commit 9c1c9bcc6ccc67f29f3e71a54e79c9c1d3f6f71f
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Oct 16 00:02:30 2026 -0300

add(sys-kernel/bentoo-kernel-bin-7.2.11, scripts/build-bentoo-kernel-bin.sh), mod(.autoupdate/packages.toml, metadata/md5-cache)

bentoo-kernel-bin installs a pre-built sys-kernel/bentoo-kernel-7.2.11:
bore + sched-ext, GCC without ThinLTO (provisional: a clang build would
make every out-of-tree module need the exact clang major), x86-64-v3, no
generic-uki (its initramfs would carry the build host's binaries).
Modules are signed with a throwaway key and CONFIG_MODULE_SIG_FORCE is
off, overriding kernel-build's modules-sign default: without Secure Boot,
nvidia-drivers and friends load tainted; under Secure Boot only a
MOK-enrolled key works, and pkg_postinst says so.

The gpkg (bentoo-kernel-7.2.11-1.amd64.gpkg.tar) is ours, on
distfiles.obentoo.org. scripts/build-bentoo-kernel-bin.sh produces it
from the source ebuild with a configuration root and /etc/kernel/config.d
of its own, so nothing of the build host leaks in (config.d, -march,
package.env signing key), checks the CachyOS signature with gpgv, and
refuses the result unless LOCALVERSION, GCC, MODULE_SIG on/FORCE off,
the autogenerated module cert and the absence of any private key hold.
It never uploads; --from-gpkg re-runs only the checks.

Verified: build + every script check, exit 0; ebuild clean install of
the -bin as non-root, exit 0 (5032 modules, signature marker on a
200-module sample); a test out-of-tree module built against the
installed tree has the same vermagic as the in-tree ones; the public
download matches the Manifest (size, BLAKE2B). Not merged, not booted;
verify-sig on the consumer side not exercised (key not installed here).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>