kconform — a Kconfig linter for embedded engineers who ship

kconform lint on upstream U-Boot's qemu_arm64_defconfig — finds a real canonical-order issue upstream didn't catch. kconform lint 对 upstream U-Boot 的 qemu_arm64_defconfig——发现了一个上游漏掉的规范排序问题。

11verbs in the CLI个 CLI 命令

3lint rules live条规则已上线

0pip / npm depspip / npm 依赖

Apache2.0 license, vendor-neutral2.0 许可，厂商中立

Why kconform为什么选 kconform

Three things the build won't catch.三件 build 抓不到的事。

A green build tells you the code compiled. It says nothing about whether your defconfig silently dropped a symbol, equals the board's old behavior, or has been quietly drifting from canonical form. kconform does. build 绿了只说明代码编过。它并不告诉你 defconfig 是不是静默丢了符号、和板子旧行为是否一致、有没有悄悄偏离规范形态。这些由 kconform 来看。

Lint静态检查

Catch what Kconfig silently drops.抓住 Kconfig 静默丢弃的行。

L001 flags ghost symbols (CONFIG_X=y with no Kconfig definition — Kconfig drops them without a word). L002 flags pseudo-disables (# CONFIG_X=y that looks like a disable but is a plain comment). L004 shells out to savedefconfig to prove the defconfig is in canonical minimal form. L001 抓 ghost 符号（CONFIG_X=y 但 Kconfig 树里没定义——会被静默丢弃）。L002 抓伪 disable（# CONFIG_X=y 看起来像禁用但其实就是普通注释）。L004 调 savedefconfig 验证 defconfig 是否已是规范最小形态。

See all rules查看所有规则

Verify等价性证明

Prove two defconfigs are equivalent.证明两份 defconfig 语义等价。

Before you merge an SDK migration, a rename, or a cleanup, run kconform verify before after. It roundtrips each side through make olddefconfig and compares the resulting .config files symbol by symbol. No silent drift. No "it worked on my machine." 合入 SDK 迁移、重命名、清理之前，跑 kconform verify before after。两边都走 make olddefconfig 回环，然后逐符号对比产出的 .config。不会静默漂移，不会"我这里能跑"。

How verify worksverify 的工作原理

Fragment片段工具

One base, many feature layers.一个 base，多个特性层。

Stop copying board_defconfig N times for N security / debug / factory variants. Write a base plus small .cfg fragments. kconform fragment gives you new, lint, apply, diff, and --from-diff to extract a fragment from any two configs. 别再为 N 种安全 / 调试 / 量产变体复制 N 份 board_defconfig。一个 base 加几个小 .cfg 片段即可。kconform fragment 提供 new、lint、apply、diff 以及 --from-diff 五件套——后者能从任意两份 config 提取出片段。

Real-world patterns真实场景

How it feels日常使用

Three commands. Open a tree, type, done.三条命令。进树，敲，收工。

kconform is 11 verbs total, but a normal day is three: detect, lint, verify. No config file. No init. cd into the tree and type. kconform 一共 11 个命令，但日常只用三个：detect、lint、verify。不需要配置文件，不需要 init。cd 进树敲就完了。

Three commands you'll reach for. 你最常敲的三条命令。

kconform detect — identify the platform & project root识别平台和项目根
kconform lint --deep — every lint rule, including savedefconfig roundtrip跑全部规则，含 savedefconfig 回环
kconform verify a b — prove two defconfigs are semantically equivalent证明两份 defconfig 语义等价

Full verb reference完整命令列表

Lint rulesLint 规则

Three rules. Each catches a specific foot-gun.三条规则。每条抓一类具体的坑。

ID编号	Severity严重性	Tier速度	What it catches抓什么
`L001` ghost-symbolghost 符号	error	fast快	`CONFIG_X=y` with no `config` / `menuconfig` definition anywhere in the Kconfig tree — Kconfig silently drops these lines.`CONFIG_X=y` 但 Kconfig 树里找不到 `config` / `menuconfig` 定义——这种行会被静默丢弃。
`L002` non-standard-comment伪 disable	warn	fast快	`# CONFIG_X=y` pseudo-disable — looks like a directive, is a plain comment. Canonical disable is `# CONFIG_X is not set`.`# CONFIG_X=y` 伪 disable——看起来像禁用指令，实际是普通注释。规范禁用是 `# CONFIG_X is not set`。
`L004` not-minimal非最小化	warn	deep (`--deep`)深度（`--deep`）	Defconfig differs from `savedefconfig` roundtrip output — likely has redundant `=default` lines or lines in non-canonical order.defconfig 与 `savedefconfig` 回环产物不一致——多半有等于 default 的冗余行或非规范排序。

What it's for拿来做什么

Three patterns this tool is built for.这工具为之而生的三种场景。

Prove your SDK bump didn't drop a feature. Run kconform verify between the old and new defconfigs — if any symbol changed, you see exactly which one and how. 证明 SDK 升级没有悄悄丢特性。对新旧 defconfig 跑 kconform verify——只要有符号变化，当场告诉你是哪一个、变成了什么。

Pattern — SDK migration safety场景 —— SDK 迁移防回退

Gate CI on canonical form. kconform minimize --check exits 1 when a defconfig isn't in savedefconfig canonical form. Add it to your pipeline and reviewers stop debating whitespace. 把 CI 卡在规范形态上。kconform minimize --check 一旦 defconfig 不是 savedefconfig 规范形态就 exit 1。接进 pipeline，reviewer 不再为空行顺序争论。

Pattern — CI-enforced defconfig hygiene场景 —— CI 强制 defconfig 卫生

One base defconfig, many feature fragments. Write board_base_defconfig + security.cfg + debug.cfg. kconform fragment apply composes them. Stop copy-pasting 800-line defconfigs. 一个 base defconfig，多个特性 fragment。写 board_base_defconfig + security.cfg + debug.cfg，用 kconform fragment apply 组合。别再复制粘贴 800 行的 defconfig。

Pattern — fragment-driven variants场景 —— 用 fragment 驱动变体

Install安装

Clone, symlink, run. No package manager.克隆、软链、运行。不走包管理器。

kconform is a single shell entry point and a handful of sourced modules. It doesn't install system-wide, doesn't pull dependencies, doesn't touch ~/.config. You can rm -rf it at any time and your system is unchanged. kconform 就是一个 shell 入口脚本 + 几个被 source 的模块。不装到系统，不拉依赖，不碰 ~/.config。任何时候 rm -rf 掉，系统原样。

$ git clone https://github.com/TbusOS/kconform.git $ ln -sf "$PWD/kconform/cli/kconform" ~/.local/bin/kconform $ kconform --version kconform 0.1.13 $ cd /path/to/your/u-boot $ kconform detect platform: uboot project root: /path/to/your/u-boot defconfigs: /path/to/your/u-boot/configs

Clone from GitHub从 GitHub 克隆 Read the design doc阅读设计文档

Ship defconfigs you trust.交付你信得过的 defconfig。

kconform is open source (Apache-2.0), vendor-neutral, and works with upstream U-Boot today. Linux kernel, Buildroot, OpenWrt, and Android adapters are next. kconform 开源（Apache-2.0），厂商中立，今天就支持 upstream U-Boot。Linux kernel、Buildroot、OpenWrt、Android 适配下一步。

Star on GitHub在 GitHub 上 Star Open an issue提 issue

A Kconfig linter.For embeddedengineers who ship. 一个 Kconfig linter。给交付产品的嵌入式工程师。