Use backup locations for kernel downloads:

It happened that today the latest point releases
for the 5.x and 6.x kernels were in the https://www.kernel.org/releases.json
but not in corresponding sha256sum.asc file,
https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc for example.
Interestingly enough, the kernels were in
https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc.
The difference being https://www.kernel.org vs https://cdn.kernel.org.
This new script will try against www.kernel.org and fall back
to cdn.kernel.org.

Signed-off-by: Jacob Weinstock <[email protected]>

Author: jacobweinstock

kernel/Dockerfile

@@ -12,23 +12,17 @@ ARG KERNEL_VERSION
 ARG KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/linux-${KERNEL_VERSION}.tar.xz
 ARG KERNEL_SHA256_SUMS=https://www.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/sha256sums.asc
 ARG KERNEL_PGP2_SIGN=https://www.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/linux-${KERNEL_VERSION}.tar.sign
+# Backup URLs in case the main ones are down or point releases are not available yet.
+ARG KERNEL_SOURCE_BACKUP=https://cdn.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/linux-${KERNEL_VERSION}.tar.xz
+ARG KERNEL_SHA256_SUMS_BACKUP=https://cdn.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/sha256sums.asc
+ARG KERNEL_PGP2_SIGN_BACKUP=https://cdn.kernel.org/pub/linux/kernel/${KERNEL_MAJOR_V}/linux-${KERNEL_VERSION}.tar.sign
 
 # PGP keys: 589DA6B1 ([email protected]) & 6092693E ([email protected]) & 00411886 ([email protected])
 COPY /keys.asc /keys.asc
 
 # Download and verify kernel
-RUN set -x &&  \
-    curl -fsSLO ${KERNEL_SHA256_SUMS} && \
-    gpg2 -q --import keys.asc && \
-    gpg2 --verify sha256sums.asc && \
-    KERNEL_SHA256=$(grep linux-${KERNEL_VERSION}.tar.xz sha256sums.asc | cut -d ' ' -f 1) && \
-    [ -f linux-${KERNEL_VERSION}.tar.xz ] || curl -fsSLO ${KERNEL_SOURCE} && \
-    echo "${KERNEL_SHA256}  linux-${KERNEL_VERSION}.tar.xz" | sha256sum -c - && \
-    xz -T 0 -d linux-${KERNEL_VERSION}.tar.xz && \
-    curl -fsSLO ${KERNEL_PGP2_SIGN} && \
-    gpg2 --verify linux-${KERNEL_VERSION}.tar.sign linux-${KERNEL_VERSION}.tar && \
-    cat linux-${KERNEL_VERSION}.tar | tar --absolute-names -x && mv /linux-${KERNEL_VERSION} /linux
-
+COPY download.sh /download.sh
+RUN /download.sh ${KERNEL_VERSION} ${KERNEL_SOURCE} ${KERNEL_SHA256_SUMS} ${KERNEL_PGP2_SIGN} ${KERNEL_SOURCE_BACKUP} ${KERNEL_SHA256_SUMS_BACKUP} ${KERNEL_PGP2_SIGN_BACKUP}
 
 FROM kernel-source-unpacked AS kernel-with-config
 

kernel/download.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+# This script downloads the Linux kernel source code and verifies it using GPG.
+
+function verify() {
+    local kernel_sha256_sums="$1"
+    local kernel_version="$2"
+    local kernel_source="$3"
+    local kernel_pgp2_sign="$4"
+
+    curl -fsSL ${kernel_sha256_sums} -o sha256sums.asc
+    [ -f linux-${kernel_version}.tar.xz ] || curl -fsSLO ${kernel_source}
+    gpg2 -q --import keys.asc
+    gpg2 --verify sha256sums.asc
+    KERNEL_SHA256=$(grep linux-${kernel_version}.tar.xz sha256sums.asc | cut -d ' ' -f 1)
+    echo "${KERNEL_SHA256}  linux-${kernel_version}.tar.xz" | sha256sum -c -
+    if [ $? -ne 0 ]; then
+        return 1
+    fi
+    # Verify the signature of the kernel source
+    [ -f linux-${kernel_version}.tar ] || xz -T 0 -d linux-${kernel_version}.tar.xz
+    curl -fsSLO ${kernel_pgp2_sign}
+    gpg2 --verify linux-${kernel_version}.tar.sign linux-${kernel_version}.tar
+    if [ $? -ne 0 ]; then
+        return 1
+    fi
+}
+
+function extract() {
+    local kernel_version="$1"
+
+    if [ -d linux-${kernel_version} ]; then
+        echo "Directory linux-${kernel_version} already exists, skipping extraction."
+    else
+        tar --absolute-names -xf linux-${kernel_version}.tar
+        rm -rf ./linux
+        mv ./linux-${kernel_version} ./linux
+    fi
+}
+
+# Main script execution
+function main() {
+    local kernel_version="$1"
+    local kernel_source="$2"
+    local kernel_sha256_sums="$3"
+    local kernel_pgp2_sign="$4"
+    local kernel_source_backup="$5"
+    local kernel_sha256_sums_backup="$6"
+    local kernel_pgp2_sign_backup="$7"
+
+    verify "${kernel_sha256_sums}" "${kernel_version}" "${kernel_source}" "${kernel_pgp2_sign}" || \
+    verify "${kernel_sha256_sums_backup}" "${kernel_version}" "${kernel_source_backup}" "${kernel_pgp2_sign_backup}"
+
+    extract "${kernel_version}"
+}
+
+main "$@"