From 4e1b1a09dd2c78e92dbbbf9eb90bad68f99c8bd3 Mon Sep 17 00:00:00 2001 From: Test User Date: Mon, 17 Nov 2025 14:05:29 -0800 Subject: [PATCH] Refactor bbappends to be more yocto like --- classes/wolfssl-helper.bbclass | 55 +++++++++++++++++++ .../openssl_%.bbappend | 34 +++++++++--- .../wolfssl_%.bbappend | 34 +++++++++--- recipes-wolfssl/wolfprovider/README.md | 15 +++-- .../wolfprovider/openssl_3.%.bbappend | 28 ++++++++-- .../wolfprovider/wolfssl-fips_%.bbappend | 17 ------ .../wolfprovider/wolfssl_%.bbappend | 25 +++++++-- 7 files changed, 160 insertions(+), 48 deletions(-) delete mode 100644 recipes-wolfssl/wolfprovider/wolfssl-fips_%.bbappend diff --git a/classes/wolfssl-helper.bbclass b/classes/wolfssl-helper.bbclass index aca77da..29bb15e 100644 --- a/classes/wolfssl-helper.bbclass +++ b/classes/wolfssl-helper.bbclass @@ -26,6 +26,61 @@ def wolfssl_conditional_require(d, package_name, inc_path): bb.parse.mark_dependency(d, inc_file) bb.parse.handle(inc_file, d, True) + +def wolfssl_conditional_require_mode(d, package_name, mode, inc_file): + """ + Conditionally include an .inc file based on a mode variable and WOLFSSL_FEATURES. + + Args: + d: BitBake datastore + package_name: Name of the package to check for (e.g., 'wolfprovider') + mode: The expected mode (e.g., 'standalone' or 'replace-default') + inc_file: Relative path from layer root to the .inc file + + Returns: + True if configuration was included, False otherwise + + Example: + wolfssl_conditional_require_mode( + d, + package_name='wolfprovider', + mode='standalone', + inc_file='inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc' + ) + """ + import os + import bb.parse + + # Check if package is enabled + if not (bb.utils.contains('WOLFSSL_FEATURES', package_name, True, False, d) or \ + bb.utils.contains('IMAGE_INSTALL', package_name, True, False, d)): + bb.debug(2, f"{package_name} not in WOLFSSL_FEATURES or IMAGE_INSTALL - skipping") + return False + + # Build the mode variable name from package name (e.g., 'wolfprovider' -> 'WOLFPROVIDER_MODE') + mode_var_name = f"{package_name.upper()}_MODE" + current_mode = d.getVar(mode_var_name) or 'standalone' # Default to standalone + + # Check if current mode matches expected mode + if current_mode != mode: + bb.debug(2, f"{mode_var_name}='{current_mode}' does not match '{mode}' - skipping") + return False + + # Mode matches - include the configuration + bb.note(f"{package_name}: {mode_var_name}='{current_mode}' - including {inc_file}") + + layerdir = d.getVar('WOLFSSL_LAYERDIR') + if not layerdir: + bb.fatal("WOLFSSL_LAYERDIR not set - ensure meta-wolfssl layer is properly configured") + + full_inc_file = os.path.join(layerdir, inc_file) + bb.parse.mark_dependency(d, full_inc_file) + try: + bb.parse.handle(full_inc_file, d, True) + return True + except Exception as e: + bb.fatal(f"Failed to include {full_inc_file}: {e}") + python do_wolfssl_check_package() { """ Task to check if package is enabled via IMAGE_INSTALL or WOLFSSL_FEATURES diff --git a/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend b/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend index ee83200..911ce09 100644 --- a/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend +++ b/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend @@ -1,10 +1,30 @@ -# Manual configuration for wolfprovider-image-minimal -# Configure OpenSSL for wolfProvider support +# Configure OpenSSL support for wolfProvider +# +# This bbappend automatically configures OpenSSL based on: +# 1. 'wolfprovider' in WOLFSSL_FEATURES +# 2. WOLFPROVIDER_MODE setting (standalone or replace-default) +# +# Usage in local.conf: +# WOLFSSL_FEATURES = "wolfprovider" +# WOLFPROVIDER_MODE = "standalone" # or "replace-default" -# WARNING: need to specify replace default or standalone mode not both -# Uncomment this to use wolfProvider in standalone mode -require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc -# Uncomment this to use wolfProvider in replace-default mode -# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc +inherit wolfssl-helper + +python __anonymous() { + # Standalone mode + wolfssl_conditional_require_mode( + d, + package_name='wolfprovider', + mode='standalone', + inc_file='inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc' + ) + # Replace-default mode + wolfssl_conditional_require_mode( + d, + package_name='wolfprovider', + mode='replace-default', + inc_file='inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc' + ) +} diff --git a/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend b/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend index fdeef86..69aa802 100644 --- a/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend +++ b/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend @@ -1,10 +1,30 @@ -# Manual configuration for wolfprovider-image-minimal -# Enable wolfProvider support in wolfSSL +# Configure wolfSSL for wolfProvider support in image +# +# This bbappend automatically configures wolfSSL based on: +# 1. 'wolfprovider' in WOLFSSL_FEATURES +# 2. PREFERRED_PROVIDER_virtual/wolfssl setting +# +# Usage in local.conf: +# WOLFSSL_FEATURES = "wolfprovider" +# PREFERRED_PROVIDER_virtual/wolfssl = "wolfssl" # or "wolfssl-fips" -# WARNING: need to specify non-FIPS or FIPS mode not both -# Uncomment this to use wolfProvider non-FIPS -require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider.inc -# Uncomment this to use wolfProvider FIPS -# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc +inherit wolfssl-osp-support + +python __anonymous() { + # non-FIPS mode + wolfssl_osp_conditional_include( + d, + feature_name='wolfprovider', + inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider.inc', + allowed_providers=['wolfssl'] + ) + # FIPS mode + wolfssl_osp_conditional_include( + d, + feature_name='wolfprovider', + inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc', + allowed_providers=['wolfssl-fips'] + ) +} diff --git a/recipes-wolfssl/wolfprovider/README.md b/recipes-wolfssl/wolfprovider/README.md index 1a91a00..659acad 100644 --- a/recipes-wolfssl/wolfprovider/README.md +++ b/recipes-wolfssl/wolfprovider/README.md @@ -121,13 +121,12 @@ Enable the wolfprovider demo image in your `local.conf` file: WOLFSSL_DEMOS = "wolfprovider-image-minimal" ``` -To enable replace default mode uncomment the following line in the `layers/meta-wolfssl/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend` file: +To enable replace default mode add these to your `local.conf` file: ```bitbake -require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc +WOLFSSL_FEATURES = "wolfprovider" +WOLFPROVIDER_MODE = "replace-default" ``` -Add `WOLFSSL_FEATURES = "wolfprovider"` to the local.conf file or include your bbappend directly to your image recipe. - run the following commands to build the image: ```bash bitbake -c cleansstate openssl @@ -136,6 +135,7 @@ bitbake wolfprovider-image-minimal bitbake ``` Note: Make sure to clean openssl if rebuilding openssl or wolfprovider or the image with replace default mode. +Note: If switching between normal and replace default mode you will need to `cleanll openssl` and rebuild the image again. once in qemu or target image verify with `openssl list -providers` that the default provider is `wolfSSL Provider` or just run `wolfproviderenv`. @@ -148,13 +148,12 @@ Enable the wolfprovider demo image in your `local.conf` file so you can veridy F WOLFSSL_DEMOS = "wolfprovider-image-minimal wolfssl-image-minimal" ``` -To enable fips uncomment the following line in the `layers/meta-wolfssl/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend` file: +To enable fips add these to your `local.conf` file: ```bitbake -require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc +WOLFSSL_FEATURES = "wolfprovider" +require /path/to/meta-wolfssl/conf/wolfssl-fips.conf ``` -Add `WOLFSSL_FEATURES = "wolfprovider"` to the local.conf file or include your bbappend directly to your image recipe. - run the following commands to build the image: ```bash bitbake -c cleansstate openssl diff --git a/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend b/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend index 7a4b064..32930d8 100644 --- a/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend +++ b/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend @@ -1,10 +1,30 @@ +# Conditionally configure openssl with wolfProvider support +# +# This bbappend automatically enables wolfProvider backend when: +# 1. 'wolfprovider' is in WOLFSSL_FEATURES (explicit intent) +# 2. AND WOLFPROVIDER_MODE specifies the desired mode +# +# Usage in local.conf: +# WOLFSSL_FEATURES = "wolfprovider" +# WOLFPROVIDER_MODE = "standalone" # or "replace-default" + inherit wolfssl-helper python __anonymous() { - # standalone - wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc') - # replace default - wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc') + # wolfProvider standalone mode (default) + wolfssl_conditional_require_mode( + d, + package_name='wolfprovider', + mode='standalone', + inc_file='inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc' + ) + # wolfProvider replace-default mode + wolfssl_conditional_require_mode( + d, + package_name='wolfprovider', + mode='replace-default', + inc_file='inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc' + ) } # OpenSSL is a dependency of wolfprovider, not a direct image package diff --git a/recipes-wolfssl/wolfprovider/wolfssl-fips_%.bbappend b/recipes-wolfssl/wolfprovider/wolfssl-fips_%.bbappend deleted file mode 100644 index eab8a07..0000000 --- a/recipes-wolfssl/wolfprovider/wolfssl-fips_%.bbappend +++ /dev/null @@ -1,17 +0,0 @@ -# Conditionally configure wolfssl FIPS with wolfprovider support -# This bbappend checks the WOLFSSL_FEATURES and IMAGE_INSTALL variables - -inherit wolfssl-helper -inherit wolfssl-osp-support -deltask do_wolfssl_check_package - -python __anonymous() { - # FIPS mode - wolfssl_osp_conditional_include( - d, - feature_name='wolfprovider', - inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc', - allowed_providers=['wolfssl-fips'] - ) -} - diff --git a/recipes-wolfssl/wolfprovider/wolfssl_%.bbappend b/recipes-wolfssl/wolfprovider/wolfssl_%.bbappend index 78b7683..c0cdfb8 100644 --- a/recipes-wolfssl/wolfprovider/wolfssl_%.bbappend +++ b/recipes-wolfssl/wolfprovider/wolfssl_%.bbappend @@ -1,17 +1,32 @@ -# Conditionally configure wolfssl with wolfprovider support -# This bbappend checks the WOLFSSL_FEATURES and IMAGE_INSTALL variables +# Configure wolfProvider FIPS support for wolfSSL +# +# This bbappend automatically configures wolfssl or wolfssl-fips with the features +# needed by wolfprovider when 'wolfprovider' is in WOLFSSL_FEATURES +# +# Usage in local.conf: +# WOLFSSL_FEATURES = "wolfprovider" +# require conf/wolfssl-fips.conf # If FIPS mode is enabled -inherit wolfssl-helper inherit wolfssl-osp-support -deltask do_wolfssl_check_package python __anonymous() { - # non-FIPS mode + # wolfProvider non-FIPS mode wolfssl_osp_conditional_include( d, feature_name='wolfprovider', inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider.inc', allowed_providers=['wolfssl'] ) + # wolfProvider FIPS mode + wolfssl_osp_conditional_include( + d, + feature_name='wolfprovider', + inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc', + allowed_providers=['wolfssl-fips'] + ) } +# Disable package check since this is configuration for wolfssl itself +deltask do_wolfssl_check_package + +