[PATCH 00/16 V2] meta: various fixes

[PATCH 00/16 V2] meta: various fixes

[Robert Yang]

* V2:
  Rebase to up-to-date master branch and drop already merged patches.

* V1:
  Initial version

// Robert

The following changes since commit 760103cdaed3e820888d8984ec0b76cfc831d534:

  nativesdk-rpm: Add wrappers for nativesdk support (2018-05-29 21:06:03 +0100)

are available in the git repository at:

  git://git.openembedded.org/openembedded-core-contrib rbt/fix_from_wr
  http://cgit.openembedded.org/openembedded-core-contrib/log/?h=rbt/fix_from_wr

Catalin Enache (1):
  init-install: add timeout for legacy grub

Chen Qi (1):
  populate_sdk_ext.bbclass: add ESDK_MANIFEST_EXCLUDES

Jackie Huang (3):
  rootfs-postcommands: split ssh_allow_empty_password
  dropbear: add default config file to disable root login
  glibc: re-package for libnss-db

Jian Liu (1):
  lsof: fix LSOF_CCV in version.h

Kai Kang (1):
  toolchain-scripts.bbclass: do not extend dependency if extended
    already

Li Wang (1):
  rpcbind: add option to make user able to use fixed port number

Mark Hatle (1):
  base.bbclass: Add buildcfg multilib values

Ovidiu Panait (1):
  openssl-nativesdk: Fix "can't open config file" warning

Robert Yang (3):
  runqemu-extract-sdk: allow install debugfs on rootfs
  oe/copy_buildsystem.py: add SDK_LAYERS_EXCLUDE_PATTERN
  site/powerpc64-linux: add cvs_cv_func_printf_ptr

Shan Hai (1):
  xinetd: add Init Script Actions to xinetd script

Yadi.hu (1):
  busybox: handle syslog

Yuanjie Huang (1):
  gcc-sanitizers: Fix libtool .la files

 meta/classes/base.bbclass                          |  13 ++-
 meta/classes/image.bbclass                         |   2 +-
 meta/classes/populate_sdk_ext.bbclass              |   6 +
 meta/classes/rootfs-postcommands.bbclass           |  25 +++-
 meta/classes/toolchain-scripts.bbclass             |  13 ++-
 meta/conf/bitbake.conf                             |   2 +-
 meta/lib/oe/copy_buildsystem.py                    |  18 +++
 .../openssl/openssl/environment.d-openssl.sh       |   1 +
 meta/recipes-connectivity/openssl/openssl10.inc    |   7 ++
 .../recipes-connectivity/openssl/openssl_1.0.2o.bb |   5 +
 .../recipes-connectivity/openssl/openssl_1.1.0h.bb |  11 ++
 meta/recipes-core/busybox/busybox.inc              |  14 ++-
 meta/recipes-core/dropbear/dropbear.inc            |   3 +
 .../dropbear/dropbear/dropbear.default             |   2 +
 meta/recipes-core/glibc/glibc-package.inc          |   5 +-
 .../initrdscripts/files/init-install.sh            |   2 +
 meta/recipes-devtools/gcc/gcc-sanitizers.inc       |   2 +
 .../files/Configure-fix-LSOF_CCV-assignment.patch  |  31 +++++
 meta/recipes-extended/lsof/lsof_4.89.bb            |   4 +-
 .../rpcbind_add_option_to_fix_port_number.patch    | 130 +++++++++++++++++++++
 meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb     |   1 +
 meta/recipes-extended/xinetd/xinetd/xinetd.init    |  12 +-
 meta/site/powerpc64-linux                          |   2 +
 scripts/runqemu-extract-sdk                        |   4 +-
 24 files changed, 298 insertions(+), 17 deletions(-)
 create mode 100644 meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh
 create mode 100644 meta/recipes-core/dropbear/dropbear/dropbear.default
 create mode 100644 meta/recipes-extended/lsof/files/Configure-fix-LSOF_CCV-assignment.patch
 create mode 100644 meta/recipes-extended/rpcbind/rpcbind/rpcbind_add_option_to_fix_port_number.patch

-- 
2.7.4

[PATCH 01/16] base.bbclass: Add buildcfg multilib values

[Robert Yang]

From: Mark Hatle <mark.hatle@windriver.com>

When displaying the buildcfg for the end user, add in processing
of the multilib variants.  Only the items that are not the same as
the DEFAULTTUNE are displayed.

I.e.:
Build Configuration:
BB_VERSION        = "1.19.0"
BUILD_SYS         = "x86_64-linux"
NATIVELSBSTRING   = "CentOS-6.4"
DISTRO_VERSION    = "oe-core.0"
MACHINE           = "qemux86-64"
DEFAULTTUNE       = "x86-64"
TARGET_SYS        = "x86_64-oe-linux"
TUNE_FEATURES     = "m64"
TARGET_FPU        = ""
lib32:  DEFAULTTUNE       = "x86"
lib32:  TARGET_SYS        = "i586-oe-linux"
lib32:  TUNE_FEATURES     = "m32"
meta              = "master:1975f3d7bbeb184489a5d0a2e0de231f317d3e1b"

The order of the displayed elements was changed slightly to group the
host information together, as well as group the target information
together.

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 meta/classes/base.bbclass | 13 ++++++++++++-
 meta/conf/bitbake.conf    |  2 +-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/meta/classes/base.bbclass b/meta/classes/base.bbclass
index 1a359a0..47ecff4 100644
--- a/meta/classes/base.bbclass
+++ b/meta/classes/base.bbclass
@@ -188,7 +188,7 @@ def get_layers_branch_rev(d):
     return layers_branch_rev
 
 
-BUILDCFG_FUNCS ??= "buildcfg_vars get_layers_branch_rev buildcfg_neededvars"
+BUILDCFG_FUNCS ??= "buildcfg_vars buildcfg_multilibs get_layers_branch_rev buildcfg_neededvars"
 BUILDCFG_FUNCS[type] = "list"
 
 def buildcfg_vars(d):
@@ -198,6 +198,17 @@ def buildcfg_vars(d):
         if value is not None:
             yield '%-20s = "%s"' % (var, value)
 
+def buildcfg_multilibs(d):
+    variants = d.getVar("MULTILIB_VARIANTS", True) or ""
+    for variant in variants.split():
+        localdata = get_multilib_datastore(variant, d)
+        statusvars = oe.data.typed_value('BUILDCFG_VARS', d)
+        for var in statusvars:
+            origvalue = d.getVar(var, True)
+            variantvalue = localdata.getVar(var, True)
+            if origvalue and variantvalue and origvalue != variantvalue:
+                yield '%-7s %-17s = "%s"' % (variant + ":", var, variantvalue)
+
 def buildcfg_neededvars(d):
     needed_vars = oe.data.typed_value("BUILDCFG_NEEDEDVARS", d)
     pesteruser = []
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index 6ecf78b..73686ea 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -699,7 +699,7 @@ PREFERRED_PROVIDER_virtual/fakeroot-native ?= "pseudo-native"
 
 # Pre-build configuration output
 BUILDCFG_HEADER = "Build Configuration:"
-BUILDCFG_VARS = "BB_VERSION BUILD_SYS NATIVELSBSTRING TARGET_SYS MACHINE DISTRO DISTRO_VERSION TUNE_FEATURES TARGET_FPU"
+BUILDCFG_VARS = "BB_VERSION BUILD_SYS NATIVELSBSTRING DISTRO DISTRO_VERSION MACHINE DEFAULTTUNE TARGET_SYS TUNE_FEATURES TARGET_FPU"
 BUILDCFG_VARS[type] = "list"
 BUILDCFG_NEEDEDVARS = "TARGET_ARCH TARGET_OS"
 BUILDCFG_NEEDEDVARS[type] = "list"
-- 
2.7.4

[PATCH 02/16] runqemu-extract-sdk: allow install debugfs on rootfs

[Robert Yang]

Usually, the debugfs' (-dbg.tar.*) work follow is:
1) Install regular rootfs to dir_foo
2) Install debugfs (-dbg.tar.*) to the same dir_foo

So we need to allow installing the debugfs on top of the rootfs.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 scripts/runqemu-extract-sdk | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/runqemu-extract-sdk b/scripts/runqemu-extract-sdk
index 2a0dd50..f4286ef 100755
--- a/scripts/runqemu-extract-sdk
+++ b/scripts/runqemu-extract-sdk
@@ -76,7 +76,9 @@ fi
 pseudo_state_dir="$SDK_ROOTFS_DIR/../$(basename "$SDK_ROOTFS_DIR").pseudo_state"
 pseudo_state_dir="$(readlink -f $pseudo_state_dir)"
 
-if [ -e "$pseudo_state_dir" ]; then
+debug_image="`echo $ROOTFS_TARBALL | grep '\-dbg\.tar\.'`"
+
+if [ -e "$pseudo_state_dir" -a -z "$debug_image" ]; then
 	echo "Error: $pseudo_state_dir already exists!"
 	echo "Please delete the rootfs tree and pseudo directory manually"
         echo "if this is really what you want."
-- 
2.7.4

[PATCH 03/16] lsof: fix LSOF_CCV in version.h

[Robert Yang]

From: Jian Liu <jian.liu@windriver.com>

When using cross compiler to build the package "lsof" on a host,
the value of LSOF_CCV in version.h genegrated by the Makefile
is the version of the compiler on the host while it should be
the version of cross compiler.

On Ubuntu host before fixed:
  #define LSOF_CCV        "4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) "

After fixed:
  #define   LSOF_CCV        "4.9.1 (GCC) "

Signed-off-by: Jian Liu <jian.liu@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
 .../files/Configure-fix-LSOF_CCV-assignment.patch  | 31 ++++++++++++++++++++++
 meta/recipes-extended/lsof/lsof_4.89.bb            |  4 ++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-extended/lsof/files/Configure-fix-LSOF_CCV-assignment.patch

diff --git a/meta/recipes-extended/lsof/files/Configure-fix-LSOF_CCV-assignment.patch b/meta/recipes-extended/lsof/files/Configure-fix-LSOF_CCV-assignment.patch
new file mode 100644
index 0000000..a182925
--- /dev/null
+++ b/meta/recipes-extended/lsof/files/Configure-fix-LSOF_CCV-assignment.patch
@@ -0,0 +1,31 @@
+From c197389c9d8ccdbfcfe1dc31da6b4ce69b90ecf6 Mon Sep 17 00:00:00 2001
+From: Wenzong Fan <wenzong.fan@windriver.com>
+Date: Thu, 23 Oct 2014 03:43:27 -0400
+Subject: [PATCH] Configure: fix LSOF_CCV assignment
+
+Allow to use specified LSOF_CC to get the version of linux compiler.
+
+Upstream-Status: Pending
+
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+---
+ Configure |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Configure b/Configure
+index 29c1292..e5a199f 100755
+--- a/Configure
++++ b/Configure
+@@ -2705,8 +2705,8 @@ LOCKF_OWNER4
+     if test "X$LSOF_CC" = "X"	# {
+     then
+       LSOF_CC=cc
+-      LSOF_CCV=`$LSOF_CC -v 2>&1 | sed -n 's/.*version \(.*\)/\1/p'`
+     fi	# }
++    LSOF_CCV=`$LSOF_CC -v 2>&1 | sed -n 's/.*version \(.*\)/\1/p'`
+     if test "X$LINUX_CONF_CC" = "X"	# {
+     then
+       LINUX_CONF_CC=$LSOF_CC
+-- 
+1.7.9.5
+
diff --git a/meta/recipes-extended/lsof/lsof_4.89.bb b/meta/recipes-extended/lsof/lsof_4.89.bb
index 14546db..52b40dc 100644
--- a/meta/recipes-extended/lsof/lsof_4.89.bb
+++ b/meta/recipes-extended/lsof/lsof_4.89.bb
@@ -13,7 +13,8 @@ LIC_FILES_CHKSUM = "file://00README;beginline=645;endline=679;md5=964df275d26429
 
 SRC_URI = "http://www.mirrorservice.org/sites/lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_${PV}.tar.bz2 \
            file://lsof-remove-host-information.patch \
-          "
+           file://Configure-fix-LSOF_CCV-assignment.patch \
+"
 
 SRC_URI[md5sum] = "1b9cd34f3fb86856a125abbf2be3a386"
 SRC_URI[sha256sum] = "81ac2fc5fdc944793baf41a14002b6deb5a29096b387744e28f8c30a360a3718"
@@ -40,6 +41,7 @@ python do_unpack () {
 export LSOF_INCLUDE = "${STAGING_INCDIR}"
 
 do_configure () {
+	export LSOF_CC="${CC}"
 	export LSOF_AR="${AR} cr"
 	export LSOF_RANLIB="${RANLIB}"
 	if [ "x${GLIBCVERSION}" != "x" ]; then
-- 
2.7.4

[PATCH 04/16] busybox: handle syslog

[Robert Yang]

From: "Yadi.hu" <yadi.hu@windriver.com>

If CONFIG_KLOGD is not enabled, then the related service file should
not be installed, The error message is below:

    Cannot add dependency job for unit busybox-klogd.service,
    ignoring: Unit busybox-klogd.service failed to load:
    No such file or directory.

So we should first check the configuration before we install these
service files.

Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
 meta/recipes-core/busybox/busybox.inc | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/meta/recipes-core/busybox/busybox.inc b/meta/recipes-core/busybox/busybox.inc
index d1675c3..8c6dbba 100644
--- a/meta/recipes-core/busybox/busybox.inc
+++ b/meta/recipes-core/busybox/busybox.inc
@@ -315,20 +315,24 @@ do_install () {
         fi
 
     if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
+        if grep -q "CONFIG_KLOGD=y" ${B}/.config; then
+            install -d ${D}${systemd_unitdir}/system
+            sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-klogd.service.in \
+            > ${D}${systemd_unitdir}/system/busybox-klogd.service
+        fi
+
         if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then
             install -d ${D}${systemd_unitdir}/system
             sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-syslog.service.in \
 		> ${D}${systemd_unitdir}/system/busybox-syslog.service
+            if  [ ! -e ${D}${systemd_unitdir}/system/busybox-klogd.service ] ; then
+                sed -i '/klog/d' ${D}${systemd_unitdir}/system/busybox-syslog.service
+            fi
             if [ -f ${WORKDIR}/busybox-syslog.default ] ; then
 		install -d ${D}${sysconfdir}/default
 		install -m 0644 ${WORKDIR}/busybox-syslog.default ${D}${sysconfdir}/default/busybox-syslog
             fi
         fi
-        if grep -q "CONFIG_KLOGD=y" ${B}/.config; then
-            install -d ${D}${systemd_unitdir}/system
-            sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-klogd.service.in \
-		> ${D}${systemd_unitdir}/system/busybox-klogd.service
-        fi
     fi
 
     # Remove the sysvinit specific configuration file for systemd systems to avoid confusion
-- 
2.7.4

[PATCH 05/16] xinetd: add Init Script Actions to xinetd script

[Robert Yang]

From: Shan Hai <shan.hai@windriver.com>

The chkconfig fails to list the xinetd service because the xinetd
lacks Init Script Actions in it, add the actions to fix it.

Signed-off-by: Shan Hai <shan.hai@windriver.com>
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
---
 meta/recipes-extended/xinetd/xinetd/xinetd.init | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-extended/xinetd/xinetd/xinetd.init b/meta/recipes-extended/xinetd/xinetd/xinetd.init
index 777c2c8..a021410 100644
--- a/meta/recipes-extended/xinetd/xinetd/xinetd.init
+++ b/meta/recipes-extended/xinetd/xinetd/xinetd.init
@@ -1,5 +1,15 @@
 #!/bin/sh
-#
+### BEGIN INIT INFO
+# Provides:          inetd
+# Required-Start:    $local_fs $remote_fs
+# Required-Stop:     $local_fs $remote_fs
+# Should-Start:      $syslog
+# Should-Stop:       $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start or stop the xinetd daemon.
+### END INIT INFO
+
 # /etc/init.d/xinetd  --  script to start and stop xinetd.
 
 # Source function library.
-- 
2.7.4

[PATCH 06/16] gcc-sanitizers: Fix libtool .la files

[Robert Yang]

From: Yuanjie Huang <yuanjie.huang@windriver.com>

Since libtool sysroot is not set when compiling sanitizers, the libtool
does no prefix the dependency path correctly. Fix it, so that programs
can link to sanitizer libraries without error.

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
---
 meta/recipes-devtools/gcc/gcc-sanitizers.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/gcc/gcc-sanitizers.inc b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
index e5e8452..2373dd8 100644
--- a/meta/recipes-devtools/gcc/gcc-sanitizers.inc
+++ b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
@@ -39,6 +39,8 @@ do_install () {
         rmdir --ignore-fail-on-non-empty -p ${D}${infodir}
     fi
     chown -R root:root ${D}
+    # Fix broken libtool with stdc++, as sysroot is not set.
+    find ${D} -name \*.la -exec sed -i "/^dependency_libs=/s@'${libdir}'@=${libdir}@g" {} \;
 }
 
 INHIBIT_DEFAULT_DEPS = "1"
-- 
2.7.4

[PATCH 07/16] oe/copy_buildsystem.py: add SDK_LAYERS_EXCLUDE_PATTERN

[Robert Yang]

It is helpful when exclude a lot of layers. It uses python re, and
supports multiple patterns (separated by space).

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 meta/lib/oe/copy_buildsystem.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/meta/lib/oe/copy_buildsystem.py b/meta/lib/oe/copy_buildsystem.py
index 4b94806..c43c2bd 100644
--- a/meta/lib/oe/copy_buildsystem.py
+++ b/meta/lib/oe/copy_buildsystem.py
@@ -1,5 +1,12 @@
 # This class should provide easy access to the different aspects of the
 # buildsystem such as layers, bitbake location, etc.
+#
+# SDK_LAYERS_EXCLUDE: Layers which will be excluded from SDK layers.
+# SDK_LAYERS_EXCLUDE_PATTERN: The simiar to SDK_LAYERS_EXCLUDE, this supports
+#                             python regular expression, use space as separator,
+#                              e.g.: ".*-downloads closed-.*"
+#
+
 import stat
 import shutil
 
@@ -23,8 +30,10 @@ class BuildSystem(object):
         self.context = context
         self.layerdirs = [os.path.abspath(pth) for pth in d.getVar('BBLAYERS').split()]
         self.layers_exclude = (d.getVar('SDK_LAYERS_EXCLUDE') or "").split()
+        self.layers_exclude_pattern = d.getVar('SDK_LAYERS_EXCLUDE_PATTERN')
 
     def copy_bitbake_and_layers(self, destdir, workspace_name=None):
+        import re
         # Copy in all metadata layers + bitbake (as repositories)
         layers_copied = []
         bb.utils.mkdirhier(destdir)
@@ -40,8 +49,17 @@ class BuildSystem(object):
         # Exclude layers
         for layer_exclude in self.layers_exclude:
             if layer_exclude in layers:
+                bb.note('Excluded %s from sdk layers since it is in SDK_LAYERS_EXCLUDE' % layer_exclude)
                 layers.remove(layer_exclude)
 
+        if self.layers_exclude_pattern:
+            layers_cp = layers[:]
+            for pattern in self.layers_exclude_pattern.split():
+                for layer in layers_cp:
+                    if re.match(pattern, layer):
+                        bb.note('Excluded %s from sdk layers since matched SDK_LAYERS_EXCLUDE_PATTERN' % layer)
+                        layers.remove(layer)
+
         workspace_newname = workspace_name
         if workspace_newname:
             layernames = [os.path.basename(layer) for layer in layers]
-- 
2.7.4

[PATCH 08/16] site/powerpc64-linux: add cvs_cv_func_printf_ptr

[Robert Yang]

Fixed when powerpc64:
$ bitbake <image> -ctestsdk
[snip]
checking whether printf supports %p... configure: error: cannot run test program while cross compiling
See `config.log' for more details.
test_cvs (oeqa.sdk.buildcvs.BuildCvsTest) ... FAIL
[snip]

The cvs_cv_func_printf_ptr is already in powerpc32-linux.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 meta/site/powerpc64-linux | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/site/powerpc64-linux b/meta/site/powerpc64-linux
index d64e230..820a4b8 100644
--- a/meta/site/powerpc64-linux
+++ b/meta/site/powerpc64-linux
@@ -37,3 +37,5 @@ ac_cv_linux_vers=${ac_cv_linux_vers=2}
 # apr
 apr_cv_tcp_nodelay_with_cork=${apr_cv_tcp_nodelay_with_cork=yes}
 
+# cvs
+cvs_cv_func_printf_ptr=${cvs_cv_func_printf_ptr=yes}
-- 
2.7.4

[PATCH 09/16] rootfs-postcommands: split ssh_allow_empty_password

[Robert Yang]

From: Jackie Huang <jackie.huang@windriver.com>

"allow root login" should not be bundled in ssh_allow_empty_password,
because some distro may want only one of "allow root login" and "allow
empty password", so split it out into ssh_allow_root_login and add new
imagefeature allow-root-login so they can be controlled separately,
debug-tweaks will still include both of them.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
---
 meta/classes/image.bbclass               |  2 +-
 meta/classes/rootfs-postcommands.bbclass | 25 ++++++++++++++++++++++---
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
index 2247b30..28e64ba 100644
--- a/meta/classes/image.bbclass
+++ b/meta/classes/image.bbclass
@@ -23,7 +23,7 @@ inherit ${TESTIMAGECLASS}
 # IMAGE_FEATURES may contain any available package group
 IMAGE_FEATURES ?= ""
 IMAGE_FEATURES[type] = "list"
-IMAGE_FEATURES[validitems] += "debug-tweaks read-only-rootfs empty-root-password allow-empty-password post-install-logging"
+IMAGE_FEATURES[validitems] += "debug-tweaks read-only-rootfs empty-root-password allow-empty-password allow-root-login post-install-logging"
 
 # Generate companion debugfs?
 IMAGE_GEN_DEBUGFS ?= "0"
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index 5522209..72cc6db 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -2,9 +2,12 @@
 # Zap the root password if debug-tweaks feature is not enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains_any("IMAGE_FEATURES", [ 'debug-tweaks', 'empty-root-password' ], "", "zap_empty_root_password ; ",d)}'
 
-# Allow dropbear/openssh to accept logins from accounts with an empty password string if debug-tweaks is enabled
+# Allow dropbear/openssh to accept logins from accounts with an empty password string if debug-tweaks or allow-empty-password is enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains_any("IMAGE_FEATURES", [ 'debug-tweaks', 'allow-empty-password' ], "ssh_allow_empty_password; ", "",d)}'
 
+# Allow dropbear/openssh to accept root logins if debug-tweaks or allow-root-login is enabled
+ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains_any("IMAGE_FEATURES", [ 'debug-tweaks', 'allow-root-login' ], "ssh_allow_root_login; ", "",d)}'
+
 # Enable postinst logging if debug-tweaks is enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains_any("IMAGE_FEATURES", [ 'debug-tweaks', 'post-install-logging' ], "postinst_enable_logging; ", "",d)}'
 
@@ -146,12 +149,11 @@ zap_empty_root_password () {
 }
 
 #
-# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
+# allow dropbear/openssh to accept logins from accounts with an empty password string
 #
 ssh_allow_empty_password () {
 	for config in sshd_config sshd_config_readonly; do
 		if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
-			sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
 			sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
 		fi
 	done
@@ -174,6 +176,23 @@ ssh_allow_empty_password () {
 	fi
 }
 
+#
+# allow dropbear/openssh to accept root logins
+#
+ssh_allow_root_login () {
+	for config in sshd_config sshd_config_readonly; do
+		if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
+			sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
+		fi
+	done
+
+	if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+		if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
+			sed -i '/^DROPBEAR_EXTRA_ARGS=/ s/-w//' ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+		fi
+	fi
+}
+
 ssh_disable_dns_lookup () {
 	if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
 		sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
-- 
2.7.4

[PATCH 10/16] dropbear: add default config file to disable root login

[Robert Yang]

From: Jackie Huang <jackie.huang@windriver.com>

root login is disabled by default for openssh and we can
enable it through IMAGE_FEATURES 'debug-tweaks' or
'allow-empty-password', so change to the same default
behavior for dropbear.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
---
 meta/recipes-core/dropbear/dropbear.inc              | 3 +++
 meta/recipes-core/dropbear/dropbear/dropbear.default | 2 ++
 2 files changed, 5 insertions(+)
 create mode 100644 meta/recipes-core/dropbear/dropbear/dropbear.default

diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc
index 16ac644..9596363 100644
--- a/meta/recipes-core/dropbear/dropbear.inc
+++ b/meta/recipes-core/dropbear/dropbear.inc
@@ -20,6 +20,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://dropbearkey.service \
            file://dropbear@.service \
            file://dropbear.socket \
+           file://dropbear.default \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} "
 
 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
@@ -63,6 +64,8 @@ do_install() {
 		${D}${sbindir} \
 		${D}${localstatedir}
 
+	install -m 0644 ${WORKDIR}/dropbear.default ${D}${sysconfdir}/default/dropbear
+
 	install -m 0755 dropbearmulti ${D}${sbindir}/
 	ln -s ${sbindir}/dropbearmulti ${D}${bindir}/dbclient
 
diff --git a/meta/recipes-core/dropbear/dropbear/dropbear.default b/meta/recipes-core/dropbear/dropbear/dropbear.default
new file mode 100644
index 0000000..522453a
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/dropbear.default
@@ -0,0 +1,2 @@
+# Disallow root logins by default
+DROPBEAR_EXTRA_ARGS="-w"
-- 
2.7.4

[PATCH 11/16] toolchain-scripts.bbclass: do not extend dependency if extended already

[Robert Yang]

From: Kai Kang <kai.kang@windriver.com>

When set MULTILIBS with two or more items, such as for mips64:

MULTILIBS ?= "multilib:lib32 multilib:libn32"

It expands dependency once in mutlib.bbclass, and expand again in
toolchain-scripts.bbclass which causes error:

| ERROR: Nothing PROVIDES 'virtual/lib32-libn32-libc'. Close matches:
|   virtual/libn32-libc
|   virtual/lib32-libc
|   virtual/libn32-librpc
| ERROR: Required build target 'libn32-meta-ide-support' has no buildable providers.
| Missing or unbuildable dependency chain was: ['libn32-meta-ide-support', 'virtual/lib32-libn32-libc']

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 meta/classes/toolchain-scripts.bbclass | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/meta/classes/toolchain-scripts.bbclass b/meta/classes/toolchain-scripts.bbclass
index 71da5e5..848bff4 100644
--- a/meta/classes/toolchain-scripts.bbclass
+++ b/meta/classes/toolchain-scripts.bbclass
@@ -170,7 +170,18 @@ python __anonymous () {
     deps = ""
     for dep in (d.getVar('TOOLCHAIN_NEED_CONFIGSITE_CACHE') or "").split():
         deps += " %s:do_populate_sysroot" % dep
-        for variant in (d.getVar('MULTILIB_VARIANTS') or "").split():
+        ml_variants = (d.getVar('MULTILIB_VARIANTS') or "").split()
+
+        # don't extend if dep has been extended already
+        extended = False
+        for variant in ml_variants:
+            if dep.startswith(variant) or dep.startswith('virtual/' + variant):
+                extended = True
+                break
+        if extended:
+            continue
+
+        for variant in ml_variants:
             clsextend = oe.classextend.ClassExtender(variant, d)
             newdep = clsextend.extend_name(dep)
             deps += " %s:do_populate_sysroot" % newdep
-- 
2.7.4

[PATCH 12/16] populate_sdk_ext.bbclass: add ESDK_MANIFEST_EXCLUDES

[Robert Yang]

From: Chen Qi <Qi.Chen@windriver.com>

Add ESDK_MANIFEST_EXCLUDES to enable excluding items in sdk-conf-manifest.

By default, files under conf/ are all added to sdk-conf-manifest, as the
manifest file is set to 'conf/*'.

However, there are situations where some configuration files under conf/
directory are not intended to be added to sdk-conf-manifest, thus adding
ESDK_MANIFEST_EXCLUDES to enable users to do this.

This variable takes the form of glob matching.
e.g.
ESDK_MANIFEST_EXCLUDES = "conf/autogen*"
This would exclude all files under conf/ starting with 'autogen' from
sdk-conf-manifest.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/classes/populate_sdk_ext.bbclass | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta/classes/populate_sdk_ext.bbclass b/meta/classes/populate_sdk_ext.bbclass
index e1bba49..017c4b6 100644
--- a/meta/classes/populate_sdk_ext.bbclass
+++ b/meta/classes/populate_sdk_ext.bbclass
@@ -484,12 +484,18 @@ python copy_buildsystem () {
     # sdk_ext_postinst() below) thus the checksum we take here would always
     # be different.
     manifest_file_list = ['conf/*']
+    esdk_manifest_excludes = (d.getVar('ESDK_MANIFEST_EXCLUDES') or '').split()
+    esdk_manifest_excludes_list = []
+    for exclude_item in esdk_manifest_excludes:
+        esdk_manifest_excludes_list += glob.glob(os.path.join(baseoutpath, exclude_item))
     manifest_file = os.path.join(baseoutpath, 'conf', 'sdk-conf-manifest')
     with open(manifest_file, 'w') as f:
         for item in manifest_file_list:
             for fn in glob.glob(os.path.join(baseoutpath, item)):
                 if fn == manifest_file:
                     continue
+                if fn in esdk_manifest_excludes_list:
+                    continue
                 chksum = bb.utils.sha256_file(fn)
                 f.write('%s\t%s\n' % (chksum, os.path.relpath(fn, baseoutpath)))
 }
-- 
2.7.4

[PATCH 13/16] init-install: add timeout for legacy grub

[Robert Yang]

From: Catalin Enache <catalin.enache@windriver.com>

After installing an image from an iso, booting the system using
the legacy boots makes the grub prompt wait for an enter.

This is not desirable since many of this devices are embedded
devices that should start by them self without user entry.

Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
---
 meta/recipes-core/initrdscripts/files/init-install.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-core/initrdscripts/files/init-install.sh b/meta/recipes-core/initrdscripts/files/init-install.sh
index 28e8f09..e715796 100644
--- a/meta/recipes-core/initrdscripts/files/init-install.sh
+++ b/meta/recipes-core/initrdscripts/files/init-install.sh
@@ -302,6 +302,8 @@ if [ -f /etc/grub.d/00_header -a $grub_version -ne 0 ] ; then
     GRUBCFG="/boot/grub/grub.cfg"
     mkdir -p $(dirname $GRUBCFG)
     cat >$GRUBCFG <<_EOF
+timeout=5
+default=0
 menuentry "Linux" {
     search --no-floppy --fs-uuid $boot_uuid --set root
     linux /$kernel root=PARTUUID=$root_part_uuid $rootwait rw $5 $3 $4 quiet
-- 
2.7.4

[PATCH 14/16] glibc: re-package for libnss-db

[Robert Yang]

From: Jackie Huang <jackie.huang@windriver.com>

On other distros like ubuntu/centos, libnss-db usually provides:
- The libraries
- The Makefile to create database
  (in /var/db for centos, /var/lib/misc/ for ubuntu)
- The makedb command (it's in glibc-common for centos7)

What we had is:
- The libraries are in glibc-extra-nss
- The Makefile is removed
- The makedb command is in glibc-utils (lack of dependency)

So when glibc-extra-nss is installed but glibc-utils is not,
we see error like:
nscd[165]: 165 checking for monitored file `/var/db/group.db': No such file or directory
nscd[165]: 165 checking for monitored file `/var/db/passwd.db': No such file or directory

And there is not an easy way to create these databases.

To fix the issue:
- Re-package the libraries into libnss-db
- Don't remove the Makefile and add it in libnss-db
- Add RDEPENDS for libnss-db on glibc-utils and make

Notes:
For external toolchain, an extra package 'libnss-db' need to be provided
If replacing glibc from core.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
---
 meta/recipes-core/glibc/glibc-package.inc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/glibc/glibc-package.inc b/meta/recipes-core/glibc/glibc-package.inc
index ae3f2f6..ad0c6d5 100644
--- a/meta/recipes-core/glibc/glibc-package.inc
+++ b/meta/recipes-core/glibc/glibc-package.inc
@@ -1,6 +1,6 @@
 INHIBIT_SYSROOT_STRIP = "1"
 
-PACKAGES = "${PN}-dbg catchsegv sln nscd ldd tzcode glibc-thread-db ${PN}-pic libcidn libmemusage libsegfault ${PN}-pcprofile libsotruss ${PN} ${PN}-utils glibc-extra-nss ${PN}-dev ${PN}-staticdev ${PN}-doc"
+PACKAGES = "${PN}-dbg catchsegv sln nscd ldd tzcode glibc-thread-db ${PN}-pic libcidn libmemusage libnss-db libsegfault ${PN}-pcprofile libsotruss ${PN} ${PN}-utils glibc-extra-nss ${PN}-dev ${PN}-staticdev ${PN}-doc"
 
 # The ld.so in this glibc supports the GNU_HASH
 RPROVIDES_${PN} = "eglibc rtld(GNU_HASH)"
@@ -23,6 +23,8 @@ FILES_ldd = "${bindir}/ldd"
 FILES_libsegfault = "${base_libdir}/libSegFault*"
 FILES_libcidn = "${base_libdir}/libcidn-*.so ${base_libdir}/libcidn.so.*"
 FILES_libmemusage = "${base_libdir}/libmemusage.so"
+FILES_libnss-db = "${base_libdir}/libnss_db.so.* ${base_libdir}/libnss_db-*.so ${localstatedir}/db/Makefile"
+RDEPENDS_libnss-db = "${PN}-utils make"
 FILES_glibc-extra-nss = "${base_libdir}/libnss_*-*.so ${base_libdir}/libnss_*.so.*"
 FILES_sln = "${base_sbindir}/sln"
 FILES_${PN}-pic = "${libdir}/*_pic.a ${libdir}/*_pic.map ${libdir}/libc_pic/*.o"
@@ -59,7 +61,6 @@ inherit libc-common multilib_header
 
 do_install_append () {
 	rm -f ${D}${sysconfdir}/localtime
-	rm -rf ${D}${localstatedir}
 
 	# remove empty glibc dir
 	if [ -d ${D}${libexecdir} ]; then
-- 
2.7.4

[PATCH 15/16] rpcbind: add option to make user able to use fixed port number

[Robert Yang]

From: Li Wang <li.wang@windriver.com>

Add option "-p" to specify fixed port number

Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 .../rpcbind_add_option_to_fix_port_number.patch    | 130 +++++++++++++++++++++
 meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb     |   1 +
 2 files changed, 131 insertions(+)
 create mode 100644 meta/recipes-extended/rpcbind/rpcbind/rpcbind_add_option_to_fix_port_number.patch

diff --git a/meta/recipes-extended/rpcbind/rpcbind/rpcbind_add_option_to_fix_port_number.patch b/meta/recipes-extended/rpcbind/rpcbind/rpcbind_add_option_to_fix_port_number.patch
new file mode 100644
index 0000000..434b6b1
--- /dev/null
+++ b/meta/recipes-extended/rpcbind/rpcbind/rpcbind_add_option_to_fix_port_number.patch
@@ -0,0 +1,130 @@
+From 76f8598fd20727908e760cbb497dd6a17eda4af5 Mon Sep 17 00:00:00 2001
+From: Roy Li <rongqing.li@windriver.com>
+Date: Wed, 17 Sep 2014 13:22:14 +0800
+Subject: [PATCH] add option to make users able to use fixed port number
+
+Upstream-Status: Submitted [https://sourceforge.net/p/rpcbind/discussion/716839/thread/32af721d/]
+
+Signed-off-by: Li Wang <li.wang@windriver.com>
+Signed-off-by: Roy Li <rongqing.li@windriver.com>
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ man/rpcbind.8      |  4 +++-
+ src/rpcb_svc_com.c | 17 +++++++++++++++++
+ src/rpcbind.c      |  8 ++++++--
+ 3 files changed, 26 insertions(+), 3 deletions(-)
+
+diff --git a/man/rpcbind.8 b/man/rpcbind.8
+index af6200f..2e6146b 100644
+--- a/man/rpcbind.8
++++ b/man/rpcbind.8
+@@ -11,7 +11,7 @@
+ .Nd universal addresses to RPC program number mapper
+ .Sh SYNOPSIS
+ .Nm
+-.Op Fl adhiLls
++.Op Fl adhpiLls
+ .Sh DESCRIPTION
+ The
+ .Nm
+@@ -107,6 +107,8 @@ will automatically add
+ and if IPv6 is enabled,
+ .Li ::1
+ to the list.
++.It Fl p
++Bind for fixed UDP port number
+ .It Fl i
+ .Dq Insecure
+ mode.
+diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
+index 8aef9e5..c2632a4 100644
+--- a/src/rpcb_svc_com.c
++++ b/src/rpcb_svc_com.c
+@@ -48,6 +48,7 @@
+ #include <rpc/rpc.h>
+ #include <rpc/rpcb_prot.h>
+ #include <rpc/svc_dg.h>
++#include <rpc/rpc_com.h>
+ #include <netconfig.h>
+ #include <errno.h>
+ #include <syslog.h>
+@@ -497,6 +498,7 @@ xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
+ 
+ static struct rmtcallfd_list *rmthead;
+ static struct rmtcallfd_list *rmttail;
++extern unsigned short fixed_port;
+ 
+ int
+ create_rmtcall_fd(struct netconfig *nconf)
+@@ -504,6 +506,8 @@ create_rmtcall_fd(struct netconfig *nconf)
+ 	int fd;
+ 	struct rmtcallfd_list *rmt;
+ 	SVCXPRT *xprt;
++	struct __rpc_sockinfo si;
++	struct t_bind taddr;
+ 
+ 	if ((fd = __rpc_nconf2fd(nconf)) == -1) {
+ 		if (debugging)
+@@ -512,6 +516,19 @@ create_rmtcall_fd(struct netconfig *nconf)
+ 			nconf->nc_device, errno);
+ 		return (-1);
+ 	}
++
++	if (fixed_port) {
++		__rpc_fd2sockinfo(fd, &si);
++		memset(&taddr, 0, sizeof(taddr));
++		taddr.addr.maxlen = taddr.addr.len = si.si_alen;
++		taddr.addr.buf = malloc(si.si_alen);
++		if (taddr.addr.buf == NULL) {
++			return -1;
++		}
++		*(unsigned short *)(&(taddr.addr.buf[0])) = si.si_af;
++		*(unsigned short *)(&(taddr.addr.buf[2])) = htons(fixed_port);
++		xprt = svc_tli_create(fd, nconf, &taddr, RPC_MAXDATASIZE, RPC_MAXDATASIZE);
++	} else
+ 	xprt = svc_tli_create(fd, 0, (struct t_bind *) 0, 0, 0);
+ 	if (xprt == NULL) {
+ 		if (debugging)
+diff --git a/src/rpcbind.c b/src/rpcbind.c
+index 137011b..dc3d2d6 100644
+--- a/src/rpcbind.c
++++ b/src/rpcbind.c
+@@ -111,6 +111,7 @@ int runasdaemon = 0;
+ int insecure = 0;
+ int oldstyle_local = 0;
+ int verboselog = 0;
++unsigned short fixed_port = 0;
+ 
+ char **hosts = NULL;
+ int nhosts = 0;
+@@ -869,7 +870,7 @@ parseargs(int argc, char *argv[])
+ {
+ 	int c;
+ 	oldstyle_local = 1;
+-	while ((c = getopt(argc, argv, "adh:ilswf")) != -1) {
++	while ((c = getopt(argc, argv, "adh:p:ilswf")) != -1) {
+ 		switch (c) {
+ 		case 'a':
+ 			doabort = 1;	/* when debugging, do an abort on */
+@@ -887,6 +888,9 @@ parseargs(int argc, char *argv[])
+ 			if (hosts[nhosts - 1] == NULL)
+ 				errx(1, "Out of memory");
+ 			break;
++		case 'p':
++			fixed_port = atoi(optarg);
++			break;
+ 		case 'i':
+ 			insecure = 1;
+ 			break;
+@@ -905,7 +909,7 @@ parseargs(int argc, char *argv[])
+ 			break;
+ #endif
+ 		default:	/* error */
+-			fprintf(stderr,	"usage: rpcbind [-adhilswf]\n");
++			fprintf(stderr,	"usage: rpcbind [-adhpilswf]\n");
+ 			exit (1);
+ 		}
+ 	}
+-- 
+1.9.1
+
diff --git a/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb b/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb
index dcdee6c..3c6774c 100644
--- a/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb
+++ b/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb
@@ -18,6 +18,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \
            file://0001-rpcbind-pair-all-svc_getargs-calls-with-svc_freeargs.patch \
            file://pmapproc_dump-Fixed-typo-in-memory-leak-patch.patch \
            file://rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch \
+           file://rpcbind_add_option_to_fix_port_number.patch \
           "
 SRC_URI[md5sum] = "cf10cd41ed8228fc54c316191c1f07fe"
 SRC_URI[sha256sum] = "074a9a530dc7c11e0d905aa59bcb0847c009313f02e98d3d798aa9568f414c66"
-- 
2.7.4

[PATCH 16/16] openssl-nativesdk: Fix "can't open config file" warning

[Robert Yang]

From: Ovidiu Panait <ovidiu.panait@windriver.com>

When SDK is not installed in the default location, openssl will not be
able to find the the openssl.cnf config file:

"WARNING: can't open config file: XXXX/usr/lib/ssl/openssl.cnf"

To fix this, we need to provide the environment variable $OPENSSL_CONF
pointing to the correct config file location.

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 .../openssl/openssl/environment.d-openssl.sh                  |  1 +
 meta/recipes-connectivity/openssl/openssl10.inc               |  7 +++++++
 meta/recipes-connectivity/openssl/openssl_1.0.2o.bb           |  5 +++++
 meta/recipes-connectivity/openssl/openssl_1.1.0h.bb           | 11 +++++++++++
 4 files changed, 24 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh

diff --git a/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh b/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh
new file mode 100644
index 0000000..b9cc24a
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh
@@ -0,0 +1 @@
+export OPENSSL_CONF="$OECORE_NATIVE_SYSROOT/usr/lib/ssl/openssl.cnf"
diff --git a/meta/recipes-connectivity/openssl/openssl10.inc b/meta/recipes-connectivity/openssl/openssl10.inc
index f7a8de8..55dfb7a 100644
--- a/meta/recipes-connectivity/openssl/openssl10.inc
+++ b/meta/recipes-connectivity/openssl/openssl10.inc
@@ -282,5 +282,12 @@ do_install_append_class-native() {
 	    OPENSSL_ENGINES=${libdir}/ssl/engines
 }
 
+do_install_append_class-nativesdk() {
+    mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
+    install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
+}
+
+FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
+
 BBCLASSEXTEND = "native nativesdk"
 
diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2o.bb b/meta/recipes-connectivity/openssl/openssl_1.0.2o.bb
index 413ebf3..7cae553 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.0.2o.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.0.2o.bb
@@ -47,6 +47,11 @@ SRC_URI_append_class-target = "\
            file://reproducible-cflags.patch \
            file://reproducible-mkbuildinf.patch \
            "
+
+SRC_URI_append_class-nativesdk = " \
+           file://environment.d-openssl.sh \
+           "
+
 SRC_URI[md5sum] = "44279b8557c3247cbe324e2322ecd114"
 SRC_URI[sha256sum] = "ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d"
 
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.0h.bb b/meta/recipes-connectivity/openssl/openssl_1.1.0h.bb
index 94b75eb..29f83a3 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.0h.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.0h.bb
@@ -19,6 +19,10 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
            file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \
            "
 
+SRC_URI_append_class-nativesdk = " \
+           file://environment.d-openssl.sh \
+          "
+
 S = "${WORKDIR}/openssl-${PV}"
 
 inherit lib_package multilib_header ptest
@@ -142,6 +146,13 @@ do_install_append_class-native () {
         sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash
 }
 
+do_install_append_class-nativesdk() {
+    mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
+    install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
+}
+
+FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
+
 do_install_ptest() {
         cp -r * ${D}${PTEST_PATH}
 
-- 
2.7.4

Re: [PATCH 03/16] lsof: fix LSOF_CCV in version.h

[Richard Purdie]

On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
> From: Jian Liu <jian.liu@windriver.com>
> 
> When using cross compiler to build the package "lsof" on a host,
> the value of LSOF_CCV in version.h genegrated by the Makefile
> is the version of the compiler on the host while it should be
> the version of cross compiler.
> 
> On Ubuntu host before fixed:
>   #define LSOF_CCV        "4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) "
> 
> After fixed:
>   #define   LSOF_CCV        "4.9.1 (GCC) "

The above is good info but its not included in the patch header which
this patch adds. Could you add it there please so that we can
understand what the patch does and why in the future without having to
trawl git history please.

Cheers,

Richard

Re: [PATCH 05/16] xinetd: add Init Script Actions to xinetd script

[Richard Purdie]

On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
> From: Shan Hai <shan.hai@windriver.com>
> 
> The chkconfig fails to list the xinetd service because the xinetd
> lacks Init Script Actions in it, add the actions to fix it.
> 
> Signed-off-by: Shan Hai <shan.hai@windriver.com>
> Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
> ---
>  meta/recipes-extended/xinetd/xinetd/xinetd.init | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-extended/xinetd/xinetd/xinetd.init
> b/meta/recipes-extended/xinetd/xinetd/xinetd.init
> index 777c2c8..a021410 100644
> --- a/meta/recipes-extended/xinetd/xinetd/xinetd.init
> +++ b/meta/recipes-extended/xinetd/xinetd/xinetd.init
> @@ -1,5 +1,15 @@
>  #!/bin/sh
> -#
> +### BEGIN INIT INFO
> +# Provides:          inetd
> +# Required-Start:    $local_fs $remote_fs
> +# Required-Stop:     $local_fs $remote_fs
> +# Should-Start:      $syslog
> +# Should-Stop:       $syslog
> +# Default-Start:     2 3 4 5
> +# Default-Stop:      0 1 6
> +# Short-Description: Start or stop the xinetd daemon.
> +### END INIT INFO
> +

Have we some kind of policy which says all init scripts have to have a
header like this? I'm wondering why this is just getting applied for
xinetd when there are probably other init scripts which don't have
this. Are we planning to add this everywhere?

Cheers,

Richard

Re: [PATCH 06/16] gcc-sanitizers: Fix libtool .la files

[Richard Purdie]

On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
> From: Yuanjie Huang <yuanjie.huang@windriver.com>
> 
> Since libtool sysroot is not set when compiling sanitizers, the
> libtool
> does no prefix the dependency path correctly. Fix it, so that
> programs
> can link to sanitizer libraries without error.
> 
> Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
> ---
>  meta/recipes-devtools/gcc/gcc-sanitizers.inc | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/meta/recipes-devtools/gcc/gcc-sanitizers.inc b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
> index e5e8452..2373dd8 100644
> --- a/meta/recipes-devtools/gcc/gcc-sanitizers.inc
> +++ b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
> @@ -39,6 +39,8 @@ do_install () {
>          rmdir --ignore-fail-on-non-empty -p ${D}${infodir}
>      fi
>      chown -R root:root ${D}
> +    # Fix broken libtool with stdc++, as sysroot is not set.
> +    find ${D} -name \*.la -exec sed -i "/^dependency_libs=/s@'${libdir}'@=${libdir}@g" {} \;
>  }
>  
>  INHIBIT_DEFAULT_DEPS = "1"

At this point we gave up and started just deleting .la files so I'm not
sure this matters any more. Do you still need to do this?

Regardless, it would be better to pass in the right libtool sysroot
rather than hacking the .la files.

Cheers,

Richard

Re: [PATCH 10/16] dropbear: add default config file to disable root login

[Richard Purdie]

On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
> From: Jackie Huang <jackie.huang@windriver.com>
> 
> root login is disabled by default for openssh and we can
> enable it through IMAGE_FEATURES 'debug-tweaks' or
> 'allow-empty-password', so change to the same default
> behavior for dropbear.
> 
> Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
> ---
>  meta/recipes-core/dropbear/dropbear.inc              | 3 +++
>  meta/recipes-core/dropbear/dropbear/dropbear.default | 2 ++
>  2 files changed, 5 insertions(+)
>  create mode 100644 meta/recipes-
> core/dropbear/dropbear/dropbear.default

This or the preceeding patch in the series appears to cause the first
failure in:

https://autobuilder.yocto.io/builders/nightly-oe-selftest/builds/1096/steps/Running%20oe-selftest/logs/stdio

(FAIL: test_non_root_user_can_connect_via_ssh_without_password
(imagefeatures.ImageFeatures))

Cheers,

Richard

Re: [PATCH 03/16] lsof: fix LSOF_CCV in version.h

[Robert Yang]

On 06/03/2018 11:52 PM, Richard Purdie wrote:
> On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
>> From: Jian Liu <jian.liu@windriver.com>
>>
>> When using cross compiler to build the package "lsof" on a host,
>> the value of LSOF_CCV in version.h genegrated by the Makefile
>> is the version of the compiler on the host while it should be
>> the version of cross compiler.
>>
>> On Ubuntu host before fixed:
>>    #define LSOF_CCV        "4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) "
>>
>> After fixed:
>>    #define   LSOF_CCV        "4.9.1 (GCC) "
> 
> The above is good info but its not included in the patch header which
> this patch adds. Could you add it there please so that we can
> understand what the patch does and why in the future without having to
> trawl git history please.

Thanks, updated.

// Robert

> 
> Cheers,
> 
> Richard
> 
> 

Re: [PATCH 05/16] xinetd: add Init Script Actions to xinetd script

[Robert Yang]

On 06/03/2018 11:59 PM, Richard Purdie wrote:
> On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
>> From: Shan Hai <shan.hai@windriver.com>
>>
>> The chkconfig fails to list the xinetd service because the xinetd
>> lacks Init Script Actions in it, add the actions to fix it.
>>
>> Signed-off-by: Shan Hai <shan.hai@windriver.com>
>> Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
>> ---
>>   meta/recipes-extended/xinetd/xinetd/xinetd.init | 12 +++++++++++-
>>   1 file changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/meta/recipes-extended/xinetd/xinetd/xinetd.init
>> b/meta/recipes-extended/xinetd/xinetd/xinetd.init
>> index 777c2c8..a021410 100644
>> --- a/meta/recipes-extended/xinetd/xinetd/xinetd.init
>> +++ b/meta/recipes-extended/xinetd/xinetd/xinetd.init
>> @@ -1,5 +1,15 @@
>>   #!/bin/sh
>> -#
>> +### BEGIN INIT INFO
>> +# Provides:          inetd
>> +# Required-Start:    $local_fs $remote_fs
>> +# Required-Stop:     $local_fs $remote_fs
>> +# Should-Start:      $syslog
>> +# Should-Stop:       $syslog
>> +# Default-Start:     2 3 4 5
>> +# Default-Stop:      0 1 6
>> +# Short-Description: Start or stop the xinetd daemon.
>> +### END INIT INFO
>> +
> 
> Have we some kind of policy which says all init scripts have to have a
> header like this? I'm wondering why this is just getting applied for
> xinetd when there are probably other init scripts which don't have
> this. Are we planning to add this everywhere?

We added this is because customer requires, and only for this one. We don't
have any plan to add more.

// Robert

> 
> Cheers,
> 
> Richard
> 
> 
> 

Re: [PATCH 06/16] gcc-sanitizers: Fix libtool .la files

[Robert Yang]

On 06/04/2018 12:01 AM, Richard Purdie wrote:
> On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
>> From: Yuanjie Huang <yuanjie.huang@windriver.com>
>>
>> Since libtool sysroot is not set when compiling sanitizers, the
>> libtool
>> does no prefix the dependency path correctly. Fix it, so that
>> programs
>> can link to sanitizer libraries without error.
>>
>> Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
>> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
>> ---
>>   meta/recipes-devtools/gcc/gcc-sanitizers.inc | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/meta/recipes-devtools/gcc/gcc-sanitizers.inc b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
>> index e5e8452..2373dd8 100644
>> --- a/meta/recipes-devtools/gcc/gcc-sanitizers.inc
>> +++ b/meta/recipes-devtools/gcc/gcc-sanitizers.inc
>> @@ -39,6 +39,8 @@ do_install () {
>>           rmdir --ignore-fail-on-non-empty -p ${D}${infodir}
>>       fi
>>       chown -R root:root ${D}
>> +    # Fix broken libtool with stdc++, as sysroot is not set.
>> +    find ${D} -name \*.la -exec sed -i "/^dependency_libs=/s@'${libdir}'@=${libdir}@g" {} \;
>>   }
>>   
>>   INHIBIT_DEFAULT_DEPS = "1"
> 
> At this point we gave up and started just deleting .la files so I'm not
> sure this matters any more. Do you still need to do this?

Sory, I can't find any la files in ${D}, I think that is not needed any more,
I will drop it in V3.

// Robert

> 
> Regardless, it would be better to pass in the right libtool sysroot
> rather than hacking the .la files.
> 
> Cheers,
> 
> Richard
> 
> 

Re: [PATCH 05/16] xinetd: add Init Script Actions to xinetd script

[Richard Purdie]

On Mon, 2018-06-04 at 10:30 +0800, Robert Yang wrote:
> 
> On 06/03/2018 11:59 PM, Richard Purdie wrote:
> > On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
> > > From: Shan Hai <shan.hai@windriver.com>
> > > 
> > > The chkconfig fails to list the xinetd service because the xinetd
> > > lacks Init Script Actions in it, add the actions to fix it.
> > > 
> > > Signed-off-by: Shan Hai <shan.hai@windriver.com>
> > > Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
> > > ---
> > >   meta/recipes-extended/xinetd/xinetd/xinetd.init | 12
> > > +++++++++++-
> > >   1 file changed, 11 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/meta/recipes-extended/xinetd/xinetd/xinetd.init
> > > b/meta/recipes-extended/xinetd/xinetd/xinetd.init
> > > index 777c2c8..a021410 100644
> > > --- a/meta/recipes-extended/xinetd/xinetd/xinetd.init
> > > +++ b/meta/recipes-extended/xinetd/xinetd/xinetd.init
> > > @@ -1,5 +1,15 @@
> > >   #!/bin/sh
> > > -#
> > > +### BEGIN INIT INFO
> > > +# Provides:          inetd
> > > +# Required-Start:    $local_fs $remote_fs
> > > +# Required-Stop:     $local_fs $remote_fs
> > > +# Should-Start:      $syslog
> > > +# Should-Stop:       $syslog
> > > +# Default-Start:     2 3 4 5
> > > +# Default-Stop:      0 1 6
> > > +# Short-Description: Start or stop the xinetd daemon.
> > > +### END INIT INFO
> > > +
> > 
> > Have we some kind of policy which says all init scripts have to
> > have a
> > header like this? I'm wondering why this is just getting applied
> > for
> > xinetd when there are probably other init scripts which don't have
> > this. Are we planning to add this everywhere?
> 
> We added this is because customer requires, and only for this one. We
> don't have any plan to add more.

I don't see the need to have this in OE-Core, it just duplicates
information from the recipe which can easily become outdated...

Cheers,

Richard

Re: [PATCH 05/16] xinetd: add Init Script Actions to xinetd script

[Robert Yang]

Hi RP,

On 06/04/2018 03:37 PM, Richard Purdie wrote:
> On Mon, 2018-06-04 at 10:30 +0800, Robert Yang wrote:
>>
>> On 06/03/2018 11:59 PM, Richard Purdie wrote:
>>> On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
>>>> From: Shan Hai <shan.hai@windriver.com>
>>>>
>>>> The chkconfig fails to list the xinetd service because the xinetd
>>>> lacks Init Script Actions in it, add the actions to fix it.
>>>>
>>>> Signed-off-by: Shan Hai <shan.hai@windriver.com>
>>>> Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
>>>> ---
>>>>    meta/recipes-extended/xinetd/xinetd/xinetd.init | 12
>>>> +++++++++++-
>>>>    1 file changed, 11 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/meta/recipes-extended/xinetd/xinetd/xinetd.init
>>>> b/meta/recipes-extended/xinetd/xinetd/xinetd.init
>>>> index 777c2c8..a021410 100644
>>>> --- a/meta/recipes-extended/xinetd/xinetd/xinetd.init
>>>> +++ b/meta/recipes-extended/xinetd/xinetd/xinetd.init
>>>> @@ -1,5 +1,15 @@
>>>>    #!/bin/sh
>>>> -#
>>>> +### BEGIN INIT INFO
>>>> +# Provides:          inetd
>>>> +# Required-Start:    $local_fs $remote_fs
>>>> +# Required-Stop:     $local_fs $remote_fs
>>>> +# Should-Start:      $syslog
>>>> +# Should-Stop:       $syslog
>>>> +# Default-Start:     2 3 4 5
>>>> +# Default-Stop:      0 1 6
>>>> +# Short-Description: Start or stop the xinetd daemon.
>>>> +### END INIT INFO
>>>> +
>>>
>>> Have we some kind of policy which says all init scripts have to
>>> have a
>>> header like this? I'm wondering why this is just getting applied
>>> for
>>> xinetd when there are probably other init scripts which don't have
>>> this. Are we planning to add this everywhere?
>>
>> We added this is because customer requires, and only for this one. We
>> don't have any plan to add more.
> 
> I don't see the need to have this in OE-Core, it just duplicates
> information from the recipe which can easily become outdated...

Yes, they may become outdated, but these info are required by lsb:

http://refspecs.linuxbase.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/initscrcomconv.html

The OE-Core also has other similar init scripts which have similar info:

$ find meta/recipes-* -name '*.init' -exec grep -H '# Provides:' {} \;
meta/recipes-core/dbus/dbus/dbus-1.init:# Provides:          dbus
meta/recipes-core/sysvinit/sysvinit/bootlogd.init:# Provides:          bootlogd
meta/recipes-devtools/tcf-agent/tcf-agent/tcf-agent.init:# Provides: 
tcf-agent
meta/recipes-extended/watchdog/watchdog/wd_keepalive.init:# Provides: 
wd_keepalive
meta/recipes-extended/cronie/cronie/crond.init:# Provides: crond crontab

And xinetd/xinetd.init is owned by oe-core, it seems that this is the
only way to fix it.

// Robert

> 
> Cheers,
> 
> Richard
> 

Re: [PATCH 10/16] dropbear: add default config file to disable root login

[Robert Yang]

On 06/04/2018 06:41 AM, Richard Purdie wrote:
> On Wed, 2018-05-30 at 17:03 +0800, Robert Yang wrote:
>> From: Jackie Huang <jackie.huang@windriver.com>
>>
>> root login is disabled by default for openssh and we can
>> enable it through IMAGE_FEATURES 'debug-tweaks' or
>> 'allow-empty-password', so change to the same default
>> behavior for dropbear.
>>
>> Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
>> ---
>>   meta/recipes-core/dropbear/dropbear.inc              | 3 +++
>>   meta/recipes-core/dropbear/dropbear/dropbear.default | 2 ++
>>   2 files changed, 5 insertions(+)
>>   create mode 100644 meta/recipes-
>> core/dropbear/dropbear/dropbear.default
> 
> This or the preceeding patch in the series appears to cause the first
> failure in:
> 
> https://autobuilder.yocto.io/builders/nightly-oe-selftest/builds/1096/steps/Running%20oe-selftest/logs/stdio
> 
> (FAIL: test_non_root_user_can_connect_via_ssh_without_password
> (imagefeatures.ImageFeatures))

Sorry, I'm working on this today, but needs more time to test it.

// Robert

> 
> Cheers,
> 
> Richard
>