Hello there,
I'm Werner from TUXEDO Computers and my colleague Max and I got to talk to
Mechthilde at FrOSCon this weekend, who strongly advised me to to write the
kernel team. I hope I found the right mailing list.
As you might already know: TUXEDO wants to use Debian as the base for our TUXEDO
OS distro in the near future. Max did a Talk at FrOSCon explaining it in detail
(sadly only in German):
https://programm.froscon.org/froscon2026/talk/f467703e-39ea-41e0-bd66-f98efe4375d1/
I'm tasked with building packing the kernel.
To have full support for the newest devices we are selling, we currently need
the newest Kernel 7.1.x + 2 Patches that are currently not upstream and TBH are
somewhat dirty fixes that need more attention before they can go upstream.
Besides my best efforts to upstream as soon as possible, this situation will
always occur from time to time, so there is no way around it for us to build our
own kernel fork where we can apply patches on our own.
My current effort to do this is based on the readme files in the Debian Linux
repo and analyzing the config directory in there to build a "-tuxedo" featureset
alongside the "-cloud" and "-rt" one with the patches added in there:
https://gitlab.com/tuxedocomputers/development/packages/linux/-/tree/tuxedo-debian?ref_type=heads
(relevant part is the patches-tuxedo folder and the new featureset in the
defines.toml in the config folder)
But I'm not quite happy with the result yet:
- When I build this, I also always build the other featuresets including base
featureset, which
- are then also included in the dsc and source tar and
- when I want to sign it for secure boot i also have to install these other
featuresets and can not just sign the "-tuxedo" one.
- To sign the kernel with our self signed secure boot key (we not yet have our
own shim bootloader, so we are using the MOK function of shim to include our
self signed certificate) I patched USB-stick HSM support in the debian-test-sign
script from the kernel-team repo.
I hope you could help me to find a recommended more "Debian way" to do all of
this:
- How to I best add a new featureset with new patches ans slightly altered
config and
- only build that to be installed alongside the not rebuild base, -rt, and
-cloud featuresets.
- How do I properly sign that kernel using a HSM USB-stick?
- How can I best contribute back to Debian besides pushing TUXEDO developed
patches as soon as possible to upstream so that all distros including Debian
gain easy and automatic access to them?
Best regards
Werner
