[Buildroot] [RFC PATCH] package/libcamera: remove rpath and strip debug symbols before signing IPA libs

[Arnout Vandecappelle]

  Hi Quentin,

On 05/05/2022 14:01, Quentin Schulz wrote:
> From: Quentin Schulz <quentin.schulz at theobroma-systems.com>
> 
> Open-Source IPA shlibs need to be signed in order to be runnable within
> the same process, otherwise they are deemed Closed-Source and run in
> another process and communicate over IPC.
> Buildroot strips debug symbols and sanitizes RPATH in a post build
> process. We need to do the same before signing the IPA shlibs otherwise
> the signature won't match the shlib on the rootfs.
> 
> meson gets rid of rpath while installing so we don't need to do it
> manually.
> However the signing process is also part of the meson install target, so
> we have a chicken and the egg problem. Let's install the libs in the
> target directory (and do a useless signing) to get rid of rpath, then
> strip debug symbols the same way Buildroot does in post build step, then
> re-sign shlibs directly in TARGET_DIR with signing script from
> libcamera.
> 
> Cc: Quentin Schulz <foss+buildroot at 0leil.net>
> Signed-off-by: Quentin Schulz <quentin.schulz at theobroma-systems.com>
> ---
>   package/libcamera/libcamera.mk | 21 +++++++++++++++++++++
>   1 file changed, 21 insertions(+)
> 
> diff --git a/package/libcamera/libcamera.mk b/package/libcamera/libcamera.mk
> index 77381ab3ca..d1303a2ff5 100644
> --- a/package/libcamera/libcamera.mk
> +++ b/package/libcamera/libcamera.mk
> @@ -104,4 +104,25 @@ LIBCAMERA_DEPENDENCIES += libexecinfo
>   LIBCAMERA_LDFLAGS = $(TARGET_LDFLAGS) -lexecinfo
>   endif
>   
> +# Open-Source IPA shlibs need to be signed in order to be runnable within the
> +# same process, otherwise they are deemed Closed-Source and run in another
> +# process and communicate over IPC.
> +# Buildroot strips debug symbols and sanitizes RPATH in a post build process. We
> +# need to do the same before signing the IPA shlibs otherwise the signature
> +# won't match the shlib on the rootfs.
> +#
> +# meson gets rid of rpath while installing so we don't need to do it manually.
> +# However the signing process is also part of the meson install target, so we
> +# have a chicken and the egg problem. Let's install the libs in the target
> +# directory (and do a useless signing) to get rid of rpath, then strip debug
> +# symbols the same way Buildroot does in post build step, then re-sign shlibs
> +# directly in TARGET_DIR with signing script from libcamera.
> +define LIBCAMERA_INSTALL_TARGET_CMDS
> +	$(TARGET_MAKE_ENV) $(LIBCAMERA_NINJA_ENV) DESTDIR=$(TARGET_DIR) \
> +		$(NINJA) $(NINJA_OPTS) -C $(LIBCAMERA_SRCDIR)/build install
> +	find $(TARGET_DIR) -type f -name "ipa_*.so" -print0 | xargs -0 $(STRIPCMD) 2>/dev/null || true

  You should add --no-run-if-empty to xargs, in case there is no library at all 
(unless you're very sure that doesn't happen). Also, why is the || true needed?

> +	MESON_INSTALL_DESTDIR_PREFIX=$(TARGET_DIR)/usr/lib/libcamera/ $(@D)/src/ipa/ipa-sign-install.sh $(@D)/build/src/ipa-priv-key.pem $(addprefix ipa_,$(addsuffix .so,$(LIBCAMERA_PIPELINES-y)))
> +	MESON_INSTALL_DESTDIR_PREFIX=$(TARGET_DIR)/usr/lib64/libcamera/ $(@D)/src/ipa/ipa-sign-install.sh $(@D)/build/src/ipa-priv-key.pem $(addprefix ipa_,$(addsuffix .so,$(LIBCAMERA_PIPELINES-y)))

  Instead of overriding INSTALL_TARGET_CMDS, you could also do the additional 
steps in POST_INSTALL_TARGET_HOOKS.

  However, I think it may be simpler to do the stripping in a POST_BUILD_HOOK. 
That way, you only need to do the strip; the signing is done in the install 
step, so if we make sure the .so is stripped by then, all should be well, right?

  Finally, there is one little caveat: if the libraries are installed in 
BR2_STRIP_EXCLUDE_DIRS (i.e. if BR2_STRIP_EXCLUDE_DIRS is set to /usr/lib), or 
if they match BR2_STRIP_EXCLUDE_FILES (e.g. if it is set to "ipa_*.so"), then 
the libs would be stripped while they shouldn't be. However, I don't think 
that's a big deal.

  Regards,
  Arnout


> +endef
> +
>   $(eval $(meson-package))