feat: wrynose integration - #674
Open
mlilien wants to merge 58 commits into
Open
Conversation
Move every kas layer pin from scarthgap (5.0.18) to wrynose (6.0): - oe.yaml: bitbake 2.18, openembedded-core wrynose @ yocto-6.0.1, OE_VERSION 6.0.1 - omnect-os.yaml: meta-openembedded, meta-security, meta-swupdate, meta-virtualization - x86_64: meta-yocto-bsp, meta-secure-core, meta-perl - phytec: meta-phytec, meta-freescale, meta-imx (wrynose-6.18.20-2.0.0), meta-arm - rpi: meta-raspberrypi pinned to master (no wrynose release branch upstream yet) Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
- layer.conf: LAYERSERIES_COMPAT_omnect = "wrynose" - omnect-os-distro.conf: migrate the obsoleted *_BACKFILL_CONSIDERED to *_OPTED_OUT and opt out the full DISTRO_FEATURES_DEFAULTS set. wrynose force-appends DISTRO_FEATURES_DEFAULTS (minus *_OPTED_OUT) regardless of the absolute DISTRO_FEATURES assignment, so opting out keeps the headless feature set as lean as it was on scarthgap (bluetooth/wifi/3g stay MACHINE_FEATURES-gated). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
In wrynose do_unpack places SRC_URI sources under ${UNPACKDIR} and git
checks out to ${UNPACKDIR}/${BP} (BB_GIT_DEFAULT_DESTSUFFIX).
- drop redundant S = "${WORKDIR}/git" (default S is now correct)
- point file:// source reads and libeis-utils git paths at ${UNPACKDIR}
- radio-firmware: S = "${UNPACKDIR}"
- add spaces around '=' assignments (CVE_PRODUCT, RUSTFLAGS); 6.0 warns on FOO="bar"
Cargo crate-path rework (omnect-device-service, iotedge, aziot-edged,
aziot-identityd) is deferred; it depends on the wrynose cargo class layout.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose ships a current rust carrying the target-spec fixes the local 1.93
override provided, so remove the override:
- delete recipes-devtools/rust/{rust,cargo,libstd-rs,rust-llvm}_1.93.0.bb,
rust-source.inc, rust-snapshots.inc
- delete kas/patches/oe_rust-target-config.patch
- drop RUSTVERSION = "1.93%" pin from omnect-os-rust.conf
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
The *_layerdir.patch files (which inject LAYERDIR_<collection>) failed to apply on wrynose because the upstream layer.conf tails shifted. Regenerate each against its pinned wrynose commit so they apply cleanly: - meta-virtualization, meta-arm, meta-imx, meta-efi-secure-boot, meta-phytec, meta-freescale, meta-raspberrypi, oe (LAYERDIR_core) - meta-imx/meta-efi-secure-boot: drop the now-obsolete LAYERSERIES_COMPAT edit (their wrynose branches already declare wrynose) Split oe.patch: oe.yaml now applies only oe_layerdir.patch (LAYERDIR_core). The omnect bootimg-efi.py customization is deferred to a layer-local WIC plugin (x86/GRUB phase); kept in oe_bootimg_efi_wic.patch for reference. Drop meta-openembedded.patch: both hunks are obsolete on wrynose (the networkmanager girepository do_configure:prepend is gone in 1.56.0; the nspr perl/tests block is gone in 4.38.2). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Yocto 5.1 removed VOLATILE_LOG_DIR. /var/log is now made non-volatile by removing files/fs-perms-volatile-log.txt from FILESYSTEM_PERMS_TABLES, which base-files reads to decide whether /var/log symlinks into /var/volatile. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose's meta-imx-sdk (fsl-sdk-release) now declares LAYERDEPENDS = "freescale-distro fsl-bsp-release perl-layer", pulling in two layers omnect doesn't use. The headless image masks every meta-imx-sdk recipe anyway (graphics/multimedia), and meta-imx-bsp only depends on freescale-layer, so drop meta-imx-sdk and its now-obsolete BBMASK block. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Yocto 6.0 WKS_SEARCH_PATH looks in <BBPATH>/files/wic; the OE-core sanity checker now errors on .wks/.wks.in left in a bare wic/ dir. Relocate them; WKS_FILE/include references are by name and resolve via the search path. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Yocto 5.3+ warns on assignments without surrounding whitespace (LIC_FILES_CHKSUM, BBCLASSEXTEND, IMAGE_LINK_NAME, SYSTEMD_SERVICE override). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
meta-phytec's wrynose branch bumped the imx8mm u-boot from u-boot-phytec-imx_2024.04-2.2.0-phy23 to -phy25 (the recipe whose COMPATIBLE_MACHINE still lists phygate-tauri-l-imx8mm-2; the newer 2025.04/ 2026.01 recipes are imx8mp/electra/lyra only). omnect_bootloader_versioning checksums OMNECT_BOOTLOADER_RECIPE_PATH, so it must name the existing file. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose meta-phytec renamed the ATF bbappend from imx-atf_2.10.bbappend to the version-independent imx-atf_%.bbappend, so the hardcoded path no longer globbed and omnect_bootloader_versioning fatally couldn't handle the checksum_file. Use imx-atf_*.bbappend (matching the imx-atf_*.bb entry just below) so it survives future ATF bumps. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
The wrynose phytec bootloader (u-boot 2024.04-2.2.0-phy25, imx-atf 2.14) differs from the scarthgap one, so OMNECT_BOOTLOADER_CHECKSUM_EXPECTED is updated to the newly-computed baseline. This is a new, non-rollback-compatible bootloader, so no OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE entry is added. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Dropping meta-imx-sdk left meta-phytec's mcore-demos bbappend (imx-m33-demos) without a base recipe; 6.0 removed BB_DANGLINGAPPENDS_WARNONLY so it's a hard error. Mask the mcore-demos dir - the Cortex-M demos aren't wanted on a headless device (cf. the imx-m4-demos removal above). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Yocto promoted patch-status to a fatal ERROR_QA. Our local recipe patches don't carry Upstream-Status headers; move the check to WARN_QA so the build doesn't fail, without annotating every patch. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose's coreutils-dev RRECOMMENDS gawk-dev, but gawk is GPL-3.0-or-later & AGPL-3.0-or-later and excluded via INCOMPATIBLE_LICENSE. Keep it out of the image with BAD_RECOMMENDATIONS rather than whitelist a (notably AGPL) license for a package we don't ship. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
dropbear 2025.89 relocated sources under src/ and already carries the exact (!exists || S_ISREG(stb.st_mode)) ftruncate guard upstream (src/scp.c), so our Fix-inappropriate-fifo-truncate.patch no longer applies and is redundant. The dropbear bbappend existed only to carry it; remove the whole recipe dir (scp is still built via BINCOMMANDS). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
BAD_RECOMMENDATIONS only filters at do_rootfs install time, but the gawk-dev miss fails earlier in bitbake's build-dependency graph (gawk is skipped for incompatible license GPL-3.0/AGPL-3.0). Remove it from coreutils-dev's RRECOMMENDS in metadata so it's never pulled into the graph. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
…ynose
do_configure/do_install copied file:// SRC_URI sources from ${WORKDIR}, but
wrynose unpacks them under ${UNPACKDIR}. Repoint the source reads:
- phytec u-boot bbappend: omnect_env_phycore_imx8mm.h, phycore_imx8mm.env
- omnect_uboot_configure_env.bbclass: omnect_env.h, omnect_env.env
- bootloader-versioned u-boot/grub: version-script template + grub script
- grub-env / bootloader-env: grubenv, bootloader_env_*.sh
- rpi u-boot bbappend: omnect_env_rpi.h
Generated outputs (uboot-env.bin, boot-menu.inc, the version .sh) stay on
${WORKDIR}. The x86 grub-efi_%.bbappend is deferred to the x86 phase (its
grub-efi.cfg/efi-secure-boot.inc come from base recipes needing verification).
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
6.0 warns on the missing space after '=' in SERIAL_CONSOLES ="...". A repo-wide scan confirms this was the last such bitbake-metadata assignment. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
u-boot-phytec-imx_%.bbappend is one of OMNECT_BOOTLOADER_CHECKSUM_FILES, so the UNPACKDIR source-read fix (74adb1d) changed the computed bootloader checksum. Update the expected baseline to match. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose's cargo classes moved CARGO_HOME to ${UNPACKDIR}/cargo_home, renamed the
config to config.toml, unpack destsuffix crates under ${UNPACKDIR}, and now
auto-emit [patch] redirects from SRC_URI name=/destsuffix=. Adapt the omnect
vendoring:
- drop S = "${WORKDIR}/git" (default S now correct; do_unpack errored on it)
- EXTRA_OECARGO_PATHS / patchdir crate paths ${WORKDIR}->${UNPACKDIR}
- omnect_rust_aziot-identityd_deps.bbclass: rewrite the workspace-member path
fixups against ${UNPACKDIR}/cargo_home/config.toml
- keep the cargo build output on ${WORKDIR}/build (B=${WORKDIR}/build),
and binaries still install from ${B}/target
Build-verify: the omnect EXTRA_OECARGO_PATHS may now overlap oe-core's auto
[patch]; refine against the first do_compile if cargo reports duplicate/missing
path entries.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose meta-imx imx-atf_2.14 controls the debug build through PACKAGECONFIG[debug]="DEBUG=1,DEBUG=0" and derives its deploy folder from PACKAGECONFIG; the old ATF_DEBUG var is no longer read, so dev builds defaulted to release/ while our do_deploy:append looked in debug/. Enable the debug PACKAGECONFIG for dev images (OMNECT_RELEASE_IMAGE=0); OUTPUT_FOLDER stays aligned for the append. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
meta-phytec pins U-Boot 2024.04, whose bundled dtc/pylibfdt calls the 2-arg SWIG_Python_AppendOutput; wrynose's SWIG 4.3 made it 3-arg, so scripts/dtc/ pylibfdt fails to compile. do_configure:prepend rewrites the typemaps to the version-agnostic SWIG_AppendOutput macro (the upstream dtc 1.7.2 fix). oe-core sidesteps this with U-Boot 2026.01/dtc 1.7.2. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
The pylibfdt SWIG-4.3 fix (c672d61) edited u-boot-phytec-imx_%.bbappend, a checksummed bootloader input, so the computed checksum changed again. Update the expected baseline. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
wrynose oe-core removed the separate rust-llvm recipe (rust now provisions LLVM
itself) and upstreamed clang into oe-core. omnect's bindgen libclang setup -
building clang into rust-llvm-native (-DLLVM_ENABLE_PROJECTS=clang) and pointing
LLVM_CONFIG_PATH at .../llvm-rust/bin - is therefore dead, so bindgen panicked
'Unable to find libclang'. Depend on clang-native and set
LIBCLANG_PATH=${STAGING_LIBDIR_NATIVE} instead (aziot-identityd +
omnect_rust_azure-iot-sdk_deps); drop the obsolete rust-llvm-native override.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
aziot recipes' cargo builds (aziot-identityd, aziot-edged, iot-hub-device-update) need PKG_CONFIG_PATH/PKG_CONFIG_SYSROOT_DIR pointing at the target sysroot to resolve system libs like tss2-tctildr (tcti-sys crate). wrynose's cargo classes only export PKG_CONFIG_ALLOW_CROSS, so pkg-config searched host paths and missed the staged tss2-tctildr.pc. inherit pkgconfig in the shared aziot class supplies those exports. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
With libclang now from host clang-native, bindgen parsed the tss2 wrapper.h
without the target headers and emitted opaque structs (only _address), so
tss-minimal failed (TPM2B_PUBLIC etc. 'has no field'). Add
--sysroot=${STAGING_DIR_TARGET} to BINDGEN_EXTRA_CLANG_ARGS (aziot-identityd +
omnect_rust_azure-iot-sdk_deps) so clang finds the real tss2 type definitions.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
The Makefile-driven keys bindgen has no cargo TARGET, so host clang defaulted
to x86_64: it rejected the aarch64 -mcpu/-mbranch-protection from TUNE_CCARGS and
misparsed the target glibc headers (bits/timesize-32.h not found). Set
--target=${TARGET_SYS} (and keep --sysroot) and drop TUNE_CCARGS, which doesn't
affect bindgen output. Cargo-driven bindgens still get their own --target; the
extra one is harmless.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
…n wrynose The 1.5.6 crate set pinned clang-sys 1.6.1 / bindgen 0.69.4, which can't walk oe-core clang's libclang AST: every tss2 TPM2 struct (tpm/tss-minimal/types-sys) bindgen'd to a field-less opaque `_address` blob, so tss-minimal failed to compile (E0560/E0609 on TPM2B_PUBLIC and friends). clang -fsyntax-only parsed the same wrapper.h cleanly and both the 0.60.1 and 0.69.4 bindgens produced identical opaque output, confirming the break is in bindgen/clang-sys, not the recipe's --target/--sysroot args. iot-identity-service main pins clang-sys 1.8.1 / bindgen 0.72.1, which parse the headers correctly, and keeps the same tss-minimal/types-sys/esys-sys build model. - bump SRCREV to main (1a7a6e70); regenerate the cargo-bitbake crate SRC_URI from main's Cargo.lock (320 crates.io crates, plus sd-notify added by send_sd_notify) - rebase send_sd_notify.patch onto main's workspace-style dependency list - drop fix_linker_and_linter_findings.patch and the `-D warnings` RUSTFLAG: that patch existed only to silence lints that warnings-as-errors turned fatal on the old tree; enforcing -D warnings on upstream code is not our concern and the patch is unmaintainable across versions Re-pin to a release tag once one ships carrying these crate versions. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
… 2024
iot-identity-service main (now pinned for aziot-identityd) is Rust edition 2024.
cbindgen 0.24.3 bundles syn 1.x, which cannot parse it: the Makefile cbindgen step
that regenerates aziot-keys.h failed with Error("expected path"). 0.29.2 (syn 2.x)
is the version aziot's ci/install-build-deps.sh pins alongside bindgen 0.72.1.
SRCREV -> v0.29.2 (76f41c0); crate SRC_URI + sha256sums regenerated from cbindgen's
Cargo.lock (72 crates.io deps); LICENSE md5 unchanged.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
This reverts commit 8ffd3a8.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
U-Boot renamed the redundant-environment Kconfig symbol SYS_REDUNDAND_ENVIRONMENT -> ENV_REDUNDANT. The rpi bump to 2026.01 thus silently dropped the old symbol from redundant-env.cfg during oldconfig, leaving CONFIG_ENV_REDUNDANT off and CONFIG_ENV_OFFSET_REDUND unset, so U-Boot was built with a non-redundant env (CRC32 + data). The Linux side stays redundant (OMNECT_PART_REDUNDANT_UBOOT_ENV=1 -> two-line fw_env.config and mkenvimage -r), whose format inserts a flags byte after the CRC. The mismatched formats made U-Boot's CRC check fail and fall back to its compiled-in default env, so fw_setenv writes from the swupdate handler (e.g. omnect_validate_update_part) never reached U-Boot: the A/B update-validation flow never engaged and base_test.sh::test_aziot_identityd_precondition failed on rpi4. List both symbol names so the fragment works across u-boot versions: rpi 2026.01 honors ENV_REDUNDANT, phytec 2024.04 still honors SYS_REDUNDAND_ENVIRONMENT; oldconfig drops whichever the recipe's u-boot does not define. Verified via 'bitbake -c configure -f u-boot': CONFIG_ENV_REDUNDANT=y and CONFIG_ENV_OFFSET_REDUND=0x120000 now stick. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
flash_mode_setup_network() looped forever on 'ifconfig ${if_name} up'
because the busybox initramfs has no ifconfig applet (net-tools), so the
interface never came up and the flashing host could never reach the DUT
(genericx86-64/arrakis flash-mode-2 'Waiting for eth0 ...' hang). Use
'ip link set ... up', matching the 'ip addr show' already used just below.
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
On 32-bit ARM (dehndetect) the gnueabi target triple defaults clang to soft-float, so bindgen resolved the wrong glibc ABI stubs header (gnu/stubs-soft.h, absent in a hard-float sysroot) and azure-iot-sdk-sys / aziot-identityd failed to generate bindings. Append TUNE_CCARGS (carrying -mfloat-abi=hard/-mfpu) to BINDGEN_EXTRA_CLANG_ARGS for arm targets; aarch64/x86 are left untouched. Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Brings in main's 6 commits since omnect#665 (security sanity skip, coredump Storage=none, iot-hub-device-update 1.4.0, image-wide RELRO hardening, adu SIGSEGV fix, wifi-commissioning 0.2.1). Conflict resolution in iot-hub-device-update (1.2.6.bb -> 1.4.0.bb rename): - keep main's version bump to 1.4.0 - re-apply wrynose framework adaptations: UNPACKDIR (not WORKDIR) and the dropped S = "${WORKDIR}/git" - keep the fix-diagnostics-devicename-header-guard.patch (GCC 15 -Wheader-guard) - follow main in dropping the "rm adu-swupdate.sh" step (1.4.0 no longer installs it) Auto-merged conf/distro/include/omnect-os-distro.conf, kas/distro/omnect-os.yaml and systemd_%.bbappend (disjoint hunks; verified). Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
mlilien
marked this pull request as draft
July 23, 2026 15:51
Signed-off-by: Marcel Lilienthal <134974+mlilien@users.noreply.github.com>
mlilien
force-pushed
the
wrynose_integration
branch
from
July 24, 2026 06:21
53a9415 to
fdb3908
Compare
mlilien
commented
Jul 24, 2026
| @@ -1,2 +1,2 @@ | |||
| CONFIG_DISPLAY_CPUINFO=y | |||
| # CONFIG_DISPLAY_CPUINFO is not set | |||
Contributor
Author
There was a problem hiding this comment.
on purpose, rpi hangs when activating it
JanZachmann
reviewed
Jul 24, 2026
JanZachmann
left a comment
JanZachmann
left a comment
Contributor
There was a problem hiding this comment.
Review focus: idiomatic yocto/bitbake, comment/language rules, scarthgap->wrynose (5.0.18 -> 6.0.2) migration completeness, inconsistencies.
Overall: the migration is thorough and internally consistent. Kas pins verified against upstream (oe-core/bitbake peel exactly from tag yocto-6.0.2, no layer left on an old branch); every deleted workaround maps to an upstream wrynose fix or the dropped rust 1.93 backport; WORKDIR->UNPACKDIR is complete (no ${WORKDIR} refs left); all component SRCREVs match their claimed tags. Two blockers, both inline: the fork URL in omnect-device-service and the missing || return 1 in fs-mount.
Should still be changed in this PR (lines outside the diff, so no inline comment possible):
- README.md:102,108 — still says "compatible with ...
scarthgap" and "versioned5.0.x.y". This PR bumps OE_VERSION to 6.0.2, so these lines need updating to wrynose /6.0.x.y. - conf/machine/include/phytec-imx8mm.inc:62-72 — this PR drops meta-imx-sdk from kas, which turns the
meta-imx/meta-imx-sdk/...BBMASK entries into no-ops (BBMASK on paths outside BBLAYERS does nothing). The stale entries can go. - recipes-devtools/toml-cli/toml-cli-0.2.3.inc:1 and cargo-cyclonedx-0.5.7.inc:1 — "not compatible with scarthgap per se" should say wrynose or drop the release name.
Noticed while reviewing, but the code is already on main (follow-up material, not this PR):
- initrdscripts resize-data — three real issues: (1) lines 30-36: if a boot is interrupted between
parted resizepartandresize2fs, the next boot sees no free sectors, sets the flag, and the filesystem stays small forever — runresize2fs(idempotent) in that branch too; (2) line 56:[ $? -gt 1 ]treats e2fsck exit 2 ("errors corrected, reboot needed") as fatal — real failures start at 4, use-ge 4; (3) line 42:sgdisk -eis the only command in the block without|| return 1. - systemd_%.bbappend:65 — the coredump
Storage=nonesed silently no-ops if the conf template format drifts; suggest thegrep -q ... || bbfatalguard this repo already uses in wifi-commissioning-service.inc. - omnect-os-distro.conf:31-32 — bitbake 2.18 supports
addpylib; alib/omnect/device_cap()helper could callbb.parse.mark_dependency()and parse the JSON once instead of on everyDISTRO_FEATURESexpansion. - doc/mac_lsm.md:25-26 — says the userspace install is gated on the
apparmorDISTRO_FEATURE, butOMNECT_MAC_USERSPACEin omnect-os-image.bb is unconditional. Also line 6: "out of the box" -> "by default"; README.md:501: "levers" -> "settings". - omnect-wifi-commissioning-start.sh:30 —
True/TRUE/CRLF values ofWCS_DISABLE_BLEsilently keep BLE enabled; log the unmatched value. - omnect-os-update-image.bb:58 — the
grubenvskip has no why-comment. - files/wic/omnect-os.rpi.wks.inc:5 — bare
includewhile the.wks.infiles use${LAYERDIR_omnect}/...; works, but the asymmetry invites a wrong copy later.
Cross-repo note: the omnect-os CI whitelists are organized per release (dunfell/kirkstone/scarthgap) — a wrynose/ set will be needed there.
| SRC_URI += "git://github.com/omnect/omnect-device-service.git;protocol=https;nobranch=1;branch=main" | ||
| SRCREV = "4d6be836f1b47d55e7479eae28d251b6a64348f2" | ||
| # SRC_URI += "crate://crates.io/omnect-device-service/0.44.1" | ||
| SRC_URI += "git://github.com/mlilien/omnect-device-service.git;protocol=https;nobranch=1;branch=main" |
Contributor
There was a problem hiding this comment.
critical: SRC_URI points to the personal fork. SRCREV 2a83cef is exactly the omnect/omnect-device-service 0.44.1 tag commit, so only the URL needs to go back to github.com/omnect/omnect-device-service.git.
Contributor
There was a problem hiding this comment.
i keep that one as a reminder
| # Mounting our own tmpfs on ${ROOTFS_DIR}/run here would be shadowed by that | ||
| # move (losing anything written to it), so we only re-apply our hardened | ||
| # options to the framework's /run instead. | ||
| run_cmd mount -o remount,mode=0755,nodev,nosuid,strictatime /run |
Contributor
There was a problem hiding this comment.
critical: the old mount line had || return 1; the remount does not. If the remount fails, boot continues with /run missing nodev,nosuid,strictatime. If /run was never mounted at all, everything written there later (e.g. omnect-os-initramfs.json) vanishes at switch_root without any error. Please restore || return 1.
| install -m 0644 -D ${WORKDIR}/${MACHINE}.json ${D}${sysconfdir}/omnect/device_caps.json | ||
| install -m 0644 -D ${UNPACKDIR}/${MACHINE}.json ${D}${sysconfdir}/omnect/device_caps.json | ||
| } | ||
| FILES_${PN} += "${sysconfdir}/omnect/device_caps.json" |
Contributor
There was a problem hiding this comment.
FILES_${PN} is the pre-kirkstone override syntax — this line is ignored on wrynose. It works anyway because oe-core base-files packages /, but it should be FILES:${PN} += (or be deleted).
| DISTRO_FEATURES:append = " efi-secure-boot modsign" | ||
|
|
||
| # We verify the grub config with SELoader (PKCS7 .p7b), matching OMNECT_GRUB_EFI_SB_FILES | ||
| # and the LockDown/SELoader artifacts below. wrynose's meta-secure-core (commit 6d83fbf) |
Contributor
There was a problem hiding this comment.
Commit hash and scarthgap-vs-wrynose history in a code comment. Keep only the mechanism, e.g.: "meta-secure-core defaults to grub's built-in GPG .sig check; we verify the grub config with SELoader (PKCS7 .p7b) instead, so pin both switches."
| @@ -1,7 +1,10 @@ | |||
| FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:" | |||
|
|
|||
| # file-only recipe: sources land in ${UNPACKDIR}, not the default ${UNPACKDIR}/${BP}. | |||
Contributor
There was a problem hiding this comment.
"not the default ${UNPACKDIR}/${BP}" describes what it is not. "file-only recipe: sources are unpacked directly into ${UNPACKDIR}." is enough. Same comment in 7 more recipes (bootloader-env, grub-env, omnect-os-initramfs-scripts, omnect-base-files, omnect-first-boot, omnect-wifi-commissioning, tpm-udev).
| @@ -1,19 +1,22 @@ | |||
| diff --git a/arch/arm/mach-bcm283x/Makefile b/arch/arm/mach-bcm283x/Makefile | |||
Contributor
There was a problem hiding this comment.
Leftovers: cmd/rstinfo.c keeps an unused extern int print_cpuinfo(void);, and the init.c hunk prints inside print_cpuinfo(), which is compiled out by the cfg fragment (# CONFIG_DISPLAY_CPUINFO is not set). Both can go.
| # this is based on the handling in openembedded-core/meta/recipes-bsp/u-boot/u-boot.inc | ||
| # openembedded-core's u-boot.inc now builds into O=${B}/${config}-${type}, | ||
| # so the initial env lives in that -${type}-suffixed dir, not ${config}/. | ||
| # UBOOT_MACHINE/UBOOT_CONFIG only ever hold a single config here. |
Contributor
There was a problem hiding this comment.
Since only the first word of each variable is wanted, the nested loops with break 2 can be:
set -- ${UBOOT_MACHINE}; config=$1
set -- ${UBOOT_CONFIG}; type=$1| @@ -1,6 +1,17 @@ | |||
| # wrynose dropped the custom rust-llvm (which carried clang); bindgen now gets | |||
Contributor
There was a problem hiding this comment.
Misattribution: the custom rust-llvm was our own recipe (deleted in this PR), not something the wrynose release dropped. Suggest: "the custom rust-llvm (which carried clang) was dropped with the wrynose upgrade; bindgen now gets libclang from oe-core's clang-native."
| UEFI_SELOADER = "1" | ||
| GRUB_SIGN_VERIFY = "0" | ||
|
|
||
| # for patched wic plugin bootimg-efi.py: |
Contributor
There was a problem hiding this comment.
Comment drift: the patched plugin now lives in the standalone wic recipe (src/wic/plugins/source/bootimg_efi.py), patched via recipes-support/wic/wic_%.bbappend.
| INSANE_SKIP:${PN}:pn-gobject-introspection = "file-rdeps" | ||
| PACKAGECONFIG:remove:pn-apparmor = "python" | ||
|
|
||
| # disable glib-2.0 dependency to shared-mime-info |
Contributor
There was a problem hiding this comment.
This pn-apparmor line sits in the glib block; the other apparmor tweaks (perl removal, PERLCONFIGTARGET) are ~20 lines up — move it next to them.
There was a problem hiding this comment.
Pull request overview
This PR migrates the meta-omnect Yocto layer and its build setup to the wrynose / OE 6.0.x baseline, updating recipes, kas pins, and integration patches to match upstream structural and QA changes (notably around ${UNPACKDIR} and stricter QA defaults).
Changes:
- Rebase/pin kas configuration and layer compatibility to wrynose / OE 6.0.2 (including multiple layerdir patches).
- Update many recipes and bbclasses to use
${UNPACKDIR}-based paths and adjust build tooling assumptions (Rust/cargo, bindgen/libclang, etc.). - Add/adjust boot & image integration pieces (wic secure-boot ESP population patch, initramfs
/runhandling, U-Boot reset-info, partition sizing).
Reviewed changes
Copilot reviewed 110 out of 117 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| wic/omnect-os.rpi4.wks.in | Remove legacy RPi4 wks location (moved under files/wic/). |
| recipes-support/wic/wic/populate-esp-from-omnect-secure-boot-artifacts.patch | Patch wic bootimg-efi plugin to populate ESP from omnect signed secure-boot artifacts. |
| recipes-support/wic/wic_%.bbappend | Apply the secure-boot ESP population patch via the standalone wic recipe. |
| recipes-omnect/wifi-commissioning-service/wifi-commissioning-service.inc | Adjust ${S} and dependency/pkgconfig handling for wrynose unpack/QAs. |
| recipes-omnect/tpm-udev/tpm-udev.bb | Switch file-only recipe install paths from ${WORKDIR} to ${UNPACKDIR}. |
| recipes-omnect/omnect-wifi-commissioning/omnect-wifi-commissioning.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-omnect/omnect-first-boot/omnect-first-boot.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-omnect/omnect-device-service/omnect-device-service.inc | Fix ${S} and cargo path overrides for wrynose unpack layout; adjust template installs. |
| recipes-omnect/omnect-device-service/omnect-device-service_0.44.1.bb | Update device-service source/lock/crate list and related versions. |
| recipes-omnect/omnect-base-files/omnect-base-files.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-omnect/initrdscripts/omnect-os-initramfs/omnect-device-service-setup | Write runtime metadata into framework /run (not ${ROOTFS_DIR}/run). |
| recipes-omnect/initrdscripts/omnect-os-initramfs/fs-mount | Align /run handling with initramfs-framework (remount vs own tmpfs). |
| recipes-omnect/initrdscripts/omnect-os-initramfs/common-sh | Replace ifconfig with ip link set in initramfs networking. |
| recipes-omnect/initrdscripts/omnect-os-initramfs-scripts.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-omnect/images/omnect-os-initramfs.bb | Set IMAGE_OVERHEAD_FACTOR = "1" for initramfs sizing logic. |
| recipes-omnect/images/omnect-os-image.bb | Minor variable formatting fix. |
| recipes-omnect/grub-env/grub-env.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-omnect/bootloader_env/bootloader-env.bb | Switch file-only recipe install paths to ${UNPACKDIR}. |
| recipes-mac/AppArmor/apparmor_%.bbappend | Work around AppArmor do_install perl-path assumptions when perl PACKAGECONFIG is disabled. |
| recipes-kernel/linux/files/wireguard.cfg | Adjust kernel config fragment content for wireguard dependencies. |
| recipes-kernel/linux/files/crc32c-intel_module.cfg | Remove crc32c-intel module fragment. |
| recipes-devtools/toml-cli/toml-cli.inc | Add ${S} override for cargo-bitbake generated layout under wrynose. |
| recipes-devtools/rust/rust-source.inc | Remove in-layer Rust source include. |
| recipes-devtools/rust/rust-snapshots.inc | Remove in-layer Rust snapshot include. |
| recipes-devtools/rust/rust-llvm_1.93.0.bb | Remove in-layer Rust LLVM recipe. |
| recipes-devtools/rust/rust_1.93.0.bb | Remove in-layer Rust recipe. |
| recipes-devtools/rust/libstd-rs_1.93.0.bb | Remove in-layer libstd recipe. |
| recipes-devtools/rust/cargo_1.93.0.bb | Remove in-layer cargo recipe. |
| recipes-devtools/msft-gsl/msft-gsl_2.0.0.bb | Drop explicit ${S} override (rely on new unpack defaults). |
| recipes-devtools/cbindgen/cbindgen.inc | Formatting-only change for BBCLASSEXTEND. |
| recipes-devtools/cbindgen/cbindgen-0.29.2.inc | Add missing per-crate sha256 sums for cbindgen 0.29.2. |
| recipes-devtools/cbindgen/cbindgen-0.24.3.inc | Remove older cbindgen sha256sum include. |
| recipes-devtools/cbindgen/cbindgen_0.29.2.bb | Add updated cbindgen recipe for Rust 2024 parsing support. |
| recipes-devtools/cbindgen/cbindgen_0.24.3.bb | Remove older cbindgen recipe. |
| recipes-devtools/bindgen/bindgen.inc | Formatting-only change for BBCLASSEXTEND. |
| recipes-devtools/bindgen/bindgen-0.72.1.inc | Add missing per-crate sha256 sums for bindgen 0.72.1. |
| recipes-devtools/bindgen/bindgen-0.60.1.inc | Remove older bindgen sha256sum include. |
| recipes-devtools/bindgen/bindgen_0.72.1.bb | Add updated bindgen recipe for Rust 2024 unsafe extern output. |
| recipes-devtools/bindgen/bindgen_0.60.1.bb | Remove older bindgen recipe. |
| recipes-devtools/cargo-cyclonedx/cargo-cyclonedx.inc | Add ${S} override for wrynose unpack layout. |
| recipes-core/systemd/systemd_%.bbappend | Switch installed file paths to ${UNPACKDIR}. |
| recipes-core/dropbear/dropbear/Fix-inappropriate-fifo-truncate.patch | Remove dropbear patch (likely upstreamed or no longer needed). |
| recipes-core/dropbear/dropbear_%.bbappend | Remove dropbear bbappend that applied the patch and suppressed QA. |
| recipes-core/base-files/base-files_%.bbappend | Switch installed file paths to ${UNPACKDIR}. |
| recipes-connectivity/wpa-supplicant/wpa-supplicant_%.bbappend | Switch installed file paths to ${UNPACKDIR}. |
| recipes-connectivity/networkmanager/networkmanager_%.bbappend | Switch installed file paths to ${UNPACKDIR}. |
| recipes-bsp/u-boot/u-boot/omnect_env.patch | Refresh patch hunk line offsets for newer U-Boot baseline. |
| recipes-bsp/u-boot/u-boot/omnect_env.env | Add rstinfo invocation in update flow. |
| recipes-bsp/u-boot/u-boot-scr.bb | Minor formatting fix for LIC_FILES_CHKSUM. |
| recipes-bsp/grub/grub-efi_%.bbappend | Switch paths used by sed/grub-script-check/install to ${UNPACKDIR}. |
| recipes-bsp/bootloader-versioned/bootloader-versioned.u-boot.inc | Switch template source path to ${UNPACKDIR}. |
| recipes-bsp/bootloader-versioned/bootloader-versioned.grub.inc | Switch script install path to ${UNPACKDIR}; update note about wic patch. |
| recipes-bsp/bootloader-versioned/bootloader-versioned.bb | Add ${S} override and minor formatting cleanup. |
| recipes-azure-iot/libeis-utils/libeis-utils_0.7.0.bb | Move patchdir/S/CMake paths from ${WORKDIR}/git to ${UNPACKDIR}/${BP}. |
| recipes-azure-iot/iot-hub-device-update/iot-hub-device-update/omnect_1.4.0.patch | Add fixes (header guard, XOPEN macro removal) into omnect patchset. |
| recipes-azure-iot/iot-hub-device-update/iot-hub-device-update_1.4.0.bb | Drop explicit ${S} override and switch installed file paths to ${UNPACKDIR}. |
| recipes-azure-iot/azure-iot-sdk-c/azure-iot-sdk-c_1.14.0.bb | Policy workaround for cmake 4.x; cleanup variable formatting and ${S} override removal. |
| recipes-azure-iot/azure-identityd/aziot-identityd/send_sd_notify.patch | Refresh patch to match updated upstream Cargo workspace/layout. |
| recipes-azure-iot/azure-identityd/aziot-identityd/fix_linker_and_linter_findings.patch | Remove now-unneeded patch. |
| recipes-azure-iot/azure-identityd/aziot-identityd.inc | Add clang-native + bindgen env wiring; adjust Rust flags export and regeneration behavior; switch install paths to ${UNPACKDIR}. |
| kas/patches/oe.patch | Remove monolithic OE patch (split into smaller targeted patches). |
| kas/patches/oe_rust-target-config.patch | Remove OE rust-target-config patch (was part of monolithic patch). |
| kas/patches/oe_layerdir.patch | Keep minimal OE layerdir patch for wrynose. |
| kas/patches/oe_bootimg_efi_wic.patch | Remove old OE wic bootimg-efi patch (replaced by wic recipe patch). |
| kas/patches/meta-virtualization_layerdir.patch | Update meta-virtualization layerdir patch for wrynose. |
| kas/patches/meta-raspberrypi_layerdir.patch | Update meta-raspberrypi layerdir patch for wrynose. |
| kas/patches/meta-phytec_layerdir.patch | Update meta-phytec layerdir patch for wrynose. |
| kas/patches/meta-openembedded.patch | Remove meta-openembedded patch bundle (no longer applied). |
| kas/patches/meta-openembedded_nspr_do_not_install_perl_to_image.patch | Remove redundant nspr patch (no longer applied). |
| kas/patches/meta-openembedded_networkmanager.patch | Remove networkmanager patch (no longer applied). |
| kas/patches/meta-imx_layerdir.patch | Update meta-imx layerdir patch for wrynose. |
| kas/patches/meta-freescale_layerdir.patch | Update meta-freescale layerdir patch for wrynose. |
| kas/patches/meta-efi-secure-boot_layerdir.patch | Update meta-efi-secure-boot compatibility and layerdir export. |
| kas/patches/meta-arm_layerdir.patch | Update meta-arm layerdir patch for wrynose. |
| kas/machine/x86_64/genericx86-64.yaml | Update external layer branches/commits to wrynose pins. |
| kas/machine/rpi/rpi.yaml | Update meta-raspberrypi branch/commit to wrynose pins. |
| kas/machine/phytec/phytec.yaml | Update phytec/freescale/imx/meta-arm pins to wrynose branches/commits. |
| kas/distro/omnect-os.yaml | Update external layer pins to wrynose; remove meta-openembedded patch injection. |
| kas/distro/oe.yaml | Update bitbake/OE-core pins to yocto-6.0.2 and adjust patch applied. |
| files/wic/omnect-os.rpi4.wks.in | Add RPi4 wks that includes the layer-absolute wks include. |
| files/wic/omnect-os.rpi.wks.inc | Add RPi partitioning include (env + boot + common). |
| files/wic/omnect-os.phytec.wks.in | Update include to layer-absolute path. |
| files/wic/omnect-os.grub.wks.in | Update include to layer-absolute path. |
| files/wic/omnect-os.common.wks.inc | Add common A/B root partitions and data partitions include. |
| dynamic-layers/virtualization/recipes-containers/docker/docker-moby_git.bbappend | Switch installed daemon.json path to ${UNPACKDIR}. |
| dynamic-layers/virtualization/recipes-azure-iot/iotedge/iotedge/iotedge/fix_docker_engine_api_version.patch | Bump Docker Engine API version used by iotedge to v1.44. |
| dynamic-layers/virtualization/recipes-azure-iot/iotedge/iotedge/iotedge.inc | ${S} + cargo path override fixes; add Docker API version patch; path updates. |
| dynamic-layers/virtualization/recipes-azure-iot/iotedge/aziot-edged/aziot-edged.inc | ${S} + cargo path override fixes; path updates. |
| dynamic-layers/raspberrypi/recipes-connectivity/pi-bluetooth/pi-bluetooth_%.bbappend | Drop one RPi bluetooth patch from SRC_URI. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot/redundant-env.cfg | Update U-Boot env redundancy Kconfig symbol name. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot/omnect_env_rpi.patch | Refresh patch offsets and include omnect env in rpi.env. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot/enable-reset-info-cmd-fragment.cfg | Enable rstinfo command and disable cpuinfo print. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot/cap-bootmapsz-cma.patch | Add BCM2711 memory relocation ceiling cap for CMA compatibility. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot/add-reset-info.patch | Add rstinfo command and reset-cause helper to U-Boot. |
| dynamic-layers/raspberrypi/recipes-bsp/u-boot/u-boot_%.bbappend | Update RPi U-Boot SRC_URI set and copy env header from ${UNPACKDIR}. |
| dynamic-layers/phytec/recipes-kernel/lwb-radio-firmware/radio-firmware.inc | Switch ${S} from ${WORKDIR} to ${UNPACKDIR}. |
| dynamic-layers/phytec/recipes-bsp/u-boot/u-boot-phytec-imx_%.bbappend | Add SWIG/setuptools/binman workarounds; deploy raw u-boot.bin; switch to ${UNPACKDIR} sources. |
| dynamic-layers/phytec/recipes-bsp/bootloader-versioned/bootloader-versioned.bbappend | Broaden imx-atf bbappend glob to avoid dangling version pin. |
| dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_%.bbappend | Replace debug flag logic with PACKAGECONFIG-based debug selection. |
| conf/machine/raspberrypi4-64.extra.conf | Increase non-release rootfs partition size. |
| conf/machine/phygate-tauri-l-imx8mm-2.extra.conf | Increase non-release rootfs partition size. |
| conf/machine/include/rpi.inc | Update bootloader recipe path + expected checksum for newer U-Boot. |
| conf/machine/include/phytec-imx8mm.inc | Update serial consoles formatting, BBMASK entries, bootloader recipe path, and checksum expectations. |
| conf/machine/genericx86-64.extra.conf | Partition sizing tweaks, secure-boot SELoader pinning, bootloader recipe version bump, and artifact list alignment. |
| conf/layer.conf | Update layer compatibility to wrynose and minor formatting. |
| conf/distro/include/omnect-os-swupdate.conf | Minor formatting fix. |
| conf/distro/include/omnect-os-rust.conf | Remove rust-llvm/clang override and in-layer rust version pin. |
| conf/distro/include/omnect-os-required.conf | Bump required OpenSSL version. |
| conf/distro/include/omnect-os-fixes.conf | Downgrade certain QA checks and adjust recommendations for license policy compatibility. |
| conf/distro/include/omnect-os-distro.conf | Switch to *_OPTED_OUT patterns, add wicenv, and adjust gobject-introspection packaging/QA behavior. |
| classes/omnect_uboot_configure_env.bbclass | Use ${UNPACKDIR} for env templates and adjust initial env path for new build dir layout. |
| classes/omnect_rust_azure-iot-sdk_deps.bbclass | Switch bindgen to clang-native + sysroot/target args, handle ARM hard-float. |
| classes/omnect_rust_aziot-identityd_deps.bbclass | Switch cargo path rewriting to ${UNPACKDIR}-based layout + config file name changes. |
| classes/disable_volatile_log_dir.bbclass | Change approach for persistent /var/log behavior via perms tables. |
| classes/aziot.bbclass | Add pkgconfig inheritance for aziot recipes. |
Comments suppressed due to low confidence (1)
recipes-omnect/omnect-device-service/omnect-device-service_0.44.1.bb:11
- This switches the source to a personal fork (
github.com/mlilien/...). That’s a supply-chain/traceability risk for a core device component, and it makes long-term maintenance harder unless there’s a documented reason (e.g., a temporary patch pending upstream). Consider switching back to the officialomnect/omnect-device-servicerepo (or crates.io) and updatingSRCREVaccordingly.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Mounting our own tmpfs on ${ROOTFS_DIR}/run here would be shadowed by that | ||
| # move (losing anything written to it), so we only re-apply our hardened | ||
| # options to the framework's /run instead. | ||
| run_cmd mount -o remount,mode=0755,nodev,nosuid,strictatime /run |
| +#include <env.h> | ||
| +#include <command.h> | ||
| + | ||
| +extern int print_cpuinfo(void); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.