meta-tolomeo¶
meta-tolomeo is a Yocto BSP and distribution layer collection for the ToloMEO edge computing platform. It targets industrial Linux deployments that require security hardening, over-the-air firmware updates, and software supply chain traceability.
Tutorials¶
Step-by-step guides that walk through a complete workflow and end with a working result. Start here if you are new to meta-tolomeo.
| Tutorial | Description |
|---|---|
| First Build | Devcontainer setup, first kas build, boot a QEMU development image |
How-to Guides¶
Step-by-step instructions for specific tasks. Assumes a working build environment.
| Guide | Description |
|---|---|
| Configure Dev Environment | sstate mirrors, external cache, performance |
| Configure Passwords | Root and admin passwords for production images |
| Configure Update Modes | Enable OTA, streaming, or USB update modes |
| Generate Signed Package | Build and sign an SWUpdate package |
| Generate Delta Update | Build an SWUpdate delta update package |
| Generate Encrypted Artifact | Encrypt update artifacts with AES-256-CBC |
| Run QEMU Standalone | Prepare and launch a QEMU virtual machine |
| Test Updates in QEMU | Test OTA and USB updates in a virtual machine |
| Export SBOM | Export CycloneDX SBOM and VEX from a build |
| Manage the CVE Database | NVD fetch, API key, backup seeding, refresh |
| Enable NXP Authenticated Boot | Enable HAB/AHAB boot image signing for i.MX8M and i.MX9 |
| Enable FIT Image Signing | RSA-sign the Linux kernel FIT image |
Reference¶
Complete technical specifications for DISTRO_FEATURES, recipe variables, conf.d files, and installed paths.
| Reference | Description |
|---|---|
| Update Mechanism | SWUpdate configurations, partition layout, image formats |
| Artifacts Collection | Build output collection, artifact directory structure |
| CVE Database | NVD database path, variables, and CI refresh job |
| Secure Boot | Signing classes, DISTRO_FEATURES, variables, recipes |
Explanation¶
Design rationale for non-obvious choices.
| Explanation | Description |
|---|---|
| Architecture | Layer separation rationale, target platforms, build configurations |
| Update Mechanism | Feature flag design, two-layer configuration model |
| Encrypted Updates | Encryption approach and key management |
| CVE Database | Fetch problem, backup seed, scheduled refresh, per-branch policy |
| Secure Boot Chain | Two-stage boot chain: NXP HAB/AHAB and FIT image signing |