Kernel build workspace moves into the repo at kernel/build/ (gitignored; mkimage anchors to its own path, the pre-mkimage 7.1.4 tarball era swept) and the image's firmware inputs are vendored and tracked at kernel/firmware/ — EDID folded in from kernel/edid keeping its cmdline-relative path, i915 blobs pinned copies from linux-firmware — so EXTRA_FIRMWARE_DIR points at the repo, the assembly step and the linux-firmware host dependency are gone, and a kernel wanting a different blob fails the build loudly

.gitignore

@@ -1,2 +1,3 @@
 /shots/
 /mockups/
+/kernel/build/

mkimage

@@ -2,9 +2,9 @@
 set -euo pipefail
 
 repo=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-work=$(dirname "$repo")/kernel
+work=$repo/kernel/build
 src=$work/linux
-fwdir=$work/firmware
+fwdir=$repo/kernel/firmware
 initdir=$work/initramfs
 cpiolist=$work/initramfs.list
 
@@ -21,10 +21,11 @@ keys=(
 )
 
 # Nothing here can be loaded from disk at runtime, so every blob the drivers
-# ask for is linked into the image. The EDID is ours; the rest come from the
-# distro's linux-firmware.
+# ask for is linked into the image, all vendored in kernel/firmware: the EDID
+# is ours, the i915 blobs are pinned copies from linux-firmware. A kernel that
+# starts asking for a different blob fails the build at EXTRA_FIRMWARE.
 edid=edid/waveshare-1024x600.bin
-distrofw=(
+fw=(
 	i915/adlp_dmc.bin
 	i915/adlp_guc_70.bin
 	i915/tgl_huc.bin
@@ -85,20 +86,6 @@ mkdir -p "$initdir"
 go version -m "$initdir/init" | grep -E 'vcs\.(revision|modified)' ||
 	die "no VCS stamp; build from a git checkout so the image is traceable"
 
-say "firmware"
-mkdir -p "$fwdir/$(dirname "$edid")"
-cp "$repo/kernel/$edid" "$fwdir/$edid"
-for f in "${distrofw[@]}"; do
-	mkdir -p "$fwdir/$(dirname "$f")"
-	if [ -e "/lib/firmware/$f" ]; then
-		cp "/lib/firmware/$f" "$fwdir/$f"
-	elif [ -e "/lib/firmware/$f.zst" ]; then
-		zstd -qdf -o "$fwdir/$f" "/lib/firmware/$f.zst"
-	else
-		die "/lib/firmware/$f is missing; install linux-firmware"
-	fi
-done
-
 # The binary is embedded by the kernel link, so it has to exist before make.
 # /dev/console must be in the cpio: the kernel opens it for init's stdio before
 # anything has had a chance to mount devtmpfs over /dev.
@@ -119,7 +106,7 @@ cp "$repo/kernel/config" "$src/.config"
 	--enable EXPERT --disable BLOCK \
 	--enable IXGBE --disable ICE --disable I40E --disable IGC \
 	--enable DRM_LOAD_EDID_FIRMWARE \
-	--set-str EXTRA_FIRMWARE "$edid ${distrofw[*]}" \
+	--set-str EXTRA_FIRMWARE "$edid ${fw[*]}" \
 	--set-str EXTRA_FIRMWARE_DIR "$fwdir" \
 	--set-str INITRAMFS_SOURCE "$cpiolist" \
 	--disable INITRAMFS_COMPRESSION_GZIP --enable INITRAMFS_COMPRESSION_NONE \