From 5f725c0c2713c240bf549ed71b051e46dd974647 Mon Sep 17 00:00:00 2001 From: Quentin Schulz Date: Fri, 6 May 2022 12:46:58 +0200 Subject: [PATCH] package/libcamera: strip symbols before signing IPA libs Open-Source IPA shlibs need to be signed in order to be runnable within the same process, otherwise they are deemed Closed-Source and run in another process and communicate over IPC. The shlib installed on the target should be the same as the one signed by libcamera during package creation otherwise the signature won't match the shlib. Buildroot sanitizes RPATH in a post build process. meson gets rid of rpath while installing so we don't need to do it manually. Buildroot may strip symbols, so we need to do the same before signing. Signing the IPA shlibs is done by the meson install target, so we need to strip the IPA shlibs, so after the build but before the install, which a post-build hooks fits the best. Cc: Quentin Schulz Signed-off-by: Quentin Schulz [yann.morin.1998@free.fr: slight rewording of commit log] Signed-off-by: Yann E. MORIN (cherry picked from commit bba4dad9aa8e7eb497e7f83b7722b8c10596e34e) Signed-off-by: Peter Korsgaard --- package/libcamera/libcamera.mk | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/package/libcamera/libcamera.mk b/package/libcamera/libcamera.mk index 77381ab3ca..41d6a5abef 100644 --- a/package/libcamera/libcamera.mk +++ b/package/libcamera/libcamera.mk @@ -104,4 +104,24 @@ LIBCAMERA_DEPENDENCIES += libexecinfo LIBCAMERA_LDFLAGS = $(TARGET_LDFLAGS) -lexecinfo endif +# Open-Source IPA shlibs need to be signed in order to be runnable within the +# same process, otherwise they are deemed Closed-Source and run in another +# process and communicate over IPC. +# Buildroot sanitizes RPATH in a post build process. meson gets rid of rpath +# while installing so we don't need to do it manually here. +# Buildroot may strip symbols, so we need to do the same before signing +# otherwise the signature won't match the shlib on the rootfs. Since meson +# install target is signing the shlibs, we need to strip them before. +LIBCAMERA_STRIP_FIND_CMD = \ + find $(@D)/build/src/ipa \ + $(if $(call qstrip,$(BR2_STRIP_EXCLUDE_FILES)), \ + -not \( $(call findfileclauses,$(call qstrip,$(BR2_STRIP_EXCLUDE_FILES))) \) ) \ + -type f -name 'ipa_*.so' -print0 + +define LIBCAMERA_BUILD_STRIP_IPA_SO + $(LIBCAMERA_STRIP_FIND_CMD) | xargs --no-run-if-empty -0 $(STRIPCMD) +endef + +LIBCAMERA_POST_BUILD_HOOKS += LIBCAMERA_BUILD_STRIP_IPA_SO + $(eval $(meson-package))