This is an attempt to help address bug #6437 (https://bugzilla.yoctoproject.org/show_bug.cgi?id=6437), starting from a clean state, as it becomes unmanageable, carrying too much history, making it difficult to grasp. I'm just keeping the information that is still useful, that is a comment from Robert Berger, summarized and expanded by this mind mapping attachement: https://bugzilla.yoctoproject.org/attachment.cgi?id=4793 A developer workflow for production should be mentioned: *) SDK for developer/bitbake for production build and Yocto/OE person *) devtool for developer/devtool for Yocto/OE person SW update solutions[1] should be mentioned for production, since people are reinventing all the time what's already there. The following can be used *) for "hardening" the production image *) to be able to see what meta-layers/branch/commit-id were used to build the image and whether something was modified without being checked in *) what packages are in the rootfs (without a package manager) - cve-check.bbclass - buildhistory.bbclass - image-buildinfo.bbclass - static code checks: https://github.com/priv-kweihmann/meta-sca - I use this[2] to write /etc/image-manifest (all packages) into my rootfs you can see here[3] how the output of image-buildinfo.bbclass and image-manifestinfo.bbclass looks like. Something like the oss-review toolkit[4] could be used to help with license compliance. I am not sure yet whether this should be outside of the YP or integrated with it. [1] https://wiki.yoctoproject.org/wiki/System_Update [2] https://gitlab.com/meta-layers/meta-resy/-/blob/dunfell/classes/image-manifestinfo.bbclass [3] https://hub.docker.com/r/yoctotrainer/app-container-tensorflow-oci [4] https://github.com/tsteenbe/ort
Some additional inputs from Randy MacLeod: - local source mirrors - strategies for handling the git cloned repos (use local branches and rebase vs bbappend )
Setting the target milestone to "Future". This enhancement is too broad to be quickly addressed anyway. This will take time, but it's worth keeping the good ideas in mind when improving the documentation.
*** Bug 6437 has been marked as a duplicate of this bug. ***
Is this here the place to collect ideas?
Actually, we discussed this during the bug triage meeting and it turns out that these too wide bugs last forever and can never be fixed. I slept on it and realize using the wiki for collecting such ideas is probably the best idea. Let me propose something.
Moved ideas to https://wiki.yoctoproject.org/wiki/Documentation_Production_Workflow Please contribute to this wiki page from now on (and send doc contribution patches too!) Closing this bug