Yocto compatibility for meta-security layer

Yocto compatibility for meta-security layer

[Yi Zhao]

Hi folks,


I used yocto-check-layer to check Yocto compatibility of meta-security. 
The tool reported the following failures in meta-security layer:

INFO: FAIL: test_security (common.CommonCheckLayer)
INFO: ----------------------------------------------------------------------
INFO: Traceback (most recent call last):
   File "poky/scripts/lib/checklayer/cases/common.py", line 70, in 
test_security
     self.assertTrue(filename, msg="Layer doesn't contain a SECURITY.md 
file.")
AssertionError: None is not true : Layer doesn't contain a SECURITY.md file.


INFO: FAIL: test_signatures (common.CommonCheckLayer)
INFO: ----------------------------------------------------------------------
INFO: Traceback (most recent call last):
   File "poky/scripts/lib/checklayer/cases/common.py", line 130, in 
test_signatures
     self.fail('Adding layer %s changed signatures.\n%s' % 
(self.tc.layer['name'], msg))
AssertionError: Adding layer meta-security changed signatures.
32 signatures changed, initial differences (first hash before, second 
after):
    libmspack:do_recipe_qa: 
c95ae911bfeba96c673fd11d13933da5bee4df3a21e93b6b764ad47b7bceeaca -> 
2381779674028e9ef4608e56fb2159dc11f37d0c6b24050dc5da7069cdb25505
       bitbake-diffsigs --task libmspack do_recipe_qa --signature 
c95ae911bfeba96c673fd11d13933da5bee4df3a21e93b6b764ad47b7bceeaca 
2381779674028e9ef4608e56fb2159dc11f37d0c6b24050dc5da7069cdb25505
       NOTE: Reconnecting to bitbake server...
       Task dependencies changed from:
       ['HOMEPAGE', 'INSANE_SKIP', 'OE_SHARED_UMASK', 'PACKAGECONFIG', 
'PN', 'PR', 'PV', 'QA_ERRORS_FOUND', 'RECIPE_MAINTAINER', 'SRC_URI', 
'SRC_URI[sha256sum]', 'SSTATECREATEFUNCS', 'SSTATEPOSTCREATEFUNCS', 'SS
TATEPOSTUNPACKFUNCS', 'SSTATE_BUILDDIR', 'SSTATE_INSTDIR', 
'SSTATE_MANIFESTS', 'SSTATE_SCAN_FILES', 'SSTATE_SKIP_CREATION', 
'SUMMARY', 'do_recipe_qa[network]', 'do_recipe_qa[sstate-inputdirs]', 
'oe.path.copyhar
dlinktree', 'oe.path.copytree', 'oe.path.remove', 
'oe.qa.exit_if_errors', 'oe.qa.exit_with_message_if_errors', 
'oe.sstatesig.sstate_get_manifest_filename', 'sstate_add', 
'sstate_clean', 'sstate_clean_manifest',
  'sstate_init', 'sstate_install', 'sstate_installpkgdir', 
'sstate_package', 'sstate_state_fromvars', 'sstate_task_postfunc', 
'sstate_task_prefunc']
       to:
       ['HOMEPAGE', 'INSANE_SKIP', 'OE_SHARED_UMASK', 'PACKAGECONFIG', 
'PN', 'PR', 'PV', 'QA_ERRORS_FOUND', 'RECIPE_MAINTAINER', 'SRC_URI', 
'SSTATECREATEFUNCS', 'SSTATEPOSTCREATEFUNCS', 'SSTATEPOSTUNPACKFUNCS',
'SSTATE_BUILDDIR', 'SSTATE_INSTDIR', 'SSTATE_MANIFESTS', 
'SSTATE_SCAN_FILES', 'SSTATE_SKIP_CREATION', 'SUMMARY', 
'do_recipe_qa[network]', 'do_recipe_qa[sstate-inputdirs]', 
'oe.path.copyhardlinktree', 'oe.path.c
opytree', 'oe.path.remove', 'oe.qa.exit_if_errors', 
'oe.qa.exit_with_message_if_errors', 
'oe.sstatesig.sstate_get_manifest_filename', 'sstate_add', 
'sstate_clean', 'sstate_clean_manifest', 'sstate_init', 'sstat
e_install', 'sstate_installpkgdir', 'sstate_package', 
'sstate_state_fromvars', 'sstate_task_postfunc', 'sstate_task_prefunc']
       basehash changed from 
7389c2b644a0cbe3efb08eb36e79682648583737171690342d91f61f860d82b9 to 
3c44df2e06825629c6dd1be4b7e660fda1c4dc9155908baef64f3cb366cf42c2
       List of dependencies for variable SRC_URI changed from 
'frozenset({'SRC_URI[sha256sum]', 'PV'})' to 'frozenset()'
       Dependency on Variable SRC_URI[sha256sum] was removed
       Variable PV value changed from '0.11alpha' to '1.11'
       Variable SRC_URI value changed from 
'https://www.cabextract.org.uk/libmspack/libmspack-${PV}.tar.gz' to 
'git://github.com/kyz/libmspack.git;branch=master;protocol=https'


INFO: FAIL: test_signatures (common.CommonCheckLayer)
INFO: ----------------------------------------------------------------------
INFO: Traceback (most recent call last):
   File "poky/scripts/lib/checklayer/cases/common.py", line 130, in 
test_signatures
     self.fail('Adding layer %s changed signatures.\n%s' % 
(self.tc.layer['name'], msg))
AssertionError: Adding layer meta-tpm changed signatures.
22 signatures changed, initial differences (first hash before, second 
after):
    systemd-boot:do_configure: 
1ac6cccd94f468f2c258666e57b8f57338e63a85ba293abe360bd9440852da93 -> 
376daf18bae87ebdfddd9c9ab6bf95bfe06a830eea45bb8ade914de66e3f4fae
       bitbake-diffsigs --task systemd-boot do_configure --signature 
1ac6cccd94f468f2c258666e57b8f57338e63a85ba293abe360bd9440852da93 
376daf18bae87ebdfddd9c9ab6bf95bfe06a830eea45bb8ade914de66e3f4fae
       NOTE: Reconnecting to bitbake server...
       basehash changed from 
5af44540c3f151f0ffc33e381a6694b6b193b0494207170656323588ee0ccc4c to 
236e8f11f35d1dfebcb81c286f3ac82353cb92c78835a4064888a8a0c7aa405c
       Variable EXTRA_OEMESON value changed:
       @@ -1 +1,2 @@
       - -Defi=true -Dbootloader=true                   -Dman=false 
${PACKAGECONFIG_CONFARGS}
       + -Defi=true -Dbootloader=true                   -Dman=false 
${PACKAGECONFIG_CONFARGS} ${@bb.utils.contains('DISTRO_FEATURES', 
'tpm2', '-Dtpm2=true', '', d)}
       +DISTRO_FEATURES{tpm2} = Unset


INFO: FAIL: test_signatures (common.CommonCheckLayer)
INFO: ----------------------------------------------------------------------
INFO: Traceback (most recent call last):
   File "poky/scripts/lib/checklayer/cases/common.py", line 130, in 
test_signatures
     self.fail('Adding layer %s changed signatures.\n%s' % 
(self.tc.layer['name'], msg))
AssertionError: Adding layer meta-integrity changed signatures.
209 signatures changed, initial differences (first hash before, second 
after):
    linux-yocto:do_kernel_metadata: 
3a727f91c23ce583b5fc28f0e052fb118a79ce2f2bcc70e36db9774a2d7b3be0 -> 
6b3ea68b9a0f4feb86e074801010f82bcd0b0024ee25ea654b5c81bbb566a382
       bitbake-diffsigs --task linux-yocto do_kernel_metadata 
--signature 
3a727f91c23ce583b5fc28f0e052fb118a79ce2f2bcc70e36db9774a2d7b3be0 
6b3ea68b9a0f4feb86e074801010f82bcd0b0024ee25ea654b5c81bbb566a382
       NOTE: Reconnecting to bitbake server...
       Dependency on checksum of file ./audit.cfg was added



Here is the command I ran:
$ yocto-check-layer-wrapper ../meta-security --dependency ../meta 
../meta-openembedded/meta-oe ../meta-openembedded/meta-python/ 
../meta-clang --no-auto-dependency



Thanks,
Yi