# SKIPPED (not applicable): debian/gitignore.patch assumes Debian's own
# slim debian/-only git repo model (its final hunk makes .gitignore
# ignore "/*" except "!/debian/"); linux-vyatta's repo tracks the full
# kernel source tree in git, so this patch's premise doesn't apply here
#debian/gitignore.patch

# Disable features broken by exclusion of upstream files
debian/dfsg/arch-powerpc-platforms-8xx-ucode-disable.patch
debian/dfsg/drivers-media-dvb-dvb-usb-af9005-disable.patch
# SKIPPED (driver removed upstream): debian/dfsg/vs6624-disable.patch --
# the VIDEO_VS6624 Kconfig symbol and drivers/media/i2c/vs6624.c no
# longer exist in 6.12, nothing left to mark as BROKEN
#debian/dfsg/vs6624-disable.patch
# SKIPPED (removed upstream): debian/dfsg/drivers-net-appletalk-cops.patch --
# drivers/net/appletalk/ no longer exists, AppleTalk networking support
# was removed from the kernel entirely
#debian/dfsg/drivers-net-appletalk-cops.patch
debian/dfsg/video-remove-nvidiafb-and-rivafb.patch
debian/dfsg/documentation-fix-broken-link-to-cipso-draft.patch

# Changes to support package build system
debian/version.patch
# SKIPPED (removed upstream): debian/uname-version-timestamp.patch --
# scripts/mkcompile_h no longer embeds any build timestamp at all
# (KBUILD_BUILD_TIMESTAMP/date logic removed as part of build
# reproducibility work), nothing left for this patch to prefer an
# alternate timestamp var over
#debian/uname-version-timestamp.patch
debian/kernelvariables.patch
# SKIPPED (out of scope): debian/ia64-hardcode-arch-script-output.patch --
# ia64 architecture support removed from the kernel entirely, and
# irrelevant to this amd64 vyatta build regardless
#debian/ia64-hardcode-arch-script-output.patch
# SKIPPED (out of scope, mips-only): debian/mips-disable-werror.patch
#debian/mips-disable-werror.patch
# SKIPPED (out of scope, mips-only): debian/mips-boston-disable-its.patch
#debian/mips-boston-disable-its.patch
# SKIPPED (out of scope, mips-only): debian/mips-ieee754-relaxed.patch
#debian/mips-ieee754-relaxed.patch
# SKIPPED (out of scope, sh-only): debian/arch-sh4-fix-uimage-build.patch
#debian/arch-sh4-fix-uimage-build.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): debian/tools-perf-version.patch
#debian/tools-perf-version.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): debian/tools-perf-install.patch
#debian/tools-perf-install.patch
debian/wireless-add-debian-wireless-regdb-certificates.patch
# SKIPPED (out of scope): debian/export-symbols-needed-by-android-drivers.patch --
# CONFIG_ANDROID is explicitly disabled in debian/config/amd64/vyatta/config
#debian/export-symbols-needed-by-android-drivers.patch
# SKIPPED (out of scope): debian/android-enable-building-ashmem-and-binder-as-modules.patch --
# CONFIG_ANDROID is explicitly disabled in debian/config/amd64/vyatta/config
#debian/android-enable-building-ashmem-and-binder-as-modules.patch
# DEFERRED (docs build only, not kernel image): debian/documentation-drop-sphinx-version-check.patch
#debian/documentation-drop-sphinx-version-check.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): debian/perf-traceevent-support-asciidoctor-for-documentatio.patch
#debian/perf-traceevent-support-asciidoctor-for-documentatio.patch
# DEFERRED (only matters for linux-kbuild cross-arch packaging, not needed for a plain single-flavour build): debian/kbuild-look-for-module.lds-under-arch-directory-too.patch
#debian/kbuild-look-for-module.lds-under-arch-directory-too.patch
debian/kbuild-abort-build-if-subdirs-used.patch

# Fixes/improvements to firmware loading
features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
debian/iwlwifi-do-not-request-unreleased-firmware.patch
# DEFERRED (cosmetic log-message-only change, no functional impact): bugfix/all/firmware_class-log-every-success-and-failure.patch
#bugfix/all/firmware_class-log-every-success-and-failure.patch
# DEFERRED (cosmetic log-message-only change across ~50 old/staging drivers, no functional impact): bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
#bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
# DEFERRED (GPU driver stability fix, irrelevant hardware for a network appliance): bugfix/all/radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
#bugfix/all/radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
# DEFERRED (cosmetic error-message-text change): debian/firmware_class-refer-to-debian-wiki-firmware-page.patch
#debian/firmware_class-refer-to-debian-wiki-firmware-page.patch

# Patches from aufs5 repository, imported with debian/bin/genpatch-aufs.
# These are only the changes needed to allow aufs to be built out-of-tree.
#features/all/aufs5/aufs5-base.patch
#features/all/aufs5/aufs5-mmap.patch
#features/all/aufs5/aufs5-standalone.patch

# Change some defaults for security reasons
debian/af_802154-Disable-auto-loading-as-mitigation-against.patch
debian/rds-Disable-auto-loading-as-mitigation-against-local.patch
# SKIPPED (removed upstream): debian/decnet-Disable-auto-loading-as-mitigation-against-lo.patch -- net/decnet/ no longer exists
#debian/decnet-Disable-auto-loading-as-mitigation-against-lo.patch
debian/dccp-disable-auto-loading-as-mitigation-against-local-exploits.patch
debian/hamradio-disable-auto-loading-as-mitigation-against-local-exploits.patch
debian/fs-enable-link-security-restrictions-by-default.patch

# Set various features runtime-disabled by default
debian/sched-autogroup-disabled.patch
debian/yama-disable-by-default.patch
debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
# DEFERRED (narrow desktop-iGPU IOMMU quirk, heavy driver-internal rewrite, low value for a headless appliance): features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch
#features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch
# DEFERRED (depends on the above): features/x86/intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch
#features/x86/intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch

# Disable autoloading/probing of various drivers by default
debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch
# DEFERRED (PC speaker driver, irrelevant to a headless appliance): debian/snd-pcsp-disable-autoload.patch
#debian/snd-pcsp-disable-autoload.patch
bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
# DEFERRED (Fujitsu FJES mainframe-specific driver, irrelevant hardware): debian/fjes-disable-autoload.patch
#debian/fjes-disable-autoload.patch

# Taint if dangerous features are used
# DEFERRED (informational taint+warning only, not an actual restriction; low value relative to fix cost): debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch
#debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch
# DEFERRED (informational mount-warning only for a filesystem feature likely unused on DANOS): debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch
#debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch

# Arch bug fixes
# SKIPPED (out of scope, arm-only): bugfix/arm/arm-dts-kirkwood-fix-sata-pinmux-ing-for-ts419.patch
#bugfix/arm/arm-dts-kirkwood-fix-sata-pinmux-ing-for-ts419.patch
# SKIPPED (out of scope, arm64-only): bugfix/arm64/dts-rockchip-correct-voltage-selector-firefly-RK3399.patch
#bugfix/arm64/dts-rockchip-correct-voltage-selector-firefly-RK3399.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): bugfix/x86/perf-tools-fix-unwind-build-on-i386.patch
#bugfix/x86/perf-tools-fix-unwind-build-on-i386.patch
# SKIPPED (out of scope, sh-only): bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch
#bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch
# SKIPPED (out of scope, arm-only): bugfix/arm/arm-mm-export-__sync_icache_dcache-for-xen-privcmd.patch
#bugfix/arm/arm-mm-export-__sync_icache_dcache-for-xen-privcmd.patch
# SKIPPED (out of scope, powerpc-only): bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch
#bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch
# SKIPPED (out of scope, arm64-only): bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
#bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
# SKIPPED (out of scope, i386-only, not amd64): bugfix/x86/x86-32-disable-3dnow-in-generic-config.patch
#bugfix/x86/x86-32-disable-3dnow-in-generic-config.patch

# Arch features
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-Add-basic-support-for-Kobol-s-Hel.patch
#features/arm64/arm64-dts-rockchip-Add-basic-support-for-Kobol-s-Hel.patch
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-Rely-on-SoC-external-pull-up-on-p.patch
#features/arm64/arm64-dts-rockchip-Rely-on-SoC-external-pull-up-on-p.patch
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-kobol-helios64-Add-mmc-aliases.patch
#features/arm64/arm64-dts-rockchip-kobol-helios64-Add-mmc-aliases.patch
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-Add-support-for-two-PWM-fans-on-h.patch
#features/arm64/arm64-dts-rockchip-Add-support-for-two-PWM-fans-on-h.patch
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-Add-support-for-PCIe-on-helios64.patch
#features/arm64/arm64-dts-rockchip-Add-support-for-PCIe-on-helios64.patch
# SKIPPED (out of scope, arm64-only): features/arm64/arm64-dts-rockchip-disable-USB-type-c-DisplayPort.patch
#features/arm64/arm64-dts-rockchip-disable-USB-type-c-DisplayPort.patch
features/x86/x86-memtest-WARN-if-bad-RAM-found.patch
# DEFERRED (x32 ABI runtime-disable toggle, niche compat feature, heavy multi-file rewrite, low value for a router appliance): features/x86/x86-make-x32-syscall-support-conditional.patch
#features/x86/x86-make-x32-syscall-support-conditional.patch

# Miscellaneous bug fixes
# DEFERRED (2013-era register-layout concern; each variant now has its own distinct config_init function upstream, suggesting the underlying bug is already fixed): bugfix/all/disable-some-marvell-phys.patch
#bugfix/all/disable-some-marvell-phys.patch
bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
# SKIPPED (already-applied (reverse-applies cleanly)): bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch
#bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch
# DEFERRED (targets a has_libelf/SKIP_STACK_VALIDATION mechanism completely restructured upstream; our build env already has libelf-dev so the underlying convenience this patch provides is not load-bearing here): debian/makefile-do-not-check-for-libelf-when-building-oot-module.patch
#debian/makefile-do-not-check-for-libelf-when-building-oot-module.patch
# SKIPPED (subsumed upstream): bugfix/all/partially-revert-net-socket-implement-64-bit-timestamps.patch --
# include/uapi/linux/sockios.h already natively auto-selects SIOCGSTAMP_OLD
# vs SIOCGSTAMP_NEW based on sizeof(struct timeval), solving the same
# qemu/suricata/glibc compat problem this patch addressed
#bugfix/all/partially-revert-net-socket-implement-64-bit-timestamps.patch

# Miscellaneous features

# Lockdown missing pieces
# DEFERRED (needs coordinated redesign, not just line-drift fixing: upstream 6.12 already has efi_get_secureboot_mode() natively but nothing wires it up to lockdown; this whole 3-patch chain needs re-engineering around that instead of adding a parallel EFI_SECURE_BOOT flag mechanism -- flagged as a follow-up task, not attempted here): features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch
#features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch
# DEFERRED (depends on the above): features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
#features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
# DEFERRED (depends on the above lockdown chain): features/all/lockdown/mtd-disable-slram-and-phram-when-locked-down.patch
#features/all/lockdown/mtd-disable-slram-and-phram-when-locked-down.patch
# SKIPPED (out of scope, arm64-only): features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
#features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch

# Improve integrity platform keyring for kernel modules verification
#features/all/db-mok-keyring/0001-MODSIGN-do-not-load-mok-when-secure-boot-disabled.patch
#features/all/db-mok-keyring/0002-MODSIGN-load-blacklist-from-MOKx.patch
#features/all/db-mok-keyring/0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module.patch
#features/all/db-mok-keyring/0004-MODSIGN-check-the-attributes-of-db-and-mok.patch
#features/all/db-mok-keyring/modsign-make-shash-allocation-failure-fatal.patch
#features/all/db-mok-keyring/KEYS-Make-use-of-platform-keyring-for-module-signature.patch

# Security fixes
# SKIPPED (out of scope, i386-only, not amd64): debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
#debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
# SKIPPED (removed upstream): debian/ntfs-mark-it-as-broken.patch -- old fs/ntfs/ driver replaced by ntfs3
#debian/ntfs-mark-it-as-broken.patch
# SKIPPED (subsumed upstream): bugfix/all/vfs-move-cap_convert_nscap-call-into-vfs_setxattr.patch --
# this IS the upstream commit (CVE-2021-3493 fix), already natively merged;
# vfs_setxattr() already calls cap_convert_nscap() exactly as intended
#bugfix/all/vfs-move-cap_convert_nscap-call-into-vfs_setxattr.patch

# Fix exported symbol versions
bugfix/all/module-disable-matching-missing-version-crc.patch

# Tools bug fixes
# DEFERRED (out of scope for this pass, usbip doc-only, not kernel image): bugfix/all/usbip-document-tcp-wrappers.patch
#bugfix/all/usbip-document-tcp-wrappers.patch
bugfix/all/kbuild-fix-recordmcount-dependency.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): bugfix/all/tools-perf-man-date.patch
#bugfix/all/tools-perf-man-date.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): bugfix/all/tools-perf-remove-shebangs.patch
#bugfix/all/tools-perf-remove-shebangs.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): bugfix/x86/revert-perf-build-fix-libunwind-feature-detection-on.patch
#bugfix/x86/revert-perf-build-fix-libunwind-feature-detection-on.patch
bugfix/all/tools-build-remove-bpf-run-time-check-at-build-time.patch
# DEFERRED (out of scope for this pass, cpupower userspace pkg, not kernel image): bugfix/all/cpupower-bump-soname-version.patch
#bugfix/all/cpupower-bump-soname-version.patch
# DEFERRED (out of scope for this pass, cpupower userspace pkg, not kernel image): bugfix/all/libcpupower-hide-private-function.patch
#bugfix/all/libcpupower-hide-private-function.patch
# DEFERRED (out of scope for this pass, cpupower userspace pkg, not kernel image): bugfix/all/cpupower-fix-checks-for-cpu-existence.patch
#bugfix/all/cpupower-fix-checks-for-cpu-existence.patch
# DEFERRED (out of scope for this pass, linux-perf userspace pkg, not kernel image): bugfix/all/tools-perf-pmu-events-fix-reproducibility.patch
#bugfix/all/tools-perf-pmu-events-fix-reproducibility.patch
# DEFERRED (out of scope for this pass, bpftool userspace pkg, not kernel image): bugfix/all/bpftool-fix-version-string-in-recursive-builds.patch
#bugfix/all/bpftool-fix-version-string-in-recursive-builds.patch
# SKIPPED (already-applied (reverse-applies cleanly)): bugfix/all/tools-include-uapi-fix-errno.h.patch
#bugfix/all/tools-include-uapi-fix-errno.h.patch

# overlay: allow mounting in user namespaces
# DEFERRED (opt-in-only, explicitly security-risk-flagged by its own description; low value for a network appliance, not a container host): debian/overlayfs-permit-mounts-in-userns.patch
#debian/overlayfs-permit-mounts-in-userns.patch

# ABI maintenance
