize conditional move.
-
-gcc/testsuite/ChangeLog:
-
-	* gcc.target/loongarch/conditional-move-opt-1.c: Remove mul.
-	* gcc.target/loongarch/conditional-move-opt-2.c: Remove and.
-	* gcc.target/loongarch/conditional-move-opt-3.c: New test.
-
-Co-Authored-By: Peng Fan <fanpeng@loongson.cn>
----
- gcc/config/loongarch/loongarch.cc             | 26 ++++++++++++++++---
- .../loongarch/conditional-move-opt-1.c        |  4 +--
- .../loongarch/conditional-move-opt-2.c        |  2 +-
- .../loongarch/conditional-move-opt-3.c        | 14 ++++++++++
- 4 files changed, 40 insertions(+), 6 deletions(-)
- create mode 100644 gcc/testsuite/gcc.target/loongarch/conditional-move-opt-3.c
-
-diff --git a/gcc/config/loongarch/loongarch.cc b/gcc/config/loongarch/loongarch.cc
-index bdf290654..740c8611a 100644
---- a/gcc/config/loongarch/loongarch.cc
-+++ b/gcc/config/loongarch/loongarch.cc
-@@ -5533,12 +5533,32 @@ loongarch_expand_conditional_move (rtx *operands)
- 	    }
- 	}
- 
-+      auto is_binary_op_0_keep_orig = [](enum rtx_code code)
-+	{
-+	  switch (code)
-+	    {
-+	    case PLUS:
-+	    case MINUS:
-+	    case IOR:
-+	    case XOR:
-+	    case ROTATE:
-+	    case ROTATERT:
-+	    case ASHIFT:
-+	    case ASHIFTRT:
-+	    case LSHIFTRT:
-+	      return true;
-+	    default:
-+	      return false;
-+	    }
-+	};
-+
-       /* Check if the optimization conditions are met.  */
-       if (value_if_true_insn
- 	  && value_if_false_insn
--	  /* Make sure that value_if_false and var are the same.  */
--	  && BINARY_P (value_if_true_insn_src
--		       = SET_SRC (single_set (value_if_true_insn)))
-+	  /* Make sure that the orig value OP 0 keep orig.  */
-+	  && (value_if_true_insn_src
-+	      = SET_SRC (single_set (value_if_true_insn)))
-+	  && is_binary_op_0_keep_orig ( GET_CODE (value_if_true_insn_src))
- 	  /* Make sure that both value_if_true and value_if_false
- 	     has the same var.  */
- 	  && rtx_equal_p (XEXP (value_if_true_insn_src, 0),
-diff --git a/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-1.c b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-1.c
-index ed13471aa..47802aa96 100644
---- a/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-1.c
-+++ b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-1.c
-@@ -27,7 +27,7 @@ void
- test_lt ()
- {
-   if (lm < ln)
--    lr *= (1 << 16);
-+    lr += (1 << 16);
-   lr += lm;
- }
- 
-@@ -35,7 +35,7 @@ void
- test_le ()
- {
-   if (lm <= ln)
--    lr = lm * ((long)1 << 32);
-+    lr = lm + ((long)1 << 32);
-   else
-     lr = lm;
-   lr += lm;
-diff --git a/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-2.c b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-2.c
-index ac72d4d93..743fd5e67 100644
---- a/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-2.c
-+++ b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-2.c
-@@ -29,7 +29,7 @@ void
- test_lez ()
- {
-   if (lm <= 0)
--    lr &= (1 << 16);
-+    lr |= (1 << 16);
-   lr += lm;
- }
- 
-diff --git a/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-3.c b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-3.c
-new file mode 100644
-index 000000000..95887980c
---- /dev/null
-+++ b/gcc/testsuite/gcc.target/loongarch/conditional-move-opt-3.c
-@@ -0,0 +1,14 @@
-+/* { dg-do compile } */
-+/* { dg-options "-O2" } */
-+/* { dg-final { scan-assembler "maskeqz" } } */
-+/* { dg-final { scan-assembler "masknez" } } */
-+
-+extern long lm, ln, lr;
-+
-+void
-+test_and ()
-+{
-+  if (lm < 0)
-+    lr &= (1 << 16);
-+  lr += lm;
-+}
--- 
-2.51.1
-

cross/gcc-aarch64/0001-posix_memalign.patch

@@ -1,4 +1,4 @@
-From 94cf7d2b3514ed3a4401861a519ead450e022afc Mon Sep 17 00:00:00 2001
+From 74c7b0df9971b6bc75d7d172c2819ffd21d51050 Mon Sep 17 00:00:00 2001
 From: Szabolcs Nagy <nsz@port70.net>
 Date: Fri, 26 Jan 2018 20:32:50 +0000
 Subject: [PATCH] posix_memalign
@@ -8,7 +8,7 @@ Subject: [PATCH] posix_memalign
  1 file changed, 5 insertions(+), 4 deletions(-)
 
 diff --git a/gcc/config/i386/pmm_malloc.h b/gcc/config/i386/pmm_malloc.h
-index d1d79a32fc9..069c3bb8324 100644
+index 3b2e4f47915..20f790904a2 100644
 --- a/gcc/config/i386/pmm_malloc.h
 +++ b/gcc/config/i386/pmm_malloc.h
 @@ -27,12 +27,13 @@
@@ -37,6 +37,3 @@ index d1d79a32fc9..069c3bb8324 100644
      return __ptr;
    else
      return NULL;
--- 
-2.50.1
-

cross/gcc-aarch64/0001-tree-object-size.cc-Fix-assert-constant-offset-in-ch.patch

@@ -1,77 +0,0 @@
-From 21b7d08714c4964403848db4144003835ff5245a Mon Sep 17 00:00:00 2001
-From: Linsen Zhou <i@lin.moe>
-Date: Fri, 17 Oct 2025 11:05:04 +0800
-Subject: [PATCH] tree-object-size.cc: Fix assert constant offset in
- check_for_plus_in_loops [PR122012]
-
-After commit 51b85dfeb19652bf3e0aaec08828ba7cee1e641c, when the
-pointer offset is a variable in the loop, the object size of the
-pointer may also need to be reexamined.
-Which make gcc_assert in the check_for_plus_in_loops failed.
-
-gcc/ChangeLog:
-
-	PR tree-optimization/122012
-	* tree-object-size.cc (check_for_plus_in_loops): Skip check
-	for the variable offset
-
-gcc/testsuite/ChangeLog:
-
-	PR tree-optimization/122012
-	* gcc.dg/torture/pr122012.c: New test.
-
-Signed-off-by: Linsen Zhou <i@lin.moe>
-(cherry picked from commit 82cefc4898d4ccabe76e28d6626b91ca9e998923)
----
- gcc/testsuite/gcc.dg/torture/pr122012.c | 18 ++++++++++++++++++
- gcc/tree-object-size.cc                 |  7 +++----
- 2 files changed, 21 insertions(+), 4 deletions(-)
- create mode 100644 gcc/testsuite/gcc.dg/torture/pr122012.c
-
-diff --git a/gcc/testsuite/gcc.dg/torture/pr122012.c b/gcc/testsuite/gcc.dg/torture/pr122012.c
-new file mode 100644
-index 00000000000..055915a1e98
---- /dev/null
-+++ b/gcc/testsuite/gcc.dg/torture/pr122012.c
-@@ -0,0 +1,18 @@
-+/* { dg-do compile } */
-+#include <stdlib.h>
-+
-+void foo();
-+
-+void test(size_t step) {
-+  char *buf = malloc(64);
-+  char *p = buf;
-+  size_t i;
-+
-+  for(i = 0; i < 64; ++i) {
-+    p += 4;
-+    if (__builtin_object_size (p, 2) != 0)
-+      foo();
-+    p += step;
-+  }
-+  free(buf);
-+}
-diff --git a/gcc/tree-object-size.cc b/gcc/tree-object-size.cc
-index 2d13ab79a84..76dc2446059 100644
---- a/gcc/tree-object-size.cc
-+++ b/gcc/tree-object-size.cc
-@@ -2153,12 +2153,11 @@ check_for_plus_in_loops (struct object_size_info *osi, tree var)
-       && gimple_assign_rhs_code (stmt) == POINTER_PLUS_EXPR)
-     {
-       tree basevar = gimple_assign_rhs1 (stmt);
--      tree cst = gimple_assign_rhs2 (stmt);
--
--      gcc_assert (TREE_CODE (cst) == INTEGER_CST);
-+      tree offset = gimple_assign_rhs2 (stmt);
- 
-       /* Skip non-positive offsets.  */
--      if (integer_zerop (cst) || compare_tree_int (cst, offset_limit) > 0)
-+      if (TREE_CODE (offset) != INTEGER_CST
-+	  || integer_zerop (offset) || compare_tree_int (offset, offset_limit) > 0)
-         return;
- 
-       osi->depths[SSA_NAME_VERSION (basevar)] = 1;
--- 
-2.51.0
-

cross/gcc-aarch64/0002-gcc-poison-system-directories.patch

@@ -1,6 +1,6 @@
-From 0d5e04099a3d2609105719f7396a4ff941b873b6 Mon Sep 17 00:00:00 2001
+From dd1e75ff4ecda96957465b34681f245e818928bd Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
-Date: Thu, 23 Jan 2025 17:12:51 -0800
+Date: Fri, 29 Mar 2013 08:59:00 +0400
 Subject: [PATCH] gcc: poison-system-directories
 
 Add /sw/include and /opt/include based on the original
@@ -11,25 +11,25 @@ aborted.
 Instead, we add the two missing items to the current scan.  If the user
 wants this to be a failure, they can add "-Werror=poison-system-directories".
 
-Upstream-Status: Inappropriate [OE configuration]
 Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
-Signed-off-by: sunil dora <sunilkumar.dora@windriver.com>
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+Upstream-Status: Pending
 ---
  gcc/common.opt      |  4 ++++
- gcc/config.in       | 10 ++++++++++
- gcc/configure       | 19 +++++++++++++++++++
- gcc/configure.ac    | 16 ++++++++++++++++
+ gcc/config.in       |  6 ++++++
+ gcc/configure       | 16 ++++++++++++++++
+ gcc/configure.ac    | 10 ++++++++++
  gcc/doc/invoke.texi |  9 +++++++++
- gcc/gcc.cc          | 12 ++++++++++--
- gcc/incpath.cc      | 25 +++++++++++++++++++++++++
- 7 files changed, 93 insertions(+), 2 deletions(-)
+ gcc/gcc.cc          |  2 ++
+ gcc/incpath.cc      | 21 +++++++++++++++++++++
+ 7 files changed, 68 insertions(+)
 
 diff --git a/gcc/common.opt b/gcc/common.opt
-index e3fa0dacec4..bea1adc0940 100644
+index 8a0dafc522d..0357868e22c 100644
 --- a/gcc/common.opt
 +++ b/gcc/common.opt
-@@ -729,6 +729,10 @@ Wreturn-local-addr
+@@ -710,6 +710,10 @@ Wreturn-local-addr
  Common Var(warn_return_local_addr) Init(1) Warning
  Warn about returning a pointer/reference to a local or temporary variable.
  
@@ -41,10 +41,10 @@ index e3fa0dacec4..bea1adc0940 100644
  Common Var(warn_shadow) Warning
  Warn when one variable shadows another.  Same as -Wshadow=global.
 diff --git a/gcc/config.in b/gcc/config.in
-index a79c51adb2b..8a531ed591c 100644
+index 64c27c9cfac..f0fbf123aa8 100644
 --- a/gcc/config.in
 +++ b/gcc/config.in
-@@ -249,6 +249,16 @@
+@@ -230,6 +230,12 @@
  #endif
  
  
@@ -52,28 +52,24 @@ index a79c51adb2b..8a531ed591c 100644
 +#ifndef USED_FOR_TARGET
 +#undef ENABLE_POISON_SYSTEM_DIRECTORIES
 +#endif
-+/* Define to warn for use of native system header directories */
-+#ifndef USED_FOR_TARGET
-+#undef POISON_BY_DEFAULT
-+#endif
 +
 +
  /* Define if you want all operations on RTL (the basic data structure of the
     optimizer and back end) to be checked for dynamic type safety at runtime.
     This is quite expensive. */
 diff --git a/gcc/configure b/gcc/configure
-index 16965953f05..0f4a5d52c30 100755
+index 5ce0557719a..e9060112384 100755
 --- a/gcc/configure
 +++ b/gcc/configure
-@@ -1051,6 +1051,7 @@ enable_maintainer_mode
+@@ -1023,6 +1023,7 @@ enable_maintainer_mode
  enable_link_mutex
  enable_link_serialization
  enable_version_specific_runtime_libs
 +enable_poison_system_directories
  enable_plugin
  enable_host_shared
- enable_host_pie
-@@ -1828,6 +1829,8 @@ Optional Features:
+ enable_libquadmath_support
+@@ -1785,6 +1786,8 @@ Optional Features:
    --enable-version-specific-runtime-libs
                            specify that runtime libraries should be installed
                            in a compiler-specific directory
@@ -81,8 +77,8 @@ index 16965953f05..0f4a5d52c30 100755
 +                          warn for use of native system header directories
    --enable-plugin         enable plugin support
    --enable-host-shared    build host code as shared libraries
-   --enable-host-pie       build host code as PIE
-@@ -34027,6 +34030,22 @@ if test "${enable_version_specific_runtime_libs+set}" = set; then :
+   --disable-libquadmath-support
+@@ -31982,6 +31985,19 @@ if test "${enable_version_specific_runtime_libs+set}" = set; then :
  fi
  
  
@@ -93,12 +89,9 @@ index 16965953f05..0f4a5d52c30 100755
 +  enable_poison_system_directories=no
 +fi
 +
-+if test "x${enable_poison_system_directories}" != "xno"; then
++if test "x${enable_poison_system_directories}" = "xyes"; then
 +
 +$as_echo "#define ENABLE_POISON_SYSTEM_DIRECTORIES 1" >>confdefs.h
-+if test "$enable_poison_system_directories" = "error"; then
-+$as_echo "#define POISON_BY_DEFAULT 1" >>confdefs.h
-+fi
 +
 +fi
 +
@@ -106,105 +99,68 @@ index 16965953f05..0f4a5d52c30 100755
  
  
 diff --git a/gcc/configure.ac b/gcc/configure.ac
-index 9f67e62950a..b0e3615e5aa 100644
+index 23bee7010a3..75a7048045c 100644
 --- a/gcc/configure.ac
 +++ b/gcc/configure.ac
-@@ -7502,6 +7502,22 @@ AC_ARG_ENABLE(version-specific-runtime-libs,
+@@ -7421,6 +7421,16 @@ AC_ARG_ENABLE(version-specific-runtime-libs,
                  [specify that runtime libraries should be
                   installed in a compiler-specific directory])])
  
 +AC_ARG_ENABLE([poison-system-directories],
 +             AS_HELP_STRING([--enable-poison-system-directories],
-+                            [warn for use of native system header directories (no/yes/error)]),,
++                            [warn for use of native system header directories]),,
 +             [enable_poison_system_directories=no])
-+AC_MSG_NOTICE([poisoned directories $enable_poison_system_directories])
-+if test "x${enable_poison_system_directories}" != "xno"; then
-+  AC_MSG_NOTICE([poisoned directories enabled])
++if test "x${enable_poison_system_directories}" = "xyes"; then
 +  AC_DEFINE([ENABLE_POISON_SYSTEM_DIRECTORIES],
 +           [1],
 +           [Define to warn for use of native system header directories])
-+  if test $enable_poison_system_directories = "error"; then
-+   AC_MSG_NOTICE([poisoned directories are fatal])
-+   AC_DEFINE([POISON_BY_DEFAULT], [1], [Define to make poison warnings errors])
-+  fi
 +fi
 +
  # Substitute configuration variables
  AC_SUBST(subdirs)
  AC_SUBST(srcdir)
 diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
-index 72009c33cd0..29aea724731 100644
+index 07b440190c3..b2de464798a 100644
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -405,6 +405,7 @@ Objective-C and Objective-C++ Dialects}.
- -Wpacked  -Wno-packed-bitfield-compat  -Wpacked-not-aligned  -Wpadded
- -Wparentheses  -Wno-pedantic-ms-format
- -Wpointer-arith  -Wno-pointer-compare  -Wno-pointer-to-int-cast
-+-Wno-poison-system-directories
- -Wno-pragmas  -Wno-pragma-once-outside-header  -Wno-prio-ctor-dtor
- -Wno-psabi
- -Wredundant-decls  -Wrestrict
-@@ -10727,6 +10728,14 @@ an error. @option{Wint-to-pointer-cast} is enabled by default.
- Suppress warnings from casts from a pointer to an integer type of a
- different size.
+@@ -379,6 +379,7 @@ Objective-C and Objective-C++ Dialects}.
+ -Wpacked  -Wno-packed-bitfield-compat  -Wpacked-not-aligned  -Wpadded @gol
+ -Wparentheses  -Wno-pedantic-ms-format @gol
+ -Wpointer-arith  -Wno-pointer-compare  -Wno-pointer-to-int-cast @gol
++-Wno-poison-system-directories @gol
+ -Wno-pragmas  -Wno-prio-ctor-dtor  -Wredundant-decls @gol
+ -Wrestrict  -Wno-return-local-addr  -Wreturn-type @gol
+ -Wno-scalar-storage-order  -Wsequence-point @gol
+@@ -8029,6 +8030,14 @@ made up of data only and thus requires no special treatment.  But, for
+ most targets, it is made up of code and thus requires the stack to be
+ made executable in order for the program to work properly.
  
-+@opindex Wno-poison-system-directories
 +@item -Wno-poison-system-directories
++@opindex Wno-poison-system-directories
 +Do not warn for @option{-I} or @option{-L} options using system
 +directories such as @file{/usr/include} when cross compiling.  This
 +option is intended for use in chroot environments when such
 +directories contain the correct headers and libraries for the target
 +system rather than the host.
 +
- @opindex Winvalid-pch
- @opindex Wno-invalid-pch
- @item -Winvalid-pch
+ @item -Wfloat-equal
+ @opindex Wfloat-equal
+ @opindex Wno-float-equal
 diff --git a/gcc/gcc.cc b/gcc/gcc.cc
-index 4fd87f2c4a1..79d4920a047 100644
+index bb07cc244e3..47fb5802194 100644
 --- a/gcc/gcc.cc
 +++ b/gcc/gcc.cc
-@@ -909,6 +909,12 @@ proper position among the other output files.  */
- #define ASM_MAP ""
- #endif
- 
-+#ifdef POISON_BY_DEFAULT
-+#define POISON_IS_ERROR " -Werror=poison-system-directories"
-+#else
-+#define POISON_IS_ERROR
-+#endif
-+
- /* Assembler options for compressed debug sections.  */
- #if HAVE_LD_COMPRESS_DEBUG == 0
- /* Reject if the linker cannot write compressed debug sections.  */
-@@ -1166,6 +1172,8 @@ proper position among the other output files.  */
+@@ -1159,6 +1159,8 @@ proper position among the other output files.  */
     "%{fuse-ld=*:-fuse-ld=%*} " LINK_COMPRESS_DEBUG_SPEC \
     "%X %{o*} %{e*} %{N} %{n} %{r}\
      %{s} %{t} %{u*} %{z} %{Z} %{!nostdlib:%{!r:%{!nostartfiles:%S}}} \
 +    %{Wno-poison-system-directories:--no-poison-system-directories} \
 +    %{Werror=poison-system-directories:--error-poison-system-directories} \
-     %{static|no-pie|static-pie:} %@{L*} %(link_libgcc) " \
+     %{static|no-pie|static-pie:} %@{L*} %(mfwrap) %(link_libgcc) " \
      VTABLE_VERIFICATION_SPEC " " SANITIZER_EARLY_SPEC " %o "" \
      %{fopenacc|fopenmp|%:gt(%{ftree-parallelize-loops=*:%*} 1):\
-@@ -1268,7 +1276,7 @@ static const char *cpp_options =
- "%(cpp_unique_options) %1 %{m*} %{std*&ansi&trigraphs} %{W*&pedantic*} %{w}\
-  %{f*} %{g*:%{%:debug-level-gt(0):%{g*}\
-  %{!fno-working-directory:-fworking-directory}}} %{O*}\
-- %{undef} %{save-temps*:-fpch-preprocess}";
-+ %{undef} %{save-temps*:-fpch-preprocess}" POISON_IS_ERROR;
- 
- /* Pass -d* flags, possibly modifying -dumpdir, -dumpbase et al.
- 
-@@ -1297,7 +1305,7 @@ static const char *cc1_options =
-  %{coverage:-fprofile-arcs -ftest-coverage}\
-  %{fprofile-arcs|fcondition-coverage|fpath-coverage|fprofile-generate*|coverage:\
-    %{!fprofile-update=single:\
--     %{pthread:-fprofile-update=prefer-atomic}}}";
-+     %{pthread:-fprofile-update=prefer-atomic}}}" POISON_IS_ERROR;
- 
- static const char *asm_options =
- "%{-target-help:%:print-asm-header()} "
 diff --git a/gcc/incpath.cc b/gcc/incpath.cc
-index c1bbfd3872a..2cdbebc4c50 100644
+index bd2a97938eb..c80f100f476 100644
 --- a/gcc/incpath.cc
 +++ b/gcc/incpath.cc
 @@ -26,6 +26,7 @@
@@ -215,20 +171,9 @@ index c1bbfd3872a..2cdbebc4c50 100644
  
  /* Microsoft Windows does not natively support inodes.
     VMS has non-numeric inodes.  */
-@@ -273,6 +274,10 @@ remove_duplicates (cpp_reader *pfile, struct cpp_dir *head,
- 			     cur->name, xstrerror (errno));
- 	      reason = REASON_NOENT;
- 	    }
-+#ifdef ENABLE_POISON_SYSTEM_DIRECTORIES
-+	  pcur = &cur->next;
-+	  continue;
-+#endif
- 	}
-       else if (!S_ISDIR (st.st_mode))
- 	cpp_error_with_line (pfile, CPP_DL_WARNING, 0, 0,
-@@ -411,6 +416,26 @@ merge_include_chains (const char *sysroot, cpp_reader *pfile, int verbose)
- 	  fprintf (stderr, _("End of #embed search list.\n"));
+@@ -399,6 +400,26 @@ merge_include_chains (const char *sysroot, cpp_reader *pfile, int verbose)
  	}
+       fprintf (stderr, _("End of search list.\n"));
      }
 +
 +#ifdef ENABLE_POISON_SYSTEM_DIRECTORIES
@@ -237,22 +182,19 @@ index c1bbfd3872a..2cdbebc4c50 100644
 +       struct cpp_dir *p;
 +
 +       for (p = heads[INC_QUOTE]; p; p = p->next)
-+	 {
-+	  if ((!strncmp (p->name, "/usr/include", 12))
-+	      || (!strncmp (p->name, "/usr/local/include", 18))
-+	      || (!strncmp (p->name, "/usr/X11R6/include", 18))
-+	      || (!strncmp (p->name, "/sw/include", 11))
-+	      || (!strncmp (p->name, "/opt/include", 12)))
-+	    warning (OPT_Wpoison_system_directories,
-+		     "include location \"%s\" is unsafe for "
-+		     "cross-compilation",
-+		     p->name);
-+	 }
++         {
++          if ((!strncmp (p->name, "/usr/include", 12))
++              || (!strncmp (p->name, "/usr/local/include", 18))
++              || (!strncmp (p->name, "/usr/X11R6/include", 18))
++              || (!strncmp (p->name, "/sw/include", 11))
++              || (!strncmp (p->name, "/opt/include", 12)))
++            warning (OPT_Wpoison_system_directories,
++                     "include location \"%s\" is unsafe for "
++                     "cross-compilation",
++                     p->name);
++         }
 +    }
 +#endif
  }
  
  /* Use given -I paths for #include "..." but not #include <...>, and
--- 
-2.50.1
-

cross/gcc-aarch64/0003-specs-turn-on-Wl-z-now-by-default.patch

@@ -1,4 +1,4 @@
-From 90e8697dd88fd99ce2cf8739e95494853005377e Mon Sep 17 00:00:00 2001
+From 40e45739e7d3787acd13b5b9a4c27d843de0ffe2 Mon Sep 17 00:00:00 2001
 From: Ariadne Conill <ariadne@dereferenced.org>
 Date: Fri, 21 Aug 2020 06:45:49 +0000
 Subject: [PATCH] specs: turn on -Wl,-z,now by default
@@ -14,24 +14,24 @@ now by default.
  2 files changed, 4 insertions(+)
 
 diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
-index 29aea724731..6fb3ab70cc7 100644
+index b2de464798a..83bd1bde433 100644
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -19477,6 +19477,9 @@ For example, @option{-Wl,-Map,output.map} passes @option{-Map output.map} to the
+@@ -16872,6 +16872,9 @@ For example, @option{-Wl,-Map,output.map} passes @option{-Map output.map} to the
  linker.  When using the GNU linker, you can also get the same effect with
  @option{-Wl,-Map=output.map}.
  
 +NOTE: In Alpine Linux, for LDFLAGS, the option
 +@option{-Wl,-z,now} is used.  To disable, use @option{-Wl,-z,nonow}.
 +
- @opindex u
  @item -u @var{symbol}
+ @opindex u
  Pretend the symbol @var{symbol} is undefined, to force linking of
 diff --git a/gcc/gcc.cc b/gcc/gcc.cc
-index 79d4920a047..74a356fdf5e 100644
+index 47fb5802194..d18b5d7b59a 100644
 --- a/gcc/gcc.cc
 +++ b/gcc/gcc.cc
-@@ -1170,6 +1170,7 @@ proper position among the other output files.  */
+@@ -1157,6 +1157,7 @@ proper position among the other output files.  */
     "%{flto|flto=*:%<fcompare-debug*} \
      %{flto} %{fno-lto} %{flto=*} %l " LINK_PIE_SPEC \
     "%{fuse-ld=*:-fuse-ld=%*} " LINK_COMPRESS_DEBUG_SPEC \
@@ -39,6 +39,3 @@ index 79d4920a047..74a356fdf5e 100644
     "%X %{o*} %{e*} %{N} %{n} %{r}\
      %{s} %{t} %{u*} %{z} %{Z} %{!nostdlib:%{!r:%{!nostartfiles:%S}}} \
      %{Wno-poison-system-directories:--no-poison-system-directories} \
--- 
-2.50.1
-

cross/gcc-aarch64/0004-Turn-on-D_FORTIFY_SOURCE-2-by-default-for-C-C-ObjC-O.patch

@@ -1,4 +1,4 @@
-From 17c9cf9272077bc7ac784daffd4c68ba1ce67a0d Mon Sep 17 00:00:00 2001
+From 666d0aeb808ac9c10d065ae7b196695c81a25a20 Mon Sep 17 00:00:00 2001
 From: Ariadne Conill <ariadne@dereferenced.org>
 Date: Fri, 21 Aug 2020 06:46:22 +0000
 Subject: [PATCH] Turn on -D_FORTIFY_SOURCE=2 by default for C, C++, ObjC,
@@ -10,10 +10,10 @@ Subject: [PATCH] Turn on -D_FORTIFY_SOURCE=2 by default for C, C++, ObjC,
  2 files changed, 10 insertions(+)
 
 diff --git a/gcc/c-family/c-cppbuiltin.cc b/gcc/c-family/c-cppbuiltin.cc
-index 4589ee4a3a6..9edf095384c 100644
+index 4672ae8486a..573c021e1e8 100644
 --- a/gcc/c-family/c-cppbuiltin.cc
 +++ b/gcc/c-family/c-cppbuiltin.cc
-@@ -1581,6 +1581,10 @@ c_cpp_builtins (cpp_reader *pfile)
+@@ -1510,6 +1510,10 @@ c_cpp_builtins (cpp_reader *pfile)
    builtin_define_with_value ("__REGISTER_PREFIX__", REGISTER_PREFIX, 0);
    builtin_define_with_value ("__USER_LABEL_PREFIX__", user_label_prefix, 0);
  
@@ -25,10 +25,10 @@ index 4589ee4a3a6..9edf095384c 100644
    if (flag_gnu89_inline)
      cpp_define (pfile, "__GNUC_GNU_INLINE__");
 diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
-index 6fb3ab70cc7..799ce073dbf 100644
+index 83bd1bde433..dda299a9987 100644
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -12840,6 +12840,12 @@ also turns on the following optimization flags:
+@@ -10896,6 +10896,12 @@ also turns on the following optimization flags:
  Please note the warning under @option{-fgcse} about
  invoking @option{-O2} on programs that use computed gotos.
  
@@ -38,9 +38,6 @@ index 6fb3ab70cc7..799ce073dbf 100644
 +functions.  To disable, specify either @option{-U_FORTIFY_SOURCE} or
 +@option{-D_FORTIFY_SOURCE=0}.
 +
- @opindex O3
  @item -O3
+ @opindex O3
  Optimize yet more.  @option{-O3} turns on all optimizations specified
--- 
-2.50.1
-

cross/gcc-aarch64/0005-On-linux-targets-pass-as-needed-by-default-to-the-li.patch

@@ -1,4 +1,4 @@
-From 95d8fac6247b2cba1142261cc95c21063539112a Mon Sep 17 00:00:00 2001
+From 75d1a35180cf0967f062765314bf091a64032062 Mon Sep 17 00:00:00 2001
 From: Ariadne Conill <ariadne@dereferenced.org>
 Date: Fri, 21 Aug 2020 06:46:56 +0000
 Subject: [PATCH] On linux targets pass --as-needed by default to the linker,
@@ -12,7 +12,6 @@ Subject: [PATCH] On linux targets pass --as-needed by default to the linker,
  gcc/config/i386/gnu-user.h         |  2 +-
  gcc/config/i386/gnu-user64.h       |  1 +
  gcc/config/ia64/linux.h            |  2 +-
- gcc/config/loongarch/gnu-user.h    |  2 +-
  gcc/config/mips/gnu-user.h         |  1 +
  gcc/config/riscv/linux.h           |  1 +
  gcc/config/rs6000/linux64.h        |  4 ++--
@@ -20,13 +19,13 @@ Subject: [PATCH] On linux targets pass --as-needed by default to the linker,
  gcc/config/s390/linux.h            |  2 +-
  gcc/config/sparc/linux.h           |  2 +-
  gcc/gcc.cc                         | 28 ++++++++++++++++++++--------
- 15 files changed, 37 insertions(+), 20 deletions(-)
+ 14 files changed, 36 insertions(+), 19 deletions(-)
 
 diff --git a/gcc/config/aarch64/aarch64-linux.h b/gcc/config/aarch64/aarch64-linux.h
-index 116bb4e69f3..daf99f8dce9 100644
+index 5e4553d79f5..b516f3ef97f 100644
 --- a/gcc/config/aarch64/aarch64-linux.h
 +++ b/gcc/config/aarch64/aarch64-linux.h
-@@ -39,6 +39,7 @@
+@@ -35,6 +35,7 @@
  #define CPP_SPEC "%{pthread:-D_REENTRANT}"
  
  #define LINUX_TARGET_LINK_SPEC  "%{h*}		\
@@ -35,7 +34,7 @@ index 116bb4e69f3..daf99f8dce9 100644
     %{shared:-shared}				\
     %{symbolic:-Bsymbolic}			\
 diff --git a/gcc/config/alpha/linux-elf.h b/gcc/config/alpha/linux-elf.h
-index 3fd3b831166..0b4c2dccebe 100644
+index 17f16a55910..9ec667e9a5e 100644
 --- a/gcc/config/alpha/linux-elf.h
 +++ b/gcc/config/alpha/linux-elf.h
 @@ -37,7 +37,7 @@ along with GCC; see the file COPYING3.  If not see
@@ -48,7 +47,7 @@ index 3fd3b831166..0b4c2dccebe 100644
    %{shared:-shared}						\
    %{!shared:							\
 diff --git a/gcc/config/arm/linux-elf.h b/gcc/config/arm/linux-elf.h
-index d4d389e2aa8..adccc0b11c2 100644
+index df3da67c4f0..7532bc29f9b 100644
 --- a/gcc/config/arm/linux-elf.h
 +++ b/gcc/config/arm/linux-elf.h
 @@ -70,6 +70,7 @@
@@ -60,7 +59,7 @@ index d4d389e2aa8..adccc0b11c2 100644
     SUBTARGET_EXTRA_LINK_SPEC
  
 diff --git a/gcc/config/gnu-user.h b/gcc/config/gnu-user.h
-index 4c4e31efa39..3c17ac6eade 100644
+index 857c0e077bf..8433e56c3e1 100644
 --- a/gcc/config/gnu-user.h
 +++ b/gcc/config/gnu-user.h
 @@ -136,7 +136,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
@@ -70,9 +69,9 @@ index 4c4e31efa39..3c17ac6eade 100644
 -  LD_DYNAMIC_OPTION "}}%{!static-libasan:-lasan}"
 +  LD_DYNAMIC_OPTION "}}%{!static-libasan:%{!fuse-ld=gold:--push-state} --no-as-needed -lasan %{fuse-ld=gold:--as-needed;:--pop-state}}"
  #undef LIBHWASAN_EARLY_SPEC
- #define LIBHWASAN_EARLY_SPEC "%{!shared:libhwasan_preinit%O%s} " \
-   "%{static-libhwasan:%{!shared:" \
-@@ -146,12 +146,12 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ #define LIBHWASAN_EARLY_SPEC "%{static-libhwasan:%{!shared:" \
+   LD_STATIC_OPTION " --whole-archive -lhwasan --no-whole-archive " \
+@@ -145,12 +145,12 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
  #define LIBTSAN_EARLY_SPEC "%{!shared:libtsan_preinit%O%s} " \
    "%{static-libtsan:%{!shared:" \
    LD_STATIC_OPTION " --whole-archive -ltsan --no-whole-archive " \
@@ -88,7 +87,7 @@ index 4c4e31efa39..3c17ac6eade 100644
  
  #undef TARGET_F951_OPTIONS
 diff --git a/gcc/config/i386/gnu-user.h b/gcc/config/i386/gnu-user.h
-index 7abfda53049..ceb8f855b7d 100644
+index 0102b2a6f3b..994414c1845 100644
 --- a/gcc/config/i386/gnu-user.h
 +++ b/gcc/config/i386/gnu-user.h
 @@ -68,7 +68,7 @@ along with GCC; see the file COPYING3.  If not see
@@ -101,7 +100,7 @@ index 7abfda53049..ceb8f855b7d 100644
      %{!static: \
        %{!static-pie: \
 diff --git a/gcc/config/i386/gnu-user64.h b/gcc/config/i386/gnu-user64.h
-index abe714711bf..3ca128a79f5 100644
+index abc8cf624ca..fe656aeae27 100644
 --- a/gcc/config/i386/gnu-user64.h
 +++ b/gcc/config/i386/gnu-user64.h
 @@ -56,6 +56,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
@@ -113,7 +112,7 @@ index abe714711bf..3ca128a79f5 100644
    %{!shared: \
      %{!static: \
 diff --git a/gcc/config/ia64/linux.h b/gcc/config/ia64/linux.h
-index a2494c214c4..e1a5d530cdf 100644
+index 93510098ccc..3813e536423 100644
 --- a/gcc/config/ia64/linux.h
 +++ b/gcc/config/ia64/linux.h
 @@ -58,7 +58,7 @@ do {						\
@@ -125,21 +124,8 @@ index a2494c214c4..e1a5d530cdf 100644
    %{shared:-shared} \
    %{!shared: \
      %{!static: \
-diff --git a/gcc/config/loongarch/gnu-user.h b/gcc/config/loongarch/gnu-user.h
-index fbc75a90ad5..adbc4b7733f 100644
---- a/gcc/config/loongarch/gnu-user.h
-+++ b/gcc/config/loongarch/gnu-user.h
-@@ -44,7 +44,7 @@ along with GCC; see the file COPYING3.  If not see
- 
- #undef GNU_USER_TARGET_LINK_SPEC
- #define GNU_USER_TARGET_LINK_SPEC \
--  "%{G*} %{shared} -m " GNU_USER_LINK_EMULATION \
-+  "%{G*} %{shared} --as-needed -m " GNU_USER_LINK_EMULATION \
-   "%{!shared: %{static} " \
-   "%{!static: %{!static-pie: %{rdynamic:-export-dynamic} " \
-   "-dynamic-linker " GNU_USER_DYNAMIC_LINKER "}} " \
 diff --git a/gcc/config/mips/gnu-user.h b/gcc/config/mips/gnu-user.h
-index 5a82508c113..6eee7cdc603 100644
+index 6aad7192e69..e1256a55add 100644
 --- a/gcc/config/mips/gnu-user.h
 +++ b/gcc/config/mips/gnu-user.h
 @@ -55,6 +55,7 @@ along with GCC; see the file COPYING3.  If not see
@@ -151,22 +137,22 @@ index 5a82508c113..6eee7cdc603 100644
      %{!static: \
        %{rdynamic:-export-dynamic} \
 diff --git a/gcc/config/riscv/linux.h b/gcc/config/riscv/linux.h
-index 9060c940a44..282c77b6a7b 100644
+index 38803723ba9..3067ed6eac8 100644
 --- a/gcc/config/riscv/linux.h
 +++ b/gcc/config/riscv/linux.h
-@@ -48,6 +48,7 @@ along with GCC; see the file COPYING3.  If not see
+@@ -58,6 +58,7 @@ along with GCC; see the file COPYING3.  If not see
    "%{mabi=ilp32:_ilp32}"
  
  #define LINK_SPEC "\
 +-as-needed \
  -melf" XLEN_SPEC DEFAULT_ENDIAN_SPEC "riscv" LD_EMUL_SUFFIX " \
  %{mno-relax:--no-relax} \
- -X \
+ %{mbig-endian:-EB} \
 diff --git a/gcc/config/rs6000/linux64.h b/gcc/config/rs6000/linux64.h
-index 0316d8cb65d..139e1b6796c 100644
+index b2a7afabc73..34ceb4e4fce 100644
 --- a/gcc/config/rs6000/linux64.h
 +++ b/gcc/config/rs6000/linux64.h
-@@ -378,13 +378,13 @@ extern int dot_symbols;
+@@ -377,13 +377,13 @@ extern int dot_symbols;
  					   " -m elf64ppc")
  #endif
  
@@ -183,10 +169,10 @@ index 0316d8cb65d..139e1b6796c 100644
      %{rdynamic:-export-dynamic} \
      -dynamic-linker " GNU_USER_DYNAMIC_LINKER64 "}}} \
 diff --git a/gcc/config/rs6000/sysv4.h b/gcc/config/rs6000/sysv4.h
-index afb5c6ad867..b64638fb25b 100644
+index 7e2519de5d4..61215a7a1b3 100644
 --- a/gcc/config/rs6000/sysv4.h
 +++ b/gcc/config/rs6000/sysv4.h
-@@ -781,7 +781,7 @@ GNU_USER_TARGET_CC1_SPEC
+@@ -788,7 +788,7 @@ GNU_USER_TARGET_CC1_SPEC
  #define GNU_USER_DYNAMIC_LINKER GLIBC_DYNAMIC_LINKER
  #endif
  
@@ -196,7 +182,7 @@ index afb5c6ad867..b64638fb25b 100644
    -dynamic-linker " GNU_USER_DYNAMIC_LINKER "}}"
  
 diff --git a/gcc/config/s390/linux.h b/gcc/config/s390/linux.h
-index 2c3bca5dfcb..b90661247a4 100644
+index d7b7e7a7b02..d2287f14f2e 100644
 --- a/gcc/config/s390/linux.h
 +++ b/gcc/config/s390/linux.h
 @@ -82,7 +82,7 @@ along with GCC; see the file COPYING3.  If not see
@@ -209,7 +195,7 @@ index 2c3bca5dfcb..b90661247a4 100644
     %{!shared: \
        %{static:-static} \
 diff --git a/gcc/config/sparc/linux.h b/gcc/config/sparc/linux.h
-index 6d928846895..3cc05bb7240 100644
+index 6a809e9092d..93bfb92d3ff 100644
 --- a/gcc/config/sparc/linux.h
 +++ b/gcc/config/sparc/linux.h
 @@ -81,7 +81,7 @@ extern const char *host_detect_local_cpu (int argc, const char **argv);
@@ -222,10 +208,10 @@ index 6d928846895..3cc05bb7240 100644
    %{!shared: \
      %{!static: \
 diff --git a/gcc/gcc.cc b/gcc/gcc.cc
-index 74a356fdf5e..fc9c7d15b04 100644
+index d18b5d7b59a..3b76311b544 100644
 --- a/gcc/gcc.cc
 +++ b/gcc/gcc.cc
-@@ -774,8 +774,11 @@ proper position among the other output files.  */
+@@ -744,8 +744,11 @@ proper position among the other output files.  */
  #ifdef LIBASAN_EARLY_SPEC
  #define LIBASAN_SPEC STATIC_LIBASAN_LIBS
  #elif defined(HAVE_LD_STATIC_DYNAMIC)
@@ -239,7 +225,7 @@ index 74a356fdf5e..fc9c7d15b04 100644
  		     STATIC_LIBASAN_LIBS
  #else
  #define LIBASAN_SPEC "-lasan" STATIC_LIBASAN_LIBS
-@@ -810,8 +813,11 @@ proper position among the other output files.  */
+@@ -780,8 +783,11 @@ proper position among the other output files.  */
  #ifdef LIBTSAN_EARLY_SPEC
  #define LIBTSAN_SPEC STATIC_LIBTSAN_LIBS
  #elif defined(HAVE_LD_STATIC_DYNAMIC)
@@ -253,7 +239,7 @@ index 74a356fdf5e..fc9c7d15b04 100644
  		     STATIC_LIBTSAN_LIBS
  #else
  #define LIBTSAN_SPEC "-ltsan" STATIC_LIBTSAN_LIBS
-@@ -828,8 +834,11 @@ proper position among the other output files.  */
+@@ -798,8 +804,11 @@ proper position among the other output files.  */
  #ifdef LIBLSAN_EARLY_SPEC
  #define LIBLSAN_SPEC STATIC_LIBLSAN_LIBS
  #elif defined(HAVE_LD_STATIC_DYNAMIC)
@@ -267,7 +253,7 @@ index 74a356fdf5e..fc9c7d15b04 100644
  		     STATIC_LIBLSAN_LIBS
  #else
  #define LIBLSAN_SPEC "-llsan" STATIC_LIBLSAN_LIBS
-@@ -844,8 +853,11 @@ proper position among the other output files.  */
+@@ -814,8 +823,11 @@ proper position among the other output files.  */
  #define STATIC_LIBUBSAN_LIBS \
    " %{static-libubsan|static:%:include(libsanitizer.spec)%(link_libubsan)}"
  #ifdef HAVE_LD_STATIC_DYNAMIC
@@ -281,6 +267,3 @@ index 74a356fdf5e..fc9c7d15b04 100644
  		     STATIC_LIBUBSAN_LIBS
  #else
  #define LIBUBSAN_SPEC "-lubsan" STATIC_LIBUBSAN_LIBS
--- 
-2.50.1
-

cross/gcc-aarch64/0006-Enable-Wformat-and-Wformat-security-by-default.patch

@@ -1,4 +1,4 @@
-From 58a94690d4dd7b34543d9d154abc96d2d90d3b32 Mon Sep 17 00:00:00 2001
+From c664283dd30949c5299d1c45bd5740bcfe993d22 Mon Sep 17 00:00:00 2001
 From: Ariadne Conill <ariadne@dereferenced.org>
 Date: Fri, 21 Aug 2020 06:47:43 +0000
 Subject: [PATCH] Enable -Wformat and -Wformat-security by default.
@@ -8,11 +8,11 @@ Subject: [PATCH] Enable -Wformat and -Wformat-security by default.
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/gcc/c-family/c.opt b/gcc/c-family/c.opt
-index 75b6531860e..78830ce4b42 100644
+index 07da40ef43b..8683f706426 100644
 --- a/gcc/c-family/c.opt
 +++ b/gcc/c-family/c.opt
-@@ -805,7 +805,7 @@ Warn about function calls with format strings that write past the end
- of the destination region.
+@@ -692,7 +692,7 @@ Warn about function calls with format strings that write past the end
+ of the destination region.  Same as -Wformat-overflow=1.
  
  Wformat-security
 -C ObjC C++ ObjC++ Var(warn_format_security) Warning LangEnabledBy(C ObjC C++ ObjC++,Wformat=, warn_format >= 2, 0)
@@ -20,7 +20,7 @@ index 75b6531860e..78830ce4b42 100644
  Warn about possible security problems with format functions.
  
  Wformat-signedness
-@@ -830,7 +830,7 @@ C ObjC C++ ObjC++ Var(warn_format_zero_length) Warning LangEnabledBy(C ObjC C++
+@@ -713,7 +713,7 @@ C ObjC C++ ObjC++ Var(warn_format_zero_length) Warning LangEnabledBy(C ObjC C++
  Warn about zero-length formats.
  
  Wformat=
@@ -28,7 +28,4 @@ index 75b6531860e..78830ce4b42 100644
 +C ObjC C++ ObjC++ Joined RejectNegative UInteger Var(warn_format) Init(1) Warning LangEnabledBy(C ObjC C++ ObjC++,Wall, 1, 0) IntegerRange(0, 2)
  Warn about printf/scanf/strftime/strfmon format string anomalies.
  
- Wframe-address
--- 
-2.50.1
-
+ Wformat-overflow=

cross/gcc-aarch64/0007-Enable-Wtrampolines-by-default.patch

@@ -1,6 +1,6 @@
-From b2a755b671d88c34402290d7d769232e01aed350 Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@ariadne.space>
-Date: Fri, 25 Jul 2025 01:44:20 -0700
+From e4d0ec43e772b6dc7c3708aed5309897df26a125 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 21 Aug 2020 06:48:24 +0000
 Subject: [PATCH] Enable -Wtrampolines by default.
 
 ---
@@ -8,11 +8,11 @@ Subject: [PATCH] Enable -Wtrampolines by default.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/gcc/common.opt b/gcc/common.opt
-index bea1adc0940..e65a575d9f8 100644
+index 0357868e22c..6d5e5eebe60 100644
 --- a/gcc/common.opt
 +++ b/gcc/common.opt
-@@ -829,7 +829,7 @@ Common Var(warn_tautological_compare) Warning LangEnabledBy(C ObjC C++ ObjC++,Wa
- Warn if a comparison always evaluates to true or false.
+@@ -802,7 +802,7 @@ Common Var(warn_system_headers) Warning
+ Do not suppress warnings from system headers.
  
  Wtrampolines
 -Common Var(warn_trampolines) Warning
@@ -20,6 +20,3 @@ index bea1adc0940..e65a575d9f8 100644
  Warn whenever a trampoline is generated.
  
  Wtrivial-auto-var-init
--- 
-2.50.1
-

cross/gcc-aarch64/0008-Disable-ssp-on-nostdlib-nodefaultlibs-and-ffreestand.patch

@@ -0,0 +1,50 @@
+From 27e5d5bd3fed9006a2958d2b09750d15ad07383b Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 21 Aug 2020 06:49:40 +0000
+Subject: [PATCH] Disable ssp on -nostdlib, -nodefaultlibs and -ffreestanding
+ Change the buffer size.
+
+---
+ gcc/gcc.cc     | 8 +++++++-
+ gcc/params.opt | 2 +-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/gcc/gcc.cc b/gcc/gcc.cc
+index 3b76311b544..cc99d0b7aa1 100644
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -996,6 +996,12 @@ proper position among the other output files.  */
+ #define LINK_GCC_C_SEQUENCE_SPEC "%G %{!nolibc:%L %G}"
+ #endif
+ 
++#ifdef ENABLE_DEFAULT_SSP
++#define NO_SSP_SPEC "%{nostdlib|nodefaultlibs|ffreestanding:-fno-stack-protector} "
++#else
++#define NO_SSP_SPEC ""
++#endif
++
+ #ifndef LINK_SSP_SPEC
+ #ifdef TARGET_LIBC_PROVIDES_SSP
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+@@ -1295,7 +1301,7 @@ static const char *cc1_options =
+  %{-version:--version}\
+  %{-help=*:--help=%*}\
+  %{!fsyntax-only:%{S:%W{o*}%{!o*:-o %w%b.s}}}\
+- %{fsyntax-only:-o %j} %{-param*}\
++ %{fsyntax-only:-o %j} %{-param*} " NO_SSP_SPEC "\
+  %{coverage:-fprofile-arcs -ftest-coverage}\
+  %{fprofile-arcs|fprofile-generate*|coverage:\
+    %{!fprofile-update=single:\
+diff --git a/gcc/params.opt b/gcc/params.opt
+index b88e1372005..82a7e25dd2f 100644
+--- a/gcc/params.opt
++++ b/gcc/params.opt
+@@ -1012,7 +1012,7 @@ Common Joined UInteger Var(param_ssa_name_def_chain_limit) Init(512) Param Optim
+ The maximum number of SSA_NAME assignments to follow in determining a value.
+ 
+ -param=ssp-buffer-size=
+-Common Joined UInteger Var(param_ssp_buffer_size) Init(8) IntegerRange(1, 65536) Param Optimization
++Common Joined UInteger Var(param_ssp_buffer_size) Init(4) IntegerRange(1, 65536) Param Optimization
+ The lower bound for a buffer to be considered for stack smashing protection.
+ 
+ -param=stack-clash-protection-guard-size=

cross/gcc-aarch64/0008-gcc-disable-SSP-on-ffreestanding-nostdlib-and-nodefa.patch

@@ -1,39 +0,0 @@
-From c355364231395090e7223ec00d8a16065903c2c5 Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@ariadne.space>
-Date: Fri, 25 Jul 2025 01:49:03 -0700
-Subject: [PATCH] gcc: disable SSP on -ffreestanding, -nostdlib and
- -nodefaultlibs
-
----
- gcc/gcc.cc | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/gcc/gcc.cc b/gcc/gcc.cc
-index fc9c7d15b04..7b0d3d2743b 100644
---- a/gcc/gcc.cc
-+++ b/gcc/gcc.cc
-@@ -1009,6 +1009,12 @@ proper position among the other output files.  */
- #define LINK_GCC_C_SEQUENCE_SPEC "%G %{!nolibc:%L %G}"
- #endif
- 
-+#ifdef ENABLE_DEFAULT_SSP
-+#define NO_SSP_SPEC "%{nostdlib|nodefaultlibs|ffreestanding:-fno-stack-protector} "
-+#else
-+#define NO_SSP_SPEC ""
-+#endif
-+
- #ifndef LINK_SSP_SPEC
- #ifdef TARGET_LIBC_PROVIDES_SSP
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
-@@ -1314,7 +1320,7 @@ static const char *cc1_options =
-  %{-version:--version}\
-  %{-help=*:--help=%*}\
-  %{!fsyntax-only:%{S:%W{o*}%{!o*:-o %w%b.s}}}\
-- %{fsyntax-only:-o %j} %{-param*}\
-+ %{fsyntax-only:-o %j} %{-param*} " NO_SSP_SPEC "\
-  %{coverage:-fprofile-arcs -ftest-coverage}\
-  %{fprofile-arcs|fcondition-coverage|fpath-coverage|fprofile-generate*|coverage:\
-    %{!fprofile-update=single:\
--- 
-2.50.1
-

cross/gcc-aarch64/0009-Ensure-that-msgfmt-doesn-t-encounter-problems-during.patch

@@ -0,0 +1,51 @@
+From 83bf2a316222e2fe0b72968cadf4e334d41173f6 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 21 Aug 2020 06:50:33 +0000
+Subject: [PATCH] Ensure that msgfmt doesn't encounter problems during gcc
+ bootstrapping.
+
+Solves error messages like the following:
+
+msgfmt: /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/./gcc/libgcc_s.so.1: version `GCC_4.2.0' not found (required by /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/libstdc++.so.6)
+
+The libgcc_s.so used during build doesn't satisfy the needs of the
+libstdc++.so that msgfmt is linked against. On the other hand, msgfmt
+is used as a stand-alone application here, and what library it uses
+behind the scenes is of no concern to the gcc build process.
+Therefore, simply invoking it "as usual", i.e. without any special
+library path, will make it work as expected here.
+
+2011-09-19 Martin von Gagern
+
+References:
+https://bugs.gentoo.org/372377
+https://bugs.gentoo.org/295480
+---
+ libstdc++-v3/po/Makefile.am | 1 +
+ libstdc++-v3/po/Makefile.in | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/libstdc++-v3/po/Makefile.am b/libstdc++-v3/po/Makefile.am
+index 8f51544989e..5329804d136 100644
+--- a/libstdc++-v3/po/Makefile.am
++++ b/libstdc++-v3/po/Makefile.am
+@@ -38,6 +38,7 @@ MSGFMT = msgfmt
+ EXTRA_DIST = string_literals.cc POTFILES.in $(PACKAGE).pot $(LOCALE_IN)
+ 
+ .po.mo:
++	env --unset=LD_LIBRARY_PATH \
+ 	$(MSGFMT) -o $@ $<
+ 
+ all-local: all-local-$(USE_NLS)
+diff --git a/libstdc++-v3/po/Makefile.in b/libstdc++-v3/po/Makefile.in
+index 243f3db7b72..822210781fa 100644
+--- a/libstdc++-v3/po/Makefile.in
++++ b/libstdc++-v3/po/Makefile.in
+@@ -561,6 +561,7 @@ uninstall-am:
+ 
+ 
+ .po.mo:
++	env --unset=LD_LIBRARY_PATH \
+ 	$(MSGFMT) -o $@ $<
+ 
+ all-local: all-local-$(USE_NLS)

cross/gcc-aarch64/0009-gcc-params-set-default-ssp-buffer-size-to-4.patch

@@ -1,25 +0,0 @@
-From 5f09842c19d6db976724cd117190a8a6951acf9b Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@ariadne.space>
-Date: Fri, 25 Jul 2025 01:50:42 -0700
-Subject: [PATCH] gcc: params: set default ssp-buffer-size to 4
-
----
- gcc/params.opt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gcc/params.opt b/gcc/params.opt
-index 64e453d29b7..bba3fd574f2 100644
---- a/gcc/params.opt
-+++ b/gcc/params.opt
-@@ -1064,7 +1064,7 @@ Common Joined UInteger Var(param_ssa_name_def_chain_limit) Init(512) Param Optim
- The maximum number of SSA_NAME assignments to follow in determining a value.
- 
- -param=ssp-buffer-size=
--Common Joined UInteger Var(param_ssp_buffer_size) Init(8) IntegerRange(1, 65536) Param Optimization
-+Common Joined UInteger Var(param_ssp_buffer_size) Init(4) IntegerRange(1, 65536) Param Optimization
- The lower bound for a buffer to be considered for stack smashing protection.
- 
- -param=stack-clash-protection-guard-size=
--- 
-2.50.1
-

cross/gcc-aarch64/0010-Don-t-declare-asprintf-if-defined-as-a-macro.patch

@@ -0,0 +1,25 @@
+From 190064993cd8ddbd48015c1fc1916e4110a97733 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 21 Aug 2020 06:52:07 +0000
+Subject: [PATCH] Don't declare asprintf if defined as a macro.
+
+---
+ include/libiberty.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/libiberty.h b/include/libiberty.h
+index a65ced9c820..eb20ab0f95f 100644
+--- a/include/libiberty.h
++++ b/include/libiberty.h
+@@ -652,8 +652,11 @@ extern void *bsearch_r (const void *, const void *,
+ /* Like sprintf but provides a pointer to malloc'd storage, which must
+    be freed by the caller.  */
+ 
++/* asprintf may be declared as a macro by glibc with __USE_FORTIFY_LEVEL.  */
++#ifndef asprintf
+ extern int asprintf (char **, const char *, ...) ATTRIBUTE_PRINTF_2;
+ #endif
++#endif
+ 
+ /* Like asprintf but allocates memory without fail. This works like
+    xmalloc.  */

cross/gcc-aarch64/0010-Ensure-that-msgfmt-doesn-t-encounter-problems-during.patch

@@ -1,54 +0,0 @@
-From ee0615536ae0d255f59070b904aa35d6de8fce49 Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@dereferenced.org>
-Date: Fri, 21 Aug 2020 06:50:33 +0000
-Subject: [PATCH] Ensure that msgfmt doesn't encounter problems during gcc
- bootstrapping.
-
-Solves error messages like the following:
-
-msgfmt: /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/./gcc/libgcc_s.so.1: version `GCC_4.2.0' not found (required by /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/libstdc++.so.6)
-
-The libgcc_s.so used during build doesn't satisfy the needs of the
-libstdc++.so that msgfmt is linked against. On the other hand, msgfmt
-is used as a stand-alone application here, and what library it uses
-behind the scenes is of no concern to the gcc build process.
-Therefore, simply invoking it "as usual", i.e. without any special
-library path, will make it work as expected here.
-
-2011-09-19 Martin von Gagern
-
-References:
-https://bugs.gentoo.org/372377
-https://bugs.gentoo.org/295480
----
- libstdc++-v3/po/Makefile.am | 1 +
- libstdc++-v3/po/Makefile.in | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/libstdc++-v3/po/Makefile.am b/libstdc++-v3/po/Makefile.am
-index 7f84a99533e..a4c6284f788 100644
---- a/libstdc++-v3/po/Makefile.am
-+++ b/libstdc++-v3/po/Makefile.am
-@@ -38,6 +38,7 @@ MSGFMT = msgfmt
- EXTRA_DIST = string_literals.cc POTFILES.in $(PACKAGE).pot $(LOCALE_IN)
- 
- .po.mo:
-+	env --unset=LD_LIBRARY_PATH \
- 	$(MSGFMT) -o $@ $<
- 
- all-local: all-local-$(USE_NLS)
-diff --git a/libstdc++-v3/po/Makefile.in b/libstdc++-v3/po/Makefile.in
-index 8e93445acd2..d6ff06e5ddb 100644
---- a/libstdc++-v3/po/Makefile.in
-+++ b/libstdc++-v3/po/Makefile.in
-@@ -561,6 +561,7 @@ uninstall-am:
- 
- 
- .po.mo:
-+	env --unset=LD_LIBRARY_PATH \
- 	$(MSGFMT) -o $@ $<
- 
- all-local: all-local-$(USE_NLS)
--- 
-2.50.1
-

cross/gcc-aarch64/0011-Don-t-declare-asprintf-if-defined-as-a-macro.patch

@@ -1,28 +0,0 @@
-From 62966418472466142a9962892177f4b1f9f56944 Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@dereferenced.org>
-Date: Fri, 21 Aug 2020 06:52:07 +0000
-Subject: [PATCH] Don't declare asprintf if defined as a macro.
-
----
- include/libiberty.h | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/include/libiberty.h b/include/libiberty.h
-index d4e8791b14b..c074980ed80 100644
---- a/include/libiberty.h
-+++ b/include/libiberty.h
-@@ -678,8 +678,11 @@ extern void *bsearch_r (const void *, const void *,
- /* Like sprintf but provides a pointer to malloc'd storage, which must
-    be freed by the caller.  */
- 
-+/* asprintf may be declared as a macro by glibc with __USE_FORTIFY_LEVEL.  */
-+#ifndef asprintf
- extern int asprintf (char **, const char *, ...) ATTRIBUTE_PRINTF_2;
- #endif
-+#endif
- 
- /* Like asprintf but allocates memory without fail. This works like
-    xmalloc.  */
--- 
-2.50.1
-

cross/gcc-aarch64/0011-libiberty-copy-PIC-objects-during-build-process.patch

@@ -0,0 +1,21 @@
+From 838e1daa955d9013c462be3471497cb39641e951 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 21 Aug 2020 06:53:00 +0000
+Subject: [PATCH] libiberty: copy PIC objects during build process
+
+---
+ libiberty/Makefile.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libiberty/Makefile.in b/libiberty/Makefile.in
+index 1b17c2e3a47..8db1176df2e 100644
+--- a/libiberty/Makefile.in
++++ b/libiberty/Makefile.in
+@@ -265,6 +265,7 @@ $(TARGETLIB): $(REQUIRED_OFILES) $(EXTRA_OFILES) $(LIBOBJS)
+ 	  $(AR) $(AR_FLAGS) $(TARGETLIB) \
+ 	    $(REQUIRED_OFILES) $(EXTRA_OFILES) $(LIBOBJS); \
+ 	  $(RANLIB) $(TARGETLIB); \
++	  cp $(TARGETLIB) ../ ; \
+ 	  cd ..; \
+ 	else true; fi
+ 

cross/gcc-aarch64/0012-libiberty-copy-PIC-objects-during-build-process.patch

@@ -1,24 +0,0 @@
-From 0351f4f3dd00bdece780ce5e24d972e97ca1b7ed Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@dereferenced.org>
-Date: Fri, 21 Aug 2020 06:53:00 +0000
-Subject: [PATCH] libiberty: copy PIC objects during build process
-
----
- libiberty/Makefile.in | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libiberty/Makefile.in b/libiberty/Makefile.in
-index ce54d88278d..10c212a1ad3 100644
---- a/libiberty/Makefile.in
-+++ b/libiberty/Makefile.in
-@@ -266,6 +266,7 @@ $(TARGETLIB): $(REQUIRED_OFILES) $(EXTRA_OFILES) $(LIBOBJS)
- 	  $(AR) $(AR_FLAGS) $(TARGETLIB) \
- 	    $(REQUIRED_OFILES) $(EXTRA_OFILES) $(LIBOBJS); \
- 	  $(RANLIB) $(TARGETLIB); \
-+	  cp $(TARGETLIB) ../ ; \
- 	  cd ..; \
- 	else true; fi
- 
--- 
-2.50.1
-