[meta-virtualization][PATCH 1/5] nagios-*: add conditional PNBLACKLIST, because of the dependency on meta-webserver

[meta-virtualization][PATCH 1/5] nagios-*: add conditional PNBLACKLIST, because of the dependency on meta-webserver

[Martin Jansa]

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 recipes-extended/nagios/nagios-core_4.4.6.bb    | 2 ++
 recipes-extended/nagios/nagios-nrpe_4.0.2.bb    | 2 ++
 recipes-extended/nagios/nagios-nsca_2.9.2.bb    | 2 ++
 recipes-extended/nagios/nagios-plugins_2.2.1.bb | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/recipes-extended/nagios/nagios-core_4.4.6.bb b/recipes-extended/nagios/nagios-core_4.4.6.bb
index 8bcd6c0..fc3d2c5 100644
--- a/recipes-extended/nagios/nagios-core_4.4.6.bb
+++ b/recipes-extended/nagios/nagios-core_4.4.6.bb
@@ -38,6 +38,8 @@ RDEPENDS_${PN} += "\
     nagios-base \
 "
 
+PNBLACKLIST[nagios-core] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on apache2 from meta-webserver which is not included', d)}"
+
 acpaths = "-I ${S}/autoconf-macros"
 
 # Set default password for the hardcoded Nagios admin user "nagiosadmin".
diff --git a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
index d9c7b15..7f81172 100644
--- a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
+++ b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
@@ -26,6 +26,8 @@ S = "${WORKDIR}/${SRCNAME}-${PV}"
 
 inherit autotools-brokensep update-rc.d systemd update-alternatives
 
+PNBLACKLIST[nagios-nrpe] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
+
 # IP address of server which proxy should connect to
 MONITORING_PROXY_SERVER_IP ??= "192.168.7.2"
 
diff --git a/recipes-extended/nagios/nagios-nsca_2.9.2.bb b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
index 66f8da5..1fce198 100644
--- a/recipes-extended/nagios/nagios-nsca_2.9.2.bb
+++ b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
@@ -22,6 +22,8 @@ S = "${WORKDIR}/${SRCNAME}-${PV}"
 
 inherit update-rc.d autotools-brokensep systemd dos2unix
 
+PNBLACKLIST[nagios-nsca] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Rdepends on nagios-base provided by nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
+
 DEPENDS = "libmcrypt"
 
 EXTRA_OECONF += "--with-nsca-user=${NAGIOS_USER} \
diff --git a/recipes-extended/nagios/nagios-plugins_2.2.1.bb b/recipes-extended/nagios/nagios-plugins_2.2.1.bb
index 0793365..b97d80c 100644
--- a/recipes-extended/nagios/nagios-plugins_2.2.1.bb
+++ b/recipes-extended/nagios/nagios-plugins_2.2.1.bb
@@ -18,6 +18,8 @@ S = "${WORKDIR}/${BPN}-${PV}"
 
 inherit autotools gettext
 
+PNBLACKLIST[nagios-plugins] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
+
 EXTRA_OECONF += "--with-sysroot=${STAGING_DIR_HOST} \
                  --with-nagios-user=${NAGIOS_USER} \
                  --with-nagios-group=${NAGIOS_GROUP} \
-- 
2.30.2

[meta-virtualization][PATCH 2/5] ipxe: add the same COMPATIBLE_HOST restriction as syslinux

[Martin Jansa]

* this depends on syslinux

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 recipes-extended/ipxe/ipxe_git.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/recipes-extended/ipxe/ipxe_git.bb b/recipes-extended/ipxe/ipxe_git.bb
index d7c60ab..7b76817 100644
--- a/recipes-extended/ipxe/ipxe_git.bb
+++ b/recipes-extended/ipxe/ipxe_git.bb
@@ -4,6 +4,9 @@ LICENSE = "GPLv2"
 DEPENDS = "binutils-native perl-native syslinux mtools-native cdrtools-native xz"
 LIC_FILES_CHKSUM = "file://../COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 
+# syslinux has this restriction
+COMPATIBLE_HOST_class-target = '(x86_64|i.86).*-(linux|freebsd.*)'
+
 SRCREV = "18dc73d27edb55ebe9cb13c58d59af3da3bd374b"
 PV = "gitr${SRCPV}"
 PR = "r0"
-- 
2.30.2

[meta-virtualization][PATCH 3/5] cri-o, podman, packagegroup-container: replace anonymous python function calling bb.parse.SkipRecipe with conditional PNBLACKLISTs

[Martin Jansa]

* PNBLACKLISTs are IMHO a bit easier to read and easier to override from distro
  which e.g. provides own recipe for libseccomp

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 recipes-containers/cri-o/cri-o_git.bb            | 16 +---------------
 recipes-containers/podman/podman_git.bb          | 10 +---------
 .../packagegroups/packagegroup-container.bb      | 10 +---------
 3 files changed, 3 insertions(+), 33 deletions(-)

diff --git a/recipes-containers/cri-o/cri-o_git.bb b/recipes-containers/cri-o/cri-o_git.bb
index 2d6187a..0ac5ddc 100644
--- a/recipes-containers/cri-o/cri-o_git.bb
+++ b/recipes-containers/cri-o/cri-o_git.bb
@@ -43,21 +43,7 @@ RDEPENDS_${PN} = " \
     libdevmapper \
     "
 
-python __anonymous() {
-    msg = ""
-    # ERROR: Nothing PROVIDES 'libseccomp' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
-    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
-    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libseccomp']
-    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
-        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
-        raise bb.parse.SkipRecipe(msg)
-    # ERROR: Nothing PROVIDES 'libselinux' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
-    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
-    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libselinux']
-    elif 'selinux' not in d.getVar('BBFILE_COLLECTIONS').split():
-        msg += "Make sure meta-selinux should be present as it provides 'libselinux'"
-        raise bb.parse.SkipRecipe(msg)
-}
+PNBLACKLIST[cri-o] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', bb.utils.contains('BBFILE_COLLECTIONS', 'selinux', '', 'Depends on libselinux from meta-selinux which is not included', d), 'Depends on libseccomp from meta-security which is not included', d)}"
 
 PACKAGES =+ "${PN}-config"
 
diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
index a552a7f..62ae024 100644
--- a/recipes-containers/podman/podman_git.bb
+++ b/recipes-containers/podman/podman_git.bb
@@ -14,15 +14,7 @@ DEPENDS = " \
     ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
 "
 
-python __anonymous() {
-    msg = ""
-    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
-    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
-    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
-    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
-        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
-        raise bb.parse.SkipRecipe(msg)
-}
+PNBLACKLIST[podman] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on libseccomp from meta-security which is not included', d)}"
 
 SRCREV = "288fb688964cb7fc7086d0728daa1f5f6b726dd6"
 SRC_URI = " \
diff --git a/recipes-core/packagegroups/packagegroup-container.bb b/recipes-core/packagegroups/packagegroup-container.bb
index b3b0d4c..b06a7c7 100644
--- a/recipes-core/packagegroups/packagegroup-container.bb
+++ b/recipes-core/packagegroups/packagegroup-container.bb
@@ -44,12 +44,4 @@ RDEPENDS_packagegroup-containerd = " \
     virtual/containerd \
 "
 
-python __anonymous() {
-    msg = ""
-    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
-    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
-    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
-    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
-        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
-        raise bb.parse.SkipRecipe(msg)
-}
+PNBLACKLIST[packagegroup-container] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on podman which depends on libseccomp from meta-security which is not included', d)}"
-- 
2.30.2

Re: [meta-virtualization][PATCH 3/5] cri-o, podman, packagegroup-container: replace anonymous python function calling bb.parse.SkipRecipe with conditional PNBLACKLISTs

[Bruce Ashfield]

On Sat, Apr 3, 2021 at 3:51 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
>
> * PNBLACKLISTs are IMHO a bit easier to read and easier to override from distro
>   which e.g. provides own recipe for libseccomp

Thanks Martin,

I'm trying to decide if I should just give up and make meta-security a
hard/full layer dependency. More and more of the container components
just don't work if we don't have seccomp enabled.

But I agree that the blacklist technique is easier to read than the
proliferating anonymous python. I'll merge it while I ponder the above
question.

On that topic, would adding meta-security as a layer dependency cause
any issues in your setup/distros/builds ?

Bruce

>
> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> ---
>  recipes-containers/cri-o/cri-o_git.bb            | 16 +---------------
>  recipes-containers/podman/podman_git.bb          | 10 +---------
>  .../packagegroups/packagegroup-container.bb      | 10 +---------
>  3 files changed, 3 insertions(+), 33 deletions(-)
>
> diff --git a/recipes-containers/cri-o/cri-o_git.bb b/recipes-containers/cri-o/cri-o_git.bb
> index 2d6187a..0ac5ddc 100644
> --- a/recipes-containers/cri-o/cri-o_git.bb
> +++ b/recipes-containers/cri-o/cri-o_git.bb
> @@ -43,21 +43,7 @@ RDEPENDS_${PN} = " \
>      libdevmapper \
>      "
>
> -python __anonymous() {
> -    msg = ""
> -    # ERROR: Nothing PROVIDES 'libseccomp' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libseccomp']
> -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> -        raise bb.parse.SkipRecipe(msg)
> -    # ERROR: Nothing PROVIDES 'libselinux' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libselinux']
> -    elif 'selinux' not in d.getVar('BBFILE_COLLECTIONS').split():
> -        msg += "Make sure meta-selinux should be present as it provides 'libselinux'"
> -        raise bb.parse.SkipRecipe(msg)
> -}
> +PNBLACKLIST[cri-o] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', bb.utils.contains('BBFILE_COLLECTIONS', 'selinux', '', 'Depends on libselinux from meta-selinux which is not included', d), 'Depends on libseccomp from meta-security which is not included', d)}"
>
>  PACKAGES =+ "${PN}-config"
>
> diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
> index a552a7f..62ae024 100644
> --- a/recipes-containers/podman/podman_git.bb
> +++ b/recipes-containers/podman/podman_git.bb
> @@ -14,15 +14,7 @@ DEPENDS = " \
>      ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
>  "
>
> -python __anonymous() {
> -    msg = ""
> -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> -        raise bb.parse.SkipRecipe(msg)
> -}
> +PNBLACKLIST[podman] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on libseccomp from meta-security which is not included', d)}"
>
>  SRCREV = "288fb688964cb7fc7086d0728daa1f5f6b726dd6"
>  SRC_URI = " \
> diff --git a/recipes-core/packagegroups/packagegroup-container.bb b/recipes-core/packagegroups/packagegroup-container.bb
> index b3b0d4c..b06a7c7 100644
> --- a/recipes-core/packagegroups/packagegroup-container.bb
> +++ b/recipes-core/packagegroups/packagegroup-container.bb
> @@ -44,12 +44,4 @@ RDEPENDS_packagegroup-containerd = " \
>      virtual/containerd \
>  "
>
> -python __anonymous() {
> -    msg = ""
> -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> -        raise bb.parse.SkipRecipe(msg)
> -}
> +PNBLACKLIST[packagegroup-container] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on podman which depends on libseccomp from meta-security which is not included', d)}"
> --
> 2.30.2
>
>
> 
>


-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II

Re: [meta-virtualization][PATCH 3/5] cri-o, podman, packagegroup-container: replace anonymous python function calling bb.parse.SkipRecipe with conditional PNBLACKLISTs

[Martin Jansa]

[-- Attachment #1: Type: text/plain, Size: 7241 bytes --]

On Tue, Apr 06, 2021 at 08:58:13AM -0400, Bruce Ashfield wrote:
> On Sat, Apr 3, 2021 at 3:51 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
> >
> > * PNBLACKLISTs are IMHO a bit easier to read and easier to override from distro
> >   which e.g. provides own recipe for libseccomp
> 
> Thanks Martin,
> 
> I'm trying to decide if I should just give up and make meta-security a
> hard/full layer dependency. More and more of the container components
> just don't work if we don't have seccomp enabled.

Agreed, but Armin also mentioned that he plans to send libseccomp to
meta-oe, so this PNBLACKLIST change should be only temporary until that happens.

And I can imagine some people pulling libseccomp to their layer already
(instead of adding whole meta-security) and then being able to simply
set PNBLACKLIST to empty for these recipes would be much easier than
undoing the anonymous python (witch is imho impossible without
overlaying whole recipe except the function).

> But I agree that the blacklist technique is easier to read than the
> proliferating anonymous python. I'll merge it while I ponder the above
> question.
> 
> On that topic, would adding meta-security as a layer dependency cause
> any issues in your setup/distros/builds ?

I wouldn't call it my setup anymore, but I'm just going through
PNBLACKLISTs used in webOS OSE:
https://github.com/webosose/meta-webosose/blob/master/meta-webos/conf/distro/include/webos-recipe-blacklist.inc
https://github.com/webosose/meta-webosose/blob/master/meta-webos-virtualization/conf/layer.conf#L19

and fixing some of them or moving them to the layer where the issue is
introduced.

In webOS OSE setup this libseccomp issue is kind of special, because it
already includes meta-security layer, but BBMASKs all its content except
smack recipes which are actively used:
https://github.com/webosose/meta-webosose/blob/master/meta-webos-smack/conf/layer.conf#L10
so these 3-4 PNBLACKLISTs will need to stay in OSE anyway even with the
conditional on security-layer, I'll just move it to meta-webos-smack
where the BBMASK is being set:
https://github.com/shr-project/meta-webosose/commit/430589dbae6c8616d69692e65a3da40d2b192277
at least until libseccomp is in meta-oe and I'll be able to drop this as
well.

And who know when LGE will update webOS OSE from currently used dunfell
release, so whatever you decide in meta-virtualization is fine with me
:).

Cheers,

> > Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> > ---
> >  recipes-containers/cri-o/cri-o_git.bb            | 16 +---------------
> >  recipes-containers/podman/podman_git.bb          | 10 +---------
> >  .../packagegroups/packagegroup-container.bb      | 10 +---------
> >  3 files changed, 3 insertions(+), 33 deletions(-)
> >
> > diff --git a/recipes-containers/cri-o/cri-o_git.bb b/recipes-containers/cri-o/cri-o_git.bb
> > index 2d6187a..0ac5ddc 100644
> > --- a/recipes-containers/cri-o/cri-o_git.bb
> > +++ b/recipes-containers/cri-o/cri-o_git.bb
> > @@ -43,21 +43,7 @@ RDEPENDS_${PN} = " \
> >      libdevmapper \
> >      "
> >
> > -python __anonymous() {
> > -    msg = ""
> > -    # ERROR: Nothing PROVIDES 'libseccomp' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libseccomp']
> > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > -        raise bb.parse.SkipRecipe(msg)
> > -    # ERROR: Nothing PROVIDES 'libselinux' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libselinux']
> > -    elif 'selinux' not in d.getVar('BBFILE_COLLECTIONS').split():
> > -        msg += "Make sure meta-selinux should be present as it provides 'libselinux'"
> > -        raise bb.parse.SkipRecipe(msg)
> > -}
> > +PNBLACKLIST[cri-o] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', bb.utils.contains('BBFILE_COLLECTIONS', 'selinux', '', 'Depends on libselinux from meta-selinux which is not included', d), 'Depends on libseccomp from meta-security which is not included', d)}"
> >
> >  PACKAGES =+ "${PN}-config"
> >
> > diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
> > index a552a7f..62ae024 100644
> > --- a/recipes-containers/podman/podman_git.bb
> > +++ b/recipes-containers/podman/podman_git.bb
> > @@ -14,15 +14,7 @@ DEPENDS = " \
> >      ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
> >  "
> >
> > -python __anonymous() {
> > -    msg = ""
> > -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > -        raise bb.parse.SkipRecipe(msg)
> > -}
> > +PNBLACKLIST[podman] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on libseccomp from meta-security which is not included', d)}"
> >
> >  SRCREV = "288fb688964cb7fc7086d0728daa1f5f6b726dd6"
> >  SRC_URI = " \
> > diff --git a/recipes-core/packagegroups/packagegroup-container.bb b/recipes-core/packagegroups/packagegroup-container.bb
> > index b3b0d4c..b06a7c7 100644
> > --- a/recipes-core/packagegroups/packagegroup-container.bb
> > +++ b/recipes-core/packagegroups/packagegroup-container.bb
> > @@ -44,12 +44,4 @@ RDEPENDS_packagegroup-containerd = " \
> >      virtual/containerd \
> >  "
> >
> > -python __anonymous() {
> > -    msg = ""
> > -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > -        raise bb.parse.SkipRecipe(msg)
> > -}
> > +PNBLACKLIST[packagegroup-container] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on podman which depends on libseccomp from meta-security which is not included', d)}"
> > --
> > 2.30.2
> >
> >
> > 
> >
> 
> 
> -- 
> - Thou shalt not follow the NULL pointer, for chaos and madness await
> thee at its end
> - "Use the force Harry" - Gandalf, Star Trek II

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 201 bytes --]

Re: [meta-virtualization][PATCH 3/5] cri-o, podman, packagegroup-container: replace anonymous python function calling bb.parse.SkipRecipe with conditional PNBLACKLISTs

[Bruce Ashfield]

On Tue, Apr 6, 2021 at 9:19 AM Martin Jansa <martin.jansa@gmail.com> wrote:
>
> On Tue, Apr 06, 2021 at 08:58:13AM -0400, Bruce Ashfield wrote:
> > On Sat, Apr 3, 2021 at 3:51 PM Martin Jansa <Martin.Jansa@gmail.com> wrote:
> > >
> > > * PNBLACKLISTs are IMHO a bit easier to read and easier to override from distro
> > >   which e.g. provides own recipe for libseccomp
> >
> > Thanks Martin,
> >
> > I'm trying to decide if I should just give up and make meta-security a
> > hard/full layer dependency. More and more of the container components
> > just don't work if we don't have seccomp enabled.
>
> Agreed, but Armin also mentioned that he plans to send libseccomp to
> meta-oe, so this PNBLACKLIST change should be only temporary until that happens.
>

Thanks for the detailed description, it helps me understand how things
are being used and gives me things to check before merging potential
breakages.

As it turns out, there was a yocto meeting today and where libseccomp
lives came up. There seems to be a consensus that it should end up in
oe-core (and at the very least meta-oe), so this will work itself out over
time.

So I went ahead and merged everything as-is, since we might as well
keep the optional meta-security dependency for now, and revisit with
libseccomp moves.

> And I can imagine some people pulling libseccomp to their layer already
> (instead of adding whole meta-security) and then being able to simply
> set PNBLACKLIST to empty for these recipes would be much easier than
> undoing the anonymous python (witch is imho impossible without
> overlaying whole recipe except the function).

Agreed.

>
> > But I agree that the blacklist technique is easier to read than the
> > proliferating anonymous python. I'll merge it while I ponder the above
> > question.
> >
> > On that topic, would adding meta-security as a layer dependency cause
> > any issues in your setup/distros/builds ?
>
> I wouldn't call it my setup anymore, but I'm just going through
> PNBLACKLISTs used in webOS OSE:
> https://github.com/webosose/meta-webosose/blob/master/meta-webos/conf/distro/include/webos-recipe-blacklist.inc
> https://github.com/webosose/meta-webosose/blob/master/meta-webos-virtualization/conf/layer.conf#L19
>
> and fixing some of them or moving them to the layer where the issue is
> introduced.

Aha!

>
> In webOS OSE setup this libseccomp issue is kind of special, because it
> already includes meta-security layer, but BBMASKs all its content except
> smack recipes which are actively used:
> https://github.com/webosose/meta-webosose/blob/master/meta-webos-smack/conf/layer.conf#L10
> so these 3-4 PNBLACKLISTs will need to stay in OSE anyway even with the
> conditional on security-layer, I'll just move it to meta-webos-smack
> where the BBMASK is being set:
> https://github.com/shr-project/meta-webosose/commit/430589dbae6c8616d69692e65a3da40d2b192277
> at least until libseccomp is in meta-oe and I'll be able to drop this as
> well.
>
> And who know when LGE will update webOS OSE from currently used dunfell
> release, so whatever you decide in meta-virtualization is fine with me
> :).

Gotcha.

Again, thanks for the detailed explanation.

Bruce

>
> Cheers,
>
> > > Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> > > ---
> > >  recipes-containers/cri-o/cri-o_git.bb            | 16 +---------------
> > >  recipes-containers/podman/podman_git.bb          | 10 +---------
> > >  .../packagegroups/packagegroup-container.bb      | 10 +---------
> > >  3 files changed, 3 insertions(+), 33 deletions(-)
> > >
> > > diff --git a/recipes-containers/cri-o/cri-o_git.bb b/recipes-containers/cri-o/cri-o_git.bb
> > > index 2d6187a..0ac5ddc 100644
> > > --- a/recipes-containers/cri-o/cri-o_git.bb
> > > +++ b/recipes-containers/cri-o/cri-o_git.bb
> > > @@ -43,21 +43,7 @@ RDEPENDS_${PN} = " \
> > >      libdevmapper \
> > >      "
> > >
> > > -python __anonymous() {
> > > -    msg = ""
> > > -    # ERROR: Nothing PROVIDES 'libseccomp' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> > > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libseccomp']
> > > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > > -        raise bb.parse.SkipRecipe(msg)
> > > -    # ERROR: Nothing PROVIDES 'libselinux' (but /buildarea/layers/meta-virtualization/recipes-containers/cri-o/cri-o_git.bb DEPENDS on or otherwise requires it).
> > > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'cri-o', 'libselinux']
> > > -    elif 'selinux' not in d.getVar('BBFILE_COLLECTIONS').split():
> > > -        msg += "Make sure meta-selinux should be present as it provides 'libselinux'"
> > > -        raise bb.parse.SkipRecipe(msg)
> > > -}
> > > +PNBLACKLIST[cri-o] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', bb.utils.contains('BBFILE_COLLECTIONS', 'selinux', '', 'Depends on libselinux from meta-selinux which is not included', d), 'Depends on libseccomp from meta-security which is not included', d)}"
> > >
> > >  PACKAGES =+ "${PN}-config"
> > >
> > > diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
> > > index a552a7f..62ae024 100644
> > > --- a/recipes-containers/podman/podman_git.bb
> > > +++ b/recipes-containers/podman/podman_git.bb
> > > @@ -14,15 +14,7 @@ DEPENDS = " \
> > >      ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
> > >  "
> > >
> > > -python __anonymous() {
> > > -    msg = ""
> > > -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> > > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> > > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > > -        raise bb.parse.SkipRecipe(msg)
> > > -}
> > > +PNBLACKLIST[podman] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on libseccomp from meta-security which is not included', d)}"
> > >
> > >  SRCREV = "288fb688964cb7fc7086d0728daa1f5f6b726dd6"
> > >  SRC_URI = " \
> > > diff --git a/recipes-core/packagegroups/packagegroup-container.bb b/recipes-core/packagegroups/packagegroup-container.bb
> > > index b3b0d4c..b06a7c7 100644
> > > --- a/recipes-core/packagegroups/packagegroup-container.bb
> > > +++ b/recipes-core/packagegroups/packagegroup-container.bb
> > > @@ -44,12 +44,4 @@ RDEPENDS_packagegroup-containerd = " \
> > >      virtual/containerd \
> > >  "
> > >
> > > -python __anonymous() {
> > > -    msg = ""
> > > -    # ERROR: Nothing PROVIDES 'libseccomp' (but meta-virtualization/recipes-containers/podman/ DEPENDS on or otherwise requires it).
> > > -    # ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
> > > -    # Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'podman', 'libseccomp']
> > > -    if 'security' not in d.getVar('BBFILE_COLLECTIONS').split():
> > > -        msg += "Make sure meta-security should be present as it provides 'libseccomp'"
> > > -        raise bb.parse.SkipRecipe(msg)
> > > -}
> > > +PNBLACKLIST[packagegroup-container] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'security', '', 'Depends on podman which depends on libseccomp from meta-security which is not included', d)}"
> > > --
> > > 2.30.2
> > >
> > >
> > > 
> > >
> >
> >
> > --
> > - Thou shalt not follow the NULL pointer, for chaos and madness await
> > thee at its end
> > - "Use the force Harry" - Gandalf, Star Trek II



-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II

[meta-virtualization][PATCH 4/5] ipxe: fix SRC_URI

[Martin Jansa]

* git.ipxe.org is gone:
  fatal: unable to access 'https://git.ipxe.org/ipxe.git/': Couldn't connect to server

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 recipes-extended/ipxe/ipxe_git.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-extended/ipxe/ipxe_git.bb b/recipes-extended/ipxe/ipxe_git.bb
index 7b76817..448087e 100644
--- a/recipes-extended/ipxe/ipxe_git.bb
+++ b/recipes-extended/ipxe/ipxe_git.bb
@@ -14,7 +14,7 @@ PR = "r0"
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
 SRC_URI = " \
-    git://git.ipxe.org/ipxe.git;protocol=https \
+    git://github.com/ipxe/ipxe.git;protocol=https \
     file://ipxe-fix-hostcc-nopie-cflags.patch \
     file://ipxe-intel-Avoid-spurious-compiler-warning-on-GCC-10.patch \
     file://ipxe-golan-Add-explicit-type-casts-for-nodnic_queue_pair_.patch \
-- 
2.30.2

[meta-virtualization][PATCH 5/5] ipxe: force using ld.bfd even when ld-is-gold is in DISTRO_FEATURES

[Martin Jansa]

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 recipes-extended/ipxe/ipxe_git.bb | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/recipes-extended/ipxe/ipxe_git.bb b/recipes-extended/ipxe/ipxe_git.bb
index 448087e..43c8f0e 100644
--- a/recipes-extended/ipxe/ipxe_git.bb
+++ b/recipes-extended/ipxe/ipxe_git.bb
@@ -27,12 +27,16 @@ EXTRA_OEMAKE = " \
     ISOLINUX_BIN="${STAGING_DIR_TARGET}/usr/share/syslinux/isolinux.bin" \
     CROSS_COMPILE="${TARGET_PREFIX}" \
     EXTRA_HOST_CFLAGS="${BUILD_CFLAGS}" \
-    EXTRA_HOST_LDFLAGS="${BUILD_LDFLAGS}""
+    EXTRA_HOST_LDFLAGS="${BUILD_LDFLAGS}" \
+"
 
 S = "${WORKDIR}/git/src"
 
 do_compile() {
-   oe_runmake
+    # Makefile.housekeeping:111: GNU gold is unsuitable for building iPXE
+    # Makefile.housekeeping:112: Use GNU ld instead
+    sed -i 's#\(^LD.*$(CROSS_COMPILE)ld\)$#\1.bfd#g' -i ${S}/Makefile
+    oe_runmake
 }
 
 do_install() {
-- 
2.30.2

Re: [meta-virtualization][PATCH 1/5] nagios-*: add conditional PNBLACKLIST, because of the dependency on meta-webserver

[Bruce Ashfield]

All 5 in the series are now merged

Bruce

In message: [meta-virtualization][PATCH 1/5] nagios-*: add conditional PNBLACKLIST, because of the dependency on meta-webserver
on 03/04/2021 Martin Jansa wrote:

> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
> ---
>  recipes-extended/nagios/nagios-core_4.4.6.bb    | 2 ++
>  recipes-extended/nagios/nagios-nrpe_4.0.2.bb    | 2 ++
>  recipes-extended/nagios/nagios-nsca_2.9.2.bb    | 2 ++
>  recipes-extended/nagios/nagios-plugins_2.2.1.bb | 2 ++
>  4 files changed, 8 insertions(+)
> 
> diff --git a/recipes-extended/nagios/nagios-core_4.4.6.bb b/recipes-extended/nagios/nagios-core_4.4.6.bb
> index 8bcd6c0..fc3d2c5 100644
> --- a/recipes-extended/nagios/nagios-core_4.4.6.bb
> +++ b/recipes-extended/nagios/nagios-core_4.4.6.bb
> @@ -38,6 +38,8 @@ RDEPENDS_${PN} += "\
>      nagios-base \
>  "
>  
> +PNBLACKLIST[nagios-core] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on apache2 from meta-webserver which is not included', d)}"
> +
>  acpaths = "-I ${S}/autoconf-macros"
>  
>  # Set default password for the hardcoded Nagios admin user "nagiosadmin".
> diff --git a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
> index d9c7b15..7f81172 100644
> --- a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
> +++ b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
> @@ -26,6 +26,8 @@ S = "${WORKDIR}/${SRCNAME}-${PV}"
>  
>  inherit autotools-brokensep update-rc.d systemd update-alternatives
>  
> +PNBLACKLIST[nagios-nrpe] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
> +
>  # IP address of server which proxy should connect to
>  MONITORING_PROXY_SERVER_IP ??= "192.168.7.2"
>  
> diff --git a/recipes-extended/nagios/nagios-nsca_2.9.2.bb b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
> index 66f8da5..1fce198 100644
> --- a/recipes-extended/nagios/nagios-nsca_2.9.2.bb
> +++ b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
> @@ -22,6 +22,8 @@ S = "${WORKDIR}/${SRCNAME}-${PV}"
>  
>  inherit update-rc.d autotools-brokensep systemd dos2unix
>  
> +PNBLACKLIST[nagios-nsca] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Rdepends on nagios-base provided by nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
> +
>  DEPENDS = "libmcrypt"
>  
>  EXTRA_OECONF += "--with-nsca-user=${NAGIOS_USER} \
> diff --git a/recipes-extended/nagios/nagios-plugins_2.2.1.bb b/recipes-extended/nagios/nagios-plugins_2.2.1.bb
> index 0793365..b97d80c 100644
> --- a/recipes-extended/nagios/nagios-plugins_2.2.1.bb
> +++ b/recipes-extended/nagios/nagios-plugins_2.2.1.bb
> @@ -18,6 +18,8 @@ S = "${WORKDIR}/${BPN}-${PV}"
>  
>  inherit autotools gettext
>  
> +PNBLACKLIST[nagios-plugins] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
> +
>  EXTRA_OECONF += "--with-sysroot=${STAGING_DIR_HOST} \
>                   --with-nagios-user=${NAGIOS_USER} \
>                   --with-nagios-group=${NAGIOS_GROUP} \
> -- 
> 2.30.2
> 

> 
> 
>