Hi folks

I've been looking into a couple of compiler flags for hardening that I think we
might want to consider enabling by default in security-flags.inc:


1) -fstack-clash-protection

This option was introduced to gcc 8.x and provides protection against the
stack clash vulnerability:

https://securingsoftware.blogspot.com/2017/12/stack-clash-vulnerability.html

It has been enabled in some Linux distributions already (e.g. Ubuntu, Fedora).


2) -z noexecstack (or alternative mitigations)

gcc will enable an executable stack under a few different circumstances - see
here for details

https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart

I've written a check that we could add to insane.bbclass that warns/errors on
binaries with an executable stack. Does this seem reasonable to have?
The other possibility is we add -Wl,-z,noexecstack to LDFLAGS and then see
what breaks, but unfortunately issues are likely only going to show up when
the program crashes at runtime, and also it will stop the aforementioned check
from working.


Any opinions?

Thanks
Paul

Once a week has proven a bit too hectic: it's better to have
more time to test, submit, review and integrate the updates
before AUH runs again.

Signed-off-by: Alexander Kanavin <alex.kanavin@...>
---
schedulers.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/schedulers.py b/schedulers.py
index a5d740e..32e3efe 100644
--- a/schedulers.py
+++ b/schedulers.py
@@ -417,9 +417,9 @@ schedulers.append(sched.Nightly(name='nightly-buildperf-ubuntu1604', branch='mas
schedulers.append(sched.Nightly(name='nightly-buildperf-centos7', branch='master', properties=parent_default_props('buildperf-centos7'),
builderNames=['buildperf-centos7'], hour=[3,9,15,21], minute=0))

-# Run the AUH every Sunday
+# Run the AUH twice a month on 1st and 15th
schedulers.append(sched.Nightly(name='nightly-auh', branch='master', properties=parent_default_props('auh'),
- builderNames=['auh'], dayOfWeek=6, hour=5, minute=0))
+ builderNames=['auh'], dayOfMonth=[1, 15], hour=5, minute=0))

# If any of our sphinx docs branches change, trigger a build
schedulers.append(sched.AnyBranchScheduler(name="yocto-docs-changed",
--
2.34.1

On 2022-01-24 11:17, Jon Mason wrote:

From the beginning, OpenEmbedded and The Yocto Project have always

strived to be as inclusive as possible to all races, sexes,
orientations, religions, nationalities, and any other thing which
might divide people. As continuation of this striving, there are
suggested changes below that are being proposed to make the projects
more inclusive and show the community as the professional, friendly,
and welcoming group that it is. There are words in use by the
projects directly or one of its derivative layers that could be
offensive to some. For more information on which words we selected
and why, please consult
https://inclusivenaming.org/word-lists/overview/
In the process of changing these, we are using this opportunity to
make the terms more obvious and useful, as well as removing cruft and
other unused code. This is the pure definition of a win-win solution.
With this in mind, a group of people have tried to identify issues and
come up with a plan to address these. We’ve divided the tasks into 3
areas: bitbake variables, oe-core variables, and everything else.

Jon,

I've looked over all the changes and agree with Ross on his one suggestion
and that the rest of the changes are fine.


The new terms are equally or in some cases more clear so hopefully that will
result in less confusion and a better experience for everyone at the one-time
cost of a hopefully not too bumpy transition.

Thanks!

../Randy

Bitbake Variables
Taking issues in turn, for bitbake:
For BB_DISKMON_DIRS, the actions "ABORT, STOPTASKS and WARN" would
become "HALT, NO_NEW_TASKS and "WARN".
BB_ENV_WHITELIST -> BB_ENV_PASSTHROUGH
BB_ENV_EXTRAWHITE -> BB_ENV_PASSTHROUGH_ADDITIONS
BB_HASHCONFIG_WHITELIST -> BB_HASHCONFIG_IGNORE_VARS
BB_SETSCENE_ENFORCE_WHITELIST -> BB_SETSCENE_ENFORCE_IGNORE_TASKS
BB_HASHBASE_WHITELIST -> BB_BASEHASH_IGNORE_VARS
MULTI_PROVIDER_WHITELIST -> BB_MULTI_PROVIDER_ALLOWED
BB_STAMP_WHITELIST and BB_STAMP_POLICY -> delete the code (already merged)
basewhitelist and taskwhitelist as used in sigdata/siginfo will need
to be renamed and older file usage of the variables renamed at import
for backwards compatibility. The variables in bitbake along with usage
of abort will be renamed as appropriate.
For most variables, errors will be shown to the user if the old
variable names are set. Mostly this can be done in event hooks but
some like the BB_ENV changes will need special handling.
These changes hopefully improve consistency (e.g. a consistent BB_
prefix and BASHHASH as terminology used elsewhere) and also improve
the description of the variables to be more understandable to users.
OE-Core Variables
For OE-Core, the proposals are:
For blacklist.bbclass, the proposal is to add the functionality to the
anonymous Python in base.bbclass instead. PNBLACKLIST[xxx] would
become SKIP_RECIPE[xxx]. INHERIT_BLACKLIST would simply be dropped.
SSTATE_DUPWHITELIST -> SSTATE_ALLOW_OVERLAP_FILES
CVE_CHECK_PN_WHITELIST -> CVE_CHECK_SKIPRECIPE
CVE_CHECK_WHITELIST -> CVE_CHECK_IGNORECVE
SYSROOT_DIRS_BLACKLIST -> SYSROOT_DIRS_IGNORE
LICENSE_FLAGS_WHITELIST -> LICENSE_FLAGS_ACCEPTED
UNKNOWN_CONFIGURE_WHITELIST -> UNKNOWN_CONFIGURE_OPT_IGNORE
SDK_LOCAL_CONF_BLACKLIST -> ESDK_LOCALCONF_REMOVE
SDK_LOCAL_CONF_WHITELIST -> ESDK_LOCALCONF_ALLOW
SDK_INHERIT_BLACKLIST -> ESDK_CLASS_INHERIT_DISABLE
TUNEABI_WHITELIST - already removed as obsolete
For the ICECC_USER_XXX and ICECC_SYSTEM_XXX, we think these can likely
be merged into single variables:
ICECC_USER_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_SYSTEM_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_USER_PACKAGE_WL -> ICECC_RECIPE_ENABLE
ICECC_USER_PACKAGE_BL -> ICECC_RECIPE_DISABLE
ICECC_SYSTEM_PACKAGE_BL -> ICECC_RECIPE_DISABLE
For license handling, we’d use the opportunity to clean up the
WHITELIST_(ANY LICENSE) syntax and replace it with a
INCOMPATIBLE_LICENSE_ALLOWED_RECIPES, which would be a list of recipes
which are of a blocked the INCOMPATIBLE_LICENSE list.
Everything else
The migration plan includes writing a script to assist with the
migration. In many cases it can likely make the translation. In cases
where that isn’t possible, it will aim to list the areas the user
needs to fix references.
A warning mechanism will be added to bitbake to detect usage of old
variable names (post parsing), except for BB_ENV issues which will
likely need special handling. A (limited) conversion script will be
created to help with the migration. For those instances where a 1-1
mapping is not achievable, a list of the occurrences and what it
should be changed to will occur.
Patch files in OE to be renamed:
11_tcpd_blacklist.patch -> 11_tcpd_blocklist.patch
mount.blacklist -> mount.disallow
0001-lxdm.conf.in-blacklist-root-for-release-images.patch ->
0001-lxdm.conf.in-deny-root-for-release-images.patch
022-RH-Remove-the-property-blacklist-exception-builtin.patch ->
022-RH-Remove-the-default-property-exception-builtin.patch
0001-Cargo.toml-do-not-abort-on-panic.patch ->
0001-Cargo.toml-do-not-exit-on-panic.patch
0004-Cargo.toml-do-not-abort-on-panic.patch ->
0004-Cargo.toml-do-not-exit-on-panic.patch
Also, there are a few others outside of OE that should probably be patched too.
Branch Names
The “master” branches on the relevant OpenEmbedded and Yocto Project
git trees will be changed to an alternative name at some point in the
future. The current preferred name is “devel”. There is no time
table for this currently, and there is no obligation or requirement to
change the branch name for any downstream project which is beyond the
project’s remit.
Similarly, there is no need to change any recipes that are using a
“master” branch as part of the SRC_URI. Those are outside the scope
of YP/OE and this effort.
Note
These changes are only to bitbake and OE-Core. There is no
requirement to change any other layers but we’d note consistency is
encouraged and helpful to users.
Helping
If you would like to help, please put your name by the items in
question on the inclusive language wiki page.
https://wiki.yoctoproject.org/wiki/Inclusive_language
Thanks
Special thanks to Richard Purdie, Michael Opdenacker. Marta
Rybczynska, Scott Murray, Jan-Simon Moeller, Saul Wold, and Armin
Kuster for providing their time, technical details, text, and feedback
on this task.

--
# Randy MacLeod
# Wind River Linux

All,

Our next OpenEmbedded Happy Hour is on January 26 for Europe/Americas
timezones @ 1700/5pm UTC (12pm ET / 9am PT):

https://www.openembedded.org/wiki/Calendar
https://www.timeanddate.com/worldclock/fixedtime.html?msg=OpenEmbedded+Happy+Hour+January+26&iso=20220126T17

--
Regards,
Denys Dmytriyenko <denis@...>
PGP: 0x420902729A92C964 - https://denix.org/0x420902729A92C964
Fingerprint: 25FC E4A5 8A72 2F69 1186 6D76 4209 0272 9A92 C964

On Tue, 2022-01-25 at 07:50 -0800, Chuck Wolber wrote:

On Mon, Jan 24, 2022 at 8:18 AM Jon Mason <jdmason@...> wrote:

%< SNIP %<
 

Branch Names
The “master” branches on the relevant OpenEmbedded and Yocto Project
git trees will be changed to an alternative name at some point in the
future.  The current preferred name is “devel”.

Why devel instead of main [1]?

[1]
https://lore.kernel.org/git/pull.656.v4.git.1593009996.gitgitgadget@gmail.com/

The idea is we're trying to use the language which makes sense and "devel" says
what the branch is/does.

Cheers,

Richard

A wrong path was given given the working directory.

Also revert the changes with "git reset --hard" to
have a clean state before further branch switches.

Signed-off-by: Michael Opdenacker <michael.opdenacker@...>
---
scripts/run-docs-build | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/run-docs-build b/scripts/run-docs-build
index 5d6d24a..c93b3e6 100755
--- a/scripts/run-docs-build
+++ b/scripts/run-docs-build
@@ -43,11 +43,12 @@ cp -r ./_build/final/* $outputdir/bitbake/next
# see the latest releases.
for branch in 1.46 1.48 1.50 1.52; do
git checkout $branch
- git checkout master doc/releases.rst
+ git checkout master releases.rst
make clean
make publish
mkdir $outputdir/bitbake/$branch
cp -r ./_build/final/* $outputdir/bitbake/$branch
+ git reset --hard
done

# only sync bitbake folder for now. We need bitbake to be published first
@@ -79,11 +80,12 @@ cp -r ./_build/final/* $outputdir/next
for branch in dunfell gatesgarth hardknott honister; do
cd $ypdocs
git checkout $branch
- git checkout master documentation/releases.rst
+ git checkout master releases.rst
make clean
make publish
mkdir $outputdir/$branch
cp -r ./_build/final/* $outputdir/$branch
+ git reset --hard
done

# Yocto Project releases/tags
@@ -101,12 +103,13 @@ for tag in $(git tag --list 'yocto-*'); do
if [ "$tag" = "yocto-3.3" ] || [ "$tag" = "yocto-3.4" ]; then
git am "${scriptdir}/${tag}/0001-conf-update-for-release.patch"
fi
- git checkout master documentation/releases.rst
+ git checkout master releases.rst
make clean
make publish
version=$(echo $tag | cut -c7-)
mkdir $outputdir/$version
cp -r ./_build/final/* $outputdir/$version
+ git reset --hard
fi
done

--
2.25.1

On Mon, 24 Jan 2022 at 16:18, Jon Mason <jdmason@...> wrote:

CVE_CHECK_PN_WHITELIST -> CVE_CHECK_SKIPRECIPE
CVE_CHECK_WHITELIST -> CVE_CHECK_IGNORECVE

This is the only one that sticks out to me. I think it needs another
_, SKIP_RECIPE and IGNORE_CVE.

Other than that, +1.

Will we have a bit of logic to detect the obsolete names being set and
emit warnings/errors?

Ross

On Tue, 25 Jan 2022 at 15:50, Chuck Wolber <chuckwolber@...> wrote:

Branch Names
The “master” branches on the relevant OpenEmbedded and Yocto Project
git trees will be changed to an alternative name at some point in the
future. The current preferred name is “devel”.

Why devel instead of main [1]?

[1] https://lore.kernel.org/git/pull.656.v4.git.1593009996.gitgitgadget@gmail.com/

Personally, the only advantage of 'main' is muscle memory of m[tab].

Semantically it's not the 'main' branch, it's the active development
branch. Thus, devel.

Ross

A build flagged for QA (yocto-3.5_M2.rc6) was completed on the autobuilder and
is available at:


https://autobuilder.yocto.io/pub/releases/yocto-3.5_M2.rc6


Build hash information:

bitbake: 1f06f326fa8b47e2a4dce756d57a9369a2225201
meta-agl: 7a644d636237459c54128a71d083cb6f9e1b8e60
meta-arm: 254482284d4588532bd7b9d980193e3e41adaa99
meta-aws: 8893e0cd4c0981eeda941eaa9ad2eb9359670502
meta-gplv2: f04e4369bf9dd3385165281b9fa2ed1043b0e400
meta-intel: 4ff5b19ba63ea69c47198e641acbc12e33634cac
meta-mingw: ddbf14b224215f47a5f80fc8154ade8d3bc318e8
meta-openembedded: a558d51fecda3e66ace21d02b57ab61bf122fdc1
oecore: a179485351a0563d12a2fef3e49971122255ed80
poky: 27ff420543f0195dab024698d804aca33f2ae139



This is an automated message from the Yocto Project Autobuilder
Git: git://git.yoctoproject.org/yocto-autobuilder2
Email: richard.purdie@...

On 24/01/2022 16:17, Jon Mason wrote:

From the beginning, OpenEmbedded and The Yocto Project have always
strived to be as inclusive as possible to all races, sexes,
orientations, religions, nationalities, and any other thing which
might divide people. As continuation of this striving, there are
suggested changes below that are being proposed to make the projects
more inclusive and show the community as the professional, friendly,
and welcoming group that it is. There are words in use by the
projects directly or one of its derivative layers that could be
offensive to some. For more information on which words we selected
and why, please consult
https://inclusivenaming.org/word-lists/overview/
In the process of changing these, we are using this opportunity to
make the terms more obvious and useful, as well as removing cruft and
other unused code. This is the pure definition of a win-win solution.
With this in mind, a group of people have tried to identify issues and
come up with a plan to address these. We’ve divided the tasks into 3
areas: bitbake variables, oe-core variables, and everything else.
Bitbake Variables
Taking issues in turn, for bitbake:
For BB_DISKMON_DIRS, the actions "ABORT, STOPTASKS and WARN" would
become "HALT, NO_NEW_TASKS and "WARN".
BB_ENV_WHITELIST -> BB_ENV_PASSTHROUGH
BB_ENV_EXTRAWHITE -> BB_ENV_PASSTHROUGH_ADDITIONS
BB_HASHCONFIG_WHITELIST -> BB_HASHCONFIG_IGNORE_VARS
BB_SETSCENE_ENFORCE_WHITELIST -> BB_SETSCENE_ENFORCE_IGNORE_TASKS
BB_HASHBASE_WHITELIST -> BB_BASEHASH_IGNORE_VARS
MULTI_PROVIDER_WHITELIST -> BB_MULTI_PROVIDER_ALLOWED
BB_STAMP_WHITELIST and BB_STAMP_POLICY -> delete the code (already merged)
basewhitelist and taskwhitelist as used in sigdata/siginfo will need
to be renamed and older file usage of the variables renamed at import
for backwards compatibility. The variables in bitbake along with usage
of abort will be renamed as appropriate.
For most variables, errors will be shown to the user if the old
variable names are set. Mostly this can be done in event hooks but
some like the BB_ENV changes will need special handling.
These changes hopefully improve consistency (e.g. a consistent BB_
prefix and BASHHASH as terminology used elsewhere) and also improve
the description of the variables to be more understandable to users.
OE-Core Variables
For OE-Core, the proposals are:
For blacklist.bbclass, the proposal is to add the functionality to the
anonymous Python in base.bbclass instead. PNBLACKLIST[xxx] would
become SKIP_RECIPE[xxx]. INHERIT_BLACKLIST would simply be dropped.
SSTATE_DUPWHITELIST -> SSTATE_ALLOW_OVERLAP_FILES
CVE_CHECK_PN_WHITELIST -> CVE_CHECK_SKIPRECIPE
CVE_CHECK_WHITELIST -> CVE_CHECK_IGNORECVE
SYSROOT_DIRS_BLACKLIST -> SYSROOT_DIRS_IGNORE
LICENSE_FLAGS_WHITELIST -> LICENSE_FLAGS_ACCEPTED
UNKNOWN_CONFIGURE_WHITELIST -> UNKNOWN_CONFIGURE_OPT_IGNORE
SDK_LOCAL_CONF_BLACKLIST -> ESDK_LOCALCONF_REMOVE
SDK_LOCAL_CONF_WHITELIST -> ESDK_LOCALCONF_ALLOW
SDK_INHERIT_BLACKLIST -> ESDK_CLASS_INHERIT_DISABLE
TUNEABI_WHITELIST - already removed as obsolete
For the ICECC_USER_XXX and ICECC_SYSTEM_XXX, we think these can likely
be merged into single variables:
ICECC_USER_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_SYSTEM_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_USER_PACKAGE_WL -> ICECC_RECIPE_ENABLE
ICECC_USER_PACKAGE_BL -> ICECC_RECIPE_DISABLE
ICECC_SYSTEM_PACKAGE_BL -> ICECC_RECIPE_DISABLE
For license handling, we’d use the opportunity to clean up the
WHITELIST_(ANY LICENSE) syntax and replace it with a
INCOMPATIBLE_LICENSE_ALLOWED_RECIPES, which would be a list of recipes
which are of a blocked the INCOMPATIBLE_LICENSE list.

This is an excellent proposal, the new variable names for bitbake & oe-core are clear and easy to understand.

Everything else
The migration plan includes writing a script to assist with the
migration. In many cases it can likely make the translation. In cases
where that isn’t possible, it will aim to list the areas the user
needs to fix references.
A warning mechanism will be added to bitbake to detect usage of old
variable names (post parsing), except for BB_ENV issues which will
likely need special handling. A (limited) conversion script will be
created to help with the migration. For those instances where a 1-1
mapping is not achievable, a list of the occurrences and what it
should be changed to will occur.
Patch files in OE to be renamed:
11_tcpd_blacklist.patch -> 11_tcpd_blocklist.patch
mount.blacklist -> mount.disallow
0001-lxdm.conf.in-blacklist-root-for-release-images.patch ->
0001-lxdm.conf.in-deny-root-for-release-images.patch
022-RH-Remove-the-property-blacklist-exception-builtin.patch ->
022-RH-Remove-the-default-property-exception-builtin.patch
0001-Cargo.toml-do-not-abort-on-panic.patch ->
0001-Cargo.toml-do-not-exit-on-panic.patch
0004-Cargo.toml-do-not-abort-on-panic.patch ->
0004-Cargo.toml-do-not-exit-on-panic.patch
Also, there are a few others outside of OE that should probably be patched too.
Branch Names
The “master” branches on the relevant OpenEmbedded and Yocto Project
git trees will be changed to an alternative name at some point in the
future. The current preferred name is “devel”. There is no time
table for this currently, and there is no obligation or requirement to
change the branch name for any downstream project which is beyond the
project’s remit.

The layer index may need some modification to handle different layers having different names for the in-development branch. We could implement the layer index changes first to support other layers which rename their master branch.

I'm going to bite the bullet with meta-linux-mainline and rename the master branch to "dev" this week to see what happens.

Similarly, there is no need to change any recipes that are using a
“master” branch as part of the SRC_URI. Those are outside the scope
of YP/OE and this effort.
Note
These changes are only to bitbake and OE-Core. There is no
requirement to change any other layers but we’d note consistency is
encouraged and helpful to users.
Helping
If you would like to help, please put your name by the items in
question on the inclusive language wiki page.
https://wiki.yoctoproject.org/wiki/Inclusive_language
Thanks
Special thanks to Richard Purdie, Michael Opdenacker. Marta
Rybczynska, Scott Murray, Jan-Simon Moeller, Saul Wold, and Armin
Kuster for providing their time, technical details, text, and feedback
on this task.

Thanks all, it's great to see this moving forward!

--
Paul Barker
Principal Software Engineer
SanCloud Ltd

e: paul.barker@...
w: https://sancloud.co.uk/

From the beginning, OpenEmbedded and The Yocto Project have always
strived to be as inclusive as possible to all races, sexes,
orientations, religions, nationalities, and any other thing which
might divide people. As continuation of this striving, there are
suggested changes below that are being proposed to make the projects
more inclusive and show the community as the professional, friendly,
and welcoming group that it is. There are words in use by the
projects directly or one of its derivative layers that could be
offensive to some. For more information on which words we selected
and why, please consult
https://inclusivenaming.org/word-lists/overview/

In the process of changing these, we are using this opportunity to
make the terms more obvious and useful, as well as removing cruft and
other unused code. This is the pure definition of a win-win solution.

With this in mind, a group of people have tried to identify issues and
come up with a plan to address these. We’ve divided the tasks into 3
areas: bitbake variables, oe-core variables, and everything else.

Bitbake Variables
Taking issues in turn, for bitbake:

For BB_DISKMON_DIRS, the actions "ABORT, STOPTASKS and WARN" would
become "HALT, NO_NEW_TASKS and "WARN".

BB_ENV_WHITELIST -> BB_ENV_PASSTHROUGH
BB_ENV_EXTRAWHITE -> BB_ENV_PASSTHROUGH_ADDITIONS

BB_HASHCONFIG_WHITELIST -> BB_HASHCONFIG_IGNORE_VARS
BB_SETSCENE_ENFORCE_WHITELIST -> BB_SETSCENE_ENFORCE_IGNORE_TASKS
BB_HASHBASE_WHITELIST -> BB_BASEHASH_IGNORE_VARS
MULTI_PROVIDER_WHITELIST -> BB_MULTI_PROVIDER_ALLOWED
BB_STAMP_WHITELIST and BB_STAMP_POLICY -> delete the code (already merged)

basewhitelist and taskwhitelist as used in sigdata/siginfo will need
to be renamed and older file usage of the variables renamed at import
for backwards compatibility. The variables in bitbake along with usage
of abort will be renamed as appropriate.

For most variables, errors will be shown to the user if the old
variable names are set. Mostly this can be done in event hooks but
some like the BB_ENV changes will need special handling.

These changes hopefully improve consistency (e.g. a consistent BB_
prefix and BASHHASH as terminology used elsewhere) and also improve
the description of the variables to be more understandable to users.

OE-Core Variables
For OE-Core, the proposals are:

For blacklist.bbclass, the proposal is to add the functionality to the
anonymous Python in base.bbclass instead. PNBLACKLIST[xxx] would
become SKIP_RECIPE[xxx]. INHERIT_BLACKLIST would simply be dropped.

SSTATE_DUPWHITELIST -> SSTATE_ALLOW_OVERLAP_FILES
CVE_CHECK_PN_WHITELIST -> CVE_CHECK_SKIPRECIPE
CVE_CHECK_WHITELIST -> CVE_CHECK_IGNORECVE
SYSROOT_DIRS_BLACKLIST -> SYSROOT_DIRS_IGNORE
LICENSE_FLAGS_WHITELIST -> LICENSE_FLAGS_ACCEPTED
UNKNOWN_CONFIGURE_WHITELIST -> UNKNOWN_CONFIGURE_OPT_IGNORE
SDK_LOCAL_CONF_BLACKLIST -> ESDK_LOCALCONF_REMOVE
SDK_LOCAL_CONF_WHITELIST -> ESDK_LOCALCONF_ALLOW
SDK_INHERIT_BLACKLIST -> ESDK_CLASS_INHERIT_DISABLE
TUNEABI_WHITELIST - already removed as obsolete

For the ICECC_USER_XXX and ICECC_SYSTEM_XXX, we think these can likely
be merged into single variables:

ICECC_USER_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_SYSTEM_CLASS_BL -> ICECC_CLASS_DISABLE
ICECC_USER_PACKAGE_WL -> ICECC_RECIPE_ENABLE
ICECC_USER_PACKAGE_BL -> ICECC_RECIPE_DISABLE
ICECC_SYSTEM_PACKAGE_BL -> ICECC_RECIPE_DISABLE

For license handling, we’d use the opportunity to clean up the
WHITELIST_(ANY LICENSE) syntax and replace it with a
INCOMPATIBLE_LICENSE_ALLOWED_RECIPES, which would be a list of recipes
which are of a blocked the INCOMPATIBLE_LICENSE list.

Everything else
The migration plan includes writing a script to assist with the
migration. In many cases it can likely make the translation. In cases
where that isn’t possible, it will aim to list the areas the user
needs to fix references.

A warning mechanism will be added to bitbake to detect usage of old
variable names (post parsing), except for BB_ENV issues which will
likely need special handling. A (limited) conversion script will be
created to help with the migration. For those instances where a 1-1
mapping is not achievable, a list of the occurrences and what it
should be changed to will occur.


Patch files in OE to be renamed:
11_tcpd_blacklist.patch -> 11_tcpd_blocklist.patch
mount.blacklist -> mount.disallow
0001-lxdm.conf.in-blacklist-root-for-release-images.patch ->
0001-lxdm.conf.in-deny-root-for-release-images.patch
022-RH-Remove-the-property-blacklist-exception-builtin.patch ->
022-RH-Remove-the-default-property-exception-builtin.patch
0001-Cargo.toml-do-not-abort-on-panic.patch ->
0001-Cargo.toml-do-not-exit-on-panic.patch
0004-Cargo.toml-do-not-abort-on-panic.patch ->
0004-Cargo.toml-do-not-exit-on-panic.patch
Also, there are a few others outside of OE that should probably be patched too.

Branch Names
The “master” branches on the relevant OpenEmbedded and Yocto Project
git trees will be changed to an alternative name at some point in the
future. The current preferred name is “devel”. There is no time
table for this currently, and there is no obligation or requirement to
change the branch name for any downstream project which is beyond the
project’s remit.

Similarly, there is no need to change any recipes that are using a
“master” branch as part of the SRC_URI. Those are outside the scope
of YP/OE and this effort.

Note
These changes are only to bitbake and OE-Core. There is no
requirement to change any other layers but we’d note consistency is
encouraged and helpful to users.

Helping
If you would like to help, please put your name by the items in
question on the inclusive language wiki page.
https://wiki.yoctoproject.org/wiki/Inclusive_language

Thanks
Special thanks to Richard Purdie, Michael Opdenacker. Marta
Rybczynska, Scott Murray, Jan-Simon Moeller, Saul Wold, and Armin
Kuster for providing their time, technical details, text, and feedback
on this task.

From: Stefan Schmidt <stefan.schmidt@...>

Instead of looking in PATH on the host to find bossac we now depend on the
native variant we build and set the path to our yocto build tool.

Signed-off-by: Stefan Schmidt <stefan.schmidt@...>
Signed-off-by: Andrei Gherzan <andrei.gherzan@...>
---
meta-zephyr-core/classes/zephyr-flash-bossac.bbclass | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/meta-zephyr-core/classes/zephyr-flash-bossac.bbclass b/meta-zephyr-core/classes/zephyr-flash-bossac.bbclass
index 50222d5..51f2dd3 100644
--- a/meta-zephyr-core/classes/zephyr-flash-bossac.bbclass
+++ b/meta-zephyr-core/classes/zephyr-flash-bossac.bbclass
@@ -1,17 +1,17 @@
#@DESCRIPTION: class file to flash boards like Arduino Nano BLE which depends on bossac for flashing

+DEPENDS += "bossa-native"
+
python do_flash_usb() {
import shutil
import subprocess
import serial.tools.list_ports

- # Note: make sure the installed bossac is set to PATH before running flash_usb()
# Check if bossac is avaiable for flashing
- origbbenv = d.getVar("BB_ORIGENV", False)
- bossac_path = shutil.which("bossac", path=origbbenv.getVar('PATH'))
+ bossac_path = shutil.which("bossac")

if not bossac_path:
- bb.fatal("ERROR: bossac not found, please install first and add to PATH")
+ bb.fatal("ERROR: bossac not found.")

board = d.getVar('BOARD')

@@ -47,4 +47,3 @@ python do_flash_usb() {
addtask do_flash_usb after do_deploy

do_flash_usb[nostamp] = "1"
-do_flash_usb[vardepsexclude] = "BB_ORIGENV"
--
2.25.1

From: Stefan Schmidt <stefan.schmidt@...>

This native recipe will be used to streamline the flashing of out
Arduino Nano 33 BLE target. Until now we have pointed to the full
Arduino IDE to get it installed and setting the PATH correctly before
any flashing would work. Having the tool supplied under the hood for
flashing will simplify documentation and support.

Signed-off-by: Stefan Schmidt <stefan.schmidt@...>
Signed-off-by: Andrei Gherzan <andrei.gherzan@...>
---
.../bossa/bossa-native_git.bb | 23 +++++++++++++++++++
1 file changed, 23 insertions(+)
create mode 100644 meta-zephyr-core/recipes-devtools/bossa/bossa-native_git.bb

diff --git a/meta-zephyr-core/recipes-devtools/bossa/bossa-native_git.bb b/meta-zephyr-core/recipes-devtools/bossa/bossa-native_git.bb
new file mode 100644
index 0000000..b645ecf
--- /dev/null
+++ b/meta-zephyr-core/recipes-devtools/bossa/bossa-native_git.bb
@@ -0,0 +1,23 @@
+SUMMARY = "Arduino variant of the BOSSA flashing tool"
+HOMEPAGE = "https://github.com/arduino/BOSSA"
+SECTION = "devel"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=bcf9399f7b9b96149837290bcdc3ad39"
+
+SRC_URI = "git://github.com/arduino/BOSSA.git;protocol=https;branch=nrf"
+
+PV = "1.9.1+git${SRCPV}"
+SRCREV = "89f3556a761833522cd93c199581265ad689310b"
+
+S = "${WORKDIR}/git"
+
+inherit native
+
+do_compile() {
+ # We only compile the bossac commandline tool, not the graphical version.
+ oe_runmake bossac
+}
+
+do_install() {
+ install -D -m 0755 ${B}/bin/bossac ${D}${bindir}/bossac
+}
--
2.25.1