linux-netfilter

Custom Arch Linux kernel with bridge netfilter support built-in (CONFIG_BRIDGE_NETFILTER=y).

Designed to coexist with linux, linux-lts, and other kernel packages.

Installation

Add to /etc/pacman.conf:

[linux-netfilter]
Server = https://r3r4um.org/arch/linux-netfilter
SigLevel = Required DatabaseOptional TrustAll

Then:

sudo pacman -S linux-netfilter linux-netfilter-headers

Building Locally

To build locally, you must first download, verify, and prepare the kernel source. Use the provided script:

chmod +x prepare-source.sh
./prepare-source.sh 6.19.6  # Replace with desired kernel version

This script will:

Download the kernel tarball and GPG signature from kernel.org
Import the kernel maintainers' GPG keys
Verify the tarball against the signature
Calculate the SHA256 checksum
Update PKGBUILD with the verified checksum

Then build:

makepkg -si

Manual Build (without script)

If you prefer to do it manually:

# Download kernel source and signature
KERNEL_VERSION=6.19.6
curl -fLO https://cdn.kernel.org/pub/linux/kernel/v${KERNEL_VERSION%%.*}.x/linux-${KERNEL_VERSION}.tar.xz
curl -fLO https://cdn.kernel.org/pub/linux/kernel/v${KERNEL_VERSION%%.*}.x/linux-${KERNEL_VERSION}.tar.sign

# Import signing keys and verify
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 79BE3E4300411886 38DBBDC86092693E
xz -d linux-${KERNEL_VERSION}.tar.xz
gpg --verify linux-${KERNEL_VERSION}.tar.sign linux-${KERNEL_VERSION}.tar

# Calculate and update the checksum in PKGBUILD
KERNEL_SHA256=$(sha256sum linux-${KERNEL_VERSION}.tar | awk '{print $1}')
sed -i "s|'SKIP'  # Replaced at build time with verified hash|'$KERNEL_SHA256'  # Verified from kernel.org|" PKGBUILD

# Now build (PKGBUILD expects the extracted .tar in the same directory)
makepkg -si

The PKGBUILD references linux-${pkgver}.tar (uncompressed) as a local source file. This must be present and verified before running makepkg.

The Gitea Actions workflow automates this entire process: it downloads, verifies, updates the checksum, and leaves the .tar for makepkg to extract.

Features

Based on latest stable kernel from kernel.org
CONFIG_BRIDGE_NETFILTER=y (built-in)
GPG verification of kernel source against upstream signatures
Signed packages (GPG)
Separate kernel and headers packages
Coexists with other kernel installations