Regenerate talos patch for v1.12.3

Patch was stale — regenerated from the working checkout to match
the v1.12.3 hack/modules-arm64.txt index.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -28,6 +28,13 @@ jobs:
       - name: Verify Docker is running
         run: docker info
 
+      - name: Install build dependencies
+        run: |
+          for pkg in make gnu-sed crane; do
+            brew list --formula "$pkg" &>/dev/null || brew install "$pkg"
+          done
+          gmake --version | head -1
+
       - name: Set up Docker Buildx
         run: |
           docker buildx version
@@ -42,22 +49,25 @@ jobs:
         run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
       - name: Clone upstream sources
-        run: make checkouts
+        run: gmake checkouts
 
       - name: Apply patches
-        run: make patches
+        run: gmake patches
 
       - name: Build kernel
-        run: make kernel
+        run: gmake kernel
 
       - name: Build SBC overlay
-        run: make overlay
+        run: gmake overlay
 
       - name: Build installer and disk image
-        run: make installer
+        run: gmake installer
 
       - name: Tag release images
-        run: make release TAG=${{ steps.version.outputs.tag }}
+        run: gmake release TAG=${{ steps.version.outputs.tag }}
+
+      - name: Run Docker Scout CVE scan
+        run: gmake scout
 
       - name: Compress disk image
         run: |
@@ -81,21 +91,38 @@ jobs:
           REPO="${GITHUB_REPOSITORY}"
           API="${GITEA_URL}/api/v1"
 
-          # Create release
+          SCOUT_SECTION=""
+          if [ -f _out/scout-report.md ]; then
+            SCOUT_SECTION=$(cat _out/scout-report.md)
+          fi
+
+          RELEASE_BODY="Custom Talos Linux image for Raspberry Pi 5 / CM5 (Compute Blade)
+
+          **Talos version**: ${TAG}
+          **Kernel**: RPi downstream (CM5/RP1 support)
+          **Extensions**: iscsi-tools, util-linux-tools
+          **Overclock**: 2.6GHz (arm_freq=2600)
+
+          ## Artifacts
+          - \`metal-arm64.raw.zst\` — Raw disk image for eMMC flashing
+          - \`docker.io/svrnty/talos-rpi5:${TAG}\` — Installer image for talosctl upgrade
+
+          ## Security Scan
+          ${SCOUT_SECTION}"
+
+          # Strip leading whitespace from heredoc-style indentation
+          RELEASE_BODY=$(echo "$RELEASE_BODY" | sed 's/^          //')
+
+          RELEASE_BODY_JSON=$(jq -Rs '.' <<< "$RELEASE_BODY")
+
           RELEASE_ID=$(curl -sf -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
-            -d "{
-              \"tag_name\": \"${TAG}\",
-              \"name\": \"Talos RPi5 ${TAG}\",
-              \"body\": \"Custom Talos Linux image for Raspberry Pi 5 / CM5 (Compute Blade)\n\n**Talos version**: ${TAG}\n**Kernel**: RPi downstream (CM5/RP1 support)\n**Extensions**: iscsi-tools, util-linux-tools\n**Overclock**: 2.6GHz (arm_freq=2600)\n\n## Artifacts\n- \`metal-arm64.raw.zst\` — Raw disk image for eMMC flashing\n- \`docker.io/svrnty/talos-rpi5:${TAG}\` — Installer image for talosctl upgrade\",
-              \"prerelease\": true
-            }" \
+            -d "{\"tag_name\":\"${TAG}\",\"name\":\"Talos RPi5 ${TAG}\",\"body\":${RELEASE_BODY_JSON},\"prerelease\":true}" \
             "${API}/repos/${REPO}/releases" | jq -r '.id')
 
           echo "Created release ID: ${RELEASE_ID}"
 
-          # Upload disk image
           curl -sf -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -F "attachment=@metal-arm64.raw.zst" \
@@ -105,4 +132,4 @@ jobs:
 
       - name: Clean up
         if: always()
-        run: make clean
+        run: gmake clean

Makefile

@@ -8,17 +8,27 @@
 #   make kernel              # Build RPi kernel (~15-30 min on ARM64)
 #   make overlay             # Build U-Boot + firmware + DTBs
 #   make installer           # Build installer image + raw disk image
-#   make release             # Tag images for release
+#   make release             # Tag and push release images
+#   make clean               # Remove checkouts and build artifacts
 
 PKG_VERSION = v1.12.0
 TALOS_VERSION = v1.12.3
 SBCOVERLAY_VERSION = main
 
+# Prefer GNU coreutils (macOS: brew install gnu-sed coreutils)
+export PATH := /opt/homebrew/opt/gnu-sed/libexec/gnubin:$(PATH)
+
 REGISTRY ?= docker.io
 REGISTRY_USERNAME ?= svrnty
 
 TAG ?= $(shell git describe --tags --exact-match 2>/dev/null || echo dev)
 
+# Docker Hub image names (project-specific)
+KERNEL_IMAGE = $(REGISTRY)/$(REGISTRY_USERNAME)/talos-rpi5-kernel
+OVERLAY_IMAGE = $(REGISTRY)/$(REGISTRY_USERNAME)/talos-rpi5-overlay
+IMAGER_IMAGE = $(REGISTRY)/$(REGISTRY_USERNAME)/talos-rpi5-imager
+INSTALLER_IMAGE = $(REGISTRY)/$(REGISTRY_USERNAME)/talos-rpi5-installer
+
 # Public image name on Docker Hub (used by talosctl upgrade)
 IMAGE_NAME ?= talos-rpi5
 
@@ -40,6 +50,13 @@ SBCOVERLAY_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5 && git descr
 # Build the --system-extension-image flags from the EXTENSIONS list
 EXTENSION_FLAGS = $(foreach ext,$(EXTENSIONS),--system-extension-image=$(ext))
 
+# Common imager flags for overlay and extensions
+IMAGER_COMMON_FLAGS = \
+	--overlay-name="rpi5" \
+	--overlay-image="$(OVERLAY_IMAGE):$(SBCOVERLAY_TAG)" \
+	--overlay-option="configTxtAppend=$$(cat $(PWD)/config/config.txt.append)" \
+	$(EXTENSION_FLAGS)
+
 #
 # Help
 #
@@ -54,6 +71,7 @@ help:
 	@echo "  overlay    — Build SBC overlay (U-Boot, firmware, DTBs)"
 	@echo "  installer  — Build Talos installer image + raw disk image"
 	@echo "  release    — Tag and push release images"
+	@echo "  scout      — Run Docker Scout CVE scan on all images"
 	@echo "  clean      — Remove checkouts and build artifacts"
 	@echo ""
 	@echo "Variables:"
@@ -61,6 +79,12 @@ help:
 	@echo "  PKG_VERSION         = $(PKG_VERSION)"
 	@echo "  REGISTRY            = $(REGISTRY)"
 	@echo "  REGISTRY_USERNAME   = $(REGISTRY_USERNAME)"
+	@echo ""
+	@echo "Images:"
+	@echo "  KERNEL_IMAGE        = $(KERNEL_IMAGE)"
+	@echo "  OVERLAY_IMAGE       = $(OVERLAY_IMAGE)"
+	@echo "  IMAGER_IMAGE        = $(IMAGER_IMAGE)"
+	@echo "  INSTALLER_IMAGE     = $(INSTALLER_IMAGE)"
 
 #
 # Checkouts
@@ -91,63 +115,116 @@ patches-talos:
 patches: patches-pkgs patches-talos
 
 #
-# Kernel
+# Kernel — build and push the RPi downstream kernel
 #
 .PHONY: kernel
 kernel:
 	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
-		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
-			PLATFORM=linux/arm64 \
-			kernel
+		$(MAKE) docker-kernel \
+			TARGET_ARGS="--tag=$(KERNEL_IMAGE):$(PKGS_TAG) --push=true" \
+			PLATFORM=linux/arm64
 
 #
-# Overlay
+# Overlay — build U-Boot + firmware + DTBs
+#
+# The overlay's pkg.yaml references the kernel as PKGS_PREFIX/kernel:PKGS.
+# We rewrite it to point to our project-specific kernel image name.
 #
 .PHONY: overlay
 overlay:
 	@echo "SBCOVERLAY_TAG = $(SBCOVERLAY_TAG)"
+	@sed -i.bak 's|{{ .BUILD_ARG_PKGS_PREFIX }}/kernel:{{ .BUILD_ARG_PKGS }}|$(KERNEL_IMAGE):$(PKGS_TAG)|' \
+		"$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5/internal/base/pkg.yaml" && \
+		rm -f "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5/internal/base/pkg.yaml.bak"
 	cd "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5" && \
-		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) IMAGE_TAG=$(SBCOVERLAY_TAG) PUSH=true \
-			PKGS_PREFIX=$(REGISTRY)/$(REGISTRY_USERNAME) PKGS=$(PKGS_TAG) \
-			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
-			sbc-raspberrypi5
+		$(MAKE) docker-sbc-raspberrypi5 \
+			TARGET_ARGS="--tag=$(OVERLAY_IMAGE):$(SBCOVERLAY_TAG) --push=true" \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64
 
 #
 # Installer / Disk Image
 #
+# Builds the imager, installer-base, and installer images step by step,
+# pushing each to our project-specific Docker Hub repos.
+#
 .PHONY: installer
 installer:
 	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
 		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
-			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) \
+			PKG_KERNEL=$(KERNEL_IMAGE):$(PKGS_TAG) \
 			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
-			IMAGER_ARGS="--overlay-name=rpi5 --overlay-image=$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG) $(EXTENSION_FLAGS)" \
-			kernel initramfs imager installer-base installer && \
+			kernel initramfs && \
+		$(MAKE) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) \
+			PKG_KERNEL=$(KERNEL_IMAGE):$(PKGS_TAG) \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
+			target-imager \
+			TARGET_ARGS="--output type=image,name=$(IMAGER_IMAGE):$(TALOS_TAG),push=true" && \
+		$(MAKE) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) \
+			PKG_KERNEL=$(KERNEL_IMAGE):$(PKGS_TAG) \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
+			target-installer-base \
+			TARGET_ARGS="--output type=image,name=$(INSTALLER_IMAGE):base-$(TALOS_TAG),push=true" && \
+		docker pull $(IMAGER_IMAGE):$(TALOS_TAG) && \
+		docker run --rm -t -v ./_out:/out --privileged --network=host \
+			$(IMAGER_IMAGE):$(TALOS_TAG) \
+			installer --arch arm64 \
+			--base-installer-image="$(INSTALLER_IMAGE):base-$(TALOS_TAG)" \
+			$(IMAGER_COMMON_FLAGS) && \
+		crane push ./_out/installer-arm64.tar $(INSTALLER_IMAGE):$(TALOS_TAG) && \
 		docker \
 			run --rm -t -v ./_out:/out -v /dev:/dev --privileged \
-			$(REGISTRY)/$(REGISTRY_USERNAME)/imager:$(TALOS_TAG) \
+			$(IMAGER_IMAGE):$(TALOS_TAG) \
 			metal --arch arm64 \
-			--base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG)" \
-			--overlay-name="rpi5" \
-			--overlay-image="$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG)" \
-			--overlay-option="configTxtAppend=$$(cat $(PWD)/config/config.txt.append)" \
-			$(EXTENSION_FLAGS)
+			--base-installer-image="$(INSTALLER_IMAGE):$(TALOS_TAG)" \
+			$(IMAGER_COMMON_FLAGS)
 
 #
 # Release — tag images with the Git tag for stable references
 #
 .PHONY: release
 release:
-	docker pull $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG) && \
-		docker tag $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG) $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG) && \
+	docker pull $(INSTALLER_IMAGE):$(TALOS_TAG) && \
+		docker tag $(INSTALLER_IMAGE):$(TALOS_TAG) $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG) && \
 		docker push $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG)
 
+#
+# Scout — Docker Scout CVE scan on all pushed images
+#
+SCOUT_REPORT := _out/scout-report.md
+SCOUT_IMAGES := \
+	$(KERNEL_IMAGE):$(PKGS_TAG) \
+	$(OVERLAY_IMAGE):$(SBCOVERLAY_TAG) \
+	$(IMAGER_IMAGE):$(TALOS_TAG) \
+	$(INSTALLER_IMAGE):base-$(TALOS_TAG) \
+	$(INSTALLER_IMAGE):$(TALOS_TAG)
+
+.PHONY: scout
+scout:
+	@mkdir -p _out
+	@if ! docker scout version >/dev/null 2>&1; then \
+		echo "Docker Scout not available -- skipping CVE scan." > $(SCOUT_REPORT); \
+		exit 0; \
+	fi
+	@echo "# Docker Scout CVE Summary" > $(SCOUT_REPORT)
+	@echo "" >> $(SCOUT_REPORT)
+	@for image in $(SCOUT_IMAGES); do \
+		echo "Scanning $$image ..."; \
+		echo "### $${image##*/}" >> $(SCOUT_REPORT); \
+		echo '```' >> $(SCOUT_REPORT); \
+		docker scout quickview "$$image" --platform linux/arm64 2>&1 >> $(SCOUT_REPORT) || \
+			echo "Scout scan failed for $$image" >> $(SCOUT_REPORT); \
+		echo '```' >> $(SCOUT_REPORT); \
+		echo "" >> $(SCOUT_REPORT); \
+	done
+	@echo "Scout report written to $(SCOUT_REPORT)"
+
 #
 # Clean
 #
 .PHONY: clean
 clean: checkouts-clean
+	rm -rf _out
 	rm -rf checkouts/_out

patches/siderolabs/talos/0001-Patched-for-Raspberry-Pi-5.patch

@@ -1,17 +1,18 @@
-From 87c9e57548bc0aef15d67967a68cc9185216361d Mon Sep 17 00:00:00 2001
+From 808bd99557797a8175464184202ff4df7c324a55 Mon Sep 17 00:00:00 2001
 From: Patrick Hunziker <patrick@hunziker.io>
 Date: Sat, 8 Nov 2025 11:31:15 +0100
-Subject: [PATCH] [PATCH] Patched for Raspberry Pi 5
+Subject: [PATCH] Patched for Raspberry Pi 5
 
 ---
- hack/modules-arm64.txt | 343 +++++++++++++++++++----------------------
- 1 file changed, 160 insertions(+), 183 deletions(-)
+ hack/modules-arm64.txt | 367 ++++++++++++++++++-----------------------
+ 1 file changed, 160 insertions(+), 207 deletions(-)
 
 diff --git a/hack/modules-arm64.txt b/hack/modules-arm64.txt
-index 6c48a7465..95c3ee669 100644
+index 3b11b7551..95c3ee669 100644
 --- a/hack/modules-arm64.txt
 +++ b/hack/modules-arm64.txt
-@@ -1,213 +1,190 @@
+@@ -1,237 +1,190 @@
+-kernel/arch/arm64/lib/xor-neon.ko
 +modules.builtin.bin
 +modules.builtin.modinfo
 +modules.builtin.alias.bin
@@ -32,6 +33,7 @@ index 6c48a7465..95c3ee669 100644
  kernel/crypto/async_tx/async_raid6_recov.ko
  kernel/crypto/async_tx/async_tx.ko
 -kernel/crypto/async_tx/async_xor.ko
+-kernel/crypto/hkdf.ko
 -kernel/crypto/xor.ko
 -kernel/drivers/acpi/video.ko
 -kernel/drivers/ata/ahci.ko
@@ -53,9 +55,10 @@ index 6c48a7465..95c3ee669 100644
 +kernel/drivers/infiniband/hw/hns/hns-roce-hw-v2.ko
 +kernel/drivers/misc/bcm2835_smi.ko
  kernel/drivers/crypto/tegra/tegra-se.ko
--kernel/drivers/gpu/drm/display/drm_dp_aux_bus.ko
 -kernel/drivers/gpu/drm/drm_buddy.ko
 -kernel/drivers/gpu/drm/drm_exec.ko
+-kernel/drivers/gpu/drm/drm_gpuvm.ko
+-kernel/drivers/gpu/drm/drm_panel_backlight_quirks.ko
 -kernel/drivers/gpu/drm/drm_suballoc_helper.ko
 +kernel/drivers/acpi/video.ko
 +kernel/drivers/gpu/drm/vc4/vc4.ko
@@ -108,12 +111,15 @@ index 6c48a7465..95c3ee669 100644
 -kernel/drivers/infiniband/hw/mlx4/mlx4_ib.ko
 -kernel/drivers/infiniband/hw/mlx5/mlx5_ib.ko
 -kernel/drivers/infiniband/sw/rxe/rdma_rxe.ko
+-kernel/drivers/irqchip/irq-bcm2712-mip.ko
 -kernel/drivers/irqchip/irq-imx-mu-msi.ko
+-kernel/drivers/leds/led-class-multicolor.ko
 -kernel/drivers/mailbox/bcm-flexrm-mailbox.ko
 -kernel/drivers/md/bcache/bcache.ko
 -kernel/drivers/md/dm-bio-prison.ko
 -kernel/drivers/md/dm-cache-smq.ko
 -kernel/drivers/md/dm-cache.ko
+-kernel/drivers/md/dm-integrity.ko
 -kernel/drivers/md/dm-multipath.ko
 -kernel/drivers/md/dm-raid.ko
 -kernel/drivers/md/dm-round-robin.ko
@@ -133,6 +139,7 @@ index 6c48a7465..95c3ee669 100644
 -kernel/drivers/mmc/host/sdhci-pci.ko
 -kernel/drivers/mmc/host/sdhci-pltfm.ko
 -kernel/drivers/mmc/host/sdhci-tegra.ko
+-kernel/drivers/mmc/host/sdhci-uhs2.ko
 -kernel/drivers/mmc/host/sdhci-xenon-driver.ko
 +kernel/drivers/nvme/host/nvme-rdma.ko
 +kernel/drivers/nvme/target/nvme-loop.ko
@@ -189,12 +196,16 @@ index 6c48a7465..95c3ee669 100644
 -kernel/drivers/net/ethernet/intel/i40e/i40e.ko
 -kernel/drivers/net/ethernet/intel/iavf/iavf.ko
 -kernel/drivers/net/ethernet/intel/ice/ice.ko
+-kernel/drivers/net/ethernet/intel/idpf/idpf.ko
 -kernel/drivers/net/ethernet/intel/igb/igb.ko
 -kernel/drivers/net/ethernet/intel/igbvf/igbvf.ko
 -kernel/drivers/net/ethernet/intel/igc/igc.ko
 -kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
 -kernel/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
+-kernel/drivers/net/ethernet/intel/libeth/libeth_xdp.ko
 -kernel/drivers/net/ethernet/intel/libeth/libeth.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_adminq.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_fwlog.ko
 -kernel/drivers/net/ethernet/intel/libie/libie.ko
 -kernel/drivers/net/ethernet/marvell/sky2.ko
 -kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko
@@ -220,6 +231,7 @@ index 6c48a7465..95c3ee669 100644
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.ko
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.ko
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.ko
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.ko
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.ko
 -kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.ko
@@ -315,18 +327,30 @@ index 6c48a7465..95c3ee669 100644
 -kernel/drivers/usb/serial/cp210x.ko
 -kernel/drivers/usb/serial/ftdi_sio.ko
 -kernel/drivers/usb/serial/pl2303.ko
+-kernel/drivers/vdpa/mlx5/mlx5_vdpa.ko
+-kernel/drivers/vdpa/octeon_ep/octep_vdpa.ko
+-kernel/drivers/vdpa/solidrun/snet_vdpa.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim_blk.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim_net.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim.ko
+-kernel/drivers/vdpa/vdpa_user/vduse.ko
+-kernel/drivers/vdpa/vdpa.ko
+-kernel/drivers/vdpa/virtio_pci/vp_vdpa.ko
 -kernel/drivers/vfio/pci/vfio-pci-core.ko
 +kernel/drivers/thunderbolt/thunderbolt.ko
  kernel/drivers/vfio/pci/vfio-pci.ko
 -kernel/drivers/vfio/vfio_iommu_type1.ko
 +kernel/drivers/vfio/pci/vfio-pci-core.ko
  kernel/drivers/vfio/vfio.ko
+-kernel/drivers/vhost/vhost_vdpa.ko
+-kernel/drivers/vhost/vringh.ko
 -kernel/drivers/virtio/virtio_balloon.ko
 -kernel/drivers/virtio/virtio_input.ko
 -kernel/drivers/virtio/virtio_mmio.ko
 -kernel/drivers/virtio/virtio_pci_legacy_dev.ko
 -kernel/drivers/virtio/virtio_pci_modern_dev.ko
 -kernel/drivers/virtio/virtio_pci.ko
+-kernel/drivers/virtio/virtio_vdpa.ko
 +kernel/drivers/vfio/vfio_iommu_type1.ko
 +kernel/drivers/usb/class/cdc-wdm.ko
 +kernel/drivers/usb/serial/usb_wwan.ko