linux/poky.git/meta/classes, branch uninative-1.7

mirrors.bbclass: provide git repo fallbacks using the https protocol

2017-07-27T21:36:53+00:00

Use MIRRORS to provide git repo fallbacks using the https protocol, for cases where git native protocol fetches may fail due to local firewall rules, etc. These rules should cover all git native repos used by recipes within oe-core, with the exception of mtd-utils, for which there's currently no upstream alternative to the git native protocol for anonymous access ( see http://git.infradead.org/mtd-utils.git ). (From OE-Core rev: abb8895d5b42a5dc171360a261a2652acd14ee7e) Signed-off-by: Andre McCurdy Signed-off-by: Richard Purdie

go: centralize definition of COMPATIBLE_HOST

2017-07-27T21:36:52+00:00

Put it in goarch.bbclass which all go related recipes inherit. (From OE-Core rev: 9e899bbc081cb932c1492f6d6802b908d70ef42f) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

image_types_wic: add dependency to e2fsprogs-native

2017-07-27T21:36:52+00:00

Added e2fsprogs-native to the list of default dependencies for wic (WKS_FILE_DEPENDS_DEFAULT) as all fs-related utilities have to be in this list. Thanks to Patrick Ohly for noticing this. [YOCTO #11817] (From OE-Core rev: b1d9f5ba5d75c6e4dae10d9d9b2c03fd3099721d) Signed-off-by: Ed Bartosh Signed-off-by: Richard Purdie

image: Fix "metadata is not deterministic" when chaining 2+ CONVERSION_CMDs

2017-07-25T22:15:53+00:00

When we have more than one CONVERSION_CMD being used, for example ext4.gz.sha256sum we will see errors about "metadata is not deterministic". This is because we do not have a stable order of intermediate files that will be removed in the generated shell command. We fix this by calling sorted() on the set of rm_tmp_images so that we will have a stable hash again. Cc: Patrick Ohly (From OE-Core rev: 98a2afeb3a53bec7a72a4a9846e1dba636cc6f3d) Signed-off-by: Tom Rini Signed-off-by: Richard Purdie

image_types.bbclass: Make u-boot signed images more versatile

2017-07-25T14:59:13+00:00

With the introduction of chaining compression/conversion support we can convert the old image_types_uboot.bbclass code that did a hand-chaining of a set of ${filesystem}.${compression} into generic and arbitrary support to sign whatever the user wants to sign for their image. This, for the record, does remove setting a valid compression type in the record in favour of just saying none. This is not a generally useful feature in U-Boot and I believe being versatile in terms of being able to pass in arbitrary compressions is more important. (From OE-Core rev: 65f27122950a35a67ce39ae4cfe93d0dca6b0dab) Signed-off-by: Tom Rini Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

image.bbclass: Correct chaining compression support

2017-07-25T14:59:13+00:00

When chaining of compression/conversion types was added, we had a new way to handle doing things like "ext4.bz2.sha256sum" or "ext2.gz.u-boot". However, because the U-Boot image class isn't included normally, it wasn't properly converted at the time. After the support was added the "clean" argument that the .u-boot code uses no longer functions. The fix for this inadvertently broke chaining compression/conversion. First, correct the u-boot conversion code. Fixes: 46bc438374de ("image.bbclass: do exact match for rootfs type") Cc: Zhenhua Luo Cc: Richard Purdie Cc: Patrick Ohly (From OE-Core rev: 0a7ce0b971a208956cb895ba5a869ec8c5d94703) Signed-off-by: Tom Rini Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

package_rpm.bbclass: disable generation of .build-id links

2017-07-25T14:59:13+00:00

As we're not using them and they're getting in the way of reproducibility. [YOCTO #11718] (From OE-Core rev: 1bd3ed18379c330c1c733dc9f043dbbe8aa0d254) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

externalsrc: place copy of git index into /tmp and do not use copyfile2

2017-07-25T14:59:12+00:00

Using shutil.copy2() to copy .git/index to a temporary file tries to copy SELinux attributes which might fail for confined users in SELinux environments. E.g. our builders are running in docker containers and modification of sources (inclusive updated of .git/index) is done outside. Trying to copy .git/index fails with | $ python3 -c 'import shutil; shutil.copy2("index", "a")' | ... | PermissionError: [Errno 13] Permission denied: 'a' and an AVC like | denied { relabelto } for pid=18043 comm="python3" name="a" dev="dm-29" ino=1067553 scontext=system_u:system_r:container_t:s0:c39,c558 tcontext=unconfined_u:object_r:build_file_t:s0 tclass=file permissive=0 is created. This can not be solved by adapting the SELinux policy because this is a very deep constraint violation: | constrain file { create relabelfrom relabelto } ((u1 == u2 -Fail-) or (t1 == can_change_object_identity -Fail-) ); Constraint DENIED | | Possible cause is the source user (system_u) and target user (unconfined_u) are different. I do not see much sense in using 'shutil.copy2()' here; 'shutil.copyfile()' seems to be a better choice (target file is created in a secure way by tempfile.NamedTemporaryFile()). By placing the tempfile into /tmp we avoid potential problems related to git's 'core.sharedRepository'. As a (positive) side effect, the source tree will not be modified anymore (at least by this part of code) which prevented to mount it read-only from somewhere else. (From OE-Core rev: 3c3c8ecc61dfed68987750d79b5482ab2f6fa02f) Signed-off-by: Enrico Scholz Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check.bbclass: use "+git" as separator in PV instead of "git+"

2017-07-24T08:13:32+00:00

PV is the recipe major version number. cve-check tries to map that to NVD database release versions of the component. If the recipe sources are taken from git, the PV can be automatically modified to include git details, but the syntax is like 233+gitAUTOINC+a1e2ef7ec9. In CVE checks we want to remove the git details and just use the major version information, in this example 233. Thus use "+git" as the separator and use the first part before the separator as SW product version number in CVE check. Fixes version number for e.g. systemd recipe. If systemd PV is 233+gitAUTOINC+a1e2ef7ec9 there will be no matches from CVE database where latest release mentioned is plain 233. If the filter is set to +git, then CVE PV is 233 and issues like this are detected by do_cve_check: https://nvd.nist.gov/vuln/detail/CVE-2017-1000082 (From OE-Core rev: db8815abe3db60b0510fb378bf6d82172c2f2768) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

kernel.bbclass: set CVE_PRODUCT to linux_kernel if not set by recipe

2017-07-24T08:13:31+00:00

It is used by NVD database CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2017-7273 Setting this in kernel.bbclass fixes CVE reporting for all users of the class. (From OE-Core rev: 2e3d325440a50265c73f7d2e782530a02458bc33) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie