ci: update musl headers to Linux 6.6

Update the musl headers in CI to use alpine-linux instead of sabotage-linux.
Alpine also uses musl but follows the linux stable releases, providing more up-to-date headers.

Signed-off-by: Pedro Tammela <pctammela@gmail.com>

ci/docker/aarch64-unknown-linux-musl/Dockerfile

@@ -2,7 +2,7 @@ FROM ubuntu:24.10
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
   gcc make libc6-dev git curl ca-certificates \
-  gcc-aarch64-linux-gnu qemu-user
+  gcc-aarch64-linux-gnu qemu-user xz-utils patch rsync
 
 COPY install-musl.sh /
 RUN /install-musl.sh aarch64

ci/docker/arm-unknown-linux-musleabihf/Dockerfile

@@ -5,7 +5,7 @@ RUN sed -i -E 's/(archive|security)\.ubuntu\.com/old-releases.ubuntu.com/g' \
         /etc/apt/sources.list && \
     apt-get update && apt-get install -y --no-install-recommends \
         gcc make libc6-dev git curl ca-certificates \
-        gcc-arm-linux-gnueabihf qemu-user
+        gcc-arm-linux-gnueabihf qemu-user xz-utils patch rsync
 
 COPY install-musl.sh /
 RUN /install-musl.sh arm

ci/docker/i686-unknown-linux-musl/Dockerfile

@@ -1,12 +1,12 @@
 FROM ubuntu:23.10
 
-
 # FIXME(time): we are using an EOL release because 24.04 changes to 64-bit time
 RUN sed -i -E 's/(archive|security)\.ubuntu\.com/old-releases.ubuntu.com/g' \
         /etc/apt/sources.list && \
     dpkg --add-architecture i386 && \
     apt-get update && apt-get install -y --no-install-recommends \
-        gcc-multilib make libc6-dev git curl ca-certificates libc6-i386
+        gcc-multilib make libc6-dev git curl ca-certificates libc6-i386 \
+        xz-utils patch rsync
 
 COPY install-musl.sh /
 RUN /install-musl.sh i686

ci/docker/s390x-unknown-linux-musl/Dockerfile

@@ -4,7 +4,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         curl ca-certificates \
         gcc \
         gcc-s390x-linux-gnu \
-        qemu-user
+        qemu-user \
+        xz-utils patch rsync
 
 COPY install-musl.sh /
 RUN /install-musl.sh s390x

ci/docker/x86_64-unknown-linux-musl/Dockerfile

@@ -2,7 +2,8 @@ FROM ubuntu:24.10
 
 RUN apt-get update
 RUN apt-get install -y --no-install-recommends \
-  gcc make libc6-dev git curl ca-certificates
+  gcc make libc6-dev git curl ca-certificates \
+  xz-utils patch rsync
 
 COPY install-musl.sh /
 RUN /install-musl.sh x86_64

ci/install-musl.sh

@@ -64,13 +64,63 @@ esac
 cd ..
 rm -rf "$musl"
 
-# Download, configure, build, and install musl-sanitized kernel headers:
-kernel_header_ver="4.19.88"
-curl --retry 5 -L \
-    "https://github.com/sabotage-linux/kernel-headers/archive/v${kernel_header_ver}.tar.gz" |
-    tar xzf -
+# Download, configure, build, and install musl-sanitized kernel headers.
+
+# Alpine follows stable kernel releases, 3.20 uses Linux 6.6 headers.
+alpine_version=3.20
+alpine_git=https://gitlab.alpinelinux.org/alpine/aports
+
+# This routine piggybacks on: https://git.alpinelinux.org/aports/tree/main/linux-headers?h=3.20-stable
+git clone -n --depth=1 --filter=tree:0 -b "${alpine_version}-stable" "$alpine_git"
 (
-    cd "kernel-headers-${kernel_header_ver}"
-    make ARCH="${kernel_arch}" prefix="/musl-${musl_arch}" install -j4
+    cd aports
+    git sparse-checkout set --no-cone main/linux-headers
+    git checkout
+
+    cd main/linux-headers
+    cp APKBUILD APKBUILD.vars
+    cat <<- EOF >> APKBUILD.vars
+        echo "\$source" > alpine-source
+        echo "\$_kernver" > alpine-kernver
+        echo "\$pkgver" > alpine-pkgver
+        echo "\$sha512sums" > alpine-sha512sums
+EOF
+
+    # Retrieve all the variables
+    sh APKBUILD.vars
+
+    cat APKBUILD.vars
+
+    kernel_version=$(tr -d "[:space:]" < alpine-kernver)
+    pkg_version=$(tr -d "[:space:]" < alpine-pkgver)
+
+    urls=$(grep -o 'https.*' alpine-source)
+    kernel=""
+    patch=""
+    for url in $urls; do
+        base=$(basename "$url")
+        curl --retry 5 -L "$url" > "$base"
+        case $base in
+            linux-*) kernel=$base;;
+            patch-*) patch=$base;;
+        esac
+        # Check if file is known
+        grep -o "$base" alpine-sha512sums
+    done
+
+    # Double check checksums
+    sha512sum -c alpine-sha512sums
+
+    # Extract, apply patches, compile and install headers
+    tar -xf "$kernel"
+    cd "linux-$kernel_version"
+    if [ "$pkg_version" != "$kernel_version" ]; then
+        unxz -c < "../$patch" | patch -p1
+    fi
+    for p in ../*.patch; do
+        patch -p1 < "$p"
+    done
+    make headers_install ARCH="${kernel_arch}" INSTALL_HDR_PATH="/musl-${musl_arch}"
 )
-rm -rf kernel-headers-${kernel_header_ver}
+
+rm -rf aports