# Contrats après olddefconfig. Format exact, une contrainte par ligne.
# = CONFIG_NOM=valeur          valeur finale obligatoire
# = # CONFIG_NOM is not set    symbole présent et éteint
# ! CONFIG_NOM                 interdit toute ligne CONFIG_NOM=... ; absence/commentaire acceptés
# Un écart non listé dans un fichier accepté identique arrête le script au code 3.

= CONFIG_64BIT=y
= CONFIG_SMP=y
= CONFIG_GENERIC_CPU=y
= CONFIG_NR_CPUS=512
! CONFIG_MAXSMP
= CONFIG_KERNEL_GZIP=y
= CONFIG_MODULES=y
! CONFIG_MODULE_COMPRESS
! CONFIG_MODULE_COMPRESS_XZ
! CONFIG_MODULE_COMPRESS_ALL
! CONFIG_MODULE_COMPRESS_GZIP
= CONFIG_RD_GZIP=y
= CONFIG_RD_XZ=y
= CONFIG_EXT4_FS=y
= CONFIG_XFS_FS=y
= CONFIG_BLK_DEV_NVME=y
= CONFIG_SATA_AHCI=y
= CONFIG_MD=y
= CONFIG_BLK_DEV_MD=m
= CONFIG_MD_RAID0=m
= CONFIG_MD_RAID1=m
= CONFIG_MD_RAID10=m
= CONFIG_MD_RAID456=m
= CONFIG_ICE=m
= CONFIG_IGB=m
= CONFIG_IXGBE=m
= CONFIG_E1000E=m
= CONFIG_CGROUPS=y
= CONFIG_MEMCG=y
= CONFIG_MEMCG_V1=y
= CONFIG_CPUSETS_V1=y
= CONFIG_IP_NF_IPTABLES=m
= CONFIG_IP_NF_FILTER=m
= CONFIG_NFT_COMPAT=m
= CONFIG_VIRTIO_PCI=y
= CONFIG_VIRTIO_BLK=y
= CONFIG_CPU_MITIGATIONS=y
= CONFIG_MITIGATION_RETPOLINE=y
= CONFIG_MITIGATION_RETHUNK=y
= CONFIG_MITIGATION_SLS=y
= CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y
= CONFIG_RANDOMIZE_BASE=y
= CONFIG_STACKPROTECTOR=y
= CONFIG_STACKPROTECTOR_STRONG=y
= CONFIG_FORTIFY_SOURCE=y
= CONFIG_INIT_STACK_ALL_ZERO=y
! CONFIG_MODULE_SIG
= CONFIG_EXTRA_FIRMWARE=""

! CONFIG_KERNEL_ZSTD
! CONFIG_MODULE_COMPRESS_ZSTD
! CONFIG_RD_ZSTD
! CONFIG_MODULE_SIG_FORCE
! CONFIG_X86_KERNEL_IBT
! CONFIG_DEBUG_INFO_BTF
! CONFIG_GCC_PLUGINS
! CONFIG_SECURITY_LOCKDOWN_LSM

= CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
= CONFIG_SECURITY_APPARMOR=y
= CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
= CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
= CONFIG_NETFILTER_XTABLES_COMPAT=y

= CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y

# Exigences finales de migration Stretch : ne valent pas acceptation de listnew.
# Les dépendances cachées sont vérifiées après résolution, pas forcées ici.
= CONFIG_KEXEC_FILE=y
= CONFIG_KEXEC_SIG=y
= CONFIG_KEXEC_SIG_FORCE=y
= CONFIG_SIGNED_PE_FILE_VERIFICATION=y
= CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y
= CONFIG_FS_ENCRYPTION=y
= CONFIG_FS_ENCRYPTION_ALGS=y
= CONFIG_AUTOFS_FS=m
= CONFIG_STRICT_KERNEL_RWX=y
= CONFIG_STRICT_MODULE_RWX=y
= CONFIG_PKCS7_MESSAGE_PARSER=y
= CONFIG_X509_CERTIFICATE_PARSER=y
= CONFIG_SYSTEM_DATA_VERIFICATION=y
= CONFIG_ASYMMETRIC_KEY_TYPE=y
= CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
= CONFIG_CRYPTO_RSA=y
= CONFIG_SYSTEM_TRUSTED_KEYRING=y
! CONFIG_RUST
! CONFIG_BUILTIN_MODULE_RANGES

# Contrats NAND après résolution, sans forcer le symbole ECC caché dans le fragment.
= CONFIG_MTD=m
= CONFIG_MTD_RAW_NAND=m
= CONFIG_MTD_NAND_ECC=y
= CONFIG_MTD_NAND_ECC_SW_HAMMING=y
= CONFIG_MTD_NAND_ECC_SW_BCH=y
! CONFIG_MTD_NAND_ECC_SW_HAMMING_SMC

# Types Stretch0625 et TPM/RNG : exigences finales, pas acceptation de listnew.
# Les auxiliaires cachés restent sélectionnés par les consommateurs, jamais forcés dans le fragment.
= CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
= # CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
= CONFIG_SLAB_FREELIST_HARDENED=y
= CONFIG_SLAB_BUCKETS=y
= # CONFIG_BASE_SMALL is not set
= CONFIG_HOTPLUG_PCI_SHPC=y
= CONFIG_HSA_AMD=y
= CONFIG_LIRC=y
= CONFIG_NF_CT_PROTO_DCCP=y
= CONFIG_NF_CT_PROTO_SCTP=y
= CONFIG_NF_CT_PROTO_UDPLITE=y
= CONFIG_NF_TABLES_ARP=y
= CONFIG_NF_TABLES_INET=y
= CONFIG_NF_TABLES_IPV4=y
= CONFIG_NF_TABLES_IPV6=y
= CONFIG_NF_TABLES_NETDEV=y
= CONFIG_NVMEM=y
= CONFIG_VIDEO_ZORAN_DC30=y
= CONFIG_VIDEO_ZORAN_ZR36060=y
= CONFIG_VIDEO_ZORAN_BUZ=y
= CONFIG_VIDEO_ZORAN_DC10=y
= CONFIG_VIDEO_ZORAN_LML33=y
= CONFIG_VIDEO_ZORAN_LML33R10=y
= CONFIG_VIDEO_ZORAN_AVS6EYES=y
= CONFIG_HW_RANDOM=y
= CONFIG_HW_RANDOM_TPM=y
! CONFIG_SLUB_TINY
= CONFIG_SLAB_FREELIST_RANDOM=y
= CONFIG_TCG_TPM=y
= CONFIG_HW_RANDOM_INTEL=m
= CONFIG_HW_RANDOM_AMD=m
= CONFIG_HW_RANDOM_VIA=m
= CONFIG_HW_RANDOM_VIRTIO=m
= CONFIG_DRM_AMDGPU=m
= CONFIG_RC_CORE=m
= CONFIG_VIDEO_ZORAN=m
= CONFIG_NF_TABLES=m
= CONFIG_NF_CONNTRACK=m
= CONFIG_NF_NAT=m
= CONFIG_VFIO_PCI=m
= CONFIG_VFIO_PCI_CORE=m
= CONFIG_BT=m
= CONFIG_MLX5_CORE=m
= CONFIG_SFC=m
= CONFIG_CRYPTO_USER_API_HASH=m
= CONFIG_CRYPTO_USER_API_SKCIPHER=m
= CONFIG_CRYPTO_USER_API_AEAD=m
! CONFIG_CRYPTO_USER_API_RNG
= CONFIG_ISDN_CAPI=y
= CONFIG_NET_DEVLINK=y
= CONFIG_NF_CT_PROTO_GRE=y
= CONFIG_NF_NAT_REDIRECT=y
= CONFIG_VFIO_VIRQFD=y

# Compatibilité Stretch0715 : 25 entrées décidées pour nouvel inventaire.
# Les parents REGULATOR et SERDEV sont explicitement demandés ; les défauts
# induits et les dépendances cachées restent à qualifier avant config finale.
= CONFIG_RD_BZIP2=y
= CONFIG_RD_LZMA=y
= CONFIG_RD_LZO=y
= CONFIG_RD_LZ4=y
= CONFIG_NFSD_V2=y
= CONFIG_NFSD_V2_ACL=y
= CONFIG_SQUASHFS_COMPILE_DECOMP_SINGLE=y
= # CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU is not set
= CONFIG_ACPI_DPTF=y
= CONFIG_DPTF_POWER=m
= # CONFIG_DPTF_PCH_FIVR is not set
= CONFIG_MISC_RTSX_PCI=m
= CONFIG_MISC_RTSX_USB=m
= CONFIG_MMC_REALTEK_PCI=m
= CONFIG_MMC_REALTEK_USB=m
= CONFIG_MEMSTICK_REALTEK_USB=m
= CONFIG_REGULATOR=y
= CONFIG_AT803X_PHY=m
= CONFIG_SERIAL_DEV_BUS=y
= CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
= CONFIG_BT_HCIUART_3WIRE=y
= CONFIG_BT_HCIUART_LL=y
= CONFIG_BT_HCIUART_BCM=y
= CONFIG_BT_HCIUART_MRVL=y
= CONFIG_BT_HCIUART_QCA=y
= CONFIG_SQUASHFS_DECOMP_SINGLE=y
= CONFIG_BT_HCIUART_SERDEV=y
