linux/meta-security.git/classes, branch master-next

aide-base.bbclass: correct STAGING_AIDE_DIR

2026-05-17T14:45:41+00:00

Fix the typo "aida" to "aide" in STAGING_AIDE_DIR. Signed-off-by: Li Zhou Signed-off-by: Scott Murray

dm-verity-img.bbclass: filter units from value part

2026-01-16T21:25:02+00:00

This is necessary for cryptsetup starting from v2.8.0 which introduced "[units]" in its output breaking the parsing of veritysetup output. VERITY header information for image-poky-20250701085433.squashfs-zst.verity. UUID: 5dc16c55-79b8-4988-9d79-900f8e143f98 Hash type: 1 Data blocks: 40091 Data block size: 4096 [bytes] Hash blocks: 318 Hash block size: 4096 [bytes] Hash algorithm: sha256 Salt: f670bf67a32f4f5a22e052d7bf84830f8d35ea24e2d52f585f6275207899153b Root hash: a7eab55b7933e347650671611e4b2a10571f2a28a1fb0fc8eae409f7a0d86693 This extends the value filter to remove the "[units]" from the .env file, while retaining compatibility to older cryptsetup releases. Signed-off-by: Stephan Wurm Signed-off-by: Scott Murray

dm-verity-img.bbclass: set sparse as "never" during initial file copy

2025-03-12T19:31:15+00:00

This is needed when a verity image is used in conjunction with tools like a WIC and a bmap file, as avoiding writing "sparse" sectors can result in errors in the signature verification. Signed-off-by: Lorenzo Arena Signed-off-by: Armin Kuster

dm-verity: set staging correctly in case basename has changed

2024-12-16T17:49:13+00:00

Fix the verity class when the IMAGE_BASENAME has changed. Prefer DM_VERITY_IMAGE for staging env and wic fragment so it matchs what is used in the dm-verity-image-initramfs and the base wks systemd-bootdisk-dmverity.wks.in. Signed-off-by: Louis Rannou Signed-off-by: Louis Rannou Signed-off-by: Armin Kuster

dm-verity-img.bbclass: add DM_VERITY_SETUP_ARGS

2024-12-16T17:49:04+00:00

Useful to pass additional arguments to veritysetup, for example '--no-superblock' to make system less vulnerable to certain types of attacks and data maniputaion on the disk. Signed-off-by: Grygorii Tertychnyi Signed-off-by: Armin Kuster

dm-verity: Set the IMAGE_FSTYPES correctly when dm-verity is enabled

2024-03-27T16:36:58+00:00

After the using inherit_defer for the image classes in oe-core commit 451363438d38 ("classes/recipes: Switch to use inherit_defer"), the using of anonymous python function in dm-verity-img.bbclass to set the IMAGE_FSTYPES doesn't work anymore. The reason is that image.bbclass also use anonymous python function to add the do_image_xxx task for the corresponding filesystem type. The anonymous function in dm-verity-img.bbclass is evaluated much later than the one in image.bbclass. Then the task such as do_image_vhash will not be added as we expect. So we choose to use "+=" to set the IMAGE_FSTYPES. The populate_sdk_ext.bbclass may generate a dependency list like below: core-image-minimal.do_sdk_depends -> lib32-core-image-minimal.do_image_vhash So we also need to make sure the do_image_vhash task for the multilib filesystem is added. Signed-off-by: Kevin Hao Signed-off-by: Armin Kuster

dm-verity: Adjust the image names according to the oe-core change

2024-03-27T16:36:58+00:00

After the oe-core commit 26d97acc7137 ("image-artifact-names: include ${IMAGE_NAME_SUFFIX} directly in both ${IMAGE_NAME} and ${IMAGE_LINK_NAME}"), the image names have changed from core-image-minimal-qemux86-64-20230307181808.rootfs.ext4 core-image-minimal-qemux86-64.ext4 to core-image-minimal-qemux86-64.rootfs-20230307181456.ext4 core-image-minimal-qemux86-64.rootfs.ext4 Adjust the images name used by dm-verity according to this change. Signed-off-by: Kevin Hao Signed-off-by: Armin Kuster

dm-verity-img.bbclass: add DM_VERITY_DEPLOY_DIR

2023-12-29T14:09:30+00:00

If image recipe A wants to embed another image B which used dm-verity-img.bbclass and generated the .wks file, then recipe B must deploy everything to IMGDEPLOYDIR but recipe A finds the output from DM_VERITY_DEPLOY_DIR = "${DEPLOY_DIR_IMAGE}". Now both A and B images can use dm-verity-img.bbclass. Signed-off-by: Mikko Rapeli Reviewed-by: Erik Schilling Signed-off-by: Armin Kuster

dm-verity-img.bbclass: remove IMAGE_NAME_SUFFIX

2023-12-29T14:09:30+00:00

It is embedded into IMAGE_NAME since poky master branch commit 6f6c79029bc2020907295858449c725952d560a1 Signed-off-by: Mikko Rapeli Signed-off-by: Erik Schilling Signed-off-by: Armin Kuster

dm-verity-img.bbclass: use bc-native

2023-12-29T14:09:30+00:00

Build host may not have bc. Signed-off-by: Mikko Rapeli Signed-off-by: Erik Schilling Signed-off-by: Armin Kuster