mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-09-28 09:11:11 -07:00
ScottW514
97287aa6a9
meta-forgefirm: the forgefirm-users init replays the account at boot; sshd refuses root and empty passwords and runs only while the panel turns it on; the release image keeps an empty root password for the console; the console banner; avahi announces forgefirm.local; https in libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on the rootfs; release.sh checks the root policy on the built rootfs. forgetest: the commission suites (commission, commission_dark, commission_sheet: 23 cases); the runner turns cloud mode on with the typed phrase for a test that declares it; the baseline's motor_lock is 0; the log-export test checks the bundle for the camera key; the record helpers write bytes as given and join the daemon's paths as POSIX. The stream harness gains rule 24: a hold verdict is held again after a resume. Bench drills: lens_travel.py and lens_stop_accel.py. Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated record.
66 lines
3.4 KiB
Plaintext
66 lines
3.4 KiB
Plaintext
require conf/distro/include/fslc-base.inc
|
|
|
|
DISTRO = "forgefirm"
|
|
DISTRO_NAME = "OpenGlow/ForgeFIRM"
|
|
DISTRO_VERSION = "0.0.0"
|
|
|
|
DISTRO_FEATURES:remove = " \
|
|
3g alsa avahi bluetooth bluez5 ext2 irda nfc nfs pci pcmcia \
|
|
pulseaudio vulkan wayland x11 zeroconf "
|
|
|
|
# mDNS: the image installs avahi-daemon by name (forgefirm-image.bb), so
|
|
# the control panel answers at forgefirm.local. The avahi and zeroconf
|
|
# features stay removed above: zeroconf would install
|
|
# packagegroup-base-zeroconf (the daemon plus libnss-mdns), and avahi
|
|
# would switch other recipes' avahi options on. The build is trimmed to
|
|
# the daemon: no D-Bus (so no libavahi-client, no avahi-utils, no bus
|
|
# activation; the daemon reads /etc/avahi/services itself), no GTK or Qt
|
|
# front ends, no libdns_sd compatibility library, no libevent binding.
|
|
# Python bindings are off in the recipe itself.
|
|
PACKAGECONFIG:pn-avahi = ""
|
|
# libnss-mdns is what avahi-daemon recommends: an NSS module so the
|
|
# machine itself resolves .local names. Nothing on the machine does.
|
|
BAD_RECOMMENDATIONS += "libnss-mdns"
|
|
|
|
# TLS: forgectrl serves HTTPS on 443 with a self-signed certificate
|
|
# through libmicrohttpd and ulfius, and links GnuTLS itself. GnuTLS is
|
|
# trimmed to the library:
|
|
# no seccomp the distro default adds libseccomp for the gnutls test
|
|
# programs; the library does not use it
|
|
# no libidn internationalized host names in certificates; the
|
|
# machine's own certificate is plain ASCII (saves libidn2)
|
|
# no p11-kit PKCS#11 tokens and the system trust store; the machine
|
|
# presents its own certificate and verifies no peer
|
|
# through GnuTLS (saves p11-kit and its modules)
|
|
# libtasn1 stays a shared library: the bundled copy is the same
|
|
# code without poky's CVE patches
|
|
# no tpm, fips, dane, and no certificate compression (brotli, zlib,
|
|
# zstd), none of which the panel uses
|
|
PACKAGECONFIG:pn-gnutls = "libtasn1"
|
|
|
|
# opengl stays: forgectrl's camera demosaic runs as GLES2 fragment
|
|
# shaders on the GC880 (etnaviv), reached through surfaceless EGL with
|
|
# no display stack. Mesa is trimmed to exactly that: the etnaviv
|
|
# gallium driver, GLES/EGL/GBM, no GLX, no X11/Wayland platforms
|
|
# (both remain removed above), so the cost is the libraries and the one
|
|
# driver, not a graphics stack.
|
|
PACKAGECONFIG:pn-mesa = "opengl gles egl gbm gallium etnaviv"
|
|
# udev's hardware database is USB and PCI vendor/product identities (7.7 MB);
|
|
# the board has neither bus.
|
|
BAD_RECOMMENDATIONS += "eudev-hwdb"
|
|
|
|
# System logger: rsyslog replaces busybox syslogd/klogd. Every ForgeFIRM
|
|
# process logs through it and it is the only log writer (one directory
|
|
# per logger under /data/log/forgefirm; per-logger levels and the remote
|
|
# target come from the machine settings). Trimmed to what the image uses:
|
|
# the local socket and kernel inputs, file output, plain UDP/TCP
|
|
# forwarding, and rainerscript filters - no TLS, database, HTTP, or
|
|
# signing modules (rootfs must fit the 200 MiB factory slot).
|
|
VIRTUAL-RUNTIME_base-utils-syslog = "rsyslog"
|
|
PACKAGECONFIG:pn-rsyslog = "rsyslogd rsyslogrt klog inet regexp"
|
|
|
|
# Local (file://) source checksums leave out a workstation's Python bytecode
|
|
# caches: the forgetest recipe fetches its package directory whole, and a
|
|
# host test run must not move a task hash without a source change.
|
|
BB_SIGNATURE_LOCAL_DIRS_EXCLUDE = "CVS .bzr .git .hg .osc .p4 .repo .svn __pycache__ .pytest_cache"
|