The dependency might not be obvious to everyone, so leave a hint as in
commit 2fbeebc18c ("dm-verity: document the meta-intel dependency in the
systemd example").
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
This removes unused variable that was dropped by commit d80cd2ba6a
("dm-verity: Set the IMAGE_FSTYPES correctly when dm-verity is
enabled").
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Several meta-tpm recipes were missing HOMEPAGE and/or SUMMARY entries,
tripping the missing-metadata recipe QA check that is enabled for
core-layer recipes. The warnings surface whenever do_recipe_qa actually
runs (a fresh build with no sstate hit), e.g.:
WARNING: tpm2-tss-4.1.3-r0 do_recipe_qa: QA Issue: Recipe tpm2-tss in
.../tpm2-tss_4.1.3.bb does not contain a HOMEPAGE. Please add an entry.
[missing-metadata]
Add the upstream project URL as HOMEPAGE, and a SUMMARY where absent:
- tpm2-tss: add HOMEPAGE
- tpm2-tools: add HOMEPAGE
- tpm2-openssl: add HOMEPAGE
- tpm2-abrmd: add HOMEPAGE
- tpm2-pkcs11: add HOMEPAGE
- tpm2-tss-engine: add HOMEPAGE
- python3-tpm2-pytss: add SUMMARY
- packagegroup-security-tpm2: add SUMMARY
Signed-off-by: Shreejit C <shreejit.c@emerson.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Fix two issues preventing samhain-server (yule) from starting:
1. The compiled-in PID file path /var/run/samhain.pid fails because
/var/run is a symlink to /run on systemd-based systems, and
samhain's security check rejects symlinks for PID directories.
Add SetLockfilePath = /run/yule.pid to yulerc.template, following
the same approach used in 0004-Set-the-PID-Lock-path-for-samhain.pid
for the standalone/client configuration.
2. The init scripts unconditionally source /etc/default/rcS which does
not exist on systemd-based systems, producing a confusing error
message. Source it conditionally instead.
Signed-off-by: Bin Cao <bin.cao.cn@windriver.com>
(adapted against prior 4.5.3 upgrade)
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Handle upstream removal of oe_cargo_build function in oe-core commit
a64ac03a61 by renaming our local override to cargo_do_compile to get
the same effect.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Backport unreleased change from upstream to handle building with nettle
4.x now that openembedded-core has upgraded to it.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
- Fix conditional checks for AIDE_SCAN_POSTINIT and AIDE_RESCAN_POSTINIT:
'[ 0 ]' always evaluates to true since it's a non-empty string.
Use string comparison '= "1"' instead.
- Fix invalid use of '&&' inside '[ ]' test brackets. Use separate
test expressions joined by shell '&&'.
Signed-off-by: Haitao Liu <haitao.liu@windriver.com>
(reworked for 0.19.3, fixed indentation)
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Previous commit made this a hard dependency because it's autodetected.
Instead of that, make it configurable so it can be disabled (roughtly
equivalent to behavior before that commit).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
meta-arm recently changed the group name that is used by TS[1], so update
the group name to match.
[1] meta-arm 595cb0f1a0 ("arm/trusted-services: fix udev management in libts")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Instead of calling groupmems after creating the user, we can tell useradd
to do the group membership when creating the user. There are several
reasons for this:
1) Consolidation of the calls into a single call means creation is atomic,
it either worked or it did not.
2) The existing logic doesn't work if both TPM and TS were enabled.
3) GROUPMEMS_PARAM is broken in oe-core master[1] and this will not be
fixed as groupmems has been removed from shadow[2].
Instead, construct a list of groups that parsec needs to be a member of,
and pass them to useradd.
[1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16277
[2] shadow 388ce70 "*/: groupmems(8): Remove program"
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
By :appending the TPM option we make it impossible for distros to simply
assign to PACKAGECONFIG.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Changes from 1.09 to 1.10:
- Shorten syslog name to work with rsyslog (#172)
- Update config file with grace period in all cases (#193)
- Remove printing QR code using Google Charts URL (service shut down)
Changes from 1.10 to 1.11:
- Change secret key bits from 128 to 160 bits (#266, #271)
- Add support for black & white terminals (#268, #270)
- Fix grace_period for IPv6 link-local addresses (#265)
Also fix the .bb recipe:
- Fix typo: RDEPNEDS -> RDEPENDS
- Use new override syntax: RDEPENDS:pam-google-authenticator
(replaces old underscore style RDEPENDS_pam-google-authenticator)
Signed-off-by: Haitao Liu <haitao.liu@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Fix the typo "tmp-layer" in "WARN_QA:append".
The right name for this layer in OVERRIDES is layer-tpm-layer
by checking "bitbake -e <recipe_name> | grep ^OVERRIDES=".
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Because "x86_64" and "arm64" aren't valid in bitbake OVERRIDES,
they should be corrected to "x86-64" and "aarch64".
On the other side, "x86_64" and "arch64" aren't valid MACHINE
name.
So correct the way to "only allow x86-64 and arm64 to build":
COMPATIBLE_MACHINE = "(-)" => disallow all machine first
COMPATIBLE_MACHINE:aarch64 = "(.*)" => when arch "aarch64" in
OVERRIDES, allow all machines.
COMPATIBLE_MACHINE:x86-64 = "(.*)" => when arch "x84-64" in
OVERRIDES, allow all machines.
Fix 1dd076d3a7 ("firejail: only allow x86-64 and arm64 to build")
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
To work around an install conflict between python3-cryptography and
python3-pyrad and unblock CI runs, remove python3-privacyidea from
the packagegroup dynamic bbappend temporarily.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Add aircrack-ng, crowdsec, ncrack, and opendnssec where appropriate
now that they have been updated to build again.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Bump to HEAD of ncrack's master branch to pick up build fixes for
newer gcc's. PV has been updated to indicate that we are now
building something newer than the 0.7 tagged commit.
License-Update: copyright years refreshed
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Remove libmspack recipe, and remove it from clamav's DEPENDS.
clamav now vendors its own substantially modified copy, so there's
no reason to carry a recipe for it.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Upgrade to the latest release, 1.7, and rework recipe so that it
actually builds again. Note that the extra scripts are no longer
installed by default as they seem somewhat stale and likely further
work is required to have any of them work. A PACKAGECONFIG option,
"ext-scripts" has been added to enable installing them if they are
required for some reason.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
The crowdsec recipes has seemingly been broken since soon after its
addition, rewrite it to build the latest version with the go-mod
bbclass.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Use patch submitted upstream to fix build error:
| src/lib/tpm.c: In function ‘tpm_unseal’:
| src/lib/tpm.c:1040:16: error: incompatible types when returning type ‘_Bool’ but ‘twist’ {aka ‘const char *’} was expected
| 1040 | return false;
| | ^~~~~
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Update LAYERSERIES_COMPAT in all layer.conf files with the exception
of meta-parsec to wrynose. For meta-parsec, added wrynose to the list
of supported versions.
Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
Change the "poky" layer configuration name to "meta-yocto" in the
KAS configuration so the cloned repo name is less confusing in logs,
and fix a spot where "poky" -> "openembedded-core" had been missed
in the gitlab configuration.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Commit cd729862f6 added native/nativesdk
possibility to tpm2-pkcs11.
After 784ca4b658 which added rdepends on
python3-tpm2-pytss, there are errors like:
Missing or unbuildable dependency chain was:
['<image>', 'swtpm-native', 'tpm2-pkcs11-tools-native', 'python3-tpm2-pytss-native']
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Allow downstream users to explicitly select desired PACKAGECONFIG
options (e.g. via "=").
Users are currently forced to use ":remove" (with "ptest").
Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
This is necessary for cryptsetup starting from v2.8.0 which introduced
"[units]" in its output breaking the parsing of veritysetup output.
VERITY header information for image-poky-20250701085433.squashfs-zst.verity.
UUID: 5dc16c55-79b8-4988-9d79-900f8e143f98
Hash type: 1
Data blocks: 40091
Data block size: 4096 [bytes]
Hash blocks: 318
Hash block size: 4096 [bytes]
Hash algorithm: sha256
Salt: f670bf67a32f4f5a22e052d7bf84830f8d35ea24e2d52f585f6275207899153b
Root hash: a7eab55b7933e347650671611e4b2a10571f2a28a1fb0fc8eae409f7a0d86693
This extends the value filter to remove the "[units]" from the .env file,
while retaining compatibility to older cryptsetup releases.
Signed-off-by: Stephan Wurm <stephan.wurm@a-eberle.de>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Gaël PORTAY
Shreejit C
Sandeep J
Bin Cao
Scott Murray
Peter Marko
jason.lau
Li Zhou
Yi Zhao
Ross Burton
Anton Antonov
Marta Rybczynska
Clayton Casciato
Wenlin Kang
Haiqing Bai
Zhang Peng
Khem Raj
Marta Rybczynska
Peter Kjellerstedt
Stephan Wurm