[PATCH] meson: make https:// wrap source downloads work

[PATCH] meson: make https:// wrap source downloads work

[Leif Middelschulte]

Meson would fail to fetch wraps' sources on bare systems (i.e. docker images),
that only provide little more than the SDK.

The SDK's SSL directory was not searched, so meson would fail when it tried
to fetch sources via https, that were specified in wrap files.
Specifically `urllib` would fail:
```
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>
```

Caution: this patch depends on the underlying C library (i.e. openssl)
to consider this environment variable.

Signed-off-by: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
---
meta/recipes-devtools/meson/meson/meson-wrapper | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/meta/recipes-devtools/meson/meson/meson-wrapper b/meta/recipes-devtools/meson/meson/meson-wrapper
index d4b5187f8d..8fafaad975 100755
--- a/meta/recipes-devtools/meson/meson/meson-wrapper
+++ b/meta/recipes-devtools/meson/meson/meson-wrapper
@@ -4,6 +4,10 @@ if [ -z "$OECORE_NATIVE_SYSROOT" ]; then
    echo "OECORE_NATIVE_SYSROOT not set; are you in a Yocto SDK environment?" >&2
fi

+if [ -z "$SSL_CERT_DIR" ]; then
+    export SSL_CERT_DIR="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/"
+fi
+
# If these are set to a cross-compile path, meson will get confused and try to
# use them as native tools. Unset them to prevent this, as all the cross-compile
# config is already in meson.cross.
-- 
2.33.0

Re: [poky] [PATCH] meson: make https:// wrap source downloads work

[Richard Purdie]

On Sat, 2021-11-06 at 10:47 +0100, Leif Middelschulte wrote:
> Meson would fail to fetch wraps' sources on bare systems (i.e. docker images),
> that only provide little more than the SDK.
> 
> The SDK's SSL directory was not searched, so meson would fail when it tried
> to fetch sources via https, that were specified in wrap files.
> Specifically `urllib` would fail:
> ```
> <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>
> ```
> 
> Caution: this patch depends on the underlying C library (i.e. openssl)
> to consider this environment variable.
> 
> Signed-off-by: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
> ---
> meta/recipes-devtools/meson/meson/meson-wrapper | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/meta/recipes-devtools/meson/meson/meson-wrapper b/meta/recipes-devtools/meson/meson/meson-wrapper
> index d4b5187f8d..8fafaad975 100755
> --- a/meta/recipes-devtools/meson/meson/meson-wrapper
> +++ b/meta/recipes-devtools/meson/meson/meson-wrapper
> @@ -4,6 +4,10 @@ if [ -z "$OECORE_NATIVE_SYSROOT" ]; then
>     echo "OECORE_NATIVE_SYSROOT not set; are you in a Yocto SDK environment?" >&2
> fi
> 
> +if [ -z "$SSL_CERT_DIR" ]; then
> +    export SSL_CERT_DIR="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/"
> +fi
> +
> # If these are set to a cross-compile path, meson will get confused and try to
> # use them as native tools. Unset them to prevent this, as all the cross-compile
> # config is already in meson.cross.

Why is meson trying to fetch sources? Shouldn't this be happening in do_fetch?

Cheers,

Richard

Re: [poky] [PATCH] meson: make https:// wrap source downloads work

[Leif Middelschulte]

Am Sa., 6. Nov. 2021 um 11:07 Uhr schrieb Richard Purdie
<richard.purdie@linuxfoundation.org>:
>
> On Sat, 2021-11-06 at 10:47 +0100, Leif Middelschulte wrote:
> > Meson would fail to fetch wraps' sources on bare systems (i.e. docker images),
> > that only provide little more than the SDK.
> >
> > The SDK's SSL directory was not searched, so meson would fail when it tried
> > to fetch sources via https, that were specified in wrap files.
> > Specifically `urllib` would fail:
> > ```
> > <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>
> > ```
> >
> > Caution: this patch depends on the underlying C library (i.e. openssl)
> > to consider this environment variable.
> >
> > Signed-off-by: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
> > ---
> > meta/recipes-devtools/meson/meson/meson-wrapper | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/meta/recipes-devtools/meson/meson/meson-wrapper b/meta/recipes-devtools/meson/meson/meson-wrapper
> > index d4b5187f8d..8fafaad975 100755
> > --- a/meta/recipes-devtools/meson/meson/meson-wrapper
> > +++ b/meta/recipes-devtools/meson/meson/meson-wrapper
> > @@ -4,6 +4,10 @@ if [ -z "$OECORE_NATIVE_SYSROOT" ]; then
> >     echo "OECORE_NATIVE_SYSROOT not set; are you in a Yocto SDK environment?" >&2
> > fi
> >
> > +if [ -z "$SSL_CERT_DIR" ]; then
> > +    export SSL_CERT_DIR="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/"
> > +fi
> > +
> > # If these are set to a cross-compile path, meson will get confused and try to
> > # use them as native tools. Unset them to prevent this, as all the cross-compile
> > # config is already in meson.cross.
>
> Why is meson trying to fetch sources? Shouldn't this be happening in do_fetch?
This happens outside of bitbake, i.e. when users of the SDK try to
build some Meson project that uses "Wraps".
Mesons "wraps" allow its users to build software on the spot, if it is
missing in the host/target toolchain. See
https://mesonbuild.com/Using-the-WrapDB.html
>
> Cheers,
>
> Richard
>
>
Thanks for the feedback,

Leif

Re: [poky] [PATCH] meson: make https:// wrap source downloads work

[Richard Purdie]

On Sat, 2021-11-06 at 11:13 +0100, Leif Middelschulte wrote:
> Am Sa., 6. Nov. 2021 um 11:07 Uhr schrieb Richard Purdie
> <richard.purdie@linuxfoundation.org>:
> > 
> > On Sat, 2021-11-06 at 10:47 +0100, Leif Middelschulte wrote:
> > > Meson would fail to fetch wraps' sources on bare systems (i.e. docker images),
> > > that only provide little more than the SDK.
> > > 
> > > The SDK's SSL directory was not searched, so meson would fail when it tried
> > > to fetch sources via https, that were specified in wrap files.
> > > Specifically `urllib` would fail:
> > > ```
> > > <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>
> > > ```
> > > 
> > > Caution: this patch depends on the underlying C library (i.e. openssl)
> > > to consider this environment variable.
> > > 
> > > Signed-off-by: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
> > > ---
> > > meta/recipes-devtools/meson/meson/meson-wrapper | 4 ++++
> > > 1 file changed, 4 insertions(+)
> > > 
> > > diff --git a/meta/recipes-devtools/meson/meson/meson-wrapper b/meta/recipes-devtools/meson/meson/meson-wrapper
> > > index d4b5187f8d..8fafaad975 100755
> > > --- a/meta/recipes-devtools/meson/meson/meson-wrapper
> > > +++ b/meta/recipes-devtools/meson/meson/meson-wrapper
> > > @@ -4,6 +4,10 @@ if [ -z "$OECORE_NATIVE_SYSROOT" ]; then
> > >     echo "OECORE_NATIVE_SYSROOT not set; are you in a Yocto SDK environment?" >&2
> > > fi
> > > 
> > > +if [ -z "$SSL_CERT_DIR" ]; then
> > > +    export SSL_CERT_DIR="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/"
> > > +fi
> > > +
> > > # If these are set to a cross-compile path, meson will get confused and try to
> > > # use them as native tools. Unset them to prevent this, as all the cross-compile
> > > # config is already in meson.cross.
> > 
> > Why is meson trying to fetch sources? Shouldn't this be happening in do_fetch?
> This happens outside of bitbake, i.e. when users of the SDK try to
> build some Meson project that uses "Wraps".
> Mesons "wraps" allow its users to build software on the spot, if it is
> missing in the host/target toolchain. See
> https://mesonbuild.com/Using-the-WrapDB.html
> 

Ok, this needs to be clearer in the commit message making it clear this is an
SDK issue with the meson-wrapper, ideally in the shortlog.

I did take a deeper look at the patch and it doesn't apply, the whitespace
somehow seems damaged as the leading whitespaces on several lines are missing
and I think there is other damage.

Also, the patch needs to be sent to the openembedded-core list.

Cheers,

Richard