[{"id":11804,"web_url":"https://patchwork.libcamera.org/comment/11804/","msgid":"","date":"2020-08-03T17:48:54","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH v3] libcamera: fix\n\tpackaging and installation","submitter":{"id":62,"url":"https://patchwork.libcamera.org/api/people/62/","name":"Khem Raj","email":"raj.khem@gmail.com"},"content":"fails with https://errors.yoctoproject.org/Errors/Details/427980/\n\nOn Sun, Aug 2, 2020 at 12:07 PM Andrey Konovalov\n wrote:\n>\n> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n> libcamera.so. If it does, it assumes that libcamera binaries are\n> run directly from the build directory without installing them, and\n> tries to use resorces like IPA modules from the build directory.\n> Mainline meson strips RPATH/RUNPATH out from libcamera.so file\n> at install time. But openembedded-core patches meson to disable\n> RPATH/RUNPATH removal. That's why we need to remove this tag manually\n> in do_install_append().\n>\n> IPA module is signed (with openssl dgst) after it is built. But\n> during packaging the OE build system 1) splits out debugging info,\n> and 2) strips the binaries. So the IPA module so file installed\n> isn't the one which the signature was calculated against. Then\n> the signature check fails, and libcamera tries to run the IPA\n> module isolated (in a sandbox), which doesn't work if the IPA\n> module wasn't designed to run isolated. The solution is to\n> recalculate the IPA modules signatures in ${PKGD} after do_package().\n>\n> Signed-off-by: Andrey Konovalov \n> Reviewed-by: Laurent Pinchart \n> ---\n> Changes in v3:\n> - As suggested by Laurent Pinchart, use ipa-sign-install.sh script\n> to recalculate the signatures instead of ipa-sign.sh.\n>\n> Changes in v2:\n> - Recalculate the IPA modules signatures after do_package()\n> instead of disabling stripping and splitting libcamera package\n>\n> .../recipes-multimedia/libcamera/libcamera.bb | 19 ++++++++++++++++++-\n> 1 file changed, 18 insertions(+), 1 deletion(-)\n>\n> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> index 00a5c480d..b34d673bd 100644\n> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n> @@ -18,13 +18,30 @@ PV = \"202006+git${SRCPV}\"\n>\n> S = \"${WORKDIR}/git\"\n>\n> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>\n> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>\n> inherit meson pkgconfig python3native\n>\n> +do_install_append() {\n> + chrpath -d ${D}${libdir}/libcamera.so\n> +}\n> +\n> +addtask do_recalculate_ipa_signatures_package after do_package before do_packagedata\n> +do_recalculate_ipa_signatures_package() {\n> + local modules\n> + for module in $(find \"${PKGD}/usr/lib/libcamera\" -name \"*.so.sign\"); do\n> + module=\"${module%.sign}\"\n> + if [ -f \"${module}\" ] ; then\n> + modules=\"${modules} ${module}\"\n> + fi\n> + done\n> +\n> + \"${S}/src/ipa/ipa-sign-install.sh\" \"${B}/src/ipa-priv-key.pem\" \"${modules}\"\n> +}\n> +\n> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>\n> --\n> 2.17.1\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 9E24EBD86F\n\tfor ;\n\tMon, 3 Aug 2020 17:49:23 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 2687C60745;\n\tMon, 3 Aug 2020 19:49:23 +0200 (CEST)","from mail-qk1-x742.google.com (mail-qk1-x742.google.com\n\t[IPv6:2607:f8b0:4864:20::742])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 85675605A9\n\tfor ;\n\tMon, 3 Aug 2020 19:49:21 +0200 (CEST)","by mail-qk1-x742.google.com with SMTP id q128so3576130qkd.2\n\tfor ;\n\tMon, 03 Aug 2020 10:49:21 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"YlOSkzCl\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=Y8Ja86GMir7ltL6W5gmY1BGylfkj7N+HuAhTwGfDQQQ=;\n\tb=YlOSkzCliAT31GzHwKE+V4U60Krjz2zDhgmsE2qmao3PJi02KbyAbx4gh+EjF0gIp6\n\tS/aLLXCX1gXtm7nDxUjqQ3/daV9GSBmc7ytUoc/n44v6jeGoBToZ2c0u0eaNL32SRf9I\n\tnSIFLqqrJivsA4zV86DVHG5sxISu4ogR4PysjpE9Qlp5fpqtEG0njRUvLXFuDREH697n\n\tLmGN2xIOEJlDCrSOiUPli2yZx+XUbpr5rX5jHNtmgGvI94ml9sDE7sZ1NzApXVjiC3a1\n\tHaxsb0IgdQuEI27CI5SOfu89hLle3+ylIV0G1eH1+wsZCLNuhihgSGRXLOhFEDSPBccm\n\t3EBg==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=Y8Ja86GMir7ltL6W5gmY1BGylfkj7N+HuAhTwGfDQQQ=;\n\tb=AYP+C/UgFS1GYVwWIbDiXxmP13OyBWyg0/y+GUnIPARelxzF/oUQpW5t+mdZBxV0U8\n\tN83L22P2VtZzVkzQF7/kvrIrLupjWijqPqciXuCS1OAdVLrxUyPh+pkvv3bRtCC/xSE3\n\tLsuZi/5h1elUbee/1dap38obAs5qkvsIAkCtynBcu8W4dAKk3b1+nybQP1Y4X89mBEq7\n\t1uUMgRvDIQ0ZEqXRMDGMDgZO+k2oiaSwmfHyLuddci/Jnnw8BJz9Q2yQekksfpNNDajQ\n\tnNzdnpHefRqED7gt2CGDRQYYlSaHajSHPHh0L3ZBp1jagNUgVMc+ScZWjOxiCpu1t6lB\n\tB0xQ==","X-Gm-Message-State":"AOAM533S1K0S2gIy0iDlErV7QZ4ZUybmA93HX95DsOtS946EVOuVjtVa\n\tBHhnXNdeNTmRLgXeDbIyXbSo7o6mz+fFm2XBkoQ=","X-Google-Smtp-Source":"ABdhPJww1n8KNVH2gBpNDR0e2Pa+k8bCtfXa3eK6gKBpqqVlR/S76cex3f4zNYogMM5ewlKUzhxfJm7iDhfzcQuNTqA=","X-Received":"by 2002:a05:620a:565:: with SMTP id\n\tp5mr18034450qkp.215.1596476960176; \n\tMon, 03 Aug 2020 10:49:20 -0700 (PDT)","MIME-Version":"1.0","References":"<20200802190719.9358-1-andrey.konovalov@linaro.org>","In-Reply-To":"<20200802190719.9358-1-andrey.konovalov@linaro.org>","From":"Khem Raj ","Date":"Mon, 3 Aug 2020 10:48:54 -0700","Message-ID":"","To":"Andrey Konovalov ","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH v3] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":12005,"web_url":"https://patchwork.libcamera.org/comment/12005/","msgid":"","date":"2020-08-13T20:32:53","subject":"Re: [libcamera-devel] [meta-multimedia][PATCH v3] libcamera: fix\n\tpackaging and installation","submitter":{"id":25,"url":"https://patchwork.libcamera.org/api/people/25/","name":"Andrey Konovalov","email":"andrey.konovalov@linaro.org"},"content":"Hi Khem,\n\nI wasn't able to reproduce this error on my system even with the same\nmachine/distro/target system combination as from the error report.\n\nAnyway, it looks like the error is due to bitbake failing to expand\nsome variables under quotation marks, so I am posting v4 which tries\nto address that. (Both v3 and v4 patches work OK at my desk.)\n\nThanks,\nAndrey\n\nOn 03.08.2020 20:48, Khem Raj wrote:\n> fails with https://errors.yoctoproject.org/Errors/Details/427980/\n> \n> On Sun, Aug 2, 2020 at 12:07 PM Andrey Konovalov\n> wrote:\n>>\n>> libcamera checks if RPATH or RUNPATH dynamic tag is present in\n>> libcamera.so. If it does, it assumes that libcamera binaries are\n>> run directly from the build directory without installing them, and\n>> tries to use resorces like IPA modules from the build directory.\n>> Mainline meson strips RPATH/RUNPATH out from libcamera.so file\n>> at install time. But openembedded-core patches meson to disable\n>> RPATH/RUNPATH removal. That's why we need to remove this tag manually\n>> in do_install_append().\n>>\n>> IPA module is signed (with openssl dgst) after it is built. But\n>> during packaging the OE build system 1) splits out debugging info,\n>> and 2) strips the binaries. So the IPA module so file installed\n>> isn't the one which the signature was calculated against. Then\n>> the signature check fails, and libcamera tries to run the IPA\n>> module isolated (in a sandbox), which doesn't work if the IPA\n>> module wasn't designed to run isolated. The solution is to\n>> recalculate the IPA modules signatures in ${PKGD} after do_package().\n>>\n>> Signed-off-by: Andrey Konovalov \n>> Reviewed-by: Laurent Pinchart \n>> ---\n>> Changes in v3:\n>> - As suggested by Laurent Pinchart, use ipa-sign-install.sh script\n>> to recalculate the signatures instead of ipa-sign.sh.\n>>\n>> Changes in v2:\n>> - Recalculate the IPA modules signatures after do_package()\n>> instead of disabling stripping and splitting libcamera package\n>>\n>> .../recipes-multimedia/libcamera/libcamera.bb | 19 ++++++++++++++++++-\n>> 1 file changed, 18 insertions(+), 1 deletion(-)\n>>\n>> diff --git a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> index 00a5c480d..b34d673bd 100644\n>> --- a/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> +++ b/meta-multimedia/recipes-multimedia/libcamera/libcamera.bb\n>> @@ -18,13 +18,30 @@ PV = \"202006+git${SRCPV}\"\n>>\n>> S = \"${WORKDIR}/git\"\n>>\n>> -DEPENDS = \"python3-pyyaml-native udev gnutls boost\"\n>> +DEPENDS = \"python3-pyyaml-native udev gnutls boost chrpath-native\"\n>> DEPENDS += \"${@bb.utils.contains('DISTRO_FEATURES', 'qt', 'qtbase qtbase-native', '', d)}\"\n>>\n>> RDEPENDS_${PN} = \"${@bb.utils.contains('DISTRO_FEATURES', 'wayland qt', 'qtwayland', '', d)}\"\n>>\n>> inherit meson pkgconfig python3native\n>>\n>> +do_install_append() {\n>> + chrpath -d ${D}${libdir}/libcamera.so\n>> +}\n>> +\n>> +addtask do_recalculate_ipa_signatures_package after do_package before do_packagedata\n>> +do_recalculate_ipa_signatures_package() {\n>> + local modules\n>> + for module in $(find \"${PKGD}/usr/lib/libcamera\" -name \"*.so.sign\"); do\n>> + module=\"${module%.sign}\"\n>> + if [ -f \"${module}\" ] ; then\n>> + modules=\"${modules} ${module}\"\n>> + fi\n>> + done\n>> +\n>> + \"${S}/src/ipa/ipa-sign-install.sh\" \"${B}/src/ipa-priv-key.pem\" \"${modules}\"\n>> +}\n>> +\n>> FILES_${PN}-dev = \"${includedir} ${libdir}/pkgconfig\"\n>> FILES_${PN} += \" ${libdir}/libcamera.so\"\n>>\n>> --\n>> 2.17.1\n>>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 558F9BD87C\n\tfor ;\n\tThu, 13 Aug 2020 20:33:00 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id A616D613D6;\n\tThu, 13 Aug 2020 22:32:59 +0200 (CEST)","from mail-lj1-x244.google.com (mail-lj1-x244.google.com\n\t[IPv6:2a00:1450:4864:20::244])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 463FA6055A\n\tfor ;\n\tThu, 13 Aug 2020 22:32:58 +0200 (CEST)","by mail-lj1-x244.google.com with SMTP id v4so7676652ljd.0\n\tfor ;\n\tThu, 13 Aug 2020 13:32:58 -0700 (PDT)","from [192.168.118.216] (37-144-159-139.broadband.corbina.ru.\n\t[37.144.159.139]) by smtp.gmail.com with ESMTPSA id\n\t185sm1305092ljf.82.2020.08.13.13.32.56\n\t(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n\tThu, 13 Aug 2020 13:32:56 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=linaro.org header.i=@linaro.org\n\theader.b=\"xgE8IErm\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;\n\th=subject:to:cc:references:from:message-id:date:user-agent\n\t:mime-version:in-reply-to:content-language:content-transfer-encoding; \n\tbh=QQYnbkvfNETwNWWTbk3cWtQIVI7w82Ut5gs9o9YG6WQ=;\n\tb=xgE8IErmY+gYqN7fR2eHbwfjC0ZItwo9Smq15+4YUZtUM8hTDm/1EKiIJPlqCBrS3w\n\tKXJk9XX6jscYGebsz31O6qWa7EQz6xwqcVfPj3dmNNN95Wd9B0riRBlV8p1yYLKW/bV1\n\t4Pxcszg/VQ0uinEwVjyKIHowze50NkK4UDJAnCTl8yB2OhDHDhFyuUH2/QKEqwpri8D4\n\tCnzFLIOXedrE+zGrLgVh8OAZnPcE9ig/EY9do698AI1xu07F9nvmRAQEYQBQLyIJEugi\n\tflNbnjxWEQTF+dwIRnWCMHt0/jA0t7dfJxyjGADGPzsjE7TvBSyQAXm0lZzorZ01F18s\n\t7YSw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:cc:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=QQYnbkvfNETwNWWTbk3cWtQIVI7w82Ut5gs9o9YG6WQ=;\n\tb=dWTQNufMH1cnijLXJliD7rgO8ZfjNkOeethJakLh58blufZBRl54blwN1KONgSF3WT\n\tdPNiQqJmiCilKj1+182oTBCqDJeGr9B20MW/VqaHggrI5MYR/AYIdGvxVKHedbxkPHkJ\n\tKPH7VqTCutkzdvmTBpYiB0yw7KOqcJtHTXuEui5mQ/CNNYwB9qvYnLvqtiisctFHGK/s\n\tLX/0DvFCXWF9OsO9Smev4ipHfCrVaP/HISYNAUbzorWkiD5T1jJP3FvZBRW7z7IoNcV1\n\t3Ea2q8xlYsygu6HqDyi7x5qpU0dCAunz0KhS7qYWq3dvEJICby0zK7hT57qFKA7DSBNa\n\t/igA==","X-Gm-Message-State":"AOAM533e5VP5lKrT7/y4gCioscOGyriwKnhuZMt1wzBd5cmJPXDZ28N2\n\tFnGL0+duuNf5JLaWV5kbb3yxGA==","X-Google-Smtp-Source":"ABdhPJzE4m2HowuQlSgOA2MznEtOhii/bedba1hxeUAgo5Oi+QvVO8G+8ixSW9GgS88lI1EkdMMxJg==","X-Received":"by 2002:a2e:a49a:: with SMTP id\n\th26mr2643410lji.168.1597350777562; \n\tThu, 13 Aug 2020 13:32:57 -0700 (PDT)","To":"Khem Raj ","References":"<20200802190719.9358-1-andrey.konovalov@linaro.org>\n\t","From":"Andrey Konovalov ","Message-ID":"","Date":"Thu, 13 Aug 2020 23:32:53 +0300","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101\n\tThunderbird/68.10.0","MIME-Version":"1.0","In-Reply-To":"","Content-Language":"en-US","Subject":"Re: [libcamera-devel] [meta-multimedia][PATCH v3] libcamera: fix\n\tpackaging and installation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"libcamera-devel@lists.libcamera.org,\n\topenembeded-devel ,\n\tmadhavan.krishnan@linaro.org","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}}]