[PATCH 0/2] Allow GIT_SSL_CAINFO set by buildtools-tarball to work

[PATCH 0/2] Allow GIT_SSL_CAINFO set by buildtools-tarball to work

[Paul Eggleton]

The following changes since commit d6241e4c94a0a72acfc57e96a59918c0b2146d65:

  useradd: Fix infinite build loop (2016-05-23 10:33:39 +0100)

are available in the git repository at:

  git://git.openembedded.org/openembedded-core-contrib paule/git-ssl-cainfo
  http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=paule/git-ssl-cainfo

Paul Eggleton (2):
  oe-init-build-env: allow GIT_SSL_CAINFO from external environment
  conf/bitbake.conf: whitelist GIT_SSL_CAINFO

 meta/conf/bitbake.conf       | 3 ++-
 scripts/oe-buildenv-internal | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

-- 
2.5.5

[PATCH 1/2] oe-init-build-env: allow GIT_SSL_CAINFO from external environment

[Paul Eggleton]

buildtools-tarball sets GIT_SSL_CAINFO so that the included
ca-certificates can be used by git; that can't work however unless
the GIT_SSL_CAINFO is still set in the environment in which git gets
run by the fetcher, so allow it through from the external environment.

Fixes [YOCTO #9666].

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
---
 scripts/oe-buildenv-internal | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/oe-buildenv-internal b/scripts/oe-buildenv-internal
index 81ee784..3441b49 100755
--- a/scripts/oe-buildenv-internal
+++ b/scripts/oe-buildenv-internal
@@ -114,7 +114,7 @@ BB_ENV_EXTRAWHITE_OE="MACHINE DISTRO TCMODE TCLIBC HTTP_PROXY http_proxy \
 HTTPS_PROXY https_proxy FTP_PROXY ftp_proxy FTPS_PROXY ftps_proxy ALL_PROXY \
 all_proxy NO_PROXY no_proxy SSH_AGENT_PID SSH_AUTH_SOCK BB_SRCREV_POLICY \
 SDKMACHINE BB_NUMBER_THREADS BB_NO_NETWORK PARALLEL_MAKE GIT_PROXY_COMMAND \
-SOCKS5_PASSWD SOCKS5_USER SCREENDIR STAMPS_DIR BBPATH_EXTRA"
+SOCKS5_PASSWD SOCKS5_USER SCREENDIR STAMPS_DIR BBPATH_EXTRA GIT_SSL_CAINFO"
 
 BB_ENV_EXTRAWHITE="$(echo $BB_ENV_EXTRAWHITE $BB_ENV_EXTRAWHITE_OE | tr ' ' '\n' | LC_ALL=C sort --unique | tr '\n' ' ')"
 
-- 
2.5.5

Re: [PATCH 1/2] oe-init-build-env: allow GIT_SSL_CAINFO from external environment

[Richard Purdie]

On Tue, 2016-05-24 at 14:40 +1200, Paul Eggleton wrote:
> buildtools-tarball sets GIT_SSL_CAINFO so that the included
> ca-certificates can be used by git; that can't work however unless
> the GIT_SSL_CAINFO is still set in the environment in which git gets
> run by the fetcher, so allow it through from the external
> environment.
> 
> Fixes [YOCTO #9666].
> 
> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
> ---
>  scripts/oe-buildenv-internal | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Would it make more sense to just list this in
lib/bb/fetch2/__init__.py:runfetchcmd() instead?

In some ways I'd be in favour of pruning the main bitbake.conf list in
favour of just listing things like proxy variables there specifically
in the fetcher.

If users want to be able to configure that list, we could expose that
list from bitbake too...

Cheers,

Richard

Re: [PATCH 1/2] oe-init-build-env: allow GIT_SSL_CAINFO from external environment

[Paul Eggleton]

On Tue, 24 May 2016 08:25:58 Richard Purdie wrote:
> On Tue, 2016-05-24 at 14:40 +1200, Paul Eggleton wrote:
> > buildtools-tarball sets GIT_SSL_CAINFO so that the included
> > ca-certificates can be used by git; that can't work however unless
> > the GIT_SSL_CAINFO is still set in the environment in which git gets
> > run by the fetcher, so allow it through from the external
> > environment.
> > 
> > Fixes [YOCTO #9666].
> > 
> > Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
> > ---
> > 
> >  scripts/oe-buildenv-internal | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Would it make more sense to just list this in
> lib/bb/fetch2/__init__.py:runfetchcmd() instead?

Actually it's already included in that list, but it wasn't working in the eSDK 
I was testing which I hadn't noticed was built before bitbake rev 
20ad1ea87712d042bd5d89ce1957793f7ff71da0 where we now also look at BB_ORIGENV, 
so it appears neither of these patches are even needed. We may need to 
backport that change to krogoth to fix this problem there though.

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

[PATCH 2/2] conf/bitbake.conf: whitelist GIT_SSL_CAINFO

[Paul Eggleton]

Just as with the proxy variables, we don't need to reparse everything if
the value of this variable changes.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
---
 meta/conf/bitbake.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index acef30b..d85e806 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -815,7 +815,8 @@ BB_HASHCONFIG_WHITELIST ?= "${BB_HASHBASE_WHITELIST} DATE TIME SSH_AGENT_PID \
     SSH_AUTH_SOCK PSEUDO_BUILD BB_ENV_EXTRAWHITE DISABLE_SANITY_CHECKS \
     PARALLEL_MAKE BB_NUMBER_THREADS BB_ORIGENV BB_INVALIDCONF BBINCLUDED \
     GIT_PROXY_COMMAND ALL_PROXY all_proxy NO_PROXY no_proxy FTP_PROXY ftp_proxy \
-    HTTP_PROXY http_proxy HTTPS_PROXY https_proxy SOCKS5_USER SOCKS5_PASSWD"
+    HTTP_PROXY http_proxy HTTPS_PROXY https_proxy SOCKS5_USER SOCKS5_PASSWD \
+    GIT_SSL_CAINFO"
 BB_SIGNATURE_EXCLUDE_FLAGS ?= "doc deps depends \
     lockfiles type vardepsexclude vardeps vardepvalue vardepvalueexclude \
     file-checksums python func task export unexport noexec nostamp dirs cleandirs \
-- 
2.5.5