C61: build fail of optee-tests

The module affected

meta-seco-imx

What is the action to reproduce the bug?

Enable optee-test build for example with LEDGE via !285 (merged) and eclipse/oniro-core/third-party/forks/meta-ledge-secure!4 (merged)

What is the result you see?

NOTE: Resolving any missing task queue dependencies
ERROR: Nothing PROVIDES 'python3-pycrypto-native' (but /oniroproject/oe-core/../meta-seco-imx/recipes-security/optee-imx/optee-test_3.13.0.imx.bb DEPENDS on or otherwise requires it). Close matches:
  python3-m2crypto-native
  python3-pycryptodome-native
  python3-pycryptodomex-native
NOTE: Runtime target 'optee-test' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['optee-test', 'python3-pycrypto-native']
NOTE: Runtime target 'packagegroup-ledge-optee' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['packagegroup-ledge-optee', 'optee-test', 'python3-pycrypto-native']
ERROR: Required build target 'oniro-image-base' has no buildable providers.
Missing or unbuildable dependency chain was: ['oniro-image-base', 'packagegroup-ledge-optee', 'optee-test', 'python3-pycrypto-native']

What is the result you expect?

Build OK

Frequency?

always

Tested version

Oniro kirkstone c00629fa, C61 2gb

Do you know any workaround of this issue?

Disable build of optee-tests

Do you have a fix for this issue?

no

added IssueBug needs-investigation teammaintenance labels

CC @waykovalenko @ektor5

changed milestone to %goofy general availability

removed teammaintenance label

added teamsecurity label

assigned to @mrybczyn

Probably just enough to depend on python3-cryptography-native, to be tested

changed title from C61: build fail of of optee-tests to C61: build fail of optee-tests

We can remove python3-pycrypto-native. However, the build then fails because of use of deprecated functions in OpenSSL3

I've noticed that meta-freescale is on 3.15 (they moved from 3.10). 3.13 is not even officially supported there. @waykovalenko @ektor5 wouldn't it be a good idea to align with meta-freescale kirkstone branch?

Hi @mrybczyn yes I see here: https://git.yoctoproject.org/meta-freescale/tree/recipes-security/optee-imx/optee-test_3.15.0.imx.bb?h=kirkstone. there is no more dependency on `python3-pycrypto-native. We can try to update the optee-imx on meta-seco-imx to version 3.15

Yes @nat that would be good

@waykovalenko @ektor5 a temporary fix for cve-check attached0001-optee-test-remove-unneeded-dependency.patch Could you integrate it in meta-seco-imx before the update of optee?

@mrybczyn this patch won't fix the build errors for optee-test, right? if I enable optee-test with this patch applied, the build still fails. it is expected?

The build will fail. What will work is the cve-check for world:

bitbake world --runonly=do_cve_check

(which fails later for other reasons)

@mrybczyn the layer update patch in attachment 0001-default.xml-Update-source-revision-on-meta-seco-imx.patch

mentioned in issue #812

added ValidationReady label

removed needs-investigation label

@mrybczyn what's the command to add optee and optee-test?

The easiest one is to add "optee" to MACHINE_FEATURES for your board. I would do that on ARM only. Then packages will be added automatically.

C61 has it enabled by default

CI build completed succesfully

https://gitlab.eclipse.org/eclipse/oniro-core/oniro/-/jobs/173102

added ValidationCI label and removed ValidationReady label

closed