Re: [RFC][PATCH 6/6] local.conf.sample: make debug-tweaks depend on IMAGE_MODE

[Patrick Ohly <patrick.ohly@intel.com>]

On Mon, 2017-05-15 at 12:34 -0700, Khem Raj wrote:
> On Mon, May 15, 2017 at 12:18 PM, Patrick Ohly <patrick.ohly@intel.com> wrote:
> > On Mon, 2017-05-15 at 08:50 -0700, Khem Raj wrote:
> >> On Mon, May 15, 2017 at 6:27 AM, Patrick Ohly <patrick.ohly@intel.com> wrote:
> >> > Enabling "debug-tweaks" unconditionally, even if it is only in the
> >> > local.conf.sample file, runs the risk of that getting used in
> >> > production images.
> >> >
> >> > By checking the per-image IMAGE_MODE, the debug tweaks only get
> >> > enabled for images not meant for production.
> >> >
> >> > Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
> >> > ---
> >> >  meta/conf/local.conf.sample | 5 +++--
> >> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >> >
> >> > diff --git a/meta/conf/local.conf.sample b/meta/conf/local.conf.sample
> >> > index 85c5e21..edadbb7 100644
> >> > --- a/meta/conf/local.conf.sample
> >> > +++ b/meta/conf/local.conf.sample
> >> > @@ -114,8 +114,9 @@ PACKAGE_CLASSES ?= "package_ipk"
> >> >  #                     e.g. ssh root access has a blank password
> >> >  # There are other application targets that can be used here too, see
> >> >  # meta/classes/image.bbclass and meta/classes/core-image.bbclass for more details.
> >> > -# We default to enabling the debugging tweaks.
> >> > -EXTRA_IMAGE_FEATURES ?= "debug-tweaks"
> >> > +# We default to enabling the debugging tweaks unless an image is explicitly
> >> > +# requested to be built for production.
> >> > +EXTRA_IMAGE_FEATURES ?= "${@ '' if 'production' == d.getVar('IMAGE_MODE') else 'debug-tweaks'}"
> >>
> >> is IMAGE_MODE defined per image recipe ?
> >
> > Conceptually it is, although I guess it might get set globally in
> > practice.
> >
> > The class just defines the empty string (= no specific mode) as ??=
> > default. Then a distro's local.conf sample can define a weak ?= default,
> > probably "development" (similar to the current practice of enabling
> > debug-tweaks in local.conf.sample). Finally, specific image recipes
> > (like a core-image-minimal-development.bb which includes
> > core-image-minimal.bb) can force a fixed mode with
> > IMAGE_MODE_forcevariable = "development".
> 
> People use same distro with two different images for production and
> devcelopment and conrols are inserted via IMAGE_FEATURES
> with this change once effectively needs two different distros for prod and dev

Why that?

The production image recipe "foobar-image-production.bb" can use
IMAGE_MODE_forcevariable = "production"
and the development image recipe "foobar-image-development.bb" can use
IMAGE_MODE_forcevariable = "development".

Then whatever the user might configure in local.conf is ignored in favor
of the fixed recipe values. If there's a concern about using
_forcevariable: that could be addressed by configuring a global
IMAGE_MODE_DEFAULT ??= "" and an IMAGE_MODE ??= "${IMAGE_MODE_DEFAULT}"
in image-mode.bbclass and changing IMAGE_MODE_DEFAULT in distro or local
conf. Then individual recipes can set IMAGE_MODE =
"development/production" without having to fall back to _forcevariable.

Or do you mean that there's just one image .bb and traditionally
IMAGE_FEATURES were changed to switch back and forth? The same works
with IMAGE_MODE. The advantage over enabling or disabling dangerous
IMAGE_FEATURES is that users of a distro don't need to know about them.
They get the guarantee that (for a responsible distro) the dangerous
once will not get enabled by default for IMAGE_MODE=development.

-- 
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.