Em ter., 27 de abr. de 2021 às 13:10, Randy MacLeod
<randy.macleod@...> escreveu:

Cross-posting to yocto since this is of general interest.

On 2021-04-23 2:02 p.m., Alexander Kanavin wrote:

This puts them on equal terms with x11 distro feature
(which I think is due).

Signed-off-by: Alexander Kanavin <alex.kanavin@...>
---
meta/conf/distro/include/default-distrovars.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/conf/distro/include/default-distrovars.inc b/meta/conf/distro/include/default-distrovars.inc
index 9fcc10f83a..384ee7fc98 100644
--- a/meta/conf/distro/include/default-distrovars.inc
+++ b/meta/conf/distro/include/default-distrovars.inc
@@ -10,7 +10,7 @@ LOCALE_UTF8_ONLY ?= "0"
LOCALE_UTF8_IS_DEFAULT ?= "1"
LOCALE_UTF8_IS_DEFAULT_class-nativesdk = "0"

-DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod ext2 ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs zeroconf pci 3g nfc x11 vfat"
+DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod ext2 ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs zeroconf pci 3g nfc x11 vfat wayland opengl"
DISTRO_FEATURES ?= "${DISTRO_FEATURES_DEFAULT}"
IMAGE_FEATURES ?= ""

We (Wind River) already drop the x11 DF from some of our distros and
we'd likely do the same for wayland and opengl so while this seems
like the wrong change for headless systems it is one we could deal with.

Adding wayland seems Ok but forcing the opengl support doesn't seems a
good default. Especially because we just also ensure software
rendering is also wrong (slow or not).

--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br http://code.ossystems.com.br
Mobile: +55 (53) 9 9981-7854 Mobile: +1 (347) 903-9750

I've added `IMAGE_INSTALL += "findutils"` to my `conf/local.conf`
file, and it seems like it was enough. There weren't any build
conflicts.

Should the AppArmor recipe be upgraded in some way to indicate that it
needs a full-featured findutils package instead of a busybox one?

Best regards,
Konstantin Aladyshev

On Mon, Apr 26, 2021 at 5:08 PM Quentin Schulz
<quentin.schulz@...> wrote:

Hi Konstantin,

On Mon, Apr 26, 2021 at 01:45:30PM +0300, Konstantin Aladyshev wrote:

I'm using the OpenBMC system (https://github.com/openbmc/openbmc) and
I've tried to enable AppArmor functionality from the 'meta-security'
layer.

To achieve this I've added these strings to my local.conf file:
DISTRO_FEATURES_append = " apparmor"
IMAGE_INSTALL += "apparmor"

The AppArmor functionality was installed to my image, but
unfortunately I've come to this issue:

kernel: AppArmor: AppArmor initialized
kernel: AppArmor: AppArmor Filesystem Enabled
kernel: AppArmor: AppArmor sha1 policy hashing enabled
systemd[1]: systemd 247.3+ running in system mode. (+PAM -AUDIT
-SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -UTMP -LIBCRYPTSETUP -GCRYPT
-GNUTLS -ACL +XZ -LZ4 -ZSTD -SECCOMP +BLKID -ELFUTILS +KMOD -IDN2 -IDN
-PCRE2 default-hierarchy=hybrid)
systemd[1]: Starting AppArmor initialization...
apparmor[113]: Starting AppArmor profiles
apparmor[128]: xargs: invalid option -- 'd'

Busybox implementation of xargs does not support specifying a delimiter.

I suggest you to install the full-featured xargs which is provided by
the findutils recipe.

You probably need to disable xargs Busybox implementation otherwise
there'll be a conflict (you'll know, Yocto won't create the image).

Cheers,
Quentin

On 4/27/21 9:09 AM, Randy MacLeod wrote:

Cross-posting to yocto since this is of general interest.

On 2021-04-23 2:02 p.m., Alexander Kanavin wrote:

This puts them on equal terms with x11 distro feature
(which I think is due).

Signed-off-by: Alexander Kanavin <alex.kanavin@...>
---
  meta/conf/distro/include/default-distrovars.inc | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/conf/distro/include/default-distrovars.inc
b/meta/conf/distro/include/default-distrovars.inc
index 9fcc10f83a..384ee7fc98 100644
--- a/meta/conf/distro/include/default-distrovars.inc
+++ b/meta/conf/distro/include/default-distrovars.inc
@@ -10,7 +10,7 @@ LOCALE_UTF8_ONLY ?= "0"
  LOCALE_UTF8_IS_DEFAULT ?= "1"
  LOCALE_UTF8_IS_DEFAULT_class-nativesdk = "0"
  -DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod
ext2 ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs
zeroconf pci 3g nfc x11 vfat"
+DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod ext2
ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs zeroconf
pci 3g nfc x11 vfat wayland opengl"
  DISTRO_FEATURES ?= "${DISTRO_FEATURES_DEFAULT}"
  IMAGE_FEATURES ?= ""
 

Randy,

We (Wind River) already drop the x11 DF from some of our distros and
we'd likely do the same for wayland and opengl so while this seems
like the wrong change for headless systems it is one we could deal with.

There was some discussion about this topic on the tech call today and
people were concerned about BSP support for opengl since the software
rendering in mesa is horridly slow.

Thanks for bring this issue up.

Kevin, Bryan,
Can you comment if you think we'd have any show-stopper problems
with opengl support for BSPs?

Err, are they going to check my BSP ; )

Joshua said that weston has a usable RDP (remote desktop backend) but
I'm not sure how usable it is especially for single application sharing.
This contrasts with x11 where you can use X11 forwarding over
ssh trivially for whole desktops or an application.

In conclusion, I see the value in pushing yocto forward but we may need
to wait for agreement from BSP folks so let's see what they say.

The layer index  BSP list is long so waiting for feedback may not be
practical.  I think it may be  more of an awareness and how can the BSP
maintainers work around the default if there are issues rather than 
stopping this progress  in core.

I personal would rather see my layer break so that I will be forced to
take action.  I see this as being  no different than when we update
u-boot or the kernel.

- armin

../Randy

Reminder, next Happy Hour is in one day - everyone is welcome to meet with
fellow developers and chat about any interesting topics over Zoom. BYOB -
bring your own beverage.

--
Regards,
Denys Dmytriyenko <denis@...>
PGP: 0x420902729A92C964 - https://denix.org/0x420902729A92C964
Fingerprint: 25FC E4A5 8A72 2F69 1186 6D76 4209 0272 9A92 C964

On 4/27/21 9:48 AM, Randy MacLeod wrote:

Hi,


I've CCed some of the maintainers of more widely used Yocto layers
to get comments on about tagging. Please add in people who I may
have missed.


For a while now, oe-core has had a yocto-X.Y tag in addition to the
release branch name. This helps users easily find the exact commit
that corresponds to the say 3.3 GA release. There have been some
omissions in tagging but Michael and Richard are adjusting the
release process so that tagging will happen more consistently.

Most yocto layers have not adopted the tagging perhaps because they
weren't aware of it so that's why I'm writing this email. Tagging
will make it easy to find the first commit for a specific release
independent of what the branching policy of a layer is. Layer
maintainers sometimes create the release branch in advance of
when oe-core is released and by adding the tag, it would make it
clear when the layer considers content to be officially released.

So the official starting point is what you are looking for? is there any
expectation to tag for dot release alignment?

Of course it's up to users to decide if they are going to follow
the HEAD of a branch or, for some reason, stick with a tagged commit
or private branch off that commit.

What's more important, tag or branch? Many layers hosted on git.yp.org
don't have the 'hardknott' branch.  If the discipline to create a new
branch is not their, I have a hard time believing 'tagging' will be high
on their list.

Are there any concerns about attempting to do this for yocto-3.3
and later?

Tagging in Poky has a meaning of a fully QA set of sources at a given
point of time.  It may be interpreted by users that if a tag showed up
in other layers, those layers are also fully tested.

Should we make it a requirement for yocto compliance?

I think you mean 'Yocto Compatible'.  Branching is already a requirement
IIRC as the program is against a specific branch.

-armin

Should it be a feature tested by the yocto compliance script?

Here's what's in oe-core and bitbake now:
$ cd .../oe-core.git
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.1.7
yocto-3.2
yocto-3.2.1
yocto-3.3

$ cd bitbake/
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.2

On Tue, Apr 27, 2021 at 9:48 AM Randy MacLeod
<randy.macleod@...> wrote:

Hi,


I've CCed some of the maintainers of more widely used Yocto layers
to get comments on about tagging. Please add in people who I may
have missed.


For a while now, oe-core has had a yocto-X.Y tag in addition to the
release branch name. This helps users easily find the exact commit
that corresponds to the say 3.3 GA release. There have been some
omissions in tagging but Michael and Richard are adjusting the
release process so that tagging will happen more consistently.

Most yocto layers have not adopted the tagging perhaps because they
weren't aware of it so that's why I'm writing this email. Tagging
will make it easy to find the first commit for a specific release
independent of what the branching policy of a layer is. Layer
maintainers sometimes create the release branch in advance of
when oe-core is released and by adding the tag, it would make it
clear when the layer considers content to be officially released.
Of course it's up to users to decide if they are going to follow
the HEAD of a branch or, for some reason, stick with a tagged commit
or private branch off that commit.

I think this could be a good thing, although it does put the burden on
release maintainers. mostly they
test against the tip of the release branch, So if yocto project
testing is including these layers for wider
testing and can then recommend a validated commit then perhaps this
could be made viable.

Are there any concerns about attempting to do this for yocto-3.3
and later?

Should we make it a requirement for yocto compliance?
Should it be a feature tested by the yocto compliance script?



Here's what's in oe-core and bitbake now:
$ cd .../oe-core.git
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.1.7
yocto-3.2
yocto-3.2.1
yocto-3.3

$ cd bitbake/
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.2

--
# Randy MacLeod
# Wind River Linux

This would be a helpful addition for us when upgrading between named
Yocto releases. Normally, when we are ready to upgrade, we checkout the
HEAD for the named branch and try to get everything working together.

Having a tagged commit for a version would (hopefully) help ensure that
all of the layers are in the same state as when it went through QA
testing. If we are upgrading at some arbitrary point after the release
was made, some layers could have additional commits that may require
changes which have not yet made it into the dependent layers.

Regards,

Claude Bing

Hi,


I've CCed some of the maintainers of more widely used Yocto layers
to get comments on about tagging. Please add in people who I may
have missed.


For a while now, oe-core has had a yocto-X.Y tag in addition to the
release branch name. This helps users easily find the exact commit
that corresponds to the say 3.3 GA release. There have been some
omissions in tagging but Michael and Richard are adjusting the
release process so that tagging will happen more consistently.

Most yocto layers have not adopted the tagging perhaps because they
weren't aware of it so that's why I'm writing this email. Tagging
will make it easy to find the first commit for a specific release
independent of what the branching policy of a layer is. Layer maintainers sometimes create the release branch in advance of
when oe-core is released and by adding the tag, it would make it
clear when the layer considers content to be officially released.
Of course it's up to users to decide if they are going to follow
the HEAD of a branch or, for some reason, stick with a tagged commit
or private branch off that commit.


Are there any concerns about attempting to do this for yocto-3.3
and later?

Should we make it a requirement for yocto compliance?
Should it be a feature tested by the yocto compliance script?



Here's what's in oe-core and bitbake now:
$ cd .../oe-core.git
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.1.7
yocto-3.2
yocto-3.2.1
yocto-3.3

$ cd bitbake/
$ git tag -l | grep yocto-3
yocto-3.0
yocto-3.1
yocto-3.2

--
# Randy MacLeod
# Wind River Linux

Cross-posting to yocto since this is of general interest.

On 2021-04-23 2:02 p.m., Alexander Kanavin wrote:

This puts them on equal terms with x11 distro feature
(which I think is due).
Signed-off-by: Alexander Kanavin <alex.kanavin@...>
---
meta/conf/distro/include/default-distrovars.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/conf/distro/include/default-distrovars.inc b/meta/conf/distro/include/default-distrovars.inc
index 9fcc10f83a..384ee7fc98 100644
--- a/meta/conf/distro/include/default-distrovars.inc
+++ b/meta/conf/distro/include/default-distrovars.inc
@@ -10,7 +10,7 @@ LOCALE_UTF8_ONLY ?= "0"
LOCALE_UTF8_IS_DEFAULT ?= "1"
LOCALE_UTF8_IS_DEFAULT_class-nativesdk = "0"
-DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod ext2 ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs zeroconf pci 3g nfc x11 vfat"
+DISTRO_FEATURES_DEFAULT ?= "acl alsa argp bluetooth debuginfod ext2 ipv4 ipv6 largefile pcmcia usbgadget usbhost wifi xattr nfs zeroconf pci 3g nfc x11 vfat wayland opengl"
DISTRO_FEATURES ?= "${DISTRO_FEATURES_DEFAULT}"
IMAGE_FEATURES ?= ""

We (Wind River) already drop the x11 DF from some of our distros and
we'd likely do the same for wayland and opengl so while this seems
like the wrong change for headless systems it is one we could deal with.

There was some discussion about this topic on the tech call today and
people were concerned about BSP support for opengl since the software
rendering in mesa is horridly slow.

Kevin, Bryan,
Can you comment if you think we'd have any show-stopper problems
with opengl support for BSPs?

Joshua said that weston has a usable RDP (remote desktop backend) but
I'm not sure how usable it is especially for single application sharing.
This contrasts with x11 where you can use X11 forwarding over
ssh trivially for whole desktops or an application.

In conclusion, I see the value in pushing yocto forward but we may need
to wait for agreement from BSP folks so let's see what they say.

../Randy

--
# Randy MacLeod
# Wind River Linux

for the first time, i'm digging around in the docs for how to
properly license various types of recipes, so a couple simple
questions to start with, at least so i can make a first pass of
cleaning up some content in front of me.

as we established recently, packagegroup files need no licensing,
the obvious observation being that they represent the collection of
licenses that comprise them. however, i notice that the
packagegroup.bbclass file does indeed define a default license:

LICENSE ?= "MIT"

so not only does a packagegroup have a default (MIT) license, but it's
conditional suggesting one could give it a different license. what
other licenses would make sense for a packagegroup? I'm sticking with
the default that packagegroup recipe files need no LICENSE assignment,
but now i'm curious as to what other options there are (or perhaps
that that default assignment in packagegroup.bbclass is obsolete).

the same sort of question can be asked about image files, including
the generic OE core-image*.bb recipe files. of all those current
core-image files:

core-image-base.bb
core-image-minimal.bb
core-image-minimal-dev.bb
core-image-minimal-initramfs.bb
core-image-minimal-mtdutils.bb
core-image-tiny-initramfs.bb

fail into two camps.

the first sets a license, then inherits core-image:

LICENSE = "MIT"
inherit core-image

the second type simply "require"s one of the other recipe files so it
has no need to set its own license, as in core-image-minimal-dev.bb:

require core-image-minimal.bb

similar to packagegroups, does a core-image recipe really need a
separate LICENSE setting, or could that be added to core-image.bbclass
to centralize it (if it's even needed at all)?

finally, WRT .bbappend files, the original recipes will have their
own licenses and if the .bbappend file is doing nothing but adding
some configuration (you know, PACKAGECONFIG, EXTRA_OEMAKE, that sort
of thing), then there should be no need for licensing in the bbappend
file. does all this sound reasonable so far?

rday

On Tue, Apr 27, 2021 at 02:01:24AM -0400, jchludzinski via lists.yoctoproject.org wrote:

When I trying using bitbake to build openembedded Linux kernel, it dies with
these download failures:

NOTE: Fetching uninative binary shim http://downloads.yoctoproject.org/releases/uninative/3.0/x86_64-nativesdk-libc.tar.xz;sha256sum=5ec5a9276046e7eceeac749a18b175667384e1f445cd4526300a41404d985a5b
(will check PREMIRRORS first)
WARNING: Failed to fetch URL http://downloads.yoctoproject.org/releases/uninative/3.0/x86_64-nativesdk-libc.tar.xz;sha256sum=5ec5a9276046e7eceeac749a18b175667384e1f445cd4526300a41404d985a5b,
attempting MIRRORS if available
ERROR: Fetcher failure: Fetch command export PSEUDO_DISABLED=1; export
DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"; export
SSH_AUTH_SOCK="/run/user/1000/keyring/ssh"; export PATH="/home/jski/poky/scripts:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot/usr/bin/crossscripts:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/usr/sbin:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/usr/bin:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/sbin:/home/jski/poky/build/tmp/work/core2-64-poky-linux/defaultpkgname/1.0-r0/recipe-sysroot-native/bin:/home/jski/poky/bitbake/bin:/home/jski/poky/build/tmp/hosttools";
export HOME="/home/jski"; /usr/bin/env wget -t 2 -T 30 --passive-ftp
--no-check-certificate -P /home/jski/poky/build/downloads/uninative/5ec5a9276046e7eceeac749a18b175667384e1f445cd4526300a41404d985a5b 'http://downloads.yoctoproject.org/releases/uninative/3.0/x86_64-nativesdk-libc.tar.xz'
--progress=dot -v failed with exit code 4, output:
--2021-04-27 01:49:09-- http://downloads.yoctoproject.org/releases/uninative/3.0/x86_64-nativesdk-libc.tar.xz
Resolving downloads.yoctoproject.org (downloads.yoctoproject.org)... failed:
Connection timed out.
wget: unable to resolve host address 'downloads.yoctoproject.org'

It looks like an issue with your DNS which does not return anything for
downloads.yoctoproject.org?

Cheers,
Quentin

I'm new to yocto as well but what we do is in our own custom image:

inherit extrausers
EXTRA_USERS_PARAMS = " useradd nodered"

and then since we use systemd we've created our own service file that includes:

User=nodered

in the [service] block definition, so the executable is run using that user instead of root.

Extrausers docs are https://www.yoctoproject.org/docs/current/mega-manual/mega-manual.html#ref-classes-extrausers

An alternative you might look at is the useradd class https://git.yoctoproject.org/cgit.cgi/poky/tree/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb which probably lets you set the users in your own recipe instead at image level

Hello,

I am trying to run my application in less privilege mode instead of root user.
As i am new to Yocto build could you please some one suggest on how to configure my build environment to get user and run
my application with the user privileges at startup.

You may be interested in ROOTLESS_X="1", to open a non-priviledged X11 session.

Regards,
Vijay

--
Yann Dirson <yann@...>
Blade / Shadow -- http://shadow.tech

Hi All,

I am trying to run my application in less privilege mode instead of root user.
As i am new to Yocto build could you please some one suggest on how to configure my build environment to get user and run
my application with the user privileges at startup.

Regards,
Vijay