From 53f762b7503306a10a5171d1cd6043aa25d47290 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Wed, 29 Jul 2026 19:26:26 +0000 Subject: [PATCH] netdata: upgrade 1.47.5 -> 2.10.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Major version jump (1.x → 2.x series). Key upstream changes: * 2.x dropped the legacy Netdata Cloud Agent-Cloud-Link (ACLK) and merged cloud-connectivity into the main binary; ENABLE_ACLK and ENABLE_CLOUD cmake options removed. OpenSSL and libcurl are now mandatory build dependencies (no longer optional via PACKAGECONFIG). * Improved database engine, new collectors (systemd-units, OTel, scripts plugin), and expanded Go plugin with SNMP overhaul. * 2.10.x stabilization: fix ZFS-related crashes, eBPF shared-memory pool leak, SNMP counter wrapping, database engine memory safety. * 2.10.4: larger patch for stability, memory safety, and crash resilience across database engine, streaming, and collectors; backports new macOS hardware sensor collectors. Recipe changes: * Add curl and openssl to mandatory DEPENDS (both now REQUIRED by cmake); remove PACKAGECONFIG[openssl] and PACKAGECONFIG[cloud]. * Remove webui_v0/v1/v2 PACKAGECONFIG entries and associated do_install block (the webui architecture changed in 2.x). * Remove -DENABLE_ACLK=OFF from EXTRA_OECMAKE (option no longer exists); keep -DENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE=OFF. * Refresh 0002-Do-not-hardcode-systemd-unit-directories.patch for 2.10.4 (the BUILD_FOR_PACKAGING/systemd service install blocks shifted ~1119 lines; same substitution preserved). * 2.x vendors its own libsensors copy which needs flex/bison to generate its config lexer/parser at build time; add flex-native and bison-native to DEPENDS. * Protobuf detection now runs unconditionally (used by several 2.x exporters/collectors even with the remote-write exporter disabled); add protobuf and protobuf-native to DEPENDS and point cmake at the native protoc via Protobuf_PROTOC_EXECUTABLE. * Disable several 2.x features that reach out to the network at configure time and cannot work in an offline build: - ENABLE_PLUGIN_OTEL / ENABLE_PLUGIN_OTEL_SIGNAL_VIEWER (pull in Rust/Corrosion via CMake FetchContent) - ENABLE_PLUGIN_SCRIPTS (requires Go, same as ENABLE_PLUGIN_GO) - ENABLE_ML (FetchContent-downloads dlib) - ENABLE_LIBBACKTRACE (ExternalProject-downloads libbacktrace) - ENABLE_DASHBOARD, now exposed as PACKAGECONFIG[dashboard] and off by default (the local agent dashboard isn't shipped in the release tarball; enabling it makes cmake fetch it from app.netdata.cloud at configure time) * BUILD_FOR_PACKAGING=ON now also installs sysusers.d/tmpfiles.d snippets under ${nonarch_libdir}; remove them in do_install since user creation is handled by useradd.bbclass and tmpfiles by our own netdata-volatiles.conf, avoiding an "installed but not shipped" QA failure from duplicate/unmanaged files. * Fix three new-in-2.x reproducibility leaks that embed host build paths into the packages (buildpaths QA, an error in oe-core's default ERROR_QA): - Add 0003-Do-not-record-the-configure-command-line-in-the-binar.patch: 2.x bakes the full cmake invocation into config.h for "netdata -W buildinfo"; the collected flags include --sysroot= and -ffile-prefix-map= and so leak ${WORKDIR} into the binary. - Add 0004-libsensors-do-not-emit-line-directives-in-generated-s.patch: pass bison -l / flex -L so the generated conf-parse.[ch] and conf-lex.c do not carry absolute #line paths (these live in file contents, so -ffile-prefix-map cannot rewrite them). - Remove the shipped build-info-cmake-cache.gz in do_install: it is a gzipped CMakeCache.txt kept only for buildinfo reporting and is full of host paths. Verified with buildpaths promoted back to ERROR_QA: netdata builds and packages with no buildpaths diagnostics and no /home path remains anywhere under the package tree. Signed-off-by: Khem Raj --- ...ot-hardcode-systemd-unit-directories.patch | 20 +++--- ...-configure-command-line-in-the-binar.patch | 31 +++++++++ ...-emit-line-directives-in-generated-s.patch | 40 +++++++++++ .../{netdata_1.47.5.bb => netdata_2.10.4.bb} | 69 +++++++++++-------- 4 files changed, 123 insertions(+), 37 deletions(-) create mode 100644 meta-webserver/recipes-webadmin/netdata/netdata/0003-Do-not-record-the-configure-command-line-in-the-binar.patch create mode 100644 meta-webserver/recipes-webadmin/netdata/netdata/0004-libsensors-do-not-emit-line-directives-in-generated-s.patch rename meta-webserver/recipes-webadmin/netdata/{netdata_1.47.5.bb => netdata_2.10.4.bb} (68%) diff --git a/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch b/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch index 143caf89cb..15668c121b 100644 --- a/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch +++ b/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch @@ -3,26 +3,28 @@ From: Enguerrand de Ribaucourt Date: Tue, 1 Oct 2024 17:01:33 +0200 Subject: [PATCH] Do not hardcode systemd unit directories +Refreshed for netdata v2.10.4 (context shifted; same intent preserved). + Upstream-Status: Inappropriate [oe-core specific] Signed-off-by: Enguerrand de Ribaucourt --- CMakeLists.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -Index: netdata-v1.47.3/CMakeLists.txt -=================================================================== ---- netdata-v1.47.3.orig/CMakeLists.txt -+++ netdata-v1.47.3/CMakeLists.txt -@@ -2531,7 +2531,7 @@ if(BUILD_FOR_PACKAGING) +diff --git a/CMakeLists.txt b/CMakeLists.txt +index d6dafd9..530298e 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -3642,7 +3642,7 @@ if(BUILD_FOR_PACKAGING) install(FILES ${CMAKE_BINARY_DIR}/system/systemd/netdata.service COMPONENT netdata - DESTINATION lib/systemd/system) + DESTINATION $ENV{systemd_system_unitdir}) - install(DIRECTORY - COMPONENT netdata - DESTINATION usr/lib/systemd/journald@netdata.conf.d) -@@ -2620,11 +2620,11 @@ if(NOT OS_WINDOWS) + install(FILES + ${CMAKE_BINARY_DIR}/system/systemd/sysusers/netdata.conf + COMPONENT user +@@ -3739,11 +3739,11 @@ if(NOT OS_WINDOWS) install(FILES ${CMAKE_BINARY_DIR}/system/systemd/netdata-updater.service COMPONENT netdata diff --git a/meta-webserver/recipes-webadmin/netdata/netdata/0003-Do-not-record-the-configure-command-line-in-the-binar.patch b/meta-webserver/recipes-webadmin/netdata/netdata/0003-Do-not-record-the-configure-command-line-in-the-binar.patch new file mode 100644 index 0000000000..4d0b81a0f3 --- /dev/null +++ b/meta-webserver/recipes-webadmin/netdata/netdata/0003-Do-not-record-the-configure-command-line-in-the-binar.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Wed, 29 Jul 2026 20:00:00 +0000 +Subject: [PATCH] Do not record the configure command line in the binary + +The CONFIGURE_COMMAND string is baked into config.h and reported by +"netdata -W buildinfo". In a cross build the collected flags contain +--sysroot=, -ffile-prefix-map= and similar arguments that carry absolute +host build paths, so the resulting binary embeds the build directory. +That makes the build unreproducible and trips OE's buildpaths QA check. + +The string is purely informational, so report it as unavailable rather +than leaking the build environment into the shipped binary. + +Upstream-Status: Inappropriate [embedded specific] +Signed-off-by: Khem Raj +--- + CMakeLists.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -3397,7 +3397,7 @@ + "-DCMAKE_SHARED_LINKER_FLAGS='${CMAKE_SHARED_LINKER_FLAGS}'" + ) + +-string(JOIN " " CONFIGURE_COMMAND "cmake" ${CONFIGURE_OPTIONS}) ++set(CONFIGURE_COMMAND "unavailable (stripped for reproducible builds)") + + if (NOT NETDATA_USER) + set(NETDATA_USER "netdata") diff --git a/meta-webserver/recipes-webadmin/netdata/netdata/0004-libsensors-do-not-emit-line-directives-in-generated-s.patch b/meta-webserver/recipes-webadmin/netdata/netdata/0004-libsensors-do-not-emit-line-directives-in-generated-s.patch new file mode 100644 index 0000000000..9d3cee4c37 --- /dev/null +++ b/meta-webserver/recipes-webadmin/netdata/netdata/0004-libsensors-do-not-emit-line-directives-in-generated-s.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Wed, 29 Jul 2026 20:10:00 +0000 +Subject: [PATCH] libsensors: do not emit #line directives in generated sources + +bison and flex embed the absolute path of both the input grammar and the +generated output into #line directives. Those paths live in the file +contents rather than in debug info, so -ffile-prefix-map cannot rewrite +them, and the generated conf-parse.[ch]/conf-lex.c shipped in the debug +source package end up referencing the host build directory. That makes +the build unreproducible and trips OE's buildpaths QA check. + +Pass -l (bison) and -L (flex) to suppress the #line directives. The only +effect is that compiler diagnostics for the generated parser point at the +generated file instead of the grammar, which is an acceptable trade for a +vendored parser that is not being developed here. + +Upstream-Status: Inappropriate [embedded specific] +Signed-off-by: Khem Raj +--- + src/collectors/debugfs.plugin/libsensors/CMakeLists.txt | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/src/collectors/debugfs.plugin/libsensors/CMakeLists.txt ++++ b/src/collectors/debugfs.plugin/libsensors/CMakeLists.txt +@@ -16,12 +16,12 @@ + + # Generate Bison parser + bison_target(LibsensorsParser vendored/lib/conf-parse.y ${CMAKE_CURRENT_BINARY_DIR}/conf-parse.c +- COMPILE_FLAGS "-p sensors_yy --defines=${CMAKE_CURRENT_BINARY_DIR}/conf-parse.h" ++ COMPILE_FLAGS "-p sensors_yy -l --defines=${CMAKE_CURRENT_BINARY_DIR}/conf-parse.h" + ) + + # Generate Flex scanner + flex_target(LibsensorsLexer vendored/lib/conf-lex.l ${CMAKE_CURRENT_BINARY_DIR}/conf-lex.c +- COMPILE_FLAGS "-Psensors_yy -Cfe -8" ++ COMPILE_FLAGS "-Psensors_yy -Cfe -8 -L" + ) + + # Add dependency to ensure correct build order diff --git a/meta-webserver/recipes-webadmin/netdata/netdata_1.47.5.bb b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb similarity index 68% rename from meta-webserver/recipes-webadmin/netdata/netdata_1.47.5.bb rename to meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb index f18c979685..709538b1d4 100644 --- a/meta-webserver/recipes-webadmin/netdata/netdata_1.47.5.bb +++ b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb @@ -6,10 +6,16 @@ LICENSE = "GPL-3.0-only" LIC_FILES_CHKSUM = "file://LICENSE;md5=fc9b848046ef54b5eaee6071947abd24" DEPENDS += "\ + bison-native \ + curl \ + flex-native \ json-c \ libuv \ libyaml \ lz4 \ + openssl \ + protobuf \ + protobuf-native \ util-linux \ zlib \ " @@ -17,11 +23,13 @@ DEPENDS += "\ SRC_URI = "\ https://github.com/${BPN}/${BPN}/releases/download/v${PV}/${BPN}-v${PV}.tar.gz \ file://0002-Do-not-hardcode-systemd-unit-directories.patch \ + file://0003-Do-not-record-the-configure-command-line-in-the-binar.patch \ + file://0004-libsensors-do-not-emit-line-directives-in-generated-s.patch \ file://netdata.conf \ file://netdata-volatiles.conf \ ${@bb.utils.contains('PACKAGECONFIG', 'go', 'file://go.d.conf', '', d)} \ " -SRC_URI[sha256sum] = "8073eee2392f92daa1f8bb5cf13fb988b8c3b52ff9574b50706ff69bdbdb51ce" +SRC_URI[sha256sum] = "d1ae949863925d626b1d42a53000bcca2c239718e0b0ddc6a3f3f5029b21cdfe" UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags" UPSTREAM_CHECK_REGEX = "${BPN}/releases/tag/v(?P(?!1\.99)\d+(?:\.\d+)*)" @@ -63,10 +71,8 @@ USERADD_PACKAGES = "${PN}" USERADD_PARAM:${PN} = "--system --no-create-home --home-dir ${localstatedir}/run/netdata \ ${@bb.utils.contains('PACKAGECONFIG','docker','--groups docker','',d)} --user-group netdata" -PACKAGECONFIG ??= "openssl freeipmi ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}" +PACKAGECONFIG ??= "freeipmi ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}" PACKAGECONFIG[brotli] = ",,brotli" -PACKAGECONFIG[cloud] = "-DENABLE_CLOUD=ON,-DENABLE_CLOUD=OFF," -PACKAGECONFIG[openssl] = "-DENABLE_OPENSSL=ON,-DENABLE_OPENSSL=OFF,openssl" PACKAGECONFIG[freeipmi] = "-DENABLE_PLUGIN_FREEIPMI=ON,-DENABLE_PLUGIN_FREEIPMI=OFF,freeipmi" PACKAGECONFIG[nfacct] = "-DENABLE_PLUGIN_NFACCT=ON,-DENABLE_PLUGIN_NFACCT=OFF,libmnl" # needs meta-virtualization @@ -75,14 +81,28 @@ PACKAGECONFIG[cups] = "-DENABLE_PLUGIN_CUPS=ON,-DENABLE_PLUGIN_CUPS=OFF,cups" PACKAGECONFIG[systemd] = "-DENABLE_PLUGIN_SYSTEMD_JOURNAL=ON,-DENABLE_PLUGIN_SYSTEMD_JOURNAL=OFF,systemd" PACKAGECONFIG[docker] = ",,virtual/docker, virtual/docker" PACKAGECONFIG[go] = "-DENABLE_PLUGIN_GO=ON, -DENABLE_PLUGIN_GO=OFF" -# WebUI (packageconfig not set: v0, v1 & v2) -PACKAGECONFIG[webui_v0] = ",,,,,webui_v1 webui_v2" -PACKAGECONFIG[webui_v1] = ",,,,,webui_v0 webui_v2" -PACKAGECONFIG[webui_v2] = ",,,,,webui_v0 webui_v1" +# The local agent dashboard is not shipped in the release tarball; enabling it +# makes CMake download https://app.netdata.cloud/agent.tar.gz at configure +# time, which cannot work in an offline build. Off by default. +PACKAGECONFIG[dashboard] = "-DENABLE_DASHBOARD=ON,-DENABLE_DASHBOARD=OFF" -# ebpf doesn't compile (or detect) the cross compilation well -EXTRA_OECMAKE += "-DENABLE_PLUGIN_EBPF=OFF -DBUILD_FOR_PACKAGING=${@bb.utils.contains('DISTRO_FEATURES','systemd','ON','OFF',d)} \ - -DENABLE_ACLK=OFF -DENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE=OFF -DCMAKE_INSTALL_PREFIX='${base_prefix}'" +# ebpf doesn't compile (or detect) the cross compilation well. +# Several 2.x features fetch sources at configure time, which cannot work in +# an offline build, so they are disabled here: +# - ENABLE_PLUGIN_OTEL / ENABLE_PLUGIN_OTEL_SIGNAL_VIEWER pull Rust/Corrosion +# via CMake FetchContent. +# - ENABLE_PLUGIN_SCRIPTS requires Go (as does ENABLE_PLUGIN_GO). +# - ENABLE_ML FetchContent-downloads dlib. +# - ENABLE_LIBBACKTRACE ExternalProject-downloads libbacktrace. +# Protobuf is detected unconditionally and needs the native protoc. +EXTRA_OECMAKE += "-DENABLE_PLUGIN_EBPF=OFF \ + -DENABLE_PLUGIN_OTEL=OFF -DENABLE_PLUGIN_OTEL_SIGNAL_VIEWER=OFF \ + -DENABLE_PLUGIN_SCRIPTS=OFF \ + -DENABLE_ML=OFF \ + -DENABLE_LIBBACKTRACE=OFF \ + -DProtobuf_PROTOC_EXECUTABLE=${STAGING_BINDIR_NATIVE}/protoc \ + -DBUILD_FOR_PACKAGING=${@bb.utils.contains('DISTRO_FEATURES','systemd','ON','OFF',d)} \ + -DENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE=OFF -DCMAKE_INSTALL_PREFIX='${base_prefix}'" do_compile:append() { # Go dependencies are protected with read-only permissions, but would prevent cleaning @@ -127,23 +147,16 @@ do_install:append() { install --group netdata --owner netdata --directory ${D}${localstatedir}/cache/netdata install --group netdata --owner netdata --directory ${D}${localstatedir}/lib/netdata - # webUI - if "${@bb.utils.contains('PACKAGECONFIG', 'webui_v0', 'true', 'false', d)}"; then - rm -rf ${D}${datadir}/netdata/web/v1 - rm -rf ${D}${datadir}/netdata/web/v2 - install -m 0644 ${D}${datadir}/netdata/web/v0/index.html ${D}${datadir}/netdata/web/ - fi - if "${@bb.utils.contains('PACKAGECONFIG', 'webui_v1', 'true', 'false', d)}"; then - rm -rf ${D}${datadir}/netdata/web/v0 - rm -rf ${D}${datadir}/netdata/web/v2 - install -m 0644 ${D}${datadir}/netdata/web/v1/index.html ${D}${datadir}/netdata/web/ - fi - if "${@bb.utils.contains('PACKAGECONFIG', 'webui_v2', 'true', 'false', d)}"; then - rm -rf ${D}${datadir}/netdata/web/v0 - rm -rf ${D}${datadir}/netdata/web/v1 - install -m 0644 ${D}${datadir}/netdata/web/v2/index.html ${D}${datadir}/netdata/web/ - fi - chown -R netdata:netdata ${D}${datadir}/netdata/web + # BUILD_FOR_PACKAGING installs its own sysusers.d/tmpfiles.d snippets, but + # user creation is handled by useradd.bbclass and tmpfiles by our own + # netdata-volatiles.conf above, so drop the upstream ones to avoid + # shipping duplicate/unmanaged files. + rm -rf ${D}${nonarch_libdir}/sysusers.d ${D}${nonarch_libdir}/tmpfiles.d + + # 2.x ships a gzipped copy of CMakeCache.txt purely so that + # "netdata -W buildinfo" can report it; it is full of host build paths. + # It carries no runtime value in a cross build, so drop it. + rm -f ${D}${datadir}/netdata/build-info-cmake-cache.gz } FILES:${PN} += "\