October kernel update

[zenmonkeykstop]

Checklist

• Source tarball saved internally (instructions)
• Logs and build info uploaded to build-logs
• server and workstation kernels uploaded to apt-test.freedom.press - see Add 5.15.135 server and workstation grsec kernels securedrop-apt-test#204
• Tested on recommended hardware (see below)
• Uploaded to apt.freedom.press and released

Testing matrix

Instructions on testing procedure
Make sure you're using the latest version of the spectre-meltdown-checker.

Server:

To update to the new kernel, please use sudo apt-get update && sudo unattended-upgrades -d (not sudo apt-get upgrade) OR wait 24h for the automatic update to happen.

Workstation:

To update to the new kernel, run updater on a staging build.

H/W testing:

• VMs: @zenmonkeykstop
• NUC12: @nathandyer
• NUC11: @legoktm
• NUC10: @legoktm
• NUC8: @zenmonkeykstop
• NUC7:
• Workstation: @zenmonkeykstop

[zenmonkeykstop]

Currently blocked on failing kernel builds, see freedomofpress/kernel-builder#40

[zenmonkeykstop]

Unblocked again by new grsecurity patch. Ready for apt-test and hardware testing.

[legoktm]

NUC11 is ✔️ , NUC10 is also good, just noting that I ran into the same checker false positive as last time: #6938 (comment).

[nathandyer]

NUC12 is also ✔️

• uname -r: 5.15.135-1-grsec-securedrop
• sudo paxtest blackhat output OK
• spectre-meltdown-checker output OK
• Basic smoke tests