From fbfabbfdf2093bb7ff784dfb16a1c280ceb77e00 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 10 Jun 2026 19:14:12 +0300 Subject: [PATCH] chore(cilium): verify BPF patch applies during make update The image build already fails on patch drift, but only when the image is built. Check the patch against the freshly vendored upstream tag inside make update as well, so the author of a cilium version bump sees the drift immediately instead of at the next image build. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/Makefile | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 82228b44c..fa90cf568 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -23,6 +23,18 @@ update: { echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; } version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ $(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile + # Verify the IPv6-passthrough BPF patch still applies to the new upstream tag, + # so the bump author learns about drift immediately instead of at image build. + version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ + tmpdir=$$(mktemp -d) && \ + { curl --fail --silent --show-error --location \ + "https://raw.githubusercontent.com/cilium/cilium/v$${version}/bpf/bpf_host.c" \ + -o "$$tmpdir/bpf_host.c" || { rm -rf "$$tmpdir"; exit 1; }; } && \ + { patch --dry-run --batch --forward --fuzz=0 -p1 -d "$$tmpdir" \ + < images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff || \ + { echo "ERROR: images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff no longer applies to upstream bpf/bpf_host.c v$${version}; regenerate it for the new cilium version" >&2; \ + rm -rf "$$tmpdir"; exit 1; }; } && \ + rm -rf "$$tmpdir" image: docker buildx build images/cilium \