Deterministic kernel build scripts, for Linux, mainly for Debian for now.
This scripts will build kernel in deterministic way, and also apply our default settings and patches.
It will also use Grsecurity patch to create secure hardened grsecurity/pax kernel (optional).
See doc/build.txt
As end user who just wishes to run a Grsecurity kernel on Debian, see http://deb.mempo.org (check the GPG key as given below).
Path and root of trust is following: 1)
- we own https://github.com/mempo/
- we own mempo.org [site is still being moved to new server, sorry]
- it is known that user is one of main developers, available on IRC, reddit, darknets
- on this sites, and/or with rfree, you can confirm our main GPG keys:
- 33D3 8C87 97A7 A35E D8BC AF1F 4EBE 40EA EFF6 2C7F - key rfree, medium
- 21A5 9D31 7421 F02E C3C3 81F3 4623 E8F7 4595 3F23 - key rfree-mempo, medium
- this PGP keys sign git commits of the sources of this project
- this PGP keys sign also the debian repository
they also sign this file here, that says that binary repository is available:
- on https://deb.mempo.org [site moved]
- on Freenet page (that you can open by installing and running special open-source program "Freenet") on address: http://127.0.0.1:8888/USK@oRy7ltZLJM-w-kcOBdiZS1pAA8P-BxZ3BPiiqkmfk0E,6a1KFG6S-Bwp6E-MplW52iH~Y3La6GigQVQDeMjI6rg,AQACAAE/deb.mempo.org/54/
- you can trust things on the Freenet page, because the sites are alaways fully signed
- This README.md file that you read here now, should itself also be signed (e.g. in file README.md.asc)
READ FILE security.txt here for list of known existing and past problems.
When using git, then:
You should verify data with both github.com by https/SSL or SSH downloads and you should check git tag -v tagname e.g.: git tag -v v0.1.26-rc3 to see if tag is signed by: pgp key 45953F23 rfree-mempo, pubkey here in doc/
= = = = = = = = = = = = = = = List of PGP keys and their security levels: 33D3 8C87 97A7 A35E D8BC AF1F 4EBE 40EA EFF6 2C7F - key rfree, medium 21A5 9D31 7421 F02E C3C3 81F3 4623 E8F7 4595 3F23 - key rfree-mempo, medium
key rfree is for preparing work for Mempo (and for many other FOSS projects) key rfree-mempo is for more finall signature after some review, for Mempo
The security levels like "medium" are defined in IFCCS_00003_1::medium etc, see https://ifccs.org/ifccs00003_1 (or mirror on http://mempo.org/#IFCCS_00003_1)
You can confirm this keys with: https://github.org/mempo/ (registered Nov 2013) http://mempo.org , http://mempo.i2p , http://www.mempo.i2p/ https://wiki.debian.org/Mempo#pgp (but more people can edit Wiki) IRC history, Freenet FMS chat history. to assert that this PGP keys in fact are historically authorized as the established "Mempo" project and as user "rfree". = = = = = = = = = = = = = = =
Bitcoin address is: 152fnfBqRjVMDvRa5LQ2upx9tJAeHnyqHC
- See the Bitcoin address above, any amount counts even 1$
- Using this software
- Hanging around #mempo in IRC
First of, read the details in doc/build.txt and rest of doc/ folder!
Maintainers of this project should do following in reaction to new version of codes:
linux-image-3.2.54-grsec-mempo.good.0.1.21_01_amd64.deb
VVVVVV LLLL MMMMMM RR AAAAA
V.V.V - vanilla kernel
M.M.M - version of Mempo, increased with grsecurity updates; usullay with other config
RR - release. for now is set to -RC (and 50 for finall)
LLLLL - level of security (will be option in future)
AAAAA - architecture (will be option in future)
When releasing new tag (RR)
- changelog
DEBIAN_REVISION="X"in env.sh
When incresing Mempo (M.M.M)
- changelog
- reset RR=0 as written above
- linux-mempo/configs/(every).config - write the proper version in
CONFIG_LOCALVERSION - change CURRENT_SEED in env.sh
When upstream grsecurity/patches change, then update:
- changelog
- sourcecode.list - the checksum and file name of patch
- linux-mempo/env.sh -
KERNEL_DATE - increase M.M.M as written above
When new upstream vanilla kernel (V.V.V)
- changelog
- sourcecode.list - the checksum and file name of kernel
- linux-mempo/env.sh -
kernel_general_versionandKERNEL_DATE - increase M.M.M