feat: wrynose integration

README.md

@@ -99,13 +99,13 @@ Device         Boot   Start      End  Sectors  Size Id Type
 - `OMNECT_PART_SIZE_UBOOT_ENV`: size of one u-boot environment bank (in KiB, decimal)
 
 ## Compatibility
-`meta-omnect` is compatible with the current yocto LTS release branch `scarthgap`.
+`meta-omnect` is compatible with the current yocto LTS release branch `wrynose`.
 
 ## Supported Devices
 See board specific documents [doc](/doc/) folder.
 
 ## Versioning
-We reflect the used yocto version in our version schema. `omnect-os` is versioned `5.0.x.y` where `x` is yocto scarthgap's patch version and `y` is the build number.
+We reflect the used yocto version in our version schema. `omnect-os` is versioned `6.0.x.y` where `x` is yocto wrynose's patch version and `y` is the build number.
 
 ## Dependencies
 Aside from hardware specific meta layers `meta-omnect` depends on:
@@ -498,7 +498,7 @@ sudo reboot
 
 Process crashes are handled by `systemd-coredump`, but **no core is stored by default** on any image (`Storage=none`) - process memory, which may hold secrets, is never written to disk.
 
-To debug a crash on a device, enable both levers per device via the writable `/etc` overlay, then reboot and reproduce:
+To debug a crash on a device, enable both settings per device via the writable `/etc` overlay, then reboot and reproduce:
 ```sh
 # 1) complete cores: containerd dumps all memory (inherited by module containers)
 sudo install -d /etc/systemd/system/containerd.service.d

classes/aziot.bbclass

@@ -1,4 +1,4 @@
-inherit useradd
+inherit useradd pkgconfig
 
 USERADD_PACKAGES = "${PN}"
 GROUPADD_PARAM:${PN} = " \

classes/disable_volatile_log_dir.bbclass

@@ -1,5 +1,4 @@
-# We want to have a nonvolatile log dir, if DISTRO_FEATURE "persistent-var-log"
-# is set, but we cannot access 'DISTRO_FEATURES' directly at conf file load
-# time.
-# We delay by using this special bbclass and the _append operator.
-VOLATILE_LOG_DIR = "no"
+# We want a nonvolatile /var/log when DISTRO_FEATURE "persistent-var-log" is
+# set, but DISTRO_FEATURES can't be read at conf-parse time; so this class is
+# inherited conditionally via USER_CLASSES instead.
+FILESYSTEM_PERMS_TABLES:remove = "files/fs-perms-volatile-log.txt"

classes/omnect-license-exceptions.bbclass

@@ -0,0 +1,35 @@
+# INCOMPATIBLE_LICENSE_EXCEPTIONS is matched per *package* name, not per recipe
+# (see oe.license.apply_pkg_license_exception: it tests "<pkg>:<license>"). So an
+# entry like "bash:GPL-3.0-or-later" only whitelists the main "bash" package while
+# every sub-package it produces (bash-dev, bash-doc, bash-src, bash-dbg,
+# bash-staticdev, bash-locale-*, ...) is still dropped by the incompatible-license
+# QA check, which is fatal (it is part of ERROR_QA) and breaks do_package.
+#
+# This class expands each existing exception entry to cover *all* packages produced
+# by the recipe that owns the named package, so a single line in
+# INCOMPATIBLE_LICENSE_EXCEPTIONS keeps covering the whole recipe.
+
+def omnect_license_exception_subpkgs(d):
+    packages = (d.getVar('PACKAGES') or '').split()
+    if not packages:
+        return ''
+
+    # Read the value unexpanded to avoid recursing into our own :append below.
+    # Concrete kas entries are literal; the "${@...}" append token contains '$'
+    # and is skipped.
+    raw = d.getVar('INCOMPATIBLE_LICENSE_EXCEPTIONS', False) or ''
+
+    extra = []
+    for entry in raw.split():
+        if ':' not in entry or '$' in entry:
+            continue
+        name, lic = entry.split(':', 1)
+        # Only the recipe that actually produces the named package expands it.
+        if name in packages:
+            extra += ['%s:%s' % (pkg, lic) for pkg in packages]
+
+    return ' '.join(sorted(set(extra)))
+
+# Evaluated lazily at do_package time, when PACKAGES already includes the
+# dynamically split locale packages.
+INCOMPATIBLE_LICENSE_EXCEPTIONS:append = " ${@omnect_license_exception_subpkgs(d)}"

classes/omnect_rust_aziot-identityd_deps.bbclass

@@ -2,32 +2,32 @@
 do_compile:prepend() {
     # instead of sed, i wanted to use toml-cli, but it can not escape the values correctly
     sed -i \
-        -e 's#"${WORKDIR}/aziot-cert-client-async"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-cert-common"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-common"#' \
-        -e 's#"${WORKDIR}/aziot-cert-common-http"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-cert-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-certd-config"#"${WORKDIR}/aziot-cert-client-async/cert/aziot-certd-config"#' \
-        -e 's#"${WORKDIR}/aziot-identity-client-async"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-identity-common"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-common"#' \
-        -e 's#"${WORKDIR}/aziot-identity-common-http"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identity-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-identityd-config"#"${WORKDIR}/aziot-cert-client-async/identity/aziot-identityd-config"#' \
-        -e 's#"${WORKDIR}/aziot-key-client"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-client"#' \
-        -e 's#"${WORKDIR}/aziot-key-client-async"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-client-async"#' \
-        -e 's#"${WORKDIR}/aziot-key-common"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-common"#' \
-        -e 's#"${WORKDIR}/aziot-key-common-http"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-common-http"#' \
-        -e 's#"${WORKDIR}/aziot-key-openssl-engine"#"${WORKDIR}/aziot-cert-client-async/key/aziot-key-openssl-engine"#' \
-        -e 's#"${WORKDIR}/aziot-keyd-config"#"${WORKDIR}/aziot-cert-client-async/key/aziot-keyd-config"#' \
-        -e 's#"${WORKDIR}/aziot-keys-common"#"${WORKDIR}/aziot-cert-client-async/key/aziot-keys-common"#' \
-        -e 's#"${WORKDIR}/aziot-tpmd-config"#"${WORKDIR}/aziot-cert-client-async/tpm/aziot-tpmd-config"#' \
-        -e 's#"${WORKDIR}/aziotctl-common"#"${WORKDIR}/aziot-cert-client-async/aziotctl/aziotctl-common"#' \
-        -e 's#"${WORKDIR}/cert-renewal"#"${WORKDIR}/aziot-cert-client-async/cert/cert-renewal"#' \
-        -e 's#"${WORKDIR}/config-common"#"${WORKDIR}/aziot-cert-client-async/config-common"#' \
-        -e 's#"${WORKDIR}/http-common"#"${WORKDIR}/aziot-cert-client-async/http-common"#' \
-        -e 's#"${WORKDIR}/logger"#"${WORKDIR}/aziot-cert-client-async/logger"#' \
-        -e 's#"${WORKDIR}/openssl-build"#"${WORKDIR}/aziot-cert-client-async/openssl-build"#' \
-        -e 's#"${WORKDIR}/openssl-sys2"#"${WORKDIR}/aziot-cert-client-async/openssl-sys2"#' \
-        -e 's#"${WORKDIR}/openssl2"#"${WORKDIR}/aziot-cert-client-async/openssl2"#' \
-        -e 's#"${WORKDIR}/pkcs11-sys"#"${WORKDIR}/aziot-cert-client-async/pkcs11/pkcs11-sys"#' \
-        -e 's#"${WORKDIR}/pkcs11"#"${WORKDIR}/aziot-cert-client-async/pkcs11/pkcs11"#' \
-        -e 's#"${WORKDIR}/test-common"#"${WORKDIR}/aziot-cert-client-async/test-common"#' \
-        ${WORKDIR}/cargo_home/config
+        -e 's#"${UNPACKDIR}/aziot-cert-client-async"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-cert-common"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-cert-common-http"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-cert-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-certd-config"#"${UNPACKDIR}/aziot-cert-client-async/cert/aziot-certd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-client-async"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-common"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-identity-common-http"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identity-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-identityd-config"#"${UNPACKDIR}/aziot-cert-client-async/identity/aziot-identityd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-client"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-client"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-client-async"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-client-async"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-common"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-common-http"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-common-http"#' \
+        -e 's#"${UNPACKDIR}/aziot-key-openssl-engine"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-key-openssl-engine"#' \
+        -e 's#"${UNPACKDIR}/aziot-keyd-config"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-keyd-config"#' \
+        -e 's#"${UNPACKDIR}/aziot-keys-common"#"${UNPACKDIR}/aziot-cert-client-async/key/aziot-keys-common"#' \
+        -e 's#"${UNPACKDIR}/aziot-tpmd-config"#"${UNPACKDIR}/aziot-cert-client-async/tpm/aziot-tpmd-config"#' \
+        -e 's#"${UNPACKDIR}/aziotctl-common"#"${UNPACKDIR}/aziot-cert-client-async/aziotctl/aziotctl-common"#' \
+        -e 's#"${UNPACKDIR}/cert-renewal"#"${UNPACKDIR}/aziot-cert-client-async/cert/cert-renewal"#' \
+        -e 's#"${UNPACKDIR}/config-common"#"${UNPACKDIR}/aziot-cert-client-async/config-common"#' \
+        -e 's#"${UNPACKDIR}/http-common"#"${UNPACKDIR}/aziot-cert-client-async/http-common"#' \
+        -e 's#"${UNPACKDIR}/logger"#"${UNPACKDIR}/aziot-cert-client-async/logger"#' \
+        -e 's#"${UNPACKDIR}/openssl-build"#"${UNPACKDIR}/aziot-cert-client-async/openssl-build"#' \
+        -e 's#"${UNPACKDIR}/openssl-sys2"#"${UNPACKDIR}/aziot-cert-client-async/openssl-sys2"#' \
+        -e 's#"${UNPACKDIR}/openssl2"#"${UNPACKDIR}/aziot-cert-client-async/openssl2"#' \
+        -e 's#"${UNPACKDIR}/pkcs11-sys"#"${UNPACKDIR}/aziot-cert-client-async/pkcs11/pkcs11-sys"#' \
+        -e 's#"${UNPACKDIR}/pkcs11"#"${UNPACKDIR}/aziot-cert-client-async/pkcs11/pkcs11"#' \
+        -e 's#"${UNPACKDIR}/test-common"#"${UNPACKDIR}/aziot-cert-client-async/test-common"#' \
+        ${UNPACKDIR}/cargo_home/config.toml
 }

classes/omnect_rust_azure-iot-sdk_deps.bbclass

@@ -1,6 +1,17 @@
+# wrynose dropped the custom rust-llvm (which carried clang); bindgen now gets
+# libclang from oe-core's clang-native.
+DEPENDS:append = " clang-native"
+
 do_compile:prepend() {
-    export LLVM_CONFIG_PATH="${STAGING_LIBDIR_NATIVE}/llvm-rust/bin/llvm-config"
-    export BINDGEN_EXTRA_CLANG_ARGS="${TUNE_CCARGS}"
+    export LIBCLANG_PATH="${STAGING_LIBDIR_NATIVE}"
+    export BINDGEN_EXTRA_CLANG_ARGS="--target=${TARGET_SYS} --sysroot=${STAGING_DIR_TARGET}"
+    # 32-bit ARM hard-float: the gnueabi triple defaults clang to soft-float, so
+    # it picks the wrong glibc ABI stubs header (gnu/stubs-soft.h, absent in a
+    # hard-float sysroot). Append the tune flags (-mfloat-abi=hard/-mfpu) so
+    # clang matches the target ABI. aarch64/x86 have no such ambiguity.
+    if [ "${TARGET_ARCH}" = "arm" ]; then
+        export BINDGEN_EXTRA_CLANG_ARGS="${BINDGEN_EXTRA_CLANG_ARGS} ${TUNE_CCARGS}"
+    fi
 
     export AZURESDK_PATH=${STAGING_DIR_TARGET}/usr/
     export UUID_PATH=${STAGING_DIR_TARGET}/usr/

classes/omnect_uboot_configure_env.bbclass

@@ -3,8 +3,8 @@ DEPENDS += "u-boot-mkenvimage-native"
 
 omnect_uboot_configure_env() {
     # configure omnect u-boot env
-    cp -f ${WORKDIR}/omnect_env.h ${S}/include/configs/
-    cp -f ${WORKDIR}/omnect_env.env ${S}/include/env/
+    cp -f ${UNPACKDIR}/omnect_env.h ${S}/include/configs/
+    cp -f ${UNPACKDIR}/omnect_env.env ${S}/include/env/
 
     # set release image
     if [ "${OMNECT_RELEASE_IMAGE}" = "1" ]; then
@@ -28,11 +28,14 @@ do_compile:append() {
         mkenvimage="mkenvimage -r"
     fi
     if [ -n "${UBOOT_CONFIG}" ]; then
-        # this is based on the handling in openembedded-core/meta/recipes-bsp/u-boot/u-boot.inc
+        # openembedded-core's u-boot.inc now builds into O=${B}/${config}-${type},
+        # so the initial env lives in that -${type}-suffixed dir, not ${config}/.
+        # UBOOT_MACHINE/UBOOT_CONFIG only ever hold a single config here.
         for config in ${UBOOT_MACHINE}; do
-            initial_env="${B}/${config}/u-boot-initial-env"
-            # so far i don't see that `UBOOT_MACHINE` is ever set to multiple configs
-            break;
+            for type in ${UBOOT_CONFIG}; do
+                initial_env="${B}/${config}-${type}/u-boot-initial-env"
+                break 2
+            done
         done
     else
         initial_env="${B}/u-boot-initial-env"

conf/distro/include/omnect-os-distro.conf

@@ -6,7 +6,10 @@ SDK_NAME_PREFIX = "${DISTRO_NAME}"
 SDK_VERSION = "${MACHINE}-${DISTRO_VERSION}"
 
 DISTRO_FEATURES = "apparmor ipv4 ipv6 polkit seccomp xattr zeroconf"
-DISTRO_FEATURES_BACKFILL_CONSIDERED += "pulseaudio gobject-introspection-data ldconfig"
+DISTRO_FEATURES_OPTED_OUT += "\
+    3g acl alsa bluetooth debuginfod ext2 gobject-introspection-data ldconfig \
+    multiarch nfc nfs opengl pci ptest pulseaudio vfat vulkan wayland wifi x11 \
+"
 
 # meta-security is only included for the AppArmor userspace; the 'security'
 # DISTRO_FEATURE would pull in kernel config fragments for linux-yocto, but we
@@ -43,7 +46,7 @@ ROOT_HOME = "/home/root"
 RDEPENDS:packagegroup-base-3g:pn-packagegroup-base = ""
 
 # We don't use qemu-usermode, resp. it is currently not usable straightforward.
-MACHINE_FEATURES_BACKFILL_CONSIDERED += "qemu-usermode"
+MACHINE_FEATURES_OPTED_OUT += "qemu-usermode"
 # Remove machine features we don't see any value in.
 # -> packagegroup-base doesn't install unwanted packages
 MACHINE_FEATURES:remove = "alsa ext2 pci pcmcia serial usbhost usbgadget vfat"
@@ -66,7 +69,7 @@ PACKAGE_CLASSES ?= "package_ipk"
 CONNECTIVITY_CHECK_URIS ?= "https://github.com/omnect"
 
 # Image configuration
-IMAGE_FSTYPES = "ext4.gz wic.xz wic.bmap"
+IMAGE_FSTYPES = "ext4.gz wic.xz wic.bmap wicenv"
 IMAGE_TYPES:remove = "cramfs"
 # rm kernel from boot partition, we use a bundled initramfs kernel in rootfs
 IMAGE_BOOT_FILES:remove = "uImage Image"
@@ -167,10 +170,6 @@ DEPENDS:remove:pn-apparmor = "perl"
 # DEPENDS that config is unstaged. Force native mode so aclocal uses perl-native.
 PERLCONFIGTARGET:pn-apparmor = "no"
 
-# use smaller and faster duktape vs mozjs in polkit
-PACKAGECONFIG:remove:pn-polkit = "mozjs"
-PACKAGECONFIG:append:pn-polkit = " duktape"
-
 # remove logind + pam
 PACKAGECONFIG:remove:pn-systemd = "logind pam"
 
@@ -179,6 +178,9 @@ PACKAGECONFIG:remove:pn-systemd = "logind pam"
 # gobject-introspection dependency in avahi + polkit
 CODEGEN_PYTHON_RDEPENDS:pn-glib-2.0 = ""
 RDEPENDS:${PN}:pn-gobject-introspection = ""
+# Emptying RDEPENDS also drops the auto libglib shlib dep; wrynose made file-rdeps
+# fatal. glib is always in the image (avahi/polkit depend on it directly), so skip it.
+INSANE_SKIP:${PN}:pn-gobject-introspection = "file-rdeps"
 PACKAGECONFIG:remove:pn-apparmor = "python"
 
 # disable glib-2.0 dependency to shared-mime-info

conf/distro/include/omnect-os-fixes.conf

@@ -8,3 +8,28 @@ DEPENDS:append:pn-libx11 = " autoconf-archive-native"
 # lshw: fix lshw e.g. on tauri-l
 FILESEXTRAPATHS:prepend:pn-lshw := "${LAYERDIR_omnect}/files/patches:"
 SRC_URI:append:pn-lshw = " file://lshw_github_PR87.patch"
+
+# wrynose promoted the patch-status QA check to a fatal error. Our local recipe
+# patches carry no Upstream-Status; silence the check (remove from both ERROR_QA and
+# WARN_QA) rather than annotate every patch.
+ERROR_QA:remove = "patch-status"
+WARN_QA:remove = "patch-status"
+
+# wrynose's oe-core also makes the buildpaths check fatal. Some Rust recipes (e.g. the
+# aziot cc-crate openssl engine) leak a ${WORKDIR} path into -dbg debug info that
+# escapes the debug-prefix-map remap; downgrade to a warning rather than chase the
+# per-crate remap. The runtime (non-dbg) binaries are clean.
+ERROR_QA:remove = "buildpaths"
+WARN_QA:append = " buildpaths"
+
+# INCOMPATIBLE_LICENSE_EXCEPTIONS is matched per package name, so a single entry
+# (e.g. "bash:GPL-3.0-or-later") only whitelists the main package while every
+# sub-package (-dev, -doc, -src, -dbg, -staticdev, -locale-*, ...) is still dropped
+# by the fatal incompatible-license QA check. Expand each entry to the whole recipe.
+INHERIT += "omnect-license-exceptions"
+
+# wrynose's coreutils-dev RRECOMMENDS gawk-dev, but gawk is GPL-3.0-or-later &
+# AGPL-3.0-or-later and excluded by INCOMPATIBLE_LICENSE. The skipped provider
+# breaks the rootfs build-dependency graph, so drop the recommend in metadata
+# (BAD_RECOMMENDATIONS only filters at install time, too late for taskdata).
+RRECOMMENDS:coreutils-dev:remove = "gawk-dev"

conf/distro/include/omnect-os-required.conf

@@ -1 +1,2 @@
-REQUIRED_VERSION_openssl ?= "3.5.6"
+# we don't want to miss openssl updates so check for exact version
+REQUIRED_VERSION_openssl ?= "3.5.7"

conf/distro/include/omnect-os-rust.conf

@@ -1,9 +1,3 @@
-# we need this to get bindgen-native to work at runtime
-EXTRA_OECMAKE:append:pn-rust-llvm-native = " -DLLVM_ENABLE_PROJECTS=clang"
-
 # set default rust panic strategy to abort, otherwise we have to patch iotedge
 # warning: this is global setting
 RUST_PANIC_STRATEGY = "abort"
-
-# we use rust from meta-omnect
-RUSTVERSION = "1.93%"

conf/distro/include/omnect-os-swupdate.conf

@@ -2,4 +2,4 @@ SOFTWARE_VERSION = "${DISTRO_VERSION}"
 SOFTWARE_NAME = "${DISTRO_NAME}"
 
 # disable automatic start of swupdate.service
-SYSTEMD_SERVICE:swupdate:remove:pn-swupdate= "swupdate.service"
+SYSTEMD_SERVICE:swupdate:remove:pn-swupdate = "swupdate.service"

conf/layer.conf

@@ -20,19 +20,16 @@ BBFILES_DYNAMIC += "\
     virtualization-layer:${LAYERDIR}/dynamic-layers/virtualization/recipes-*/*/*.bbappend \
     virtualization-layer:${LAYERDIR}/dynamic-layers/virtualization/recipes-*/*/*/*.bb \
     virtualization-layer:${LAYERDIR}/dynamic-layers/virtualization/recipes-*/*/*/*.bbappend \
-    welotec-bsp-layer:${LAYERDIR}/dynamic-layers/welotec-bsp-layer/recipes-*/*/*.bb \
-    welotec-bsp-layer:${LAYERDIR}/dynamic-layers/welotec-bsp-layer/recipes-*/*/*.bbappend \
 "
 BBFILE_COLLECTIONS += "omnect"
 BBFILE_PATTERN_omnect = "^${LAYERDIR}/"
 BBFILE_PRIORITY_omnect = "10"
 
 LAYERDEPENDS_omnect = "swupdate security"
-LAYERSERIES_COMPAT_omnect = "scarthgap"
+LAYERSERIES_COMPAT_omnect = "wrynose"
 LAYERDIR_omnect = "${LAYERDIR}"
 
 # orchestrate other layers (we ensure our layer is latest when building with kas)
 # if you don't use kas, you should ensure meta-omnect is behind meta-phytec resp. meta-welotec-bsp in BBLAYERS.
 BBFILE_PRIORITY_phytec = "9"
-BBFILE_PRIORITY_raspberrypi="9"
-BBFILE_PRIORITY_welotec-bsp-layer = "9"
+BBFILE_PRIORITY_raspberrypi = "9"