Conversation
sha256sum --check's checksum-file parsing differs across coreutils implementations: Rust/uutils coreutils rejects our tab-separated sha256sum.txt format that GNU coreutils accepts fine. Rather than change the on-disk format (which would break byte-for-byte reproducibility against already-published release tarballs), verify each entry directly with a portable read/sha256sum loop. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New self-contained v2.15.1 point release directory, following the v2.14.1 precedent: existing platforms (arl, arl-s, lnl, mtl, nvl, nvl-s, ptl, wcl) are copied forward unchanged, plus a new mtl-s platform with its Intel-signed firmware binary. No community-signed mtl-s binary yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Arrow Lake S and Meteor Lake S share the same ACE 1.5 DSP, same as the existing arl -> mtl aliasing. arl-s/intel-signed was left empty when mtl-s was added in 1ac4f41; symlink it to mtl-s instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Nothing previously checked that when a platform's firmware is re-shipped in a later point release, it's still signed with the same Intel key as before. Extend validate_sof_install.py (both the local and remote/SSH manifest parsers) to extract a sha256 fingerprint of the CSS manifest's RSA modulus, and add a --compare-signing-keys PREV_DIR CURR_DIR mode that diffs .ri/.llext signing keys between two version directories: files only on one side are informational (new platform), a key mismatch on a shared path is an error. Wire this into a new tests/key_continuity.bats that dynamically discovers every consecutive point-release pair under sof-ipc4-v* and sof-ipc4-lib-v*, and a dedicated .github/workflows/key-continuity.yml (no sibling sof checkout or tag fetch needed, unlike BATS.yml). Scoped to the modern IPC4 layout only: the legacy pre-IPC4 sof-vX.Y tree had genuine historical key rotations (jsl, ehl), so a full-history check there would need a from-day-one exception list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
kv2019i
reviewed
Sep 18, 2026
kv2019i
left a comment
kv2019i
left a comment
Collaborator
There was a problem hiding this comment.
This is somehow mixed, there is no 2.15.1 release. Source release is same, this is a dot release of the binary package.
| @@ -0,0 +1 @@ | |||
| ../../mtl/community/sof-mtl.ri No newline at end of file | |||
Collaborator
There was a problem hiding this comment.
This is not 2.15.1 release! This is still binary for v2.15 SOF release. It is a point release of sof-bin-v2026.09.1 that has missing binaries.
Btw: you should have your own signed-off as well in the commits
kv2019i
reviewed
Sep 18, 2026
kv2019i
left a comment
kv2019i
left a comment
Collaborator
There was a problem hiding this comment.
Added test and sha256 fix looks good. Some issues with the binaries, not aligning to previous releases.
| @@ -0,0 +1 @@ | |||
| intel-signed/sof-mtl.ri No newline at end of file | |||
Collaborator
There was a problem hiding this comment.
This is same as v2.15/mtl/intel-signed/sof-mtl.ri (not needed here)
| @@ -0,0 +1 @@ | |||
| intel-signed/sof-mtl-s.ri No newline at end of file | |||
Collaborator
There was a problem hiding this comment.
We have never released this firmware, all previous releases have "arl-s" only and none of our build scripts support sof-mtl-s.ri.
|
|
||
| jobs: | ||
| testjob: | ||
| runs-on: ubuntu-22.04 |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sha256sum --checkportability issue in tarball_multi_releases.bash's checksum verification (some coreutils implementations reject our tab-separated checksum file format); verify each entry directly instead.--compare-signing-keys PREV_DIR CURR_DIRto diff signing-key identity between two version directories. Wired into a new tests/key_continuity.bats that dynamically discovers every consecutive point-release pair, and a dedicated.github/workflows/key-continuity.yml.Test plan
bats tests/*.bats— all 21 tests pass, including the newsigning key continuitytests--compare-signing-keyscorrectly flags a known historical key rotation (legacy jsl v1.9 -> v1.9.2) and exits 1--compare-signing-keys v2.15 v2.15.1passes with mtl-s/arl-s reported as new-in-release (informational), exit 0compare_signed_unsigned.pyreports arl-s as matching mtl-s at the module levelshellcheck -e SC3043clean on the new bats file and the existing glob🤖 Generated with Claude Code