[meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity

[meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity

[Atharv Dubey]

Add an optional dynamic layer enabling dm-verity block-level integrity
verification of the root filesystem for TI K3 platforms, using
meta-security's stock dm-verity mechanism as-is. Requires meta-security
to be present in bblayers.conf.

dm-verity hashes the rootfs at build time; at boot, a dedicated
initramfs loads the root hash and the kernel checks every block read
against it. Set DM_VERITY_IMAGE to enable all the verity-related
recipes for that image; other images build as usual.

Signed-off-by: Atharv Dubey <a-dubey@ti.com>

---
v4:
 - Use ti-core-initramfs instead of a separate dm-verity initramfs
 - Instead of a DISTRO_FEATURE, just check if DM_VERITY_IMAGE is set
v3:
 - Disabled the automount rules from udev-aragoconf, so don't need the
   ignorelist for dm-verity
v2:
 - Replaced hardcoded /dev/mmcblk1p2 with a PARTUUID
---
 meta-ti-bsp/conf/layer.conf                   |  3 +++
 meta-ti-bsp/conf/machine/include/k3.inc       |  7 ++++++
 .../conf/include/dm-verity-upstream.inc       | 23 +++++++++++++++++++
 .../udev/udev-aragoconf_%.bbappend            |  5 ++++
 .../udev/udev-extraconf_%.bbappend            |  6 +++++
 meta-ti-bsp/files/wic/k3-verity.wks.in        |  5 ++++
 6 files changed, 49 insertions(+)
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
 create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in

diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
index 3cc54aa4..aca35cd3 100644
--- a/meta-ti-bsp/conf/layer.conf
+++ b/meta-ti-bsp/conf/layer.conf
@@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
 LAYERRECOMMENDS_meta-ti-bsp = " \
     openembedded-layer \
     tpm-layer \
+    security \
 "
 
 BBFILES_DYNAMIC += " \
     openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
     tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \
     tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \
+    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \
+    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \
 "
 
 SIGGEN_EXCLUDERECIPES_ABISAFE += " \
diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc
index 2ebbfb9e..f19db45f 100644
--- a/meta-ti-bsp/conf/machine/include/k3.inc
+++ b/meta-ti-bsp/conf/machine/include/k3.inc
@@ -64,3 +64,10 @@ FALCON_INCLUDE = ""
 FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc"
 
 require ${FALCON_INCLUDE}
+
+# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on.
+DM_VERITY_IMAGE ??= ""
+
+DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' if d.getVar('DM_VERITY_IMAGE') else ''}"
+
+require ${DM_VERITY_UPSTREAM_INCLUDE}
diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
new file mode 100644
index 00000000..3ff2b7d6
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
@@ -0,0 +1,23 @@
+# Enables dm-verity to check the rootfs for tampering on TI K3 boards.
+DM_VERITY_IMAGE_TYPE = "ext4"
+IMAGE_CLASSES += "dm-verity-img"
+
+# ti-core-initramfs.bbappend already wires the initramfs into the boot partition once dm-verity is enabled, so we don't need to do it here.
+
+# Derive the root partition's UUID from MACHINE so everyone computes the same one.
+python () {
+    import uuid
+
+    if not d.getVar('DM_VERITY_ROOT_PARTUUID'):
+        d.setVar('DM_VERITY_ROOT_PARTUUID',
+                 str(uuid.uuid5(uuid.NAMESPACE_DNS, 'dm-verity-root-%s' % d.getVar('MACHINE'))))
+}
+
+python () {
+    if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'):
+        return
+
+    d.setVar('WKS_FILE', 'k3-verity.wks.in')
+    d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs')
+    d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR DM_VERITY_ROOT_PARTUUID')
+}
diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
new file mode 100644
index 00000000..e5f6c1b2
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
@@ -0,0 +1,5 @@
+do_install:append() {
+    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
+        : > ${D}${libdir}/udev/rules.d/50-arago.rules
+    fi
+}
diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
new file mode 100644
index 00000000..a14e21ea
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
@@ -0,0 +1,6 @@
+# Nothing should ever get auto-mounted under dm-verity, so just kill the automounter.
+do_install:append() {
+    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
+        : > ${D}${sysconfdir}/udev/rules.d/automount.rules
+    fi
+}
diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in
new file mode 100644
index 00000000..62ae0ec1
--- /dev/null
+++ b/meta-ti-bsp/files/wic/k3-verity.wks.in
@@ -0,0 +1,5 @@
+# Disk layout for a board that boots with dm-verity enabled.
+
+bootloader --timeout=3 --append="rootfstype=ext4 root=PARTUUID=${DM_VERITY_ROOT_PARTUUID} ${TI_WKS_BOOTLOADER_APPEND}"
+part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}${TI_WKS_INITRAMFS}" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M
+part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 --uuid ${DM_VERITY_ROOT_PARTUUID}
-- 
2.34.1

[meta-ti][master][PATCH v4 2/3] linux-ti-staging: Add dm-verity kernel config

[Atharv Dubey]

Add a kernel config fragment enabling dm-verity and its crypto
dependencies (CONFIG_DM_VERITY, CONFIG_DM_CRYPT, CONFIG_BLK_DEV_DM).
Applied via KERNEL_CONFIG_FRAGMENTS, which setup-defconfig.inc reads
and merges directly through merge_config.sh.

Gated on DM_VERITY_IMAGE being set, matching the rest of the dm-verity
dynamic layer.

Signed-off-by: Atharv Dubey <a-dubey@ti.com>
---
 .../security-layer/recipes-kernel/linux/files/dm-verity.cfg  | 5 +++++
 .../recipes-kernel/linux/linux-ti-staging_%.bbappend         | 5 +++++
 2 files changed, 10 insertions(+)
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend

diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg
new file mode 100644
index 00000000..c50ce403
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg
@@ -0,0 +1,5 @@
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+CONFIG_DM_VERITY=y
+CONFIG_CRYPTO_SHA256=y
diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend
new file mode 100644
index 00000000..9a380cf6
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend
@@ -0,0 +1,5 @@
+# Enable the dm-verity kernel config fragment via KERNEL_CONFIG_FRAGMENTS.
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+SRC_URI += "${@'file://dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}"
+KERNEL_CONFIG_FRAGMENTS += "${@'${UNPACKDIR}/dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}"
-- 
2.34.1

[meta-ti][master][PATCH v4 3/3] ti-core-initramfs: Extend with dm-verity support

[Atharv Dubey]

Add dm-verity support to ti-core-initramfs by:
- Enabling dm-verity modules and tools (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set
- Adding do_rootfs[nostamp] and do_image[nostamp] to rebuild initramfs after rootfs verity task completes
- Making deploy_verity_hash gracefully handle missing .verity.env file on first pass with bbwarn

Signed-off-by: Atharv Dubey <a-dubey@ti.com>
---
 .../machine/include/ti-core-initramfs.inc     |  4 +--
 .../initramfs/ti-core-initramfs.bbappend      | 25 +++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend

diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
index c816f1dc..08da8e80 100644
--- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
+++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
@@ -5,7 +5,7 @@
 #   TI_CORE_INITRAMFS_ENABLED = "0"
 #
 #------------------------------------------------------------------------------
-TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
+TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) or d.getVar('DM_VERITY_IMAGE') else '0'}"
 
 TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
 TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
@@ -22,4 +22,4 @@ TI_WKS_INITRAMFS ?= "${@ ',initrd=${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('
 
 IMAGE_BOOT_FILES += "${@ '${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
 
-INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
+INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
\ No newline at end of file
diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
new file mode 100644
index 00000000..25fe775f
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
@@ -0,0 +1,25 @@
+# Install the essential utils for dm-verity in ti-core-initramfs
+TI_CORE_INITRAMFS_EXTRA_INSTALL:append = "${@' initramfs-module-dmverity cryptsetup util-linux-mount' if d.getVar('DM_VERITY_IMAGE') else ''}"
+
+# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE
+do_image[nostamp] = "1"
+do_rootfs[nostamp] = "1"
+
+IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
+
+deploy_verity_hash() {
+    # The .verity.env file is created by the DM_VERITY_IMAGE build (e.g., arago-base-image).
+    # On the first pass, it won't exist yet because the initramfs is built before the rootfs
+    # (due to INITRAMFS_IMAGE dependency). The do_rootfs[nostamp] = "1" causes this task
+    # to re-run after the rootfs is built, at which point the file will exist.
+    if [ -f ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ]; then
+        install -D -m 0644 \
+            ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \
+            ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
+    else
+        bbwarn "dm-verity.env not found at ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env - will retry on rebuild (nostamp)"
+    fi
+}
+
+
+IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
-- 
2.34.1

Re: [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity

[PRC Automation]

meta-ti / na / 20260930125938.95629-1-a-dubey

PRC Results: FAIL

=========================================================
  check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
WARN - [meta-ti][master][PATCH v4 2/3] linux-ti-staging: Add dm-verity kernel config
    WARN: Revised patch missing a comment. (REVISION-1)
        patch
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v4 3/3] ti-core-initramfs: Extend with dm-verity support
    WARN: Revised patch missing a comment. (REVISION-1)
        patch
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887



=========================================================
  apply-yocto-patch: FAIL
=========================================================
master
=====================
Summary:
- Patch Series: [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity
- Submitter: From: Atharv Dubey <a-dubey@ti.com>
- Date: Date: Wed, 30 Sep 2026 18:29:36 +0530
- Num Patches: 3
- Mailing List (public inbox) Commit SHA: 9a1220ed1f51854c8dcf5b95709213f9e510bbe3

Applied to:
- Repository: lcpd-prc-meta-ti
- Base Branch: master
- Commit Author: LCPD Automation Script <lcpdbld@list.ti.com>
- Commit Subject: CI/CD Auto-Merger: cicd.master.202609251030
- Commit SHA: 9a970370942d7ff753a64b31bc367e1e27aa3048

Patches
----------------------------------------
FAIL - [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity
    error: patch failed: meta-ti-bsp/conf/layer.conf:20
    error: meta-ti-bsp/conf/layer.conf: patch does not apply
    Applying: dm-verity-upstream: Add dynamic layer for meta-security dm-verity
    Patch failed at 0001 dm-verity-upstream: Add dynamic layer for meta-security dm-verity

Re: [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity

[Denys Dmytriyenko]

On Wed, Sep 30, 2026 at 06:29:36PM +0530, Atharv Dubey via lists.yoctoproject.org wrote:
> Add an optional dynamic layer enabling dm-verity block-level integrity
> verification of the root filesystem for TI K3 platforms, using
> meta-security's stock dm-verity mechanism as-is. Requires meta-security
> to be present in bblayers.conf.
> 
> dm-verity hashes the rootfs at build time; at boot, a dedicated
> initramfs loads the root hash and the kernel checks every block read
> against it. Set DM_VERITY_IMAGE to enable all the verity-related
> recipes for that image; other images build as usual.
> 
> Signed-off-by: Atharv Dubey <a-dubey@ti.com>
> 
> ---
> v4:
>  - Use ti-core-initramfs instead of a separate dm-verity initramfs
>  - Instead of a DISTRO_FEATURE, just check if DM_VERITY_IMAGE is set
> v3:
>  - Disabled the automount rules from udev-aragoconf, so don't need the
>    ignorelist for dm-verity
> v2:
>  - Replaced hardcoded /dev/mmcblk1p2 with a PARTUUID
> ---
>  meta-ti-bsp/conf/layer.conf                   |  3 +++
>  meta-ti-bsp/conf/machine/include/k3.inc       |  7 ++++++
>  .../conf/include/dm-verity-upstream.inc       | 23 +++++++++++++++++++
>  .../udev/udev-aragoconf_%.bbappend            |  5 ++++
>  .../udev/udev-extraconf_%.bbappend            |  6 +++++
>  meta-ti-bsp/files/wic/k3-verity.wks.in        |  5 ++++
>  6 files changed, 49 insertions(+)
>  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
>  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
>  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
>  create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in
> 
> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> index 3cc54aa4..aca35cd3 100644
> --- a/meta-ti-bsp/conf/layer.conf
> +++ b/meta-ti-bsp/conf/layer.conf
> @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>  LAYERRECOMMENDS_meta-ti-bsp = " \
>      openembedded-layer \
>      tpm-layer \
> +    security \
>  "
>  
>  BBFILES_DYNAMIC += " \
>      openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
>      tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \
>      tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \
> +    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \
> +    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \
>  "
>  
>  SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc
> index 2ebbfb9e..f19db45f 100644
> --- a/meta-ti-bsp/conf/machine/include/k3.inc
> +++ b/meta-ti-bsp/conf/machine/include/k3.inc
> @@ -64,3 +64,10 @@ FALCON_INCLUDE = ""
>  FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc"
>  
>  require ${FALCON_INCLUDE}
> +
> +# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on.
> +DM_VERITY_IMAGE ??= ""
> +
> +DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' if d.getVar('DM_VERITY_IMAGE') else ''}"
> +
> +require ${DM_VERITY_UPSTREAM_INCLUDE}
> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> new file mode 100644
> index 00000000..3ff2b7d6
> --- /dev/null
> +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> @@ -0,0 +1,23 @@
> +# Enables dm-verity to check the rootfs for tampering on TI K3 boards.
> +DM_VERITY_IMAGE_TYPE = "ext4"
> +IMAGE_CLASSES += "dm-verity-img"
> +
> +# ti-core-initramfs.bbappend already wires the initramfs into the boot partition once dm-verity is enabled, so we don't need to do it here.
> +
> +# Derive the root partition's UUID from MACHINE so everyone computes the same one.
> +python () {
> +    import uuid
> +
> +    if not d.getVar('DM_VERITY_ROOT_PARTUUID'):
> +        d.setVar('DM_VERITY_ROOT_PARTUUID',
> +                 str(uuid.uuid5(uuid.NAMESPACE_DNS, 'dm-verity-root-%s' % d.getVar('MACHINE'))))
> +}

Should these 2 anonymous python functions be combined and the above code go 
behind the check below? Is DM_VERITY_ROOT_PARTUUID needed outside of the 
DM_VERITY_IMAGE image?


> +
> +python () {
> +    if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'):
> +        return
> +
> +    d.setVar('WKS_FILE', 'k3-verity.wks.in')
> +    d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs')
> +    d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR DM_VERITY_ROOT_PARTUUID')
> +}
> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
> new file mode 100644
> index 00000000..e5f6c1b2
> --- /dev/null
> +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
> @@ -0,0 +1,5 @@
> +do_install:append() {
> +    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
> +        : > ${D}${libdir}/udev/rules.d/50-arago.rules

Why not simply remove the file?


> +    fi
> +}
> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> new file mode 100644
> index 00000000..a14e21ea
> --- /dev/null
> +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> @@ -0,0 +1,6 @@
> +# Nothing should ever get auto-mounted under dm-verity, so just kill the automounter.
> +do_install:append() {
> +    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
> +        : > ${D}${sysconfdir}/udev/rules.d/automount.rules

Same question as above.


> +    fi
> +}
> diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in
> new file mode 100644
> index 00000000..62ae0ec1
> --- /dev/null
> +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in
> @@ -0,0 +1,5 @@
> +# Disk layout for a board that boots with dm-verity enabled.
> +
> +bootloader --timeout=3 --append="rootfstype=ext4 root=PARTUUID=${DM_VERITY_ROOT_PARTUUID} ${TI_WKS_BOOTLOADER_APPEND}"
> +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}${TI_WKS_INITRAMFS}" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M
> +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 --uuid ${DM_VERITY_ROOT_PARTUUID}
> -- 
> 2.34.1

Re: [meta-ti][master][PATCH v4 3/3] ti-core-initramfs: Extend with dm-verity support

[Denys Dmytriyenko]

On Wed, Sep 30, 2026 at 06:29:38PM +0530, Atharv Dubey via lists.yoctoproject.org wrote:
> Add dm-verity support to ti-core-initramfs by:
> - Enabling dm-verity modules and tools (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set
> - Adding do_rootfs[nostamp] and do_image[nostamp] to rebuild initramfs after rootfs verity task completes
> - Making deploy_verity_hash gracefully handle missing .verity.env file on first pass with bbwarn
> 
> Signed-off-by: Atharv Dubey <a-dubey@ti.com>
> ---
>  .../machine/include/ti-core-initramfs.inc     |  4 +--
>  .../initramfs/ti-core-initramfs.bbappend      | 25 +++++++++++++++++++
>  2 files changed, 27 insertions(+), 2 deletions(-)
>  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> 
> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> index c816f1dc..08da8e80 100644
> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> @@ -5,7 +5,7 @@
>  #   TI_CORE_INITRAMFS_ENABLED = "0"
>  #
>  #------------------------------------------------------------------------------
> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) or d.getVar('DM_VERITY_IMAGE') else '0'}"
>  
>  TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>  TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
> @@ -22,4 +22,4 @@ TI_WKS_INITRAMFS ?= "${@ ',initrd=${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('
>  
>  IMAGE_BOOT_FILES += "${@ '${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
>  
> -INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
> +INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
> \ No newline at end of file

You are not changing the code here, but it shows as a diff because you lost 
the newline at the end of file.


> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> new file mode 100644
> index 00000000..25fe775f
> --- /dev/null
> +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> @@ -0,0 +1,25 @@
> +# Install the essential utils for dm-verity in ti-core-initramfs
> +TI_CORE_INITRAMFS_EXTRA_INSTALL:append = "${@' initramfs-module-dmverity cryptsetup util-linux-mount' if d.getVar('DM_VERITY_IMAGE') else ''}"
> +
> +# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE
> +do_image[nostamp] = "1"
> +do_rootfs[nostamp] = "1"
> +
> +IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
> +
> +deploy_verity_hash() {
> +    # The .verity.env file is created by the DM_VERITY_IMAGE build (e.g., arago-base-image).
> +    # On the first pass, it won't exist yet because the initramfs is built before the rootfs
> +    # (due to INITRAMFS_IMAGE dependency). The do_rootfs[nostamp] = "1" causes this task
> +    # to re-run after the rootfs is built, at which point the file will exist.
> +    if [ -f ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ]; then
> +        install -D -m 0644 \
> +            ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \
> +            ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
> +    else
> +        bbwarn "dm-verity.env not found at ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env - will retry on rebuild (nostamp)"
> +    fi
> +}
> +
> +
> +IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
> -- 
> 2.34.1

Re: [EXTERNAL] Re: [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity

[Atharv Dubey]

[-- Attachment #1: Type: text/plain, Size: 8228 bytes --]

Hi Denys,

On 30/09/26 21:52, Denys Dmytriyenko wrote:
> On Wed, Sep 30, 2026 at 06: 29: 36PM +0530, Atharv Dubey via 
> lists. yoctoproject. org wrote: > Add an optional dynamic layer 
> enabling dm-verity block-level integrity > verification of the root 
> filesystem for TI K3 platforms, using > meta-security's
> ZjQcmQRYFpfptBannerStart
> This message was sent from outside of Texas Instruments.
> Do not click links or open attachments unless you recognize the source 
> of this email and know the content is safe.
> Report Suspicious
> <https://us-phishalarm-ewt.proofpoint.com/EWT/v1/G3vK!uJdqXRfPtmw7SgZE_JPD3T2ZGKQQCoLNXhtUZkSdkelZkg_-b1-LC9k-eu2ov9pdMYotJXXEww$> 
>
> ZjQcmQRYFpfptBannerEnd
> On Wed, Sep 30, 2026 at 06:29:36PM +0530, Atharv Dubey via lists.yoctoproject.org wrote:
> > Add an optional dynamic layer enabling dm-verity block-level integrity
> > verification of the root filesystem for TI K3 platforms, using
> > meta-security's stock dm-verity mechanism as-is. Requires meta-security
> > to be present in bblayers.conf.
> > 
> > dm-verity hashes the rootfs at build time; at boot, a dedicated
> > initramfs loads the root hash and the kernel checks every block read
> > against it. Set DM_VERITY_IMAGE to enable all the verity-related
> > recipes for that image; other images build as usual.
> > 
> > Signed-off-by: Atharv Dubey <a-dubey@ti.com>
> > 
> > ---
> > v4:
> >  - Use ti-core-initramfs instead of a separate dm-verity initramfs
> >  - Instead of a DISTRO_FEATURE, just check if DM_VERITY_IMAGE is set
> > v3:
> >  - Disabled the automount rules from udev-aragoconf, so don't need the
> >    ignorelist for dm-verity
> > v2:
> >  - Replaced hardcoded /dev/mmcblk1p2 with a PARTUUID
> > ---
> >  meta-ti-bsp/conf/layer.conf                   |  3 +++
> >  meta-ti-bsp/conf/machine/include/k3.inc       |  7 ++++++
> >  .../conf/include/dm-verity-upstream.inc       | 23 +++++++++++++++++++
> >  .../udev/udev-aragoconf_%.bbappend            |  5 ++++
> >  .../udev/udev-extraconf_%.bbappend            |  6 +++++
> >  meta-ti-bsp/files/wic/k3-verity.wks.in        |  5 ++++
> >  6 files changed, 49 insertions(+)
> >  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> >  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
> >  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> >  create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in
> > 
> > diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> > index 3cc54aa4..aca35cd3 100644
> > --- a/meta-ti-bsp/conf/layer.conf
> > +++ b/meta-ti-bsp/conf/layer.conf
> > @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
> >  LAYERRECOMMENDS_meta-ti-bsp = " \
> >      openembedded-layer \
> >      tpm-layer \
> > +    security \
> >  "
> >  
> >  BBFILES_DYNAMIC += " \
> >      openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
> >      tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \
> >      tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \
> > +    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \
> > +    security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \
> >  "
> >  
> >  SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> > diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc
> > index 2ebbfb9e..f19db45f 100644
> > --- a/meta-ti-bsp/conf/machine/include/k3.inc
> > +++ b/meta-ti-bsp/conf/machine/include/k3.inc
> > @@ -64,3 +64,10 @@ FALCON_INCLUDE = ""
> >  FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc"
> >  
> >  require ${FALCON_INCLUDE}
> > +
> > +# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on.
> > +DM_VERITY_IMAGE ??= ""
> > +
> > +DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' 
> if d.getVar('DM_VERITY_IMAGE') else ''}"
> > +
> > +require ${DM_VERITY_UPSTREAM_INCLUDE}
> > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> > new file mode 100644
> > index 00000000..3ff2b7d6
> > --- /dev/null
> > +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> > @@ -0,0 +1,23 @@
> > +# Enables dm-verity to check the rootfs for tampering on TI K3 boards.
> > +DM_VERITY_IMAGE_TYPE = "ext4"
> > +IMAGE_CLASSES += "dm-verity-img"
> > +
> > +# ti-core-initramfs.bbappend already wires the initramfs into the boot partition once dm-verity is enabled, so we don't need to do it here.
> > +
> > +# Derive the root partition's UUID from MACHINE so everyone computes the same one.
> > +python () {
> > +    import uuid
> > +
> > +    if not d.getVar('DM_VERITY_ROOT_PARTUUID'):
> > +        d.setVar('DM_VERITY_ROOT_PARTUUID',
> > +                 str(uuid.uuid5(uuid.NAMESPACE_DNS, 'dm-verity-root-%s' % d.getVar('MACHINE'))))
> > +}
>
> Should these 2 anonymous python functions be combined and the above code go
> behind the check below? Is DM_VERITY_ROOT_PARTUUID needed outside of the
> DM_VERITY_IMAGE image?


Yes we can club the 2 functions. Nope we dont need DM_VERITY_ROOT_PARTUUID

anywhere else.


>
>
> > +
> > +python () {
> > +    if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'):
> > +        return
> > +
> > +    d.setVar('WKS_FILE', 'k3-verity.wks.in')
> > +    d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs')
> > +    d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR DM_VERITY_ROOT_PARTUUID')
> > +}
> > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
> > new file mode 100644
> > index 00000000..e5f6c1b2
> > --- /dev/null
> > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend
> > @@ -0,0 +1,5 @@
> > +do_install:append() {
> > +    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
> > +        : > ${D}${libdir}/udev/rules.d/50-arago.rules
>
> Why not simply remove the file?
>
>
> > +    fi
> > +}
> > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> > new file mode 100644
> > index 00000000..a14e21ea
> > --- /dev/null
> > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> > @@ -0,0 +1,6 @@
> > +# Nothing should ever get auto-mounted under dm-verity, so just kill the automounter.
> > +do_install:append() {
> > +    if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then
> > +        : > ${D}${sysconfdir}/udev/rules.d/automount.rules
>
> Same question as above.


We would get QA issues, if we exclude them as a whole. Thats why zeroing 
them made sense.

>
>
> > +    fi
> > +}
> > diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in
> > new file mode 100644
> > index 00000000..62ae0ec1
> > --- /dev/null
> > +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in
> > @@ -0,0 +1,5 @@
> > +# Disk layout for a board that boots with dm-verity enabled.
> > +
> > +bootloader --timeout=3 --append="rootfstype=ext4 root=PARTUUID=${DM_VERITY_ROOT_PARTUUID} ${TI_WKS_BOOTLOADER_APPEND}"
> > +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}${TI_WKS_INITRAMFS}" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M
> > +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 --uuid ${DM_VERITY_ROOT_PARTUUID}
> > -- 
> > 2.34.1
>   

Regards,
Atharv

[-- Attachment #2: Type: text/html, Size: 15713 bytes --]

Re: [EXTERNAL] Re: [meta-ti][master][PATCH v4 3/3] ti-core-initramfs: Extend with dm-verity support

[Atharv Dubey]

[-- Attachment #1: Type: text/plain, Size: 5791 bytes --]


On 30/09/26 21:54, Denys Dmytriyenko wrote:
> On Wed, Sep 30, 2026 at 06: 29: 38PM +0530, Atharv Dubey via 
> lists. yoctoproject. org wrote: > Add dm-verity support to 
> ti-core-initramfs by: > - Enabling dm-verity modules and tools 
> (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set
> ZjQcmQRYFpfptBannerStart
> This message was sent from outside of Texas Instruments.
> Do not click links or open attachments unless you recognize the source 
> of this email and know the content is safe.
> Report Suspicious
> <https://us-phishalarm-ewt.proofpoint.com/EWT/v1/G3vK!uJdqXRfPtmw7SgZE_JMD3PSdzRdTmnkXYRe2ioxpDfi8vZDP0_QavxK7wTdvuOnYrkFBk0RC1w$> 
>
> ZjQcmQRYFpfptBannerEnd
> On Wed, Sep 30, 2026 at 06:29:38PM +0530, Atharv Dubey via lists.yoctoproject.org wrote:
> > Add dm-verity support to ti-core-initramfs by:
> > - Enabling dm-verity modules and tools (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set
> > - Adding do_rootfs[nostamp] and do_image[nostamp] to rebuild initramfs after rootfs verity task completes
> > - Making deploy_verity_hash gracefully handle missing .verity.env file on first pass with bbwarn
> > 
> > Signed-off-by: Atharv Dubey <a-dubey@ti.com>
> > ---
> >  .../machine/include/ti-core-initramfs.inc     |  4 +--
> >  .../initramfs/ti-core-initramfs.bbappend      | 25 +++++++++++++++++++
> >  2 files changed, 27 insertions(+), 2 deletions(-)
> >  create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> > 
> > diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> > index c816f1dc..08da8e80 100644
> > --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> > +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> > @@ -5,7 +5,7 @@
> >  #   TI_CORE_INITRAMFS_ENABLED = "0"
> >  #
> >  #------------------------------------------------------------------------------
> > -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
> > +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) or d.getVar('DM_VERITY_IMAGE') else '0'}"
> >  
> >  TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
> >  TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
> > @@ -22,4 +22,4 @@ TI_WKS_INITRAMFS ?= "${@ ',initrd=${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('
> >  
> >  IMAGE_BOOT_FILES += "${@ '${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
> >  
> > -INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
> > +INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}"
> > \ No newline at end of file
>
> You are not changing the code here, but it shows as a diff because you lost
> the newline at the end of file.


Will fix this in the nxt revision.

>
>
> > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> > new file mode 100644
> > index 00000000..25fe775f
> > --- /dev/null
> > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend
> > @@ -0,0 +1,25 @@
> > +# Install the essential utils for dm-verity in ti-core-initramfs
> > +TI_CORE_INITRAMFS_EXTRA_INSTALL:append = "${@' initramfs-module-dmverity cryptsetup util-linux-mount' if 
> d.getVar('DM_VERITY_IMAGE') else ''}"
> > +
> > +# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE
> > +do_image[nostamp] = "1"
> > +do_rootfs[nostamp] = "1"
> > +
> > +IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
> > +
> > +deploy_verity_hash() {
> > +    # The .verity.env file is created by the DM_VERITY_IMAGE build (e.g., arago-base-image).
> > +    # On the first pass, it won't exist yet because the initramfs is built before the rootfs
> > +    # (due to INITRAMFS_IMAGE dependency). The do_rootfs[nostamp] = "1" causes this task
> > +    # to re-run after the rootfs is built, at which point the file will exist.
> > +    if [ -f ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ]; then
> > +        install -D -m 0644 \
> > +            ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \
> > +            ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
> > +    else
> > +        bbwarn "dm-verity.env not found at ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env - will retry on rebuild (nostamp)"
> > +    fi
> > +}
> > +
> > +
> > +IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
> > -- 
> > 2.34.1
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#20427):https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-ti/message/20427__;!!G3vK!VDAkXMq9ZcHrDAlzrWiJbW2ZJ5LBlhBeM-6UXmt_s_Dido7I4hdendkHIamu4ndIWJUqlByUPw$ 
> Mute This Topic:https://urldefense.com/v3/__https://lists.yoctoproject.org/mt/121507548/10595936__;!!G3vK!VDAkXMq9ZcHrDAlzrWiJbW2ZJ5LBlhBeM-6UXmt_s_Dido7I4hdendkHIamu4ndIWJWxPUKQYw$ 
> Group Owner:meta-ti+owner@lists.yoctoproject.org
> Unsubscribe:https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-ti/unsub__;!!G3vK!VDAkXMq9ZcHrDAlzrWiJbW2ZJ5LBlhBeM-6UXmt_s_Dido7I4hdendkHIamu4ndIWJWrjHS9XQ$  [a-dubey@ti.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

[-- Attachment #2: Type: text/html, Size: 13755 bytes --]