# SPDX-License-Identifier: MIT

require conf/distro/include/fslc-base.inc

DISTRO = "forgefirm"
DISTRO_NAME = "OpenGlow/ForgeFIRM"
DISTRO_VERSION = "0.0.0"

DISTRO_FEATURES:remove = " \
  3g alsa avahi bluetooth bluez5 ext2 irda nfc nfs pci pcmcia \
  pulseaudio vulkan wayland x11 zeroconf "

# The name the image ships in /etc/hostname. forgefirm-hostname replaces
# it at S38 in rcS with forgefirm-<xxxx>, from the machine's MAC address;
# this is what the few seconds before that show, and the fallback on a
# machine whose MAC address cannot be read.
hostname:pn-base-files = "forgefirm"

# No mDNS. The panel is reached at the machine's address, which every
# network resolves; the machine's own name (forgefirm-<xxxx>, from
# forgefirm-hostname) goes out in the DHCP request, so a network with
# dynamic DNS publishes it as well. The avahi and zeroconf features stay
# removed above: zeroconf would install packagegroup-base-zeroconf (the
# daemon plus libnss-mdns), and avahi would switch other recipes' avahi
# options on.

# TLS: forgectrl serves HTTPS on 443 with a self-signed certificate
# through libmicrohttpd and ulfius, and links GnuTLS itself. GnuTLS is
# trimmed to the library:
#   no seccomp   the distro default adds libseccomp for the gnutls test
#                programs; the library does not use it
#   no libidn    internationalized host names in certificates; the
#                machine's own certificate is plain ASCII (saves libidn2)
#   no p11-kit   PKCS#11 tokens and the system trust store; the machine
#                presents its own certificate and verifies no peer
#                through GnuTLS (saves p11-kit and its modules)
#   libtasn1     stays a shared library: the bundled copy is the same
#                code without poky's CVE patches
#   no tpm, fips, dane, and no certificate compression (brotli, zlib,
#   zstd), none of which the panel uses
PACKAGECONFIG:pn-gnutls = "libtasn1"

# opengl stays: forgectrl's camera demosaic runs as GLES2 fragment
# shaders on the GC880 (etnaviv), reached through surfaceless EGL with
# no display stack. Mesa is trimmed to exactly that: the etnaviv
# gallium driver, GLES/EGL/GBM, no GLX, no X11/Wayland platforms
# (both remain removed above), so the cost is the libraries and the one
# driver, not a graphics stack.
PACKAGECONFIG:pn-mesa = "opengl gles egl gbm gallium etnaviv"
# udev's hardware database is USB and PCI vendor/product identities (7.7 MB);
# the board has neither bus.
BAD_RECOMMENDATIONS += "eudev-hwdb"

# System logger: rsyslog replaces busybox syslogd/klogd. Every ForgeFIRM
# process logs through it and it is the only log writer (one directory
# per logger under /data/log/forgefirm; per-logger levels and the remote
# target come from the machine settings). Trimmed to what the image uses:
# the local socket and kernel inputs, file output, plain UDP/TCP
# forwarding, and rainerscript filters - no TLS, database, HTTP, or
# signing modules (rootfs must fit the 200 MiB factory slot).
VIRTUAL-RUNTIME_base-utils-syslog = "rsyslog"
PACKAGECONFIG:pn-rsyslog = "rsyslogd rsyslogrt klog inet regexp"

# Local (file://) source checksums leave out a workstation's Python bytecode
# caches: the forgetest recipe fetches its package directory whole, and a
# host test run must not move a task hash without a source change.
BB_SIGNATURE_LOCAL_DIRS_EXCLUDE = "CVS .bzr .git .hg .osc .p4 .repo .svn __pycache__ .pytest_cache"