pack-licenses.sh: the image's license step refuses a manifest without the project's recipes; the layer's interfaces file starts no DHCPv6 client

The host proofs of image.license-bundle's pack half and of
image.network-boot's interfaces check. No catalog test is removed here;
suite/image.py is unchanged.

pack-licenses.sh, next to forgefirm-image.bb, is the license step.
pack_licenses calls it with the common-licenses directory and the
output tar path (forgefirm-image-dev.bb requires the release recipe, so
both images run the one call), and do_rootfs's file-checksums name it.
Before it writes the tar or removes the tree, it exits non-zero with a
message on stderr when the directory is missing, when the manifest is
missing, or when the manifest lacks any of the newline-terminated lines
"RECIPE NAME: forgectrl", "RECIPE NAME: grblhal-glowforge" and "RECIPE
NAME: kernel-module-glowforge". On success it packs as before: tar
--sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner, gzip -9 -n,
the member common-licenses/license.manifest, and the loose tree removed
once the bundle holds the manifest.

test_image.py's PackLicensesTests drives that script on a fixture: a
missing directory, a missing manifest, and a manifest missing each one
of the three lines are refused with a message on stderr and no tar, the
tree left; a manifest naming all three packs, the tar holds
common-licenses/license.manifest, and the tree is gone.

NetworkBootTests reads the BSP layer's interfaces file from the
meta-openglow checkout beside forgefirm's (forgetest-ci checks out its
scarthgap branch there) and finds no line that starts a DHCPv6 client.
A missing file fails the case.

meta-forgefirm's content hash moved (forgefirm-image.bb and the new
script are layer content, and the platform identity of
forgefirm-image-manifest.bbclass leaves out only *.md, *-pin.inc and
forgefirm-release.inc): the next image cannot inherit a campaign.

Proof: python3 -B -m unittest discover -s tests -p test_image.py on
Linux (Ubuntu 24.04, GNU tar 1.35, meta-openglow at f012d8e): 14 OK, the
five new cases among them; pyflakes names no undefined name.

meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb

@@ -216,18 +216,18 @@ ROOTFS_POSTPROCESS_COMMAND += "write_forgefirm_version "
 # control panel serves the bundle and its manifest (GET /system/licenses,
 # GET /system/licenses/manifest). The license class runs first
 # (license_create_manifest is prepended to this list); this step is
-# appended, so it runs after.
+# appended, so it runs after. pack-licenses.sh, next to this recipe, is
+# the step: it refuses a tree with no manifest, and a manifest that does
+# not name forgectrl, grblhal-glowforge and kernel-module-glowforge.
 COPY_LIC_MANIFEST = "1"
 COPY_LIC_DIRS = "1"
 
+PACK_LICENSES := "${THISDIR}/pack-licenses.sh"
+do_rootfs[file-checksums] += "${PACK_LICENSES}:True"
+
 pack_licenses() {
-    d="${IMAGE_ROOTFS}${datadir}/common-licenses"
-    [ -d "$d" ] || bbfatal "pack_licenses: $d is missing (COPY_LIC_DIRS off?)"
-    [ -f "$d/license.manifest" ] || bbfatal "pack_licenses: no license.manifest in $d"
-    install -d "${IMAGE_ROOTFS}${datadir}/forgefirm"
-    tar -C "${IMAGE_ROOTFS}${datadir}" --sort=name --mtime=@0 --owner=0 --group=0 \
-        --numeric-owner -cf - common-licenses | gzip -9 -n \
-        > "${IMAGE_ROOTFS}${datadir}/forgefirm/licenses.tar.gz"
-    rm -rf "$d"
+    sh "${PACK_LICENSES}" "${IMAGE_ROOTFS}${datadir}/common-licenses" \
+        "${IMAGE_ROOTFS}${datadir}/forgefirm/licenses.tar.gz" \
+        || bbfatal "pack_licenses: pack-licenses.sh refused the license tree (its message is above)"
 }
 ROOTFS_POSTPROCESS_COMMAND += "pack_licenses "

meta-forgefirm/recipes-forgefirm/images/pack-licenses.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Copyright 2026 514 LLC d/b/a OpenGlow
+# Written by Scott Wiederhold
+# https://community.openglow.org
+# SPDX-License-Identifier:    MIT
+#
+# pack-licenses.sh <common-licenses directory> <tar.gz>
+#
+# Packs the image's license tree into one reproducible tar.gz (sorted
+# names, no timestamps, no owners), its members under the tree's own
+# name, and removes the tree. It refuses, before it writes the tar or
+# removes anything, a tree that is missing, a tree with no
+# license.manifest, and a manifest that does not name the project's own
+# recipes: forgectrl, grblhal-glowforge and kernel-module-glowforge.
+# forgefirm-image.bb's pack_licenses runs it; forgetest's test_image.py
+# runs it on a fixture.
+
+dir=${1:?common-licenses directory}
+out=${2:?output tar.gz}
+fail() { echo "pack-licenses: $*" >&2; exit 1; }
+
+[ -d "$dir" ] || fail "$dir is missing (COPY_LIC_DIRS off?)"
+manifest=$dir/license.manifest
+[ -f "$manifest" ] || fail "no license.manifest in $dir"
+# A line counts with its newline: an unterminated last line is not read.
+lines=$(wc -l < "$manifest")
+for name in forgectrl grblhal-glowforge kernel-module-glowforge; do
+    head -n "$lines" "$manifest" | grep -Fxq "RECIPE NAME: $name" \
+        || fail "$manifest does not name the recipe $name"
+done
+
+base=$(basename "$dir")
+mkdir -p "$(dirname "$out")" || fail "cannot make the directory of $out"
+tar -C "$(dirname "$dir")" --sort=name --mtime=@0 --owner=0 --group=0 \
+    --numeric-owner -cf - "$base" | gzip -9 -n > "$out" || fail "cannot write $out"
+# the tree goes only once the bundle holds its manifest
+tar -tzf "$out" "$base/license.manifest" > /dev/null 2>&1 \
+    || fail "$out holds no $base/license.manifest"
+rm -rf "$dir"