linux/meta-security.git/recipes-core, branch scarthgap-next

packagegroup-core-security: add missing packages

2025-11-24T17:04:14+00:00

Changes: - Add libmhash and libgssglue so they will get tested by CI. - Switch to MACHINE_ARCH to facilitate the above, but it makes sense anyway due to all the machine overrides used in the packagegroup definition. Since this packagegroup is to facilitate testing and unlikely to be used by downstreams, it is believed this will have minimal impact. (adapted from 26e745243d6d28768ed4a237d9a48f68210c70a6) Signed-off-by: Scott Murray

dm-verity-image-initramfs: Set IMAGE_NAME_SUFFIX to empty

2024-03-27T16:36:58+00:00

According to the Yocto reference manual [1], the IMAGE_NAME_SUFFIX should be set to empty for the initramfs image. Otherwise, we may incur a build error like following due to the initrd check in live-vm-common.bbclass: ERROR: core-image-minimal-1.0-r0 do_bootimg: build-test/tmp/deploy/images/genericx86-64/dm-verity-image-initramfs-genericx86-64.cpio.gz is invalid. initrd image creation failed. ERROR: core-image-minimal-1.0-r0 do_bootimg: ExecutionError('build-test/tmp/work/genericx86_64-poky-linux/core-image-minimal/1.0/temp/run.build_hddimg.1961965', 1, None, None) ERROR: Logfile of failure stored in: build-test/tmp/work/genericx86_64-poky-linux/core-image-minimal/1.0/temp/log.do_bootimg.1961965 ERROR: Task (poky/meta/recipes-core/images/core-image-minimal.bb:do_bootimg) failed with exit code '1' [1] https://docs.yoctoproject.org/ref-manual/variables.html#term-IMAGE_NAME_SUFFIX Signed-off-by: Kevin Hao Signed-off-by: Armin Kuster

dm-verity-image-initramfs: Allow compressed image types

2023-08-06T15:31:18+00:00

Using in the depends variable does not work for compressed image types like squashfs-zst, as the resulting task dependency still contains the incompatible dash. Replacing the dash by an underscore resolves this issue. Signed-off-by: Stephan Wurm Signed-off-by: Armin Kuster

packagegroup-core-security: only include firejail x86-64 and arch64

2023-07-31T10:18:52+00:00

Signed-off-by: Armin Kuster

qemu: move qemu setting to image and out of layer.conf

2023-07-31T10:18:52+00:00

I suspect its better form to have these in the image definition. Signed-off-by: Armin Kuster

packagegroup-core-security: add os-release

2023-06-25T19:05:28+00:00

Exclude openscap and scap-security-guide if musl Fix RDEPENDS list to include compliance packages. Signed-off-by: Armin Kuster

dm-verity: hook separate hash into initramfs framework

2023-06-25T19:05:28+00:00

The prior commits create the separate hash so now it is time to update the initramfs framework so that veritysetup, which is responsible for binding the data and hash, is aware of when separate hash is in use, and can react accordingly. The added code follows the existing appended hash code style, but is considerably smaller because it doesn't have the large case statement that supports all possible identification schemes (label, UUID, ...). With the root hash split in two to create the respective partition UUIDs, we know exactly how to identify it, and the UUIDs used. Signed-off-by: Paul Gortmaker Signed-off-by: Armin Kuster

packagegroup-core-security: add compliance pkg group

2023-06-20T15:07:20+00:00

Signed-off-by: Armin Kuster --- v2] Missed to include trailing \

dmverity: Suppress the realpath errors

2023-06-11T14:40:33+00:00

If we use a non PARTUUID root parameter, we would always get a error like below: realpath: /dev/disk/by-partuuid//dev/mmcblk0p2: No such file or directory This seems pretty confusion and it also seems no need to emit this kind of error when we are waiting for the root device. So suppress all the realpath errors. Signed-off-by: Kevin Hao Signed-off-by: Armin Kuster

packagegroup-core-security: refactor the inclusion of krill

2023-03-22T12:02:50+00:00

Signed-off-by: Armin Kuster