Re: [yocto] [meta-swupd][PATCH] swupdimage.bbclass: ensure that do_rootfs gets executed

2016-09-12 Thread Patrick Ohly
Hello Joshua! Please also apply to the pre-sstate branch. There's a slight merge conflict (previous line differs), but that's easy to resolve, so I am not sending that as a separate patch. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and alt

[yocto] [meta-swupd][PATCH] swupdimage.bbclass: ensure that do_rootfs gets executed

2016-09-12 Thread Patrick Ohly
ated. Signed-off-by: Patrick Ohly --- classes/swupdimage.bbclass | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/classes/swupdimage.bbclass b/classes/swupdimage.bbclass index 20bd4c8..56aa60a 100644 --- a/classes/swupdimage.bbclass +++ b/classes/swupdimage.bbclass @@ -4

Re: [yocto] machine specific task

2016-10-12 Thread Patrick Ohly
figure', d) } I personally find that nicer than the if check in the function itself, because the tasks will only show up in build logs when it actually does something. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel

Re: [yocto] How do you remove an IMAGEFS?

2017-06-27 Thread Patrick Ohly
ved this in refkit: https://github.com/intel/intel-iot-refkit/blob/0ec24f348453/meta-refkit-core/classes/refkit-image.bbclass#L219 -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in

Re: [yocto] How do you remove an IMAGEFS?

2017-06-27 Thread Patrick Ohly
rnel? Is that normally done with "wic" and a > minimal .wks script? I don't know that much about how boot loader menus get generated (we don't use a boot loader in refkit). But yes, wic is the mechanism of choice for creating images these days. -- Best Regards, Patrick Ohly

[yocto] dynamic layer dependencies in meta-security

2017-07-18 Thread Patrick Ohly
't be dynamic. It either has to include everything that a layer might depend on (even when the additional content doesn't end up being used), or it just depends on the essential parts and then enables additional recipes only when the optional layers they depend on are present. BBFILES_DYNAMIC can

Re: [yocto] dynamic layer dependencies in meta-security

2017-07-20 Thread Patrick Ohly
?= "${HAVE_META_OE}" ... And here's how it is used: https://github.com/intel/intel-iot-refkit/blob/master/meta-refkit-core/recipes-images/images/initramfs-framework-refkit-dm-verity.bb#L22 python () { if not oe.types.boolean(d.getVar('HAVE_CRY

Re: [yocto] [meta-security][PATCH] layer: remove TPM layer depends and other dynamic ones.

2017-08-01 Thread Patrick Ohly
ATURES", > "vtpm", "tpm-layer meta-filesystems", "",d)}" > +LAYERDEPENDS_security = "core openembedded-layer perl-layer meta- > python" How does this affect recipes which depend on some of things in those layers? I suspect that using meta-se

Re: [yocto] cannot re-use shared state cache between build hosts

2017-09-04 Thread Patrick Ohly
y fail with logs like this: ... > DEBUG: checkstatus() urlopen failed: file descriptor> More recent bitbake should not fail like that anymore. It's still better to use an HTTP server that performs better, though. commit 6fa07752bbd3ac345cd8617da49a70e0b2dd565f Author: Patrick Ohly Dat

[yocto] [meta-security][PATCH] tpm2.0-tss: fix systemd package list

2017-09-07 Thread Patrick Ohly
a package of that name: ERROR: tpm2.0-tss-git-r0 do_package: tpm2.0-tss does not appear in package list, please add it Signed-off-by: Patrick Ohly --- meta-tpm/recipes-tpm/tpm2.0-tss/tpm2.0-tss_git.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-tpm/recipes-tpm/

Re: [yocto] minimize size of SW update bundle

2017-10-19 Thread Patrick Ohly
ps://ostree.readthedocs.io/en/latest/ma nual/repository-management/#derived-data-static-deltas-and-the-summary- file for instructions on generating deltas. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements

Re: [yocto] [meta-swupd][PATCH] layer.conf: exclude libarchive (bsdtar) dependency from swupd-client

2017-11-16 Thread Patrick Ohly
hly/meta-swupd/commits/master and https://github.com/intel/intel- iot-refkit/pull/318, but that's just a temporary activity. I understand that this isn't a tenable situation for those of you using meta-swupd; hopefully by the end of the year at the latest it'll be resolved. -- Best Re

[yocto] [meta-security][PATCH 1/1] swtpm/libtpm: update to latest master

2017-12-06 Thread Patrick Ohly
This allows dropping some patches for issues that were addressed upstream. It also brings in support for connecting swtpm to qemu without relying on CUSE. Signed-off-by: Patrick Ohly --- meta-tpm/recipes-tpm/libtpm/libtpm_1.0.bb | 4 +- meta-tpm/recipes-tpm/swtpm/files

Re: [yocto] [meta-swupd] allow username/password encoded in SWUPD_VERSION_URL and SWUPD_CONTENT_URL

2017-12-20 Thread Patrick Ohly
opener(authHandler) > +urllib.request.install_opener(opener) Cut-and-paste... this should be in a helper function. I tried to come up with a cleaner patch that implements the same behavior. But I don't have a way to test it. Can you perhaps try out the patch that I wil

[yocto] [meta-swupd][PATCH 1/1] bundles.py: allow username/password encoded in URLs

2017-12-20 Thread Patrick Ohly
Downloading content and version information via HTTP may need a username/password for basic authentication. To support this, SWUPD_VERSION_URL and SWUPD_CONTENT_URL can now contain URLs of the form http(s)://:@/. Original patch from: Ingo Flaschberger Signed-off-by: Patrick Ohly --- lib/swupd

Re: [yocto] How to config kernel in my own meta layer?

2017-12-23 Thread Patrick Ohly
n. The right place to add your "file://uio-test.cfg" is in a .bbappend for the kernel that you are building. But as Bruce said, that kernel must be derived from linux-yocto. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an empl

Re: [yocto] [meta-swupd][PATCH 1/1] bundles.py: allow username/password encoded in URLs

2018-01-09 Thread Patrick Ohly
s shown below, test it, and it if works send the final version to the list? Obviously I am not doing a good job with posting code that I can't test :-/ Am 20.12.2017 um 16:50 schrieb Patrick Ohly: > > Downloading content and version information via HTTP may need a > > username/pass

Re: [yocto] [meta-swupd][PATCH 1/1] bundles.py: allow username/password encoded in URLs

2018-01-10 Thread Patrick Ohly
parsed_url.password) I assume this works on top of my proposal. To avoid such ambiguity and the risk that something gets merged that is still incomplete, please post the entire patch as tested by you. The right way would be "git send-email", but I can also take "git diff" atta

Re: [yocto] btrfs-tools Requires libgcc_s.so.1

2018-03-08 Thread Patrick Ohly
d_cancel and automatically infer that libgcc is required.) There is already a feature request for that: https://bugzilla.yoctoproject.org/show_bug.cgi?id=10954 -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statem

Re: [yocto] curl-native and ca-bundle

2016-10-24 Thread Patrick Ohly
really. Patching binaries was mentioned, but it wasn't clear how to do that in practice. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent I

Re: [yocto] curl-native and ca-bundle

2016-10-25 Thread Patrick Ohly
rent machine (sorry, I'm lazy^Wbusy right now and haven't checked)? I suspect that this won't work when moving the resulting lib through sstate from one Linux distro to another if the location of the bundle file is different on those two distros. -- Best Regards, Patrick Ohly The

Re: [yocto] curl-native and ca-bundle

2016-10-25 Thread Patrick Ohly
ate that was prepared on distro foo. The result is a curl-native that doesn't have SSL certificates and thus https will not work. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Int

Re: [yocto] [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

2016-10-27 Thread Patrick Ohly
functional Smack-enabled image, the rootfs also needs to be set up a bit differently. I can imagine that it would be worthwhile to take more of the things done in meta-intel-iot-security and then deprecate that layer. -- Best Regards, Patrick Ohly The content of this message is my persona

Re: [yocto] [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

2016-10-28 Thread Patrick Ohly
On Thu, 2016-10-27 at 19:32 -0700, Khem Raj wrote: > > On Oct 27, 2016, at 12:22 AM, Patrick Ohly wrote: > > Can you say a bit more about your plans regarding Smack support in > > meta-security? A recipe for the userspace tool and the kernel config is > > a start, but for

Re: [yocto] cve-checker tool

2016-10-28 Thread Patrick Ohly
in the XMLunit format. Here's an example how Jenkins displays that: https://ostroproject.org/jenkins/view/Code-Analysis/job/code_isafw_reports/checker=cve,label=coordinator,machine=beaglebone/lastCompletedBuild/testReport/ -- Best Regards, Patrick Ohly The content of this message is my person

Re: [yocto] What criteria are categorized? (tmp/work/...)

2016-11-29 Thread Patrick Ohly
, so there's basically a forth level of sharing. I just wish that the naming of the resulting directories was a bit more intuitive. I'm constantly wondering what's in "corei7-64-intel-common-ostro-linux" and what's in "intel_corei7_64-ostro-linux" :-/ --

Re: [yocto] [meta-swupd][PATCH] bsdiff: update to latest version

2016-11-30 Thread Patrick Ohly
g it. I'm going to stage your patches in that branch and after one round of testing, will also push them to meta-swupd master. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way repr

Re: [yocto] [meta-swupd][PATCH] swupd-client: do out-of-tree builds

2016-11-30 Thread Patrick Ohly
ion soon and merging this change would just lead to conflicts with my development branch. Is it okay to wait for this version update? Thanks for fixing this problem also upstream! -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an em

Re: [yocto] [meta-swupd][PATCH] swupd-client: fix invalid directory in do_install_append()

2016-11-30 Thread Patrick Ohly
lly creates that directory, and onfiguring the image so that the swupd-client is usable is part of image creation, not of compiling the client. For example, different images may need different settings, and that can't be done with settings compiled into swupd-client because it gets built on

[yocto] update mechanisms (was: Re: [meta-swupd][PATCH] bsdiff: update to latest version)

2016-11-30 Thread Patrick Ohly
On Wed, 2016-11-30 at 14:31 +, André Draszik wrote: > On Wed, 2016-11-30 at 12:04 +0100, Patrick Ohly wrote: > > On Mon, 2016-11-21 at 12:03 +, André Draszik wrote: > > > This allows us to completely remove the build time > > > depenency on libcheck when not nee

Re: [yocto] update mechanisms (was: Re: [meta-swupd][PATCH] bsdiff: update to latest version)

2016-11-30 Thread Patrick Ohly
On Wed, 2016-11-30 at 17:19 +, André Draszik wrote: > On Wed, 2016-11-30 at 15:59 +0100, Patrick Ohly wrote: > > I've started a Wiki page > > https://wiki.yoctoproject.org/wiki/System_Update - rudimentary at the > > moment, but might as well be mentioned already now

Re: [yocto] update mechanisms (was: Re: [meta-swupd][PATCH] bsdiff: update to latest version)

2016-12-01 Thread Patrick Ohly
On Thu, 2016-12-01 at 10:26 +, André Draszik wrote: > On Thu, 2016-12-01 at 08:42 +0100, Patrick Ohly wrote: > > On Wed, 2016-11-30 at 17:19 +, André Draszik wrote: > > > I liked swupd for its ability to be used both for initial provisioning > > > > You m

Re: [yocto] [meta-swupd][PATCH 1/2] oe-swupd-helpers: convert scripts to posix shell

2016-12-01 Thread Patrick Ohly
On Mon, 2016-11-21 at 16:29 +, André Draszik wrote: > These scripts don't do much and there's no reason for > them to require bash as interpreter. Makes sense, I'll submit soon. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only

Re: [yocto] [meta-swupd][PATCH 2/2] swupd-client: don't unconditionally depend on bash

2016-12-01 Thread Patrick Ohly
d does introduce > a bash dependency, it should just state that dependency > itself. > > As the shell now be provided by bash or busybox, also add > an appropriate entry to SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS. Makes sense, I'll submit soon. -- Best Regards, Patrick Ohly The c

Re: [yocto] [patchwork][PATCH v4] patchwork.models: Include first patch's name in series name

2016-12-05 Thread Patrick Ohly
, c-1) > + > # update series.last_revision > series.last_revision = series.latest_revision() > series.save() Looks reasonable to me, but I don't really know the code. Were you testing this and noticed cases with c == 0, i.e. cases where the last series,name change

Re: [yocto] update mechanisms

2016-12-06 Thread Patrick Ohly
On Tue, 2016-12-06 at 10:01 +0100, Stefano Babic wrote: > Hi Patrick, > > On 30/11/2016 15:59, Patrick Ohly wrote: > > I've started a Wiki page > > https://wiki.yoctoproject.org/wiki/System_Update - rudimentary at the > > moment, but might as well be mention

Re: [yocto] update mechanisms

2016-12-09 Thread Patrick Ohly
, isn't it? I understand that this restriction allows you to implement things like automatic rollback, but it's worth mentioning that this comes with that limitation. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee

Re: [yocto] update mechanisms

2016-12-12 Thread Patrick Ohly
On Mon, 2016-12-12 at 15:13 +, André Draszik wrote: > Hi, > > On Tue, 2016-12-06 at 10:45 +0100, Patrick Ohly wrote: > > I'll do the same for swupd. Editing the sections should be possible > > without conflicts, we just have to be more careful about editing

Re: [yocto] update mechanisms

2016-12-12 Thread Patrick Ohly
was the easier to > implement. Which "getting started" document or presentation were you using? The documentation for mender (https://docs.mender.io/) is very straight-forward (partly of course because it doesn't need to cover many variations), while for swupdate (http://sbab

Re: [yocto] update mechanisms

2016-12-12 Thread Patrick Ohly
On Mon, 2016-12-12 at 09:49 -0600, Mariano Lopez wrote: > > On 12/12/16 09:41, Patrick Ohly wrote: > > On Mon, 2016-12-12 at 08:59 -0600, Mariano Lopez wrote: > >>>> In particular the "complexity" column is a bit subjective. Stefano, I > >>>> ho

Re: [yocto] update mechanisms

2016-12-13 Thread Patrick Ohly
On Tue, 2016-12-13 at 09:51 +0100, Mike Looijmans wrote: > On 09-12-16 16:13, Patrick Ohly wrote: > > Hello everyone! > > > > Thanks for contributing directly to the page. It's great to see this > > done collaboratively. > > Nice informative page. > &g

Re: [yocto] esdk without using Poky?

2017-01-04 Thread Patrick Ohly
acter. > Task 'rdepends' should be specified in the form 'packagename:task' > > Any ideas what changed and how I get it working again? I enhanced the error checking, and the rdepends varflag in your example indeed isn't valid. ":do_populate_sysroot" got

Re: [yocto] [patchwork][PATCH] patchwork/bin/parsemail: Make "[PATCH" prefix mandatory

2017-01-09 Thread Patrick Ohly
the [PATCH] tag. For example: patch_prefix = re.match('(\s*\[[^]]*\]\s*)*\[\s*PATCH', mail.get('Subject')) -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I

Re: [yocto] [meta-swupd][PATCH] swupd-image.bbclass: do_swupd_update() depends on time-native

2017-01-17 Thread Patrick Ohly
he case when time-native has to be compiled first. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I

Re: [yocto] x86 testing

2017-01-18 Thread Patrick Ohly
k-qemu = " sdl" #ASSUME_PROVIDED += "libsdl-native" > Advice on this would be great as I need to test the "native" X > setup, not VNC connections. For the guest OS it shouldn't make a difference whether qemu uses its own window or VNC. -- Best Regards, Pat

Re: [yocto] Yocto - Building initramfs to run a shell script for the support of IMA/EVM

2017-01-22 Thread Patrick Ohly
s? -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Int

Re: [yocto] Changing over to systemd (no dhcp)

2017-01-23 Thread Patrick Ohly
stemd and do not enable sysvinit. rm_systemd_unitdir does the opposite when systemd is disabled and only sysvinit is enabled. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent

[yocto] [meta-swupd][PATCH] swupd-image.bbclass: avoid depending on time command

2017-01-23 Thread Patrick Ohly
tting SWUPD_TIMING_CMD = "time" in local.conf or site.conf. Signed-off-by: Patrick Ohly --- classes/swupd-image.bbclass | 8 +++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/classes/swupd-image.bbclass b/classes/swupd-image.bbclass index 78a26ac..771a416 100644 ---

[yocto] [meta-swupd][PATCH] meta-swupd: support rm_work.bbclass

2017-01-23 Thread Patrick Ohly
first having to build all swupd images, which might speed up a build (less work on the critical path). Fixes: [YOCTO #10799] Signed-off-by: Patrick Ohly --- classes/swupd-image.bbclass | 32 -- classes/swupdimage.bbclass | 7 ++-- lib/swupd/bundles.py| 81

Re: [yocto] [meta-swupd][PATCH] swupd-image.bbclass: do_swupd_update() depends on time-native

2017-01-23 Thread Patrick Ohly
On Tue, 2017-01-17 at 16:49 +, André Draszik wrote: > I have no preference either way. Let's remove the hard dependency. I've posted a "swupd-image.bbclass: avoid depending on time command" patch which does that. Are you okay with that? -- Best Regards, Patrick Oh

[yocto] [yocto-kernel-cache][PATCH 0/1] features: enable tpm

2017-01-23 Thread Patrick Ohly
This was tested with the yocto-4.8 branch and linux-yocto 4.8.17 under qemu with TPM provided by swtpm, but can and should also get merged into the yocto-4.9 and master branches. The feature intentionally enables all current TPM drivers. A real production kernel should be more selective. Patrick

[yocto] [yocto-kernel-cache][PATCH 1/1] meta: add TPM feature

2017-01-23 Thread Patrick Ohly
Some hardware has a TPM chip and in addition, qemu can emulate it using swtpm. Signed-off-by: Patrick Ohly --- features/tpm/tpm.cfg | 18 ++ features/tpm/tpm.scc | 4 2 files changed, 22 insertions(+) create mode 100644 features/tpm/tpm.cfg create mode 100644 features

Re: [yocto] [yocto-kernel-cache][PATCH 0/1] features: enable tpm

2017-01-23 Thread Patrick Ohly
On Mon, 2017-01-23 at 14:51 -0500, Bruce Ashfield wrote: > On 01/23/2017 09:11 AM, Patrick Ohly wrote: > > This was tested with the yocto-4.8 branch and linux-yocto 4.8.17 under > > qemu with TPM provided by swtpm, but can and should also get merged > > into the yocto-4.

Re: [yocto] [meta-security][PATCH 5/6] libtpm: update to tip.

2017-01-30 Thread Patrick Ohly
ne, so please consider them Signed-off-by: Patrick Ohly However, when I started using these recipes already before the latest changes, I had to fix quite a few things before the recipes were usable (will send patches shortly): - tcsd from trousers doesn't start because of incorrect ownership o

Re: [yocto] [meta-security][PATCH 6/6] swtpm: update to tip

2017-01-30 Thread Patrick Ohly
\n", (uint64_t)devtoh64(is_chardev, cap)); | ^ | cc1: all warnings being treated as errors If you want, I can fix it as part of my upcoming patches with: printf("ptm capability is 0x%llx\n", (long long unsigned)devtoh64(is_chardev, cap)); -- Best Regards, Patrick

[yocto] [meta-security][PATCH 0/8] tpm: virtual TPM for qemu

2017-01-30 Thread Patrick Ohly
ds to be merged first to avoid merge conflicts. Patrick Ohly (8): trousers: missing libtspi.so.1 in libtspi package trousers: recommend tcsd trousers: tcsd.conf must be owned tss:tss swtpm: enable native and nativesdk flavors swtpm: depends on tpm-tools swtpm: fix compiler format wa

[yocto] [meta-security][PATCH 1/8] trousers: missing libtspi.so.1 in libtspi package

2017-01-30 Thread Patrick Ohly
The soname of libtspi.so is "libtspi.so.1" and therefore apps linked against that library depend on the libtspi.so.1 symlink to find the library. Signed-off-by: Patrick Ohly --- recipes-tpm/trousers/trousers_git.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/r

[yocto] [meta-security][PATCH 2/8] trousers: recommend tcsd

2017-01-30 Thread Patrick Ohly
Installing tpm-tools for tools like tpm_takeown pull in the libtspi package, but the resulting system is not functional unless the tcsd (from the main "trousers" package) also gets installed. A RRECOMMENDS entry for that takes care of that automatically. Signed-off-by: Patrick Ohly --

[yocto] [meta-security][PATCH 3/8] trousers: tcsd.conf must be owned tss:tss

2017-01-30 Thread Patrick Ohly
The upstream dist/Makefile.am ensures that /etc/tcsd.conf is owned by tss:tss, and that must not be changed because otherwise tcsd refuses to start. Signed-off-by: Patrick Ohly --- recipes-tpm/trousers/trousers_git.bb | 1 - 1 file changed, 1 deletion(-) diff --git a/recipes-tpm/trousers

[yocto] [meta-security][PATCH 4/8] swtpm: enable native and nativesdk flavors

2017-01-30 Thread Patrick Ohly
. Here's a version that applies cleanly again. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/files/fix_lib_search_path.patch | 64 - recipes-tpm/swtpm/swtpm_1.0.bb| 3 +- 2 files changed, 67 insertions(+) create mode 100644 recipes-tpm/swtpm/

[yocto] [meta-security][PATCH 5/8] swtpm: depends on tpm-tools

2017-01-30 Thread Patrick Ohly
The configure script checks for tpm_nvdefine from tpm-tools and fails when it is not present. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm_1.0.bb | 5 + 1 file changed, 5 insertions(+) diff --git a/recipes-tpm/swtpm/swtpm_1.0.bb b/recipes-tpm/swtpm/swtpm_1.0.bb index d5a2a58

[yocto] [meta-security][PATCH 7/8] swtpm: cuse packageconfig

2017-01-30 Thread Patrick Ohly
The CUSE support in swtpm does not depend on selinux. It is needed for simulating a virtual TPM, one of the use cases for swtpm-native, so enable it by default. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm_1.0.bb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a

[yocto] [meta-security][PATCH 6/8] swtpm: fix compiler format warning

2017-01-30 Thread Patrick Ohly
rdev, cap)); | ^ | cc1: all warnings being treated as errors Casting to "long long unsigned" matches the format specifier in all cases, including those where "long long" is larger than 64 bits. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/files/fix_signed_issue.patch | 2 +- 1 f

[yocto] [meta-security][PATCH 8/8] swtpm-wrappers: simplify using swtpm-native

2017-01-30 Thread Patrick Ohly
currently in OE-core, have to be applied manually): $ sudo env TPM_DIR=my-machine/myvtpm0 tmp-glibc/work/x86_64-linux/swtpm-wrappers/1.0-r0/swtpm_cuse_oe.sh -n vtpm0 $ sudo chmod a+rw /dev/vtpm0 $ runqemu ... 'qemuparams=-tpmdev cuse-tpm,id=tpm0,path=/dev/vtpm0 -device tpm-tis,tpmdev=tpm0'

Re: [yocto] DEPENDS only half working

2017-02-01 Thread Patrick Ohly
t;libfoo" ... RDEPENDS is for runtime dependencies specific packages and thus has _ as suffix ($PN = bar in this case). libfoo gets compiled because of this entry, but because it is a runtime dependency, compilation of bar doesn't wait for libfoo's completion. -- Best Regards, Pa

[yocto] [meta-security][PATCH v2 0/9] tpm: virtual TPM for qemu

2017-02-03 Thread Patrick Ohly
ds to be merged first to avoid merge conflicts. Changes in V2: - add --system to tss user and group creation - revised commit message for wrapper scripts (swtpm_cuse needs absolute path to tpm state dir, can be passed via parameter) - another swtpm SRCREV bump Patrick Ohly (9): trousers: mi

[yocto] [meta-security][PATCH v2 1/9] trousers: missing libtspi.so.1 in libtspi package

2017-02-03 Thread Patrick Ohly
The soname of libtspi.so is "libtspi.so.1" and therefore apps linked against that library depend on the libtspi.so.1 symlink to find the library. Signed-off-by: Patrick Ohly --- recipes-tpm/trousers/trousers_git.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/r

[yocto] [meta-security][PATCH v2 2/9] trousers: recommend tcsd

2017-02-03 Thread Patrick Ohly
Installing tpm-tools for tools like tpm_takeown pull in the libtspi package, but the resulting system is not functional unless the tcsd (from the main "trousers" package) also gets installed. A RRECOMMENDS entry for that takes care of that automatically. Signed-off-by: Patrick Ohly --

[yocto] [meta-security][PATCH v2 3/9] trousers: tcsd.conf must be owned tss:tss

2017-02-03 Thread Patrick Ohly
-user-contaminated QA warning because the "tss" user will typically not get assigned a UID from the same range as the host user that is used for building. Signed-off-by: Patrick Ohly --- recipes-tpm/trousers/trousers_git.bb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) di

[yocto] [meta-security][PATCH v2 5/9] swtpm: depends on tpm-tools

2017-02-03 Thread Patrick Ohly
The configure script checks for tpm_nvdefine from tpm-tools and fails when it is not present. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm_1.0.bb | 5 + 1 file changed, 5 insertions(+) diff --git a/recipes-tpm/swtpm/swtpm_1.0.bb b/recipes-tpm/swtpm/swtpm_1.0.bb index d5a2a58

[yocto] [meta-security][PATCH v2 4/9] swtpm: enable native and nativesdk flavors

2017-02-03 Thread Patrick Ohly
. Here's a version that applies cleanly again. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/files/fix_lib_search_path.patch | 64 - recipes-tpm/swtpm/swtpm_1.0.bb| 3 +- 2 files changed, 67 insertions(+) create mode 100644 recipes-tpm/swtpm/

[yocto] [meta-security][PATCH v2 6/9] swtpm: fix compiler format warning

2017-02-03 Thread Patrick Ohly
rdev, cap)); | ^ | cc1: all warnings being treated as errors Casting to "long long unsigned" matches the format specifier in all cases, including those where "long long" is larger than 64 bits. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/files/fix_signed_issue.patch | 2 +- 1 f

[yocto] [meta-security][PATCH v2 7/9] swtpm: cuse packageconfig

2017-02-03 Thread Patrick Ohly
The CUSE support in swtpm does not depend on selinux. It is needed for simulating a virtual TPM, one of the use cases for swtpm-native, so enable it by default. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm_1.0.bb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a

[yocto] [meta-security][PATCH v2 8/9] swtpm-wrappers: simplify using swtpm-native

2017-02-03 Thread Patrick Ohly
use-tpm,id=tpm0,path=/dev/vtpm0 -device tpm-tis,tpmdev=tpm0' Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm-wrappers.bb | 41 ++- 1 file changed, 41 insertions(+) create mode 100644 recipes-tpm/swtpm/swtpm-wrappers.bb diff --git a/recipes-tpm/swtpm/swtpm-w

[yocto] [meta-security][PATCH v2 9/9] swtpm: update to latest tip

2017-02-03 Thread Patrick Ohly
Brings in instructions for setting the log level. Setting the log level with --log file=...,level=1 is necessary at the moment before anything gets written to the log. Even errors are suppressed by default. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm_1.0.bb | 2 +- 1 file changed, 1

Re: [yocto] [meta-security][PATCH v2 0/9] tpm: virtual TPM for qemu

2017-02-14 Thread Patrick Ohly
On Fri, 2017-02-03 at 10:35 -0800, akuster808 wrote: > On 2/3/17 12:46 AM, Patrick Ohly wrote: > > I recently started using swtpm-native in combination with the qemu-tpm > > patches to simulate a virtual TPM chip in qemu. The qemu-tpm patches > > should go into OE-core, but

Re: [yocto] Changing UID GID

2017-02-15 Thread Patrick Ohly
n-Embedded without > patching (or creating a bbappend) for each imported package ? There's useradd-staticids.bbclass in OE-core, see https://github.com/ostroproject/ostro-os/blob/master/meta-ostro/conf/distro/ostro.conf#L179 for an example how that was used. -- Best Regards, Patrick O

Re: [yocto] [meta-swupd][PATCH 3/3] bundles.py: fix copying of full image to full bundle when no SWUPD_BUNDLES

2017-02-16 Thread Patrick Ohly
t 531a8e636 "bundles.py: fix "no bundles" special case". Can you rebase onto current master and retest. The other patches look fine, I'm just wondering why I hadn't run into that. Perhaps I was working with an empty SWUPD_BUNDLES instead of an unset one. -- Best Re

Re: [yocto] [meta-swupd][PATCH 3/3] bundles.py: fix copying of full image to full bundle when no SWUPD_BUNDLES

2017-02-16 Thread Patrick Ohly
On Thu, 2017-02-16 at 16:41 +0100, Patrick Ohly wrote: > On Thu, 2017-02-16 at 14:58 +, André Draszik wrote: > > When SWUPD_BUNDLES is not set, exceptions are thrown, stopping the > > build - there are two issues in here: > > - the debug statement references a non-exist

Re: [yocto] [meta-swupd][RFC][PATCH] swupd-image.bbclass: split out swupd-client and config specific bits

2017-02-16 Thread Patrick Ohly
On Tue, 2017-02-14 at 16:58 +, André Draszik wrote: > It is useful to be able to integrate swupd-client into an image that > is not itself subject to swupd based processing. Makes sense, merged to master-next. -- Best Regards, Patrick Ohly The content of this message is my personal o

Re: [yocto] [OE-core] [PATCHv2] yocto-compat-layer.py: Add script to YP Compatible Layer validation

2017-02-28 Thread Patrick Ohly
te_sametune_samesigs in sstatetests.py, has the same limitation of its scope, i.e. doesn't actually test with real machine definitions. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in

Re: [yocto] [OE-core] [PATCHv2] yocto-compat-layer.py: Add script to YP Compatible Layer validation

2017-02-28 Thread Patrick Ohly
On Tue, 2017-02-28 at 14:33 -0600, Aníbal Limón wrote: > > On 02/28/2017 02:09 PM, Patrick Ohly wrote: > > On Mon, 2017-02-20 at 15:12 -0600, Aníbal Limón wrote: > >> common.test_signatures: Test executed in BSP and DISTRO layers to review > >> doesn't

Re: [yocto] [OE-core] [PATCHv2] yocto-compat-layer.py: Add script to YP Compatible Layer validation

2017-02-28 Thread Patrick Ohly
On Wed, 2017-03-01 at 04:00 +, Richard Purdie wrote: > On Tue, 2017-02-28 at 21:09 +0100, Patrick Ohly wrote: > > On Mon, 2017-02-20 at 15:12 -0600, Aníbal Limón wrote: > > > > > > common.test_signatures: Test executed in BSP and DISTRO layers to > > >

Re: [yocto] [OE-core] [PATCHv2] yocto-compat-layer.py: Add script to YP Compatible Layer validation

2017-03-01 Thread Patrick Ohly
On Wed, 2017-03-01 at 15:12 +, Richard Purdie wrote: > On Wed, 2017-03-01 at 08:10 +0100, Patrick Ohly wrote: > > Is the "build single distro for different machines" scenario that I > > described part of the Yocto Compliance 2.0? Should there be tests for > > i

Re: [yocto] [OE-core] [PATCHv2] yocto-compat-layer.py: Add script to YP Compatible Layer validation

2017-03-01 Thread Patrick Ohly
On Wed, 2017-03-01 at 16:01 +, Richard Purdie wrote: > On Wed, 2017-03-01 at 16:51 +0100, Patrick Ohly wrote: > > On Wed, 2017-03-01 at 15:12 +, Richard Purdie wrote: > > > > > > On Wed, 2017-03-01 at 08:10 +0100, Patrick Ohly wrote: > > > >

Re: [yocto] Error with Cynara pkg_postinst when updating AGL to from morty master

2017-03-02 Thread Patrick Ohly
t')[0]} > I wonder if something has hanged in bb.data but I could not find > anything obvious. bb.data.getVar() has been deprecated for a while and was finally removed. Use d.getVar('PV') instead on master (no additional parameters needed, expansion is on by default). -- Best R

Re: [yocto] cannot build image using sstate

2017-03-08 Thread Patrick Ohly
e mechanism which adds files to the sstate cache and then you get exactly the problem you describe. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on

Re: [yocto] cannot build image using sstate

2017-03-09 Thread Patrick Ohly
into DEPLOYDIR, and the class will take care of copying them into > DEPLOY_DIR_IMAGE afterwards." > > So I should just replace ${DEPLOY_DIR_IMAGE} with ${DEPLOYDIR} and I > get the same behaviour as before + the benefit of sstate cache ? Yes. -- Best Regards, Patrick Ohly The

Re: [yocto] update mechanisms

2017-03-10 Thread Patrick Ohly
On Wed, 2017-03-01 at 16:35 -0800, Eystein Måløy Stenberg wrote: > On Tue, 2016-12-06 at 10:45 +0100, Patrick Ohly wrote: > > On Tue, 2016-12-06 at 10:01 +0100, Stefano Babic wrote: > > > Hi Patrick, > > > > > > On 30/11/2016 15:59, Patrick Ohly wro

Re: [yocto] update mechanisms

2017-03-10 Thread Patrick Ohly
On Fri, 2017-03-10 at 14:35 +0100, Kristian Amlie wrote: > On 10/03/17 14:02, Patrick Ohly wrote: > > On Wed, 2017-03-01 at 16:35 -0800, Eystein Måløy Stenberg wrote: > >> On Tue, 2016-12-06 at 10:45 +0100, Patrick Ohly wrote: > >>> On Tue, 2016-12-06 at 10:01 +0100,

Re: [yocto] [Openembedded-architecture] Sum up - Proposal: dealing with language-specific build tools/dependency management tools

2017-03-16 Thread Patrick Ohly
detects exactly the modified files and only needs to replace those. Just a thought, in case that auto-packaging turns out to be too hard. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make her

[yocto] [meta-security] master-next rebased?

2017-03-24 Thread Patrick Ohly
$ git log --oneline origin/master..origin/master-next | wc -l 179 $ git log --oneline origin/master | wc -l 211 Looking at the content, it seems that only the last two commits in master-next are actually new ;-} -- Best Regards, Patrick Ohly The content of this message is my personal opinion onl

Re: [yocto] [meta-swupd] allow username/password encoded in SWUPD_VERSION_URL and SWUPD_CONTENT_URL

2017-03-24 Thread Patrick Ohly
ch" format? Don't forget the signed-off-by and add short prefix to the summary line, perhaps like this: bundles.py: allow username/password encoded into HTTP server URLs An example how username/password need to be encoded in the URL would also be useful. -- Best Regards, Patrick Ohly The

[yocto] [meta-security][PATCH] swtpm-wrappers: wrap more commands

2017-03-24 Thread Patrick Ohly
Soon it might be possible to let qemu start swtpm directly, without requiring root privileges as for swtpm_cuse. For that to work we also need to wrap the swtpm binary. Just in case we now also do it for everything. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm-wrappers.bb | 26

Re: [yocto] [meta-security][PATCH] tpm2.0-tss: install resourcemgr service

2017-03-24 Thread Patrick Ohly
Start=${sbindir}/resourcemgr;' ${S}/contrib/resourcemgr.service } Just my 2 cents. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on

Re: [yocto] Custom conf files

2017-04-04 Thread Patrick Ohly
doesn't scale when considering that the recipe might have to be used in different ways, and layers which do that tend to be hard to reuse. > Or I could add a > ROOTFS_POSTPROCESS_COMMAND and patch in my changes Yep. -- Best Regards, Patrick Ohly The content of this message is my per

Re: [yocto] Modifying CFLAGS in .bbappend

2017-04-11 Thread Patrick Ohly
On Tue, 2017-04-11 at 11:45 +0100, Mark T wrote: > If I add an include path to CFLAGS in a .bbappend is it only applied > for that recipe or is it present in CFLAGS for all recipes built after > that ? Just for that recipe. You can check that with "bitbake -e ". -- Best Re

[yocto] [meta-security][PATCH 1/1] swtpm-wrappers: fix naming convention violation

2017-04-25 Thread Patrick Ohly
URES for native recipes was skipped and thus swtpm-wrappers ended up using different paths than the other native recipes. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/{swtpm-wrappers.bb => swtpm-wrappers-native.bb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename recipe

[yocto] [meta-security][PATCH 1/1] swtpm-wrappers-native.bb: need netstat

2017-04-27 Thread Patrick Ohly
netstat from net-tools-native is needed for swtpm_setup.sh, which uses it to check whether the swtpm daemon has started. The scripts hangs in a loop during startup when netstat is missing. Signed-off-by: Patrick Ohly --- recipes-tpm/swtpm/swtpm-wrappers-native.bb | 2 +- 1 file changed, 1

Re: [yocto] Enabling tpm from meta-security for AGL

2017-05-05 Thread Patrick Ohly
ameters must be ${CFLAGS) $(LDFLAGS). I've tried with meta-security master and it doesn't happen there, so perhaps it was already fixed. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make her

  1   2   >