14482 2021-07-15 09:32:26 +0000 Document how to set up the Yocto Project for production work 2021-07-30 15:45:03 +0000 1 1 9 Documentation General Docs docs-general 3.3 x86 Multiple RESOLVED MOVED Medium enhancement Future 1 michael.opdenacker michael.opdenacker belen.barros.pena michael.opdenacker pokylinux randy.macleod --- --- Yes (doc changes required) oldest_to_newest 90921 0 michael.opdenacker 2021-07-15 09:32:26 +0000 This is an attempt to help address bug #6437 (https://bugzilla.yoctoproject.org/show_bug.cgi?id=6437), starting from a clean state, as it becomes unmanageable, carrying too much history, making it difficult to grasp. I'm just keeping the information that is still useful, that is a comment from Robert Berger, summarized and expanded by this mind mapping attachement: https://bugzilla.yoctoproject.org/attachment.cgi?id=4793 A developer workflow for production should be mentioned: *) SDK for developer/bitbake for production build and Yocto/OE person *) devtool for developer/devtool for Yocto/OE person SW update solutions[1] should be mentioned for production, since people are reinventing all the time what's already there. The following can be used *) for "hardening" the production image *) to be able to see what meta-layers/branch/commit-id were used to build the image and whether something was modified without being checked in *) what packages are in the rootfs (without a package manager) - cve-check.bbclass - buildhistory.bbclass - image-buildinfo.bbclass - static code checks: https://github.com/priv-kweihmann/meta-sca - I use this[2] to write /etc/image-manifest (all packages) into my rootfs you can see here[3] how the output of image-buildinfo.bbclass and image-manifestinfo.bbclass looks like. Something like the oss-review toolkit[4] could be used to help with license compliance. I am not sure yet whether this should be outside of the YP or integrated with it. [1] https://wiki.yoctoproject.org/wiki/System_Update [2] https://gitlab.com/meta-layers/meta-resy/-/blob/dunfell/classes/image-manifestinfo.bbclass [3] https://hub.docker.com/r/yoctotrainer/app-container-tensorflow-oci [4] https://github.com/tsteenbe/ort 90922 1 michael.opdenacker 2021-07-15 09:33:24 +0000 Some additional inputs from Randy MacLeod: - local source mirrors - strategies for handling the git cloned repos (use local branches and rebase vs bbappend ) 90923 2 michael.opdenacker 2021-07-15 09:36:07 +0000 Setting the target milestone to "Future". This enhancement is too broad to be quickly addressed anyway. This will take time, but it's worth keeping the good ideas in mind when improving the documentation. 90925 3 michael.opdenacker 2021-07-15 09:39:45 +0000 *** Bug 6437 has been marked as a duplicate of this bug. *** 91063 4 pokylinux 2021-07-29 19:55:31 +0000 Is this here the place to collect ideas? 91067 5 michael.opdenacker 2021-07-30 10:17:55 +0000 Actually, we discussed this during the bug triage meeting and it turns out that these too wide bugs last forever and can never be fixed. I slept on it and realize using the wiki for collecting such ideas is probably the best idea. Let me propose something. 91072 6 michael.opdenacker 2021-07-30 15:45:03 +0000 Moved ideas to https://wiki.yoctoproject.org/wiki/Documentation_Production_Workflow Please contribute to this wiki page from now on (and send doc contribution patches too!) Closing this bug