nss postinst requires nss-native during rootfs generation

[Mike Crowe <mac@mcrowe.com>]

We've recently added nss to our image and have started to see rootfs
generation anomalies. We use IMAGE_FEATURES = "read-only-rootfs" so
postinsts run at rootfs generation time.

nss's postinst calls shlibsign. Under normal circumstances with
read-only-rootfs, this appears to come from nss-native being in the native
sysroot during the build.

We're finding that nss-native isn't in the native sysroot at the time the
postinst runs if nss and nss-native come from the sstate cache.

I've simplied the problem enough to reproduce it with stock oe-core and
core-image-minimal. Add "nss" to IMAGE_INSTALL and "read-only-rootfs" to
IMAGE_FEATURES and then run:

 # First populate the sstate cache
 bitbake core-image-minimal

 # Then build again using the sstate cache
 rm -rf tmp-glibc
 bitbake -c rootfs core-image-minimal

I get:

 ERROR: core-image-minimal-1.0-r0 do_rootfs: The following packages could
 not be configured offline and rootfs is read-only: ['nss']

This could be because the image dependencies are incorrectly expressed.
task-depends.dot contains:

 "core-image-minimal.do_build" -> "nss-native.do_build"

Since I'm explicitly running do_rootfs this dependency is never taken into
account. I believe that a better dependency would be:

 "core-image-minimal.do_rootfs" -> "nss-native.do_build"

I can avoid the problem by running core-image-minimal.do_build rather than
core-image-minimal.do_rootfs but I'm worried that this opens the
possibility of a race since there's no guarantee that all of
core-image-minimal.do_build's dependencies have been satisfied before
core-image-minimal.do_rootfs runs.

Alternatively, perhaps nss's postinst isn't supposed to be relying on
nss-native at all in its postinst?

Any ideas?

Thanks.

Mike.