fix: update manifests for kernel-headers 6.6.139.1-2 after release bump#17367
Draft
Copilot wants to merge 4 commits into
Draft
fix: update manifests for kernel-headers 6.6.139.1-2 after release bump#17367Copilot wants to merge 4 commits into
Copilot wants to merge 4 commits into
Conversation
microsoft-github-policy-service
Bot
added
security
3.0-dev
The x86_64 kernel config has had CONFIG_RDS disabled since 5.4.23-11 (May 2020), but the aarch64 config retained CONFIG_RDS=m, CONFIG_RDS_TCP=m, and CONFIG_RDS_RDMA=m. This was an oversight in the original change which predated full aarch64 support in CBL-Mariner, and has persisted across every kernel rebase since. Align aarch64 with x86_64. RDS (Oracle Reliable Datagram Sockets) has no expected use in Azure Linux guest workloads, and recent CVEs in the RDS zerocopy send path (e.g. PinTheft LPE disclosed 2026-05-19) reinforce that the protocol should not be reachable on hosts that don't need it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: dethoma <11412958+dethoma@users.noreply.github.com>
Agent-Logs-Url: https://github.com/microsoft/azurelinux/sessions/3248fcc9-0a83-4171-ab2c-16d383ac50e4 Co-authored-by: dethoma <11412958+dethoma@users.noreply.github.com>
The kernel.spec Release was bumped from 1 to 2 (for RDS config change on aarch64) and the entanglement check required kernel-headers.spec to be bumped to Release 2 as well. However, the toolchain and pkggen manifests were not updated to reference the new kernel-headers-6.6.139.1-2.azl3.noarch.rpm RPM names. Update all four manifest files: - toolkit/resources/manifests/package/toolchain_x86_64.txt - toolkit/resources/manifests/package/toolchain_aarch64.txt - toolkit/resources/manifests/package/pkggen_core_x86_64.txt - toolkit/resources/manifests/package/pkggen_core_aarch64.txt to replace kernel-headers-6.6.139.1-1.azl3 → kernel-headers-6.6.139.1-2.azl3 and kernel-cross-headers-6.6.139.1-1.azl3 → kernel-cross-headers-6.6.139.1-2.azl3. Agent-Logs-Url: https://github.com/microsoft/azurelinux/sessions/559043db-bb88-48a8-baf4-5b4b6b0a607a Co-authored-by: dethoma <11412958+dethoma@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix failing GitHub Actions job 'Check Manifests'
fix: update manifests for kernel-headers 6.6.139.1-2 after release bump
May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kernel.specRelease was bumped 1→2 (disable CONFIG_RDS on aarch64), requiringkernel-headers.specto match for the Spec Entanglement check — but the four toolchain/pkggen manifest files were left referencing the old-1.azl3NVRs, breaking the Check Manifests CI job.Merge Checklist
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
Carries forward the kernel RDS aarch64 config change and release alignment, and fixes the missing manifest update that caused the Check Manifests CI failure.
Change Log
kernel: disableCONFIG_RDS,CONFIG_RDS_TCP,CONFIG_RDS_RDMAon aarch64 to match x86_64 (oversight since 5.4.23-11 / 2020)kernel,kernel-64k,kernel-uki,kernel-headers, and signed variants: Release1→2toolkit/resources/manifests/package/toolchain_x86_64.txt:kernel-cross-headersandkernel-headersNVR6.6.139.1-1.azl3→6.6.139.1-2.azl3toolkit/resources/manifests/package/toolchain_aarch64.txt:kernel-headersNVR6.6.139.1-1.azl3→6.6.139.1-2.azl3toolkit/resources/manifests/package/pkggen_core_x86_64.txt: sametoolkit/resources/manifests/package/pkggen_core_aarch64.txt: sameDoes this affect the toolchain?
YES —
kernel-headersandkernel-cross-headersare in the toolchain manifest; manifests updated accordingly.Test Methodology
toolkit/scripts/toolchain/check_manifests.sh -a x86_64→ passtoolkit/scripts/toolchain/check_manifests.sh -a aarch64→ pass