Direkt zum Hauptbereich

Securing recipe against manipulation by other layer in YOCTO

In my last post I described a way how to ensure a safe and know configuration for KConfig-based system.
But there is a lot more that could be altered when you include additional layer into your workspace. Just think of

  • configure options
  • build instructions
  • additional patches being applied
  • license changes (a very bad one)
  • files remove which should have been there
  • a.s.o.
I though about this for a longer time... after a very deep dive into the way bitbake is handling the parsing of any file (bb, bbappend, inc, conf) I created a small helper bbclass which you can find here.

This class can monitor changes done by bbappend file (no matter where they are actually located in your workspace) and diff them to the plain recipe.

You can now define a set of variables which you don't want to be changed at all (like. SRC_URI, or LICENSE).

The helper class does then the magic for you and diffs them against each other.
If a variable (and all there machine/arch-specific variants) is on the monitoring list and a bbappend alters this - you will get a reasonable warning, what and to which value the change happened.

What about files...?


The bitbake-construct does also offer the possibility to overload files

Just think of the following directory structure
  • recipes-foo
    • foo
      • files
        • foo.file
      • foo_1.2.3.bb
  • recipes-bar
    • foo
      • files
        • foo.file
      • foo_%.bbappend
now take a guess which "foo.file" will make into the build?
The answer: it depends!

If the file "foo_%.bbappend" contains a line like this
FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
the file from the bbappend-subdir will win. If not the it's mostly likely that the "original" file will make it.

This behavior is a gift and a curse that the same time.

The class I wrote, does help you to make it into a gift only.
It offers the possibility to check if a file is defined more than once among the bb-file and all bbappends.
This is also configurable, so you can just set the filter to the files you really don't want to altered by anyone (e.g. defconfig is a typical example).


I wrote the layer-safety.bbclass as part of my collection meta-buildtuils of useful helper functions.

I would be happy to get your input here in the comments or over on GitHub.
Labels:

Kommentare

Kommentar veröffentlichen

Beliebte Posts aus diesem Blog

Sharing is caring... about task hashes

The YOCTO-project can do amazing things, but requires a very decent build machine, as by nature when you build everything from scratch it does require a lot of compilation. So the ultimate goal has to be to perform only the necessary steps in each run. Understanding task hashing The thing is that bitbake uses a task hashing to determine, which tasks (such as compilation, packaging, a.s.o.) are actually required to be performed. As tasks depend on each other, this information is also embedded into a hash, so the last task for a recipe is ultimately depending on the variable that are used for this specific task and every task before. You could visualize this by using a utility called bitbake-dumpsig , which produces output like this basewhitelist: {'SOURCE_DATE_EPOCH', 'FILESEXTRAPATHS', 'PRSERV_HOST', 'THISDIR', 'TMPDIR', 'WORKDIR', 'EXTERNAL_TOOLCHAIN', 'FILE', 'BB_TASKHASH', 'USER', 'BBSERVER&
Kommentar veröffentlichen
Mehr anzeigen

Making go not a no-go

Anyone that dealt with container engines came across go - a wonderful language, that was built to provide a right way of what C++ intended to do. The language itself is pretty straight forward and upstream poky support is given since ages... In the go world one would just run 1 2 go get github.com/foo/bar go build github.com/foo/bar and magically the go ecosystem would pull all the needed sources and build them into an executable. This is where the issues start... In the Openembedded world, one would have  one provider (aka recipe) for each dependency each recipe comes with a (remote) artifact (e.g. tarball, git repo, a.s.o.) which can be archived (so one can build the same software at a later point in time without any online connectivity) dedicated license information all this information is pretty useful when working is an environment (aka company) that has restrictions, such as reproducible builds license compliance security compliance (for instance no unpatched CVE) but when us
Kommentar veröffentlichen
Mehr anzeigen

Speedup python on embedded systems

Have you ever considered to use python as a scripting language in an embedded system? I've been using this on recent projects although it wasn't my first choice. If I had to choose a scripting language to be used in embedded I always had a strong preference for shell/bash or lua, because they are either builtin or designed to have a significant lower footprint compared to others. Nevertheless the choice was python3 (was out of my hands to decide). When putting together the first builds using YOCTO I realized that there are two sides to python. the starting phase, where the app is initializing the execution phase, where the app just processes new data In the 2nd phase python3 has good tradeoffs between maintainability of code vs. execution speed, so there is nothing to moan about. Startup is the worst But the 1st phase where the python3-interpreter is starting is really bad. So I did some research where is might be coming from. Just to give a comparison of
Kommentar veröffentlichen
Mehr anzeigen