feat: wrynose integration

classes/aziot.bbclass

@@ -1,4 +1,4 @@
-inherit useradd
+inherit useradd pkgconfig
 
 USERADD_PACKAGES = "${PN}"
 GROUPADD_PARAM:${PN} = " \

classes/disable_volatile_log_dir.bbclass

@@ -1,5 +1,4 @@
-# We want to have a nonvolatile log dir, if DISTRO_FEATURE "persistent-var-log"
-# is set, but we cannot access 'DISTRO_FEATURES' directly at conf file load
-# time.
-# We delay by using this special bbclass and the _append operator.
-VOLATILE_LOG_DIR = "no"
+# We want a nonvolatile /var/log when DISTRO_FEATURE "persistent-var-log" is
+# set, but DISTRO_FEATURES can't be read at conf-parse time; so this class is
+# inherited conditionally via USER_CLASSES instead.
+FILESYSTEM_PERMS_TABLES:remove = "files/fs-perms-volatile-log.txt"

classes/omnect_rust_aziot-identityd_deps.bbclass

@@ -2,32 +2,32 @@
 do_compile:prepend() {
     # instead of sed, i wanted to use toml-cli, but it can not escape the values correctly
     sed -i \
-        -e 's#"${WORKDIR}/aziot-cert-client-async"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-cert-common"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-common"#' \
-        -e 's#"${WORKDIR}/aziot-cert-common-http"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-certd-config"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-certd-config"#' \
-        -e 's#"${WORKDIR}/aziot-identity-client-async"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-identity-common"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-common"#' \
-        -e 's#"${WORKDIR}/aziot-identity-common-http"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-identityd-config"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identityd-config"#' \
-        -e 's#"${WORKDIR}/aziot-key-client"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-client"#' \
-        -e 's#"${WORKDIR}/aziot-key-client-async"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-key-common"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-common"#' \
-        -e 's#"${WORKDIR}/aziot-key-common-http"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-key-openssl-engine"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-openssl-engine"#' \
-        -e 's#"${WORKDIR}/aziot-keyd-config"#"${WORKDIR}/aziot-cert-client-async/key/aziot-keyd-config"#' \
-        -e 's#"${WORKDIR}/aziot-keys-common"#"${WORKDIR}/aziot-cert-client-async/key/aziot-keys-common"#' \
-        -e 's#"${WORKDIR}/aziot-tpmd-config"#"${WORKDIR}/aziot-cert-client-async/tpm/aziot-tpmd-config"#' \
-        -e 's#"${WORKDIR}/aziotctl-common"#"${WORKDIR}/aziot-cert-client-async/aziotctl/aziotctl-common"#' \
-        -e 's#"${WORKDIR}/cert-renewal"#"${WORKDIR}/aziot-cert-client-async/cert/cert-renewal"#' \
-        -e 's#"${WORKDIR}/config-common"#"${WORKDIR}/aziot-cert-client-async/config-common"#' \
-        -e 's#"${WORKDIR}/http-common"#"${WORKDIR}/aziot-cert-client-async/http-common"#' \
-        -e 's#"${WORKDIR}/logger"#"${WORKDIR}/aziot-cert-client-async/logger"#' \
-        -e 's#"${WORKDIR}/openssl-build"#"${WORKDIR}/aziot-cert-client-async/openssl-build"#' \
-        -e 's#"${WORKDIR}/openssl-sys2"#"${WORKDIR}/aziot-cert-client-async/openssl-sys2"#' \
-        -e 's#"${WORKDIR}/openssl2"#"${WORKDIR}/aziot-cert-client-async/openssl2"#' \
-        -e 's#"${WORKDIR}/pkcs11-sys"#"${WORKDIR}/aziot-cert-client-async/pkcs11/pkcs11-sys"#' \
-        -e 's#"${WORKDIR}/pkcs11"#"${WORKDIR}/aziot-cert-client-async/pkcs11/pkcs11"#' \
-        -e 's#"${WORKDIR}/test-common"#"${WORKDIR}/aziot-cert-client-async/test-common"#' \
-        ${WORKDIR}/cargo_home/config
+        -e 's#"${UNPACKDIR}/aziot-cert-client-async"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-cert-common"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-cert-common-http"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-certd-config"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-certd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-client-async"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-common"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-common-http"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-identityd-config"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identityd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-client"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-client"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-client-async"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-common"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-common-http"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-openssl-engine"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-openssl-engine"#' \
+        -e 's#"${UNPACKDIR}/aziot-keyd-config"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-keyd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-keys-common"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-keys-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-tpmd-config"#"${UNPACKDIR}/aziot-cert-client-async/tpm/aziot-tpmd-config"#' \
+        -e 's#"${UNPACKDIR}/aziotctl-common"#"${UNPACKDIR}/aziot-cert-client-async/aziotctl/aziotctl-common"#' \
+        -e 's#"${UNPACKDIR}/cert-renewal"#"${UNPACKDIR}/aziot-cert-client-async/cert/cert-renewal"#' \
+        -e 's#"${UNPACKDIR}/config-common"#"${UNPACKDIR}/aziot-cert-client-async/config-common"#' \
+        -e 's#"${UNPACKDIR}/http-common"#"${UNPACKDIR}/aziot-cert-client-async/http-common"#' \
+        -e 's#"${UNPACKDIR}/logger"#"${UNPACKDIR}/aziot-cert-client-async/logger"#' \
+        -e 's#"${UNPACKDIR}/openssl-build"#"${UNPACKDIR}/aziot-cert-client-async/openssl-build"#' \
+        -e 's#"${UNPACKDIR}/openssl-sys2"#"${UNPACKDIR}/aziot-cert-client-async/openssl-sys2"#' \
+        -e 's#"${UNPACKDIR}/openssl2"#"${UNPACKDIR}/aziot-cert-client-async/openssl2"#' \
+        -e 's#"${UNPACKDIR}/pkcs11-sys"#"${UNPACKDIR}/aziot-cert-client-async/pkcs11/pkcs11-sys"#' \
+        -e 's#"${UNPACKDIR}/pkcs11"#"${UNPACKDIR}/aziot-cert-client-async/pkcs11/pkcs11"#' \
+        -e 's#"${UNPACKDIR}/test-common"#"${UNPACKDIR}/aziot-cert-client-async/test-common"#' \
+        ${UNPACKDIR}/cargo_home/config.toml
 }

classes/omnect_rust_azure-iot-sdk_deps.bbclass

@@ -1,6 +1,17 @@
+# wrynose dropped the custom rust-llvm (which carried clang); bindgen now gets
+# libclang from oe-core's clang-native.
+DEPENDS:append = " clang-native"
+
 do_compile:prepend() {
-    export LLVM_CONFIG_PATH="${STAGING_LIBDIR_NATIVE}/llvm-rust/bin/llvm-config"
-    export BINDGEN_EXTRA_CLANG_ARGS="${TUNE_CCARGS}"
+    export LIBCLANG_PATH="${STAGING_LIBDIR_NATIVE}"
+    export BINDGEN_EXTRA_CLANG_ARGS="--target=${TARGET_SYS} --sysroot=${STAGING_DIR_TARGET}"
+    # 32-bit ARM hard-float: the gnueabi triple defaults clang to soft-float, so
+    # it picks the wrong glibc ABI stubs header (gnu/stubs-soft.h, absent in a
+    # hard-float sysroot). Append the tune flags (-mfloat-abi=hard/-mfpu) so
+    # clang matches the target ABI. aarch64/x86 have no such ambiguity.
+    if [ "${TARGET_ARCH}" = "arm" ]; then
+        export BINDGEN_EXTRA_CLANG_ARGS="${BINDGEN_EXTRA_CLANG_ARGS} ${TUNE_CCARGS}"
+    fi
 
     export AZURESDK_PATH=${STAGING_DIR_TARGET}/usr/
     export UUID_PATH=${STAGING_DIR_TARGET}/usr/

classes/omnect_uboot_configure_env.bbclass

@@ -3,8 +3,8 @@ DEPENDS += "u-boot-mkenvimage-native"
 
 omnect_uboot_configure_env() {
     # configure omnect u-boot env
-    cp -f ${WORKDIR}/omnect_env.h ${S}/include/configs/
-    cp -f ${WORKDIR}/omnect_env.env ${S}/include/env/
+    cp -f ${UNPACKDIR}/omnect_env.h ${S}/include/configs/
+    cp -f ${UNPACKDIR}/omnect_env.env ${S}/include/env/
 
     # set release image
     if [ "${OMNECT_RELEASE_IMAGE}" = "1" ]; then
@@ -28,11 +28,14 @@ do_compile:append() {
         mkenvimage="mkenvimage -r"
     fi
     if [ -n "${UBOOT_CONFIG}" ]; then
-        # this is based on the handling in openembedded-core/meta/recipes-bsp/u-boot/u-boot.inc
+        # openembedded-core's u-boot.inc now builds into O=${B}/${config}-${type},
+        # so the initial env lives in that -${type}-suffixed dir, not ${config}/.
+        # UBOOT_MACHINE/UBOOT_CONFIG only ever hold a single config here.
         for config in ${UBOOT_MACHINE}; do
-            initial_env="${B}/${config}/u-boot-initial-env"
-            # so far i don't see that `UBOOT_MACHINE` is ever set to multiple configs
-            break;
+            for type in ${UBOOT_CONFIG}; do
+                initial_env="${B}/${config}-${type}/u-boot-initial-env"
+                break 2
+            done
         done
     else
         initial_env="${B}/u-boot-initial-env"

conf/distro/include/omnect-os-distro.conf

@@ -6,7 +6,10 @@ SDK_NAME_PREFIX = "${DISTRO_NAME}"
 SDK_VERSION = "${MACHINE}-${DISTRO_VERSION}"
 
 DISTRO_FEATURES = "apparmor ipv4 ipv6 polkit seccomp xattr zeroconf"
-DISTRO_FEATURES_BACKFILL_CONSIDERED += "pulseaudio gobject-introspection-data ldconfig"
+DISTRO_FEATURES_OPTED_OUT += "\
+    3g acl alsa bluetooth debuginfod ext2 gobject-introspection-data ldconfig \
+    multiarch nfc nfs opengl pci ptest pulseaudio vfat vulkan wayland wifi x11 \
+"
 
 # meta-security is only included for the AppArmor userspace; the 'security'
 # DISTRO_FEATURE would pull in kernel config fragments for linux-yocto, but we
@@ -43,7 +46,7 @@ ROOT_HOME = "/home/root"
 RDEPENDS:packagegroup-base-3g:pn-packagegroup-base = ""
 
 # We don't use qemu-usermode, resp. it is currently not usable straightforward.
-MACHINE_FEATURES_BACKFILL_CONSIDERED += "qemu-usermode"
+MACHINE_FEATURES_OPTED_OUT += "qemu-usermode"
 # Remove machine features we don't see any value in.
 # -> packagegroup-base doesn't install unwanted packages
 MACHINE_FEATURES:remove = "alsa ext2 pci pcmcia serial usbhost usbgadget vfat"
@@ -66,7 +69,7 @@ PACKAGE_CLASSES ?= "package_ipk"
 CONNECTIVITY_CHECK_URIS ?= "https://github.com/omnect"
 
 # Image configuration
-IMAGE_FSTYPES = "ext4.gz wic.xz wic.bmap"
+IMAGE_FSTYPES = "ext4.gz wic.xz wic.bmap wicenv"
 IMAGE_TYPES:remove = "cramfs"
 # rm kernel from boot partition, we use a bundled initramfs kernel in rootfs
 IMAGE_BOOT_FILES:remove = "uImage Image"
@@ -167,10 +170,6 @@ DEPENDS:remove:pn-apparmor = "perl"
 # DEPENDS that config is unstaged. Force native mode so aclocal uses perl-native.
 PERLCONFIGTARGET:pn-apparmor = "no"
 
-# use smaller and faster duktape vs mozjs in polkit
-PACKAGECONFIG:remove:pn-polkit = "mozjs"
-PACKAGECONFIG:append:pn-polkit = " duktape"
-
 # remove logind + pam
 PACKAGECONFIG:remove:pn-systemd = "logind pam"
 
@@ -179,6 +178,9 @@ PACKAGECONFIG:remove:pn-systemd = "logind pam"
 # gobject-introspection dependency in avahi + polkit
 CODEGEN_PYTHON_RDEPENDS:pn-glib-2.0 = ""
 RDEPENDS:${PN}:pn-gobject-introspection = ""
+# Emptying RDEPENDS also drops the auto libglib shlib dep; wrynose made file-rdeps
+# fatal. glib is always in the image (avahi/polkit depend on it directly), so skip it.
+INSANE_SKIP:${PN}:pn-gobject-introspection = "file-rdeps"
 PACKAGECONFIG:remove:pn-apparmor = "python"
 
 # disable glib-2.0 dependency to shared-mime-info

conf/distro/include/omnect-os-fixes.conf

@@ -8,3 +8,22 @@ DEPENDS:append:pn-libx11 = " autoconf-archive-native"
 # lshw: fix lshw e.g. on tauri-l
 FILESEXTRAPATHS:prepend:pn-lshw := "${LAYERDIR_omnect}/files/patches:"
 SRC_URI:append:pn-lshw = " file://lshw_github_PR87.patch"
+
+# wrynose promoted the patch-status QA check to a fatal error. Our local recipe
+# patches carry no Upstream-Status; silence the check (remove from both ERROR_QA and
+# WARN_QA) rather than annotate every patch.
+ERROR_QA:remove = "patch-status"
+WARN_QA:remove = "patch-status"
+
+# wrynose's oe-core also makes the buildpaths check fatal. Some Rust recipes (e.g. the
+# aziot cc-crate openssl engine) leak a ${WORKDIR} path into -dbg debug info that
+# escapes the debug-prefix-map remap; downgrade to a warning rather than chase the
+# per-crate remap. The runtime (non-dbg) binaries are clean.
+ERROR_QA:remove = "buildpaths"
+WARN_QA:append = " buildpaths"
+
+# wrynose's coreutils-dev RRECOMMENDS gawk-dev, but gawk is GPL-3.0-or-later &
+# AGPL-3.0-or-later and excluded by INCOMPATIBLE_LICENSE. The skipped provider
+# breaks the rootfs build-dependency graph, so drop the recommend in metadata
+# (BAD_RECOMMENDATIONS only filters at install time, too late for taskdata).
+RRECOMMENDS:coreutils-dev:remove = "gawk-dev"

conf/distro/include/omnect-os-required.conf

@@ -1 +1 @@
-REQUIRED_VERSION_openssl ?= "3.5.6"
+REQUIRED_VERSION_openssl ?= "3.5.7"

conf/distro/include/omnect-os-rust.conf

@@ -1,9 +1,3 @@
-# we need this to get bindgen-native to work at runtime
-EXTRA_OECMAKE:append:pn-rust-llvm-native = " -DLLVM_ENABLE_PROJECTS=clang"
-
 # set default rust panic strategy to abort, otherwise we have to patch iotedge
 # warning: this is global setting
 RUST_PANIC_STRATEGY = "abort"
-
-# we use rust from meta-omnect
-RUSTVERSION = "1.93%"

conf/distro/include/omnect-os-swupdate.conf

@@ -2,4 +2,4 @@ SOFTWARE_VERSION = "${DISTRO_VERSION}"
 SOFTWARE_NAME = "${DISTRO_NAME}"
 
 # disable automatic start of swupdate.service
-SYSTEMD_SERVICE:swupdate:remove:pn-swupdate= "swupdate.service"
+SYSTEMD_SERVICE:swupdate:remove:pn-swupdate = "swupdate.service"

conf/layer.conf

@@ -28,11 +28,11 @@ BBFILE_PATTERN_omnect = "^${LAYERDIR}/"
 BBFILE_PRIORITY_omnect = "10"
 
 LAYERDEPENDS_omnect = "swupdate security"
-LAYERSERIES_COMPAT_omnect = "scarthgap"
+LAYERSERIES_COMPAT_omnect = "wrynose"
 LAYERDIR_omnect = "${LAYERDIR}"
 
 # orchestrate other layers (we ensure our layer is latest when building with kas)
 # if you don't use kas, you should ensure meta-omnect is behind meta-phytec resp. meta-welotec-bsp in BBLAYERS.
 BBFILE_PRIORITY_phytec = "9"
-BBFILE_PRIORITY_raspberrypi="9"
+BBFILE_PRIORITY_raspberrypi = "9"
 BBFILE_PRIORITY_welotec-bsp-layer = "9"

conf/machine/genericx86-64.extra.conf

@@ -1,7 +1,6 @@
 # additional kernel config
 OMNECT_KERNEL_SRC_URI:append = " \
     file://acpi-watchdog.cfg \
-    file://crc32c-intel_module.cfg \
     file://bluetooth_hcibtusb.cfg \
     file://i2c-chardev.cfg \
     file://intel-igc.cfg \
@@ -38,7 +37,7 @@ OMNECT_INITRAMFS_FSTYPE = "cpio.gz"
 WKS_FILE = "omnect-os.grub.wks.in"
 # no differentiation for now between release an devel images concerning rootfs
 # size
-OMNECT_PART_SIZE_ROOTFS ?= "${@bb.utils.contains('OMNECT_RELEASE_IMAGE', '1', '900000', '900000', d)}"
+OMNECT_PART_SIZE_ROOTFS ?= "${@bb.utils.contains('OMNECT_RELEASE_IMAGE', '1', '900000', '1048576', d)}"
 OMNECT_PART_OFFSET_BOOT ?= "2048"
 
 # adu compatibility id
@@ -71,6 +70,14 @@ MACHINE_EXTRA_RRECOMMENDS:remove = "linux-firmware"
 
 DISTRO_FEATURES:append = " efi-secure-boot modsign"
 
+# We verify the grub config with SELoader (PKCS7 .p7b), matching OMNECT_GRUB_EFI_SB_FILES
+# and the LockDown/SELoader artifacts below. wrynose's meta-secure-core (commit 6d83fbf)
+# flipped the defaults to UEFI_SELOADER=0 + GRUB_SIGN_VERIFY=1 (grub's built-in GPG .sig
+# check); scarthgap had UEFI_SELOADER=1 + GRUB_SIGN_VERIFY=0. The two are mutually
+# exclusive, so pin both to restore the SELoader path.
+UEFI_SELOADER = "1"
+GRUB_SIGN_VERIFY = "0"
+
 # for patched wic plugin bootimg-efi.py:
 WICVARS:append = " OMNECT_GRUB_EFI_SB_FILES"
 OMNECT_GRUB_EFI_SB_FILES = " \
@@ -94,7 +101,7 @@ OMNECT_GRUB_EFI_SB_FILES = " \
 SYSTEMD_RuntimeWatchdogSec  = "60"
 SYSTEMD_RebootWatchdogSec   = "60"
 
-OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/grub/grub-efi_2.12.bb"
+OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/grub/grub-efi_2.14.bb"
 # force bootloader version checksum to be old, when sure it's 100% binary compatible
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned = "<newchecksum> <oldchecksum>"
 # e.g.:
@@ -103,5 +110,5 @@ OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/grub/grub-efi_2.12
 # OMNECT_BOOTLOADER_CHECKSUM_EXPTECTED:pn-bootloader-versioned - build will fail, if the
 # computed checksum is different to this; set to <oldchecksum> when
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned is set
-OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "69a43de1bc02f87f36adb29b4215300bda0b4b144ef1505dd71d17f5ae27ff09"
+OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "5aa682e34bdaeae271cbd96dc1d4f6d26fd9be104372cf56dcca35953c7fc066"
 #OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned = ""

conf/machine/include/phytec-imx8mm.inc

@@ -18,6 +18,7 @@ IMAGE_BOOT_FILES:remove:pn-omnect-os-image = " \
     fitImage  \
     oftree \
     bootenv.txt \
+    overlays.txt \
 "
 
 IMAGE_INSTALL:append:pn-omnect-os-image = " kernel-devicetree"
@@ -26,7 +27,7 @@ IMAGE_INSTALL:append:pn-omnect-os-image = " kernel-devicetree"
 OMNECT_INITRAMFS_FSTYPE = "cpio.gz.u-boot"
 
 # Set Serial console
-SERIAL_CONSOLES ="${@bb.utils.contains('OMNECT_RELEASE_IMAGE', '1', '', '115200;ttymxc2', d)}"
+SERIAL_CONSOLES = "${@bb.utils.contains('OMNECT_RELEASE_IMAGE', '1', '', '115200;ttymxc2', d)}"
 #bootargs console is not part of the devictree, so we have to append it to kernel commandline
 APPEND += "console=ttymxc2,115200"
 
@@ -76,6 +77,15 @@ BBMASK:append = " \
     meta-imx/meta-imx-bsp/recipes-connectivity/openssl/openssl_3.2.%.bbappend \
 "
 
+# mask phytec's Cortex-M demo bbappend: its base recipe lives in the dropped
+# meta-imx-sdk, so it would dangle; we don't want the demos anyway.
+BBMASK:append = " meta-phytec/dynamic-layers/fsl-bsp-release/recipes-fsl/mcore-demos/"
+
+# u-boot-master.bb tracks u-boot master via AUTOREV, doing a git ls-remote at
+# parse time; we don't use it and the remote fetch breaks parsing when
+# source.denx.de is unreachable.
+BBMASK:append = " meta-phytec/recipes-bsp/u-boot/u-boot-master.bb"
+
 # fix search path
 FILESEXTRAPATHS:prepend:pn-imx-boot-phytec := "${LAYERDIR_freescale-layer}/recipes-bsp/imx-mkimage/files:"
 FILESEXTRAPATHS:prepend:pn-optee-client := "${LAYERDIR_arm}/recipes-security/optee/optee-client:"
@@ -102,7 +112,7 @@ MACHINE_FEATURES:append = " \
     pstore \
 "
 
-OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_phytec}/recipes-bsp/u-boot/u-boot-phytec-imx_2024.04-2.2.0-phy23.bb"
+OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_phytec}/recipes-bsp/u-boot/u-boot-phytec-imx_2024.04-2.2.0-phy25.bb"
 
 # force bootloader version checksum to be old, when sure it's 100% binary compatible
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned = "<newchecksum> <oldchecksum>"
@@ -112,4 +122,4 @@ OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_phytec}/recipes-bsp/u-boot/u-boot-ph
 # OMNECT_BOOTLOADER_CHECKSUM_EXPTECTED:pn-bootloader-versioned - build will fail, if the
 # computed checksum is different to this; set to <oldchecksum> when
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned is set
-OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "5165f005922e91b9513e4316db9316097f421109e2e678f6aed21f3a5cfbff51"
+OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "c4284d87e36c02b2c35eceed96ac30cf502ff9b19c39d27c12deeaf50134ab49"

conf/machine/include/rpi.inc

@@ -34,7 +34,7 @@ MACHINE_FEATURES += "pstore"
 # optional tpm2 support
 MACHINE_FEATURES += "tpm2"
 
-OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/u-boot/u-boot_2024.01.bb"
+OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/u-boot/u-boot_2026.01.bb"
 # force bootloader version checksum to be old, when sure it's 100% binary compatible
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned = "<newchecksum> <oldchecksum>"
 # e.g.:
@@ -43,4 +43,4 @@ OMNECT_BOOTLOADER_RECIPE_PATH = "${LAYERDIR_core}/recipes-bsp/u-boot/u-boot_2024
 # OMNECT_BOOTLOADER_CHECKSUM_EXPTECTED:pn-bootloader-versioned - build will fail, if the
 # computed checksum is different to this; set to <oldchecksum> when
 # OMNECT_BOOTLOADER_CHECKSUM_COMPATIBLE:pn-bootloader-versioned is set
-OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "0a28102f487988548315da27e3fada50c138656acdd3866f818743831ed74c35"
+OMNECT_BOOTLOADER_CHECKSUM_EXPECTED:pn-bootloader-versioned = "9dbbfaa83c08214b9c9114a21e7cd9eb5b116cff048fb780655d3ff9f158e604"