From ea871d691bf13bf8855875174d8a2eaa3781bc9e Mon Sep 17 00:00:00 2001
From: Saikrishna Arcot <sarcot@microsoft.com>
Date: Thu, 3 Sep 2026 22:40:19 -0700
Subject: [PATCH 1/2] Verify that locally-specified configs are actually
 getting set

After local configs are set and oldconfig is run, make sure that the
configs that we are locally setting are actually staying set. Note that
the current code isn't comprehensive, and won't necessarily check to see
that something is unset.

Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
---
 Makefile                                      |  1 +
 .../verify-local-configs-are-applied.patch    | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 patches-debian/verify-local-configs-are-applied.patch

diff --git a/Makefile b/Makefile
index 2c4cc7609..5aeae2770 100644
--- a/Makefile
+++ b/Makefile
@@ -89,6 +89,7 @@ $(addprefix $(DEST)/, $(MAIN_TARGET)): $(DEST)/% :
 	fi
 
 	patch -p1 -i ../patches-debian/disable-secureboot-config-checks.patch
+	patch -p1 -i ../patches-debian/verify-local-configs-are-applied.patch
 
 	# Enable secure boot configs if needed
 	../manage-config $(CONFIGURED_ARCH) $(SECURE_UPGRADE_MODE) $(SECURE_UPGRADE_KERNEL_CAFILE)
diff --git a/patches-debian/verify-local-configs-are-applied.patch b/patches-debian/verify-local-configs-are-applied.patch
new file mode 100644
index 000000000..1cc4c1000
--- /dev/null
+++ b/patches-debian/verify-local-configs-are-applied.patch
@@ -0,0 +1,53 @@
+Index: linux-6.12.41/debian/bin/buildcheck.py
+===================================================================
+--- linux-6.12.41.orig/debian/bin/buildcheck.py
++++ linux-6.12.41/debian/bin/buildcheck.py
+@@ -6,7 +6,38 @@ import pathlib
+ import sys
+ 
+ from debian_linux.config_v2 import Config
+-from debian_linux.kconfig import KconfigFile
++from debian_linux.kconfig import KconfigFile, KConfigEntryTristate
++
++
++class CheckConfigsAreSet:
++    def __init__(self, config, dir, *_):
++        self.config = config
++        self.dir = pathlib.Path(dir)
++
++    def __call__(self, out):
++        fail = 0
++
++        kconfig = KconfigFile()
++        with (self.dir / '.config').open() as fh:
++            kconfig.read(fh)
++
++        merged_config = KconfigFile()
++        for c in self.config.config:
++            if (f := pathlib.Path('debian/config.local') / c).exists():
++                with f.open() as fh:
++                    merged_config.read(fh)
++
++        missing_configs = set(merged_config.values()) - set(kconfig.values())
++        actual_missing_configs = set([config for config in missing_configs if config.value != KConfigEntryTristate.VALUE_NO])
++        if missing_configs - actual_missing_configs:
++            print(f'Ignoring "no" configs that are not set in the final config: {missing_configs - actual_missing_configs}')
++
++        if actual_missing_configs:
++            print('Error: there are configs not set in the final config!')
++            print(f'Unset configs: {actual_missing_configs}')
++            fail = 1
++
++        return fail
+ 
+ 
+ class CheckSecureBootConfig:
+@@ -42,7 +73,7 @@ class CheckSecureBootConfig:
+ class Main(object):
+ 
+     checks = {
+-        'setup': [CheckSecureBootConfig],
++        'setup': [CheckSecureBootConfig, CheckConfigsAreSet],
+         'build': [],
+     }
+ 

From 61405299f29b3d5f775020a8cd4c3acddc3b0b7c Mon Sep 17 00:00:00 2001
From: Saikrishna Arcot <sarcot@microsoft.com>
Date: Thu, 3 Sep 2026 22:51:00 -0700
Subject: [PATCH 2/2] Use out.write instead of print

Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
---
 patches-debian/verify-local-configs-are-applied.patch | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/patches-debian/verify-local-configs-are-applied.patch b/patches-debian/verify-local-configs-are-applied.patch
index 1cc4c1000..ffc12eac8 100644
--- a/patches-debian/verify-local-configs-are-applied.patch
+++ b/patches-debian/verify-local-configs-are-applied.patch
@@ -31,11 +31,11 @@ Index: linux-6.12.41/debian/bin/buildcheck.py
 +        missing_configs = set(merged_config.values()) - set(kconfig.values())
 +        actual_missing_configs = set([config for config in missing_configs if config.value != KConfigEntryTristate.VALUE_NO])
 +        if missing_configs - actual_missing_configs:
-+            print(f'Ignoring "no" configs that are not set in the final config: {missing_configs - actual_missing_configs}')
++            out.write(f'Ignoring "no" configs that are not set in the final config: {missing_configs - actual_missing_configs}\n')
 +
 +        if actual_missing_configs:
-+            print('Error: there are configs not set in the final config!')
-+            print(f'Unset configs: {actual_missing_configs}')
++            out.write('Error: there are configs not set in the final config!\n')
++            out.write(f'Unset configs: {actual_missing_configs}\n')
 +            fail = 1
 +
 +        return fail