Re: Yocto compatibility for meta-security layer

Hello Yi,
Thank you for your messages. There is work in progress to modernize the
layer. If you already have patches that fix those issues, they are more
than welcome!

Kind regards,
Marta

On Tue, Aug 5, 2025 at 8:26 AM Yi Zhao <[email protected]> wrote:

> Hi folks,
>
>
> I used yocto-check-layer to check Yocto compatibility of meta-security.
> The tool reported the following failures in meta-security layer:
>
> INFO: FAIL: test_security (common.CommonCheckLayer)
> INFO:
> ----------------------------------------------------------------------
> INFO: Traceback (most recent call last):
>    File "poky/scripts/lib/checklayer/cases/common.py", line 70, in
> test_security
>      self.assertTrue(filename, msg="Layer doesn't contain a SECURITY.md
> file.")
> AssertionError: None is not true : Layer doesn't contain a SECURITY.md
> file.
>
>
> INFO: FAIL: test_signatures (common.CommonCheckLayer)
> INFO:
> ----------------------------------------------------------------------
> INFO: Traceback (most recent call last):
>    File "poky/scripts/lib/checklayer/cases/common.py", line 130, in
> test_signatures
>      self.fail('Adding layer %s changed signatures.\n%s' %
> (self.tc.layer['name'], msg))
> AssertionError: Adding layer meta-security changed signatures.
> 32 signatures changed, initial differences (first hash before, second
> after):
>     libmspack:do_recipe_qa:
> c95ae911bfeba96c673fd11d13933da5bee4df3a21e93b6b764ad47b7bceeaca ->
> 2381779674028e9ef4608e56fb2159dc11f37d0c6b24050dc5da7069cdb25505
>        bitbake-diffsigs --task libmspack do_recipe_qa --signature
> c95ae911bfeba96c673fd11d13933da5bee4df3a21e93b6b764ad47b7bceeaca
> 2381779674028e9ef4608e56fb2159dc11f37d0c6b24050dc5da7069cdb25505
>        NOTE: Reconnecting to bitbake server...
>        Task dependencies changed from:
>        ['HOMEPAGE', 'INSANE_SKIP', 'OE_SHARED_UMASK', 'PACKAGECONFIG',
> 'PN', 'PR', 'PV', 'QA_ERRORS_FOUND', 'RECIPE_MAINTAINER', 'SRC_URI',
> 'SRC_URI[sha256sum]', 'SSTATECREATEFUNCS', 'SSTATEPOSTCREATEFUNCS', 'SS
> TATEPOSTUNPACKFUNCS', 'SSTATE_BUILDDIR', 'SSTATE_INSTDIR',
> 'SSTATE_MANIFESTS', 'SSTATE_SCAN_FILES', 'SSTATE_SKIP_CREATION',
> 'SUMMARY', 'do_recipe_qa[network]', 'do_recipe_qa[sstate-inputdirs]',
> 'oe.path.copyhar
> dlinktree', 'oe.path.copytree', 'oe.path.remove',
> 'oe.qa.exit_if_errors', 'oe.qa.exit_with_message_if_errors',
> 'oe.sstatesig.sstate_get_manifest_filename', 'sstate_add',
> 'sstate_clean', 'sstate_clean_manifest',
>   'sstate_init', 'sstate_install', 'sstate_installpkgdir',
> 'sstate_package', 'sstate_state_fromvars', 'sstate_task_postfunc',
> 'sstate_task_prefunc']
>        to:
>        ['HOMEPAGE', 'INSANE_SKIP', 'OE_SHARED_UMASK', 'PACKAGECONFIG',
> 'PN', 'PR', 'PV', 'QA_ERRORS_FOUND', 'RECIPE_MAINTAINER', 'SRC_URI',
> 'SSTATECREATEFUNCS', 'SSTATEPOSTCREATEFUNCS', 'SSTATEPOSTUNPACKFUNCS',
> 'SSTATE_BUILDDIR', 'SSTATE_INSTDIR', 'SSTATE_MANIFESTS',
> 'SSTATE_SCAN_FILES', 'SSTATE_SKIP_CREATION', 'SUMMARY',
> 'do_recipe_qa[network]', 'do_recipe_qa[sstate-inputdirs]',
> 'oe.path.copyhardlinktree', 'oe.path.c
> opytree', 'oe.path.remove', 'oe.qa.exit_if_errors',
> 'oe.qa.exit_with_message_if_errors',
> 'oe.sstatesig.sstate_get_manifest_filename', 'sstate_add',
> 'sstate_clean', 'sstate_clean_manifest', 'sstate_init', 'sstat
> e_install', 'sstate_installpkgdir', 'sstate_package',
> 'sstate_state_fromvars', 'sstate_task_postfunc', 'sstate_task_prefunc']
>        basehash changed from
> 7389c2b644a0cbe3efb08eb36e79682648583737171690342d91f61f860d82b9 to
> 3c44df2e06825629c6dd1be4b7e660fda1c4dc9155908baef64f3cb366cf42c2
>        List of dependencies for variable SRC_URI changed from
> 'frozenset({'SRC_URI[sha256sum]', 'PV'})' to 'frozenset()'
>        Dependency on Variable SRC_URI[sha256sum] was removed
>        Variable PV value changed from '0.11alpha' to '1.11'
>        Variable SRC_URI value changed from
> 'https://www.cabextract.org.uk/libmspack/libmspack-${PV}.tar.gz' to
> 'git://github.com/kyz/libmspack.git;branch=master;protocol=https'
>
>
> INFO: FAIL: test_signatures (common.CommonCheckLayer)
> INFO:
> ----------------------------------------------------------------------
> INFO: Traceback (most recent call last):
>    File "poky/scripts/lib/checklayer/cases/common.py", line 130, in
> test_signatures
>      self.fail('Adding layer %s changed signatures.\n%s' %
> (self.tc.layer['name'], msg))
> AssertionError: Adding layer meta-tpm changed signatures.
> 22 signatures changed, initial differences (first hash before, second
> after):
>     systemd-boot:do_configure:
> 1ac6cccd94f468f2c258666e57b8f57338e63a85ba293abe360bd9440852da93 ->
> 376daf18bae87ebdfddd9c9ab6bf95bfe06a830eea45bb8ade914de66e3f4fae
>        bitbake-diffsigs --task systemd-boot do_configure --signature
> 1ac6cccd94f468f2c258666e57b8f57338e63a85ba293abe360bd9440852da93
> 376daf18bae87ebdfddd9c9ab6bf95bfe06a830eea45bb8ade914de66e3f4fae
>        NOTE: Reconnecting to bitbake server...
>        basehash changed from
> 5af44540c3f151f0ffc33e381a6694b6b193b0494207170656323588ee0ccc4c to
> 236e8f11f35d1dfebcb81c286f3ac82353cb92c78835a4064888a8a0c7aa405c
>        Variable EXTRA_OEMESON value changed:
>        @@ -1 +1,2 @@
>        - -Defi=true -Dbootloader=true                   -Dman=false
> ${PACKAGECONFIG_CONFARGS}
>        + -Defi=true -Dbootloader=true                   -Dman=false
> ${PACKAGECONFIG_CONFARGS} ${@bb.utils.contains('DISTRO_FEATURES',
> 'tpm2', '-Dtpm2=true', '', d)}
>        +DISTRO_FEATURES{tpm2} = Unset
>
>
> INFO: FAIL: test_signatures (common.CommonCheckLayer)
> INFO:
> ----------------------------------------------------------------------
> INFO: Traceback (most recent call last):
>    File "poky/scripts/lib/checklayer/cases/common.py", line 130, in
> test_signatures
>      self.fail('Adding layer %s changed signatures.\n%s' %
> (self.tc.layer['name'], msg))
> AssertionError: Adding layer meta-integrity changed signatures.
> 209 signatures changed, initial differences (first hash before, second
> after):
>     linux-yocto:do_kernel_metadata:
> 3a727f91c23ce583b5fc28f0e052fb118a79ce2f2bcc70e36db9774a2d7b3be0 ->
> 6b3ea68b9a0f4feb86e074801010f82bcd0b0024ee25ea654b5c81bbb566a382
>        bitbake-diffsigs --task linux-yocto do_kernel_metadata
> --signature
> 3a727f91c23ce583b5fc28f0e052fb118a79ce2f2bcc70e36db9774a2d7b3be0
> 6b3ea68b9a0f4feb86e074801010f82bcd0b0024ee25ea654b5c81bbb566a382
>        NOTE: Reconnecting to bitbake server...
>        Dependency on checksum of file ./audit.cfg was added
>
>
>
> Here is the command I ran:
> $ yocto-check-layer-wrapper ../meta-security --dependency ../meta
> ../meta-openembedded/meta-oe ../meta-openembedded/meta-python/
> ../meta-clang --no-auto-dependency
>
>
>
> Thanks,
> Yi
>
>