Re: [docs] [PATCH v3] security-manual: Add information about how security is handled in builds

On Tue, 2026-08-11 at 11:08 +0200, Quentin Schulz wrote:
> On 8/11/26 11:02 AM, Richard Purdie via lists.yoctoproject.org wrote:
> 
> > +
> > +-  :term:`OpenEmbedded-Core (OE-Core)` is well tested for reproducibility issues but other
> > +   layers and their recipes and code may not be as well tested. Those reproducibility tests
> > +   are available for others to run against their own layers and code.
> > +
> 
> Would be nice to have a link to those reproducibility tests (or if we
> have documentation for those, that) so we remove friction for layers to 
> figure out how to do them.

It would. I was going to say it is a bit more involved however it would
be good for someone to document it so let me at least write down that
bit in the hope someone can sort the markup/docs entry for it.

To test a layer's reproducibility, you would setup a build with
OE-Core with the addition of the layer you want to test. You'd use a
configuration along the lines of:

EXCLUDE_FROM_WORLD:layer-core = '1'
EXCLUDE_FROM_WORLD:layer-yocto = '1'
EXCLUDE_FROM_WORLD:layer-yoctobsp = '1'
EXCLUDE_FROM_WORLD:layer-selftest = '1'
OEQA_REPRODUCIBLE_TEST_TARGET = 'world'

which would setup the reproducibility target as 'world' but then only
include the additional layer in the world build.

You could then run the reproducibility test as:

OEQA_DEBUGGING_SAVED_OUTPUT=/place/to/save/failing-output oe-selftest -r reproducible

where differences would be stored in /place/to/save/failing-output for
debugging, which is handy in CI.

Cheers,

Richard