Just to clarify, btrfs-tools has always had an LGPL-3.0 library (libbtrfsutil), the recipe just never declared it before. Upstream is relicensing that library to LGPL-2.1+, which should be done for the next release.

Sorry about this, I sent the update and didn’t realize it broke the non-gplv3 builds. I’ll keep an eye out for the next upstream release which should allow this patch to be reverted.

Thanks,
Robert

Hello,

We are pleased to announce the Yocto Project 3.3 (hardknott-25.0.0) Release is now available for download.

http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/poky-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/poky-hardknott-25.0.0.tar.bz2

A gpg signed version of these release notes is available at:

http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/RELEASENOTES

Full Test Report:

http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/testreport.txt

Thank you for everyone's contributions to this release.

Vineela Tummalapalli
Yocto Project Build and Release
vineela.tummalapalli@...


--------------------------
yocto-3.3 Release Notes
--------------------------

--------------------------
Repositories/Downloads
--------------------------

Repository Name: poky
Repository Location: https://git.yoctoproject.org/git/poky
Branch: hardknott
Tag: yocto-3.3
Git Revision: e1839b58ebe05242a52fe050aa9a08140136aa0a
Release Artefact: poky-hardknott-25.0.0
sha: 2d08ed735badad119a4228e113115f91615837127b62176fb570be6929417292
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/poky-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/poky-hardknott-25.0.0.tar.bz2

Repository Name: openembedded-core
Repository Location: https://git.openembedded.org/openembedded-core
Branch: hardknott
Tag: 2021-04-hardknott
Git Revision: 14241ed09f9ed317045cf75a6d08416d3579bb8d
Release Artefact: oecore-hardknott-25.0.0
sha: 4f00bfd3804517ea5e68502af896e5a162a5cef86d00f5170e9748ffe77386a6
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/oecore-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/oecore-hardknott-25.0.0.tar.bz2

Repository Name: meta-mingw
Repository Location: https://git.yoctoproject.org/git/meta-mingw
Branch: hardknott
Tag: yocto-3.3
Git Revision: 422b96cb2b6116442be1f40dfb5bd77447d1219e
Release Artefact: meta-mingw-hardknott-25.0.0
sha: 39bfa386f04111d8cfa8791977a416344bbb0a1fd5167e42bd9c9d6923f0e009
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/meta-mingw-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/meta-mingw-hardknott-25.0.0.tar.bz2

Repository Name: meta-intel
Repository Location: https://git.yoctoproject.org/git/meta-intel
Branch: hardknott
Tag: yocto-3.3
Git Revision: 01cfc99a8f960917433a8a46b41bb4febb5b1993
Release Artefact: meta-intel-hardknott-25.0.0
sha: 671c2a7f7080bd0dc4049c0ceef8d9ca561e6b1412586d2c218834e13d8f99c7
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/meta-intel-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/meta-intel-hardknott-25.0.0.tar.bz2

Repository Name: meta-gplv2
Repository Location: https://git.yoctoproject.org/git/meta-gplv2
Branch: hardknott
Tag: yocto-3.3
Git Revision: 9e119f333cc8f53bd3cf64326f826dbc6ce3db0f
Release Artefact: meta-gplv2-hardknott-25.0.0
sha: 2679412d6a3c8db0471d1d91f5667c2ebc10558ad574b6169e2e572608c0e6c6
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/meta-gplv2-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/meta-gplv2-hardknott-25.0.0.tar.bz2

Repository Name: bitbake
Repository Location: https://git.openembedded.org/bitbake
Branch: 1.50
Tag: 2021-04-hardknott
Git Revision: a1848a481e36b729c8e4130c394b1d462d4b488a
Release Artefact: bitbake-hardknott-25.0.0
sha: 09e6ebcb579a3eaf3760ff53e0da71cd55b5eed557918230bd5cddd5b5c53c72
Download Locations:
http://downloads.yoctoproject.org/releases/yocto/yocto-3.3/bitbake-hardknott-25.0.0.tar.bz2
http://mirrors.kernel.org/yocto/yocto/yocto-3.3/bitbake-hardknott-25.0.0.tar.bz2

Repository Name: yocto-docs
Repository Location: https://git.yoctoproject.org/git/yocto-docs
Branch: hardknott
Tag: yocto-3.3
Git Revision:4f7f451df266a307b34bf145b29291ca85eb882f

--------------
Contributors
--------------

Thanks to the following people who contributed to this release:

Abdellatif El Khlifi
Adrian Fiergolski
Adrian Herrera
Alan Perry
Alban Bedel
Alejandro Hernandez Samaniego
Alexander Kamensky
Alexander Kanavin
Alexander Vickberg
Alex Stewart
Alistair Francis
Anatol Belski
Andreas Müller
Andrei Gherzan
Andrej Valek
Andrey Mozzhuhin
Andrey Zhizhikin
Anibal Limon
Anthony Bagwell
Anton D. Kachalov
Anton Kachalov
Anuj Mittal
Armin Kuster
Awais Belal
Bartosz Golaszewski
Brett Warren
Bruce Ashfield
Cedric Hombourger
Chaitanya Vadrevu
Chandana Kalluri
Changhyeok Bae
Changqing Li
Charlie Davies
Chee Yang Lee
Chen Qi
Chris Laplante
Christophe Priouzeau
Christopher Larson
Colin Finck
Dan Callaghan
Deepak Rawat
Denys Dmytriyenko
Denys Zagorui
Diego Santa Cruz
Diego Sueiro
Dmitry Baryshkov
Dorinda Bassey
Douglas Royds
Easwar Hariharan
Elvis Stansvik
Fabio Berton
Federico Pellegrin
Fedor Ross
Florian Bezdeka
Fredrik Gustafsson
Gratian Crisan
Guillaume Champagne
He Zhe
Hongxu Jia
Jack Mitchell
Jan Brzezanski
Jan Vermaete
Janne Kiiskila
Jan-Simon Möller
Jason Wessel
Jate Sujjavanich
Joel Stanley
Joey Degges
Jonathan Richardson
Jon Mason
Joseph Reynolds
Jose Quaresma
Joshua Watt
Kai Kang
Kamel Bouhara
Kevin Hao
Khairul Rohaizzat Jamaluddin
Khasim Mohammed
Khem Raj
Klaus Heinrich Kiwi
Konrad Weihmann
Lee Chee Yang
Leon Anavi
Li Wang
Loic Domaigne
Luca Boccassi
Mans Rullgard
Manuel Leonhardt
Marek Vasut
Mark Hatle
Mark Jonas
Martin Jansa
Matt Hoosier
Matt Madison
Maxime Roussin-Bélanger
Max Krummenacher
Meh Mbeh Ida Delphine
Mert Kirpici
Michael Halstead
Michael Ho
Michael Opdenacker
Michael Trensch
Mike Crowe
Mike Looijmans
Mikko Rapeli
Milan Shah
Ming Liu
Mingli Yu
Minjae Kim
Nathan Rossi
Naveen Saini
Nicolas Dechesne
Norbert Kaminski
Oleksandr Kravchuk
Oleksiy Obitotskyy
Ovidiu Panait
Paul Barker
Paul Eggleton
Paul Gortmaker
Peter Bergin
Peter Kjellerstedt
Petr Vorel
Purushottam Choudhary
Quentin Schulz
Randy Li
Randy MacLeod
Randy Witt
Ricardo Salveti
Richard Leitner
Richard Purdie
Robert P. J. Day
Robert Rosengren
Robert Yang
Ross Burton
Sakib Sajal
Saloni Jain
Sangeeta Jain
Saul Wold
Scott Branden
Scott Murray
Shachar Menashe
Sinan Kaya
Stacy Gaikovaia
Stefan Ghinea
Stefan Schmidt
Steve Sakoman
Suji Velupillai
Tanu Kaskinen
Teoh Jay Shen
Thomas Perrot
Thomas Viehweger
Tim Orling
Tomasz Dziendzielski
Tom Hochstein
Trevor Woerner
Tyler Hicks
Ulrich Ölmann
Vinícius Ossanes Aquino
Vivien Didelot
Vyacheslav Yurkov
Wang Mingyu
Wes Lindauer
Wonmin Jung
Yanfei Xu
Yann Dirson
Yann E. MORIN
Yi Fan Yu
Yi Zhao
Yoann Congal
Yongxin Liu
Zang Ruochen
Zheng Ruoqin
Zhixiong Chi



-----------------------------
New Features / Enhancements
-----------------------------
* Linux kernel 5.10, glibc 2.33 and ~280 other recipe upgrades
* New recipes: glslang, gst-devtools, libgit2, libmd, libportal, libssh2, numactl, packagegroup-core-weston, python3-atomicwrites, python3-attrs, python3-hypothesis, python3-importlib-metadata, python3-iniconfig, python3-more-itertools, python3-packaging, python3-pathlib2, python3-pluggy, python3-py, python3-pytest, python3-setuptools-scm, python3-sortedcontainers, python3-toml, python3-wcwidth, python3-zipp, shaderc, spirv-headers, spirv-tools, util-linux-libuuid, vulkan-samples, wayland-utils, xxhash, zstd
* Python 3.6 or newer is required to be on build host.
* New PACKAGECONFIG options in: binutils, coreutils, elfutils, epiphany, ffmpeg, gdb, gstreamer1.0-plugins-*, iproute2, json-glib, libomxil, openssl, p11-kit, parted, psplash, pulseaudio, qemu, socat, systemd, systemd-conf, webkitgtk
* New meta/conf/distro/include/lto.inc for enabling Link-Time Optimisation (LTO)
* Added support for elfutils debug info server (debuginfod)
* Added infrastructure to support u-boot SPL verified boot with optional separate signing key
* Reduce poky-tiny size by over 15% by enabling size optimisation by default, enabling section removal and tweaking busybox configuration
* Increased package granularity for dbus, sudo, iproute2, net-tools, procps, rpm, systemtap
* Added support for vhd/vhdx format in IMAGE_FSTYPES
* New extrausers "passwd-expire" command to force password change on first login
* buildhistory now records LICENSE
* Architecture-specific improvements:
- New qemuriscv32 machine
- New qemuppc64 machine
- python-numpy: Add support for riscv32
- arch-riscv: Enable qemu-usermode on rv32
- grub: Add support for RISC-V
- Enable systemd-boot and grub-efi for Arm targets
- core-image-tiny-initramfs: add compatibility for aarch64
- linux-yocto/cfg: qemuppc: set CONFIG_SCSI to '=y'
- linux-yocto/cfg: qemuarm64-gfx.cfg: add CONFIG_INPUT_UINPUT
- Enabled bochs-display on qemuriscv* machines
- go: Enable CGO and pie buildmode on rv64
- tune-power9: Enable qemu-usermode
- glibc: Build for power9 cpu when using powerpc64le tunes
- tune-octeontx2.inc: Add tune for Marvell OCTEON TX2 core
- tune-cortexa32: Add hard FPU
- beaglebone-yocto: allow other virtual/bootloader
* SDK-related changes:
- New ppc64le SDK machine
- Extended to nativesdk: apt, ccache, diffstat, dpkg, grep, grub, rsync, sed, vim, which
- New SDK_PS1 variable to allow custom prompt string for SDKs
- New SDK_CUSTOM_TEMPLATECONF variable to enable custom templateconf.cfg in eSDK
- do_populate_sdk can now run in parallel with do_rootfs
* Kernel related improvements:
- linux-yocto*: add features/gpio/mockup.scc to KERNEL_FEATURES
- kern-tools: non-gcc config support and option re-classification
- kernel-module-split.bbclass: identify kernel modconf files as configuration files for package upgrade purposes
- kernel-devicetree: Introduce KERNEL_DTC_FLAGS to pass dtc flags
* u-boot fitImage related improvements:
- Added support for Initramfs bundle and u-boot script
- Support both KERNEL_DEVICETREE and EXTERNAL_KERNEL_DEVICETREE
- Allow substituting mkimage command and add additional signing options
- Added ability to sign individual images
- Added variable for description
- Allow kernel image compression to be disabled
* wic image creator improvements:
- New "empty" plugin to create unformatted empty partitions
- Warn if an ext filesystem affected by the Y2038 problem is used
- Add workdir argument and option to preserve it for debugging
* runqemu improvements:
- New "novga" option to disable VGA emulation
- Added QB_GRAPHICS for QEMU video card type options
- Added support for VHD/VHDX rootfs
* BitBake improvements:
- Added Azure Storage (az://) fetcher
- Added zstd support to unpack
- hashserv: new -r/--readonly option to disable writes
- hashserv: new -u/--upstream option to enable upstream server
- hashserv: added Dockerfile under bitbake/contrib/ for building hash server
- Added REQUIRED_VERSION variable
- PREFERRED_VERSION is now a warning instead of a note
- bitbake-layers create-layer: added optional --layerid option
- Added BB_DEFAULT_UMASK to avoid having to set umask flag everywhere
- Show an appropriate error when a task name contains reserved keywords (e.g. _remove)
- Print pseudo.log if a fakeroot task fails
* cve-check improvements:
- New CVE_VERSION_SUFFIX variable to indicate suffix in versioning
- Fixed handling of pre-release version numbers
- Record layer in cve log
- Added ability to include/exclude layers
- cve-update-db-native: enable overriding the URL to allow local mirror usage
* Wayland/weston related changes:
- weston-init: Weston can now run using non-root user
- weston-init: introduce WESTON_GROUP
- core-image.bbclass: add a weston IMAGE_FEATURES feature, similar to x11-base
* Extension of package management is now possible from custom layers
* build-appliance: enabled VHD/VHDX generation
* buildstats: add functionality to collect build system stats
* base-files: better support for terminal resizing over serial connections
* Added /sysroot-only dir to install files to sysroot but not include in packages
* Removed some extraneous files that were installed into the sysroot
* New python3targetconfig class to enable using python3-native but with target configuration
* isoimage-isohybrid.py: Support adding files/dirs
* distutils3: allow setup.py to be run from a different directory to ${S}
* busybox-inittab: implemented SYSVINIT_ENABLED_GETTYS and USE_VT
* busybox: Run mdev as daemon
* psplash (sysvinit): add textual updates
* libyaml: Enable static lib on native/nativesdk
* rootfs: add option to allow delayed postinsts on read-only rootfs
* npm.bbclass: make shrinkwrap file optional
* initrdscripts: init-install-efi.sh install extra files for ESP
* openssl: add support for mingw64 as target
* mpg123: Add support for FPU-less targets
* mesa: enable dri in native/nativesdk through gallium drivers
* security_flags.inc: Add same O<level> as in SELECTED_OPTIMIZATION
* systemd: add hostname fallback when polkit is not available
* Use canonical SPDX license names in image license manifests
* gcr: Add support for building without x11
* gstreamer1.0: add support for coretracers
* file: enable all built-in compression checkers
* linux-firmware: package firmware for Lontium lt9611uxc bridge, ath11k
* sstate-diff-machines.sh: support rpm, deb and tar package types in analysis
* systemd-serialgetty: Switch to TERM=linux for better xterm compatibility
* volatile-binds: add /srv to mount and install
* New oe-time-dd-test.sh script for testing build system I/O loading
* packagegroup-base: make hdparm and e2fsprogs RRECOMMENDS so they can be optional
* New QA check for native/nativesdk inherit order
* GitLab /archive/ URLs in SRC_URI now trigger a warning
* Added descriptive error message to getpwuid/getgrgid "uid/gid not found" KeyError
* Added additional checks for PSEUDO_IGNORE_PATHS validity
* Split sstate summary display into locally and network found artifacts
* report-error.bbclass: added layer and bitbake version info to error report
* perl: allow empty lines and comments in perl-rdepends.txt
* contrib/git-hooks: add a sendemail-validate example hook that adds FROM: lines to outgoing patch emails
* common-licenses: add BSD-3-Clause-Clear license
* common-licenses: Add GPL-3.0-with-bison-exception
* Renamed GPL-family common license files so that "-only" and "-or-later" is explicitly specified to match with current SPDX.

--------------
Known Issues
--------------
N/A

-----------------
Recipe Licenses
-----------------

The following corrections have been made to the LICENSE values set by recipes:

* alsa-utils: GPLv2+ -> GPLv2 (as some parts of the source are GPLv2 only)
* busybox: included bzip2 source is the 1.0.4 version not 1.0.6, so tweak the LICENSE value to reflect that
* libbsd: specify per-package licensing to reflect that BSD-4-Clause doesn't cover contents of main package (only some documentation)
* libdnf: LGPLv2.1 -> LGPLv2.1+ to match with what is specified in header comments
* openssh: expand "BSD" to specifically include BSD-2-Clause, BSD-3-Clause and BSD-4-Clause
* ptest-runner: GPLv2 -> GPLv2+ to match with what is specified in header comments


------------------------
Migration instructions
------------------------

For details on changes that you might need to make when migrating to the Yocto Project 3.3 release from previous releases, please see the following manual section:

http://www.yoctoproject.org/docs/3.3/ref-manual/ref-manual.html#moving-to-the-yocto-project-3.3-release



----------------
Security Fixes
----------------

* binutils: CVE-2020-35448
* connman: CVE-2021-26675, CVE-2021-26676
* cups: CVE-2020-10001
* curl: CVE-2020-8284, CVE-2020-8285, CVE-2020-8286
* ffmpeg: CVE-2020-35964, CVE-2020-35965
* gdk-pixbuf: CVE-2020-29385
* git: CVE-2021-21300
* glibc: CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2020-29573, CVE-2021-27645
* grub: CVE-2014-4607, CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-14372, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-3418, CVE-2021-20225, CVE-2021-20233
* libcroco: CVE-2020-12825
* libexif: CVE-2020-0198, CVE-2020-0452
* libproxy: CVE-2020-26154
* openssl: CVE-2020-1971, CVE-2021-3449, CVE-2021-3450
* p11-kit: CVE-2020-29361, CVE-2020-29362, CVE-2020-29363
* patch: CVE-2019-20633
* python3: CVE-2020-27619, CVE-2021-3177
* qemu: CVE-2020-24352, CVE-2020-25624, CVE-2020-25723, CVE-2020-28916, CVE-2020-29129, CVE-2020-29130, CVE-2021-20203
* ruby: CVE-2020-25613
* screen: CVE-2021-26937
* sudo: CVE-2021-3156
* u-boot: CVE-2021-27097, CVE-2021-27138
* wpa-supplicant: CVE-2021-0326, CVE-2021-27803



-----------------
Recipe Upgrades
-----------------

* acpica 20200717 -> 20210105
* adwaita-icon-theme 3.36.1 -> 3.34.3, 3.38.0
* alsa-lib 1.2.3.2 -> 1.2.4
* alsa-topology-conf 1.2.3 -> 1.2.4
* alsa-ucm-conf 1.2.3 -> 1.2.4
* alsa-utils 1.2.3 -> 1.2.4
* alsa-utils-scripts 1.2.3 -> 1.2.4
* apt 1.8.2.1 -> 2.2.2
* asciidoc 9.0.2 -> 9.1.0
* at 3.1.23 -> 3.2.1
* at-spi2-atk 2.34.2 -> 2.38.0
* at-spi2-core 2.36.1 -> 2.38.0
* attr 2.4.48 -> 2.5.1
* autoconf 2.69 -> 2.71
* automake 1.16.2 -> 1.16.3
* bash 5.0 -> 5.1
* bind 9.16.7 -> 9.16.12
* binutils 2.35.1 -> 2.36.1
* bison 3.7.2 -> 3.7.5
* bluez5 5.55 -> 5.56
* bmap-tools 3.5+gitX -> 3.6+gitX
* boost 1.74.0 -> 1.75.0
* btrfs-tools 5.7 -> 5.10.1
* busybox 1.32.0 -> 1.33.0
* busybox-inittab 1.32.0 -> 1.33.0
* cantarell-fonts 0.0.25 -> 0.301
* ccache 3.7.11 -> 4.2
* cmake 3.18.2 -> 3.19.5
* cmake-native 3.18.2 -> 3.19.5
* createrepo-c 0.16.0 -> 0.17.0
* cross-localedef-native 2.32 -> 2.33
* cryptodev-linux 1.11 -> 1.12
* cryptodev-module 1.11 -> 1.12
* cryptodev-tests 1.11 -> 1.12
* curl 7.72.0 -> 7.75.0
* debianutils 4.11.1 -> 4.11.2
* dhcpcd 9.2.0 -> 9.4.0
* diffoscope 160 -> 172
* diffstat 1.63 -> 1.64
* distcc 3.3.3 -> 3.3.5
* dmidecode 3.2 -> 3.3
* dnf 4.2.23 -> 4.6.0
* dos2unix 7.4.1 -> 7.4.2
* dosfstools 4.1 -> 4.2
* dpkg 1.20.5 -> 1.20.7.1
* dropbear 2020.80 -> 2020.81
* e2fsprogs 1.45.6 -> 1.46.1
* ed 1.16 -> 1.17
* elfutils 0.180 -> 0.183
* ell 0.33 -> 0.38
* enchant2 2.2.9 -> 2.2.15
* epiphany 3.36.4 -> 3.38.2
* ethtool 5.8 -> 5.10
* eudev 3.2.9 -> 3.2.10
* expat 2.2.9 -> 2.2.10
* ffmpeg 4.3.1 -> 4.3.2
* findutils 4.7.0 -> 4.8.0
* freetype 2.10.2 -> 2.10.4
* gcr 3.36.0 -> 3.38.1
* gdb 9.2 -> 10.1
* gdbm 1.18.1 -> 1.19
* ghostscript 9.52 -> 9.53.3
* git 2.28.0 -> 2.31.1
* glib-2.0 2.64.5 -> 2.66.7
* glib-networking 2.64.3 -> 2.66.0
* glibc 2.32 -> 2.33
* gmp 6.2.0 -> 6.2.1
* gnu-config 20200831+gitX -> 20210125+gitX
* gnupg 2.2.23 -> 2.2.27
* gnutls 3.6.14 -> 3.7.1
* go 1.15.8 -> 1.16.2
* gobject-introspection 1.64.1 -> 1.66.1
* gpgme 1.14.0 -> 1.15.1
* gptfdisk 1.0.5 -> 1.0.7
* grep 3.4 -> 3.6
* grub 2.04 -> 2.04+2.06~rc1
* grub-efi 2.04 -> 2.04+2.06~rc1
* gsettings-desktop-schemas 3.36.1 -> 3.38.0
* gst-examples 1.16.0 -> 1.18.4
* gstreamer1.0 1.16.3 -> 1.18.4
* gstreamer1.0-libav 1.16.3 -> 1.18.4
* gstreamer1.0-omx 1.16.3 -> 1.18.4
* gstreamer1.0-plugins-bad 1.16.3 -> 1.18.4
* gstreamer1.0-plugins-base 1.16.3 -> 1.18.4
* gstreamer1.0-plugins-good 1.16.3 -> 1.18.4
* gstreamer1.0-plugins-ugly 1.16.3 -> 1.18.4
* gstreamer1.0-python 1.16.3 -> 1.18.4
* gstreamer1.0-rtsp-server 1.16.3 -> 1.18.4
* gstreamer1.0-vaapi 1.16.3 -> 1.18.4
* gtk+3 3.24.22 -> 3.24.25
* gtk-doc 1.32 -> 1.33.2
* harfbuzz 2.7.2 -> 2.7.4
* hdparm 9.58 -> 9.60
* help2man 1.47.15 -> 1.48.2
* hwlatdetect 1.1 -> 1.10
* i2c-tools 4.1 -> 4.2
* icu 67.1 -> 68.2
* ifupdown 0.8.35 -> 0.8.36
* inetutils 1.9.4 -> 2.0
* init-system-helpers 1.58 -> 1.60
* iproute2 5.8.0 -> 5.11.0
* iptables 1.8.5 -> 1.8.7
* iso-codes 4.5.0 -> 4.6.0
* iw 5.8 -> 5.9
* jquery 3.5.1 -> 3.6.0
* json-glib 1.4.4 -> 1.6.2
* kbd 2.3.0 -> 2.4.0
* kea 1.7.10 -> 1.8.2
* kern-tools-native 0.2+gitX (df4390b18a...) -> 0.2+gitX (8f6aaab7f6...)
* kexec-tools 2.0.20 -> 2.0.21
* kmod 27 -> 28
* kmod-native 27 -> 28
* kmscube git (4660a7dca6...) -> git (9f63f359fa...)
* less 562 -> 563
* libaio 0.3.111 -> 0.3.112
* libarchive 3.4.3 -> 3.5.1
* libassuan 2.5.3 -> 2.5.4
* libbsd 0.10.0 -> 0.11.3
* libcap 2.43 -> 2.48
* libcap-ng 0.7.11 -> 0.8.2
* libdazzle 3.36.0 -> 3.38.0
* libdnf 0.48.0 -> 0.58.0
* libdrm 2.4.102 -> 2.4.104
* libedit 20191231-3.1 -> 20210216-3.1
* libepoxy 1.5.4 -> 1.5.5
* libevdev 1.9.1 -> 1.11.0
* libfm-extra 1.3.1 -> 1.3.2
* libgcrypt 1.8.6 -> 1.9.2
* libgloss 3.3.0 -> 4.1.0
* libgpg-error 1.39 -> 1.41
* libgudev 233 -> 234
* libhandy 0.0.13 -> 1.2.0
* libical 3.0.8 -> 3.0.9
* libinput 1.16.1 -> 1.16.4
* libjitterentropy 2.2.0 -> 3.0.1
* libjpeg-turbo 2.0.5 -> 2.0.6
* libksba 1.4.0 -> 1.5.0
* libmodulemd 2.9.4 -> 2.12.0
* libmpc 1.2.0 -> 1.2.1
* libpam 1.3.1 -> 1.5.1
* libpcap 1.9.1 -> 1.10.0
* libpcre2 10.35 -> 10.36
* libproxy 0.4.15 -> 0.4.17
* librepo 1.12.1 -> 1.13.0
* libsdl2 2.0.12 -> 2.0.14
* libsecret 0.20.3 -> 0.20.4
* libsolv 0.7.14 -> 0.7.17
* libsoup-2.4 2.70.0 -> 2.72.0
* libtirpc 1.2.6 -> 1.3.1
* libunwind 1.4.0 -> 1.5.0
* liburcu 0.12.1 -> 0.12.2
* liburi-perl 1.74 -> 5.08
* libusb1 1.0.23 -> 1.0.24
* libuv 1.39.0 -> 1.41.0
* libva 2.8.0 -> 2.10.0
* libva-initial 2.8.0 -> 2.10.0
* libva-utils 2.8.0 -> 2.10.0
* libwebp 1.1.0 -> 1.2.0
* libwpe 1.7.1 -> 1.8.0
* libx11 1.6.12 -> 1.7.0
* libxcrypt 4.4.17 -> 4.4.18
* libxcrypt-compat 4.4.17 -> 4.4.18
* libxkbcommon 0.10.0 -> 1.0.3
* libxt 1.2.0 -> 1.2.1
* lighttpd 1.4.55 -> 1.4.59
* linux-libc-headers 5.8 -> 5.10
* linux-yocto 5.4.103+gitX, 5.8.18+gitX -> 5.4.107+gitX, 5.10.25+gitX
* linux-yocto-dev 5.10-rc++gitX -> 5.12++gitX
* linux-yocto-rt 5.4.103+gitX, 5.8.18+gitX -> 5.4.107+gitX, 5.10.25+gitX
* linux-yocto-tiny 5.4.103+gitX, 5.8.18+gitX -> 5.4.107+gitX, 5.10.25+gitX
* llvm 10.0.1 -> 11.1.0
* log4cplus 2.0.5 -> 2.0.6
* logrotate 3.17.0 -> 3.18.0
* ltp 20200515 -> 20210121
* lttng-modules 2.12.3 -> 2.12.5
* lttng-tools 2.12.2 -> 2.12.3
* lttng-ust 2.12.0 -> 2.12.1
* lz4 1.9.2 -> 1.9.3
* lzip 1.21 -> 1.22
* man-db 2.9.3 -> 2.9.4
* man-pages 5.08 -> 5.10
* mc 4.8.25 -> 4.8.26
* mesa 20.1.8 -> 21.0.1
* mesa-gl 20.1.8 -> 21.0.1
* meson 0.55.1 -> 0.57.1
* mpg123 1.26.3 -> 1.26.4
* msmtp 1.8.12 -> 1.8.15
* mtools 4.0.24 -> 4.0.26
* musl 1.2.1+gitX -> 1.2.2+gitX
* nativesdk-meson 0.55.1 -> 0.57.1
* net-tools 1.60-20181103+gitX -> 2.10
* netbase 6.1 -> 6.2
* nettle 3.6 -> 3.7.1
* newlib 3.3.0 -> 4.1.0
* nfs-utils 2.5.1 -> 2.5.3
* ninja 1.10.1 -> 1.10.2
* opensbi 0.8 -> 0.9
* openssh 8.3p1 -> 8.5p1
* openssl 1.1.1j -> 1.1.1k
* opkg 0.4.3 -> 0.4.4
* orc 0.4.31 -> 0.4.32
* ovmf edk2-stable202005 -> edk2-stable202102
* pango 1.46.2 -> 1.48.2
* parted 3.3 -> 3.4
* pcmanfm 1.3.1 -> 1.3.2
* perl 5.32.0 -> 5.32.1
* piglit 1.0+gitrX (2a6a8f954d...) -> 1.0+gitrX (d4d9353b72...)
* pigz 2.4 -> 2.6
* pinentry 1.1.0 -> 1.1.1
* ppp 2.4.8 -> 2.4.9
* procps 3.3.16 -> 3.3.17
* psmisc 23.3 -> 23.4
* ptest-runner 2.4.0+gitX -> 2.4.1+gitX
* pulseaudio 13.0 -> 14.2
* puzzles 0.0+gitX (9aa7b7cdfb...) -> 0.0+gitX (84cb4c6701...)
* python3 3.8.5 -> 3.9.2
* python3-cython 0.29.21 -> 0.29.22
* python3-dbusmock 0.19 -> 0.22.0
* python3-git 3.1.7 -> 3.1.14
* python3-jinja2 2.11.2 -> 2.11.3
* python3-magic 0.4.18 -> 0.4.22
* python3-mako 1.1.3 -> 1.1.4
* python3-numpy 1.19.1 -> 1.20.1
* python3-pycairo 1.19.1 -> 1.20.0
* python3-pycryptodome 3.9.8 -> 3.10.1
* python3-pycryptodomex 3.9.8 -> 3.10.1
* python3-pyelftools 0.26 -> 0.27
* python3-pygments 2.6.1 -> 2.8.1
* python3-pygobject 3.36.1 -> 3.38.0
* python3-setuptools 49.6.0 -> 54.1.1
* python3-smmap 3.0.4 -> 4.0.0
* qemu 5.1.0 -> 5.2.0
* quota 4.05 -> 4.06
* readline 8.0 -> 8.1
* resolvconf 1.83 -> 1.87
* rng-tools 6.10 -> 6.11
* rpm 4.15.1 -> 4.16.1.2
* rt-tests 1.1 -> 1.10
* ruby 2.7.1 -> 3.0.0
* sbc 1.4 -> 1.5
* shared-mime-info 2.0 -> 2.1
* socat 1.7.3.4 -> 1.7.4.1
* sqlite3 3.33.0 -> 3.35.0
* strace 5.8 -> 5.11
* stress-ng 0.11.21 -> 0.12.05
* subversion 1.14.0 -> 1.14.1
* sudo 1.9.3 -> 1.9.6p1
* sysklogd 2.1.2 -> 2.2.2
* sysstat 12.4.0 -> 12.4.3
* systemd 246.9 -> 247.4
* systemd-boot 246.9 -> 247.4
* systemd-bootchart 233+gitX -> 234
* systemd-conf 246.9 -> 247.3
* systemtap 4.3 -> 4.4
* systemtap-native 4.3 -> 4.4
* systemtap-uprobes 4.3 -> 4.4
* sysvinit 2.97 -> 2.99
* taglib 1.11.1 -> 1.12
* tar 1.32 -> 1.34
* tcl 8.6.10 -> 8.6.11
* tiff 4.1.0 -> 4.2.0
* u-boot 2020.07 -> 2021.01
* u-boot-tools 2020.07 -> 2021.01
* usbutils 012 -> 013
* util-linux 2.36 -> 2.36.2
* util-macros 1.19.2 -> 1.19.3
* vala 0.48.9 -> 0.50.4
* vte 0.60.3 -> 0.62.2
* vulkan-headers 1.2.135.0 -> 1.2.170.0
* vulkan-loader 1.2.135.0 -> 1.2.170.0
* vulkan-tools 1.2.135.0 -> 1.2.170.0
* wayland 1.18.0 -> 1.19.0
* webkitgtk 2.28.4 -> 2.30.5
* wget 1.20.3 -> 1.21.1
* wpebackend-fdo 1.7.1 -> 1.8.0
* x264 r3011+gitX -> r3039+gitX
* xf86-video-vesa 2.4.0 -> 2.5.0
* xkbcomp 1.4.3 -> 1.4.4
* xkeyboard-config 2.30 -> 2.32
* xprop 1.2.4 -> 1.2.5
* xserver-xorg 1.20.9 -> 1.20.10

+1.

Ross

On Mon, 19 Apr 2021 at 21:47, Richard Purdie
<richard.purdie@...> wrote:

btrfs-tools has changed to LGPL-3.1 so to allow util-linux to build,
remove the dependency from its ptest package. This may regress some
ptests but keeps the gplv2 layer working.

Signed-off-by: Richard Purdie <richard.purdie@...>
---
conf/distro/include/disable-gplv3.inc | 1 +
1 file changed, 1 insertion(+)

diff --git a/conf/distro/include/disable-gplv3.inc b/conf/distro/include/disable-gplv3.inc
index bded378..3285543 100644
--- a/conf/distro/include/disable-gplv3.inc
+++ b/conf/distro/include/disable-gplv3.inc
@@ -1,3 +1,4 @@
INCOMPATIBLE_LICENSE = '*GPLv3*'
WARN_QA_remove = 'incompatible-license'
RDEPENDS_${PN}-ptest_remove_pn-glib-2.0 = "python3-dbusmock"
+RDEPENDS_${PN}-ptest_remove_pn-util-linux = "btrfs-tools"
--
2.30.2

btrfs-tools has changed to LGPL-3.1 so to allow util-linux to build,
remove the dependency from its ptest package. This may regress some
ptests but keeps the gplv2 layer working.

Signed-off-by: Richard Purdie <richard.purdie@...>
---
conf/distro/include/disable-gplv3.inc | 1 +
1 file changed, 1 insertion(+)

diff --git a/conf/distro/include/disable-gplv3.inc b/conf/distro/include/disable-gplv3.inc
index bded378..3285543 100644
--- a/conf/distro/include/disable-gplv3.inc
+++ b/conf/distro/include/disable-gplv3.inc
@@ -1,3 +1,4 @@
INCOMPATIBLE_LICENSE = '*GPLv3*'
WARN_QA_remove = 'incompatible-license'
RDEPENDS_${PN}-ptest_remove_pn-glib-2.0 = "python3-dbusmock"
+RDEPENDS_${PN}-ptest_remove_pn-util-linux = "btrfs-tools"
--
2.30.2

Hi Robert,

Having the device tree compiler on the target has been useful for me
in the past to check the actual content of the device tree using
commands such as:

* dtc -I fs -O dts /sys/firmware/devicetree/base

I have seen cases where the boot-loader updates the device-tree right
before the boot and it is good to be able to check what the
device-tree content is.

Also quite often the hardware is not the cause of the issue, instead
it is the software/driver configuration.

Kind regards, Laurent.

--
Laurent Gauthier
Embedded Linux Systems & Software
Phone: +33 630 483 429
https://soccasys.com

Hi all,

I recently upgraded my project from dunfell 3.1.5 to 3.1.6 and saw
errors about pseudo path mismatches on various build machines. Removing
TMPDIR solved the problem, but I did some digging to see if I find the
source of the problem.

First of all: The wiki page about pseudo aborts [1] is generally a good
thing, I hope it gets higher into search machines result lists as time
passes (a week ago I didn't find it at all, now it's result #4 on
Google for "yocto exit code 134" which is okay).

Second, a nice message was added to sanity.bbclass that the user should
clean the TMPDIR and rebuild. Sadly, an override of the OELAYOUT_ABI
variable in meta-poky/conf/distro/poky.conf suppressed this message for
dunfell 3.1.6. It's fixed in the branch for 3.1.7 (the offending code
was removed).

# $OELAYOUT_ABI [2 operations]
# set /workdir/build/../layers/poky/meta/conf/abi_version.conf:7
# "14"
# set /workdir/build/../layers/poky/meta-
poky/conf/distro/poky.conf:76
# "12"
# pre-expansion value:
# "12"
OELAYOUT_ABI="12"

Maybe we should add a section about that bug which suppresses the
message and that emptying the TMPDIR is recommended when updating to
3.1.6 from an older release to the wiki page?

I haven't checked if this also affects other versions.

[1]: https://wiki.yoctoproject.org/wiki/Pseudo_Abort

Hello,

We are experiencing a build failures only on our build servers, but not
using the same containerised build environment locally, which is
confusing to say the least. We have already tried the nuclear option
and deleted all the caches to no avail.

The following is the error message we are getting, if anyone has an
idea for further debugging it would be much appreciated:

ERROR: keepalived-2.1.5-r0 do_package: Error executing a python
function in exec_python_func() autogenerated:


The stack trace of python calls that resulted in this exception/failure
was:

File: 'exec_python_func() autogenerated', lineno: 2, function: <module>

0001:

*** 0002:perform_packagecopy(d)

0003:

File: '/var/sstate/build/intel-corei7-
64/poky/build/conf/../../../poky/meta/classes/package.bbclass', lineno:
826, function: perform_packagecopy

0822: rpath_replace (dvar, d)

0823:}

0824:perform_packagecopy[cleandirs] = "${PKGD}"

0825:perform_packagecopy[dirs] = "${PKGD}"

*** 0826:

0827:# We generate a master list of directories to process, we
start by

0828:# seeding this list with reasonable defaults, then load from

0829:# the fs-perms.txt files

0830:python fixup_perms () {

File: '/usr/lib/python3.6/subprocess.py', lineno: 356, function:
check_output

0352: # empty string. That is maintained here for backwards
compatibility.

0353: kwargs['input'] = '' if
kwargs.get('universal_newlines', False) else b''

0354:

0355: return run(*popenargs, stdout=PIPE, timeout=timeout,
check=True,

*** 0356: **kwargs).stdout

0357:

0358:

0359:class CompletedProcess(object):

0360: """A process that has finished running.

File: '/usr/lib/python3.6/subprocess.py', lineno: 438, function: run

0434: raise

0435: retcode = process.poll()

0436: if check and retcode:

0437: raise CalledProcessError(retcode, process.args,

*** 0438: output=stdout,
stderr=stderr)

0439: return CompletedProcess(process.args, retcode, stdout,
stderr)

0440:

0441:

0442:def list2cmdline(seq):

Exception: subprocess.CalledProcessError: Command 'tar -cf - -C
/var/sstate/build/intel-corei7-64/poky/build/tmp-glibc/work/corei7-64-
holoplot-linux/keepalived/2.1.5-r0/image -p -S . | tar -xf - -C
/var/sstate/build/intel-corei7-64/poky/build/tmp-glibc/work/corei7-64-
holoplot-linux/keepalived/2.1.5-r0/package' returned non-zero exit
status 2.


Subprocess output:

abort()ing pseudo client by server request. See
https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on
this.

Check logfile: /var/sstate/build/intel-corei7-64/poky/build/tmp-
glibc/work/corei7-64-holoplot-linux/keepalived/2.1.5-
r0/pseudo//pseudo.log

Aborted (core dumped)

tar: Unexpected EOF in archive

tar: Unexpected EOF in archive

tar: Error is not recoverable: exiting now


Best regards,

Morgan


--

<http://holoplot.com/?utm_source=email&utm_medium=sg&utm_campaign=Holoplot_Signature+>

<https://holoplot.com/>*HOLOPLOT GmbH - Headquarters*


Ringbahnstr. 12
(10-14) / A2

12099 Berlin, Germany

+49 (0) 30 40745812




*HOLOPLOT GmbH
- Manufacturing*


Alboinstr. 17-23 / Hall 12

12103 Berlin, Germany

+49
(0) 30 959988740


www.holoplot.com <https://holoplot.com/>



Follow us on
<https://www.facebook.com/OriginalHOLOPLOT/?utm_source=email&utm_medium=sg&utm_campaign=Holoplot_Signature+>
LinkedIn
<https://www.linkedin.com/company/holoplot-gmbh?utm_source=email&utm_medium=sg&utm_campaign=Holoplot_Signature+>.




Roman Sick – CEO | HRB183974B, Register Court Charlottenburg, Germany |
EU Tax-Registration No. DE277000701 This e-mail contains confidential
and/or privileged information. If you are not the intended recipient (or
have received this e-mail in error) please notify the sender immediately
and destroy this e-mail. Any unauthorized copying, disclosure or
distribution of the information in this e-mail is strictly forbidden.

Hello ,
I am experiencing same issue for Rocko build rootfs with QT application for X11.

I have tried the solution provided by Max , but it did not worked for me.

as Per my log :
Using calibration data stored in /etc/pointercal.xinput
Invalid format 42060
unable to find device EETI eGalax Touch Screen
INFO: width=1024, height=600
imx6ull14x14evk login: RandR extension missing
matchbox: Cant find a keycode for keysym 269025056
matchbox: ignoring key shortcut XF86Calendar=!$contacts

matchbox: Cant find a keycode for keysym 2809
matchbox: ignoring key shortcut telephone=!$dates

matchbox: Cant find a keycode for keysym 269025050
matchbox: ignoring key shortcut XF86Start=!matchbox-remote -desktop

Activating service name='org.a11y.atspi.Registry'
Successfully activated service 'org.a11y.atspi.Registry'
SpiRegistry daemon is running with well-known name - org.a11y.atspi.Registry
random: nonblocking pool is initialized

I have used Touch screen module of TFT TOUCH MODULE ,MODULE NO. : SF 70175.

Please provide some guidance.
Thank You.

Regards
Rohit J.

From: Ming Liu <liu.ming50@...>

Introduce IMA_FORCE to allow the IMA policy be applied forcely even
'no_ima' boot parameter is available.

This ensures the end users have a way to disable 'no_ima' support if
they want to, because it may expose a security risk if an attacker can
find a way to change kernel arguments, it will easily bypass rootfs
authenticity checks.

Signed-off-by: Sergio Prado <sergio.prado@...>
Signed-off-by: Ming Liu <liu.ming50@...>
Signed-off-by: Armin Kuster <akuster808@...>
---
.../initrdscripts/initramfs-framework-ima.bb | 5 +++++
.../initrdscripts/initramfs-framework-ima/ima | 9 +++++++--
2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framewor=
k-ima.bb b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-=
ima.bb
index 77f6f7c..6471c53 100644
--- a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.b=
b
+++ b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.b=
b
@@ -14,6 +14,9 @@ LIC_FILES_CHKSUM =3D "file://${COREBASE}/meta/COPYING.M=
IT;md5=3D3da9cfbcb788c80a0384
# to this recipe can just point towards one of its own files.
IMA_POLICY ?=3D "ima-policy-hashed"
=20
+# Force proceed IMA procedure even 'no_ima' boot parameter is available.
+IMA_FORCE ?=3D "false"
+
SRC_URI =3D " file://ima"
=20
inherit features_check
@@ -23,6 +26,8 @@ do_install () {
install -d ${D}/${sysconfdir}/ima
install -d ${D}/init.d
install ${WORKDIR}/ima ${D}/init.d/20-ima
+
+ sed -i "s/@@FORCE_IMA@@/${IMA_FORCE}/g" ${D}/init.d/20-ima
}
=20
FILES_${PN} =3D "/init.d ${sysconfdir}"
diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framewor=
k-ima/ima b/meta-integrity/recipes-core/initrdscripts/initramfs-framework=
-ima/ima
index cff26a3..8971494 100644
--- a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/i=
ma
+++ b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/i=
ma
@@ -2,11 +2,16 @@
#
# Loads IMA policy into the kernel.
=20
+force_ima=3D@@FORCE_IMA@@
+
ima_enabled() {
- if [ "$bootparam_no_ima" =3D "true" ]; then
+ if [ "$force_ima" =3D "true" ]; then
+ return 0
+ elif [ "$bootparam_no_ima" =3D "true" ]; then
return 1
+ else
+ return 0
fi
- return 0
}
=20
ima_run() {
--=20
2.29.0

From: Ming Liu <liu.ming50@...>

IMA_POLICY is being referred as policy recipe name in some places and it
is also being referred as policy file in other places, they are
conflicting with each other which make it impossible to set a IMA_POLICY
global variable in config file.

Fix it by dropping IMA_POLICY definitions from policy recipes

Signed-off-by: Ming Liu <liu.ming50@...>
Signed-off-by: Armin Kuster <akuster808@...>
---
.../ima-policy-appraise-all_1.0.bb | 9 ++-------
.../ima_policy_hashed/ima-policy-hashed_1.0.bb | 9 ++-------
.../ima_policy_simple/ima-policy-simple_1.0.bb | 9 ++-------
3 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-=
policy-appraise-all_1.0.bb b/meta-integrity/recipes-security/ima_policy_a=
ppraise_all/ima-policy-appraise-all_1.0.bb
index da62a4c..84ea161 100644
--- a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-=
appraise-all_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-=
appraise-all_1.0.bb
@@ -2,19 +2,14 @@ SUMMARY =3D "IMA sample simple appraise policy "
LICENSE =3D "MIT"
LIC_FILES_CHKSUM =3D "file://${COREBASE}/meta/COPYING.MIT;md5=3D3da9cfbc=
b788c80a0384361b4de20420"
=20
-# This policy file will get installed as /etc/ima/ima-policy.
-# It is located via the normal file search path, so a .bbappend
-# to this recipe can just point towards one of its own files.
-IMA_POLICY ?=3D "ima_policy_appraise_all"
-
-SRC_URI =3D " file://${IMA_POLICY}"
+SRC_URI =3D " file://ima_policy_appraise_all"
=20
inherit features_check
REQUIRED_DISTRO_FEATURES =3D "ima"
=20
do_install () {
install -d ${D}/${sysconfdir}/ima
- install ${WORKDIR}/${IMA_POLICY} ${D}/${sysconfdir}/ima/ima-policy
+ install ${WORKDIR}/ima_policy_appraise_all ${D}/${sysconfdir}/ima/im=
a-policy
}
=20
FILES_${PN} =3D "${sysconfdir}/ima"
diff --git a/meta-integrity/recipes-security/ima_policy_hashed/ima-policy=
-hashed_1.0.bb b/meta-integrity/recipes-security/ima_policy_hashed/ima-po=
licy-hashed_1.0.bb
index ebb0426..ff7169e 100644
--- a/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed=
_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed=
_1.0.bb
@@ -2,13 +2,8 @@ SUMMARY =3D "IMA sample hash policy"
LICENSE =3D "MIT"
LIC_FILES_CHKSUM =3D "file://${COREBASE}/meta/COPYING.MIT;md5=3D3da9cfbc=
b788c80a0384361b4de20420"
=20
-# This policy file will get installed as /etc/ima/ima-policy.
-# It is located via the normal file search path, so a .bbappend
-# to this recipe can just point towards one of its own files.
-IMA_POLICY ?=3D "ima_policy_hashed"
-
SRC_URI =3D " \
- file://${IMA_POLICY} \
+ file://ima_policy_hashed \
"
=20
inherit features_check
@@ -16,7 +11,7 @@ REQUIRED_DISTRO_FEATURES =3D "ima"
=20
do_install () {
install -d ${D}/${sysconfdir}/ima
- install ${WORKDIR}/${IMA_POLICY} ${D}/${sysconfdir}/ima/ima-policy
+ install ${WORKDIR}/ima_policy_hashed ${D}/${sysconfdir}/ima/ima-poli=
cy
}
=20
FILES_${PN} =3D "${sysconfdir}/ima"
diff --git a/meta-integrity/recipes-security/ima_policy_simple/ima-policy=
-simple_1.0.bb b/meta-integrity/recipes-security/ima_policy_simple/ima-po=
licy-simple_1.0.bb
index cb4b6b8..0e56aec 100644
--- a/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple=
_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple=
_1.0.bb
@@ -2,19 +2,14 @@ SUMMARY =3D "IMA sample simple policy"
LICENSE =3D "MIT"
LIC_FILES_CHKSUM =3D "file://${COREBASE}/meta/COPYING.MIT;md5=3D3da9cfbc=
b788c80a0384361b4de20420"
=20
-# This policy file will get installed as /etc/ima/ima-policy.
-# It is located via the normal file search path, so a .bbappend
-# to this recipe can just point towards one of its own files.
-IMA_POLICY ?=3D "ima_policy_simple"
-
-SRC_URI =3D " file://${IMA_POLICY}"
+SRC_URI =3D " file://ima_policy_simple"
=20
inherit features_check
REQUIRED_DISTRO_FEATURES =3D "ima"
=20
do_install () {
install -d ${D}/${sysconfdir}/ima
- install ${WORKDIR}/${IMA_POLICY} ${D}/${sysconfdir}/ima/ima-policy
+ install ${WORKDIR}/ima_policy_simple ${D}/${sysconfdir}/ima/ima-poli=
cy
}
=20
FILES_${PN} =3D "${sysconfdir}/ima"
--=20
2.29.0

From: Ming Liu <liu.ming50@...>

This ensures when a end user change the IMA_EVM_X509 key file,
ima-evm-keys recipe will be rebuilt.

Signed-off-by: Ming Liu <liu.ming50@...>
Signed-off-by: Armin Kuster <akuster808@...>
---
meta-integrity/recipes-security/ima-evm-keys/ima-evm-keys_1.0.bb | 1 +
1 file changed, 1 insertion(+)

diff --git a/meta-integrity/recipes-security/ima-evm-keys/ima-evm-keys_1.=
0.bb b/meta-integrity/recipes-security/ima-evm-keys/ima-evm-keys_1.0.bb
index 62685bb..7708aef 100644
--- a/meta-integrity/recipes-security/ima-evm-keys/ima-evm-keys_1.0.bb
+++ b/meta-integrity/recipes-security/ima-evm-keys/ima-evm-keys_1.0.bb
@@ -14,3 +14,4 @@ do_install () {
lnr ${D}${sysconfdir}/keys/x509_evm.der ${D}${sysconfdir}/keys/x=
509_ima.der
fi
}
+do_install[file-checksums] +=3D "${@'${IMA_EVM_X509}:%s' % os.path.exist=
s('${IMA_EVM_X509}')}"
--=20
2.29.0

From: Ming Liu <ming.liu@...>

Ming Liu (3):
ima-evm-keys: add file-checksums to IMA_EVM_X509
meta: drop IMA_POLICY from policy recipes
initramfs-framework-ima: introduce IMA_FORCE

.../initrdscripts/initramfs-framework-ima.bb | 5 +++++
.../initrdscripts/initramfs-framework-ima/ima | 9 +++++++--
.../recipes-security/ima-evm-keys/ima-evm-keys_1.0.bb | 1 +
.../ima-policy-appraise-all_1.0.bb | 9 ++-------
.../ima_policy_hashed/ima-policy-hashed_1.0.bb | 9 ++-------
.../ima_policy_simple/ima-policy-simple_1.0.bb | 9 ++-------
6 files changed, 19 insertions(+), 23 deletions(-)

--=20
2.29.0

Hi,
Op 18-04-2021 om 11:59 schreef Richard Purdie:

On Sun, 2021-04-18 at 00:17 +0200, Gmane Admin wrote:

Hi,
Op 14-04-2021 om 06:59 schreef Richard Purdie:

On Tue, 2021-04-13 at 21:14 -0400, Randy MacLeod wrote:

On 2021-04-11 12:19 p.m., Alexander Kanavin wrote:

make already has -l option for limiting new instances if load average is
too high, so it's only natural to add a RAM limiter too.

    -l [N], --load-average[=N], --max-load[=N]
                                Don't start multiple jobs unless load is
below N.

In any case, patches welcome :)

During today's Yocto technical call (1),
we talked about approaches to limiting the system load and avoiding
swap and/or OOM events. Here's what (little!) i recall from the
discussion, 9 busy hours later.

In the short run, instead of independently maintaining changes to
configurations to limit parallelism or xz memory usage, etc, we
could develop an optional common include file where such limits
are shared across the community.

I tried PARALLEL_MAKE_nodejs = "-j 1" from local.conf but that didn't work.

It would need to be:
PARALLEL_MAKE_pn-nodejs = "-j 1"

So I watched it run for a while. It compiles with g++ and as at about
0.5GB per thread, which is OK. In the end it does ld taking 4GB and it
tries to do 4 in parallel. And then swapping becomes so heavy the
desktop becomes unresponsive. Like I mentioned before ssh from another
machine allows me to STOP one of them, allowing the remaining to
complete. And then CONT the last one.

I worked around it now, by creating a bbappend for nodejs with only
PARALLEL_MAKE = "-j 2"

If that works, the override above should also work. You do need the "pn-"
prefix to the recipe name though.

And indeed it does, thanks so much for the tip.

Ferry

Cheers,
Richard

With the previous interval of 10 seconds, there would be
serveral times when the system was very busy and the
script would not return before the next run was scheduled
resulting in no measurement. In addition, build:
https://autobuilder.yocto.io/pub/non-release/20210417-13/
produced 17 files with top output with top running 454 times
and that's a bit too much data to analyze for each run. By
decreasing the measurements, we'll find the worse problems
first, fix them and then we can increase the freqency of
measurement if needed.

Signed-off-by: Randy MacLeod <Randy.MacLeod@...>
---
config.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config.json b/config.json
index aad5257..962d8ae 100644
--- a/config.json
+++ b/config.json
@@ -56,7 +56,7 @@
"BB_DISKMON_DIRS = 'STOPTASKS,${TMPDIR},1G,100K STOPTASKS,${DL_DIR},1G STOPTASKS,${SSTATE_DIR},1G STOPTASKS,/tmp,100M,100K ABORT,${TMPDIR},100M,1K ABORT,${DL_DIR},100M ABORT,${SSTATE_DIR},100M ABORT,/tmp,10M,1K'",
"BB_HASHSERVE = 'typhoon.yocto.io:8686'",
"RUNQEMU_TMPFS_DIR = '/home/pokybuild/tmp'",
- "BB_HEARTBEAT_EVENT = '10'",
+ "BB_HEARTBEAT_EVENT = '60'",
"BB_LOG_HOST_STAT_ON_INTERVAL = '1'",
"BB_LOG_HOST_STAT_CMDS = 'oe-time-dd-test.sh 100'"
]
--
2.27.0