From 24b177350650ffc00c6c01a76b5da8765ee01480 Mon Sep 17 00:00:00 2001
From: Luciano Dittgen <luciano.dittgen@ossystems.com.br>
Date: Wed, 15 Jul 2026 10:53:20 -0300
Subject: qoriq-cst: Add DESCRIPTION, fix ordering and do_install per oelint

Address the oelint findings for the recipe:

- Add a distinct DESCRIPTION (mandatoryvar.DESCRIPTION).
- Move RDEPENDS below the SRC_URI/FILES block so SRC_URI is no longer
  placed after RDEPENDS (order.SRC_URI).
- Quote CFLAGS:append with double quotes. The leading space is already
  present, but the single-quoted form tripped oelint's inconspaces check.
- Replace the two "cp -f" calls that copy user-supplied SRK signing keys
  with "install" (task.nocopy), installing the private key 0600 and the
  public key 0644.
- Accept the -dbg buildpaths INSANE_SKIP with an inline # nooelint.

No functional change (the private key is now installed mode 0600 rather
than inheriting the source mode, a minor hardening on the optional
SECURE_PRI_KEY path).

Signed-off-by: Luciano Dittgen <luciano.dittgen@ossystems.com.br>
---
 recipes-devtools/qoriq-cst/qoriq-cst_git.bb | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/recipes-devtools/qoriq-cst/qoriq-cst_git.bb b/recipes-devtools/qoriq-cst/qoriq-cst_git.bb
index 48e410e8a..1613309dd 100644
--- a/recipes-devtools/qoriq-cst/qoriq-cst_git.bb
+++ b/recipes-devtools/qoriq-cst/qoriq-cst_git.bb
@@ -1,4 +1,5 @@
 SUMMARY = "utility for security boot"
+DESCRIPTION = "Code Signing Tool (CST) for QorIQ secure boot: generates keys, signs images and produces the CSF headers consumed by the SoC boot ROM"
 HOMEPAGE = "https://github.com/nxp-qoriq/cst"
 SECTION = "cst"
 LICENSE = "BSD-3-Clause"
@@ -6,7 +7,6 @@ LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e959d5d617e33779d0e90ce1d9043eff"
 
 DEPENDS += "openssl qoriq-cst-native"
-RDEPENDS:${PN} = "bash"
 
 GENKEYS ?= "${STAGING_BINDIR_NATIVE}/cst/gen_keys"
 GENKEYS:class-native = "./gen_keys"
@@ -21,7 +21,7 @@ SRC_URI = "git://github.com/nxp-qoriq/cst;protocol=https;nobranch=1"
 SRCREV = "892d2ed3207d78a3cb5533eeb91bcc73967e3e36"
 
 EXTRA_OEMAKE = 'CC="${CC}" LD="${CC}"'
-CFLAGS:append = ' -Wno-deprecated-declarations'
+CFLAGS:append = " -Wno-deprecated-declarations"
 
 PARALLEL_MAKE = ""
 
@@ -29,14 +29,17 @@ do_install () {
     oe_runmake install DESTDIR=${D} BIN_DEST_DIR=${bindir}
 
     if [ -n "${SECURE_PRI_KEY}" ]; then
-       cp -f ${SECURE_PRI_KEY} ${D}/${bindir}/cst/srk.pri
-       cp -f ${SECURE_PUB_KEY} ${D}/${bindir}/cst/srk.pub
+       install -m 0600 ${SECURE_PRI_KEY} ${D}/${bindir}/cst/srk.pri
+       install -m 0644 ${SECURE_PUB_KEY} ${D}/${bindir}/cst/srk.pub
     elif [ ! -f ${D}/${bindir}/cst/srk.pri -o ! ${D}/${bindir}/cst/srk.pub ]; then
        cd ${D}/${bindir}/cst  && ${GENKEYS} 1024
     fi
 }
 
 FILES:${PN}-dbg += "${bindir}/cst/.debug"
+RDEPENDS:${PN} = "bash"
 BBCLASSEXTEND = "native nativesdk"
+# The cst tools live under ${bindir}/cst and retain build-host paths.
+# nooelint: oelint.vars.insaneskip
 INSANE_SKIP:${PN}-dbg += "buildpaths"
 
-- 
cgit v1.2.3-54-g00ecf