[meta-oe][PATCH] nss: fix postinst in do_rootfs for target

[meta-oe][PATCH] nss: fix postinst in do_rootfs for target

[Martin Jansa]

Partially revert "nss: fix postinst script for nativesdk build"

This reverts commit 31552510b15c1c97aa6cbe180c2bb53d139efbcc.

When running in do_rootfs we need to run shlibsign provided
by nss-native, otherwise it fails when /usr/bin/shlibsign
doesn't exist on host builder:

do_rootfs: Postinstall scriptlets of ['nss'] have failed. If the intention is to defer them to first boot,
then please place them into pkg_postinst_ontarget_${PN} ().
Deferring to first boot via 'exit 1' is no longer supported.

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 meta-oe/recipes-support/nss/nss_3.54.bb | 26 ++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/meta-oe/recipes-support/nss/nss_3.54.bb b/meta-oe/recipes-support/nss/nss_3.54.bb
index 882145c1ef..81b2538813 100644
--- a/meta-oe/recipes-support/nss/nss_3.54.bb
+++ b/meta-oe/recipes-support/nss/nss_3.54.bb
@@ -240,19 +240,19 @@ do_install_append_class-target() {
 
 PACKAGE_WRITE_DEPS += "nss-native"
 pkg_postinst_${PN} () {
-    if [ -n "$D" ]; then
-        for I in $D${libdir}/lib*.chk; do
-            DN=`dirname $I`
-            BN=`basename $I .chk`
-            FN=$DN/$BN.so
-            ${bindir}/shlibsign -i $FN
-            if [ $? -ne 0 ]; then
-                exit 1
-            fi
-        done
-    else
-        ${bindir}/signlibs.sh
-    fi
+    for I in $D${libdir}/lib*.chk; do
+        DN=`dirname $I`
+        BN=`basename $I .chk`
+        FN=$DN/$BN.so
+        shlibsign -i $FN
+        if [ $? -ne 0 ]; then
+            echo "shlibsign -i $FN failed"
+        fi
+    done
+}
+
+pkg_postinst_ontarget_${PN} () {
+    ${bindir}/signlibs.sh
 }
 
 PACKAGES =+ "${PN}-smime"
-- 
2.25.1

Re: [oe] [meta-oe][PATCH] nss: fix postinst in do_rootfs for target

[akuster]

On 8/28/20 12:01 PM, Martin Jansa wrote:
> Partially revert "nss: fix postinst script for nativesdk build"
>
> This reverts commit 31552510b15c1c97aa6cbe180c2bb53d139efbcc.
>
> When running in do_rootfs we need to run shlibsign provided
> by nss-native, otherwise it fails when /usr/bin/shlibsign
> doesn't exist on host builder:

this fixes the issue I was seeing.

thanks.
>
> do_rootfs: Postinstall scriptlets of ['nss'] have failed. If the intention is to defer them to first boot,
> then please place them into pkg_postinst_ontarget_${PN} ().
> Deferring to first boot via 'exit 1' is no longer supported.
>
> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> ---
>  meta-oe/recipes-support/nss/nss_3.54.bb | 26 ++++++++++++-------------
>  1 file changed, 13 insertions(+), 13 deletions(-)
>
> diff --git a/meta-oe/recipes-support/nss/nss_3.54.bb b/meta-oe/recipes-support/nss/nss_3.54.bb
> index 882145c1ef..81b2538813 100644
> --- a/meta-oe/recipes-support/nss/nss_3.54.bb
> +++ b/meta-oe/recipes-support/nss/nss_3.54.bb
> @@ -240,19 +240,19 @@ do_install_append_class-target() {
>  
>  PACKAGE_WRITE_DEPS += "nss-native"
>  pkg_postinst_${PN} () {
> -    if [ -n "$D" ]; then
> -        for I in $D${libdir}/lib*.chk; do
> -            DN=`dirname $I`
> -            BN=`basename $I .chk`
> -            FN=$DN/$BN.so
> -            ${bindir}/shlibsign -i $FN
> -            if [ $? -ne 0 ]; then
> -                exit 1
> -            fi
> -        done
> -    else
> -        ${bindir}/signlibs.sh
> -    fi
> +    for I in $D${libdir}/lib*.chk; do
> +        DN=`dirname $I`
> +        BN=`basename $I .chk`
> +        FN=$DN/$BN.so
> +        shlibsign -i $FN
> +        if [ $? -ne 0 ]; then
> +            echo "shlibsign -i $FN failed"
> +        fi
> +    done
> +}
> +
> +pkg_postinst_ontarget_${PN} () {
> +    ${bindir}/signlibs.sh
>  }
>  
>  PACKAGES =+ "${PN}-smime"
>
> 

Re: [oe] [meta-oe][PATCH] nss: fix postinst in do_rootfs for target

[Mikko Rapeli]

Hi,

On Fri, Aug 28, 2020 at 09:01:34PM +0200, Martin Jansa wrote:
> Partially revert "nss: fix postinst script for nativesdk build"
> 
> This reverts commit 31552510b15c1c97aa6cbe180c2bb53d139efbcc.
> 
> When running in do_rootfs we need to run shlibsign provided
> by nss-native, otherwise it fails when /usr/bin/shlibsign
> doesn't exist on host builder:
> 
> do_rootfs: Postinstall scriptlets of ['nss'] have failed. If the intention is to defer them to first boot,
> then please place them into pkg_postinst_ontarget_${PN} ().
> Deferring to first boot via 'exit 1' is no longer supported.

Thanks for this, it fixes all issues.

I didn't properly test my patch. Sorry!

-Mikko

> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> ---
>  meta-oe/recipes-support/nss/nss_3.54.bb | 26 ++++++++++++-------------
>  1 file changed, 13 insertions(+), 13 deletions(-)
> 
> diff --git a/meta-oe/recipes-support/nss/nss_3.54.bb b/meta-oe/recipes-support/nss/nss_3.54.bb
> index 882145c1ef..81b2538813 100644
> --- a/meta-oe/recipes-support/nss/nss_3.54.bb
> +++ b/meta-oe/recipes-support/nss/nss_3.54.bb
> @@ -240,19 +240,19 @@ do_install_append_class-target() {
>
>  PACKAGE_WRITE_DEPS += "nss-native"
>  pkg_postinst_${PN} () {
> -    if [ -n "$D" ]; then
> -        for I in $D${libdir}/lib*.chk; do
> -            DN=`dirname $I`
> -            BN=`basename $I .chk`
> -            FN=$DN/$BN.so
> -            ${bindir}/shlibsign -i $FN
> -            if [ $? -ne 0 ]; then
> -                exit 1
> -            fi
> -        done
> -    else
> -        ${bindir}/signlibs.sh
> -    fi
> +    for I in $D${libdir}/lib*.chk; do
> +        DN=`dirname $I`
> +        BN=`basename $I .chk`
> +        FN=$DN/$BN.so
> +        shlibsign -i $FN
> +        if [ $? -ne 0 ]; then
> +            echo "shlibsign -i $FN failed"
> +        fi
> +    done
> +}
> +
> +pkg_postinst_ontarget_${PN} () {
> +    ${bindir}/signlibs.sh
>  }
>
>  PACKAGES =+ "${PN}-smime"
> -- 
> 2.25.1
> 

> 

Re: [oe] [meta-oe][PATCH] nss: fix postinst in do_rootfs for target

[Martin Jansa]

[-- Attachment #1: Type: text/plain, Size: 3928 bytes --]

Looks like my "solution" also isn't working well at least for images with
read-only-rootfs in IMAGE_FEATURES.

pkg_postinst_ontarget_${PN} is always forced to run on the target, which
for read-only-rootfs results in:
log.do_rootfs:
...
NOTE: If an image is being built, the postinstalls for the following
packages will be postponed for first boot: nss
...
ERROR: The following packages could not be configured offline and rootfs is
read-only: ['nss']

and now looking at the /usr/bin/signlibs.sh:

CHK_FILES=`ls /lib*/*.chk /usr/lib*/*.chk 2>/dev/null`
SIGN_BINARY=`which shlibsign`
for I in $CHK_FILES
do
       DN=`dirname $I`
       BN=`basename $I .chk`
       FN=$DN/$BN.so
       $SIGN_BINARY -i $FN
done

it does pretty much the same as the postinst script when D isn't empty.

From oe-core git history it shows that signlibs.sh was added first:
https://git.openembedded.org/openembedded-core/commit/?id=a4580f967c8064294a06d406acf5deb24aee2acc
then the offline version of postinst was added to support read-only-rootfs
in:
https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
and nss-native should always provide the shlibsign since:
https://git.openembedded.org/openembedded-core/commit/?id=88540c5b08dea069660d1a68e506aebdd68e6ae0
and only after
https://git.openembedded.org/openembedded-core/commit/?id=8f782f7095e718dd9452055af53363beb6bdbece
it looked like signlibs.sh was something special only for target.

So it looks to me, that we should just remove signlibs.sh script and let
the same postinst be used on target and offline
(with or without D being empty).

Cheers,

On Mon, Aug 31, 2020 at 9:45 AM <Mikko.Rapeli@bmw.de> wrote:

> Hi,
>
> On Fri, Aug 28, 2020 at 09:01:34PM +0200, Martin Jansa wrote:
> > Partially revert "nss: fix postinst script for nativesdk build"
> >
> > This reverts commit 31552510b15c1c97aa6cbe180c2bb53d139efbcc.
> >
> > When running in do_rootfs we need to run shlibsign provided
> > by nss-native, otherwise it fails when /usr/bin/shlibsign
> > doesn't exist on host builder:
> >
> > do_rootfs: Postinstall scriptlets of ['nss'] have failed. If the
> intention is to defer them to first boot,
> > then please place them into pkg_postinst_ontarget_${PN} ().
> > Deferring to first boot via 'exit 1' is no longer supported.
>
> Thanks for this, it fixes all issues.
>
> I didn't properly test my patch. Sorry!
>
> -Mikko
>
> > Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> > ---
> >  meta-oe/recipes-support/nss/nss_3.54.bb | 26 ++++++++++++-------------
> >  1 file changed, 13 insertions(+), 13 deletions(-)
> >
> > diff --git a/meta-oe/recipes-support/nss/nss_3.54.bb
> b/meta-oe/recipes-support/nss/nss_3.54.bb
> > index 882145c1ef..81b2538813 100644
> > --- a/meta-oe/recipes-support/nss/nss_3.54.bb
> > +++ b/meta-oe/recipes-support/nss/nss_3.54.bb
> > @@ -240,19 +240,19 @@ do_install_append_class-target() {
> >
> >  PACKAGE_WRITE_DEPS += "nss-native"
> >  pkg_postinst_${PN} () {
> > -    if [ -n "$D" ]; then
> > -        for I in $D${libdir}/lib*.chk; do
> > -            DN=`dirname $I`
> > -            BN=`basename $I .chk`
> > -            FN=$DN/$BN.so
> > -            ${bindir}/shlibsign -i $FN
> > -            if [ $? -ne 0 ]; then
> > -                exit 1
> > -            fi
> > -        done
> > -    else
> > -        ${bindir}/signlibs.sh
> > -    fi
> > +    for I in $D${libdir}/lib*.chk; do
> > +        DN=`dirname $I`
> > +        BN=`basename $I .chk`
> > +        FN=$DN/$BN.so
> > +        shlibsign -i $FN
> > +        if [ $? -ne 0 ]; then
> > +            echo "shlibsign -i $FN failed"
> > +        fi
> > +    done
> > +}
> > +
> > +pkg_postinst_ontarget_${PN} () {
> > +    ${bindir}/signlibs.sh
> >  }
> >
> >  PACKAGES =+ "${PN}-smime"
> > --
> > 2.25.1
> >
>
> > 
>

[-- Attachment #2: Type: text/html, Size: 5940 bytes --]

[meta-oe][PATCH] nss: remove signlibs.sh

[Martin Jansa]

Looks like my "solution" also isn't working well at least for images with read-only-rootfs in IMAGE_FEATURES.

pkg_postinst_ontarget_${PN} is always forced to run on the target, which for read-only-rootfs results in:
log.do_rootfs:
...
NOTE: If an image is being built, the postinstalls for the following packages will be postponed for first boot: nss
...
ERROR: The following packages could not be configured offline and rootfs is read-only: ['nss']

and now looking at the /usr/bin/signlibs.sh and it does pretty much
the same as the postinst script when D isn't empty.

From oe-core git history it shows that signlibs.sh was added first:
https://git.openembedded.org/openembedded-core/commit/?id=a4580f967c8064294a06d406acf5deb24aee2acc
then the offline version of postinst was added to support read-only-rootfs in:
https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
and nss-native should always provide the shlibsign since:
https://git.openembedded.org/openembedded-core/commit/?id=88540c5b08dea069660d1a68e506aebdd68e6ae0
and only after
https://git.openembedded.org/openembedded-core/commit/?id=8f782f7095e718dd9452055af53363beb6bdbece
it looked like signlibs.sh was something special only for target.

So it looks to me, that we should just remove signlibs.sh script and let the same postinst be used on target and offline
(with or without D being empty).

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 meta-oe/recipes-support/nss/nss/signlibs.sh | 20 --------------------
 meta-oe/recipes-support/nss/nss_3.56.bb     |  6 ------
 2 files changed, 26 deletions(-)
 delete mode 100644 meta-oe/recipes-support/nss/nss/signlibs.sh

diff --git a/meta-oe/recipes-support/nss/nss/signlibs.sh b/meta-oe/recipes-support/nss/nss/signlibs.sh
deleted file mode 100644
index a74e499f8c..0000000000
--- a/meta-oe/recipes-support/nss/nss/signlibs.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-
-# signlibs.sh
-#
-# (c)2010 Wind River Systems, Inc.
-#
-# regenerates the .chk files for the NSS libraries that require it
-# since the ones that are built have incorrect checksums that were
-# calculated on the host where they really need to be done on the
-# target
-
-CHK_FILES=`ls /lib*/*.chk /usr/lib*/*.chk 2>/dev/null`
-SIGN_BINARY=`which shlibsign`
-for I in $CHK_FILES
-do
-       DN=`dirname $I`
-       BN=`basename $I .chk`
-       FN=$DN/$BN.so
-       $SIGN_BINARY -i $FN
-done
diff --git a/meta-oe/recipes-support/nss/nss_3.56.bb b/meta-oe/recipes-support/nss/nss_3.56.bb
index 107b0a0152..997f8950fd 100644
--- a/meta-oe/recipes-support/nss/nss_3.56.bb
+++ b/meta-oe/recipes-support/nss/nss_3.56.bb
@@ -21,7 +21,6 @@ VERSION_DIR = "${@d.getVar('BP').upper().replace('-', '_').replace('.', '_') + '
 
 SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSION_DIR}/src/${BP}.tar.gz \
            file://nss.pc.in \
-           file://signlibs.sh \
            file://0001-nss-fix-support-cross-compiling.patch \
            file://nss-no-rpath-for-cross-compiling.patch \
            file://nss-fix-incorrect-shebang-of-perl.patch \
@@ -214,7 +213,6 @@ do_install_append() {
         touch ${D}/${libdir}/$file
         chmod 755 ${D}/${libdir}/$file
     done
-    install -D -m 755 ${WORKDIR}/signlibs.sh ${D}/${bindir}/signlibs.sh
 
     install -d ${D}${libdir}/pkgconfig/
     sed 's/%NSS_VERSION%/${PV}/' ${WORKDIR}/nss.pc.in | sed 's/%NSPR_VERSION%/4.9.2/' > ${D}${libdir}/pkgconfig/nss.pc
@@ -251,10 +249,6 @@ pkg_postinst_${PN} () {
     done
 }
 
-pkg_postinst_ontarget_${PN} () {
-    ${bindir}/signlibs.sh
-}
-
 PACKAGES =+ "${PN}-smime"
 FILES_${PN}-smime = "\
     ${bindir}/smime \
-- 
2.25.1

Re: [oe] [meta-oe][PATCH] nss: remove signlibs.sh

[Khem Raj]

On Tue, Sep 1, 2020 at 3:41 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
>
> Looks like my "solution" also isn't working well at least for images with read-only-rootfs in IMAGE_FEATURES.
>
> pkg_postinst_ontarget_${PN} is always forced to run on the target, which for read-only-rootfs results in:
> log.do_rootfs:
> ...
> NOTE: If an image is being built, the postinstalls for the following packages will be postponed for first boot: nss
> ...
> ERROR: The following packages could not be configured offline and rootfs is read-only: ['nss']
>
> and now looking at the /usr/bin/signlibs.sh and it does pretty much
> the same as the postinst script when D isn't empty.
>
> From oe-core git history it shows that signlibs.sh was added first:
> https://git.openembedded.org/openembedded-core/commit/?id=a4580f967c8064294a06d406acf5deb24aee2acc
> then the offline version of postinst was added to support read-only-rootfs in:
> https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
> and nss-native should always provide the shlibsign since:
> https://git.openembedded.org/openembedded-core/commit/?id=88540c5b08dea069660d1a68e506aebdd68e6ae0
> and only after
> https://git.openembedded.org/openembedded-core/commit/?id=8f782f7095e718dd9452055af53363beb6bdbece
> it looked like signlibs.sh was something special only for target.
>
> So it looks to me, that we should just remove signlibs.sh script and let the same postinst be used on target and offline
> (with or without D being empty).
>
> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> ---
>  meta-oe/recipes-support/nss/nss/signlibs.sh | 20 --------------------
>  meta-oe/recipes-support/nss/nss_3.56.bb     |  6 ------
>  2 files changed, 26 deletions(-)
>  delete mode 100644 meta-oe/recipes-support/nss/nss/signlibs.sh
>
> diff --git a/meta-oe/recipes-support/nss/nss/signlibs.sh b/meta-oe/recipes-support/nss/nss/signlibs.sh
> deleted file mode 100644
> index a74e499f8c..0000000000
> --- a/meta-oe/recipes-support/nss/nss/signlibs.sh
> +++ /dev/null
> @@ -1,20 +0,0 @@
> -#!/bin/sh
> -
> -# signlibs.sh
> -#
> -# (c)2010 Wind River Systems, Inc.
> -#
> -# regenerates the .chk files for the NSS libraries that require it
> -# since the ones that are built have incorrect checksums that were
> -# calculated on the host where they really need to be done on the
> -# target
> -

if we remove this then how do we solve above said issue? is it still an issue ?

> -CHK_FILES=`ls /lib*/*.chk /usr/lib*/*.chk 2>/dev/null`
> -SIGN_BINARY=`which shlibsign`
> -for I in $CHK_FILES
> -do
> -       DN=`dirname $I`
> -       BN=`basename $I .chk`
> -       FN=$DN/$BN.so
> -       $SIGN_BINARY -i $FN
> -done
> diff --git a/meta-oe/recipes-support/nss/nss_3.56.bb b/meta-oe/recipes-support/nss/nss_3.56.bb
> index 107b0a0152..997f8950fd 100644
> --- a/meta-oe/recipes-support/nss/nss_3.56.bb
> +++ b/meta-oe/recipes-support/nss/nss_3.56.bb
> @@ -21,7 +21,6 @@ VERSION_DIR = "${@d.getVar('BP').upper().replace('-', '_').replace('.', '_') + '
>
>  SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSION_DIR}/src/${BP}.tar.gz \
>             file://nss.pc.in \
> -           file://signlibs.sh \
>             file://0001-nss-fix-support-cross-compiling.patch \
>             file://nss-no-rpath-for-cross-compiling.patch \
>             file://nss-fix-incorrect-shebang-of-perl.patch \
> @@ -214,7 +213,6 @@ do_install_append() {
>          touch ${D}/${libdir}/$file
>          chmod 755 ${D}/${libdir}/$file
>      done
> -    install -D -m 755 ${WORKDIR}/signlibs.sh ${D}/${bindir}/signlibs.sh
>
>      install -d ${D}${libdir}/pkgconfig/
>      sed 's/%NSS_VERSION%/${PV}/' ${WORKDIR}/nss.pc.in | sed 's/%NSPR_VERSION%/4.9.2/' > ${D}${libdir}/pkgconfig/nss.pc
> @@ -251,10 +249,6 @@ pkg_postinst_${PN} () {
>      done
>  }
>
> -pkg_postinst_ontarget_${PN} () {
> -    ${bindir}/signlibs.sh
> -}
> -
>  PACKAGES =+ "${PN}-smime"
>  FILES_${PN}-smime = "\
>      ${bindir}/smime \
> --
> 2.25.1
>
> 

Re: [oe] [meta-oe][PATCH] nss: remove signlibs.sh

[Martin Jansa]

[-- Attachment #1: Type: text/plain, Size: 4738 bytes --]

On Tue, Sep 01, 2020 at 04:16:15PM -0700, Khem Raj wrote:
> On Tue, Sep 1, 2020 at 3:41 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
> >
> > Looks like my "solution" also isn't working well at least for images with read-only-rootfs in IMAGE_FEATURES.
> >
> > pkg_postinst_ontarget_${PN} is always forced to run on the target, which for read-only-rootfs results in:
> > log.do_rootfs:
> > ...
> > NOTE: If an image is being built, the postinstalls for the following packages will be postponed for first boot: nss
> > ...
> > ERROR: The following packages could not be configured offline and rootfs is read-only: ['nss']
> >
> > and now looking at the /usr/bin/signlibs.sh and it does pretty much
> > the same as the postinst script when D isn't empty.
> >
> > From oe-core git history it shows that signlibs.sh was added first:
> > https://git.openembedded.org/openembedded-core/commit/?id=a4580f967c8064294a06d406acf5deb24aee2acc
> > then the offline version of postinst was added to support read-only-rootfs in:
> > https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
> > and nss-native should always provide the shlibsign since:
> > https://git.openembedded.org/openembedded-core/commit/?id=88540c5b08dea069660d1a68e506aebdd68e6ae0
> > and only after
> > https://git.openembedded.org/openembedded-core/commit/?id=8f782f7095e718dd9452055af53363beb6bdbece
> > it looked like signlibs.sh was something special only for target.
> >
> > So it looks to me, that we should just remove signlibs.sh script and let the same postinst be used on target and offline
> > (with or without D being empty).
> >
> > Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> > ---
> >  meta-oe/recipes-support/nss/nss/signlibs.sh | 20 --------------------
> >  meta-oe/recipes-support/nss/nss_3.56.bb     |  6 ------
> >  2 files changed, 26 deletions(-)
> >  delete mode 100644 meta-oe/recipes-support/nss/nss/signlibs.sh
> >
> > diff --git a/meta-oe/recipes-support/nss/nss/signlibs.sh b/meta-oe/recipes-support/nss/nss/signlibs.sh
> > deleted file mode 100644
> > index a74e499f8c..0000000000
> > --- a/meta-oe/recipes-support/nss/nss/signlibs.sh
> > +++ /dev/null
> > @@ -1,20 +0,0 @@
> > -#!/bin/sh
> > -
> > -# signlibs.sh
> > -#
> > -# (c)2010 Wind River Systems, Inc.
> > -#
> > -# regenerates the .chk files for the NSS libraries that require it
> > -# since the ones that are built have incorrect checksums that were
> > -# calculated on the host where they really need to be done on the
> > -# target
> > -
> 
> if we remove this then how do we solve above said issue? is it still an issue ?

I think above said issue was resolved in 2013 with:
https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8

since then nobody should be running signlibs.sh on target (if it was
already finished in do_rootfs) and if it works offline for read-only-rootfs
then it doesn't really run on the target, right?

> 
> > -CHK_FILES=`ls /lib*/*.chk /usr/lib*/*.chk 2>/dev/null`
> > -SIGN_BINARY=`which shlibsign`
> > -for I in $CHK_FILES
> > -do
> > -       DN=`dirname $I`
> > -       BN=`basename $I .chk`
> > -       FN=$DN/$BN.so
> > -       $SIGN_BINARY -i $FN
> > -done
> > diff --git a/meta-oe/recipes-support/nss/nss_3.56.bb b/meta-oe/recipes-support/nss/nss_3.56.bb
> > index 107b0a0152..997f8950fd 100644
> > --- a/meta-oe/recipes-support/nss/nss_3.56.bb
> > +++ b/meta-oe/recipes-support/nss/nss_3.56.bb
> > @@ -21,7 +21,6 @@ VERSION_DIR = "${@d.getVar('BP').upper().replace('-', '_').replace('.', '_') + '
> >
> >  SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSION_DIR}/src/${BP}.tar.gz \
> >             file://nss.pc.in \
> > -           file://signlibs.sh \
> >             file://0001-nss-fix-support-cross-compiling.patch \
> >             file://nss-no-rpath-for-cross-compiling.patch \
> >             file://nss-fix-incorrect-shebang-of-perl.patch \
> > @@ -214,7 +213,6 @@ do_install_append() {
> >          touch ${D}/${libdir}/$file
> >          chmod 755 ${D}/${libdir}/$file
> >      done
> > -    install -D -m 755 ${WORKDIR}/signlibs.sh ${D}/${bindir}/signlibs.sh
> >
> >      install -d ${D}${libdir}/pkgconfig/
> >      sed 's/%NSS_VERSION%/${PV}/' ${WORKDIR}/nss.pc.in | sed 's/%NSPR_VERSION%/4.9.2/' > ${D}${libdir}/pkgconfig/nss.pc
> > @@ -251,10 +249,6 @@ pkg_postinst_${PN} () {
> >      done
> >  }
> >
> > -pkg_postinst_ontarget_${PN} () {
> > -    ${bindir}/signlibs.sh
> > -}
> > -
> >  PACKAGES =+ "${PN}-smime"
> >  FILES_${PN}-smime = "\
> >      ${bindir}/smime \
> > --
> > 2.25.1
> >
> > 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 201 bytes --]

Re: [oe] [meta-oe][PATCH] nss: remove signlibs.sh

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 5423 bytes --]

Correct.

On Tue, Sep 1, 2020 at 5:03 PM Martin Jansa <martin.jansa@gmail.com> wrote:

> On Tue, Sep 01, 2020 at 04:16:15PM -0700, Khem Raj wrote:
>
> > On Tue, Sep 1, 2020 at 3:41 PM Martin Jansa <Martin.Jansa@gmail.com>
> wrote:
>
> > >
>
> > > Looks like my "solution" also isn't working well at least for images
> with read-only-rootfs in IMAGE_FEATURES.
>
> > >
>
> > > pkg_postinst_ontarget_${PN} is always forced to run on the target,
> which for read-only-rootfs results in:
>
> > > log.do_rootfs:
>
> > > ...
>
> > > NOTE: If an image is being built, the postinstalls for the following
> packages will be postponed for first boot: nss
>
> > > ...
>
> > > ERROR: The following packages could not be configured offline and
> rootfs is read-only: ['nss']
>
> > >
>
> > > and now looking at the /usr/bin/signlibs.sh and it does pretty much
>
> > > the same as the postinst script when D isn't empty.
>
> > >
>
> > > From oe-core git history it shows that signlibs.sh was added first:
>
> > >
> https://git.openembedded.org/openembedded-core/commit/?id=a4580f967c8064294a06d406acf5deb24aee2acc
>
> > > then the offline version of postinst was added to support
> read-only-rootfs in:
>
> > >
> https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
>
> > > and nss-native should always provide the shlibsign since:
>
> > >
> https://git.openembedded.org/openembedded-core/commit/?id=88540c5b08dea069660d1a68e506aebdd68e6ae0
>
> > > and only after
>
> > >
> https://git.openembedded.org/openembedded-core/commit/?id=8f782f7095e718dd9452055af53363beb6bdbece
>
> > > it looked like signlibs.sh was something special only for target.
>
> > >
>
> > > So it looks to me, that we should just remove signlibs.sh script and
> let the same postinst be used on target and offline
>
> > > (with or without D being empty).
>
> > >
>
> > > Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
>
> > > ---
>
> > >  meta-oe/recipes-support/nss/nss/signlibs.sh | 20 --------------------
>
> > >  meta-oe/recipes-support/nss/nss_3.56.bb     |  6 ------
>
> > >  2 files changed, 26 deletions(-)
>
> > >  delete mode 100644 meta-oe/recipes-support/nss/nss/signlibs.sh
>
> > >
>
> > > diff --git a/meta-oe/recipes-support/nss/nss/signlibs.sh
> b/meta-oe/recipes-support/nss/nss/signlibs.sh
>
> > > deleted file mode 100644
>
> > > index a74e499f8c..0000000000
>
> > > --- a/meta-oe/recipes-support/nss/nss/signlibs.sh
>
> > > +++ /dev/null
>
> > > @@ -1,20 +0,0 @@
>
> > > -#!/bin/sh
>
> > > -
>
> > > -# signlibs.sh
>
> > > -#
>
> > > -# (c)2010 Wind River Systems, Inc.
>
> > > -#
>
> > > -# regenerates the .chk files for the NSS libraries that require it
>
> > > -# since the ones that are built have incorrect checksums that were
>
> > > -# calculated on the host where they really need to be done on the
>
> > > -# target
>
> > > -
>
> >
>
> > if we remove this then how do we solve above said issue? is it still an
> issue ?
>
>
>
> I think above said issue was resolved in 2013 with:
>
>
> https://git.openembedded.org/openembedded-core/commit/?id=64e87fc6e99bc1d4807034166735034b1f92bad8
>
>
>
> since then nobody should be running signlibs.sh on target (if it was
>
> already finished in do_rootfs) and if it works offline for read-only-rootfs
>
> then it doesn't really run on the target, right?
>
>
>
> >
>
> > > -CHK_FILES=`ls /lib*/*.chk /usr/lib*/*.chk 2>/dev/null`
>
> > > -SIGN_BINARY=`which shlibsign`
>
> > > -for I in $CHK_FILES
>
> > > -do
>
> > > -       DN=`dirname $I`
>
> > > -       BN=`basename $I .chk`
>
> > > -       FN=$DN/$BN.so
>
> > > -       $SIGN_BINARY -i $FN
>
> > > -done
>
> > > diff --git a/meta-oe/recipes-support/nss/nss_3.56.bb
> b/meta-oe/recipes-support/nss/nss_3.56.bb
>
> > > index 107b0a0152..997f8950fd 100644
>
> > > --- a/meta-oe/recipes-support/nss/nss_3.56.bb
>
> > > +++ b/meta-oe/recipes-support/nss/nss_3.56.bb
>
> > > @@ -21,7 +21,6 @@ VERSION_DIR =
> "${@d.getVar('BP').upper().replace('-', '_').replace('.', '_') + '
>
> > >
>
> > >  SRC_URI = "
> http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSION_DIR}/src/${BP}.tar.gz
> \
>
> > >             file://nss.pc.in \
>
> > > -           file://signlibs.sh \
>
> > >             file://0001-nss-fix-support-cross-compiling.patch \
>
> > >             file://nss-no-rpath-for-cross-compiling.patch \
>
> > >             file://nss-fix-incorrect-shebang-of-perl.patch \
>
> > > @@ -214,7 +213,6 @@ do_install_append() {
>
> > >          touch ${D}/${libdir}/$file
>
> > >          chmod 755 ${D}/${libdir}/$file
>
> > >      done
>
> > > -    install -D -m 755 ${WORKDIR}/signlibs.sh
> ${D}/${bindir}/signlibs.sh
>
> > >
>
> > >      install -d ${D}${libdir}/pkgconfig/
>
> > >      sed 's/%NSS_VERSION%/${PV}/' ${WORKDIR}/nss.pc.in | sed
> 's/%NSPR_VERSION%/4.9.2/' > ${D}${libdir}/pkgconfig/nss.pc
>
> > > @@ -251,10 +249,6 @@ pkg_postinst_${PN} () {
>
> > >      done
>
> > >  }
>
> > >
>
> > > -pkg_postinst_ontarget_${PN} () {
>
> > > -    ${bindir}/signlibs.sh
>
> > > -}
>
> > > -
>
> > >  PACKAGES =+ "${PN}-smime"
>
> > >  FILES_${PN}-smime = "\
>
> > >      ${bindir}/smime \
>
> > > --
>
> > > 2.25.1
>
> > >
>
> > > 
>
>

[-- Attachment #2: Type: text/html, Size: 8048 bytes --]