fix(build): make vmlinux extraction mandatory for x86_64 and fix CI pipeline

GNU gzip 1.12+ (Ubuntu 24.04) returns exit 2 on trailing garbage after a
valid gzip stream in bzImage, killing extract-vmlinux.sh under pipefail.
macOS gunzip tolerates this, so the bug only manifests in CI. The original
kernel scripts/extract-vmlinux intentionally avoids strict mode for this
reason.

- extract-vmlinux.sh: add `|| true` to decompression pipeline so
  decompressor trailing-data exits don't abort the script; caller still
  validates output via PVH note check
- extract-kernel.sh: remove silent fallback to vmlinuz on failure; vmlinux
  extraction or missing PVH note on x86_64 now fails the build (return 1)
- release.yml: add nullglob before zstd compression loop since vmlinux is
  x86_64-only and the glob won't match for aarch64 artifacts

Author: clemlesne

.github/workflows/release.yml

@@ -328,11 +328,13 @@ jobs:
           cp artifacts/vm-images-x86_64/* release/
           cp artifacts/vm-images-aarch64/* release/
 
-          # Compress large files
+          # Compress large files (nullglob: vmlinux is x86_64 only, glob may not match for aarch64)
           cd release
+          shopt -s nullglob
           for f in *.qcow2 vmlinux-* vmlinuz-* initramfs-*; do
             zstd -19 --rm "$f"
           done
+          shopt -u nullglob
 
           # Generate checksums
           sha256sum * > SHA256SUMS

scripts/extract-kernel.sh

@@ -144,20 +144,20 @@ extract_for_arch() {
         if [ "$target_arch" = "x86_64" ]; then
             local vmlinux_file="$OUTPUT_DIR/vmlinux-x86_64"
             echo "Extracting vmlinux for PVH boot..."
-            if "$SCRIPT_DIR/extract-vmlinux.sh" "$vmlinuz_file" > "$vmlinux_file" 2>/dev/null; then
-                chmod 644 "$vmlinux_file"
-                # Verify PVH note exists (XEN_ELFNOTE_PHYS32_ENTRY)
-                if docker run --rm -v "$OUTPUT_DIR:/output" --platform linux/amd64 \
-                    "alpine:$ALPINE_VERSION" sh -c "apk add --no-cache binutils >/dev/null 2>&1 && readelf -n /output/vmlinux-x86_64 2>/dev/null | grep -q Xen"; then
-                    echo "vmlinux-x86_64: PVH note verified ($(du -h "$vmlinux_file" | cut -f1))"
-                else
-                    echo "Warning: vmlinux lacks PVH note, removing (will use vmlinuz)"
-                    rm -f "$vmlinux_file"
-                fi
-            else
-                echo "Warning: vmlinux extraction failed (will use vmlinuz)"
+            if ! "$SCRIPT_DIR/extract-vmlinux.sh" "$vmlinuz_file" > "$vmlinux_file" 2>/dev/null; then
+                echo "ERROR: vmlinux extraction failed for x86_64" >&2
                 rm -f "$vmlinux_file"
+                return 1
             fi
+            chmod 644 "$vmlinux_file"
+            # Verify PVH note exists (XEN_ELFNOTE_PHYS32_ENTRY)
+            if ! docker run --rm -v "$OUTPUT_DIR:/output" --platform linux/amd64 \
+                "alpine:$ALPINE_VERSION" sh -c "apk add --no-cache binutils >/dev/null 2>&1 && readelf -n /output/vmlinux-x86_64 2>/dev/null | grep -q Xen"; then
+                echo "ERROR: vmlinux lacks PVH note for x86_64" >&2
+                rm -f "$vmlinux_file"
+                return 1
+            fi
+            echo "vmlinux-x86_64: PVH note verified ($(du -h "$vmlinux_file" | cut -f1))"
         fi
     fi
 

scripts/extract-vmlinux.sh

@@ -22,7 +22,7 @@ try_decompress() {
     local offset
     offset=$(grep -aboP "$magic" "$BZIMAGE" 2>/dev/null | head -1 | cut -d: -f1) || true
     if [ -n "$offset" ]; then
-        dd if="$BZIMAGE" bs=1 skip="$offset" 2>/dev/null | "$@" 2>/dev/null
+        dd if="$BZIMAGE" bs=1 skip="$offset" 2>/dev/null | "$@" 2>/dev/null || true
         return 0
     fi
     return 1