[needs-packaging] optee-os-s32

[Laider Lai]

[needs-packaging] optee-os-s32 (3.18-bsp37.0-0ubuntu1)
For Erlangen project, we have to provide the NXP S32G OP-TEE OS to the customer via Ubuntu archive (universe).

URL: https://launchpad.net/~nemos-team/+archive/ubuntu/archive-target/+packages
Source code: https://code.launchpad.net/~nemos-team/nemos/+git/optee-os-s32/+ref/ubuntu/archive
License: https://git.launchpad.net/~nemos-team/nemos/+git/optee-os-s32/tree/debian/copyright
Notes: The NXP S32G OP-TEE OS [Noble]

This package has a dependency for (LP: #2043448) and should wait for it to be approved into the target archive.

[Brian Murray (brian-murray)]

*** This is an automated message ***

This bug is tagged needs-packaging which identifies it as a request for a new package in Ubuntu. As a part of the managing needs-packaging bug reports specification, https://wiki.ubuntu.com/QATeam/Specs/NeedsPackagingBugs, all needs-packaging bug reports have Wishlist importance. Subsequently, I'm setting this bug's status to Wishlist.

[Laider Lai (laiderlai)]

Please hold on for this request.
Because the same platform's kernel resources may have some limitations.

We have to confirm the find public method about the kernel resources. Tks.

[Laider Lai (laiderlai)]

After checking with the HWE team, the kernel resources are okay to be published to the Ubuntu archive.
Therefore, the release target (Ubuntu archive) review process can continue.

[Sebastien Bacher (seb128)]

Thank you for your work, some review notes

- please run 'wrap-and-sort' to fix the debian/control formatting

- debian/copyright lists only BSD-2 but grepping for 'BSD-3-Clause' in the source returns a number of matches

the copyright owner listed there are also
  2015 Linaro Limited
  2023 NXP

but check the output of
$ grep -i ' Copyright (c) ' * -r | sed 's/.*://g' | sort | uniq

[Lucas Kanashiro (lucaskanashiro)]

I have some more comments on top of what seb said:

- Source package name: why did you decide to use optee-os-s32 when upstream
  names it as optee-os? I was not able to find the reason behind that decision.

- d/watch: it is not working properly:

$ uscan --verbose --download-version 3.18-bsp37.0
uscan info: uscan (version 2.20.2ubuntu2) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="optee-os-s32" version="3.18-bsp37.0-5" (as seen in debian/changelog)
uscan info: package="optee-os-s32" version="3.18-bsp37.0" (no epoch/revision)
uscan info: ./debian/changelog sets package="optee-os-s32" version="3.18-bsp37.0"
uscan info: Process watch file at: debian/watch
    package = optee-os-s32
    version = 3.18-bsp37.0
    pkg_dir = .
uscan info: opts: filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/optee-os-s32-$2-$1\.tar\.gz/,uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/,
uscan info: line: https://github.com/nxp-auto-linux/optee_os/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Parsing filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/optee-os-s32-$2-$1\.tar\.gz/
uscan info: Parsing uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/
uscan info: line: https://github.com/nxp-auto-linux/optee_os/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Last orig.tar.* tarball version (from debian/changelog): 3.18-bsp37.0
uscan info: Download the --download-version specified version: 3.18-bsp37.0
uscan info: Requesting URL:
   https://github.com/nxp-auto-linux/optee_os/tags
uscan info: Matching pattern:
   (?:(?:https://github.com)?\/nxp\-auto\-linux\/optee_os\/tags)?.*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Found the following matching hrefs on the web page (newest first):
   /nxp-auto-linux/optee_os/archive/refs/tags/bsp38.0-3.18.tar.gz (3.18-bsp38.0) index=3.18-bsp38.0-1
   /nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz (3.18-bsp37.0) index=3.18-bsp37.0-1 matched with the download version
   /nxp-auto-linux/optee_os/archive/refs/tags/bsp36.0-3.18.tar.gz (3.18-bsp36.0) index=3.18-bsp36.0-1
   /nxp-auto-linux/optee_os/archive/refs/tags/bsp35.0-3.18.tar.gz (3.18-bsp35.0) index=3.18-bsp35.0-1
   /nxp-auto-linux/optee_os/archive/refs/tags/bsp34.2-3.11.tar.gz (3.11-bsp34.2) index=3.11-bsp34.2-1
uscan info: Looking at $base = https://github.com/nxp-auto-linux/optee_os/tags with
    $filepattern = .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz found
    $newfile = /nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz
    $newversion = 3.18-bsp37.0
    $lastversion = 3.18-bsp37.0
uscan info: Matching target for downloadurlmangle: https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz
uscan info: Upstream URL(+tag) to download is identified as https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz
uscan info: Matching target for filenamemangle: /nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz
uscan info: Filename (filenamemangled) for downloaded file: /nxp-auto-linux/optee_os/archive/refs/tags/optee-os-s32-3.18-bsp37.0.tar.gz
uscan: Newest version of optee-os-s32 on rem...

[Isaac True (itrue)]

Hi Lucas,

> Source package name

As with https://bugs.launchpad.net/ubuntu/+bug/2034642/comments/11, this is a fork of OP-TEE containing patches from NXP which is incompatible with standard OP-TEE packages.

> d/watch: it is not working properly

I'm not sure why - it's working okay for me [1]. It seems to be adding a strange path to yours...

> d/changelog

We'd prefer to be able to keep the existing changelog, if possible.

> d/control

Thanks, changed the maintainer.

> d/copyright

Thanks, updated.

Cheers,
Isaac

[1]

$ uscan --verbose --download-version 3.18-bsp37.0
uscan info: uscan (version 2.22.1ubuntu1) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="optee-os-s32" version="3.18-bsp37.0-5" (as seen in debian/changelog)
uscan info: package="optee-os-s32" version="3.18-bsp37.0" (no epoch/revision)
uscan info: ./debian/changelog sets package="optee-os-s32" version="3.18-bsp37.0"
uscan info: Process watch file at: debian/watch
    package = optee-os-s32
    version = 3.18-bsp37.0
    pkg_dir = .
uscan info: opts: filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/optee-os-s32-$2-$1\.tar\.gz/,uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/,
uscan info: line: https://github.com/nxp-auto-linux/optee_os/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Parsing filenamemangle=s/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz/optee-os-s32-$2-$1\.tar\.gz/
uscan info: Parsing uversionmangle=s/(bsp\d+\.\d+).(\d+\.\d+)/$2-$1/
uscan info: line: https://github.com/nxp-auto-linux/optee_os/tags .*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Last orig.tar.* tarball version (from debian/changelog): 3.18-bsp37.0
uscan info: Download the --download-version specified version: 3.18-bsp37.0
uscan info: Requesting URL:
   https://github.com/nxp-auto-linux/optee_os/tags
uscan info: Matching pattern:
   (?:(?:https://github.com)?\/nxp\-auto\-linux\/optee_os\/)?.*/(bsp\d+\.\d+)-(\d+\.\d+)\.tar\.gz
uscan info: Found the following matching hrefs on the web page (newest first):
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp38.0-3.18.tar.gz (3.18-bsp38.0) index=3.18-bsp38.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp38.0-3.18.tar.gz (3.18-bsp38.0) index=3.18-bsp38.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz (3.18-bsp37.0) index=3.18-bsp37.0-1 matched with the download version
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp37.0-3.18.tar.gz (3.18-bsp37.0) index=3.18-bsp37.0-1 matched with the download version
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp36.0-3.18.tar.gz (3.18-bsp36.0) index=3.18-bsp36.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp36.0-3.18.tar.gz (3.18-bsp36.0) index=3.18-bsp36.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp35.0-3.18.tar.gz (3.18-bsp35.0) index=3.18-bsp35.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp35.0-3.18.tar.gz (3.18-bsp35.0) index=3.18-bsp35.0-1
   https://github.com/nxp-auto-linux/optee_os/archive/refs/tags/bsp34.2-3.11.tar.gz (3.11-bsp34.2) in...

[Dave Jones (waveform)]

Looks like the review comments have now been addressed, and I'd be happy to sponsor this for noble. Trivial questions remaining:

In the linked PPA at the top there are versions for mantic, lunar, and jammy. Would I be correct in assuming the version for noble is the current mantic version there, and do you want the ~ubuntu23.10.1 suffix removed or adjusted?

Also, where's the nemos-dev-key packaging bug? I can't find it in the sponsoring list, or on launchpad, and the nemos-dev-key package in the PPA doesn't have a bug link either.

[Dave Jones (waveform)]

tsimonq2 has kindly sponsored LP: #2043448 for nemos-dev-key so this is ready to go. Sponsored for noble with two trivial changes (to appease lintian):

* Remove build-dep on essential package gcc
* Fixed the lintian override to include the [brackets] around the file pattern (causing a mis-matched lintian warning)

[Laider Lai (laiderlai)]

Hi Dave,

Thanks for your review.
1. Since the development series is moved to Noble. Update the description target to Noble.

2.
* Remove build-dep on essential package gcc
* Fixed the lintian override to include the [brackets] around the file pattern (causing a mis-matched lintian warning)
Are fixed by optee-os-s32 (3.18-bsp37.0-9+nemos~202311220931~ubuntu24.04.1) version.

Tks.

[Dave Jones (waveform)]

Okay, since the last upload was rejected with a bad version number, let's try again with a new version number. Being an Ubuntu-only package this apparently should have a 0ubuntuN version suffix so that firstly we're not implying it derives from Debian, and secondly so an initial Debian upload of this version (should that ever happen) will override this one.

So, I'm going to try uploading again (to noble), with the changelog tweaked to fit the 0ubuntuN versioning scheme. I don't want to lose all the info you've diligently put in the changelog, so I'm going to revise the versions so 3.18-bsp37.0-N becomes 3.18-bsp37.0-0ubuntuN. Hence, the 3.18-bsp37.0-6 entry will become 3.18-bsp37.0-0ubuntu6 and so on.

I do realize these versions are technically "behind" the versions you've got in your PPA, and I suspect that may cause some issues for anyone currently relying on your PPA, sorry! Hopefully this will be a temporary situation if we can sort out the objections from the SRU team regarding the other uploads. I'll take a look at those this week and see if we can get things moving on those again.

[Laider Lai (laiderlai)]

Hi Dave Jones,

Thanks for your help!
I will bring this information to the nemos-team for a discussion. The key point is whether we can remove nemos word or not.

Our PPA version naming rule should align with the Ubuntu archive version.
Ex. 3.18-bsp37.0-9+nemos~202311220931~ubuntu24.04.1 is changed to 3.18-bsp37.0-0ubuntu9

[Laider Lai (laiderlai)]

Hi Dave Jones,

The version number is all changed for
1. arm-trusted-firmware-s32 - 2.5-bsp37.0-0ubuntu10
2. nemos-dev-key - 1.3
3. optee-client-s32 - 3.18.0-0ubuntu5
4. optee-os-s32 - 3.18-bsp37.0-0ubuntu9
5. optee-test-s32 - 3.18.0-0ubuntu2
6. u-boot-s32 - 2022.04-bsp37.0-0ubuntu14

We also changed the source of PPA to https://launchpad.net/~nemos-team/+archive/ubuntu/archive-staging/+packages

Tks.

[Laider Lai (laiderlai)]

Reference comments from other cases, refine version 3.18-bsp37.0-0ubuntu1 in PPA.

[Laider Lai (laiderlai)]

The dependency nemos-dev-key is uploaded to noble universe.
The optee-os-s32 can be resumed for uploading.

Please help to sponsor it to the upload queue. Tks.

[Loïc Minier (lool)]

I'm starting to take a look at optee-os-s32 (optee-os-s32_3.18-bsp37.0-0ubuntu1~ppa4.dsc) towards sponsoring it.

0) I think it's worth stating why we want the package. optee-os provides the "secure world" side of the OPTEE TEE implementation, which is typically loaded very early in the boot process of Arm platforms such as the NXP S32x family, and could be needed as part of the boot process. NXP has forked from https://github.com/OP-TEE/optee_os/ to add support for their S32x platform. Separately, NXP's OPTEE implementation can optionally be built with support for NXP's discrete security component called "HSE". We would like to add this package to Ubuntu as for its binaries to be included in to-be-created Ubuntu images for S32x platforms. These images would initially be without HSE support as it currently depends on a proprietary non-redistributable NXP firmware.

1) First, I thought we had a copy of optee_os in Debian/Ubuntu for some time already, but actually we only had optee_client (Source: optee-client) – until... oracular since we just imported optee-os_4.2.0-3.dsc from Debian. It was failing to build, I've just uploaded a build fix.
  optee-os and optee-os-s32 probably have disjoint development history, but it would be in our interest to keep these close as to find some similarities when we address one issue in one to carry the fix in the other. Unfortunately, these are quite far apart in terms of upstream versions. I'm not sure how much there is to align on between the two packages, but at least the way the build is called is slightly different since optee-os was failing to build due to taking Ubuntu's LDFLAGS while optee-os-s32 builds and seems not pass LDFLAGS through. It's not exactly a run of the mill shared ELF file to start with, but it might be worth comparing the ways both are built. I think we should at least try to align package names/splits and list of files as to imagine a world where S32x support for upstream, and optee-os can build a flavor for S32x (much like the u-boot package).
  optee-os provides subdirs under usr/lib/optee for each target platform:
/usr/lib/optee/k3-am62x/tee-raw.bin
/usr/lib/optee/vexpress-qemu_armv8a/tee-header_v2.bin
/usr/lib/optee/vexpress-qemu_armv8a/tee-pageable_v2.bin
/usr/lib/optee/vexpress-qemu_armv8a/tee-pager_v2.bin
/usr/lib/optee/vexpress-qemu_armv8a-virtualized/tee-header_v2.bin
/usr/lib/optee/vexpress-qemu_armv8a-virtualized/tee-pageable_v2.bin
/usr/lib/optee/vexpress-qemu_armv8a-virtualized/tee-pager_v2.bin
  while optee-os-dev provides a bunch of development files suc as headers, pre-built binaries, assembly files and makefiles. These are also under platform specific directories:
/usr/lib/optee-os-dev/PLATFORM/host_include/**/*.{h,ta,a,S}
/usr/lib/optee-os-dev/PLATFORM/host_include/conf.{mk,.h,cmake}
/usr/lib/optee-os-dev/PLATFORM/include/**/*.h
/usr/lib/optee-os-dev/PLATFORM/mk/*.mk
/usr/lib/optee-os-dev/PLATFORM/scripts/*.py
/usr/lib/optee-os-dev/PLATFORM/src/*.{S,c}
/usr/lib/optee-os-dev/PLATFORM/ta/*.ta
  where PLATFORM is in arm-plat-k3, vexpress-qemu_armv8a, vexpress-qemu_armv8a-virtualized. (I didn't attempt diffing the headers)

The optee-os-s32 deb follows a similar layout ...