[Buildroot] [RFC PATCH] package/libcamera: remove rpath and strip debug symbols before signing IPA libs

[Quentin Schulz]

Hi Arnout,

On 5/5/22 22:57, Arnout Vandecappelle wrote:
>   Hi Quentin,
> 
> On 05/05/2022 14:01, Quentin Schulz wrote:
>> From: Quentin Schulz <quentin.schulz at theobroma-systems.com>
>>
>> Open-Source IPA shlibs need to be signed in order to be runnable within
>> the same process, otherwise they are deemed Closed-Source and run in
>> another process and communicate over IPC.
>> Buildroot strips debug symbols and sanitizes RPATH in a post build
>> process. We need to do the same before signing the IPA shlibs otherwise
>> the signature won't match the shlib on the rootfs.
>>
>> meson gets rid of rpath while installing so we don't need to do it
>> manually.
>> However the signing process is also part of the meson install target, so
>> we have a chicken and the egg problem. Let's install the libs in the
>> target directory (and do a useless signing) to get rid of rpath, then
>> strip debug symbols the same way Buildroot does in post build step, then
>> re-sign shlibs directly in TARGET_DIR with signing script from
>> libcamera.
>>
>> Cc: Quentin Schulz <foss+buildroot at 0leil.net>
>> Signed-off-by: Quentin Schulz <quentin.schulz at theobroma-systems.com>
>> ---
>>   package/libcamera/libcamera.mk | 21 +++++++++++++++++++++
>>   1 file changed, 21 insertions(+)
>>
>> diff --git a/package/libcamera/libcamera.mk 
>> b/package/libcamera/libcamera.mk
>> index 77381ab3ca..d1303a2ff5 100644
>> --- a/package/libcamera/libcamera.mk
>> +++ b/package/libcamera/libcamera.mk
>> @@ -104,4 +104,25 @@ LIBCAMERA_DEPENDENCIES += libexecinfo
>>   LIBCAMERA_LDFLAGS = $(TARGET_LDFLAGS) -lexecinfo
>>   endif
>> +# Open-Source IPA shlibs need to be signed in order to be runnable 
>> within the
>> +# same process, otherwise they are deemed Closed-Source and run in 
>> another
>> +# process and communicate over IPC.
>> +# Buildroot strips debug symbols and sanitizes RPATH in a post build 
>> process. We
>> +# need to do the same before signing the IPA shlibs otherwise the 
>> signature
>> +# won't match the shlib on the rootfs.
>> +#
>> +# meson gets rid of rpath while installing so we don't need to do it 
>> manually.
>> +# However the signing process is also part of the meson install 
>> target, so we
>> +# have a chicken and the egg problem. Let's install the libs in the 
>> target
>> +# directory (and do a useless signing) to get rid of rpath, then 
>> strip debug
>> +# symbols the same way Buildroot does in post build step, then 
>> re-sign shlibs
>> +# directly in TARGET_DIR with signing script from libcamera.
>> +define LIBCAMERA_INSTALL_TARGET_CMDS
>> +    $(TARGET_MAKE_ENV) $(LIBCAMERA_NINJA_ENV) DESTDIR=$(TARGET_DIR) \
>> +        $(NINJA) $(NINJA_OPTS) -C $(LIBCAMERA_SRCDIR)/build install
>> +    find $(TARGET_DIR) -type f -name "ipa_*.so" -print0 | xargs -0 
>> $(STRIPCMD) 2>/dev/null || true
> 
>   You should add --no-run-if-empty to xargs, in case there is no library 
> at all (unless you're very sure that doesn't happen). Also, why is the 
> || true needed?
> 

Shamelessly stolen from main Makefile :) 
https://git.busybox.net/buildroot/tree/Makefile#n758

But yes, no guarantee today that an IPA shlib will be installed by 
libcamera package, so I'll add this option to xargs command. Thanks for 
the heads up.

Will remove the redirect and the || true as they are not really useful 
in that package.

>> +    MESON_INSTALL_DESTDIR_PREFIX=$(TARGET_DIR)/usr/lib/libcamera/ 
>> $(@D)/src/ipa/ipa-sign-install.sh $(@D)/build/src/ipa-priv-key.pem 
>> $(addprefix ipa_,$(addsuffix .so,$(LIBCAMERA_PIPELINES-y)))
>> +    MESON_INSTALL_DESTDIR_PREFIX=$(TARGET_DIR)/usr/lib64/libcamera/ 
>> $(@D)/src/ipa/ipa-sign-install.sh $(@D)/build/src/ipa-priv-key.pem 
>> $(addprefix ipa_,$(addsuffix .so,$(LIBCAMERA_PIPELINES-y)))
> 
>   Instead of overriding INSTALL_TARGET_CMDS, you could also do the 
> additional steps in POST_INSTALL_TARGET_HOOKS.
> 

Was not aware of those hooks, neat :)

>   However, I think it may be simpler to do the stripping in a 
> POST_BUILD_HOOK. That way, you only need to do the strip; the signing is 
> done in the install step, so if we make sure the .so is stripped by 
> then, all should be well, right?
> 

If having the staging shlibs stripped is fine, then this shouldn't be an 
issue indeed.

>   Finally, there is one little caveat: if the libraries are installed in 
> BR2_STRIP_EXCLUDE_DIRS (i.e. if BR2_STRIP_EXCLUDE_DIRS is set to 
> /usr/lib), or if they match BR2_STRIP_EXCLUDE_FILES (e.g. if it is set 
> to "ipa_*.so"), then the libs would be stripped while they shouldn't be. 
> However, I don't think that's a big deal.
> 

Does not hurt to use the same logic as in STRIP_FIND_CMD in main 
Makefile, so will do.

Will send a v2 soon, thanks!

Quentin