linux/meta-secure-core.git/meta-integrity, branch thud

base-files: only apply the bbappend if ima distro flag set

2018-12-03T07:12:41+00:00

When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao

key-store: rename ima private key and certificate on target

2018-11-07T06:22:47+00:00

If sample keys are selected, key-store service will deploy IMA private key during first boot, but beople may be confused if we deploy a sample private key like "xxx.crt", so this commit is making sure key/cert on target are consistent with key files on build system. Signed-off-by: Yunguo Wei

rpm: disable inhibit plugin for rpm-native

2018-10-17T08:55:13+00:00

We have a bbappend file which enables plugins for rpm. We need to ensure to also disable the inhibit plugin for rpm-native. Otherwise, we get the following warning at rootfs time. Unable to get systemd shutdown inhibition lock: Socket name too long The inhibit plugin tries to inhibit shutdown during rpm operation. It obviously makes no sense for rpm-native, as 1) we may not build on a systemd based host and 2) the build process does not affect the package management on host. Signed-off-by: Chen Qi

layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'

2018-10-08T06:47:47+00:00

Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia

Clean up the stuffs for stable branches

2018-09-21T01:21:37+00:00

The following commits are reverted by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because they are only applicable to rocko. Signed-off-by: Jia Zhang

meta-integrity: rpm: Add back in required patches for rocko

2018-07-31T14:48:35+00:00

In 59a9f43b899c ("meta-integrity: Drop RPM patches that are upstream now") we removed patches to RPM that were not required with a move up to 4.14.0 as they are upstream. However, rocko ships with an older version of RPM and still needs these patches. Add conditional logic to apply these patches only for rocko. Signed-off-by: Tom Rini

layer.conf: Mark as compatible with rocko

2018-07-25T12:41:35+00:00

As we also work with the 'rocko' release list that in our LAYERSERIES_COMPAT. Signed-off-by: Tom Rini

util-linux: allow -static linking for switch_root.static

2018-07-06T06:50:47+00:00

Specify -no-pie to override possible -pie default. Signed-off-by: Joe Slater Signed-off-by: Yi Zhao

sign_rpm_ext.bbclass: fix check_rpm_public_key racing at recipe parsing time

2018-05-31T03:26:13+00:00

All recipe will be parsed which caused lockfile of check_rpm_public_key racing issue. ... |WARNING: meta-secure-core/meta/recipes-core/images/secure-core-image-initramfs.bb: oe-core/bitbake/lib/bb/utils.py:400: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmp-glibc/check_rpm_public_key.lock' mode='a+' encoding='UTF-8'> ... Refer do_package_write_rpm, add check_rpm_public_key to prefunc of do_rootfs, only the running image recipe will invoke check_rpm_public_key. Signed-off-by: Hongxu Jia

layer.conf: add LAYERSERIES_COMPAT

2018-05-26T00:08:58+00:00

see https://patchwork.openembedded.org/patch/140542/ Signed-off-by: Trevor Woerner