17 files changed, 849 insertions, 755 deletions
diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
index 0999b42daa..6be1f5c2df 100644
--- a/meta/classes-global/base.bbclass
+++ b/meta/classes-global/base.bbclass
@@ -19,6 +19,22 @@ PACKAGECONFIG_CONFARGS ??= ""
 inherit metadata_scm
+PREFERRED_TOOLCHAIN_TARGET ??= "gcc"
+PREFERRED_TOOLCHAIN_NATIVE ??= "gcc"
+PREFERRED_TOOLCHAIN_SDK ??= "gcc"
+PREFERRED_TOOLCHAIN = "${PREFERRED_TOOLCHAIN_TARGET}"
+PREFERRED_TOOLCHAIN:class-native = "${PREFERRED_TOOLCHAIN_NATIVE}"
+PREFERRED_TOOLCHAIN:class-cross = "${PREFERRED_TOOLCHAIN_NATIVE}"
+PREFERRED_TOOLCHAIN:class-crosssdk = "${PREFERRED_TOOLCHAIN_SDK}"
+PREFERRED_TOOLCHAIN:class-nativesdk = "${PREFERRED_TOOLCHAIN_SDK}"
+TOOLCHAIN ??= "${PREFERRED_TOOLCHAIN}"
+TOOLCHAIN_NATIVE ??= "${PREFERRED_TOOLCHAIN_NATIVE}"
+inherit_defer toolchain/${TOOLCHAIN_NATIVE}-native
+inherit_defer toolchain/${TOOLCHAIN}
 def lsb_distro_identifier(d):
    adjust = d.getVar('LSB_DISTRO_ADJUST')
    adjust_func = None
@@ -48,13 +64,13 @@ def get_base_dep(d):
        return ""
    return "${BASE_DEFAULT_DEPS}"
-BASE_DEFAULT_DEPS = "virtual/${HOST_PREFIX}gcc virtual/${HOST_PREFIX}compilerlibs virtual/libc"
+BASE_DEFAULT_DEPS = "virtual/cross-cc virtual/compilerlibs virtual/libc"
 BASEDEPENDS = ""
 BASEDEPENDS:class-target = "${@get_base_dep(d)}"
 BASEDEPENDS:class-nativesdk = "${@get_base_dep(d)}"
-DEPENDS:prepend="${BASEDEPENDS} "
+DEPENDS:prepend = "${BASEDEPENDS} "
 FILESPATH = "${@base_set_filespath(["${FILE_DIRNAME}/${BP}", "${FILE_DIRNAME}/${BPN}", "${FILE_DIRNAME}/files"], d)}"
 # THISDIR only works properly with imediate expansion as it has to run
@@ -139,6 +155,7 @@ do_fetch[file-checksums] = "${@bb.fetch.get_checksum_file_list(d)}"
 do_fetch[file-checksums] += " ${@get_lic_checksum_file_list(d)}"
 do_fetch[prefuncs] += "fetcher_hashes_dummyfunc"
 do_fetch[network] = "1"
+do_fetch[umask] = "${OE_SHARED_UMASK}"
 python base_do_fetch() {
    src_uri = (d.getVar('SRC_URI') or "").split()
@@ -153,18 +170,29 @@ python base_do_fetch() {
 }
 addtask unpack after do_fetch
-do_unpack[dirs] = "${WORKDIR}"
+do_unpack[cleandirs] = "${UNPACKDIR}"
-do_unpack[cleandirs] = "${@d.getVar('S') if os.path.normpath(d.getVar('S')) != os.path.normpath(d.getVar('WORKDIR')) else os.path.join('${S}', 'patches')}"
 python base_do_unpack() {
+    import shutil
+    sourcedir = d.getVar('S')
+    # Intentionally keep SOURCE_BASEDIR internal to the task just for SDE
+    d.setVar("SOURCE_BASEDIR", sourcedir)
    src_uri = (d.getVar('SRC_URI') or "").split()
    if not src_uri:
        return
+    basedir = None
+    unpackdir = d.getVar('UNPACKDIR')
+    if sourcedir.startswith(unpackdir):
+        basedir = sourcedir.replace(unpackdir, '').strip("/").split('/')[0]
+        if basedir:
+            d.setVar("SOURCE_BASEDIR", unpackdir + '/' + basedir)
    try:
        fetcher = bb.fetch2.Fetch(src_uri, d)
-        fetcher.unpack(d.getVar('WORKDIR'))
+        fetcher.unpack(d.getVar('UNPACKDIR'))
    except bb.fetch2.BBFetchException as e:
        bb.fatal("Bitbake Fetcher Error: " + repr(e))
 }
@@ -199,8 +227,8 @@ addtask do_deploy_source_date_epoch_setscene
 addtask do_deploy_source_date_epoch before do_configure after do_patch
 python create_source_date_epoch_stamp() {
-    # Version: 1
+    # Version: 2
-    source_date_epoch = oe.reproducible.get_source_date_epoch(d, d.getVar('S'))
+    source_date_epoch = oe.reproducible.get_source_date_epoch(d, d.getVar('SOURCE_BASEDIR') or d.getVar('S'))
    oe.reproducible.epochfile_write(source_date_epoch, d.getVar('SDE_FILE'), d)
 }
 do_unpack[postfuncs] += "create_source_date_epoch_stamp"
@@ -249,10 +277,19 @@ def buildcfg_neededvars(d):
        bb.fatal('The following variable(s) were not set: %s\nPlease set them directly, or choose a MACHINE or DISTRO that sets them.' % ', '.join(pesteruser))
 addhandler base_eventhandler
-base_eventhandler[eventmask] = "bb.event.ConfigParsed bb.event.MultiConfigParsed bb.event.BuildStarted bb.event.RecipePreFinalise bb.event.RecipeParsed"
+base_eventhandler[eventmask] = "bb.event.ConfigParsed bb.event.MultiConfigParsed bb.event.BuildStarted bb.event.RecipePreFinalise bb.event.RecipeParsed bb.event.RecipePreDeferredInherits"
 python base_eventhandler() {
    import bb.runqueue
+    if isinstance(e, bb.event.RecipePreDeferredInherits):
+        # Use this to snoop on class extensions and set these up before the deferred inherits
+        # are processed which allows overrides on conditional variables.
+        for c in ['native', 'nativesdk', 'crosssdk', 'cross']:
+            if c in e.inherits:
+                d.setVar('CLASSOVERRIDE', 'class-' + c)
+                break
+        return
    if isinstance(e, bb.event.ConfigParsed):
        if not d.getVar("NATIVELSBSTRING", False):
            d.setVar("NATIVELSBSTRING", lsb_distro_identifier(d))
@@ -294,16 +331,6 @@ python base_eventhandler() {
        if statusheader:
            bb.plain('\n%s\n%s\n' % (statusheader, '\n'.join(statuslines)))
-    # This code is to silence warnings where the SDK variables overwrite the 
-    # target ones and we'd see duplicate key names overwriting each other
-    # for various PREFERRED_PROVIDERS
-    if isinstance(e, bb.event.RecipePreFinalise):
-        if d.getVar("TARGET_PREFIX") == d.getVar("SDK_PREFIX"):
-            d.delVar("PREFERRED_PROVIDER_virtual/${TARGET_PREFIX}binutils")
-            d.delVar("PREFERRED_PROVIDER_virtual/${TARGET_PREFIX}gcc")
-            d.delVar("PREFERRED_PROVIDER_virtual/${TARGET_PREFIX}g++")
-            d.delVar("PREFERRED_PROVIDER_virtual/${TARGET_PREFIX}compilerlibs")
    if isinstance(e, bb.event.RecipeParsed):
        #
        # If we have multiple providers of virtual/X and a PREFERRED_PROVIDER_virtual/X is set
@@ -312,7 +339,7 @@ python base_eventhandler() {
        # particular.
        #
        pn = d.getVar('PN')
-        source_mirror_fetch = d.getVar('SOURCE_MIRROR_FETCH', False)
+        source_mirror_fetch = bb.utils.to_boolean(d.getVar('SOURCE_MIRROR_FETCH', False))
        if not source_mirror_fetch:
            provs = (d.getVar("PROVIDES") or "").split()
            multiprovidersallowed = (d.getVar("BB_MULTI_PROVIDER_ALLOWED") or "").split()
@@ -410,16 +437,6 @@ python () {
    oe.utils.features_backfill("DISTRO_FEATURES", d)
    oe.utils.features_backfill("MACHINE_FEATURES", d)
-    if d.getVar("S")[-1] == '/':
-        bb.warn("Recipe %s sets S variable with trailing slash '%s', remove it" % (d.getVar("PN"), d.getVar("S")))
-    if d.getVar("B")[-1] == '/':
-        bb.warn("Recipe %s sets B variable with trailing slash '%s', remove it" % (d.getVar("PN"), d.getVar("B")))
-    if os.path.normpath(d.getVar("WORKDIR")) != os.path.normpath(d.getVar("S")):
-        d.appendVar("PSEUDO_IGNORE_PATHS", ",${S}")
-    if os.path.normpath(d.getVar("WORKDIR")) != os.path.normpath(d.getVar("B")):
-        d.appendVar("PSEUDO_IGNORE_PATHS", ",${B}")
    # To add a recipe to the skip list , set:
    #   SKIP_RECIPE[pn] = "message"
    pn = d.getVar('PN')
@@ -463,10 +480,10 @@ python () {
        def appendVar(varname, appends):
            if not appends:
                return
-            if varname.find("DEPENDS") != -1:
+            if "DEPENDS" in varname or varname.startswith("RRECOMMENDS"):
                if bb.data.inherits_class('nativesdk', d) or bb.data.inherits_class('cross-canadian', d) :
                    appends = expandFilter(appends, "", "nativesdk-")
-                elif bb.data.inherits_class('native', d):
+                elif bb.data.inherits_class('native', d) or bb.data.inherits_class('cross', d):
                    appends = expandFilter(appends, "-native", "")
                elif mlprefix:
                    appends = expandFilter(appends, "", mlprefix)
@@ -520,8 +537,8 @@ python () {
        bb.fatal('This recipe does not have the LICENSE field set (%s)' % pn)
    if bb.data.inherits_class('license', d):
-        check_license_format(d)
+        oe.license.check_license_format(d)
-        unmatched_license_flags = check_license_flags(d)
+        unmatched_license_flags = oe.license.check_license_flags(d)
        if unmatched_license_flags:
            for unmatched in unmatched_license_flags:
                message = "Has a restricted license '%s' which is not listed in your LICENSE_FLAGS_ACCEPTED." % unmatched
@@ -545,7 +562,7 @@ python () {
        d.appendVarFlag('do_devshell', 'depends', ' virtual/fakeroot-native:do_populate_sysroot')
    need_machine = d.getVar('COMPATIBLE_MACHINE')
-    if need_machine and not d.getVar('PARSE_ALL_RECIPES', False):
+    if need_machine and not bb.utils.to_boolean(d.getVar('PARSE_ALL_RECIPES', False)):
        import re
        compat_machines = (d.getVar('MACHINEOVERRIDES') or "").split(":")
        for m in compat_machines:
@@ -554,7 +571,8 @@ python () {
        else:
            raise bb.parse.SkipRecipe("incompatible with machine %s (not in COMPATIBLE_MACHINE)" % d.getVar('MACHINE'))
-    source_mirror_fetch = d.getVar('SOURCE_MIRROR_FETCH', False) or d.getVar('PARSE_ALL_RECIPES', False)
+    source_mirror_fetch = bb.utils.to_boolean(d.getVar('SOURCE_MIRROR_FETCH', False)) or \
+            bb.utils.to_boolean(d.getVar('PARSE_ALL_RECIPES', False))
    if not source_mirror_fetch:
        need_host = d.getVar('COMPATIBLE_HOST')
        if need_host:
@@ -565,46 +583,18 @@ python () {
        bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
-        check_license = False if pn.startswith("nativesdk-") else True
+        pkgs = d.getVar('PACKAGES').split()
-        for t in ["-native", "-cross-${TARGET_ARCH}", "-cross-initial-${TARGET_ARCH}",
+        if pkgs:
-              "-crosssdk-${SDK_SYS}", "-crosssdk-initial-${SDK_SYS}",
+            skipped_pkgs = oe.license.skip_incompatible_package_licenses(d, pkgs)
-              "-cross-canadian-${TRANSLATED_TARGET_ARCH}"]:
+            unskipped_pkgs = [p for p in pkgs if p not in skipped_pkgs]
-            if pn.endswith(d.expand(t)):
-                check_license = False
-        if pn.startswith("gcc-source-"):
-            check_license = False
-        if check_license and bad_licenses:
-            bad_licenses = expand_wildcard_licenses(d, bad_licenses)
-            exceptions = (d.getVar("INCOMPATIBLE_LICENSE_EXCEPTIONS") or "").split()
-            for lic_exception in exceptions:
-                if ":" in lic_exception:
-                    lic_exception = lic_exception.split(":")[1]
-                if lic_exception in oe.license.obsolete_license_list():
-                    bb.fatal("Obsolete license %s used in INCOMPATIBLE_LICENSE_EXCEPTIONS" % lic_exception)
-            pkgs = d.getVar('PACKAGES').split()
-            skipped_pkgs = {}
-            unskipped_pkgs = []
-            for pkg in pkgs:
-                remaining_bad_licenses = oe.license.apply_pkg_license_exception(pkg, bad_licenses, exceptions)
-                incompatible_lic = incompatible_license(d, remaining_bad_licenses, pkg)
-                if incompatible_lic:
-                    skipped_pkgs[pkg] = incompatible_lic
-                else:
-                    unskipped_pkgs.append(pkg)
            if unskipped_pkgs:
                for pkg in skipped_pkgs:
                    bb.debug(1, "Skipping the package %s at do_rootfs because of incompatible license(s): %s" % (pkg, ' '.join(skipped_pkgs[pkg])))
-                    d.setVar('_exclude_incompatible-' + pkg, ' '.join(skipped_pkgs[pkg]))
                for pkg in unskipped_pkgs:
                    bb.debug(1, "Including the package %s" % pkg)
            else:
-                incompatible_lic = incompatible_license(d, bad_licenses)
+                incompatible_lic = oe.license.incompatible_license(d, bad_licenses)
                for pkg in skipped_pkgs:
                    incompatible_lic += skipped_pkgs[pkg]
                incompatible_lic = sorted(list(set(incompatible_lic)))
@@ -674,9 +664,9 @@ python () {
        elif path.endswith('.deb'):
            d.appendVarFlag('do_unpack', 'depends', ' xz-native:do_populate_sysroot')
-        # *.7z should DEPEND on p7zip-native for unpacking
+        # *.7z should DEPEND on 7zip-native for unpacking
        elif path.endswith('.7z'):
-            d.appendVarFlag('do_unpack', 'depends', ' p7zip-native:do_populate_sysroot')
+            d.appendVarFlag('do_unpack', 'depends', ' 7zip-native:do_populate_sysroot')
    set_packagetriplet(d)
diff --git a/meta/classes-global/buildstats.bbclass b/meta/classes-global/buildstats.bbclass
index f49a67aa4f..fe64789e10 100644
--- a/meta/classes-global/buildstats.bbclass
+++ b/meta/classes-global/buildstats.bbclass
@@ -188,14 +188,17 @@ python run_buildstats () {
    # bitbake fires HeartbeatEvent even before a build has been
    # triggered, causing BUILDNAME to be None
    ########################################################################
-    if bn is not None:
+    if bn is None:
-        bsdir = os.path.join(d.getVar('BUILDSTATS_BASE'), bn)
+        return
-        taskdir = os.path.join(bsdir, d.getVar('PF'))
-        if isinstance(e, bb.event.HeartbeatEvent) and bb.utils.to_boolean(d.getVar("BB_LOG_HOST_STAT_ON_INTERVAL")):
+    bsdir = os.path.join(d.getVar('BUILDSTATS_BASE'), bn)
+    taskdir = os.path.join(bsdir, d.getVar('PF'))
+    if isinstance(e, bb.event.HeartbeatEvent):
+        if bb.utils.to_boolean(d.getVar("BB_LOG_HOST_STAT_ON_INTERVAL")):
            bb.utils.mkdirhier(bsdir)
            write_host_data(os.path.join(bsdir, "host_stats_interval"), e, d, "interval")
-    if isinstance(e, bb.event.BuildStarted):
+    elif isinstance(e, bb.event.BuildStarted):
        ########################################################################
        # If the kernel was not configured to provide I/O statistics, issue
        # a one time warning.
@@ -234,7 +237,7 @@ python run_buildstats () {
                if cpu:
                    f.write("CPU usage: %0.1f%% \n" % cpu)
-    if isinstance(e, bb.build.TaskStarted):
+    elif isinstance(e, bb.build.TaskStarted):
        set_timedata("__timedata_task", d, e.time)
        bb.utils.mkdirhier(taskdir)
        # write into the task event file the name and start time
@@ -276,7 +279,7 @@ addhandler run_buildstats
 run_buildstats[eventmask] = "bb.event.BuildStarted bb.event.BuildCompleted bb.event.HeartbeatEvent bb.build.TaskStarted bb.build.TaskSucceeded bb.build.TaskFailed"
 python runqueue_stats () {
-    import buildstats
+    import oe.buildstats
    from bb import event, runqueue
    # We should not record any samples before the first task has started,
    # because that's the first activity shown in the process chart.
@@ -286,7 +289,7 @@ python runqueue_stats () {
    # closed when the build is done.
    system_stats = d.getVar('_buildstats_system_stats', False)
    if not system_stats and isinstance(e, (bb.runqueue.sceneQueueTaskStarted, bb.runqueue.runQueueTaskStarted)):
-        system_stats = buildstats.SystemStats(d)
+        system_stats = oe.buildstats.SystemStats(d)
        d.setVar('_buildstats_system_stats', system_stats)
    if system_stats:
        # Ensure that we sample at important events.
diff --git a/meta/classes-global/insane.bbclass b/meta/classes-global/insane.bbclass
index e963001d09..4ef664b3ce 100644
--- a/meta/classes-global/insane.bbclass
+++ b/meta/classes-global/insane.bbclass
@@ -24,41 +24,36 @@
 #   files under exec_prefix
 #  -Check if the package name is upper case
+# These tests are required to be enabled and pass for Yocto Project Compatible Status
+# for a layer. To change this list, please contact the Yocto Project TSC.
+CHECKLAYER_REQUIRED_TESTS = "\
+    configure-gettext configure-unsafe debug-files dep-cmp expanded-d files-invalid \
+    host-user-contaminated incompatible-license infodir installed-vs-shipped invalid-chars \
+    invalid-packageconfig la \
+    license-checksum license-exception license-exists license-file-missing license-format license-no-generic license-syntax \
+    mime mime-xdg missing-update-alternatives multilib obsolete-license \
+    packages-list patch-fuzz patch-status perllocalpod perm-config perm-line perm-link recipe-naming \
+    pkgconfig pkgvarcheck pkgv-undefined pn-overrides shebang-size src-uri-bad symlink-to-sysroot \
+    unhandled-features-check unknown-configure-option unlisted-pkg-lics uppercase-pn useless-rpaths \
+    var-undefined virtual-slash xorg-driver-abi"
 # Elect whether a given type of error is a warning or error, they may
 # have been set by other files.
-WARN_QA ?= " libdir xorg-driver-abi buildpaths \
+WARN_QA ?= "32bit-time native-last pep517-backend"
-            textrel incompatible-license files-invalid \
+ERROR_QA ?= "\
-            infodir build-deps src-uri-bad symlink-to-sysroot multilib \
+    already-stripped arch buildpaths build-deps debug-deps dev-deps dev-elf dev-so empty-dirs file-rdeps \
-            invalid-packageconfig host-user-contaminated uppercase-pn \
+    ldflags libdir missing-ptest rpaths staticdev textrel version-going-backwards \
-            mime mime-xdg unlisted-pkg-lics unhandled-features-check \
+    ${CHECKLAYER_REQUIRED_TESTS}"
-            missing-update-alternatives native-last missing-ptest \
-            license-exists license-no-generic license-syntax license-format \
-            license-incompatible license-file-missing obsolete-license \
-            32bit-time virtual-slash \
-            "
-ERROR_QA ?= "dev-so debug-deps dev-deps debug-files arch pkgconfig la \
-            perms dep-cmp pkgvarcheck perm-config perm-line perm-link \
-            split-strip packages-list pkgv-undefined var-undefined \
-            version-going-backwards expanded-d invalid-chars \
-            license-checksum dev-elf file-rdeps configure-unsafe \
-            configure-gettext perllocalpod shebang-size \
-            already-stripped installed-vs-shipped ldflags compile-host-path \
-            install-host-path pn-overrides unknown-configure-option \
-            useless-rpaths rpaths staticdev empty-dirs \
-            patch-fuzz \
-            "
 # Add usrmerge QA check based on distro feature
 ERROR_QA:append = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', ' usrmerge', '', d)}"
-ERROR_QA:append:layer-core = " patch-status"
 WARN_QA:append:layer-core = " missing-metadata missing-maintainer"
 FAKEROOT_QA = "host-user-contaminated"
 FAKEROOT_QA[doc] = "QA tests which need to run under fakeroot. If any \
 enabled tests are listed here, the do_package_qa task will run under fakeroot."
-ALL_QA = "${WARN_QA} ${ERROR_QA}"
+UNKNOWN_CONFIGURE_OPT_IGNORE ?= "--enable-nls --disable-nls --disable-silent-rules --disable-dependency-tracking --disable-static"
-UNKNOWN_CONFIGURE_OPT_IGNORE ?= "--enable-nls --disable-nls --disable-silent-rules --disable-dependency-tracking --with-libtool-sysroot --disable-static"
 # This is a list of directories that are expected to be empty.
 QA_EMPTY_DIRS ?= " \
@@ -85,9 +80,10 @@ def package_qa_clean_path(path, d, pkg=None):
    return path.replace(d.getVar("TMPDIR"), "/").replace("//", "/")
 QAPATHTEST[shebang-size] = "package_qa_check_shebang_size"
-def package_qa_check_shebang_size(path, name, d, elf, messages):
+def package_qa_check_shebang_size(path, name, d, elf):
-    import stat
+    global cpath
-    if os.path.islink(path) or stat.S_ISFIFO(os.stat(path).st_mode) or elf:
+    if elf or cpath.islink(path) or not cpath.isfile(path):
        return
    try:
@@ -104,50 +100,44 @@ def package_qa_check_shebang_size(path, name, d, elf, messages):
            return
        if len(stanza) > 129:
-            oe.qa.add_message(messages, "shebang-size", "%s: %s maximum shebang size exceeded, the maximum size is 128." % (name, package_qa_clean_path(path, d, name)))
+            oe.qa.handle_error("shebang-size", "%s: %s maximum shebang size exceeded, the maximum size is 128." % (name, package_qa_clean_path(path, d, name)), d)
            return
 QAPATHTEST[libexec] = "package_qa_check_libexec"
-def package_qa_check_libexec(path,name, d, elf, messages):
+def package_qa_check_libexec(path,name, d, elf):
    # Skip the case where the default is explicitly /usr/libexec
    libexec = d.getVar('libexecdir')
    if libexec == "/usr/libexec":
-        return True
+        return
    if 'libexec' in path.split(os.path.sep):
-        oe.qa.add_message(messages, "libexec", "%s: %s is using libexec please relocate to %s" % (name, package_qa_clean_path(path, d, name), libexec))
+        oe.qa.handle_error("libexec", "%s: %s is using libexec please relocate to %s" % (name, package_qa_clean_path(path, d, name), libexec), d)
-        return False
-    return True
 QAPATHTEST[rpaths] = "package_qa_check_rpath"
-def package_qa_check_rpath(file,name, d, elf, messages):
+def package_qa_check_rpath(file, name, d, elf):
    """
    Check for dangerous RPATHs
    """
    if not elf:
        return
-    if os.path.islink(file):
-        return
    bad_dirs = [d.getVar('BASE_WORKDIR'), d.getVar('STAGING_DIR_TARGET')]
    phdrs = elf.run_objdump("-p", d)
    import re
-    rpath_re = re.compile(r"\s+RPATH\s+(.*)")
+    rpath_re = re.compile(r"\s+(?:RPATH|RUNPATH)\s+(.*)")
    for line in phdrs.split("\n"):
        m = rpath_re.match(line)
        if m:
            rpath = m.group(1)
            for dir in bad_dirs:
                if dir in rpath:
-                    oe.qa.add_message(messages, "rpaths", "package %s contains bad RPATH %s in file %s" % (name, rpath, file))
+                    oe.qa.handle_error("rpaths", "%s: %s contains bad RPATH %s" % (name, package_qa_clean_path(file, d, name), rpath), d)
 QAPATHTEST[useless-rpaths] = "package_qa_check_useless_rpaths"
-def package_qa_check_useless_rpaths(file, name, d, elf, messages):
+def package_qa_check_useless_rpaths(file, name, d, elf):
    """
    Check for RPATHs that are useless but not dangerous
    """
@@ -157,16 +147,13 @@ def package_qa_check_useless_rpaths(file, name, d, elf, messages):
    if not elf:
        return
-    if os.path.islink(file):
-        return
    libdir = d.getVar("libdir")
    base_libdir = d.getVar("base_libdir")
    phdrs = elf.run_objdump("-p", d)
    import re
-    rpath_re = re.compile(r"\s+RPATH\s+(.*)")
+    rpath_re = re.compile(r"\s+(?:RPATH|RUNPATH)\s+(.*)")
    for line in phdrs.split("\n"):
        m = rpath_re.match(line)
        if m:
@@ -174,31 +161,32 @@ def package_qa_check_useless_rpaths(file, name, d, elf, messages):
            if rpath_eq(rpath, libdir) or rpath_eq(rpath, base_libdir):
                # The dynamic linker searches both these places anyway.  There is no point in
                # looking there again.
-                oe.qa.add_message(messages, "useless-rpaths", "%s: %s contains probably-redundant RPATH %s" % (name, package_qa_clean_path(file, d, name), rpath))
+                oe.qa.handle_error("useless-rpaths", "%s: %s contains probably-redundant RPATH %s" % (name, package_qa_clean_path(file, d, name), rpath), d)
 QAPATHTEST[dev-so] = "package_qa_check_dev"
-def package_qa_check_dev(path, name, d, elf, messages):
+def package_qa_check_dev(path, name, d, elf):
    """
    Check for ".so" library symlinks in non-dev packages
    """
+    global cpath
-    if not name.endswith("-dev") and not name.endswith("-dbg") and not name.endswith("-ptest") and not name.startswith("nativesdk-") and path.endswith(".so") and os.path.islink(path):
+    if not name.endswith("-dev") and not name.endswith("-dbg") and not name.endswith("-ptest") and not name.startswith("nativesdk-") and path.endswith(".so") and cpath.islink(path):
-        oe.qa.add_message(messages, "dev-so", "non -dev/-dbg/nativesdk- package %s contains symlink .so '%s'" % \
+        oe.qa.handle_error("dev-so", "non -dev/-dbg/nativesdk- package %s contains symlink .so '%s'" % \
-                 (name, package_qa_clean_path(path, d, name)))
+                 (name, package_qa_clean_path(path, d, name)), d)
 QAPATHTEST[dev-elf] = "package_qa_check_dev_elf"
-def package_qa_check_dev_elf(path, name, d, elf, messages):
+def package_qa_check_dev_elf(path, name, d, elf):
    """
    Check that -dev doesn't contain real shared libraries.  The test has to
    check that the file is not a link and is an ELF object as some recipes
    install link-time .so files that are linker scripts.
    """
-    if name.endswith("-dev") and path.endswith(".so") and not os.path.islink(path) and elf:
+    global cpath
-        oe.qa.add_message(messages, "dev-elf", "-dev package %s contains non-symlink .so '%s'" % \
+    if name.endswith("-dev") and path.endswith(".so") and not cpath.islink(path) and elf:
-                 (name, package_qa_clean_path(path, d, name)))
+        oe.qa.handle_error("dev-elf", "-dev package %s contains non-symlink .so '%s'" % \
+                 (name, package_qa_clean_path(path, d, name)), d)
 QAPATHTEST[staticdev] = "package_qa_check_staticdev"
-def package_qa_check_staticdev(path, name, d, elf, messages):
+def package_qa_check_staticdev(path, name, d, elf):
    """
    Check for ".a" library in non-staticdev packages
    There are a number of exceptions to this rule, -pic packages can contain
@@ -207,22 +195,22 @@ def package_qa_check_staticdev(path, name, d, elf, messages):
    """
    if not name.endswith("-pic") and not name.endswith("-staticdev") and not name.endswith("-ptest") and path.endswith(".a") and not path.endswith("_nonshared.a") and not '/usr/lib/debug-static/' in path and not '/.debug-static/' in path:
-        oe.qa.add_message(messages, "staticdev", "non -staticdev package contains static .a library: %s path '%s'" % \
+        oe.qa.handle_error("staticdev", "non -staticdev package contains static .a library: %s path '%s'" % \
-                 (name, package_qa_clean_path(path, d, name)))
+                 (name, package_qa_clean_path(path, d, name)), d)
 QAPATHTEST[mime] = "package_qa_check_mime"
-def package_qa_check_mime(path, name, d, elf, messages):
+def package_qa_check_mime(path, name, d, elf):
    """
    Check if package installs mime types to /usr/share/mime/packages
    while no inheriting mime.bbclass
    """
    if d.getVar("datadir") + "/mime/packages" in path and path.endswith('.xml') and not bb.data.inherits_class("mime", d):
-        oe.qa.add_message(messages, "mime", "package contains mime types but does not inherit mime: %s path '%s'" % \
+        oe.qa.handle_error("mime", "package contains mime types but does not inherit mime: %s path '%s'" % \
-                 (name, package_qa_clean_path(path, d, name)))
+                 (name, package_qa_clean_path(path, d, name)), d)
 QAPATHTEST[mime-xdg] = "package_qa_check_mime_xdg"
-def package_qa_check_mime_xdg(path, name, d, elf, messages):
+def package_qa_check_mime_xdg(path, name, d, elf):
    """
    Check if package installs desktop file containing MimeType and requires
    mime-types.bbclass to create /usr/share/applications/mimeinfo.cache
@@ -245,10 +233,10 @@ def package_qa_check_mime_xdg(path, name, d, elf, messages):
            if name == d.getVar('PN'):
                pkgname = '${PN}'
            wstr += "If yes: add \'inhert mime-xdg\' and \'MIME_XDG_PACKAGES += \"%s\"\' / if no add \'INSANE_SKIP:%s += \"mime-xdg\"\' to recipe." % (pkgname, pkgname)
-            oe.qa.add_message(messages, "mime-xdg", wstr)
+            oe.qa.handle_error("mime-xdg", wstr, d)
        if mime_type_found:
-            oe.qa.add_message(messages, "mime-xdg", "%s: contains desktop file with key 'MimeType' but does not inhert mime-xdg: %s" % \
+            oe.qa.handle_error("mime-xdg", "%s: contains desktop file with key 'MimeType' but does not inhert mime-xdg: %s" % \
-                    (name, package_qa_clean_path(path, d, name)))
+                    (name, package_qa_clean_path(path, d, name)), d)
 def package_qa_check_libdir(d):
    """
@@ -298,7 +286,7 @@ def package_qa_check_libdir(d):
                        try:
                            elf.open()
                            messages.append("%s: found library in wrong location: %s" % (package, rel_path))
-                        except (oe.qa.NotELFFileError):
+                        except (oe.qa.NotELFFileError, FileNotFoundError):
                            pass
                if exec_re.match(rel_path):
                    if libdir not in rel_path and libexecdir not in rel_path:
@@ -307,25 +295,25 @@ def package_qa_check_libdir(d):
                        try:
                            elf.open()
                            messages.append("%s: found library in wrong location: %s" % (package, rel_path))
-                        except (oe.qa.NotELFFileError):
+                        except (oe.qa.NotELFFileError, FileNotFoundError):
                            pass
    if messages:
        oe.qa.handle_error("libdir", "\n".join(messages), d)
 QAPATHTEST[debug-files] = "package_qa_check_dbg"
-def package_qa_check_dbg(path, name, d, elf, messages):
+def package_qa_check_dbg(path, name, d, elf):
    """
    Check for ".debug" files or directories outside of the dbg package
    """
    if not "-dbg" in name and not "-ptest" in name:
        if '.debug' in path.split(os.path.sep):
-            oe.qa.add_message(messages, "debug-files", "%s: non debug package contains .debug directory %s" % \
+            oe.qa.handle_error("debug-files", "%s: non debug package contains .debug directory %s" % \
-                     (name, package_qa_clean_path(path, d, name)))
+                     (name, package_qa_clean_path(path, d, name)), d)
 QAPATHTEST[arch] = "package_qa_check_arch"
-def package_qa_check_arch(path,name,d, elf, messages):
+def package_qa_check_arch(path,name,d, elf):
    """
    Check if archs are compatible
    """
@@ -334,47 +322,47 @@ def package_qa_check_arch(path,name,d, elf, messages):
    if not elf:
        return
-    target_os   = d.getVar('HOST_OS')
+    host_os   = d.getVar('HOST_OS')
-    target_arch = d.getVar('HOST_ARCH')
+    host_arch = d.getVar('HOST_ARCH')
-    provides = d.getVar('PROVIDES')
+    provides  = d.getVar('PROVIDES')
-    bpn = d.getVar('BPN')
-    if target_arch == "allarch":
+    if host_arch == "allarch":
-        pn = d.getVar('PN')
+        oe.qa.handle_error("arch", "%s: inherits the allarch class, but has architecture-specific binaries %s" % \
-        oe.qa.add_message(messages, "arch", pn + ": Recipe inherits the allarch class, but has packaged architecture-specific binaries")
+            (name, package_qa_clean_path(path, d, name)), d)
        return
-    # FIXME: Cross package confuse this check, so just skip them
+    # If this throws an exception, the machine_dict needs expanding
-    for s in ['cross', 'nativesdk', 'cross-canadian']:
+    (expected_machine, expected_osabi, expected_abiversion, expected_littleendian, expected_bits) \
-        if bb.data.inherits_class(s, d):
+        = oe.elf.machine_dict(d)[host_os][host_arch]
-            return
+    actual_machine = elf.machine()
+    actual_bits = elf.abiSize()
+    actual_littleendian = elf.isLittleEndian()
-    # avoid following links to /usr/bin (e.g. on udev builds)
+    # BPF don't match the target
-    # we will check the files pointed to anyway...
+    if oe.qa.elf_machine_to_string(actual_machine) == "BPF":
-    if os.path.islink(path):
        return
-    #if this will throw an exception, then fix the dict above
+    # These targets have 32-bit userspace but 64-bit kernel, so fudge the expected values
-    (machine, osabi, abiversion, littleendian, bits) \
+    if (("virtual/kernel" in provides) or bb.data.inherits_class("module", d)) and (host_os in ("linux-gnux32", "linux-muslx32", "linux-gnu_ilp32") or re.match(r'mips64.*32', d.getVar('DEFAULTTUNE'))):
-        = oe.elf.machine_dict(d)[target_os][target_arch]
+        expected_bits = 64
    # Check the architecture and endiannes of the binary
-    is_32 = (("virtual/kernel" in provides) or bb.data.inherits_class("module", d)) and \
+    if expected_machine != actual_machine:
-            (target_os == "linux-gnux32" or target_os == "linux-muslx32" or \
+        oe.qa.handle_error("arch", "Architecture did not match (%s, expected %s) in %s" % \
-            target_os == "linux-gnu_ilp32" or re.match(r'mips64.*32', d.getVar('DEFAULTTUNE')))
+                 (oe.qa.elf_machine_to_string(actual_machine), oe.qa.elf_machine_to_string(expected_machine), package_qa_clean_path(path, d, name)), d)
-    is_bpf = (oe.qa.elf_machine_to_string(elf.machine()) == "BPF")
-    if not ((machine == elf.machine()) or is_32 or is_bpf):
+    if expected_bits != actual_bits:
-        oe.qa.add_message(messages, "arch", "Architecture did not match (%s, expected %s) in %s" % \
+        oe.qa.handle_error("arch", "Bit size did not match (%d, expected %d) in %s" % \
-                 (oe.qa.elf_machine_to_string(elf.machine()), oe.qa.elf_machine_to_string(machine), package_qa_clean_path(path, d, name)))
+                 (actual_bits, expected_bits, package_qa_clean_path(path, d, name)), d)
-    elif not ((bits == elf.abiSize()) or is_32 or is_bpf):
-        oe.qa.add_message(messages, "arch", "Bit size did not match (%d, expected %d) in %s" % \
+    if expected_littleendian != actual_littleendian:
-                 (elf.abiSize(), bits, package_qa_clean_path(path, d, name)))
+        oe.qa.handle_error("arch", "Endiannes did not match (%d, expected %d) in %s" % \
-    elif not ((littleendian == elf.isLittleEndian()) or is_bpf):
+                 (actual_littleendian, expected_littleendian, package_qa_clean_path(path, d, name)), d)
-        oe.qa.add_message(messages, "arch", "Endiannes did not match (%d, expected %d) in %s" % \
+package_qa_check_arch[vardepsexclude] = "DEFAULTTUNE"
-                 (elf.isLittleEndian(), littleendian, package_qa_clean_path(path, d, name)))
 QAPATHTEST[desktop] = "package_qa_check_desktop"
-def package_qa_check_desktop(path, name, d, elf, messages):
+def package_qa_check_desktop(path, name, d, elf):
    """
    Run all desktop files through desktop-file-validate.
    """
@@ -383,10 +371,10 @@ def package_qa_check_desktop(path, name, d, elf, messages):
        output = os.popen("%s %s" % (desktop_file_validate, path))
        # This only produces output on errors
        for l in output:
-            oe.qa.add_message(messages, "desktop", "Desktop file issue: " + l.strip())
+            oe.qa.handle_error("desktop", "Desktop file issue: " + l.strip(), d)
 QAPATHTEST[textrel] = "package_qa_textrel"
-def package_qa_textrel(path, name, d, elf, messages):
+def package_qa_textrel(path, name, d, elf):
    """
    Check if the binary contains relocations in .text
    """
@@ -394,25 +382,18 @@ def package_qa_textrel(path, name, d, elf, messages):
    if not elf:
        return
-    if os.path.islink(path):
-        return
    phdrs = elf.run_objdump("-p", d)
-    sane = True
    import re
    textrel_re = re.compile(r"\s+TEXTREL\s+")
    for line in phdrs.split("\n"):
        if textrel_re.match(line):
-            sane = False
+            path = package_qa_clean_path(path, d, name)
-            break
+            oe.qa.handle_error("textrel", "%s: ELF binary %s has relocations in .text" % (name, path), d)
+            return
-    if not sane:
-        path = package_qa_clean_path(path, d, name)
-        oe.qa.add_message(messages, "textrel", "%s: ELF binary %s has relocations in .text" % (name, path))
 QAPATHTEST[ldflags] = "package_qa_hash_style"
-def package_qa_hash_style(path, name, d, elf, messages):
+def package_qa_hash_style(path, name, d, elf):
    """
    Check if the binary has the right hash style...
    """
@@ -420,9 +401,6 @@ def package_qa_hash_style(path, name, d, elf, messages):
    if not elf:
        return
-    if os.path.islink(path):
-        return
    gnu_hash = "--hash-style=gnu" in d.getVar('LDFLAGS')
    if not gnu_hash:
        gnu_hash = "--hash-style=both" in d.getVar('LDFLAGS')
@@ -444,17 +422,17 @@ def package_qa_hash_style(path, name, d, elf, messages):
            sane = True
    if has_syms and not sane:
        path = package_qa_clean_path(path, d, name)
-        oe.qa.add_message(messages, "ldflags", "File %s in package %s doesn't have GNU_HASH (didn't pass LDFLAGS?)" % (path, name))
+        oe.qa.handle_error("ldflags", "File %s in package %s doesn't have GNU_HASH (didn't pass LDFLAGS?)" % (path, name), d)
+package_qa_hash_style[vardepsexclude] = "TCLIBC"
 QAPATHTEST[buildpaths] = "package_qa_check_buildpaths"
-def package_qa_check_buildpaths(path, name, d, elf, messages):
+def package_qa_check_buildpaths(path, name, d, elf):
    """
    Check for build paths inside target files and error if paths are not
    explicitly ignored.
    """
    import stat
    # Ignore symlinks/devs/fifos
    mode = os.lstat(path).st_mode
    if stat.S_ISLNK(mode) or stat.S_ISBLK(mode) or stat.S_ISFIFO(mode) or stat.S_ISCHR(mode) or stat.S_ISSOCK(mode):
@@ -464,12 +442,12 @@ def package_qa_check_buildpaths(path, name, d, elf, messages):
    with open(path, 'rb') as f:
        file_content = f.read()
        if tmpdir in file_content:
-            trimmed = path.replace(os.path.join (d.getVar("PKGDEST"), name), "")
+            path = package_qa_clean_path(path, d, name)
-            oe.qa.add_message(messages, "buildpaths", "File %s in package %s contains reference to TMPDIR" % (trimmed, name))
+            oe.qa.handle_error("buildpaths", "File %s in package %s contains reference to TMPDIR" % (path, name), d)
 QAPATHTEST[xorg-driver-abi] = "package_qa_check_xorg_driver_abi"
-def package_qa_check_xorg_driver_abi(path, name, d, elf, messages):
+def package_qa_check_xorg_driver_abi(path, name, d, elf):
    """
    Check that all packages containing Xorg drivers have ABI dependencies
    """
@@ -484,33 +462,34 @@ def package_qa_check_xorg_driver_abi(path, name, d, elf, messages):
        for rdep in bb.utils.explode_deps(d.getVar('RDEPENDS:' + name) or ""):
            if rdep.startswith("%sxorg-abi-" % mlprefix):
                return
-        oe.qa.add_message(messages, "xorg-driver-abi", "Package %s contains Xorg driver (%s) but no xorg-abi- dependencies" % (name, os.path.basename(path)))
+        oe.qa.handle_error("xorg-driver-abi", "Package %s contains Xorg driver (%s) but no xorg-abi- dependencies" % (name, os.path.basename(path)), d)
 QAPATHTEST[infodir] = "package_qa_check_infodir"
-def package_qa_check_infodir(path, name, d, elf, messages):
+def package_qa_check_infodir(path, name, d, elf):
    """
    Check that /usr/share/info/dir isn't shipped in a particular package
    """
    infodir = d.expand("${infodir}/dir")
    if infodir in path:
-        oe.qa.add_message(messages, "infodir", "The /usr/share/info/dir file is not meant to be shipped in a particular package.")
+        oe.qa.handle_error("infodir", "The %s file is not meant to be shipped in a particular package." % infodir, d)
 QAPATHTEST[symlink-to-sysroot] = "package_qa_check_symlink_to_sysroot"
-def package_qa_check_symlink_to_sysroot(path, name, d, elf, messages):
+def package_qa_check_symlink_to_sysroot(path, name, d, elf):
    """
    Check that the package doesn't contain any absolute symlinks to the sysroot.
    """
-    if os.path.islink(path):
+    global cpath
+    if cpath.islink(path):
        target = os.readlink(path)
        if os.path.isabs(target):
            tmpdir = d.getVar('TMPDIR')
            if target.startswith(tmpdir):
-                trimmed = path.replace(os.path.join (d.getVar("PKGDEST"), name), "")
+                path = package_qa_clean_path(path, d, name)
-                oe.qa.add_message(messages, "symlink-to-sysroot", "Symlink %s in %s points to TMPDIR" % (trimmed, name))
+                oe.qa.handle_error("symlink-to-sysroot", "Symlink %s in %s points to TMPDIR" % (path, name), d)
 QAPATHTEST[32bit-time] = "check_32bit_symbols"
-def check_32bit_symbols(path, packagename, d, elf, messages):
+def check_32bit_symbols(path, packagename, d, elf):
    """
    Check that ELF files do not use any 32 bit time APIs from glibc.
    """
@@ -615,7 +594,7 @@ def check_32bit_symbols(path, packagename, d, elf, messages):
    )
    # elf is a oe.qa.ELFFile object
-    if elf is not None:
+    if elf:
        phdrs = elf.run_objdump("-tw", d)
        syms = re.finditer(ptrn, phdrs)
        usedapis = {sym.group('notag') for sym in syms}
@@ -629,11 +608,9 @@ def check_32bit_symbols(path, packagename, d, elf, messages):
            if not allowed:
                msgformat = elfpath + " uses 32-bit api '%s'"
                for sym in usedapis:
-                    oe.qa.add_message(messages, '32bit-time', msgformat % sym)
+                    oe.qa.handle_error('32bit-time', msgformat % sym, d)
-                oe.qa.add_message(
+                oe.qa.handle_error('32bit-time', 'Suppress with INSANE_SKIP = "32bit-time"', d)
-                    messages, '32bit-time',
+check_32bit_symbols[vardepsexclude] = "OVERRIDES"
-                    'Suppress with INSANE_SKIP = "32bit-time"'
-                )
 # Check license variables
 do_populate_lic[postfuncs] += "populate_lic_qa_checksum"
@@ -794,62 +771,19 @@ def qa_check_staged(path,d):
                        oe.qa.handle_error("pkgconfig", error_msg, d)
            if not skip_shebang_size:
-                errors = {}
+                global cpath
-                package_qa_check_shebang_size(path, "", d, None, errors)
+                cpath = oe.cachedpath.CachedPath()
-                for e in errors:
+                package_qa_check_shebang_size(path, "", d, None)
-                    oe.qa.handle_error(e, errors[e], d)
+                cpath = None
-# Run all package-wide warnfuncs and errorfuncs
-def package_qa_package(warnfuncs, errorfuncs, package, d):
-    warnings = {}
-    errors = {}
-    for func in warnfuncs:
-        func(package, d, warnings)
-    for func in errorfuncs:
-        func(package, d, errors)
-    for w in warnings:
-        oe.qa.handle_error(w, warnings[w], d)
-    for e in errors:
-        oe.qa.handle_error(e, errors[e], d)
-    return len(errors) == 0
-# Run all recipe-wide warnfuncs and errorfuncs
-def package_qa_recipe(warnfuncs, errorfuncs, pn, d):
-    warnings = {}
-    errors = {}
-    for func in warnfuncs:
-        func(pn, d, warnings)
-    for func in errorfuncs:
-        func(pn, d, errors)
-    for w in warnings:
-        oe.qa.handle_error(w, warnings[w], d)
-    for e in errors:
-        oe.qa.handle_error(e, errors[e], d)
-    return len(errors) == 0
-def prepopulate_objdump_p(elf, d):
-    output = elf.run_objdump("-p", d)
-    return (elf.name, output)
 # Walk over all files in a directory and call func
-def package_qa_walk(warnfuncs, errorfuncs, package, d):
+def package_qa_walk(checkfuncs, package, d):
-    #if this will throw an exception, then fix the dict above
+    global cpath
-    target_os   = d.getVar('HOST_OS')
-    target_arch = d.getVar('HOST_ARCH')
-    warnings = {}
-    errors = {}
    elves = {}
    for path in pkgfiles[package]:
            elf = None
-            if os.path.isfile(path):
+            if cpath.isfile(path) and not cpath.islink(path):
                elf = oe.qa.ELFFile(path)
                try:
                    elf.open()
@@ -859,24 +793,22 @@ def package_qa_walk(warnfuncs, errorfuncs, package, d):
            if elf:
                elves[path] = elf
+    def prepopulate_objdump_p(elf, d):
+        output = elf.run_objdump("-p", d)
+        return (elf.name, output)
    results = oe.utils.multiprocess_launch(prepopulate_objdump_p, elves.values(), d, extraargs=(d,))
    for item in results:
        elves[item[0]].set_objdump("-p", item[1])
    for path in pkgfiles[package]:
-            if path in elves:
+        elf = elves.get(path)
-                elves[path].open()
+        if elf:
-            for func in warnfuncs:
+            elf.open()
-                func(path, package, d, elves.get(path), warnings)
+        for func in checkfuncs:
-            for func in errorfuncs:
+            func(path, package, d, elf)
-                func(path, package, d, elves.get(path), errors)
+        if elf:
-            if path in elves:
+            elf.close()
-                elves[path].close()
-    for w in warnings:
-        oe.qa.handle_error(w, warnings[w], d)
-    for e in errors:
-        oe.qa.handle_error(e, errors[e], d)
 def package_qa_check_rdepends(pkg, pkgdest, skip, taskdeps, packages, d):
    # Don't do this check for kernel/module recipes, there aren't too many debug/development
@@ -893,25 +825,30 @@ def package_qa_check_rdepends(pkg, pkgdest, skip, taskdeps, packages, d):
        # Now do the sanity check!!!
        if "build-deps" not in skip:
+            def check_rdep(rdep_data, possible_pn):
+                if rdep_data and "PN" in rdep_data:
+                    possible_pn.add(rdep_data["PN"])
+                    return rdep_data["PN"] in taskdeps
+                return False
            for rdepend in rdepends:
-                if "-dbg" in rdepend and "debug-deps" not in skip:
+                if rdepend.endswith("-dbg") and "debug-deps" not in skip:
                    error_msg = "%s rdepends on %s" % (pkg,rdepend)
                    oe.qa.handle_error("debug-deps", error_msg, d)
                if (not "-dev" in pkg and not "-staticdev" in pkg) and rdepend.endswith("-dev") and "dev-deps" not in skip:
                    error_msg = "%s rdepends on %s" % (pkg, rdepend)
                    oe.qa.handle_error("dev-deps", error_msg, d)
                if rdepend not in packages:
+                    possible_pn = set()
                    rdep_data = oe.packagedata.read_subpkgdata(rdepend, d)
-                    if rdep_data and 'PN' in rdep_data and rdep_data['PN'] in taskdeps:
+                    if check_rdep(rdep_data, possible_pn):
                        continue
-                    if not rdep_data or not 'PN' in rdep_data:
-                        for _, rdep_data in oe.packagedata.foreach_runtime_provider_pkgdata(d, rdepend):
+                    if any(check_rdep(rdep_data, possible_pn) for _, rdep_data in  oe.packagedata.foreach_runtime_provider_pkgdata(d, rdepend)):
-                            if rdep_data and 'PN' in rdep_data and rdep_data['PN'] in taskdeps:
-                                break
-                    if rdep_data and 'PN' in rdep_data and rdep_data['PN'] in taskdeps:
                        continue
-                    if rdep_data and 'PN' in rdep_data:
-                        error_msg = "%s rdepends on %s, but it isn't a build dependency, missing %s in DEPENDS or PACKAGECONFIG?" % (pkg, rdepend, rdep_data['PN'])
+                    if possible_pn:
+                        error_msg = "%s rdepends on %s, but it isn't a build dependency, missing one of %s in DEPENDS or PACKAGECONFIG?" % (pkg, rdepend, ", ".join(possible_pn))
                    else:
                        error_msg = "%s rdepends on %s, but it isn't a build dependency?" % (pkg, rdepend)
                    oe.qa.handle_error("build-deps", error_msg, d)
@@ -998,20 +935,19 @@ def package_qa_check_deps(pkg, pkgdest, d):
    check_valid_deps('RCONFLICTS')
 QAPKGTEST[usrmerge] = "package_qa_check_usrmerge"
-def package_qa_check_usrmerge(pkg, d, messages):
+def package_qa_check_usrmerge(pkg, d):
+    global cpath
    pkgdest = d.getVar('PKGDEST')
    pkg_dir = pkgdest + os.sep + pkg + os.sep
    merged_dirs = ['bin', 'sbin', 'lib'] + d.getVar('MULTILIB_VARIANTS').split()
    for f in merged_dirs:
-        if os.path.exists(pkg_dir + f) and not os.path.islink(pkg_dir + f):
+        if cpath.exists(pkg_dir + f) and not cpath.islink(pkg_dir + f):
            msg = "%s package is not obeying usrmerge distro feature. /%s should be relocated to /usr." % (pkg, f)
-            oe.qa.add_message(messages, "usrmerge", msg)
+            oe.qa.handle_error("usrmerge", msg, d)
-            return False
+            return
-    return True
 QAPKGTEST[perllocalpod] = "package_qa_check_perllocalpod"
-def package_qa_check_perllocalpod(pkg, d, messages):
+def package_qa_check_perllocalpod(pkg, d):
    """
    Check that the recipe didn't ship a perlocal.pod file, which shouldn't be
    installed in a distribution package.  cpan.bbclass sets NO_PERLLOCAL=1 to
@@ -1025,67 +961,61 @@ def package_qa_check_perllocalpod(pkg, d, messages):
    if matches:
        matches = [package_qa_clean_path(path, d, pkg) for path in matches]
        msg = "%s contains perllocal.pod (%s), should not be installed" % (pkg, " ".join(matches))
-        oe.qa.add_message(messages, "perllocalpod", msg)
+        oe.qa.handle_error("perllocalpod", msg, d)
 QAPKGTEST[expanded-d] = "package_qa_check_expanded_d"
-def package_qa_check_expanded_d(package, d, messages):
+def package_qa_check_expanded_d(package, d):
    """
    Check for the expanded D (${D}) value in pkg_* and FILES
    variables, warn the user to use it correctly.
    """
-    sane = True
    expanded_d = d.getVar('D')
    for var in 'FILES','pkg_preinst', 'pkg_postinst', 'pkg_prerm', 'pkg_postrm':
        bbvar = d.getVar(var + ":" + package) or ""
        if expanded_d in bbvar:
            if var == 'FILES':
-                oe.qa.add_message(messages, "expanded-d", "FILES in %s recipe should not contain the ${D} variable as it references the local build directory not the target filesystem, best solution is to remove the ${D} reference" % package)
+                oe.qa.handle_error("expanded-d", "FILES in %s recipe should not contain the ${D} variable as it references the local build directory not the target filesystem, best solution is to remove the ${D} reference" % package, d)
-                sane = False
            else:
-                oe.qa.add_message(messages, "expanded-d", "%s in %s recipe contains ${D}, it should be replaced by $D instead" % (var, package))
+                oe.qa.handle_error("expanded-d", "%s in %s recipe contains ${D}, it should be replaced by $D instead" % (var, package), d)
-                sane = False
-    return sane
 QAPKGTEST[unlisted-pkg-lics] = "package_qa_check_unlisted_pkg_lics"
-def package_qa_check_unlisted_pkg_lics(package, d, messages):
+def package_qa_check_unlisted_pkg_lics(package, d):
    """
    Check that all licenses for a package are among the licenses for the recipe.
    """
    pkg_lics = d.getVar('LICENSE:' + package)
    if not pkg_lics:
-        return True
+        return
    recipe_lics_set = oe.license.list_licenses(d.getVar('LICENSE'))
    package_lics = oe.license.list_licenses(pkg_lics)
    unlisted = package_lics - recipe_lics_set
    if unlisted:
-        oe.qa.add_message(messages, "unlisted-pkg-lics",
+        oe.qa.handle_error("unlisted-pkg-lics",
                               "LICENSE:%s includes licenses (%s) that are not "
-                               "listed in LICENSE" % (package, ' '.join(unlisted)))
+                               "listed in LICENSE" % (package, ' '.join(unlisted)), d)
-        return False
    obsolete = set(oe.license.obsolete_license_list()) & package_lics - recipe_lics_set
    if obsolete:
-        oe.qa.add_message(messages, "obsolete-license",
+        oe.qa.handle_error("obsolete-license",
-                               "LICENSE:%s includes obsolete licenses %s" % (package, ' '.join(obsolete)))
+                               "LICENSE:%s includes obsolete licenses %s" % (package, ' '.join(obsolete)), d)
-        return False
-    return True
 QAPKGTEST[empty-dirs] = "package_qa_check_empty_dirs"
-def package_qa_check_empty_dirs(pkg, d, messages):
+def package_qa_check_empty_dirs(pkg, d):
    """
    Check for the existence of files in directories that are expected to be
    empty.
    """
+    global cpath
    pkgd = oe.path.join(d.getVar('PKGDEST'), pkg)
    for dir in (d.getVar('QA_EMPTY_DIRS') or "").split():
        empty_dir = oe.path.join(pkgd, dir)
-        if os.path.exists(empty_dir) and os.listdir(empty_dir):
+        if cpath.exists(empty_dir) and os.listdir(empty_dir):
            recommendation = (d.getVar('QA_EMPTY_DIRS_RECOMMENDATION:' + dir) or
                              "but it is expected to be empty")
            msg = "%s installs files in %s, %s" % (pkg, dir, recommendation)
-            oe.qa.add_message(messages, "empty-dirs", msg)
+            oe.qa.handle_error("empty-dirs", msg, d)
 def package_qa_check_encoding(keys, encode, d):
    def check_encoding(key, enc):
@@ -1109,10 +1039,11 @@ HOST_USER_UID := "${@os.getuid()}"
 HOST_USER_GID := "${@os.getgid()}"
 QAPATHTEST[host-user-contaminated] = "package_qa_check_host_user"
-def package_qa_check_host_user(path, name, d, elf, messages):
+def package_qa_check_host_user(path, name, d, elf):
    """Check for paths outside of /home which are owned by the user running bitbake."""
+    global cpath
-    if not os.path.lexists(path):
+    if not cpath.lexists(path):
        return
    dest = d.getVar('PKGDEST')
@@ -1130,17 +1061,15 @@ def package_qa_check_host_user(path, name, d, elf, messages):
    else:
        check_uid = int(d.getVar('HOST_USER_UID'))
        if stat.st_uid == check_uid:
-            oe.qa.add_message(messages, "host-user-contaminated", "%s: %s is owned by uid %d, which is the same as the user running bitbake. This may be due to host contamination" % (pn, package_qa_clean_path(path, d, name), check_uid))
+            oe.qa.handle_error("host-user-contaminated", "%s: %s is owned by uid %d, which is the same as the user running bitbake. This may be due to host contamination" % (pn, package_qa_clean_path(path, d, name), check_uid), d)
-            return False
        check_gid = int(d.getVar('HOST_USER_GID'))
        if stat.st_gid == check_gid:
-            oe.qa.add_message(messages, "host-user-contaminated", "%s: %s is owned by gid %d, which is the same as the user running bitbake. This may be due to host contamination" % (pn, package_qa_clean_path(path, d, name), check_gid))
+            oe.qa.handle_error("host-user-contaminated", "%s: %s is owned by gid %d, which is the same as the user running bitbake. This may be due to host contamination" % (pn, package_qa_clean_path(path, d, name), check_gid), d)
-            return False
+package_qa_check_host_user[vardepsexclude] = "HOST_USER_UID HOST_USER_GID"
-    return True
 QARECIPETEST[unhandled-features-check] = "package_qa_check_unhandled_features_check"
-def package_qa_check_unhandled_features_check(pn, d, messages):
+def package_qa_check_unhandled_features_check(pn, d):
    if not bb.data.inherits_class('features_check', d):
        var_set = False
        for kind in ['DISTRO', 'MACHINE', 'COMBINED']:
@@ -1151,22 +1080,36 @@ def package_qa_check_unhandled_features_check(pn, d, messages):
            oe.qa.handle_error("unhandled-features-check", "%s: recipe doesn't inherit features_check" % pn, d)
 QARECIPETEST[missing-update-alternatives] = "package_qa_check_missing_update_alternatives"
-def package_qa_check_missing_update_alternatives(pn, d, messages):
+def package_qa_check_missing_update_alternatives(pn, d):
    # Look at all packages and find out if any of those sets ALTERNATIVE variable
    # without inheriting update-alternatives class
    for pkg in (d.getVar('PACKAGES') or '').split():
        if d.getVar('ALTERNATIVE:%s' % pkg) and not bb.data.inherits_class('update-alternatives', d):
            oe.qa.handle_error("missing-update-alternatives", "%s: recipe defines ALTERNATIVE:%s but doesn't inherit update-alternatives. This might fail during do_rootfs later!" % (pn, pkg), d)
+def parse_test_matrix(matrix_name, skip, d):
+        testmatrix = d.getVarFlags(matrix_name) or {}
+        g = globals()
+        checks = []
+        for w in (d.getVar("WARN_QA") or "").split():
+            if w in skip:
+               continue
+            if w in testmatrix and testmatrix[w] in g:
+                checks.append(g[testmatrix[w]])
+        for e in (d.getVar("ERROR_QA") or "").split():
+            if e in skip:
+               continue
+            if e in testmatrix and testmatrix[e] in g:
+                checks.append(g[testmatrix[e]])
+        return checks
+parse_test_matrix[vardepsexclude] = "ERROR_QA WARN_QA"
 # The PACKAGE FUNC to scan each package
 python do_package_qa () {
-    import subprocess
    import oe.packagedata
-    bb.note("DO PACKAGE QA")
-    main_lic = d.getVar('LICENSE')
    # Check for obsolete license references in main LICENSE (packages are checked below for any changes)
    main_licenses = oe.license.list_licenses(d.getVar('LICENSE'))
    obsolete = set(oe.license.obsolete_license_list()) & main_licenses
@@ -1182,27 +1125,28 @@ python do_package_qa () {
    pn = d.getVar('PN')
    # Scan the packages...
-    pkgdest = d.getVar('PKGDEST')
    packages = set((d.getVar('PACKAGES') or '').split())
+    # no packages should be scanned
+    if not packages:
+        return
-    global pkgfiles
+    global pkgfiles, cpath
    pkgfiles = {}
+    cpath = oe.cachedpath.CachedPath()
+    pkgdest = d.getVar('PKGDEST')
    for pkg in packages:
-        pkgfiles[pkg] = []
        pkgdir = os.path.join(pkgdest, pkg)
+        pkgfiles[pkg] = []
        for walkroot, dirs, files in os.walk(pkgdir):
            # Don't walk into top-level CONTROL or DEBIAN directories as these
            # are temporary directories created by do_package.
            if walkroot == pkgdir:
-                for control in ("CONTROL", "DEBIAN"):
+                for removedir in ("CONTROL", "DEBIAN"):
-                    if control in dirs:
+                    try:
-                        dirs.remove(control)
+                        dirs.remove(removedir)
-            for file in files:
+                    except ValueError:
-                pkgfiles[pkg].append(os.path.join(walkroot, file))
+                        pass
+            pkgfiles[pkg].extend((os.path.join(walkroot, f) for f in files))
-    # no packages should be scanned
-    if not packages:
-        return
    import re
    # The package name matches the [a-z0-9.+-]+ regular expression
@@ -1213,24 +1157,6 @@ python do_package_qa () {
    for dep in taskdepdata:
        taskdeps.add(taskdepdata[dep][0])
-    def parse_test_matrix(matrix_name):
-        testmatrix = d.getVarFlags(matrix_name) or {}
-        g = globals()
-        warnchecks = []
-        for w in (d.getVar("WARN_QA") or "").split():
-            if w in skip:
-               continue
-            if w in testmatrix and testmatrix[w] in g:
-                warnchecks.append(g[testmatrix[w]])
-        errorchecks = []
-        for e in (d.getVar("ERROR_QA") or "").split():
-            if e in skip:
-               continue
-            if e in testmatrix and testmatrix[e] in g:
-                errorchecks.append(g[testmatrix[e]])
-        return warnchecks, errorchecks
    for package in packages:
        skip = set((d.getVar('INSANE_SKIP') or "").split() +
                   (d.getVar('INSANE_SKIP:' + package) or "").split())
@@ -1243,21 +1169,23 @@ python do_package_qa () {
            oe.qa.handle_error("pkgname",
                    "%s doesn't match the [a-z0-9.+-]+ regex" % package, d)
-        warn_checks, error_checks = parse_test_matrix("QAPATHTEST")
+        checks = parse_test_matrix("QAPATHTEST", skip, d)
-        package_qa_walk(warn_checks, error_checks, package, d)
+        package_qa_walk(checks, package, d)
-        warn_checks, error_checks = parse_test_matrix("QAPKGTEST")
+        checks = parse_test_matrix("QAPKGTEST", skip, d)
-        package_qa_package(warn_checks, error_checks, package, d)
+        for func in checks:
+            func(package, d)
        package_qa_check_rdepends(package, pkgdest, skip, taskdeps, packages, d)
        package_qa_check_deps(package, pkgdest, d)
-    warn_checks, error_checks = parse_test_matrix("QARECIPETEST")
+    checks = parse_test_matrix("QARECIPETEST", skip, d)
-    package_qa_recipe(warn_checks, error_checks, pn, d)
+    for func in checks:
+        func(pn, d)
-    if 'libdir' in d.getVar("ALL_QA").split():
+    package_qa_check_libdir(d)
-        package_qa_check_libdir(d)
+    cpath = None
    oe.qa.exit_if_errors(d)
 }
@@ -1269,11 +1197,17 @@ do_package_qa[vardepsexclude] = "BB_TASKDEPDATA"
 do_package_qa[rdeptask] = "do_packagedata"
 addtask do_package_qa after do_packagedata do_package before do_build
+do_build[rdeptask] += "do_package_qa"
 # Add the package specific INSANE_SKIPs to the sstate dependencies
 python() {
    pkgs = (d.getVar('PACKAGES') or '').split()
    for pkg in pkgs:
        d.appendVarFlag("do_package_qa", "vardeps", " INSANE_SKIP:{}".format(pkg))
+    funcs = d.getVarFlags("QAPATHTEST")
+    funcs.update(d.getVarFlags("QAPKGTEST"))
+    funcs.update(d.getVarFlags("QARECIPETEST"))
+    d.appendVarFlag("do_package_qa", "vardeps", " ".join(funcs.values()))
 }
 SSTATETASKS += "do_package_qa"
@@ -1373,10 +1307,10 @@ python do_qa_patch() {
    srcdir = d.getVar('S')
    if not bb.utils.contains('DISTRO_FEATURES', 'ptest', True, False, d):
        pass
+    elif not (bb.utils.contains('ERROR_QA', 'unimplemented-ptest', True, False, d) or bb.utils.contains('WARN_QA', 'unimplemented-ptest', True, False, d)):
+        pass
    elif bb.data.inherits_class('ptest', d):
        bb.note("Package %s QA: skipping unimplemented-ptest: ptest implementation detected" % d.getVar('PN'))
-    elif srcdir == d.getVar('WORKDIR'):
-        bb.note("Package %s QA: skipping unimplemented-ptest: This check is not supported for recipe with \"S = \"${WORKDIR}\"" % d.getVar('PN'))
    # Detect perl Test:: based tests
    elif os.path.exists(os.path.join(srcdir, "t")) and any(filename.endswith('.t') for filename in os.listdir(os.path.join(srcdir, 't'))):
@@ -1398,8 +1332,15 @@ python do_qa_patch() {
    elif os.path.exists(os.path.join(srcdir, "Makefile.in")) and (match_line_in_files(srcdir, "**/Makefile.in", r'\s*TESTS\s*\+?=') or match_line_in_files(srcdir,"**/*.at",r'.*AT_INIT')):
        oe.qa.handle_error("unimplemented-ptest", "%s: autotools-based tests detected" % d.getVar('PN'), d)
+    # Detect cargo-based tests
+    elif os.path.exists(os.path.join(srcdir, "Cargo.toml")) and (
+        match_line_in_files(srcdir, "**/*.rs", r'\s*#\s*\[\s*test\s*\]') or 
+        match_line_in_files(srcdir, "**/*.rs", r'\s*#\s*\[\s*cfg\s*\(\s*test\s*\)\s*\]')
+    ):
+        oe.qa.handle_error("unimplemented-ptest", "%s: cargo-based tests detected" % d.getVar('PN'), d)
    # Last resort, detect a test directory in sources
-    elif any(filename.lower() in ["test", "tests"] for filename in os.listdir(srcdir)):
+    elif os.path.exists(srcdir) and any(filename.lower() in ["test", "tests"] for filename in os.listdir(srcdir)):
        oe.qa.handle_error("unimplemented-ptest", "%s: test subdirectory detected" % d.getVar('PN'), d)
    oe.qa.exit_if_errors(d)
@@ -1484,22 +1425,20 @@ Rerun configure task after fixing this."""
        except subprocess.CalledProcessError:
            pass
-    # Check invalid PACKAGECONFIG
-    pkgconfig = (d.getVar("PACKAGECONFIG") or "").split()
-    if pkgconfig:
-        pkgconfigflags = d.getVarFlags("PACKAGECONFIG") or {}
-        for pconfig in pkgconfig:
-            if pconfig not in pkgconfigflags:
-                pn = d.getVar('PN')
-                error_msg = "%s: invalid PACKAGECONFIG: %s" % (pn, pconfig)
-                oe.qa.handle_error("invalid-packageconfig", error_msg, d)
    oe.qa.exit_if_errors(d)
 }
 python do_qa_unpack() {
    src_uri = d.getVar('SRC_URI')
    s_dir = d.getVar('S')
+    s_dir_orig = d.getVar('S', False)
+    if s_dir_orig == '${WORKDIR}/git' or s_dir_orig == '${UNPACKDIR}/git':
+        bb.fatal('Recipes that set S = "${WORKDIR}/git" or S = "${UNPACKDIR}/git" should remove that assignment, as S set by bitbake.conf in oe-core now works.')
+    if '${WORKDIR}' in s_dir_orig:
+        bb.fatal('S should be set relative to UNPACKDIR, e.g. replace WORKDIR with UNPACKDIR in "S = {}"'.format(s_dir_orig))
    if src_uri and not os.path.exists(s_dir):
        bb.warn('%s: the directory %s (%s) pointed to by the S variable doesn\'t exist - please set S within the recipe to point to where the source has been unpacked to' % (d.getVar('PN'), d.getVar('S', False), s_dir))
 }
@@ -1507,6 +1446,12 @@ python do_qa_unpack() {
 python do_recipe_qa() {
    import re
+    def test_naming(pn, d):
+        if pn.endswith("-native") and not bb.data.inherits_class("native", d):
+            oe.qa.handle_error("recipe-naming", "Recipe %s appears native but is not, should inherit native" % pn, d)
+        if pn.startswith("nativesdk-") and not bb.data.inherits_class("nativesdk", d):
+            oe.qa.handle_error("recipe-naming", "Recipe %s appears nativesdk but is not, should inherit nativesdk" % pn, d)
    def test_missing_metadata(pn, d):
        fn = d.getVar("FILE")
        srcfile = d.getVar('SRC_URI').split()
@@ -1541,10 +1486,21 @@ python do_recipe_qa() {
            if re.search(r"git(hu|la)b\.com/.+/.+/archive/.+", url) or "//codeload.github.com/" in url:
                oe.qa.handle_error("src-uri-bad", "%s: SRC_URI uses unstable GitHub/GitLab archives, convert recipe to use git protocol" % pn, d)
+    def test_packageconfig(pn, d):
+        pkgconfigs = (d.getVar("PACKAGECONFIG") or "").split()
+        if pkgconfigs:
+            pkgconfigflags = d.getVarFlags("PACKAGECONFIG") or {}
+            invalid_pkgconfigs = set(pkgconfigs) - set(pkgconfigflags)
+            if invalid_pkgconfigs:
+                error_msg = "%s: invalid PACKAGECONFIG(s): %s" % (pn, " ".join(sorted(invalid_pkgconfigs)))
+                oe.qa.handle_error("invalid-packageconfig", error_msg, d)
    pn = d.getVar('PN')
+    test_naming(pn, d)
    test_missing_metadata(pn, d)
    test_missing_maintainer(pn, d)
    test_srcuri(pn, d)
+    test_packageconfig(pn, d)
    oe.qa.exit_if_errors(d)
 }
@@ -1572,8 +1528,7 @@ do_unpack[postfuncs] += "do_qa_unpack"
 python () {
    import re
-    tests = d.getVar('ALL_QA').split()
+    if bb.utils.contains('ERROR_QA', 'desktop', True, False, d) or bb.utils.contains('WARN_QA', 'desktop', True, False, d):
-    if "desktop" in tests:
        d.appendVar("PACKAGE_DEPENDS", " desktop-file-utils-native")
    ###########################################################################
@@ -1602,17 +1557,31 @@ python () {
    if prog.search(pn):
        oe.qa.handle_error("uppercase-pn", 'PN: %s is upper case, this can result in unexpected behavior.' % pn, d)
+    sourcedir = d.getVar("S")
+    builddir = d.getVar("B")
+    workdir = d.getVar("WORKDIR")
+    unpackdir = d.getVar("UNPACKDIR")
+    if sourcedir == workdir:
+        bb.fatal("Using S = ${WORKDIR} is no longer supported")
+    if builddir == workdir:
+        bb.fatal("Using B = ${WORKDIR} is no longer supported")
+    if unpackdir == workdir:
+        bb.fatal("Using UNPACKDIR = ${WORKDIR} is not supported")
+    if sourcedir[-1] == '/':
+        bb.warn("Recipe %s sets S variable with trailing slash '%s', remove it" % (d.getVar("PN"), d.getVar("S")))
+    if builddir[-1] == '/':
+        bb.warn("Recipe %s sets B variable with trailing slash '%s', remove it" % (d.getVar("PN"), d.getVar("B")))
    # Some people mistakenly use DEPENDS:${PN} instead of DEPENDS and wonder
    # why it doesn't work.
    if (d.getVar(d.expand('DEPENDS:${PN}'))):
        oe.qa.handle_error("pkgvarcheck", "recipe uses DEPENDS:${PN}, should use DEPENDS", d)
    # virtual/ is meaningless for these variables
-    if "virtual-slash" in (d.getVar("ALL_QA") or "").split():
+    for k in ['RDEPENDS', 'RPROVIDES']:
-        for k in ['RDEPENDS', 'RPROVIDES']:
+        for var in bb.utils.explode_deps(d.getVar(k + ':' + pn) or ""):
-            for var in bb.utils.explode_deps(d.getVar(k + ':' + pn) or ""):
+            if var.startswith("virtual/"):
-                if var.startswith("virtual/"):
+                oe.qa.handle_error("virtual-slash", "%s is set to %s but the substring 'virtual/' holds no meaning in this context. It only works for build time dependencies, not runtime ones. It is suggested to use 'VIRTUAL-RUNTIME_' variables instead." % (k, var), d)
-                    oe.qa.handle_error("virtual-slash", "%s is set to %s but the substring 'virtual/' holds no meaning in this context. It only works for build time dependencies, not runtime ones. It is suggested to use 'VIRTUAL-RUNTIME_' variables instead." % (k, var), d)
    issues = []
    if (d.getVar('PACKAGES') or "").split():
@@ -1622,8 +1591,7 @@ python () {
            if d.getVar(var, False):
                issues.append(var)
-        fakeroot_tests = d.getVar('FAKEROOT_QA').split()
+        if bb.utils.contains('ERROR_QA', 'host-user-contaminated', True, False, d) or bb.utils.contains('WARN_QA', 'host-user-contaminated', True, False, d):
-        if set(tests) & set(fakeroot_tests):
            d.setVarFlag('do_package_qa', 'fakeroot', '1')
            d.appendVarFlag('do_package_qa', 'depends', ' virtual/fakeroot-native:do_populate_sysroot')
    else:
diff --git a/meta/classes-global/license.bbclass b/meta/classes-global/license.bbclass
index b2e0d3faba..af5f1ed41d 100644
--- a/meta/classes-global/license.bbclass
+++ b/meta/classes-global/license.bbclass
@@ -18,8 +18,14 @@ LICENSE_CREATE_PACKAGE ??= "0"
 LICENSE_PACKAGE_SUFFIX ??= "-lic"
 LICENSE_FILES_DIRECTORY ??= "${datadir}/licenses/"
+LICENSE_DEPLOY_PATHCOMPONENT = "${SSTATE_PKGARCH}"
+LICENSE_DEPLOY_PATHCOMPONENT:class-cross = "native"
+LICENSE_DEPLOY_PATHCOMPONENT:class-native = "native"
+# Ensure the *value* of SSTATE_PKGARCH is captured as it is used in the output paths
+LICENSE_DEPLOY_PATHCOMPONENT[vardepvalue] += "${LICENSE_DEPLOY_PATHCOMPONENT}"
 addtask populate_lic after do_patch before do_build
-do_populate_lic[dirs] = "${LICSSTATEDIR}/${PN}"
+do_populate_lic[dirs] = "${LICSSTATEDIR}/${LICENSE_DEPLOY_PATHCOMPONENT}/${PN}"
 do_populate_lic[cleandirs] = "${LICSSTATEDIR}"
 python do_populate_lic() {
@@ -29,7 +35,7 @@ python do_populate_lic() {
    lic_files_paths = find_license_files(d)
    # The base directory we wrangle licenses to
-    destdir = os.path.join(d.getVar('LICSSTATEDIR'), d.getVar('SSTATE_PKGARCH'), d.getVar('PN'))
+    destdir = os.path.join(d.getVar('LICSSTATEDIR'), d.getVar('LICENSE_DEPLOY_PATHCOMPONENT'), d.getVar('PN'))
    copy_license_files(lic_files_paths, destdir)
    info = get_recipe_info(d)
    with open(os.path.join(destdir, "recipeinfo"), "w") as f:
@@ -38,8 +44,7 @@ python do_populate_lic() {
    oe.qa.exit_if_errors(d)
 }
-PSEUDO_IGNORE_PATHS .= ",${@','.join(((d.getVar('COMMON_LICENSE_DIR') or '') + ' ' + (d.getVar('LICENSE_PATH') or '') + ' ' + d.getVar('COREBASE') + '/meta/COPYING').split())}"
+# it would be better to copy them in do_install:append, but find_license_files is python
-# it would be better to copy them in do_install:append, but find_license_filesa is python
 python perform_packagecopy:prepend () {
    enabled = oe.data.typed_value('LICENSE_CREATE_PACKAGE', d)
    if d.getVar('CLASSOVERRIDE') == 'class-target' and enabled:
@@ -149,14 +154,14 @@ def find_license_files(d):
            # and "with exceptions" being *
            # we'll just strip out the modifier and put
            # the base license.
-            find_license(node.s.replace("+", "").replace("*", ""))
+            find_licenses(node.s.replace("+", "").replace("*", ""))
            self.generic_visit(node)
        def visit_Constant(self, node):
-            find_license(node.value.replace("+", "").replace("*", ""))
+            find_licenses(node.value.replace("+", "").replace("*", ""))
            self.generic_visit(node)
-    def find_license(license_type):
+    def find_licenses(license_type):
        try:
            bb.utils.mkdirhier(gen_lic_dest)
        except:
@@ -249,171 +254,6 @@ def find_license_files(d):
    return lic_files_paths
-def return_spdx(d, license):
-    """
-    This function returns the spdx mapping of a license if it exists.
-     """
-    return d.getVarFlag('SPDXLICENSEMAP', license)
-def canonical_license(d, license):
-    """
-    Return the canonical (SPDX) form of the license if available (so GPLv3
-    becomes GPL-3.0-only) or the passed license if there is no canonical form.
-    """
-    return d.getVarFlag('SPDXLICENSEMAP', license) or license
-def expand_wildcard_licenses(d, wildcard_licenses):
-    """
-    There are some common wildcard values users may want to use. Support them
-    here.
-    """
-    licenses = set(wildcard_licenses)
-    mapping = {
-        "AGPL-3.0*" : ["AGPL-3.0-only", "AGPL-3.0-or-later"],
-        "GPL-3.0*" : ["GPL-3.0-only", "GPL-3.0-or-later"],
-        "LGPL-3.0*" : ["LGPL-3.0-only", "LGPL-3.0-or-later"],
-    }
-    for k in mapping:
-        if k in wildcard_licenses:
-            licenses.remove(k)
-            for item in mapping[k]:
-                licenses.add(item)
-    for l in licenses:
-        if l in oe.license.obsolete_license_list():
-            bb.fatal("Error, %s is an obsolete license, please use an SPDX reference in INCOMPATIBLE_LICENSE" % l)
-        if "*" in l:
-            bb.fatal("Error, %s is an invalid license wildcard entry" % l)
-    return list(licenses)
-def incompatible_license_contains(license, truevalue, falsevalue, d):
-    license = canonical_license(d, license)
-    bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
-    bad_licenses = expand_wildcard_licenses(d, bad_licenses)
-    return truevalue if license in bad_licenses else falsevalue
-def incompatible_pkg_license(d, dont_want_licenses, license):
-    # Handles an "or" or two license sets provided by
-    # flattened_licenses(), pick one that works if possible.
-    def choose_lic_set(a, b):
-        return a if all(oe.license.license_ok(canonical_license(d, lic),
-                            dont_want_licenses) for lic in a) else b
-    try:
-        licenses = oe.license.flattened_licenses(license, choose_lic_set)
-    except oe.license.LicenseError as exc:
-        bb.fatal('%s: %s' % (d.getVar('P'), exc))
-    incompatible_lic = []
-    for l in licenses:
-        license = canonical_license(d, l)
-        if not oe.license.license_ok(license, dont_want_licenses):
-            incompatible_lic.append(license)
-    return sorted(incompatible_lic)
-def incompatible_license(d, dont_want_licenses, package=None):
-    """
-    This function checks if a recipe has only incompatible licenses. It also
-    take into consideration 'or' operand.  dont_want_licenses should be passed
-    as canonical (SPDX) names.
-    """
-    import oe.license
-    license = d.getVar("LICENSE:%s" % package) if package else None
-    if not license:
-        license = d.getVar('LICENSE')
-    return incompatible_pkg_license(d, dont_want_licenses, license)
-def check_license_flags(d):
-    """
-    This function checks if a recipe has any LICENSE_FLAGS that
-    aren't acceptable.
-    If it does, it returns the all LICENSE_FLAGS missing from the list
-    of acceptable license flags, or all of the LICENSE_FLAGS if there
-    is no list of acceptable flags.
-    If everything is is acceptable, it returns None.
-    """
-    def license_flag_matches(flag, acceptlist, pn):
-        """
-        Return True if flag matches something in acceptlist, None if not.
-        Before we test a flag against the acceptlist, we append _${PN}
-        to it.  We then try to match that string against the
-        acceptlist.  This covers the normal case, where we expect
-        LICENSE_FLAGS to be a simple string like 'commercial', which
-        the user typically matches exactly in the acceptlist by
-        explicitly appending the package name e.g 'commercial_foo'.
-        If we fail the match however, we then split the flag across
-        '_' and append each fragment and test until we either match or
-        run out of fragments.
-        """
-        flag_pn = ("%s_%s" % (flag, pn))
-        for candidate in acceptlist:
-            if flag_pn == candidate:
-                    return True
-        flag_cur = ""
-        flagments = flag_pn.split("_")
-        flagments.pop() # we've already tested the full string
-        for flagment in flagments:
-            if flag_cur:
-                flag_cur += "_"
-            flag_cur += flagment
-            for candidate in acceptlist:
-                if flag_cur == candidate:
-                    return True
-        return False
-    def all_license_flags_match(license_flags, acceptlist):
-        """ Return all unmatched flags, None if all flags match """
-        pn = d.getVar('PN')
-        split_acceptlist = acceptlist.split()
-        flags = []
-        for flag in license_flags.split():
-            if not license_flag_matches(flag, split_acceptlist, pn):
-                flags.append(flag)
-        return flags if flags else None
-    license_flags = d.getVar('LICENSE_FLAGS')
-    if license_flags:
-        acceptlist = d.getVar('LICENSE_FLAGS_ACCEPTED')
-        if not acceptlist:
-            return license_flags.split()
-        unmatched_flags = all_license_flags_match(license_flags, acceptlist)
-        if unmatched_flags:
-            return unmatched_flags
-    return None
-def check_license_format(d):
-    """
-    This function checks if LICENSE is well defined,
-        Validate operators in LICENSES.
-        No spaces are allowed between LICENSES.
-    """
-    pn = d.getVar('PN')
-    licenses = d.getVar('LICENSE')
-    from oe.license import license_operator, license_operator_chars, license_pattern
-    elements = list(filter(lambda x: x.strip(), license_operator.split(licenses)))
-    for pos, element in enumerate(elements):
-        if license_pattern.match(element):
-            if pos > 0 and license_pattern.match(elements[pos - 1]):
-                oe.qa.handle_error('license-format',
-                        '%s: LICENSE value "%s" has an invalid format - license names ' \
-                        'must be separated by the following characters to indicate ' \
-                        'the license selection: %s' %
-                        (pn, licenses, license_operator_chars), d)
-        elif not license_operator.match(element):
-            oe.qa.handle_error('license-format',
-                    '%s: LICENSE value "%s" has an invalid separator "%s" that is not ' \
-                    'in the valid list of separators (%s)' %
-                    (pn, licenses, element, license_operator_chars), d)
 SSTATETASKS += "do_populate_lic"
 do_populate_lic[sstate-inputdirs] = "${LICSSTATEDIR}"
 do_populate_lic[sstate-outputdirs] = "${LICENSE_DIRECTORY}/"
diff --git a/meta/classes-global/logging.bbclass b/meta/classes-global/logging.bbclass
index ce03abfe42..136f1e1733 100644
--- a/meta/classes-global/logging.bbclass
+++ b/meta/classes-global/logging.bbclass
@@ -32,6 +32,16 @@ bbnote() {
        fi
 }
+# Notify the user of a noteworthy condition.
+# Output: logs console
+bbverbnote() {
+        if [ -p ${LOGFIFO} ]; then
+                printf "%b\0" "bbverbnote $*" > ${LOGFIFO}
+        else
+            echo "NOTE: $*"
+        fi
+}
 # Print a warning to the log. Warnings are non-fatal, and do not
 # indicate a build failure.
 # Output: logs console
diff --git a/meta/classes-global/mirrors.bbclass b/meta/classes-global/mirrors.bbclass
index 862648eec5..e31af488b9 100644
--- a/meta/classes-global/mirrors.bbclass
+++ b/meta/classes-global/mirrors.bbclass
@@ -6,26 +6,10 @@
 MIRRORS += "\
 ${DEBIAN_MIRROR}        http://snapshot.debian.org/archive/debian/20180310T215105Z/pool \
+${DEBIAN_MIRROR}        http://snapshot.debian.org/archive/debian/20250101T023759Z/pool \
 ${DEBIAN_MIRROR}        http://snapshot.debian.org/archive/debian-archive/20120328T092752Z/debian/pool \
 ${DEBIAN_MIRROR}        http://snapshot.debian.org/archive/debian-archive/20110127T084257Z/debian/pool \
 ${DEBIAN_MIRROR}        http://snapshot.debian.org/archive/debian-archive/20090802T004153Z/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.de.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.au.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.cl.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.hr.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.fi.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.hk.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.hu.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.ie.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.it.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.jp.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.no.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.pl.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.ro.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.si.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.es.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.se.debian.org/debian/pool \
-${DEBIAN_MIRROR}        http://ftp.tr.debian.org/debian/pool \
 ${GNU_MIRROR}   https://mirrors.kernel.org/gnu \
 ${KERNELORG_MIRROR}     http://www.kernel.org/pub \
 ${GNUPG_MIRROR} ftp://ftp.gnupg.org/gcrypt \
@@ -88,7 +72,7 @@ git://.*/.*                   git://HOST/git/PATH;protocol=https \
 BB_GIT_SHALLOW:pn-binutils = "1"
 BB_GIT_SHALLOW:pn-binutils-cross-${TARGET_ARCH} = "1"
 BB_GIT_SHALLOW:pn-binutils-cross-canadian-${TRANSLATED_TARGET_ARCH} = "1"
-BB_GIT_SHALLOW:pn-binutils-cross-testsuite = "1"
+BB_GIT_SHALLOW:pn-binutils-testsuite = "1"
 BB_GIT_SHALLOW:pn-binutils-crosssdk-${SDK_SYS} = "1"
 BB_GIT_SHALLOW:pn-binutils-native = "1"
 BB_GIT_SHALLOW:pn-nativesdk-binutils = "1"
diff --git a/meta/classes-global/package.bbclass b/meta/classes-global/package.bbclass
index aa1eb5e901..9be1d6a5b1 100644
--- a/meta/classes-global/package.bbclass
+++ b/meta/classes-global/package.bbclass
@@ -447,10 +447,6 @@ def gen_packagevar(d, pkgvars="PACKAGEVARS"):
    for p in pkgs:
        for v in vars:
            ret.append(v + ":" + p)
-        # Ensure that changes to INCOMPATIBLE_LICENSE re-run do_package for
-        # affected recipes.
-        ret.append('_exclude_incompatible-%s' % p)
    return " ".join(ret)
@@ -476,7 +472,7 @@ python do_package () {
    # cache.  This is useful if an item this class depends on changes in a
    # way that the output of this class changes.  rpmdeps is a good example
    # as any change to rpmdeps requires this to be rerun.
-    # PACKAGE_BBCLASS_VERSION = "5"
+    # PACKAGE_BBCLASS_VERSION = "6"
    # Init cachedpath
    global cpath
diff --git a/meta/classes-global/package_ipk.bbclass b/meta/classes-global/package_ipk.bbclass
index 209568ae5f..3e72c4c494 100644
--- a/meta/classes-global/package_ipk.bbclass
+++ b/meta/classes-global/package_ipk.bbclass
@@ -17,7 +17,7 @@ PKGWRITEDIRIPK = "${WORKDIR}/deploy-ipks"
 # Program to be used to build opkg packages
 OPKGBUILDCMD ??= 'opkg-build -Z zstd -a "${ZSTD_DEFAULTS}"'
-OPKG_ARGS += "--force_postinstall --prefer-arch-to-version"
+OPKG_ARGS += "--force-postinstall --prefer-arch-to-version"
 OPKG_ARGS += "${@['', '--no-install-recommends'][d.getVar("NO_RECOMMENDATIONS") == "1"]}"
 OPKG_ARGS += "${@['', '--add-exclude ' + ' --add-exclude '.join((d.getVar('PACKAGE_EXCLUDE') or "").split())][(d.getVar("PACKAGE_EXCLUDE") or "").strip() != ""]}"
diff --git a/meta/classes-global/package_rpm.bbclass b/meta/classes-global/package_rpm.bbclass
index 2e3e4e8c79..f383ed140e 100644
--- a/meta/classes-global/package_rpm.bbclass
+++ b/meta/classes-global/package_rpm.bbclass
@@ -10,7 +10,7 @@ IMAGE_PKGTYPE ?= "rpm"
 RPM = "rpm"
 RPMBUILD = "rpmbuild"
-RPMBUILD_COMPMODE ?= "${@'w19T%d.zstdio' % int(d.getVar('ZSTD_THREADS'))}"
+RPMBUILD_COMPMODE ?= "${@'w%dT%d.zstdio' % (int(d.getVar('ZSTD_COMPRESSION_LEVEL')), int(d.getVar('ZSTD_THREADS')))}"
 PKGWRITEDIRRPM = "${WORKDIR}/deploy-rpms"
@@ -38,6 +38,7 @@ def filter_nativesdk_deps(srcname, var):
 # Construct per file dependencies file
 def write_rpm_perfiledata(srcname, d):
+    import oe.package
    workdir = d.getVar('WORKDIR')
    packages = d.getVar('PACKAGES')
    pkgd = d.getVar('PKGD')
@@ -53,12 +54,7 @@ def write_rpm_perfiledata(srcname, d):
                key = "FILE" + varname + ":" + dfile + ":" + pkg
                deps = filter_nativesdk_deps(srcname, d.getVar(key) or "")
                depends_dict = bb.utils.explode_dep_versions(deps)
-                file = dfile.replace("@underscore@", "_")
+                file = oe.package.file_reverse_translate(dfile)
-                file = file.replace("@closebrace@", "]")
-                file = file.replace("@openbrace@", "[")
-                file = file.replace("@tab@", "\t")
-                file = file.replace("@space@", " ")
-                file = file.replace("@at@", "@")
                outfile.write('"' + pkgd + file + '" : "')
                for dep in depends_dict:
                    ver = depends_dict[dep]
@@ -108,7 +104,7 @@ python write_specfile () {
    # append information for logs and patches to %prep
    def add_prep(d, spec_files_bottom):
        if d.getVarFlag('ARCHIVER_MODE', 'srpm') == '1' and bb.data.inherits_class('archiver', d):
-            spec_files_bottom.append('%%prep -n %s' % d.getVar('PN'))
+            spec_files_bottom.append('%%prep')
            spec_files_bottom.append('%s' % "echo \"include logs and patches, Please check them in SOURCES\"")
            spec_files_bottom.append('')
@@ -191,7 +187,7 @@ python write_specfile () {
                if not len(depends_dict[dep]):
                    array.append("%s: %s" % (tag, dep))
-    def walk_files(walkpath, target, conffiles, dirfiles):
+    def walk_files(walkpath, target, conffiles):
        # We can race against the ipk/deb backends which create CONTROL or DEBIAN directories
        # when packaging. We just ignore these files which are created in
        # packages-split/ and not package/
@@ -205,14 +201,22 @@ python write_specfile () {
                try:
                    owner = pwd.getpwuid(stat_f.st_uid).pw_name
                except Exception as e:
-                    bb.error("Content of /etc/passwd in sysroot:\n{}".format(
+                    filename = d.getVar('RECIPE_SYSROOT') + '/etc/passwd'
-                        open(d.getVar("RECIPE_SYSROOT") +"/etc/passwd").read()))
+                    if os.path.exists(filename):
+                        bb.error("Content of /etc/passwd in sysroot:\n{}".format(
+                            open(filename).read()))
+                    else:
+                        bb.error("File {} doesn't exist in sysroot!".format(filename))
                    raise e
                try:
                    group = grp.getgrgid(stat_f.st_gid).gr_name
                except Exception as e:
-                    bb.error("Content of /etc/group in sysroot:\n{}".format(
+                    filename = d.getVar("RECIPE_SYSROOT") +"/etc/group"
-                        open(d.getVar("RECIPE_SYSROOT") +"/etc/group").read()))
+                    if os.path.exists(filename):
+                        bb.error("Content of /etc/group in sysroot:\n{}".format(
+                            open(filename).read()))
+                    else:
+                        bb.error("File {} doesn't exists in sysroot!".format(filename))
                    raise e
                return "%attr({:o},{},{}) ".format(mode, owner, group)
@@ -233,22 +237,12 @@ python write_specfile () {
                    return False
            dirs[:] = [dir for dir in dirs if not move_to_files(dir)]
-            # Directory handling can happen in two ways, either DIRFILES is not set at all
+            for dir in dirs:
-            # in which case we fall back to the older behaviour of packages owning all their
+                if dir == "CONTROL" or dir == "DEBIAN":
-            # directories
+                    continue
-            if dirfiles is None:
+                p = path + '/' + dir
-                for dir in dirs:
+                # All packages own the directories their files are in...
-                    if dir == "CONTROL" or dir == "DEBIAN":
+                target.append(get_attr(dir) + '%dir "' + escape_chars(p) + '"')
-                        continue
-                    p = path + '/' + dir
-                    # All packages own the directories their files are in...
-                    target.append(get_attr(dir) + '%dir "' + escape_chars(p) + '"')
-            elif path:
-                # packages own only empty directories or explict directory.
-                # This will prevent the overlapping of security permission.
-                attr = get_attr(path)
-                if (not files and not dirs) or path in dirfiles:
-                    target.append(attr + '%dir "' + escape_chars(path) + '"')
            for file in files:
                if file == "CONTROL" or file == "DEBIAN":
@@ -363,9 +357,6 @@ python write_specfile () {
        localdata.setVar('OVERRIDES', d.getVar("OVERRIDES", False) + ":" + pkg)
        conffiles = oe.package.get_conffiles(pkg, d)
-        dirfiles = localdata.getVar('DIRFILES')
-        if dirfiles is not None:
-            dirfiles = dirfiles.split()
        splitname    = pkgname
@@ -430,7 +421,7 @@ python write_specfile () {
            srcrpostrm     = splitrpostrm
            file_list = []
-            walk_files(root, file_list, conffiles, dirfiles)
+            walk_files(root, file_list, conffiles)
            if not file_list and localdata.getVar('ALLOW_EMPTY', False) != "1":
                bb.note("Not creating empty RPM package for %s" % splitname)
            else:
@@ -522,7 +513,7 @@ python write_specfile () {
        # Now process files
        file_list = []
-        walk_files(root, file_list, conffiles, dirfiles)
+        walk_files(root, file_list, conffiles)
        if not file_list and localdata.getVar('ALLOW_EMPTY', False) != "1":
            bb.note("Not creating empty RPM package for %s" % splitname)
        else:
@@ -705,9 +696,10 @@ python do_package_rpm () {
    cmd = cmd + " --define '_use_internal_dependency_generator 0'"
    cmd = cmd + " --define '_binaries_in_noarch_packages_terminate_build 0'"
    cmd = cmd + " --define '_build_id_links none'"
+    cmd = cmd + " --define '_smp_ncpus_max 4'"
    cmd = cmd + " --define '_source_payload %s'" % rpmbuild_compmode
    cmd = cmd + " --define '_binary_payload %s'" % rpmbuild_compmode
-    cmd = cmd + " --define 'clamp_mtime_to_source_date_epoch 1'"
+    cmd = cmd + " --define 'build_mtime_policy clamp_to_source_date_epoch'"
    cmd = cmd + " --define 'use_source_date_epoch_as_buildtime 1'"
    cmd = cmd + " --define '_buildhost reproducible'"
    cmd = cmd + " --define '__font_provides %{nil}'"
diff --git a/meta/classes-global/retain.bbclass b/meta/classes-global/retain.bbclass
new file mode 100644
index 0000000000..46e8c256cf
--- /dev/null
+++ b/meta/classes-global/retain.bbclass
@@ -0,0 +1,182 @@
+# Creates a tarball of the work directory for a recipe when one of its
+# tasks fails, or any other nominated directories.
+# Useful in cases where the environment in which builds are run is
+# ephemeral or otherwise inaccessible for examination during
+# debugging.
+#
+# To enable, simply add the following to your configuration:
+#
+# INHERIT += "retain"
+#
+# You can specify the recipe-specific directories to save upon failure
+# or always (space-separated) e.g.:
+#
+# RETAIN_DIRS_FAILURE = "${WORKDIR};prefix=workdir"    # default
+# RETAIN_DIRS_ALWAYS = "${T}"
+#
+# Naturally you can use overrides to limit it to a specific recipe:
+# RETAIN_DIRS_ALWAYS:pn-somerecipe = "${T}"
+#
+# You can also specify global (non-recipe-specific) directories to save:
+#
+# RETAIN_DIRS_GLOBAL_FAILURE = "${LOG_DIR}"
+# RETAIN_DIRS_GLOBAL_ALWAYS = "${BUILDSTATS_BASE}"
+#
+# If you wish to use a different tarball name prefix than the default of
+# the directory name, you can do so by specifying a ;prefix= followed by
+# the desired prefix (no spaces) in any of the RETAIN_DIRS_* variables.
+# e.g. to always save the log files with a "recipelogs" as the prefix for
+# the tarball of ${T} you would do this:
+#
+# RETAIN_DIRS_ALWAYS = "${T};prefix=recipelogs"
+#
+# Notes:
+# * For this to be useful you also need corresponding logic in your build
+#   orchestration tool to pick up any files written out to RETAIN_OUTDIR
+#   (with the other assumption being that no files are present there at
+#   the start of the build, since there is no logic to purge old files).
+# * Work directories can be quite large, so saving them can take some time
+#   and of course space.
+# * Tarball creation is deferred to the end of the build, thus you will
+#   get the state at the end, not immediately upon failure.
+# * Extra directories must naturally be populated at the time the retain
+#   class goes to save them (build completion); to try ensure this for
+#   things that are also saved on build completion (e.g. buildstats), put
+#   the INHERIT += "retain" after the INHERIT += lines for the class that
+#   is writing out the data that you wish to save.
+# * The tarballs have the tarball name as a top-level directory so that
+#   multiple tarballs can be extracted side-by-side easily.
+#
+# Copyright (c) 2020, 2024 Microsoft Corporation
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+RETAIN_OUTDIR ?= "${TMPDIR}/retained"
+RETAIN_DIRS_FAILURE ?= "${WORKDIR};prefix=workdir"
+RETAIN_DIRS_ALWAYS ?= ""
+RETAIN_DIRS_GLOBAL_FAILURE ?= ""
+RETAIN_DIRS_GLOBAL_ALWAYS ?= ""
+RETAIN_TARBALL_SUFFIX ?= "${DATETIME}.tar.gz"
+RETAIN_ENABLED ?= "1"
+def retain_retain_dir(desc, tarprefix, path, tarbasepath, d):
+    import datetime
+    outdir = d.getVar('RETAIN_OUTDIR')
+    bb.utils.mkdirhier(outdir)
+    suffix = d.getVar('RETAIN_TARBALL_SUFFIX')
+    tarname = '%s_%s' % (tarprefix, suffix)
+    tarfp = os.path.join(outdir, '%s' % tarname)
+    tardir = os.path.relpath(path, tarbasepath)
+    cmdargs = ['tar', 'cfa', tarfp]
+    # Prefix paths within the tarball with the tarball name so that
+    # multiple tarballs can be extracted side-by-side
+    tarname_noext = os.path.splitext(tarname)[0]
+    if tarname_noext.endswith('.tar'):
+        tarname_noext = tarname_noext[:-4]
+    cmdargs += ['--transform', 's:^:%s/:' % tarname_noext]
+    cmdargs += [tardir]
+    try:
+        bb.process.run(cmdargs, cwd=tarbasepath)
+    except bb.process.ExecutionError as e:
+        # It is possible for other tasks to be writing to the workdir
+        # while we are tarring it up, in which case tar will return 1,
+        # but we don't care in this situation (tar returns 2 for other
+        # errors so we we will see those)
+        if e.exitcode != 1:
+            bb.warn('retain: error saving %s: %s' % (desc, str(e)))
+addhandler retain_task_handler
+retain_task_handler[eventmask] = "bb.build.TaskFailed bb.build.TaskSucceeded"
+addhandler retain_build_handler
+retain_build_handler[eventmask] = "bb.event.BuildStarted bb.event.BuildCompleted"
+python retain_task_handler() {
+    if d.getVar('RETAIN_ENABLED') != '1':
+        return
+    dirs = d.getVar('RETAIN_DIRS_ALWAYS')
+    if isinstance(e, bb.build.TaskFailed):
+        dirs += ' ' + d.getVar('RETAIN_DIRS_FAILURE')
+    dirs = dirs.strip().split()
+    if dirs:
+        outdir = d.getVar('RETAIN_OUTDIR')
+        bb.utils.mkdirhier(outdir)
+        dirlist_file = os.path.join(outdir, 'retain_dirs.list')
+        pn = d.getVar('PN')
+        taskname = d.getVar('BB_CURRENTTASK')
+        with open(dirlist_file, 'a') as f:
+            for entry in dirs:
+                f.write('%s %s %s\n' % (pn, taskname, entry))
+}
+python retain_build_handler() {
+    outdir = d.getVar('RETAIN_OUTDIR')
+    dirlist_file = os.path.join(outdir, 'retain_dirs.list')
+    if isinstance(e, bb.event.BuildStarted):
+        if os.path.exists(dirlist_file):
+            os.remove(dirlist_file)
+        return
+    if d.getVar('RETAIN_ENABLED') != '1':
+        return
+    savedirs = {}
+    try:
+        with open(dirlist_file, 'r') as f:
+            for line in f:
+                pn, _, path = line.rstrip().split()
+                if not path in savedirs:
+                    savedirs[path] = pn
+        os.remove(dirlist_file)
+    except FileNotFoundError:
+        pass
+    if e.getFailures():
+        for path in (d.getVar('RETAIN_DIRS_GLOBAL_FAILURE') or '').strip().split():
+            savedirs[path] = ''
+    for path in (d.getVar('RETAIN_DIRS_GLOBAL_ALWAYS') or '').strip().split():
+        savedirs[path] = ''
+    if savedirs:
+        bb.plain('NOTE: retain: retaining build output...')
+        count = 0
+        for path, pn in savedirs.items():
+            prefix = None
+            if ';' in path:
+                pathsplit = path.split(';')
+                path = pathsplit[0]
+                for param in pathsplit[1:]:
+                    if '=' in param:
+                        name, value = param.split('=', 1)
+                        if name == 'prefix':
+                            prefix = value
+                        else:
+                            bb.error('retain: invalid parameter "%s" in RETAIN_* variable value' % param)
+                            return
+                    else:
+                        bb.error('retain: parameter "%s" missing value in RETAIN_* variable value' % param)
+                        return
+            if prefix:
+                itemname = prefix
+            else:
+                itemname = os.path.basename(path)
+            if pn:
+                # Always add the recipe name in front
+                itemname = pn + '_' + itemname
+            if os.path.exists(path):
+                retain_retain_dir(itemname, itemname, path, os.path.dirname(path), d)
+                count += 1
+            else:
+                bb.warn('retain: path %s does not currently exist' % path)
+        if count:
+            item = 'archive' if count == 1 else 'archives'
+            bb.plain('NOTE: retain: saved %d %s to %s' % (count, item, outdir))
+}
diff --git a/meta/classes-global/sanity.bbclass b/meta/classes-global/sanity.bbclass
index 180c6b77d8..1044ed9cc6 100644
--- a/meta/classes-global/sanity.bbclass
+++ b/meta/classes-global/sanity.bbclass
@@ -299,6 +299,11 @@ def check_path_length(filepath, pathname, limit):
        return "The length of %s is longer than %s, this would cause unexpected errors, please use a shorter path.\n" % (pathname, limit)
    return ""
+def check_non_ascii(filepath, pathname):
+    if(not filepath.isascii()):
+        return "Non-ASCII character(s) in %s path (\"%s\") detected. This would cause build failures as we build software that doesn't support this.\n" % (pathname, filepath)
+    return ""
 def get_filesystem_id(path):
    import subprocess
    try:
@@ -475,6 +480,31 @@ def check_wsl(d):
            bb.warn("You are running bitbake under WSLv2, this works properly but you should optimize your VHDX file eventually to avoid running out of storage space")
    return None
+def check_userns():
+    """
+    Check that user namespaces are functional, as they're used for network isolation.
+    """
+    # There is a known failure case with AppAmrmor where the unshare() call
+    # succeeds (at which point the uid is nobody) but writing to the uid_map
+    # fails (so the uid isn't reset back to the user's uid). We can detect this.
+    parentuid = os.getuid()
+    if not bb.utils.is_local_uid(parentuid):
+        return None
+    pid = os.fork()
+    if not pid:
+        try:
+            bb.utils.disable_network()
+        except:
+            pass
+        os._exit(parentuid != os.getuid())
+    ret = os.waitpid(pid, 0)[1]
+    if ret:
+        bb.fatal("User namespaces are not usable by BitBake, possibly due to AppArmor.\n"
+                 "See https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions for more information.")
 # Require at least gcc version 8.0
 #
 # This can be fixed on CentOS-7 with devtoolset-6+
@@ -484,23 +514,23 @@ def check_wsl(d):
 # built buildtools-extended-tarball)
 #
 def check_gcc_version(sanity_data):
-    import subprocess
+    version = oe.utils.get_host_gcc_version(sanity_data)
-    
+    if bb.utils.vercmp_string_op(version, "8.0", "<"):
-    build_cc, version = oe.utils.get_host_compiler_version(sanity_data)
+        return "Your version of gcc is older than 8.0 and will break builds. Please install a newer version of gcc (you could use the project's buildtools-extended-tarball or use scripts/install-buildtools).\n"
-    if build_cc.strip() == "gcc":
-        if bb.utils.vercmp_string_op(version, "8.0", "<"):
-            return "Your version of gcc is older than 8.0 and will break builds. Please install a newer version of gcc (you could use the project's buildtools-extended-tarball or use scripts/install-buildtools).\n"
    return None
 # Tar version 1.24 and onwards handle overwriting symlinks correctly
 # but earlier versions do not; this needs to work properly for sstate
 # Version 1.28 is needed so opkg-build works correctly when reproducible builds are enabled
+# Gtar is assumed at to be used as tar in poky
 def check_tar_version(sanity_data):
    import subprocess
    try:
        result = subprocess.check_output(["tar", "--version"], stderr=subprocess.STDOUT).decode('utf-8')
    except subprocess.CalledProcessError as e:
        return "Unable to execute tar --version, exit code %d\n%s\n" % (e.returncode, e.output)
+    if not "GNU" in result:
+        return "Your version of tar is not gtar. Please install gtar (you could use the project's buildtools-tarball from our last release or use scripts/install-buildtools).\n"
    version = result.split()[3]
    if bb.utils.vercmp_string_op(version, "1.28", "<"):
        return "Your version of tar is older than 1.28 and does not have the support needed to enable reproducible builds. Please install a newer version of tar (you could use the project's buildtools-tarball from our last release or use scripts/install-buildtools).\n"
@@ -574,6 +604,28 @@ def drop_v14_cross_builds(d):
                bb.utils.remove(stamp + "*")
                bb.utils.remove(workdir, recurse = True)
+def check_cpp_toolchain_flag(d, flag, error_message=None):
+    """
+    Checks if the g++ compiler supports the given flag
+    """
+    import shlex
+    import subprocess
+    cpp_code = """
+    #include <iostream>
+    int main() {
+        std::cout << "Hello, World!" << std::endl;
+        return 0;
+    }
+    """
+    cmd = ["g++", "-x", "c++","-", "-o", "/dev/null", flag]
+    try:
+        subprocess.run(cmd, input=cpp_code, capture_output=True, text=True, check=True)
+        return None
+    except subprocess.CalledProcessError as e:
+        return error_message or f"An unexpected issue occurred during the C++ toolchain check: {str(e)}"
 def sanity_handle_abichanges(status, d):
    #
    # Check the 'ABI' of TMPDIR
@@ -638,17 +690,18 @@ def check_sanity_version_change(status, d):
    status.addresult(check_git_version(d))
    status.addresult(check_perl_modules(d))
    status.addresult(check_wsl(d))
+    status.addresult(check_userns())
    missing = ""
    if not check_app_exists("${MAKE}", d):
        missing = missing + "GNU make,"
-    if not check_app_exists('${BUILD_CC}', d):
+    if not check_app_exists('gcc', d):
-        missing = missing + "C Compiler (%s)," % d.getVar("BUILD_CC")
+        missing = missing + "C Compiler (gcc),"
-    if not check_app_exists('${BUILD_CXX}', d):
+    if not check_app_exists('g++', d):
-        missing = missing + "C++ Compiler (%s)," % d.getVar("BUILD_CXX")
+        missing = missing + "C++ Compiler (g++),"
    required_utilities = d.getVar('SANITY_REQUIRED_UTILITIES')
@@ -668,6 +721,7 @@ def check_sanity_version_change(status, d):
    # Check that TMPDIR isn't on a filesystem with limited filename length (eg. eCryptFS)
    import stat
    tmpdir = d.getVar('TMPDIR')
+    topdir = d.getVar('TOPDIR')
    status.addresult(check_create_long_filename(tmpdir, "TMPDIR"))
    tmpdirmode = os.stat(tmpdir).st_mode
    if (tmpdirmode & stat.S_ISGID):
@@ -676,14 +730,14 @@ def check_sanity_version_change(status, d):
        status.addresult("TMPDIR is setuid, please don't build in a setuid directory")
    # Check that a user isn't building in a path in PSEUDO_IGNORE_PATHS
-    pseudoignorepaths = d.getVar('PSEUDO_IGNORE_PATHS', expand=True).split(",")
+    pseudoignorepaths = (d.getVar('PSEUDO_IGNORE_PATHS', expand=True) or "").split(",")
    workdir = d.getVar('WORKDIR', expand=True)
    for i in pseudoignorepaths:
        if i and workdir.startswith(i):
            status.addresult("You are building in a path included in PSEUDO_IGNORE_PATHS " + str(i) + " please locate the build outside this path.\n")
    # Check if PSEUDO_IGNORE_PATHS and paths under pseudo control overlap
-    pseudoignorepaths = d.getVar('PSEUDO_IGNORE_PATHS', expand=True).split(",")
+    pseudoignorepaths = (d.getVar('PSEUDO_IGNORE_PATHS', expand=True) or "").split(",")
    pseudo_control_dir = "${D},${PKGD},${PKGDEST},${IMAGEROOTFS},${SDK_OUTPUT}"
    pseudocontroldir = d.expand(pseudo_control_dir).split(",")
    for i in pseudoignorepaths:
@@ -731,8 +785,11 @@ def check_sanity_version_change(status, d):
    if not oes_bb_conf:
        status.addresult('You are not using the OpenEmbedded version of conf/bitbake.conf. This means your environment is misconfigured, in particular check BBPATH.\n')
-    # The length of TMPDIR can't be longer than 410
+    # The length of TMPDIR can't be longer than 400
-    status.addresult(check_path_length(tmpdir, "TMPDIR", 410))
+    status.addresult(check_path_length(tmpdir, "TMPDIR", 400))
+    # Check that TOPDIR does not contain non ascii chars (perl_5.40.0, Perl-native and shadow-native build failures)
+    status.addresult(check_non_ascii(topdir, "TOPDIR"))
    # Check that TMPDIR isn't located on nfs
    status.addresult(check_not_nfs(tmpdir, "TMPDIR"))
@@ -741,6 +798,14 @@ def check_sanity_version_change(status, d):
    # macOS with default HFS+ file system)
    status.addresult(check_case_sensitive(tmpdir, "TMPDIR"))
+    # Check if linking with lstdc++ is failing
+    status.addresult(check_cpp_toolchain_flag(d, "-lstdc++"))
+    # Check if the C++ toochain support the "--std=gnu++20" flag
+    status.addresult(check_cpp_toolchain_flag(d, "--std=gnu++20",
+        "An error occurred during checking the C++ toolchain for '--std=gnu++20' support. "
+        "Please use a g++ compiler that supports C++20 (e.g. g++ version 10 onwards)."))
 def sanity_check_locale(d):
    """
    Currently bitbake switches locale to en_US.UTF-8 so check that this locale actually exists.
@@ -759,10 +824,10 @@ def check_sanity_everybuild(status, d):
    if 0 == os.getuid():
        raise_sanity_error("Do not use Bitbake as root.", d)
-    # Check the Python version, we now have a minimum of Python 3.8
+    # Check the Python version, we now have a minimum of Python 3.9
    import sys
-    if sys.hexversion < 0x030800F0:
+    if sys.hexversion < 0x030900F0:
-        status.addresult('The system requires at least Python 3.8 to run. Please update your Python interpreter.\n')
+        status.addresult('The system requires at least Python 3.9 to run. Please update your Python interpreter.\n')
    # Check the bitbake version meets minimum requirements
    minversion = d.getVar('BB_MIN_VERSION')
diff --git a/meta/classes-global/sstate.bbclass b/meta/classes-global/sstate.bbclass
index 04539bbb99..53bc2e3940 100644
--- a/meta/classes-global/sstate.bbclass
+++ b/meta/classes-global/sstate.bbclass
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: MIT
 #
-SSTATE_VERSION = "12"
+SSTATE_VERSION = "14"
 SSTATE_ZSTD_CLEVEL ??= "8"
@@ -76,7 +76,7 @@ SSTATE_SCAN_CMD_NATIVE ??= 'grep -Irl -e ${RECIPE_SYSROOT} -e ${RECIPE_SYSROOT_N
 SSTATE_HASHEQUIV_FILEMAP ?= " \
    populate_sysroot:*/postinst-useradd-*:${TMPDIR} \
    populate_sysroot:*/postinst-useradd-*:${COREBASE} \
-    populate_sysroot:*/postinst-useradd-*:regex-\s(PATH|PSEUDO_IGNORE_PATHS|HOME|LOGNAME|OMP_NUM_THREADS|USER)=.*\s \
+    populate_sysroot:*/postinst-useradd-*:regex-\s(PATH|PSEUDO_INCLUDE_PATHS|HOME|LOGNAME|OMP_NUM_THREADS|USER)=.*\s \
    populate_sysroot:*/crossscripts/*:${TMPDIR} \
    populate_sysroot:*/crossscripts/*:${COREBASE} \
    "
@@ -103,7 +103,6 @@ SSTATECREATEFUNCS[vardeps] = "SSTATE_SCAN_FILES"
 SSTATEPOSTCREATEFUNCS = ""
 SSTATEPREINSTFUNCS = ""
 SSTATEPOSTUNPACKFUNCS = "sstate_hardcode_path_unpack"
-SSTATEPOSTINSTFUNCS = ""
 EXTRA_STAGING_FIXMES ?= "HOSTTOOLS_DIR"
 # Check whether sstate exists for tasks that support sstate and are in the
@@ -161,7 +160,10 @@ python () {
    d.setVar('SSTATETASKS', " ".join(unique_tasks))
    for task in unique_tasks:
        d.prependVarFlag(task, 'prefuncs', "sstate_task_prefunc ")
-        d.appendVarFlag(task, 'postfuncs', " sstate_task_postfunc")
+        # Generally sstate should be last, execpt for buildhistory functions
+        postfuncs = (d.getVarFlag(task, 'postfuncs') or "").split()
+        newpostfuncs = [p for p in postfuncs if "buildhistory" not in p] + ["sstate_task_postfunc"] + [p for p in postfuncs if "buildhistory" in p]
+        d.setVarFlag(task, 'postfuncs', " ".join(newpostfuncs))
        d.setVarFlag(task, 'network', '1')
        d.setVarFlag(task + "_setscene", 'network', '1')
 }
@@ -189,7 +191,6 @@ def sstate_state_fromvars(d, task = None):
    plaindirs = (d.getVarFlag("do_" + task, 'sstate-plaindirs') or "").split()
    lockfiles = (d.getVarFlag("do_" + task, 'sstate-lockfile') or "").split()
    lockfilesshared = (d.getVarFlag("do_" + task, 'sstate-lockfile-shared') or "").split()
-    interceptfuncs = (d.getVarFlag("do_" + task, 'sstate-interceptfuncs') or "").split()
    fixmedir = d.getVarFlag("do_" + task, 'sstate-fixmedir') or ""
    if not task or len(inputs) != len(outputs):
        bb.fatal("sstate variables not setup correctly?!")
@@ -205,7 +206,6 @@ def sstate_state_fromvars(d, task = None):
    ss['lockfiles'] = lockfiles
    ss['lockfiles-shared'] = lockfilesshared
    ss['plaindirs'] = plaindirs
-    ss['interceptfuncs'] = interceptfuncs
    ss['fixmedir'] = fixmedir
    return ss
@@ -225,12 +225,23 @@ def sstate_install(ss, d):
    import oe.sstatesig
    import subprocess
+    def prepdir(dir):
+        # remove dir if it exists, ensure any parent directories do exist
+        if os.path.exists(dir):
+            oe.path.remove(dir)
+        bb.utils.mkdirhier(dir)
+        oe.path.remove(dir)
+    sstateinst = d.getVar("SSTATE_INSTDIR")
+    for state in ss['dirs']:
+        prepdir(state[1])
+        bb.utils.rename(sstateinst + state[0], state[1])
    sharedfiles = []
    shareddirs = []
    bb.utils.mkdirhier(d.expand("${SSTATE_MANIFESTS}"))
-    sstateinst = d.expand("${WORKDIR}/sstate-install-%s/" % ss['task'])
    manifest, d2 = oe.sstatesig.sstate_get_manifest_filename(ss['task'], d)
    if os.access(manifest, os.R_OK):
@@ -329,15 +340,21 @@ def sstate_install(ss, d):
        if os.path.exists(state[1]):
            oe.path.copyhardlinktree(state[1], state[2])
-    for postinst in (d.getVar('SSTATEPOSTINSTFUNCS') or '').split():
+    for plain in ss['plaindirs']:
-        # All hooks should run in the SSTATE_INSTDIR
+        workdir = d.getVar('WORKDIR')
-        bb.build.exec_func(postinst, d, (sstateinst,))
+        sharedworkdir = os.path.join(d.getVar('TMPDIR'), "work-shared")
+        src = sstateinst + "/" + plain.replace(workdir, '')
+        if sharedworkdir in plain:
+            src = sstateinst + "/" + plain.replace(sharedworkdir, '')
+        dest = plain
+        bb.utils.mkdirhier(src)
+        prepdir(dest)
+        bb.utils.rename(src, dest)
    for lock in locks:
        bb.utils.unlockfile(lock)
-sstate_install[vardepsexclude] += "SSTATE_ALLOW_OVERLAP_FILES SSTATE_MANMACH SSTATE_MANFILEPREFIX"
+sstate_install[vardepsexclude] += "SSTATE_ALLOW_OVERLAP_FILES SSTATE_MANMACH SSTATE_MANFILEPREFIX STAMP"
-sstate_install[vardeps] += "${SSTATEPOSTINSTFUNCS}"
 def sstate_installpkg(ss, d):
    from oe.gpg_sign import get_signer
@@ -393,29 +410,8 @@ def sstate_installpkgdir(ss, d):
        # All hooks should run in the SSTATE_INSTDIR
        bb.build.exec_func(f, d, (sstateinst,))
-    def prepdir(dir):
-        # remove dir if it exists, ensure any parent directories do exist
-        if os.path.exists(dir):
-            oe.path.remove(dir)
-        bb.utils.mkdirhier(dir)
-        oe.path.remove(dir)
-    for state in ss['dirs']:
-        prepdir(state[1])
-        bb.utils.rename(sstateinst + state[0], state[1])
    sstate_install(ss, d)
-    for plain in ss['plaindirs']:
-        workdir = d.getVar('WORKDIR')
-        sharedworkdir = os.path.join(d.getVar('TMPDIR'), "work-shared")
-        src = sstateinst + "/" + plain.replace(workdir, '')
-        if sharedworkdir in plain:
-            src = sstateinst + "/" + plain.replace(sharedworkdir, '')
-        dest = plain
-        bb.utils.mkdirhier(src)
-        prepdir(dest)
-        bb.utils.rename(src, dest)
    return True
 python sstate_hardcode_path_unpack () {
@@ -645,20 +641,12 @@ def sstate_package(ss, d):
    tmpdir = d.getVar('TMPDIR')
-    fixtime = False
-    if ss['task'] == "package":
-        fixtime = True
-    def fixtimestamp(root, path):
-        f = os.path.join(root, path)
-        if os.lstat(f).st_mtime > sde:
-            os.utime(f, (sde, sde), follow_symlinks=False)
    sstatebuild = d.expand("${WORKDIR}/sstate-build-%s/" % ss['task'])
    sde = int(d.getVar("SOURCE_DATE_EPOCH") or time.time())
    d.setVar("SSTATE_CURRTASK", ss['task'])
    bb.utils.remove(sstatebuild, recurse=True)
    bb.utils.mkdirhier(sstatebuild)
+    exit = False
    for state in ss['dirs']:
        if not os.path.exists(state[1]):
            continue
@@ -668,8 +656,6 @@ def sstate_package(ss, d):
        # to sstate tasks but there aren't many of these so better just avoid them entirely.
        for walkroot, dirs, files in os.walk(state[1]):
            for file in files + dirs:
-                if fixtime:
-                    fixtimestamp(walkroot, file)
                srcpath = os.path.join(walkroot, file)
                if not os.path.islink(srcpath):
                    continue
@@ -679,8 +665,11 @@ def sstate_package(ss, d):
                if not link.startswith(tmpdir):
                    continue
                bb.error("sstate found an absolute path symlink %s pointing at %s. Please replace this with a relative link." % (srcpath, link))
+                exit = True
        bb.debug(2, "Preparing tree %s for packaging at %s" % (state[1], sstatebuild + state[0]))
        bb.utils.rename(state[1], sstatebuild + state[0])
+    if exit:
+        bb.fatal("Failing task due to absolute path symlinks")
    workdir = d.getVar('WORKDIR')
    sharedworkdir = os.path.join(d.getVar('TMPDIR'), "work-shared")
@@ -691,11 +680,6 @@ def sstate_package(ss, d):
        bb.utils.mkdirhier(plain)
        bb.utils.mkdirhier(pdir)
        bb.utils.rename(plain, pdir)
-        if fixtime:
-            fixtimestamp(pdir, "")
-            for walkroot, dirs, files in os.walk(pdir):
-                for file in files + dirs:
-                    fixtimestamp(walkroot, file)
    d.setVar('SSTATE_BUILDDIR', sstatebuild)
    d.setVar('SSTATE_INSTDIR', sstatebuild)
@@ -728,7 +712,7 @@ def sstate_package(ss, d):
    return
-sstate_package[vardepsexclude] += "SSTATE_SIG_KEY"
+sstate_package[vardepsexclude] += "SSTATE_SIG_KEY SSTATE_PKG"
 def pstaging_fetch(sstatefetch, d):
    import bb.fetch2
@@ -742,7 +726,6 @@ def pstaging_fetch(sstatefetch, d):
    localdata = bb.data.createCopy(d)
    dldir = localdata.expand("${SSTATE_DIR}")
-    bb.utils.mkdirhier(dldir)
    localdata.delVar('MIRRORS')
    localdata.setVar('FILESPATH', dldir)
@@ -762,16 +745,19 @@ def pstaging_fetch(sstatefetch, d):
    if bb.utils.to_boolean(d.getVar("SSTATE_VERIFY_SIG"), False):
        uris += ['file://{0}.sig;downloadfilename={0}.sig'.format(sstatefetch)]
-    for srcuri in uris:
+    with bb.utils.umask(bb.utils.to_filemode(d.getVar("OE_SHARED_UMASK"))):
-        localdata.delVar('SRC_URI')
+        bb.utils.mkdirhier(dldir)
-        localdata.setVar('SRC_URI', srcuri)
-        try:
-            fetcher = bb.fetch2.Fetch([srcuri], localdata, cache=False)
-            fetcher.checkstatus()
-            fetcher.download()
-        except bb.fetch2.BBFetchException:
+        for srcuri in uris:
-            pass
+            localdata.delVar('SRC_URI')
+            localdata.setVar('SRC_URI', srcuri)
+            try:
+                fetcher = bb.fetch2.Fetch([srcuri], localdata, cache=False)
+                fetcher.checkstatus()
+                fetcher.download()
+            except bb.fetch2.BBFetchException:
+                pass
 def sstate_setscene(d):
    shared_state = sstate_state_fromvars(d)
@@ -790,12 +776,10 @@ sstate_task_prefunc[dirs] = "${WORKDIR}"
 python sstate_task_postfunc () {
    shared_state = sstate_state_fromvars(d)
-    for intercept in shared_state['interceptfuncs']:
+    shared_umask = bb.utils.to_filemode(d.getVar("OE_SHARED_UMASK"))
-        bb.build.exec_func(intercept, d, (d.getVar("WORKDIR"),))
+    omask = os.umask(shared_umask)
+    if omask != shared_umask:
-    omask = os.umask(0o002)
+       bb.note("Using umask %0o (not %0o) for sstate packaging" % (shared_umask, omask))
-    if omask != 0o002:
-       bb.note("Using umask 0o002 (not %0o) for sstate packaging" % omask)
    sstate_package(shared_state, d)
    os.umask(omask)
@@ -860,15 +844,15 @@ python sstate_create_and_sign_package () {
    # Create the required sstate directory if it is not present.
    if not sstate_pkg.parent.is_dir():
-        with bb.utils.umask(0o002):
+        shared_umask = bb.utils.to_filemode(d.getVar("OE_SHARED_UMASK"))
+        with bb.utils.umask(shared_umask):
            bb.utils.mkdirhier(str(sstate_pkg.parent))
    if sign_pkg:
        from tempfile import TemporaryDirectory
        with TemporaryDirectory(dir=sstate_pkg.parent) as tmp_dir:
            tmp_pkg = Path(tmp_dir) / sstate_pkg.name
-            d.setVar("TMP_SSTATE_PKG", str(tmp_pkg))
+            sstate_archive_package(tmp_pkg, d)
-            bb.build.exec_func('sstate_archive_package', d)
            from oe.gpg_sign import get_signer
            signer = get_signer(d, 'local')
@@ -888,8 +872,7 @@ python sstate_create_and_sign_package () {
        from tempfile import NamedTemporaryFile
        with NamedTemporaryFile(prefix=sstate_pkg.name, dir=sstate_pkg.parent) as tmp_pkg_fd:
            tmp_pkg = tmp_pkg_fd.name
-            d.setVar("TMP_SSTATE_PKG", str(tmp_pkg))
+            sstate_archive_package(tmp_pkg, d)
-            bb.build.exec_func('sstate_archive_package',d)
            update_file(tmp_pkg, sstate_pkg)
            # update_file() may have renamed tmp_pkg, which must exist when the
            # NamedTemporaryFile() context handler ends.
@@ -897,32 +880,33 @@ python sstate_create_and_sign_package () {
 }
-# Shell function to generate a sstate package from a directory
+# Function to generate a sstate package from the current directory.
-# set as SSTATE_BUILDDIR. Will be run from within SSTATE_BUILDDIR.
 # The calling function handles moving the sstate package into the final
 # destination.
-sstate_archive_package () {
+def sstate_archive_package(sstate_pkg, d):
-        OPT="-cS"
+    import subprocess
-        ZSTD="zstd -${SSTATE_ZSTD_CLEVEL} -T${ZSTD_THREADS}"
-        # Use pzstd if available
-        if [ -x "$(command -v pzstd)" ]; then
-                ZSTD="pzstd -${SSTATE_ZSTD_CLEVEL} -p ${ZSTD_THREADS}"
-        fi
-        # Need to handle empty directories
+    cmd = [
-        if [ "$(ls -A)" ]; then
+        "tar",
-                set +e
+        "-I", d.expand("pzstd -${SSTATE_ZSTD_CLEVEL} -p${ZSTD_THREADS}"),
-                tar -I "$ZSTD" $OPT -f ${TMP_SSTATE_PKG} *
+        "-cS",
-                ret=$?
+        "-f", sstate_pkg,
-                if [ $ret -ne 0 ] && [ $ret -ne 1 ]; then
+    ]
-                        exit 1
-                fi
+    # tar refuses to create an empty archive unless told explicitly
-                set -e
+    files = sorted(os.listdir("."))
-        else
+    if not files:
-                tar -I "$ZSTD" $OPT --file=${TMP_SSTATE_PKG} --files-from=/dev/null
+        files = ["--files-from=/dev/null"]
-        fi
-        chmod 0664 ${TMP_SSTATE_PKG}
+    try:
-}
+        subprocess.run(cmd + files, check=True)
+    except subprocess.CalledProcessError as e:
+        # Ignore error 1 as this is caused by files changing
+        # (link count increasing from hardlinks being created).
+        if e.returncode != 1:
+            raise
+    os.chmod(sstate_pkg, 0o664)
 python sstate_report_unihash() {
@@ -1115,7 +1099,7 @@ def sstate_checkhashes(sq_data, d, siginfo=False, currentcount=0, summary=True,
        bb.parse.siggen.checkhashes(sq_data, missed, found, d)
    return found
-setscene_depvalid[vardepsexclude] = "SSTATE_EXCLUDEDEPS_SYSROOT"
+setscene_depvalid[vardepsexclude] = "SSTATE_EXCLUDEDEPS_SYSROOT _SSTATE_EXCLUDEDEPS_SYSROOT"
 BB_SETSCENE_DEPVALID = "setscene_depvalid"
diff --git a/meta/classes-global/staging.bbclass b/meta/classes-global/staging.bbclass
index 3678a1b441..1008867a6c 100644
--- a/meta/classes-global/staging.bbclass
+++ b/meta/classes-global/staging.bbclass
@@ -126,8 +126,8 @@ do_populate_sysroot[vardeps] += "${SYSROOT_PREPROCESS_FUNCS}"
 do_populate_sysroot[vardepsexclude] += "BB_MULTI_PROVIDER_ALLOWED"
 POPULATESYSROOTDEPS = ""
-POPULATESYSROOTDEPS:class-target = "virtual/${HOST_PREFIX}binutils:do_populate_sysroot"
+POPULATESYSROOTDEPS:class-target = "virtual/cross-binutils:do_populate_sysroot"
-POPULATESYSROOTDEPS:class-nativesdk = "virtual/${HOST_PREFIX}binutils:do_populate_sysroot"
+POPULATESYSROOTDEPS:class-nativesdk = "virtual/nativesdk-cross-binutils:do_populate_sysroot"
 do_populate_sysroot[depends] += "${POPULATESYSROOTDEPS}"
 SSTATETASKS += "do_populate_sysroot"
@@ -652,10 +652,17 @@ python do_prepare_recipe_sysroot () {
 addtask do_prepare_recipe_sysroot before do_configure after do_fetch
 python staging_taskhandler() {
+    EXCLUDED_TASKS = (
+        "do_prepare_recipe_sysroot",
+        "do_create_spdx",
+    )
    bbtasks = e.tasklist
    for task in bbtasks:
+        if task in EXCLUDED_TASKS:
+            continue
        deps = d.getVarFlag(task, "depends")
-        if task != 'do_prepare_recipe_sysroot' and (task == "do_configure" or (deps and "populate_sysroot" in deps)):
+        if task == "do_configure" or (deps and "populate_sysroot" in deps):
            d.prependVarFlag(task, "prefuncs", "extend_recipe_sysroot ")
 }
 staging_taskhandler[eventmask] = "bb.event.RecipeTaskPreProcess"
diff --git a/meta/classes-global/uninative.bbclass b/meta/classes-global/uninative.bbclass
index d2297b53f5..c246a1ecd6 100644
--- a/meta/classes-global/uninative.bbclass
+++ b/meta/classes-global/uninative.bbclass
@@ -109,7 +109,7 @@ ${UNINATIVE_STAGING_DIR}-uninative/relocate_sdk.py \
  ${UNINATIVE_LOADER} \
  ${UNINATIVE_STAGING_DIR}-uninative/${BUILD_ARCH}-linux/${bindir_native}/patchelf-uninative \
  ${UNINATIVE_STAGING_DIR}-uninative/${BUILD_ARCH}-linux${base_libdir_native}/libc*.so*" % chksum)
-        subprocess.check_output(cmd, shell=True)
+        subprocess.check_output(cmd, shell=True, text=True, stderr=subprocess.STDOUT)
        with open(loaderchksum, "w") as f:
            f.write(chksum)
@@ -122,7 +122,9 @@ ${UNINATIVE_STAGING_DIR}-uninative/relocate_sdk.py \
        bb.warn("Disabling uninative as unable to fetch uninative tarball: %s" % str(exc))
        bb.warn("To build your own uninative loader, please bitbake uninative-tarball and set UNINATIVE_TARBALL appropriately.")
    except subprocess.CalledProcessError as exc:
-        bb.warn("Disabling uninative as unable to install uninative tarball: %s" % str(exc))
+        bb.warn("Disabling uninative as unable to install uninative tarball:")
+        bb.warn(str(exc))
+        bb.warn(exc.stdout)
        bb.warn("To build your own uninative loader, please bitbake uninative-tarball and set UNINATIVE_TARBALL appropriately.")
    finally:
        os.chdir(olddir)
@@ -140,7 +142,7 @@ def enable_uninative(d):
    loader = d.getVar("UNINATIVE_LOADER")
    if os.path.exists(loader):
        bb.debug(2, "Enabling uninative")
-        d.setVar("NATIVELSBSTRING", "universal%s" % oe.utils.host_gcc_version(d))
+        d.setVar("NATIVELSBSTRING", "universal")
        d.appendVar("SSTATEPOSTUNPACKFUNCS", " uninative_changeinterp")
        d.appendVarFlag("SSTATEPOSTUNPACKFUNCS", "vardepvalueexclude", "| uninative_changeinterp")
        d.appendVar("BUILD_LDFLAGS", " -Wl,--allow-shlib-undefined -Wl,--dynamic-linker=${UNINATIVE_LOADER} -pthread")
diff --git a/meta/classes-global/utility-tasks.bbclass b/meta/classes-global/utility-tasks.bbclass
index ae2da330b8..394cc3158d 100644
--- a/meta/classes-global/utility-tasks.bbclass
+++ b/meta/classes-global/utility-tasks.bbclass
@@ -9,18 +9,17 @@ do_listtasks[nostamp] = "1"
 python do_listtasks() {
    taskdescs = {}
    maxlen = 0
-    for e in d.keys():
+    for t in bb.build.listtasks(d):
-        if d.getVarFlag(e, 'task'):
+        maxlen = max(maxlen, len(t))
-            maxlen = max(maxlen, len(e))
-            if e.endswith('_setscene'):
+        if t.endswith('_setscene'):
-                desc = "%s (setscene version)" % (d.getVarFlag(e[:-9], 'doc') or '')
+            desc = "%s (setscene version)" % (d.getVarFlag(t[:-9], 'doc') or '')
-            else:
+        else:
-                desc = d.getVarFlag(e, 'doc') or ''
+            desc = d.getVarFlag(t, 'doc') or ''
-            taskdescs[e] = desc
+        taskdescs[t] = desc
-    tasks = sorted(taskdescs.keys())
+    for task, doc in sorted(taskdescs.items()):
-    for taskname in tasks:
+        bb.plain("%s  %s" % (task.ljust(maxlen), doc))
-        bb.plain("%s  %s" % (taskname.ljust(maxlen), taskdescs[taskname]))
 }
 CLEANFUNCS ?= ""
diff --git a/meta/classes-global/utils.bbclass b/meta/classes-global/utils.bbclass
index 957389928f..530a490ea8 100644
--- a/meta/classes-global/utils.bbclass
+++ b/meta/classes-global/utils.bbclass
@@ -15,7 +15,7 @@ oe_soinstall() {
                ;;
        esac
        install -m 755 $1 $2/$libname
-        sonamelink=`${READELF} -d $1 |grep 'Library soname:' |sed -e 's/.*\[\(.*\)\].*/\1/'`
+        sonamelink=`${OBJDUMP} -p $1 | grep SONAME | awk '{print $2}'`
        if [ -z $sonamelink ]; then
                bbfatal "oe_soinstall: $libname is missing ELF tag 'SONAME'."
        fi
@@ -147,7 +147,7 @@ oe_libinstall() {
                # special case hack for non-libtool .so.#.#.# links
                baselibfile=`basename "$libfile"`
                if (echo $baselibfile | grep -qE '^lib.*\.so\.[0-9.]*$'); then
-                        sonamelink=`${READELF} -d $libfile |grep 'Library soname:' |sed -e 's/.*\[\(.*\)\].*/\1/'`
+                        sonamelink=`${OBJDUMP} -p $libfile | grep SONAME | awk '{print $2}'`
                        solink=`echo $baselibfile | sed -e 's/\.so\..*/.so/'`
                        if [ -n "$sonamelink" -a x"$baselibfile" != x"$sonamelink" ]; then
                                __runcmd ln -sf $baselibfile $destpath/$sonamelink
@@ -367,3 +367,13 @@ check_git_config() {
                git config --local user.name "${PATCH_GIT_USER_NAME}"
        fi
 }
+# Sets fixed git committer and author for reproducible commits
+reproducible_git_committer_author() {
+        export GIT_COMMITTER_NAME="${PATCH_GIT_USER_NAME}"
+        export GIT_COMMITTER_EMAIL="${PATCH_GIT_USER_EMAIL}"
+        export GIT_COMMITTER_DATE="$(date -d @${SOURCE_DATE_EPOCH})"
+        export GIT_AUTHOR_NAME="${PATCH_GIT_USER_NAME}"
+        export GIT_AUTHOR_EMAIL="${PATCH_GIT_USER_EMAIL}"
+        export GIT_AUTHOR_DATE="$(date -d @${SOURCE_DATE_EPOCH})"
+}
diff --git a/meta/classes-global/yocto-check-layer.bbclass b/meta/classes-global/yocto-check-layer.bbclass
new file mode 100644
index 0000000000..ba93085325
--- /dev/null
+++ b/meta/classes-global/yocto-check-layer.bbclass
@@ -0,0 +1,62 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: MIT
+#
+# This class is used by the yocto-check-layer script for additional
+# per-recipe tests.
+#
+# It adds an anonymous python function with extra processing to all recipes,
+# globally inheriting this class isn't advisable - yocto-check-layer script
+# handles that during its signature dump
+# Ensure that recipes don't skip required QA checks as listed
+# in CHECKLAYER_REQUIRED_TESTS, defined by insane.bbclass
+def check_insane_skip(d):
+    required_tests = set((d.getVar('CHECKLAYER_REQUIRED_TESTS') or '').split())
+    packages = set((d.getVar('PACKAGES') or '').split())
+    for package in packages:
+        skip = set((d.getVar('INSANE_SKIP') or "").split() +
+                   (d.getVar('INSANE_SKIP:' + package) or "").split())
+        skip_required = skip & required_tests
+        if skip_required:
+            oe.qa.write_error(" ".join(skip_required), 'Package %s is skipping required QA tests.' % package, d)
+            bb.error("QA Issue: %s [%s]" % ('Package %s is skipping required QA tests.' % package, " ".join(skip_required)))
+            d.setVar("QA_ERRORS_FOUND", "True")
+# Check that no tasks (with rare exceptions) between do_fetch and do_build
+# use the network.
+def check_network_flag(d):
+    # BPN:task names that are allowed to reach the network, using fnmatch to compare.
+    allowed = []
+    # build-appliance-image uses pip at image time
+    allowed += ["build-appliance-image:do_image"]
+    def is_allowed(bpn, task):
+        from fnmatch import fnmatch
+        name = f"{bpn}:{task}"
+        return any(fnmatch(name, pattern) for pattern in allowed)
+    bpn = d.getVar("BPN")
+    seen = set()
+    stack = {"do_build"}
+    while stack:
+        task = stack.pop()
+        if task == "do_fetch":
+            continue
+        seen.add(task)
+        deps = d.getVarFlag(task, "deps") or []
+        stack |= {d for d in deps if d not in seen}
+        network = bb.utils.to_boolean(d.getVarFlag(task, "network"))
+        if network and not is_allowed(bpn, task):
+            bb.error(f"QA Issue: task {task} has network enabled")
+python () {
+    check_insane_skip(d)
+    check_network_flag(d)
+}