Re: [meta-arm] [PATCH 1/3] arm/arm-bsp: optee: add version 4.9.0

Hi Denys,

On 1/26/26 3:56 PM, Denys Dmytriyenko wrote:
> On Mon, Jan 26, 2026 at 02:48:29PM +0100, Quentin Schulz via lists.yoctoproject.org wrote:
>> Hi Hugues,
>>
>> On 1/21/26 3:03 PM, Hugues KAMBA MPIANA wrote:
>> [...]
>>> diff --git a/meta-arm/recipes-security/optee/optee-os_4.9.0.bb b/meta-arm/recipes-security/optee/optee-os_4.9.0.bb
>>> new file mode 100644
>>> index 00000000..8e64a636
>>> --- /dev/null
>>> +++ b/meta-arm/recipes-security/optee/optee-os_4.9.0.bb
>>> @@ -0,0 +1,8 @@
>>> +require recipes-security/optee/optee-os.inc
>>> +
>>> +DEPENDS += "dtc-native"
>>> +
>>> +FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
>>> +
>>
>> We don't need that line anymore as there are no in-tree patches for
>> optee-os anymore.
> 
> This is not a bbappend, but a standalone recipe, so the line is not needed
> even with local patches.
> 

Indeed, good catch.

> 
>>> +# 4.9.0
>>> +SRCREV = "c2b0684fcd89929976a8726e6e3af922b48dd2c7"
>>> diff --git a/meta-arm/recipes-security/optee/optee-test_4.9.0.bb b/meta-arm/recipes-security/optee/optee-test_4.9.0.bb
>>> new file mode 100644
>>> index 00000000..ddb574fc
>>> --- /dev/null
>>> +++ b/meta-arm/recipes-security/optee/optee-test_4.9.0.bb
>>> @@ -0,0 +1,14 @@
>>> +require recipes-security/optee/optee-test.inc
>>> +
>>> +# v4.9.0
>>> +SRCREV = "b27648ea8472cceceb8dda368a965c709066f7aa"
>>> +
>>> +LIC_FILES_CHKSUM = "file://LICENSE.md;md5=a8fa504109e4cd7ea575bc49ea4be560"
>>> +
>>
>> This isn't the actual license but a file pointing to other files. I
>> would suggest to add LICENSE-BSD and LICENSE-GPL as well so that we
>> can catch modifications to those files.
>>
>> I've checked all commit hashes, they match the tags.
>>
>> I've run `xtest` on Rockchip PX30, RK3399 and RK3588 and they all pass, so:
>>
>> Tested-by: Quentin Schulz <[email protected]> # xtest on
>> PX30, RK3399, RK3588
>>
>> We should probably think about also passing ;tag=${PV} to the
> 
> Will this require network connectivity every time the recipe is parsed to
> resolve the tag, even when you have a corresponding snapshot available
> locally?
> 

It used to, but not anymore as far as I understood. Many recipes in 
OE-Core now do have ;tag=${PV} in their SRC_URI and I would expect that 
the project doesn't require network access by default.

See commit d591d7633fe8 ("fetch/git: Rework tag parameter handling") in 
bitbake, available since Walnascar (5.2), which seems to hint that this 
is now possible.

This adds an additional check that the commit hash does really match the 
tag. If the tag moves, then new builds will fail and you'll know that 
something happened upstream and likely requires your attention.

Cheers,
Quentin