[{"id":11619,"web_url":"https://patchwork.libcamera.org/comment/11619/","msgid":"","date":"2020-07-27T09:42:24","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"content":"Hi Andrey,\n\nOn 27/07/2020 10:21, Andrey Konovalov wrote:\n> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> libcamera.so. If it does, it assumes that libcamera binaries are\n> run directly from the build directory without installing them, and\n> tries to use resorces like IPA modules from the build directory.\n> Mainline meson strips RPATH/RUNPATH out at install time (for\n> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> That's why we need to remove this tag manually in do_install_append().\n\nUh oh, what's changed... (I'll have to go take a look).\n\n -\nhttps://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n\nIf we're reliant upon meson behaviour which is no longer consistent,\nthen we are going to have to do something else in libcamera.\n\n/me sighs ...\n\n> IPA module is signed (with openssl dgst) after it is built. But\n> during packaging the OE build system 1) splits out debugging info,\n> and 2) strips the binaries. So the IPA module *.so file installed\n> isn't the one which the signature was calculated against. Then\n> the signature check fails, and libcamera tries to run the IPA\n> module isolated (in a sandbox), which doesn't work if the IPA\n> module wasn't designed to run isolated. The easiest way to fix that\n> is to disable splitting out debug information and stripping the binaries\n> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> INHIBIT_PACKAGE_STRIP.\n\n\nThis sounds like an effective solution for openembedded, but it needs to\nbe fixed in libcamera all the same.\n\n\nI'll try to follow up with the meson guys to see what we can do,.\n\n\n> Signed-off-by: Andrey Konovalov \n> ---\n> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> 1 file changed, 8 insertions(+), 1 deletion(-)\n> \n> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> index 00a5c480d..573366f08 100644\n> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> \n> S = \"${WORKDIR}/git\"\n> \n> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> \n> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> \n> inherit meson pkgconfig python3native\n> \n> +do_install_append() {\n> + chrpath -d ${D}${libdir}/libcamera.so\n\nAha, I didn't know about chrpath, that looks helpful. Perhaps part of\nthe solution will be handling our own strip/install actions to do this\nexplicitly in the build.\n\nIt will be a pain to have to pull in another external dependency though...\n\n> +}\n> +\n> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> \n> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> +INHIBIT_PACKAGE_STRIP = \"1\"\n> +\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 08B5ABD86F\n\tfor ;\n\tMon, 27 Jul 2020 09:42:31 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 7379061247;\n\tMon, 27 Jul 2020 11:42:30 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id C8B646039B\n\tfor ;\n\tMon, 27 Jul 2020 11:42:28 +0200 (CEST)","from [192.168.0.20]\n\t(cpc89242-aztw30-2-0-cust488.18-1.cable.virginm.net [86.31.129.233])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id F28642A9;\n\tMon, 27 Jul 2020 11:42:26 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"ZtQmQjS6\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595842947;\n\tbh=go8IY+vJI0zSBDna3L7KvEuTyMS8MYBiYzi8zx+VlRI=;\n\th=Reply-To:Subject:To:Cc:References:From:Date:In-Reply-To:From;\n\tb=ZtQmQjS6PyeggGxx8S1qH9Leoj4O9R0D6bcHToLXjpooO7xXs8juB3tsYAtQ6wWb6\n\tYE04Rzr4SC9AXcPQUmWG3Io5dR98Wl1i8OkcVPk/9svHBDcdIbWc46Dea64Dfzy4TA\n\tv1X4AAXe9MCw8p0T3VbwF7BUnaRGx+8TBxTpMt28=","To":"Andrey Konovalov ,\n\topenembedded-devel@lists.openembedded.org","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>","From":"Kieran Bingham ","Autocrypt":"addr=kieran.bingham@ideasonboard.com; keydata=\n\tmQINBFYE/WYBEACs1PwjMD9rgCu1hlIiUA1AXR4rv2v+BCLUq//vrX5S5bjzxKAryRf0uHat\n\tV/zwz6hiDrZuHUACDB7X8OaQcwhLaVlq6byfoBr25+hbZG7G3+5EUl9cQ7dQEdvNj6V6y/SC\n\trRanWfelwQThCHckbobWiQJfK9n7rYNcPMq9B8e9F020LFH7Kj6YmO95ewJGgLm+idg1Kb3C\n\tpotzWkXc1xmPzcQ1fvQMOfMwdS+4SNw4rY9f07Xb2K99rjMwZVDgESKIzhsDB5GY465sCsiQ\n\tcSAZRxqE49RTBq2+EQsbrQpIc8XiffAB8qexh5/QPzCmR4kJgCGeHIXBtgRj+nIkCJPZvZtf\n\tKr2EAbc6tgg6DkAEHJb+1okosV09+0+TXywYvtEop/WUOWQ+zo+Y/OBd+8Ptgt1pDRyOBzL8\n\tRXa8ZqRf0Mwg75D+dKntZeJHzPRJyrlfQokngAAs4PaFt6UfS+ypMAF37T6CeDArQC41V3ko\n\tlPn1yMsVD0p+6i3DPvA/GPIksDC4owjnzVX9kM8Zc5Cx+XoAN0w5Eqo4t6qEVbuettxx55gq\n\t8K8FieAjgjMSxngo/HST8TpFeqI5nVeq0/lqtBRQKumuIqDg+Bkr4L1V/PSB6XgQcOdhtd36\n\tOe9X9dXB8YSNt7VjOcO7BTmFn/Z8r92mSAfHXpb07YJWJosQOQARAQABtDBLaWVyYW4gQmlu\n\tZ2hhbSA8a2llcmFuLmJpbmdoYW1AaWRlYXNvbmJvYXJkLmNvbT6JAlcEEwEKAEECGwMFCwkI\n\tBwIGFQgJCgsCBBYCAwECHgECF4ACGQEWIQSQLdeYP70o/eNy1HqhHkZyEKRh/QUCXWTtygUJ\n\tCyJXZAAKCRChHkZyEKRh/f8dEACTDsbLN2nioNZMwyLuQRUAFcXNolDX48xcUXsWS2QjxaPm\n\tVsJx8Uy8aYkS85mdPBh0C83OovQR/OVbr8AxhGvYqBs3nQvbWuTl/+4od7DfK2VZOoKBAu5S\n\tQK2FYuUcikDqYcFWJ8DQnubxfE8dvzojHEkXw0sA4igINHDDFX3HJGZtLio+WpEFQtCbfTAG\n\tYZslasz1YZRbwEdSsmO3/kqy5eMnczlm8a21A3fKUo3g8oAZEFM+f4DUNzqIltg31OAB/kZS\n\tenKZQ/SWC8PmLg/ZXBrReYakxXtkP6w3FwMlzOlhGxqhIRNiAJfXJBaRhuUWzPOpEDE9q5YJ\n\tBmqQL2WJm1VSNNVxbXJHpaWMH1sA2R00vmvRrPXGwyIO0IPYeUYQa3gsy6k+En/aMQJd27dp\n\taScf9am9PFICPY5T4ppneeJLif2lyLojo0mcHOV+uyrds9XkLpp14GfTkeKPdPMrLLTsHRfH\n\tfA4I4OBpRrEPiGIZB/0im98MkGY/Mu6qxeZmYLCcgD6qz4idOvfgVOrNh+aA8HzIVR+RMW8H\n\tQGBN9f0E3kfwxuhl3omo6V7lDw8XOdmuWZNC9zPq1UfryVHANYbLGz9KJ4Aw6M+OgBC2JpkD\n\thXMdHUkC+d20dwXrwHTlrJi1YNp6rBc+xald3wsUPOZ5z8moTHUX/uPA/qhGsbkCDQRWBP1m\n\tARAAzijkb+Sau4hAncr1JjOY+KyFEdUNxRy+hqTJdJfaYihxyaj0Ee0P0zEi35CbE6lgU0Uz\n\ttih9fiUbSV3wfsWqg1Ut3/5rTKu7kLFp15kF7eqvV4uezXRD3Qu4yjv/rMmEJbbD4cTvGCYI\n\td6MDC417f7vK3hCbCVIZSp3GXxyC1LU+UQr3fFcOyCwmP9vDUR9JV0BSqHHxRDdpUXE26Dk6\n\tmhf0V1YkspE5St814ETXpEus2urZE5yJIUROlWPIL+hm3NEWfAP06vsQUyLvr/GtbOT79vXl\n\tEn1aulcYyu20dRRxhkQ6iILaURcxIAVJJKPi8dsoMnS8pB0QW12AHWuirPF0g6DiuUfPmrA5\n\tPKe56IGlpkjc8cO51lIxHkWTpCMWigRdPDexKX+Sb+W9QWK/0JjIc4t3KBaiG8O4yRX8ml2R\n\t+rxfAVKM6V769P/hWoRGdgUMgYHFpHGSgEt80OKK5HeUPy2cngDUXzwrqiM5Sz6Od0qw5pCk\n\tNlXqI0W/who0iSVM+8+RmyY0OEkxEcci7rRLsGnM15B5PjLJjh1f2ULYkv8s4SnDwMZ/kE04\n\t/UqCMK/KnX8pwXEMCjz0h6qWNpGwJ0/tYIgQJZh6bqkvBrDogAvuhf60Sogw+mH8b+PBlx1L\n\toeTK396wc+4c3BfiC6pNtUS5GpsPMMjYMk7kVvEAEQEAAYkCPAQYAQoAJgIbDBYhBJAt15g/\n\tvSj943LUeqEeRnIQpGH9BQJdizzIBQkLSKZiAAoJEKEeRnIQpGH9eYgQAJpjaWNgqNOnMTmD\n\tMJggbwjIotypzIXfhHNCeTkG7+qCDlSaBPclcPGYrTwCt0YWPU2TgGgJrVhYT20ierN8LUvj\n\t6qOPTd+Uk7NFzL65qkh80ZKNBFddx1AabQpSVQKbdcLb8OFs85kuSvFdgqZwgxA1vl4TFhNz\n\tPZ79NAmXLackAx3sOVFhk4WQaKRshCB7cSl+RIng5S/ThOBlwNlcKG7j7W2MC06BlTbdEkUp\n\tECzuuRBv8wX4OQl+hbWbB/VKIx5HKlLu1eypen/5lNVzSqMMIYkkZcjV2SWQyUGxSwq0O/sx\n\tS0A8/atCHUXOboUsn54qdxrVDaK+6jIAuo8JiRWctP16KjzUM7MO0/+4zllM8EY57rXrj48j\n\tsbEYX0YQnzaj+jO6kJtoZsIaYR7rMMq9aUAjyiaEZpmP1qF/2sYenDx0Fg2BSlLvLvXM0vU8\n\tpQk3kgDu7kb/7PRYrZvBsr21EIQoIjXbZxDz/o7z95frkP71EaICttZ6k9q5oxxA5WC6sTXc\n\tMW8zs8avFNuA9VpXt0YupJd2ijtZy2mpZNG02fFVXhIn4G807G7+9mhuC4XG5rKlBBUXTvPU\n\tAfYnB4JBDLmLzBFavQfvonSfbitgXwCG3vS+9HEwAjU30Bar1PEOmIbiAoMzuKeRm2LVpmq4\n\tWZw01QYHU/GUV/zHJSFk","Organization":"Ideas on Board","Message-ID":"","Date":"Mon, 27 Jul 2020 10:42:24 +0100","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"<20200727092108.6209-1-andrey.konovalov@linaro.org>","Content-Language":"en-GB","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Reply-To":"kieran.bingham@ideasonboard.com","Cc":"libcamera-devel@lists.libcamera.org, raj.khem@gmail.com,\n\tmadhavan.krishnan@linaro.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11621,"web_url":"https://patchwork.libcamera.org/comment/11621/","msgid":"<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","date":"2020-07-27T09:58:23","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Kieran,\n\nOn 27.07.2020 12:42, Kieran Bingham wrote:\n> Hi Andrey,\n> \n> On 27/07/2020 10:21, Andrey Konovalov wrote:\n>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>> libcamera.so. If it does, it assumes that libcamera binaries are\n>> run directly from the build directory without installing them, and\n>> tries to use resorces like IPA modules from the build directory.\n>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>> That's why we need to remove this tag manually in do_install_append().\n> \n> Uh oh, what's changed... (I'll have to go take a look).\n> \n> -\n> https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> \n> If we're reliant upon meson behaviour which is no longer consistent,\n> then we are going to have to do something else in libcamera.\n\nI haven't tried meson 0.55 yet, but my impression was that 0.55 should work\njust as before for \"usual\" (as per libcamera's README) libcamera build. And\nstarting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n*might* be dropped - if all the packages would be able to set RUNPATH to\nwhat they need, and meson would detect that OK in all those cases.\n\nThanks,\nAndrey\n\n> /me sighs ...\n> \n>> IPA module is signed (with openssl dgst) after it is built. But\n>> during packaging the OE build system 1) splits out debugging info,\n>> and 2) strips the binaries. So the IPA module *.so file installed\n>> isn't the one which the signature was calculated against. Then\n>> the signature check fails, and libcamera tries to run the IPA\n>> module isolated (in a sandbox), which doesn't work if the IPA\n>> module wasn't designed to run isolated. The easiest way to fix that\n>> is to disable splitting out debug information and stripping the binaries\n>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>> INHIBIT_PACKAGE_STRIP.\n> \n> \n> This sounds like an effective solution for openembedded, but it needs to\n> be fixed in libcamera all the same.\n> \n> \n> I'll try to follow up with the meson guys to see what we can do,.\n> \n> \n>> Signed-off-by: Andrey Konovalov \n>> ---\n>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>\n>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> index 00a5c480d..573366f08 100644\n>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>> \n>> S = \"${WORKDIR}/git\"\n>> \n>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>> \n>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>> \n>> inherit meson pkgconfig python3native\n>> \n>> +do_install_append() {\n>> + chrpath -d ${D}${libdir}/libcamera.so\n> \n> Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> the solution will be handling our own strip/install actions to do this\n> explicitly in the build.\n> \n> It will be a pain to have to pull in another external dependency though...\n> \n>> +}\n>> +\n>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>> \n>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>> +INHIBIT_PACKAGE_STRIP = \"1\"\n>> +\n>>\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id C9F80BD86F\n\tfor ;\n\tMon, 27 Jul 2020 09:58:28 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 47B0E61247;\n\tMon, 27 Jul 2020 11:58:28 +0200 (CEST)","from mail-lj1-x243.google.com (mail-lj1-x243.google.com\n\t[IPv6:2a00:1450:4864:20::243])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5D3FC6039B\n\tfor ;\n\tMon, 27 Jul 2020 11:58:26 +0200 (CEST)","by mail-lj1-x243.google.com with SMTP id 185so6318901ljj.7\n\tfor ;\n\tMon, 27 Jul 2020 02:58:26 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\tj17sm2930232lfr.32.2020.07.27.02.58.24\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 02:58:25 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"FbJXliCy\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=jjqtMnaNo5h3W9gD2YyliEChhFmlOdlJOCyxaj4lTMo=;\n\tb=FbJXliCyVNOGVOusi5Z7azszsFvDHeDJqY3Pm4s7mEqUoyAja8dn8ccdgY+aLLQMbf\n\tVTbh88XI4tgYV9TD7vKjGwpspGXA1Yvo2wi2hLurhVpj3wFuMEIjdouVcUCDJEAjZCik\n\tp/29EN3S7ZgzDIitRqcnz8uimfK5Z2GI0N9dOAqH07TiKQL6jeR7KiN93NWEcvAYnEic\n\tqsoJ4eODIMuRbJe0fWKMU7TFk6C96z+gpEQsm7OHjA4/pOdLRgd52Vs3iRT2xcXqQnOL\n\tWWaWPrOKXO49HaAG2puHD48C+cjwAJzaf92yzkoOp8Ql6K6qp+rkHRynKOktBtBQbRDm\n\txUxw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=jjqtMnaNo5h3W9gD2YyliEChhFmlOdlJOCyxaj4lTMo=;\n\tb=ZzWKVxIxcY3V0iY/wK0Ec8VdZ2ii7hxWriGbAQTyGzPfXtdUnsTyMkrAKarcu6rhIC\n\troXyhJOP3q+f8GFxtTQZA4G2uO1tdH2w3Uv9AYzKEpRggLj7C+zZAREjkcU7yZuW0y1i\n\ttOq3pwcTf6AP1biDlRNsXl+E/NA+0mSRU/YdcHf8yVs9fheGZhHBhSVxLaNl3DzUxNYH\n\tKh0rEL9Sl/od6OtswFre71QOsmyme4zFjFW+Nwb9BYolnvI/aMNXos72+kKiA44JBmTu\n\tDbLXkk+VzdiQHxV9Nq/V7ghAy3vMyXvhsOcN+0PzGfS7pQB5sgQRXFotETkckL/aDKiF\n\tAA5w==","X-Gm-Message-State":"AOAM530TFD9heVXQ/96xW4sypzQg6QpbXSthoLw3s8wv+bAkxLsXD2TO\n\te6F5i14ugiykFgg3dj107j2paA==","X-Google-Smtp-Source":"ABdhPJwoDo5qYsjDGbMUYtxk4DsDW5wJxp5YQ2vZVI6NkikoOjdXJMq7ous2MmklTty473KwKanLBg==","X-Received":"by 2002:a2e:9cd6:: with SMTP id\n\tg22mr9953358ljj.429.1595843905627; \n\tMon, 27 Jul 2020 02:58:25 -0700 (PDT)","To":"kieran.bingham@ideasonboard.com,\n\topenembedded-devel@lists.openembedded.org","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t","From":"Andrey Konovalov ","Message-ID":"<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","Date":"Mon, 27 Jul 2020 12:58:23 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org, raj.khem@gmail.com,\n\tmadhavan.krishnan@linaro.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11626,"web_url":"https://patchwork.libcamera.org/comment/11626/","msgid":"<20200727111107.GD5925@pendragon.ideasonboard.com>","date":"2020-07-27T11:11:07","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hello,\n\nOn Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n> On 27.07.2020 12:42, Kieran Bingham wrote:\n> > On 27/07/2020 10:21, Andrey Konovalov wrote:\n> >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >> libcamera.so. If it does, it assumes that libcamera binaries are\n> >> run directly from the build directory without installing them, and\n> >> tries to use resorces like IPA modules from the build directory.\n> >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >> That's why we need to remove this tag manually in do_install_append().\n> > \n> > Uh oh, what's changed... (I'll have to go take a look).\n> > \n> > -\n> > https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> > \n> > If we're reliant upon meson behaviour which is no longer consistent,\n> > then we are going to have to do something else in libcamera.\n> \n> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> *might* be dropped - if all the packages would be able to set RUNPATH to\n> what they need, and meson would detect that OK in all those cases.\n\nI think that if the problem is caused by a meson patch in openembedded,\nthen it would make sense to fix it there. We can decide to address the\nissue in libcamera itself if it's found to affect other distributions\ntoo, or if meson's behaviour changes in an incompatible way.\n\n> > /me sighs ...\n> > \n> >> IPA module is signed (with openssl dgst) after it is built. But\n> >> during packaging the OE build system 1) splits out debugging info,\n> >> and 2) strips the binaries. So the IPA module *.so file installed\n> >> isn't the one which the signature was calculated against. Then\n> >> the signature check fails, and libcamera tries to run the IPA\n> >> module isolated (in a sandbox), which doesn't work if the IPA\n> >> module wasn't designed to run isolated. The easiest way to fix that\n> >> is to disable splitting out debug information and stripping the binaries\n> >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >> INHIBIT_PACKAGE_STRIP.\n> > \n> > This sounds like an effective solution for openembedded, but it needs to\n> > be fixed in libcamera all the same.\n> > \n> > I'll try to follow up with the meson guys to see what we can do,.\n\nWe re-sign the IPA modules at install time for this very specific\nreason. If openembedded modifies the binaries after installing them,\nshould it re-run the signing script ?\n\n> >> Signed-off-by: Andrey Konovalov \n> >> ---\n> >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>\n> >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> index 00a5c480d..573366f08 100644\n> >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >> \n> >> S = \"${WORKDIR}/git\"\n> >> \n> >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >> \n> >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >> \n> >> inherit meson pkgconfig python3native\n> >> \n> >> +do_install_append() {\n> >> + chrpath -d ${D}${libdir}/libcamera.so\n> > \n> > Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> > the solution will be handling our own strip/install actions to do this\n> > explicitly in the build.\n> > \n> > It will be a pain to have to pull in another external dependency though...\n> > \n> >> +}\n> >> +\n> >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >> \n> >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> >> +","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 8878BBD86F\n\tfor ;\n\tMon, 27 Jul 2020 11:12:33 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 18FA361212;\n\tMon, 27 Jul 2020 13:12:33 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id AD60460536\n\tfor ;\n\tMon, 27 Jul 2020 13:12:32 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 584602A9;\n\tMon, 27 Jul 2020 13:12:19 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"DqfWXFcl\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595848339;\n\tbh=BjVXxpDV1trHpgvPPNSgSLPpz2vuKtstsFWzGq8ODBs=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=DqfWXFclftzZzTvZt1TO80zedg5xnHftaLi6cCqfL4O2NG5XBU0DdbJIsG30xqBCF\n\tEskyf7IuBrkXl5+oL25TroU2zs+uRmiN0Pl4pK2i3D+DcpaAo3a+od2opRrXw7eXc7\n\tA4UgJ+W1eYoeFdHR/hqMxBEKuW4LVukU+qKCRQfw=","Date":"Mon, 27 Jul 2020 14:11:07 +0300","From":"Laurent Pinchart ","To":"Andrey Konovalov ","Message-ID":"<20200727111107.GD5925@pendragon.ideasonboard.com>","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","MIME-Version":"1.0","Content-Disposition":"inline","In-Reply-To":"<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\traj.khem@gmail.com, openembedded-devel@lists.openembedded.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11636,"web_url":"https://patchwork.libcamera.org/comment/11636/","msgid":"","date":"2020-07-27T15:28:23","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":62,"url":"https://patchwork.libcamera.org/api/people/62/","name":"Khem Raj","email":"raj.khem@gmail.com"},"content":"On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov\n wrote:\n>\n> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> libcamera.so. If it does, it assumes that libcamera binaries are\n> run directly from the build directory without installing them, and\n> tries to use resorces like IPA modules from the build directory.\n> Mainline meson strips RPATH/RUNPATH out at install time (for\n> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> That's why we need to remove this tag manually in do_install_append().\n>\n> IPA module is signed (with openssl dgst) after it is built. But\n> during packaging the OE build system 1) splits out debugging info,\n> and 2) strips the binaries. So the IPA module *.so file installed\n> isn't the one which the signature was calculated against. Then\n> the signature check fails, and libcamera tries to run the IPA\n> module isolated (in a sandbox), which doesn't work if the IPA\n> module wasn't designed to run isolated. The easiest way to fix that\n> is to disable splitting out debug information and stripping the binaries\n> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> INHIBIT_PACKAGE_STRIP.\n>\n> Signed-off-by: Andrey Konovalov \n> ---\n> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> 1 file changed, 8 insertions(+), 1 deletion(-)\n>\n> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> index 00a5c480d..573366f08 100644\n> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>\n> S = \"${WORKDIR}/git\"\n>\n> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>\n> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>\n> inherit meson pkgconfig python3native\n>\n> +do_install_append() {\n> + chrpath -d ${D}${libdir}/libcamera.so\n> +}\n> +\n> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>\n> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> +INHIBIT_PACKAGE_STRIP = \"1\"\n\nI think this is sub-optimal, it means we can not have stripped\nbinaries and it will increase the size unnecessarily\n\n> +\n> --\n> 2.17.1\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id D2C6CBD86F\n\tfor ;\n\tMon, 27 Jul 2020 15:30:08 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 9F06361253;\n\tMon, 27 Jul 2020 17:30:08 +0200 (CEST)","from mail-qk1-x744.google.com (mail-qk1-x744.google.com\n\t[IPv6:2607:f8b0:4864:20::744])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8B57D605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:28:50 +0200 (CEST)","by mail-qk1-x744.google.com with SMTP id 11so15620540qkn.2\n\tfor ;\n\tMon, 27 Jul 2020 08:28:50 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"rTQBUO2V\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=5KcXTSwtN7FGrhsn+VZeMSY1uJ6phjI/QZyY87UMQnI=;\n\tb=rTQBUO2V4DVOG0lyLCO8BgIk9UvORAR36fNrxtzHyNyDOkPsMM6sxezALynbV/MZJ2\n\tWTwB2s7QYR3c2egAg3kUm94jI/bWLU9sNPClx1hu6dyCyFdu/WecjzYS27JFNyDorMnW\n\t3EuYSluW5cd3Nv7wfwwnTtbV28wfKp4b+vtBObhVYaUz8PK3denYZ62AXcoi2BXRRTGM\n\tvoxhhyx4oXSCmFZzJTL6PPIXFnBSMeDnIO/AOjD0r4rewBSeR7QEREdj0TjfP6EZdY25\n\tiFEvcXX7vELrqr62uObvJ9mup+PG6vsbsZGZL9Lrq1YBVIjprtgdxqdXkQS4FdHkyHpy\n\tUjrQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=5KcXTSwtN7FGrhsn+VZeMSY1uJ6phjI/QZyY87UMQnI=;\n\tb=tHSyl6ABM/KxVtKg5KNYqhpOochSzYMog06C2IvgoyiV8vrYh9rS90Qqz65hOamEG9\n\tLcncnW9rlWKH0XOLRK0xqP3m4uBvsGYneyZVRaAeIW2kedeUvdyzyyMQa6svvf9mE22s\n\tfIjtPhlGH+ZJlm6DZZqIKuMAxccn85KNMepBWebHD9Uiue1LHDvVTHDyV4Hu73vesIHe\n\tm11vDcY/uX99veCgBDM8sPmBu2veQ9i92KEP5e9XGTYm2ylf6qYj7MkVadGrAruNDK9L\n\tNe6KzYuf+ol4nGrI/FYh8Y7euDn3bAj7tIgI4D5FGAYi0Pt4XzR8l4BeWparJ2y7qsK6\n\tpkUg==","X-Gm-Message-State":"AOAM531FB2d2w/AR8ijm5KUsT3h9HfS10erfGAU0zVlH+e9JNbsKIUUr\n\tKYVzrbZW00/NlrYzwkWMBm7f8GwP0IZKwWx1Z64=","X-Google-Smtp-Source":"ABdhPJwd4k07MJa+O1rMg9RSbAUmHhv18T/TEYlU8hJak7sH2qFfSU9zE4cIV/bUcOaqqRKPpaNRbP6hfdNbAZJiVVo=","X-Received":"by 2002:a05:620a:565:: with SMTP id\n\tp5mr24591574qkp.215.1595863729436; \n\tMon, 27 Jul 2020 08:28:49 -0700 (PDT)","MIME-Version":"1.0","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>","In-Reply-To":"<20200727092108.6209-1-andrey.konovalov@linaro.org>","From":"Khem Raj ","Date":"Mon, 27 Jul 2020 08:28:23 -0700","Message-ID":"","To":"Andrey Konovalov ","X-Mailman-Approved-At":"Mon, 27 Jul 2020 17:30:07 +0200","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11637,"web_url":"https://patchwork.libcamera.org/comment/11637/","msgid":"","date":"2020-07-27T15:31:08","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":62,"url":"https://patchwork.libcamera.org/api/people/62/","name":"Khem Raj","email":"raj.khem@gmail.com"},"content":"On Mon, Jul 27, 2020 at 2:58 AM Andrey Konovalov\n wrote:\n>\n> Hi Kieran,\n>\n> On 27.07.2020 12:42, Kieran Bingham wrote:\n> > Hi Andrey,\n> >\n> > On 27/07/2020 10:21, Andrey Konovalov wrote:\n> >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >> libcamera.so. If it does, it assumes that libcamera binaries are\n> >> run directly from the build directory without installing them, and\n> >> tries to use resorces like IPA modules from the build directory.\n> >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >> That's why we need to remove this tag manually in do_install_append().\n> >\n> > Uh oh, what's changed... (I'll have to go take a look).\n> >\n> > -\n> > https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> >\n> > If we're reliant upon meson behaviour which is no longer consistent,\n> > then we are going to have to do something else in libcamera.\n>\n> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> *might* be dropped - if all the packages would be able to set RUNPATH to\n> what they need, and meson would detect that OK in all those cases.\n\nrunpath is problem more than solution when cross-compiling for a\nsystem which has normal file hierarchy standard\nsince it gets absolute values of build time paths embedded into\nbinaries, which is unwanted, so its stripped\nmost of the time on OE.\n\n>\n> Thanks,\n> Andrey\n>\n> > /me sighs ...\n> >\n> >> IPA module is signed (with openssl dgst) after it is built. But\n> >> during packaging the OE build system 1) splits out debugging info,\n> >> and 2) strips the binaries. So the IPA module *.so file installed\n> >> isn't the one which the signature was calculated against. Then\n> >> the signature check fails, and libcamera tries to run the IPA\n> >> module isolated (in a sandbox), which doesn't work if the IPA\n> >> module wasn't designed to run isolated. The easiest way to fix that\n> >> is to disable splitting out debug information and stripping the binaries\n> >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >> INHIBIT_PACKAGE_STRIP.\n> >\n> >\n> > This sounds like an effective solution for openembedded, but it needs to\n> > be fixed in libcamera all the same.\n> >\n> >\n> > I'll try to follow up with the meson guys to see what we can do,.\n> >\n> >\n> >> Signed-off-by: Andrey Konovalov \n> >> ---\n> >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>\n> >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> index 00a5c480d..573366f08 100644\n> >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >>\n> >> S = \"${WORKDIR}/git\"\n> >>\n> >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >>\n> >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >>\n> >> inherit meson pkgconfig python3native\n> >>\n> >> +do_install_append() {\n> >> + chrpath -d ${D}${libdir}/libcamera.so\n> >\n> > Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> > the solution will be handling our own strip/install actions to do this\n> > explicitly in the build.\n> >\n> > It will be a pain to have to pull in another external dependency though...\n> >\n> >> +}\n> >> +\n> >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >>\n> >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> >> +\n> >>\n> >","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 49DF0BD86F\n\tfor ;\n\tMon, 27 Jul 2020 15:31:38 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 1A5F861253;\n\tMon, 27 Jul 2020 17:31:38 +0200 (CEST)","from mail-qk1-x742.google.com (mail-qk1-x742.google.com\n\t[IPv6:2607:f8b0:4864:20::742])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id A773E605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:31:36 +0200 (CEST)","by mail-qk1-x742.google.com with SMTP id b79so15570355qkg.9\n\tfor ;\n\tMon, 27 Jul 2020 08:31:36 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"kg1Z042O\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=OoNxx3sIT6KOefGS5XH5anwqrUG6Z3cG79MmzOhxVZM=;\n\tb=kg1Z042OX5L0h4jGOSCOn5X1/wAFC4WDTK/ghd7oUvc+JI5ZjhC5CjOr41plqZqnr1\n\t3aSICrhWHd46UMAccY2eToUnxjpMhoY55I4XhyFQUZ9CFOJIOcXK3ByWXvg70DEK5P3c\n\tovSK1DFCQ1X0NYbyFTMSik4HvheCavjlE1XdVxu39UnLNx3hgZccOUzNbr60hBy6lDzo\n\t9WL+wzOtC73wNrMsaC9jWpfOTs6IV5AgkwRnRBq1ynzpLunslh+zGslEi+DpA3lPHdaI\n\t27gA0B2GRp+xZ3ibPmLYvrl6Q9s/rEbpe4NsDSnlAdJpC7fhUE/ttxkg3Rq7LhAwOfsJ\n\t1rKA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=OoNxx3sIT6KOefGS5XH5anwqrUG6Z3cG79MmzOhxVZM=;\n\tb=m2FHWmAhhSErLO8CnZYmanssrBiKJixw0Gx5nxkAfQuwxbe+plAJELFd7iJcaRS8nm\n\tUR26VDIDtMrrhBSCC7L3Nfye/8SNYOoci59S0H18i1/zwsq95jmAUzGtCLgAGL3W1V3b\n\tz/S3ck+RtqEQaH/cWetYi0SAMwG69HDQRrUDBwjJoh3cPNn+cNDWea1H7e+hRGAJZOoR\n\t7Mjg2gP3Ow1VSKVLQvnr8cudZwYpgkCXrdnBIPKUnf0hHo8fJ852fPMcx97gHFKX/np+\n\tLctdF0/BuYDJAK3WV/LzemS0QI329dhz4y8tFY/EZByhJz7YYQgondEcwZPn/cToMC/e\n\tlCKQ==","X-Gm-Message-State":"AOAM5329CF9es3KCnMA9UGHqGADtYYl7IND2zb/lBZQtRdVQahM6XDJi\n\trLhw5jETi/qblX8CFSC9gmKZ/6Acwar7HsVpjg0=","X-Google-Smtp-Source":"ABdhPJzJW4RtDdypJsqKWtUdd49EetD1SS0U0sqShu3nKaFE3o4yvEHSNfEZGfeR26FqSUY5Xong2bTdl0WQE5/gA0c=","X-Received":"by 2002:a05:620a:565:: with SMTP id\n\tp5mr24605493qkp.215.1595863895571; \n\tMon, 27 Jul 2020 08:31:35 -0700 (PDT)","MIME-Version":"1.0","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","In-Reply-To":"<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>","From":"Khem Raj ","Date":"Mon, 27 Jul 2020 08:31:08 -0700","Message-ID":"","To":"Andrey Konovalov ","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11639,"web_url":"https://patchwork.libcamera.org/comment/11639/","msgid":"","date":"2020-07-27T15:36:28","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Khem,\n\nOn 27.07.2020 18:28, Khem Raj wrote:\n> On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov\n> wrote:\n>>\n>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>> libcamera.so. If it does, it assumes that libcamera binaries are\n>> run directly from the build directory without installing them, and\n>> tries to use resorces like IPA modules from the build directory.\n>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>> That's why we need to remove this tag manually in do_install_append().\n>>\n>> IPA module is signed (with openssl dgst) after it is built. But\n>> during packaging the OE build system 1) splits out debugging info,\n>> and 2) strips the binaries. So the IPA module *.so file installed\n>> isn't the one which the signature was calculated against. Then\n>> the signature check fails, and libcamera tries to run the IPA\n>> module isolated (in a sandbox), which doesn't work if the IPA\n>> module wasn't designed to run isolated. The easiest way to fix that\n>> is to disable splitting out debug information and stripping the binaries\n>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>> INHIBIT_PACKAGE_STRIP.\n>>\n>> Signed-off-by: Andrey Konovalov \n>> ---\n>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>\n>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> index 00a5c480d..573366f08 100644\n>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>>\n>> S = \"${WORKDIR}/git\"\n>>\n>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>\n>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>\n>> inherit meson pkgconfig python3native\n>>\n>> +do_install_append() {\n>> + chrpath -d ${D}${libdir}/libcamera.so\n>> +}\n>> +\n>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>\n>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>> +INHIBIT_PACKAGE_STRIP = \"1\"\n> \n> I think this is sub-optimal, it means we can not have stripped\n> binaries and it will increase the size unnecessarily\n\nIndeed.\n\nBut the alternative is to recalculate the signature on the stripped binary in do_install_append(),\nand the drawback of this is moving part of the module signature implementation into the recipe.\n\nOr the libcamera implementation is to be changed to handle stripped binaries.\n\nThanks,\nAndrey\n\n>> +\n>> --\n>> 2.17.1\n>>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id B1B3DBD878\n\tfor ;\n\tMon, 27 Jul 2020 15:36:33 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 2C099613AA;\n\tMon, 27 Jul 2020 17:36:33 +0200 (CEST)","from mail-lf1-x141.google.com (mail-lf1-x141.google.com\n\t[IPv6:2a00:1450:4864:20::141])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id BEC25605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:36:31 +0200 (CEST)","by mail-lf1-x141.google.com with SMTP id h8so9231277lfp.9\n\tfor ;\n\tMon, 27 Jul 2020 08:36:31 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\tt205sm3102628lff.8.2020.07.27.08.36.29\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 08:36:29 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"AQFXh6Py\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=7lejTIqCLz085px/SxOF3xjPAS2PdkxRi8NaRsLbmCA=;\n\tb=AQFXh6PyNmNVWVHMt7+xyj1Vk28CrvZbFU8xDOZd8L1QTYD2adFwH9SbRk+jUpT4Gw\n\tDfi3+h4j4RIzO3ScV65uZmfwkp8wUa0OdoSkL3FkGdPxbQ6xTKQt+8wc2Y6VgsxHfPY7\n\tplcH8tTCZO93v+C02Yh6IdnIkshVi5aJ2mo33Ncxf2Lm/cY/WgD+Xfauu8DsucVZApw/\n\tpQCDeXOD7evrohoK5ZVR1wv2pc0rLyoIcILYk2noaPDpsaQAwmZtmIuIORA9wPNi72Ig\n\tzAv6e1aQV0jz+5M3a9U4w6e4qWD+CG3+U035cbNSCwKWfGyAyoed4qmbmEy0g5Y0wK8r\n\tBnag==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=7lejTIqCLz085px/SxOF3xjPAS2PdkxRi8NaRsLbmCA=;\n\tb=PZS/AmxQZ0ue48Vc4cbGyyA4ALke+UqYg1c/8CYkQj0NJel1JtKZ95oF19mzSotUM9\n\tp8FxhJii7X2TDn/Dv3HiVui6LSkj4rUaIrzEXdLLZLBaiMrsUT1vxddnovLGneQpGntj\n\tFnVuJi3aimZ0NNRceUs/m0ZCoxmouaOgMsiQw+eL1Oj4DyPdB3PoyLwiaH/5u8B2piWL\n\t2JQ1L6jz65mQq8MOJnlfKwq48xUGQuE0NtqnlGyjAUTOwXEd0sDzFroye6rmYi87LCG1\n\t9bgO9q3qaGyht4VtV/YdsszQTAZ09z/GRDlVb7uEvObLm7VCY+AN1RaaAXOdKvIEeKex\n\teWlA==","X-Gm-Message-State":"AOAM532bnhN3/ESmFzQ5T03Kms5ax09L0iG/0gl5tS1q2Woned8S1Cx+\n\tv20/604ZbSAmC6b2VFcxTjMiLw==","X-Google-Smtp-Source":"ABdhPJz4BrN/vxu5LHD5KV+Izth4K3o2LyrTRzi5MsAKjBd4iEafbrJXVVDJoMbjuTexLX+PwK6ULw==","X-Received":"by 2002:a19:ac03:: with SMTP id\n\tg3mr11870500lfc.164.1595864190865; \n\tMon, 27 Jul 2020 08:36:30 -0700 (PDT)","To":"Khem Raj ","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t","From":"Andrey Konovalov ","Message-ID":"","Date":"Mon, 27 Jul 2020 18:36:28 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11640,"web_url":"https://patchwork.libcamera.org/comment/11640/","msgid":"","date":"2020-07-27T15:37:27","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":62,"url":"https://patchwork.libcamera.org/api/people/62/","name":"Khem Raj","email":"raj.khem@gmail.com"},"content":"On Mon, Jul 27, 2020 at 4:12 AM Laurent Pinchart\n wrote:\n>\n> Hello,\n>\n> On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n> > On 27.07.2020 12:42, Kieran Bingham wrote:\n> > > On 27/07/2020 10:21, Andrey Konovalov wrote:\n> > >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> > >> libcamera.so. If it does, it assumes that libcamera binaries are\n> > >> run directly from the build directory without installing them, and\n> > >> tries to use resorces like IPA modules from the build directory.\n> > >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> > >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> > >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> > >> That's why we need to remove this tag manually in do_install_append().\n> > >\n> > > Uh oh, what's changed... (I'll have to go take a look).\n> > >\n> > > -\n> > > https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> > >\n> > > If we're reliant upon meson behaviour which is no longer consistent,\n> > > then we are going to have to do something else in libcamera.\n> >\n> > I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> > just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> > starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> > *might* be dropped - if all the packages would be able to set RUNPATH to\n> > what they need, and meson would detect that OK in all those cases.\n>\n> I think that if the problem is caused by a meson patch in openembedded,\n> then it would make sense to fix it there. We can decide to address the\n> issue in libcamera itself if it's found to affect other distributions\n> too, or if meson's behaviour changes in an incompatible way.\n\nAs I said in prior email, It causes problems in cross compiling, so\nperhaps it will be\nbetter to have an option to not specify it or reset it during configure.\n\n>\n> > > /me sighs ...\n> > >\n> > >> IPA module is signed (with openssl dgst) after it is built. But\n> > >> during packaging the OE build system 1) splits out debugging info,\n> > >> and 2) strips the binaries. So the IPA module *.so file installed\n> > >> isn't the one which the signature was calculated against. Then\n> > >> the signature check fails, and libcamera tries to run the IPA\n> > >> module isolated (in a sandbox), which doesn't work if the IPA\n> > >> module wasn't designed to run isolated. The easiest way to fix that\n> > >> is to disable splitting out debug information and stripping the binaries\n> > >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> > >> INHIBIT_PACKAGE_STRIP.\n> > >\n> > > This sounds like an effective solution for openembedded, but it needs to\n> > > be fixed in libcamera all the same.\n> > >\n> > > I'll try to follow up with the meson guys to see what we can do,.\n>\n> We re-sign the IPA modules at install time for this very specific\n> reason. If openembedded modifies the binaries after installing them,\n> should it re-run the signing script ?\n\nbuild systems take on creating debuggable packages and for that\nusually, it builds the package and then\ntakes the control of stripping the binaries since it will save the\nsymbols and debug info into a separate package\nunlike install -s or explicit strip commands the components build\nsystem might do, which would discard this\ncontent unconditionally. Perhaps it would be better for libcamera\nbuildsystem to take this into consideration\nin order for distros to be able to package it easily. so we need a way\nto resign it or not sign it at all since strip\nstep runs past install during build.\n\n>\n> > >> Signed-off-by: Andrey Konovalov \n> > >> ---\n> > >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> > >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> > >>\n> > >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > >> index 00a5c480d..573366f08 100644\n> > >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> > >>\n> > >> S = \"${WORKDIR}/git\"\n> > >>\n> > >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> > >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> > >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> > >>\n> > >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> > >>\n> > >> inherit meson pkgconfig python3native\n> > >>\n> > >> +do_install_append() {\n> > >> + chrpath -d ${D}${libdir}/libcamera.so\n> > >\n> > > Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> > > the solution will be handling our own strip/install actions to do this\n> > > explicitly in the build.\n> > >\n> > > It will be a pain to have to pull in another external dependency though...\n> > >\n> > >> +}\n> > >> +\n> > >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> > >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> > >>\n> > >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> > >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> > >> +\n>\n> --\n> Regards,\n>\n> Laurent Pinchart\n> -=-=-=-=-=-=-=-=-=-=-=-\n> Links: You receive all messages sent to this group.\n>\n> View/Reply Online (#85980): https://lists.openembedded.org/g/openembedded-devel/message/85980\n> Mute This Topic: https://lists.openembedded.org/mt/75819340/1997914\n> Group Owner: openembedded-devel+owner@lists.openembedded.org\n> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [raj.khem@gmail.com]\n> -=-=-=-=-=-=-=-=-=-=-=-","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 4F988BD86F\n\tfor ;\n\tMon, 27 Jul 2020 15:37:56 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 1DE2361253;\n\tMon, 27 Jul 2020 17:37:56 +0200 (CEST)","from mail-qk1-x743.google.com (mail-qk1-x743.google.com\n\t[IPv6:2607:f8b0:4864:20::743])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id B8C73605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:37:54 +0200 (CEST)","by mail-qk1-x743.google.com with SMTP id b14so13912696qkn.4\n\tfor ;\n\tMon, 27 Jul 2020 08:37:54 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"Q3PWSuym\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=BPmx7WwJ1bln0SNV9A4creLgAOhnquUTcUEDAwdqcuY=;\n\tb=Q3PWSuymOpGsc+5qYuLLk8JMeDO1aXjM4Miy3M+7TS4rQjK8fxSfWhJDjsQTh3XV4j\n\twWT0N3Fye5npDYsGWs05vBs3qHmXkbt/bnIBGq94nOTy4rYbTOoPrCzXF38cV63LB90z\n\tG/mYfDVs5nh1crQqgombabmzoS4aLxFWp9Fb90szYJMCEpXbzn5mR3b9/2Z3GdzyB0tq\n\tHkhpmXiGRq4T6dcKeVCgUHFh2jxNC/dHh65x7YwOGJzp+HM0IxBeM1TjQYHxhOCQvFHu\n\tYHI5OSZYUuyShwNnDJg1a1wUlGaBWecM6UKjoY2RdAv9AxDatqaBlYQFEgqYpFXH88uc\n\t4cPA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=BPmx7WwJ1bln0SNV9A4creLgAOhnquUTcUEDAwdqcuY=;\n\tb=e898Ra499h0b/ZB9udbFtoEPg8Tb14ftVBnkgrEJ+FecTuKBgiwdl1WLtGLzBj/EvE\n\tHhTpkRWsXTUuWdRcfAReC4guKU3okWRS5Nv/k4AuP49UBeDA65wXiZpp+NZIy4sUETh5\n\t38rxTBS8CpOQgUTnVwE8bWjmHkBcjhXHD0bd0gfL0E2dscWBxS4x5Zy9Vvh9jVsxDcYg\n\tEAviqlce69bzFLd8bV2YvzwETwGBw0hlLHo4hAWAEX5BiIO2zzNMeBpCd9YFLC2wBEAy\n\tc8h7sz90aew/m19J6Q72pUzO9KzmUmmhJ8W1+2S02i+ieCAmsujFe4cY+71tHUZJrTxB\n\thwJA==","X-Gm-Message-State":"AOAM530HjOvx4KwN5RUAC4M8MWMnyb5Q49lf4w2duoILQ2QntOdWvdho\n\tOVHlb9Uzxuk/uiJzzag+66b+iKPMBx72snl46Ws=","X-Google-Smtp-Source":"ABdhPJxmY1NEUgG9JEgnHY8ZiFDNl2WiKj8wdQQn+F6KxDw9hkm6EjTvE08KuUv7VufZZqNA5+8xW+0fh7fdY25jiyQ=","X-Received":"by 2002:a05:620a:565:: with SMTP id\n\tp5mr24634959qkp.215.1595864273640; \n\tMon, 27 Jul 2020 08:37:53 -0700 (PDT)","MIME-Version":"1.0","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>","In-Reply-To":"<20200727111107.GD5925@pendragon.ideasonboard.com>","From":"Khem Raj ","Date":"Mon, 27 Jul 2020 08:37:27 -0700","Message-ID":"","To":"Laurent Pinchart ","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11643,"web_url":"https://patchwork.libcamera.org/comment/11643/","msgid":"","date":"2020-07-27T15:38:39","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":62,"url":"https://patchwork.libcamera.org/api/people/62/","name":"Khem Raj","email":"raj.khem@gmail.com"},"content":"On Mon, Jul 27, 2020 at 8:36 AM Andrey Konovalov\n wrote:\n>\n> Hi Khem,\n>\n> On 27.07.2020 18:28, Khem Raj wrote:\n> > On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov\n> > wrote:\n> >>\n> >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >> libcamera.so. If it does, it assumes that libcamera binaries are\n> >> run directly from the build directory without installing them, and\n> >> tries to use resorces like IPA modules from the build directory.\n> >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >> That's why we need to remove this tag manually in do_install_append().\n> >>\n> >> IPA module is signed (with openssl dgst) after it is built. But\n> >> during packaging the OE build system 1) splits out debugging info,\n> >> and 2) strips the binaries. So the IPA module *.so file installed\n> >> isn't the one which the signature was calculated against. Then\n> >> the signature check fails, and libcamera tries to run the IPA\n> >> module isolated (in a sandbox), which doesn't work if the IPA\n> >> module wasn't designed to run isolated. The easiest way to fix that\n> >> is to disable splitting out debug information and stripping the binaries\n> >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >> INHIBIT_PACKAGE_STRIP.\n> >>\n> >> Signed-off-by: Andrey Konovalov \n> >> ---\n> >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>\n> >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> index 00a5c480d..573366f08 100644\n> >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >>\n> >> S = \"${WORKDIR}/git\"\n> >>\n> >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >>\n> >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >>\n> >> inherit meson pkgconfig python3native\n> >>\n> >> +do_install_append() {\n> >> + chrpath -d ${D}${libdir}/libcamera.so\n> >> +}\n> >> +\n> >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >>\n> >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> >\n> > I think this is sub-optimal, it means we can not have stripped\n> > binaries and it will increase the size unnecessarily\n>\n> Indeed.\n>\n> But the alternative is to recalculate the signature on the stripped binary in do_install_append(),\n> and the drawback of this is moving part of the module signature implementation into the recipe.\n>\n> Or the libcamera implementation is to be changed to handle stripped binaries.\n>\n\neither of these solutions will be better perhaps.\n\n> Thanks,\n> Andrey\n>\n> >> +\n> >> --\n> >> 2.17.1\n> >>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 746A4BD86F\n\tfor ;\n\tMon, 27 Jul 2020 15:39:08 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 446DC61253;\n\tMon, 27 Jul 2020 17:39:08 +0200 (CEST)","from mail-qt1-x844.google.com (mail-qt1-x844.google.com\n\t[IPv6:2607:f8b0:4864:20::844])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id EB053605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:39:06 +0200 (CEST)","by mail-qt1-x844.google.com with SMTP id 6so12544177qtt.0\n\tfor ;\n\tMon, 27 Jul 2020 08:39:06 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"ZYJt4aCo\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=aAsF1/QiSd/WcqXt3CpOkkeT2tIl8QfV37XhCmFxEnU=;\n\tb=ZYJt4aCoE4Wl6MsZZOOjjVbrxr22+4s5lEaLddPa5p7xatnmse2YD0cXqUtoAdV52r\n\tk2n6OHxMQ6kSQ6zj+GFP/8mXQyTuXRU3YvGmxq8Dxjd4NkxRDXWShinhYAz+ZN0fVdlQ\n\t+ZpXHPzxgks23qJFgfjSPx8gyU0Ly5eX7VrS7gd1VAQVZDhc13EHDOAt3IgNlrXdcygz\n\tyl/30jXPjtpi8WbLJZHm9mVU54EVA7/wljEUWLJdXiWc6iySR9eQssvzVjQePDYd+JhH\n\tddHVLFVev4sD7ONCr0bNdsiqca6fKW2orsMd5PF6ycq+gF0KLDZsBmW1HoL1dsRey/a0\n\tZ7sQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=aAsF1/QiSd/WcqXt3CpOkkeT2tIl8QfV37XhCmFxEnU=;\n\tb=Fdxo9Q4Y4ozUmzrUQ1EFyqBLyNZ64hY9aIDDV4sGYmUpk0yyFI+aIxrnnPeJwof9+k\n\te1DFZxBlL6wJLGVwMch7v7b4+rkiIAOCHd3DBp8WsbtQFaqesl1nZnph31Toowwi7ujA\n\tqJSAojbipe+XFAuPLKwfS0DtASMQ81ADHLPbywcg3pjbwj9Y+1G2HxAmn1IPe6NGiMqj\n\tdeQqmmPrdJonAhnsx+1+n41AqaQUfI72UDq0c4jkDNoE4uWnOYHwx75eu4RCKd1XoaEL\n\tvk60Kd2o1Xr2HUoEfNpcNqMKwUs5VOK5PirSnpUyF85Q+nomJ1M2WC3D8SDPBSmnGHZR\n\to3Cw==","X-Gm-Message-State":"AOAM531E1uMPS6q6XxWbDLN4QfmUrOREeSmzWKIqE2E21+0skBIdGXz3\n\tQ2ZMHi0JAsr4DVW/hWnccbnvDf16TglfIs4Tv0g=","X-Google-Smtp-Source":"ABdhPJzuBSfaTeA1RDIwt9mmPe6zIG/hZU7mEg+ykl8c+0Wz/hlczpFWEsBdruvb+y7zzOtLNdhQCpC5FgoygNsOLfg=","X-Received":"by 2002:ac8:22ea:: with SMTP id\n\tg39mr19667087qta.146.1595864345668; \n\tMon, 27 Jul 2020 08:39:05 -0700 (PDT)","MIME-Version":"1.0","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t","In-Reply-To":"","From":"Khem Raj ","Date":"Mon, 27 Jul 2020 08:38:39 -0700","Message-ID":"","To":"Andrey Konovalov ","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11644,"web_url":"https://patchwork.libcamera.org/comment/11644/","msgid":"<20200727154310.GA17521@pendragon.ideasonboard.com>","date":"2020-07-27T15:43:10","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Khem,\n\nOn Mon, Jul 27, 2020 at 08:37:27AM -0700, Khem Raj wrote:\n> On Mon, Jul 27, 2020 at 4:12 AM Laurent Pinchart wrote:\n> > On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n> > > On 27.07.2020 12:42, Kieran Bingham wrote:\n> > > > On 27/07/2020 10:21, Andrey Konovalov wrote:\n> > > >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> > > >> libcamera.so. If it does, it assumes that libcamera binaries are\n> > > >> run directly from the build directory without installing them, and\n> > > >> tries to use resorces like IPA modules from the build directory.\n> > > >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> > > >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> > > >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> > > >> That's why we need to remove this tag manually in do_install_append().\n> > > >\n> > > > Uh oh, what's changed... (I'll have to go take a look).\n> > > >\n> > > > -\n> > > > https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> > > >\n> > > > If we're reliant upon meson behaviour which is no longer consistent,\n> > > > then we are going to have to do something else in libcamera.\n> > >\n> > > I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> > > just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> > > starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> > > *might* be dropped - if all the packages would be able to set RUNPATH to\n> > > what they need, and meson would detect that OK in all those cases.\n> >\n> > I think that if the problem is caused by a meson patch in openembedded,\n> > then it would make sense to fix it there. We can decide to address the\n> > issue in libcamera itself if it's found to affect other distributions\n> > too, or if meson's behaviour changes in an incompatible way.\n> \n> As I said in prior email, It causes problems in cross compiling, so\n> perhaps it will be\n> better to have an option to not specify it or reset it during configure.\n\nThat's something we can consider, yes.\n\n> > > > /me sighs ...\n> > > >\n> > > >> IPA module is signed (with openssl dgst) after it is built. But\n> > > >> during packaging the OE build system 1) splits out debugging info,\n> > > >> and 2) strips the binaries. So the IPA module *.so file installed\n> > > >> isn't the one which the signature was calculated against. Then\n> > > >> the signature check fails, and libcamera tries to run the IPA\n> > > >> module isolated (in a sandbox), which doesn't work if the IPA\n> > > >> module wasn't designed to run isolated. The easiest way to fix that\n> > > >> is to disable splitting out debug information and stripping the binaries\n> > > >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> > > >> INHIBIT_PACKAGE_STRIP.\n> > > >\n> > > > This sounds like an effective solution for openembedded, but it needs to\n> > > > be fixed in libcamera all the same.\n> > > >\n> > > > I'll try to follow up with the meson guys to see what we can do,.\n> >\n> > We re-sign the IPA modules at install time for this very specific\n> > reason. If openembedded modifies the binaries after installing them,\n> > should it re-run the signing script ?\n> \n> build systems take on creating debuggable packages and for that\n> usually, it builds the package and then\n> takes the control of stripping the binaries since it will save the\n> symbols and debug info into a separate package\n> unlike install -s or explicit strip commands the components build\n> system might do, which would discard this\n> content unconditionally. Perhaps it would be better for libcamera\n> buildsystem to take this into consideration\n> in order for distros to be able to package it easily. so we need a way\n> to resign it or not sign it at all since strip\n> step runs past install during build.\n\nThe src/ipa/ipa-sign-install.sh script can be used by the build system\nto regenerate signatures. It takes the private key file as the first\nparameter, followed by all the modules to be signed. We can improve the\nscript to facilitate its integration with distribution packaging.\n\n> > > >> Signed-off-by: Andrey Konovalov \n> > > >> ---\n> > > >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> > > >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> > > >>\n> > > >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > > >> index 00a5c480d..573366f08 100644\n> > > >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > > >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> > > >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> > > >>\n> > > >> S = \"${WORKDIR}/git\"\n> > > >>\n> > > >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> > > >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> > > >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> > > >>\n> > > >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> > > >>\n> > > >> inherit meson pkgconfig python3native\n> > > >>\n> > > >> +do_install_append() {\n> > > >> + chrpath -d ${D}${libdir}/libcamera.so\n> > > >\n> > > > Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> > > > the solution will be handling our own strip/install actions to do this\n> > > > explicitly in the build.\n> > > >\n> > > > It will be a pain to have to pull in another external dependency though...\n> > > >\n> > > >> +}\n> > > >> +\n> > > >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> > > >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> > > >>\n> > > >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> > > >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> > > >> +","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 7E2ADBD878\n\tfor ;\n\tMon, 27 Jul 2020 15:43:23 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id F1C37613AA;\n\tMon, 27 Jul 2020 17:43:22 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5D759605B2\n\tfor ;\n\tMon, 27 Jul 2020 17:43:21 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id D8604556;\n\tMon, 27 Jul 2020 17:43:17 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"n/paZKlp\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595864598;\n\tbh=R6dTJkCspTfxP5jWXv1tqJigfmPwvMO7czgdYhlHcrw=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=n/paZKlpzXWLZSa1ab+2TGqDJFZyTvaMiJfaIAac5VZMWl1lJ+8qQcEfFfnPglM0k\n\tq6wln7eBSBPQ0N+PQX8j5LpLPUXjjDkFJgpLOskqofgLzMgGUbUyLIeLuXimZsAuNG\n\tJP2R0Uf2MMqw4qyisy3nRKXIw2LXOUWsA2V+Uil8=","Date":"Mon, 27 Jul 2020 18:43:10 +0300","From":"Laurent Pinchart ","To":"Khem Raj ","Message-ID":"<20200727154310.GA17521@pendragon.ideasonboard.com>","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>\n\t","MIME-Version":"1.0","Content-Disposition":"inline","In-Reply-To":"","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11645,"web_url":"https://patchwork.libcamera.org/comment/11645/","msgid":"<20200727154503.GB17521@pendragon.ideasonboard.com>","date":"2020-07-27T15:45:03","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Andrey,\n\nOn Mon, Jul 27, 2020 at 06:36:28PM +0300, Andrey Konovalov wrote:\n> On 27.07.2020 18:28, Khem Raj wrote:\n> > On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov wrote:\n> >>\n> >> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >> libcamera.so. If it does, it assumes that libcamera binaries are\n> >> run directly from the build directory without installing them, and\n> >> tries to use resorces like IPA modules from the build directory.\n> >> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >> That's why we need to remove this tag manually in do_install_append().\n> >>\n> >> IPA module is signed (with openssl dgst) after it is built. But\n> >> during packaging the OE build system 1) splits out debugging info,\n> >> and 2) strips the binaries. So the IPA module *.so file installed\n> >> isn't the one which the signature was calculated against. Then\n> >> the signature check fails, and libcamera tries to run the IPA\n> >> module isolated (in a sandbox), which doesn't work if the IPA\n> >> module wasn't designed to run isolated. The easiest way to fix that\n> >> is to disable splitting out debug information and stripping the binaries\n> >> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >> INHIBIT_PACKAGE_STRIP.\n> >>\n> >> Signed-off-by: Andrey Konovalov \n> >> ---\n> >> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>\n> >> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> index 00a5c480d..573366f08 100644\n> >> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >>\n> >> S = \"${WORKDIR}/git\"\n> >>\n> >> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >>\n> >> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >>\n> >> inherit meson pkgconfig python3native\n> >>\n> >> +do_install_append() {\n> >> + chrpath -d ${D}${libdir}/libcamera.so\n> >> +}\n> >> +\n> >> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >>\n> >> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >> +INHIBIT_PACKAGE_STRIP = \"1\"\n> > \n> > I think this is sub-optimal, it means we can not have stripped\n> > binaries and it will increase the size unnecessarily\n> \n> Indeed.\n> \n> But the alternative is to recalculate the signature on the stripped binary in do_install_append(),\n> and the drawback of this is moving part of the module signature implementation into the recipe.\n> \n> Or the libcamera implementation is to be changed to handle stripped binaries.\n\nWe could calculate the signature on selected sections only, but that\nwould make the implementation much more complex. Could the\nsrc/ipa/ipa-sign-install.sh resign script could be used by the recipe ?\nWe can also improve the script to facilitate its usage.\n\n> >> +","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 28983BD878\n\tfor ;\n\tMon, 27 Jul 2020 15:45:13 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id BAAE361253;\n\tMon, 27 Jul 2020 17:45:12 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 771B360536\n\tfor ;\n\tMon, 27 Jul 2020 17:45:11 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id C7779556;\n\tMon, 27 Jul 2020 17:45:10 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"pSDICcxy\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595864711;\n\tbh=7+rjYJViHAv45O3xFRhSAkzd3zPLg2wp+hX497k+wmg=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=pSDICcxyjFYzs5ByJKFv0clKBXqi903zF7lJkDYFNA44WbPNWlK+KiWN/GKqwdGJd\n\tonpSD//gKhAoCxT/bQ4bqLFnXFXb7zVyGzYf9gcp/K7cWSwVzhb5dQ4DVkR++YX72O\n\tlMgT+PF+Wr7oCUqc/M+wcRxDQkCheytK/2BxxeFg=","Date":"Mon, 27 Jul 2020 18:45:03 +0300","From":"Laurent Pinchart ","To":"Andrey Konovalov ","Message-ID":"<20200727154503.GB17521@pendragon.ideasonboard.com>","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t","MIME-Version":"1.0","Content-Disposition":"inline","In-Reply-To":"","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\tKhem Raj ,\n\topenembeded-devel ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11646,"web_url":"https://patchwork.libcamera.org/comment/11646/","msgid":"<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>","date":"2020-07-27T15:46:47","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Laurent,\n\nOn 27.07.2020 14:11, Laurent Pinchart wrote:\n> Hello,\n> \n> On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n>> On 27.07.2020 12:42, Kieran Bingham wrote:\n>>> On 27/07/2020 10:21, Andrey Konovalov wrote:\n>>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>>>> libcamera.so. If it does, it assumes that libcamera binaries are\n>>>> run directly from the build directory without installing them, and\n>>>> tries to use resorces like IPA modules from the build directory.\n>>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>>>> That's why we need to remove this tag manually in do_install_append().\n>>>\n>>> Uh oh, what's changed... (I'll have to go take a look).\n>>>\n>>> -\n>>> https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n>>>\n>>> If we're reliant upon meson behaviour which is no longer consistent,\n>>> then we are going to have to do something else in libcamera.\n>>\n>> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n>> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n>> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n>> *might* be dropped - if all the packages would be able to set RUNPATH to\n>> what they need, and meson would detect that OK in all those cases.\n> \n> I think that if the problem is caused by a meson patch in openembedded,\n> then it would make sense to fix it there. We can decide to address the\n> issue in libcamera itself if it's found to affect other distributions\n> too, or if meson's behaviour changes in an incompatible way.\n\nIt looks like it is not openembedded only issue:\n\n-------- Forwarded Message --------\nSubject: [libcamera-devel] [PATCH v4 0/2] package/libcamera: bump version to 96fab38\nDate: Tue, 16 Jun 2020 20:59:49 +0200\nFrom: Peter Seiderer \nTo: buildroot@busybox.net\nCC: libcamera-devel@lists.libcamera.org, Yann E . MORIN \n\n\n\nWith the following patch libcamera is forced to believe it is running\nin a installed environment:\n\ndiff --git a/src/libcamera/utils.cpp b/src/libcamera/utils.cpp\nindex d55338f..4ff9dac 100644\n--- a/src/libcamera/utils.cpp\n+++ b/src/libcamera/utils.cpp\n@@ -346,15 +346,18 @@ details::StringSplitter split(const std::string &str, const std::string &delim)\n */\n bool isLibcameraInstalled()\n {\n+#if 0\n \t/*\n \t * DT_RUNPATH (DT_RPATH when the linker uses old dtags) is removed on\n \t * install.\n \t */\n \tfor (const ElfW(Dyn) *dyn = _DYNAMIC; dyn->d_tag != DT_NULL; ++dyn) {\n-\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH)\n+\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH) {\n+\t\t\tprintf(\"XXXXX - dyn->d_un.d_ptr: %s\\n\", (char*)dyn->d_un.d_ptr);\n \t\t\treturn false;\n+\t\t}\n \t}\n-\n+#endif\n \treturn true;\n }\n\nMaybe this is because of the buildroot local meson patch ([1]), leading\nto an empty (but not absent) RPATH?\n\n\n\n[0:02:18.125804232] [252] DEBUG IPAManager ipa_manager.cpp:316 IPA module /usr/lib/libcamera/ipa_rpi.so signature is not valid\n\n\n\nThis can be avoided with the following patch/hack (disable signature check):\n\ndiff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\nindex 505cf61..3d64898 100644\n--- a/src/libcamera/ipa_manager.cpp\n+++ b/src/libcamera/ipa_manager.cpp\n@@ -301,6 +301,9 @@ std::unique_ptr IPAManager::createIPA(PipelineHandler *pipe,\n\n bool IPAManager::isSignatureValid(IPAModule *ipa) const\n {\n+#if 1\n+\treturn true;\n+#else\n #if HAVE_IPA_PUBKEY\n \tFile file{ ipa->path() };\n \tif (!file.open(File::ReadOnly))\n@@ -320,6 +323,7 @@ bool IPAManager::isSignatureValid(IPAModule *ipa) const\n #else\n \treturn false;\n #endif\n+#endif\n }\n\n } /* namespace libcamera */\n\n\nMaybe related to the buildroot finalize and/or sanitizing RPATH in target tree\nstep (and/or strip after install with BR2_ENABLE_DEBUG=y/BR2_STRIP_strip=y\nenabled)?\n-------- End of Forwarded Message --------\n\nThanks,\nAndrey\n\n>>> /me sighs ...\n>>>\n>>>> IPA module is signed (with openssl dgst) after it is built. But\n>>>> during packaging the OE build system 1) splits out debugging info,\n>>>> and 2) strips the binaries. So the IPA module *.so file installed\n>>>> isn't the one which the signature was calculated against. Then\n>>>> the signature check fails, and libcamera tries to run the IPA\n>>>> module isolated (in a sandbox), which doesn't work if the IPA\n>>>> module wasn't designed to run isolated. The easiest way to fix that\n>>>> is to disable splitting out debug information and stripping the binaries\n>>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>>>> INHIBIT_PACKAGE_STRIP.\n>>>\n>>> This sounds like an effective solution for openembedded, but it needs to\n>>> be fixed in libcamera all the same.\n>>>\n>>> I'll try to follow up with the meson guys to see what we can do,.\n> \n> We re-sign the IPA modules at install time for this very specific\n> reason. If openembedded modifies the binaries after installing them,\n> should it re-run the signing script ?\n> \n>>>> Signed-off-by: Andrey Konovalov \n>>>> ---\n>>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>>>\n>>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> index 00a5c480d..573366f08 100644\n>>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>>>> \n>>>> S = \"${WORKDIR}/git\"\n>>>> \n>>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>>> \n>>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>>> \n>>>> inherit meson pkgconfig python3native\n>>>> \n>>>> +do_install_append() {\n>>>> + chrpath -d ${D}${libdir}/libcamera.so\n>>>\n>>> Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n>>> the solution will be handling our own strip/install actions to do this\n>>> explicitly in the build.\n>>>\n>>> It will be a pain to have to pull in another external dependency though...\n>>>\n>>>> +}\n>>>> +\n>>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>>> \n>>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n>>>> +\n> \n> \n> -=-=-=-=-=-=-=-=-=-=-=-\n> Links: You receive all messages sent to this group.\n> \n> View/Reply Online (#85980): https://lists.openembedded.org/g/openembedded-devel/message/85980\n> Mute This Topic: https://lists.openembedded.org/mt/75819340/4454599\n> Group Owner: openembedded-devel+owner@lists.openembedded.org\n> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [andrey.konovalov@linaro.org]\n> -=-=-=-=-=-=-=-=-=-=-=-\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 671DFBD878\n\tfor ;\n\tMon, 27 Jul 2020 15:46:52 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 34DAB61253;\n\tMon, 27 Jul 2020 17:46:52 +0200 (CEST)","from mail-lj1-x242.google.com (mail-lj1-x242.google.com\n\t[IPv6:2a00:1450:4864:20::242])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 7F0CD60536\n\tfor ;\n\tMon, 27 Jul 2020 17:46:50 +0200 (CEST)","by mail-lj1-x242.google.com with SMTP id q6so17766431ljp.4\n\tfor ;\n\tMon, 27 Jul 2020 08:46:50 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\tb204sm3107480lfd.48.2020.07.27.08.46.48\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 08:46:48 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"PKCljGU2\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=OO8LD9ADkgw8ZCS3eVFJ5OQX79AdfsHV6gdTceJOmKw=;\n\tb=PKCljGU2oEjzy6rDGPcs4C2XqxG/UeNUmZbYXMrrpaC/1v9VaEG90PNlwOBqIDjHgJ\n\tNArzKDkZFTlThi/Xhdp+2KHWIPaWEqf/LymXOZ5FBjTd4Z/jHrr05+Ahi+avsn24P5u5\n\t2FTKCc1uX4evO/Ud9uLsRJO3IYTBw2gm+HXx4d0HPMSJm0Ha24MuGSJQjbmunsl2aJVC\n\tfEOq8cfzYPaljKhKhUa6kPQuYi0G9WlXIwzXT/xaYxPLEl5AK57ZSOx/WFVE5pDrBWBR\n\t1rdTIvMAn/9iR7wGoebMxx7TDYsvCenColQpuFo0o8nTbxNXUT/K9bk91YyfZDG02CPC\n\tODBw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=OO8LD9ADkgw8ZCS3eVFJ5OQX79AdfsHV6gdTceJOmKw=;\n\tb=Z6DORZTZcYCTkNGbFLcwTL94eTFDOA+KB7jnBe/YkIdEldJ+VTfCGzaDovkdCrvQPo\n\t11gV+gzoNzVp6ciK2d50QOk0GdO0ofogbYk/dT2wKsuhyHJzcTwqynCZQ12gUKvpcrHx\n\teBhaOFf7XNq3NNmguCB1KwiFQSryaLO0/IdDll/e313Pdk8TSa706uFL0VyefDr7Gr4o\n\tE4sHPohlut0xgCMcFOzz23Zao8oIpsVBaCedq2AF3DQ5J/weyiGYCOXIGKovuYluQHDO\n\tE1IZOfp1l1wh2GB7DyDjCMWuqKh6/bO9SmqI4dBHeAvqygZ6Sn8XX7aPbsZVIL7hIwvv\n\tqDkg==","X-Gm-Message-State":"AOAM530zBB8BxvWs8j2Pwcd3Iy/xz7q3grC+iWzk4vzvYMFGU7E6xIP9\n\t3hRRmgQkzfQPZBv3Dj+dJH2FRA==","X-Google-Smtp-Source":"ABdhPJxCmxBXspMr2dHuy92qhwZv2ErZOYGG3JdDe72zYgLq8WotsAaaB+bRjTAHl3pDc1omq6fyQQ==","X-Received":"by 2002:a2e:8e2a:: with SMTP id r10mr2195425ljk.31.1595864809829;\n\tMon, 27 Jul 2020 08:46:49 -0700 (PDT)","To":"Laurent Pinchart ","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>","From":"Andrey Konovalov ","Message-ID":"<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>","Date":"Mon, 27 Jul 2020 18:46:47 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"<20200727111107.GD5925@pendragon.ideasonboard.com>","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\traj.khem@gmail.com, openembedded-devel@lists.openembedded.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11648,"web_url":"https://patchwork.libcamera.org/comment/11648/","msgid":"<3831a2ac-eb6e-6b96-01b0-c6db1623f5b7@linaro.org>","date":"2020-07-27T15:51:02","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Laurent,\n\nOn 27.07.2020 18:45, Laurent Pinchart wrote:\n> Hi Andrey,\n> \n> On Mon, Jul 27, 2020 at 06:36:28PM +0300, Andrey Konovalov wrote:\n>> On 27.07.2020 18:28, Khem Raj wrote:\n>>> On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov wrote:\n>>>>\n>>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>>>> libcamera.so. If it does, it assumes that libcamera binaries are\n>>>> run directly from the build directory without installing them, and\n>>>> tries to use resorces like IPA modules from the build directory.\n>>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>>>> That's why we need to remove this tag manually in do_install_append().\n>>>>\n>>>> IPA module is signed (with openssl dgst) after it is built. But\n>>>> during packaging the OE build system 1) splits out debugging info,\n>>>> and 2) strips the binaries. So the IPA module *.so file installed\n>>>> isn't the one which the signature was calculated against. Then\n>>>> the signature check fails, and libcamera tries to run the IPA\n>>>> module isolated (in a sandbox), which doesn't work if the IPA\n>>>> module wasn't designed to run isolated. The easiest way to fix that\n>>>> is to disable splitting out debug information and stripping the binaries\n>>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>>>> INHIBIT_PACKAGE_STRIP.\n>>>>\n>>>> Signed-off-by: Andrey Konovalov \n>>>> ---\n>>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>>>\n>>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> index 00a5c480d..573366f08 100644\n>>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>>>>\n>>>> S = \"${WORKDIR}/git\"\n>>>>\n>>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>>>\n>>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>>>\n>>>> inherit meson pkgconfig python3native\n>>>>\n>>>> +do_install_append() {\n>>>> + chrpath -d ${D}${libdir}/libcamera.so\n>>>> +}\n>>>> +\n>>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>>>\n>>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n>>>\n>>> I think this is sub-optimal, it means we can not have stripped\n>>> binaries and it will increase the size unnecessarily\n>>\n>> Indeed.\n>>\n>> But the alternative is to recalculate the signature on the stripped binary in do_install_append(),\n>> and the drawback of this is moving part of the module signature implementation into the recipe.\n>>\n>> Or the libcamera implementation is to be changed to handle stripped binaries.\n> \n> We could calculate the signature on selected sections only, but that\n> would make the implementation much more complex. Could the\n> src/ipa/ipa-sign-install.sh resign script could be used by the recipe ?\n\nYes, it could.\nI'll try this.\n\n> We can also improve the script to facilitate its usage.\n\nOK.\n\nThanks,\nAndrey\n\n>>>> +\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id B79FBBD86F\n\tfor ;\n\tMon, 27 Jul 2020 15:51:06 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 85BDB613B6;\n\tMon, 27 Jul 2020 17:51:06 +0200 (CEST)","from mail-lj1-x242.google.com (mail-lj1-x242.google.com\n\t[IPv6:2a00:1450:4864:20::242])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 276CC6118A\n\tfor ;\n\tMon, 27 Jul 2020 17:51:05 +0200 (CEST)","by mail-lj1-x242.google.com with SMTP id b25so17799548ljp.6\n\tfor ;\n\tMon, 27 Jul 2020 08:51:05 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\ty21sm1955806ljg.111.2020.07.27.08.51.03\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 08:51:03 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"LgdRiT+f\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=BxnaWYpqH+TZSEPPchJigI0vXWd0qDsUviHuDeau2xE=;\n\tb=LgdRiT+fWZXsqXNbaKQfIY0PZNXMoGPPgFftvDoUxnFx9gtpLSjY+cM+yGLb0iW+Jj\n\tzSRW5TWnv9KZKe6zXhGR19kPl3jUBIfQB+GmPPQQRRAWbWOyzveY5HA4ioz8dz+YW0F+\n\thzjLfY53Ny/YWntmjgfpqclhMmONiM1y+aZcJQK7CuuRUltD5qIJx8RtqDVusS61DpGz\n\t2haVGtGwylglqvvf8wcYqKTTnUHn6RxgNyQsjoNgIkzlmYo9FJ2RHAGM/x2ROUYf4kgI\n\tFPUVqLxUDb8gaZpjMMvQgITeBuynGx7wb3UnXtJOUarXHBN5qTS1Au4UxZGWzc01KxgA\n\t3FWQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=BxnaWYpqH+TZSEPPchJigI0vXWd0qDsUviHuDeau2xE=;\n\tb=iPDCsns7gZZno5EKxb7r2XoX2teV0zJRo2AJjao/hSNQgJOFkERLN1ypH2A8qEFC+I\n\tQ2+hBxDOeDzVZ2iGHjJ+VhrQJirh4J3KnIGT9BSBYWMR54cgi++BgAlfOv7fOvhE2ba+\n\tFugjpbQvgtEQX1yQ5SGbkfH5ZjSCzbbp2p4wvghgkovM3DUV9devW8qkelnF8+hJWyKe\n\tjDOPfSwXmPwOhWYFXKW6W9Xl5ptt73xYZZ2noKYbbobQRz2jiIDIUrNWSX1hYG4F4bb7\n\tV7C8XNK8xdgA9NckJmi3lWm10R5LKOblTfKwQRvzfukvR2ty4kj0168fgLhLDCHiuu/h\n\tjK4A==","X-Gm-Message-State":"AOAM532B3rdcKHGfaWwQaELnDwlDJreHCzhrqCEs3UVnPODQm96zaOAj\n\tqPdyQqC1hIY7Ee8GrD4u/uV6cA==","X-Google-Smtp-Source":"ABdhPJzF7R/Bg1yZa/Cr8UBiK/lhyaOVIeNTz955JsPdIM9tvYsdciMGdZ0wnJLlo2iLdmCqkq8b+w==","X-Received":"by 2002:a2e:8684:: with SMTP id l4mr10808346lji.75.1595865064543;\n\tMon, 27 Jul 2020 08:51:04 -0700 (PDT)","To":"Laurent Pinchart ","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t\n\t<20200727154503.GB17521@pendragon.ideasonboard.com>","From":"Andrey Konovalov ","Message-ID":"<3831a2ac-eb6e-6b96-01b0-c6db1623f5b7@linaro.org>","Date":"Mon, 27 Jul 2020 18:51:02 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"<20200727154503.GB17521@pendragon.ideasonboard.com>","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\tKhem Raj ,\n\topenembeded-devel ","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11649,"web_url":"https://patchwork.libcamera.org/comment/11649/","msgid":"","date":"2020-07-27T15:56:01","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Khem,\n\nOn 27.07.2020 18:38, Khem Raj wrote:\n> On Mon, Jul 27, 2020 at 8:36 AM Andrey Konovalov\n> wrote:\n>>\n>> Hi Khem,\n>>\n>> On 27.07.2020 18:28, Khem Raj wrote:\n>>> On Mon, Jul 27, 2020 at 2:21 AM Andrey Konovalov\n>>> wrote:\n>>>>\n>>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>>>> libcamera.so. If it does, it assumes that libcamera binaries are\n>>>> run directly from the build directory without installing them, and\n>>>> tries to use resorces like IPA modules from the build directory.\n>>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>>>> That's why we need to remove this tag manually in do_install_append().\n>>>>\n>>>> IPA module is signed (with openssl dgst) after it is built. But\n>>>> during packaging the OE build system 1) splits out debugging info,\n>>>> and 2) strips the binaries. So the IPA module *.so file installed\n>>>> isn't the one which the signature was calculated against. Then\n>>>> the signature check fails, and libcamera tries to run the IPA\n>>>> module isolated (in a sandbox), which doesn't work if the IPA\n>>>> module wasn't designed to run isolated. The easiest way to fix that\n>>>> is to disable splitting out debug information and stripping the binaries\n>>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>>>> INHIBIT_PACKAGE_STRIP.\n>>>>\n>>>> Signed-off-by: Andrey Konovalov \n>>>> ---\n>>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>>>\n>>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> index 00a5c480d..573366f08 100644\n>>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>>>>\n>>>> S = \"${WORKDIR}/git\"\n>>>>\n>>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>>>\n>>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>>>\n>>>> inherit meson pkgconfig python3native\n>>>>\n>>>> +do_install_append() {\n>>>> + chrpath -d ${D}${libdir}/libcamera.so\n>>>> +}\n>>>> +\n>>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>>>\n>>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n>>>\n>>> I think this is sub-optimal, it means we can not have stripped\n>>> binaries and it will increase the size unnecessarily\n>>\n>> Indeed.\n>>\n>> But the alternative is to recalculate the signature on the stripped binary in do_install_append(),\n>> and the drawback of this is moving part of the module signature implementation into the recipe.\n>>\n>> Or the libcamera implementation is to be changed to handle stripped binaries.\n>>\n> \n> either of these solutions will be better perhaps.\n\nSound good. I'll try recalculating the signature and post v2 of the patch.\n\nThanks,\nAndrey","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id BF3CCBD878\n\tfor ;\n\tMon, 27 Jul 2020 15:56:05 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 4EAE3613AA;\n\tMon, 27 Jul 2020 17:56:05 +0200 (CEST)","from mail-lj1-x242.google.com (mail-lj1-x242.google.com\n\t[IPv6:2a00:1450:4864:20::242])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id F31986118A\n\tfor ;\n\tMon, 27 Jul 2020 17:56:03 +0200 (CEST)","by mail-lj1-x242.google.com with SMTP id q4so17842176lji.2\n\tfor ;\n\tMon, 27 Jul 2020 08:56:03 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\tl12sm2427326ljj.43.2020.07.27.08.56.01\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 08:56:02 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"zkaJJYvV\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=kkWxCQ9j53wQUvJl9/qJLUdu52u5aAE113JOx3lV9mU=;\n\tb=zkaJJYvVJCqvCj+7XISwmJS1qvhH7HoywibgHVAxJSy2ZM6RKt8qNUB2VlnxKH0Vp1\n\tBrMN1TaAH557JxUSpdThFB0jqYmtbBWv50bZRLfrzcL2DFCP496M2ykBbgTcyhrc891/\n\tnHmDFImYo0ZMZLP6QeZTE7h8dHQxvXE/OKwA3aDO1WDVwvTi/nmuoLUodigYVfTsrtTo\n\tcTyFwudLfXv0fca51yoV8uoIN1UyAdiRpnaXYI0tfXZ00RjGWPo95Z5FIZUZynzkJZmy\n\tpfpAWOfyExc2ivRpITQ2OzTR9nGJh1WHyOH10XQ9JnoSoNoTCBIOt8mNB4LeTRm8IukU\n\tzsoQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=kkWxCQ9j53wQUvJl9/qJLUdu52u5aAE113JOx3lV9mU=;\n\tb=mC/eFVP2IpgL5MIuH2kvdtalr5K2UlSL45xp/P81HRTiU6g7w6ztg/2cmrvZZ7h0Lw\n\tqAvWNWTLDrkJ4t0K0z+XL1gQtuiREy6oPEQP7iduZWjpSIPcNh8wmZ0jKfyXm4V4vjci\n\tGGGx6JOYH5WebYewJ0IyiYdssaMmn/6RAinWXpJGqXrL5mODxQimM2Nqk47porbO9mJD\n\tnFFEJC2yYBchELyOdCWOaGJmHCdWtUiDqToZHVhRSzS4zooG/LgbYTvqpBgH4ad8CKU+\n\tUO+mjL6VN3V6ldKpUoI9bSKmoy79HSKM/O4sJaN4zpmCCiz1wVnqUWzRVfRnXZ1MQszZ\n\t9iQA==","X-Gm-Message-State":"AOAM530GRqFbxzZQo7IGF04iaA+Lh56UdHftXWMyAPh7OeBDgXMB85vA\n\t8EaZs2XbsCQ8hWcr6cRNzCUnTQ==","X-Google-Smtp-Source":"ABdhPJyYpn6zEM80idRnqTq/8a2pWsUb2IJr7WMAF3SXWMIYA7Rm/CiIFmy8eYeQ57GCIea+eHRMSA==","X-Received":"by 2002:a05:651c:1182:: with SMTP id\n\tw2mr4910848ljo.197.1595865363290; \n\tMon, 27 Jul 2020 08:56:03 -0700 (PDT)","To":"Khem Raj ","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t\n\t","From":"Andrey Konovalov ","Message-ID":"","Date":"Mon, 27 Jul 2020 18:56:01 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11651,"web_url":"https://patchwork.libcamera.org/comment/11651/","msgid":"<20200727160310.GE17521@pendragon.ideasonboard.com>","date":"2020-07-27T16:03:10","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Andrey,\n\nOn Mon, Jul 27, 2020 at 06:46:47PM +0300, Andrey Konovalov wrote:\n> On 27.07.2020 14:11, Laurent Pinchart wrote:\n> > On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n> >> On 27.07.2020 12:42, Kieran Bingham wrote:\n> >>> On 27/07/2020 10:21, Andrey Konovalov wrote:\n> >>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >>>> libcamera.so. If it does, it assumes that libcamera binaries are\n> >>>> run directly from the build directory without installing them, and\n> >>>> tries to use resorces like IPA modules from the build directory.\n> >>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >>>> That's why we need to remove this tag manually in do_install_append().\n> >>>\n> >>> Uh oh, what's changed... (I'll have to go take a look).\n> >>>\n> >>> -\n> >>> https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> >>>\n> >>> If we're reliant upon meson behaviour which is no longer consistent,\n> >>> then we are going to have to do something else in libcamera.\n> >>\n> >> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> >> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> >> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> >> *might* be dropped - if all the packages would be able to set RUNPATH to\n> >> what they need, and meson would detect that OK in all those cases.\n> > \n> > I think that if the problem is caused by a meson patch in openembedded,\n> > then it would make sense to fix it there. We can decide to address the\n> > issue in libcamera itself if it's found to affect other distributions\n> > too, or if meson's behaviour changes in an incompatible way.\n> \n> It looks like it is not openembedded only issue:\n> \n> -------- Forwarded Message --------\n> Subject: [libcamera-devel] [PATCH v4 0/2] package/libcamera: bump version to 96fab38\n> Date: Tue, 16 Jun 2020 20:59:49 +0200\n> From: Peter Seiderer \n> To: buildroot@busybox.net\n> CC: libcamera-devel@lists.libcamera.org, Yann E . MORIN \n> \n> \n> \n> With the following patch libcamera is forced to believe it is running\n> in a installed environment:\n> \n> diff --git a/src/libcamera/utils.cpp b/src/libcamera/utils.cpp\n> index d55338f..4ff9dac 100644\n> --- a/src/libcamera/utils.cpp\n> +++ b/src/libcamera/utils.cpp\n> @@ -346,15 +346,18 @@ details::StringSplitter split(const std::string &str, const std::string &delim)\n> */\n> bool isLibcameraInstalled()\n> {\n> +#if 0\n> \t/*\n> \t * DT_RUNPATH (DT_RPATH when the linker uses old dtags) is removed on\n> \t * install.\n> \t */\n> \tfor (const ElfW(Dyn) *dyn = _DYNAMIC; dyn->d_tag != DT_NULL; ++dyn) {\n> -\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH)\n> +\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH) {\n> +\t\t\tprintf(\"XXXXX - dyn->d_un.d_ptr: %s\\n\", (char*)dyn->d_un.d_ptr);\n> \t\t\treturn false;\n> +\t\t}\n> \t}\n> -\n> +#endif\n> \treturn true;\n> }\n> \n> Maybe this is because of the buildroot local meson patch ([1]), leading\n> to an empty (but not absent) RPATH?\n\nbuildroot preserves empty RPATH when installing. Maybe we could adapt\nisLibcameraInstalled() to return true only if RPATH is found *and* not\nempty ?\n\nFor openembedded, why is RPATH stripping skipped ?\n\n> \n> \n> [0:02:18.125804232] [252] DEBUG IPAManager ipa_manager.cpp:316 IPA module /usr/lib/libcamera/ipa_rpi.so signature is not valid\n> \n> \n> \n> This can be avoided with the following patch/hack (disable signature check):\n> \n> diff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\n> index 505cf61..3d64898 100644\n> --- a/src/libcamera/ipa_manager.cpp\n> +++ b/src/libcamera/ipa_manager.cpp\n> @@ -301,6 +301,9 @@ std::unique_ptr IPAManager::createIPA(PipelineHandler *pipe,\n> \n> bool IPAManager::isSignatureValid(IPAModule *ipa) const\n> {\n> +#if 1\n> +\treturn true;\n> +#else\n> #if HAVE_IPA_PUBKEY\n> \tFile file{ ipa->path() };\n> \tif (!file.open(File::ReadOnly))\n> @@ -320,6 +323,7 @@ bool IPAManager::isSignatureValid(IPAModule *ipa) const\n> #else\n> \treturn false;\n> #endif\n> +#endif\n> }\n> \n> } /* namespace libcamera */\n> \n> \n> Maybe related to the buildroot finalize and/or sanitizing RPATH in target tree\n> step (and/or strip after install with BR2_ENABLE_DEBUG=y/BR2_STRIP_strip=y\n> enabled)?\n\nFor this, let's first see how module re-signing works with\nopenemebedded, possibly improving the resigning script. If it's\nsuccessful, I think we can then use the same methods for buildroot and\nother distributions. A packaging document to explain all this would be\nuseful.\n\n> -------- End of Forwarded Message --------\n> \n> >>> /me sighs ...\n> >>>\n> >>>> IPA module is signed (with openssl dgst) after it is built. But\n> >>>> during packaging the OE build system 1) splits out debugging info,\n> >>>> and 2) strips the binaries. So the IPA module *.so file installed\n> >>>> isn't the one which the signature was calculated against. Then\n> >>>> the signature check fails, and libcamera tries to run the IPA\n> >>>> module isolated (in a sandbox), which doesn't work if the IPA\n> >>>> module wasn't designed to run isolated. The easiest way to fix that\n> >>>> is to disable splitting out debug information and stripping the binaries\n> >>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >>>> INHIBIT_PACKAGE_STRIP.\n> >>>\n> >>> This sounds like an effective solution for openembedded, but it needs to\n> >>> be fixed in libcamera all the same.\n> >>>\n> >>> I'll try to follow up with the meson guys to see what we can do,.\n> > \n> > We re-sign the IPA modules at install time for this very specific\n> > reason. If openembedded modifies the binaries after installing them,\n> > should it re-run the signing script ?\n> > \n> >>>> Signed-off-by: Andrey Konovalov \n> >>>> ---\n> >>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>>>\n> >>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>> index 00a5c480d..573366f08 100644\n> >>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >>>> \n> >>>> S = \"${WORKDIR}/git\"\n> >>>> \n> >>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >>>> \n> >>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >>>> \n> >>>> inherit meson pkgconfig python3native\n> >>>> \n> >>>> +do_install_append() {\n> >>>> + chrpath -d ${D}${libdir}/libcamera.so\n> >>>\n> >>> Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> >>> the solution will be handling our own strip/install actions to do this\n> >>> explicitly in the build.\n> >>>\n> >>> It will be a pain to have to pull in another external dependency though...\n> >>>\n> >>>> +}\n> >>>> +\n> >>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >>>> \n> >>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n> >>>> +","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 0134CBD86F\n\tfor ;\n\tMon, 27 Jul 2020 16:03:19 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 7569261253;\n\tMon, 27 Jul 2020 18:03:19 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 470C660536\n\tfor ;\n\tMon, 27 Jul 2020 18:03:18 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id B029F556;\n\tMon, 27 Jul 2020 18:03:17 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"kAC9hFg0\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595865797;\n\tbh=/6m+DWhEuZ9TjI89G/XLiXQUkvvBWc7qsbsvJp3j/EY=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=kAC9hFg0ebcd98HuTnlxoqBxKaUxEn6X+QOs78pdWuJd1LPN44LiY/ToHQ+0RFGT/\n\t1Ddre7GOcQQIUVH74KUXbLmdPe7PURyEM7NQkfzor2+Me0r72zM8eY2/snp4Vzj1nX\n\tXlHw6YdGhGDoqRAfCAdDEqGpHLtXehBcGlu5EMZs=","Date":"Mon, 27 Jul 2020 19:03:10 +0300","From":"Laurent Pinchart ","To":"Andrey Konovalov ","Message-ID":"<20200727160310.GE17521@pendragon.ideasonboard.com>","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>\n\t<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>","MIME-Version":"1.0","Content-Disposition":"inline","In-Reply-To":"<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\traj.khem@gmail.com, openembedded-devel@lists.openembedded.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11654,"web_url":"https://patchwork.libcamera.org/comment/11654/","msgid":"<2a89b48b-b4f7-1bf7-1a32-27d22360ee2d@linaro.org>","date":"2020-07-27T16:17:04","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Laurent,\n\nOn 27.07.2020 19:03, Laurent Pinchart wrote:\n> Hi Andrey,\n> \n> On Mon, Jul 27, 2020 at 06:46:47PM +0300, Andrey Konovalov wrote:\n>> On 27.07.2020 14:11, Laurent Pinchart wrote:\n>>> On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n>>>> On 27.07.2020 12:42, Kieran Bingham wrote:\n>>>>> On 27/07/2020 10:21, Andrey Konovalov wrote:\n>>>>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>>>>>> libcamera.so. If it does, it assumes that libcamera binaries are\n>>>>>> run directly from the build directory without installing them, and\n>>>>>> tries to use resorces like IPA modules from the build directory.\n>>>>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n>>>>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n>>>>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n>>>>>> That's why we need to remove this tag manually in do_install_append().\n>>>>>\n>>>>> Uh oh, what's changed... (I'll have to go take a look).\n>>>>>\n>>>>> -\n>>>>> https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n>>>>>\n>>>>> If we're reliant upon meson behaviour which is no longer consistent,\n>>>>> then we are going to have to do something else in libcamera.\n>>>>\n>>>> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n>>>> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n>>>> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n>>>> *might* be dropped - if all the packages would be able to set RUNPATH to\n>>>> what they need, and meson would detect that OK in all those cases.\n>>>\n>>> I think that if the problem is caused by a meson patch in openembedded,\n>>> then it would make sense to fix it there. We can decide to address the\n>>> issue in libcamera itself if it's found to affect other distributions\n>>> too, or if meson's behaviour changes in an incompatible way.\n>>\n>> It looks like it is not openembedded only issue:\n>>\n>> -------- Forwarded Message --------\n>> Subject: [libcamera-devel] [PATCH v4 0/2] package/libcamera: bump version to 96fab38\n>> Date: Tue, 16 Jun 2020 20:59:49 +0200\n>> From: Peter Seiderer \n>> To: buildroot@busybox.net\n>> CC: libcamera-devel@lists.libcamera.org, Yann E . MORIN \n>>\n>> \n>>\n>> With the following patch libcamera is forced to believe it is running\n>> in a installed environment:\n>>\n>> diff --git a/src/libcamera/utils.cpp b/src/libcamera/utils.cpp\n>> index d55338f..4ff9dac 100644\n>> --- a/src/libcamera/utils.cpp\n>> +++ b/src/libcamera/utils.cpp\n>> @@ -346,15 +346,18 @@ details::StringSplitter split(const std::string &str, const std::string &delim)\n>> */\n>> bool isLibcameraInstalled()\n>> {\n>> +#if 0\n>> \t/*\n>> \t * DT_RUNPATH (DT_RPATH when the linker uses old dtags) is removed on\n>> \t * install.\n>> \t */\n>> \tfor (const ElfW(Dyn) *dyn = _DYNAMIC; dyn->d_tag != DT_NULL; ++dyn) {\n>> -\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH)\n>> +\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH) {\n>> +\t\t\tprintf(\"XXXXX - dyn->d_un.d_ptr: %s\\n\", (char*)dyn->d_un.d_ptr);\n>> \t\t\treturn false;\n>> +\t\t}\n>> \t}\n>> -\n>> +#endif\n>> \treturn true;\n>> }\n>>\n>> Maybe this is because of the buildroot local meson patch ([1]), leading\n>> to an empty (but not absent) RPATH?\n> \n> buildroot preserves empty RPATH when installing. Maybe we could adapt\n> isLibcameraInstalled() to return true only if RPATH is found *and* not\n> empty ?\n> \n> For openembedded, why is RPATH stripping skipped ?\n\nNot sure if I can give a proper explanation, so I would better refer you to:\n\nhttps://patches.openembedded.org/patch/156584/\nhttps://github.com/mesonbuild/meson/issues/2567 (rpurdie's comments especially)\n\nMaybe the fix done in meson 0.55 would let distributions to re-enable RPATH stripping:\n https://mesonbuild.com/Release-notes-for-0-55-0.html#added-ability-to-specify-targets-in-meson-compile\n https://github.com/mesonbuild/meson/pull/7103\n https://github.com/mesonbuild/meson/pull/7472\n- but I don't know if/when this could happen. For me it looks like a lot of re-testing\nat least (distros have a whole lot of packages which could be affected).\n\n>> \n>>\n>> [0:02:18.125804232] [252] DEBUG IPAManager ipa_manager.cpp:316 IPA module /usr/lib/libcamera/ipa_rpi.so signature is not valid\n>>\n>> \n>>\n>> This can be avoided with the following patch/hack (disable signature check):\n>>\n>> diff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\n>> index 505cf61..3d64898 100644\n>> --- a/src/libcamera/ipa_manager.cpp\n>> +++ b/src/libcamera/ipa_manager.cpp\n>> @@ -301,6 +301,9 @@ std::unique_ptr IPAManager::createIPA(PipelineHandler *pipe,\n>>\n>> bool IPAManager::isSignatureValid(IPAModule *ipa) const\n>> {\n>> +#if 1\n>> +\treturn true;\n>> +#else\n>> #if HAVE_IPA_PUBKEY\n>> \tFile file{ ipa->path() };\n>> \tif (!file.open(File::ReadOnly))\n>> @@ -320,6 +323,7 @@ bool IPAManager::isSignatureValid(IPAModule *ipa) const\n>> #else\n>> \treturn false;\n>> #endif\n>> +#endif\n>> }\n>>\n>> } /* namespace libcamera */\n>>\n>>\n>> Maybe related to the buildroot finalize and/or sanitizing RPATH in target tree\n>> step (and/or strip after install with BR2_ENABLE_DEBUG=y/BR2_STRIP_strip=y\n>> enabled)?\n> \n> For this, let's first see how module re-signing works with\n> openemebedded, possibly improving the resigning script. If it's\n> successful, I think we can then use the same methods for buildroot and\n> other distributions. A packaging document to explain all this would be\n> useful.\n\nSounds good.\n\nThanks,\nAndrey\n\n>> -------- End of Forwarded Message --------\n>>\n>>>>> /me sighs ...\n>>>>>\n>>>>>> IPA module is signed (with openssl dgst) after it is built. But\n>>>>>> during packaging the OE build system 1) splits out debugging info,\n>>>>>> and 2) strips the binaries. So the IPA module *.so file installed\n>>>>>> isn't the one which the signature was calculated against. Then\n>>>>>> the signature check fails, and libcamera tries to run the IPA\n>>>>>> module isolated (in a sandbox), which doesn't work if the IPA\n>>>>>> module wasn't designed to run isolated. The easiest way to fix that\n>>>>>> is to disable splitting out debug information and stripping the binaries\n>>>>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n>>>>>> INHIBIT_PACKAGE_STRIP.\n>>>>>\n>>>>> This sounds like an effective solution for openembedded, but it needs to\n>>>>> be fixed in libcamera all the same.\n>>>>>\n>>>>> I'll try to follow up with the meson guys to see what we can do,.\n>>>\n>>> We re-sign the IPA modules at install time for this very specific\n>>> reason. If openembedded modifies the binaries after installing them,\n>>> should it re-run the signing script ?\n>>>\n>>>>>> Signed-off-by: Andrey Konovalov \n>>>>>> ---\n>>>>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n>>>>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n>>>>>>\n>>>>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>>>> index 00a5c480d..573366f08 100644\n>>>>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>>>>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n>>>>>> \n>>>>>> S = \"${WORKDIR}/git\"\n>>>>>> \n>>>>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>>>>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>>>>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>>>>> \n>>>>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>>>>> \n>>>>>> inherit meson pkgconfig python3native\n>>>>>> \n>>>>>> +do_install_append() {\n>>>>>> + chrpath -d ${D}${libdir}/libcamera.so\n>>>>>\n>>>>> Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n>>>>> the solution will be handling our own strip/install actions to do this\n>>>>> explicitly in the build.\n>>>>>\n>>>>> It will be a pain to have to pull in another external dependency though...\n>>>>>\n>>>>>> +}\n>>>>>> +\n>>>>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>>>>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>>>>> \n>>>>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n>>>>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n>>>>>> +\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 3BABDBD86F\n\tfor ;\n\tMon, 27 Jul 2020 16:17:10 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id BD85461253;\n\tMon, 27 Jul 2020 18:17:09 +0200 (CEST)","from mail-lf1-x142.google.com (mail-lf1-x142.google.com\n\t[IPv6:2a00:1450:4864:20::142])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8BFC1605B2\n\tfor ;\n\tMon, 27 Jul 2020 18:17:08 +0200 (CEST)","by mail-lf1-x142.google.com with SMTP id h8so9306750lfp.9\n\tfor ;\n\tMon, 27 Jul 2020 09:17:08 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\t20sm2122808ljj.51.2020.07.27.09.17.06\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tMon, 27 Jul 2020 09:17:06 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"h4mTR0TW\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=vyo3ejdeiKuEMNEq5FECv+rrwWgqTap4q5k3dq9jAUo=;\n\tb=h4mTR0TWXTUr4oul7jP9AyNvQ2WKiOdx6kcu8kl+ogmM74lsc7BtoAyk+tSK7uEzpD\n\tp0ULVSx78Xkiv7DopugsdPDzagjj7mDjiPXAhVA/YXQYTYJE6bd3IxLCA1+D8tCKzTXo\n\tc1RJ371uQjLAgz8EdVOtTbdE4e2jiV4K3lxIUcBIoCJy1a7zPgf9AxMufKuT4ZbEY1Y4\n\tF9pb+QMXCUMfe5QjPZuW/CxFBgo+75Z3CrxSbKDmgAoMlq3vNZNf0MS+tcP3fIZDGqqK\n\tIyMuQYTNzFo4O0ZEPSqnGN+6FFDbypuOAzVkrAtSfwBBKo7FtBGWmf1dVtvHbnatPRS4\n\tJUjw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=vyo3ejdeiKuEMNEq5FECv+rrwWgqTap4q5k3dq9jAUo=;\n\tb=QmM5KFoEQZUZOaDedx89GhjypJ3HzEPvcl+Y7OLZmtW+FMR2Q9XO1qkq8KzWErHNp8\n\t3OGiSom5j9cLVmsZyszSiMrQp+/aR0NM/fkOTVEI8iyh3ji7s79hIllbgNyhuegQ07RK\n\tFT+2579o8zXD1dm5lMEzqQoGrxPGihDrJObjhfXJsL0NoDizEGvAFDZnPfdDYff3HkoM\n\t33rw1LPRqJy/V2eVOWTy/HlGd2Vt1HKt5nbkBDO3o5KzPHc8OFlh+15pr1AW5/6ytL4l\n\tK+cPKqmzGvl/krfCkYmROPrpwUq4NqgvAA39txwd7AwBFvkTwRn6M6094ts55X5f7N3N\n\t/Oqw==","X-Gm-Message-State":"AOAM530UJYtGgPu+vUyxingnU1bWjvZWWxgnRmyDlETVAqGvTr0dDA5A\n\t+msqsRHri9hqIJUYVH1tXkXzSA==","X-Google-Smtp-Source":"ABdhPJyXvqWht1wNX14tDreAQHutxEaIjyy7DB9UytcTkD8CbWTPo9UYz4nqcGYQFieXkIyREmZ7Ng==","X-Received":"by 2002:a19:c752:: with SMTP id\n\tx79mr11705230lff.197.1595866627760; \n\tMon, 27 Jul 2020 09:17:07 -0700 (PDT)","To":"Laurent Pinchart ","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>\n\t<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>\n\t<20200727160310.GE17521@pendragon.ideasonboard.com>","From":"Andrey Konovalov ","Message-ID":"<2a89b48b-b4f7-1bf7-1a32-27d22360ee2d@linaro.org>","Date":"Mon, 27 Jul 2020 19:17:04 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"<20200727160310.GE17521@pendragon.ideasonboard.com>","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\traj.khem@gmail.com, openembedded-devel@lists.openembedded.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":11660,"web_url":"https://patchwork.libcamera.org/comment/11660/","msgid":"<20200728004024.GH15448@pendragon.ideasonboard.com>","date":"2020-07-28T00:40:24","subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Andrey,\n\nOn Mon, Jul 27, 2020 at 07:17:04PM +0300, Andrey Konovalov wrote:\n> On 27.07.2020 19:03, Laurent Pinchart wrote:\n> > On Mon, Jul 27, 2020 at 06:46:47PM +0300, Andrey Konovalov wrote:\n> >> On 27.07.2020 14:11, Laurent Pinchart wrote:\n> >>> On Mon, Jul 27, 2020 at 12:58:23PM +0300, Andrey Konovalov wrote:\n> >>>> On 27.07.2020 12:42, Kieran Bingham wrote:\n> >>>>> On 27/07/2020 10:21, Andrey Konovalov wrote:\n> >>>>>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> >>>>>> libcamera.so. If it does, it assumes that libcamera binaries are\n> >>>>>> run directly from the build directory without installing them, and\n> >>>>>> tries to use resorces like IPA modules from the build directory.\n> >>>>>> Mainline meson strips RPATH/RUNPATH out at install time (for\n> >>>>>> meson versions up to 0.54; the things are somewhat changed in 0.55).\n> >>>>>> But openembedded-core patches meson to disable RPATH/RUNPATH removal.\n> >>>>>> That's why we need to remove this tag manually in do_install_append().\n> >>>>>\n> >>>>> Uh oh, what's changed... (I'll have to go take a look).\n> >>>>>\n> >>>>> -\n> >>>>> https://mesonbuild.com/Release-notes-for-0-55-0.html#rpath-removal-now-more-careful\n> >>>>>\n> >>>>> If we're reliant upon meson behaviour which is no longer consistent,\n> >>>>> then we are going to have to do something else in libcamera.\n> >>>>\n> >>>> I haven't tried meson 0.55 yet, but my impression was that 0.55 should work\n> >>>> just as before for \"usual\" (as per libcamera's README) libcamera build. And\n> >>>> starting from 0.55 the patch in openembedded-core to disable RPATH/RUNPATH removal\n> >>>> *might* be dropped - if all the packages would be able to set RUNPATH to\n> >>>> what they need, and meson would detect that OK in all those cases.\n> >>>\n> >>> I think that if the problem is caused by a meson patch in openembedded,\n> >>> then it would make sense to fix it there. We can decide to address the\n> >>> issue in libcamera itself if it's found to affect other distributions\n> >>> too, or if meson's behaviour changes in an incompatible way.\n> >>\n> >> It looks like it is not openembedded only issue:\n> >>\n> >> -------- Forwarded Message --------\n> >> Subject: [libcamera-devel] [PATCH v4 0/2] package/libcamera: bump version to 96fab38\n> >> Date: Tue, 16 Jun 2020 20:59:49 +0200\n> >> From: Peter Seiderer \n> >> To: buildroot@busybox.net\n> >> CC: libcamera-devel@lists.libcamera.org, Yann E . MORIN \n> >>\n> >> \n> >>\n> >> With the following patch libcamera is forced to believe it is running\n> >> in a installed environment:\n> >>\n> >> diff --git a/src/libcamera/utils.cpp b/src/libcamera/utils.cpp\n> >> index d55338f..4ff9dac 100644\n> >> --- a/src/libcamera/utils.cpp\n> >> +++ b/src/libcamera/utils.cpp\n> >> @@ -346,15 +346,18 @@ details::StringSplitter split(const std::string &str, const std::string &delim)\n> >> */\n> >> bool isLibcameraInstalled()\n> >> {\n> >> +#if 0\n> >> \t/*\n> >> \t * DT_RUNPATH (DT_RPATH when the linker uses old dtags) is removed on\n> >> \t * install.\n> >> \t */\n> >> \tfor (const ElfW(Dyn) *dyn = _DYNAMIC; dyn->d_tag != DT_NULL; ++dyn) {\n> >> -\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH)\n> >> +\t\tif (dyn->d_tag == DT_RUNPATH || dyn->d_tag == DT_RPATH) {\n> >> +\t\t\tprintf(\"XXXXX - dyn->d_un.d_ptr: %s\\n\", (char*)dyn->d_un.d_ptr);\n> >> \t\t\treturn false;\n> >> +\t\t}\n> >> \t}\n> >> -\n> >> +#endif\n> >> \treturn true;\n> >> }\n> >>\n> >> Maybe this is because of the buildroot local meson patch ([1]), leading\n> >> to an empty (but not absent) RPATH?\n> > \n> > buildroot preserves empty RPATH when installing. Maybe we could adapt\n> > isLibcameraInstalled() to return true only if RPATH is found *and* not\n> > empty ?\n> > \n> > For openembedded, why is RPATH stripping skipped ?\n> \n> Not sure if I can give a proper explanation, so I would better refer you to:\n> \n> https://patches.openembedded.org/patch/156584/\n> https://github.com/mesonbuild/meson/issues/2567 (rpurdie's comments especially)\n\nThank you for the pointers, it's pretty interesting.\n\n> Maybe the fix done in meson 0.55 would let distributions to re-enable RPATH stripping:\n> https://mesonbuild.com/Release-notes-for-0-55-0.html#added-ability-to-specify-targets-in-meson-compile\n> https://github.com/mesonbuild/meson/pull/7103\n> https://github.com/mesonbuild/meson/pull/7472\n> - but I don't know if/when this could happen. For me it looks like a lot of re-testing\n> at least (distros have a whole lot of packages which could be affected).\n\nYes, it will likely take time, even if I think it's the right solution.\nIn the meantime, I think we'll have to handle this in the OE and\nbuildroot recipes, I don't really see what else we could do. It may be\npossible to improve the implementation in libcamera by checking the\nR(UN)PATH value (it's tricky though, glibc and musl handle this quite\ndifferently, where glibc patches the _DYNAMIC entries with pointers to\nthe string table in memory, while musl doesn't AFAIR), but it would only\nhelp if we can get the build system to strip the custom R(UN)PATH entry\nthat we add. If nothing is stripped, I think we're stuck.\n\n> >> \n> >>\n> >> [0:02:18.125804232] [252] DEBUG IPAManager ipa_manager.cpp:316 IPA module /usr/lib/libcamera/ipa_rpi.so signature is not valid\n> >>\n> >> \n> >>\n> >> This can be avoided with the following patch/hack (disable signature check):\n> >>\n> >> diff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\n> >> index 505cf61..3d64898 100644\n> >> --- a/src/libcamera/ipa_manager.cpp\n> >> +++ b/src/libcamera/ipa_manager.cpp\n> >> @@ -301,6 +301,9 @@ std::unique_ptr IPAManager::createIPA(PipelineHandler *pipe,\n> >>\n> >> bool IPAManager::isSignatureValid(IPAModule *ipa) const\n> >> {\n> >> +#if 1\n> >> +\treturn true;\n> >> +#else\n> >> #if HAVE_IPA_PUBKEY\n> >> \tFile file{ ipa->path() };\n> >> \tif (!file.open(File::ReadOnly))\n> >> @@ -320,6 +323,7 @@ bool IPAManager::isSignatureValid(IPAModule *ipa) const\n> >> #else\n> >> \treturn false;\n> >> #endif\n> >> +#endif\n> >> }\n> >>\n> >> } /* namespace libcamera */\n> >>\n> >>\n> >> Maybe related to the buildroot finalize and/or sanitizing RPATH in target tree\n> >> step (and/or strip after install with BR2_ENABLE_DEBUG=y/BR2_STRIP_strip=y\n> >> enabled)?\n> > \n> > For this, let's first see how module re-signing works with\n> > openemebedded, possibly improving the resigning script. If it's\n> > successful, I think we can then use the same methods for buildroot and\n> > other distributions. A packaging document to explain all this would be\n> > useful.\n> \n> Sounds good.\n> \n> >> -------- End of Forwarded Message --------\n> >>\n> >>>>> /me sighs ...\n> >>>>>\n> >>>>>> IPA module is signed (with openssl dgst) after it is built. But\n> >>>>>> during packaging the OE build system 1) splits out debugging info,\n> >>>>>> and 2) strips the binaries. So the IPA module *.so file installed\n> >>>>>> isn't the one which the signature was calculated against. Then\n> >>>>>> the signature check fails, and libcamera tries to run the IPA\n> >>>>>> module isolated (in a sandbox), which doesn't work if the IPA\n> >>>>>> module wasn't designed to run isolated. The easiest way to fix that\n> >>>>>> is to disable splitting out debug information and stripping the binaries\n> >>>>>> during packaging with INHIBIT_PACKAGE_DEBUG_SPLIT and\n> >>>>>> INHIBIT_PACKAGE_STRIP.\n> >>>>>\n> >>>>> This sounds like an effective solution for openembedded, but it needs to\n> >>>>> be fixed in libcamera all the same.\n> >>>>>\n> >>>>> I'll try to follow up with the meson guys to see what we can do,.\n> >>>\n> >>> We re-sign the IPA modules at install time for this very specific\n> >>> reason. If openembedded modifies the binaries after installing them,\n> >>> should it re-run the signing script ?\n> >>>\n> >>>>>> Signed-off-by: Andrey Konovalov \n> >>>>>> ---\n> >>>>>> .../recipes-multimedia/libcamera/libcamera.bb | 9 ++++++++-\n> >>>>>> 1 file changed, 8 insertions(+), 1 deletion(-)\n> >>>>>>\n> >>>>>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>>>> index 00a5c480d..573366f08 100644\n> >>>>>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>>>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> >>>>>> @@ -18,13 +18,20 @@ PV = \"202006+git${SRCPV}\"\n> >>>>>> \n> >>>>>> S = \"${WORKDIR}/git\"\n> >>>>>> \n> >>>>>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> >>>>>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> >>>>>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n> >>>>>> \n> >>>>>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n> >>>>>> \n> >>>>>> inherit meson pkgconfig python3native\n> >>>>>> \n> >>>>>> +do_install_append() {\n> >>>>>> + chrpath -d ${D}${libdir}/libcamera.so\n> >>>>>\n> >>>>> Aha, I didn't know about chrpath, that looks helpful. Perhaps part of\n> >>>>> the solution will be handling our own strip/install actions to do this\n> >>>>> explicitly in the build.\n> >>>>>\n> >>>>> It will be a pain to have to pull in another external dependency though...\n> >>>>>\n> >>>>>> +}\n> >>>>>> +\n> >>>>>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> >>>>>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n> >>>>>> \n> >>>>>> +INHIBIT_PACKAGE_DEBUG_SPLIT = \"1\"\n> >>>>>> +INHIBIT_PACKAGE_STRIP = \"1\"\n> >>>>>> +","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 753DABD878\n\tfor ;\n\tTue, 28 Jul 2020 00:40:34 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id DCF2060939;\n\tTue, 28 Jul 2020 02:40:33 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 1E5BB6039F\n\tfor ;\n\tTue, 28 Jul 2020 02:40:33 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 6C6CC556;\n\tTue, 28 Jul 2020 02:40:32 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"Y3yt6Tb+\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1595896832;\n\tbh=Hg6Zj+A4aQtYJO7gCJ3Bew5KDSG1Slvs/LxpNvCd+Ns=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=Y3yt6Tb+UKCsfkYaeBngtbDomh6MqCk61TnHL3VxTolJLdgwFCeOFvxejt9vQIMu5\n\tu3V7dqrcWlfnd+uFEgsvSjsTV1ygz6OuhwZ6Jk4pPJbkhRf0OE8eJveI523lZp1MMT\n\t0m2rhwR2b7Xs0kzykb7pqEi/yEezbBj8ae421TtQ=","Date":"Tue, 28 Jul 2020 03:40:24 +0300","From":"Laurent Pinchart ","To":"Andrey Konovalov ","Message-ID":"<20200728004024.GH15448@pendragon.ideasonboard.com>","References":"<20200727092108.6209-1-andrey.konovalov@linaro.org>\n\t\n\t<4ba4b745-06b5-c5a9-b046-0357aac9f9bd@linaro.org>\n\t<20200727111107.GD5925@pendragon.ideasonboard.com>\n\t<886753d5-5f11-c240-272f-5a25c096823b@linaro.org>\n\t<20200727160310.GE17521@pendragon.ideasonboard.com>\n\t<2a89b48b-b4f7-1bf7-1a32-27d22360ee2d@linaro.org>","MIME-Version":"1.0","Content-Disposition":"inline","In-Reply-To":"<2a89b48b-b4f7-1bf7-1a32-27d22360ee2d@linaro.org>","Subject":"Re: [libcamera-devel] [oe] [meta-multimedia][PATCH] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"madhavan.krishnan@linaro.org, libcamera-devel@lists.libcamera.org,\n\traj.khem@gmail.com, openembedded-devel@lists.openembedded.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}}]