meta-tolomeo¶
meta-tolomeo is a Yocto BSP and distribution layer collection for the ToloMEO edge computing platform. It targets industrial Linux deployments that require security hardening, over-the-air firmware updates, and software supply chain traceability.
Tutorials¶
Step-by-step guides that walk through a complete workflow and end with a working result. Start here if you are new to meta-tolomeo.
| Tutorial | Covers |
|---|---|
| Build the ToloMEO Reference Image | meta-tolomeo's own target: a running QEMU development image built from source |
| Build Your Own BSP Layer | Your own integration project consuming meta-tolomeo, with a derived distro and image |
How-to Guides¶
Step-by-step instructions for specific tasks. Assumes a working build environment.
| Guide | Covers |
|---|---|
| Configure the dev environment | sstate cache mirror, external cache directories, performance tuning, troubleshooting |
| Configure passwords | root and admin password generation for production images |
| Configure meta-tolomeo for your machine | override the TLM_ interface, redirect OTA paths, machine configuration checklist |
| Configure update modes | enable OTA file, OTA streaming, and USB update modes via DISTRO_FEATURES |
| Generate a signed update package | RSA key management, SWUpdate configuration, and package build |
| Generate a delta update | incremental (rdiff) update packages with binary diffs |
| Generate an encrypted artifact | AES-256-CBC encrypted .swu packages |
| Enable offline capabilities | licensed access token, opt-in build, layer-dependency use, the gating mechanism |
| Run standalone | run a ToloMEO image in QEMU without the devcontainer |
| Test updates in QEMU | trigger OTA streaming and USB updates against a QEMU instance |
| Export SBOM and VEX | CycloneDX SBOM/VEX generation, kernel CVE enrichment, supplier setup |
| Manage the CVE database | NVD database fetch, API key, backup seeding, and scheduled refresh |
| Generate a HAB4 PKI tree | CST keys, SRK table, and eFuse programming (i.MX8M) |
| Generate an AHAB PKI tree | SPSDK keys, SRK hash, and eFuse programming (i.MX9) |
| Enable NXP authenticated boot | HAB4 and AHAB boot image signing for i.MX8M and i.MX9 |
| Enable FIT image signing | RSA signing of the Linux kernel FIT image |
Reference¶
Complete technical specifications for DISTRO_FEATURES, recipe variables, conf.d files, and installed paths.
| Reference | Covers |
|---|---|
| kas Configuration | File roles and naming, meta-tolomeo kas fragments, merge semantics, repository pinning |
| Machine Configuration | Machine contract, storage profiles, secure-boot include, required board variables |
| Configuration Classes | TLM_ variable interface, the tolomeo_* classes, required-variable validation, install helpers |
| Artifacts Collection | Build output collection classes, artifact directory structure, configuration variables |
| Update Mechanism | DISTRO_FEATURES, recipe variables, conf.d files, runtime variables, installed paths |
| CVE Database | NVD database path, variables, enablement include, and CI refresh job |
| Secure Boot | Signing classes, include files, DISTRO_FEATURES, variables, recipes |
Explanation¶
Design rationale for non-obvious choices.
| Explanation | Covers |
|---|---|
| Architecture | Layer separation rationale, target platforms, build configurations |
| Configuration Classes | TLM_ interface rationale, OTA single source of truth, parse-time validation, class hierarchy |
| Update Mechanism | Feature flag design, two-layer configuration model, runtime argument composition |
| Encrypted Updates | Feature boundary, signing vs. encryption, on-device key delivery design space |
| CVE Database | NVD fetch problem, backup seed, scheduled refresh, per-branch update policy |
| Secure Boot Chain | Two-stage boot chain: NXP HAB/AHAB and U-Boot FIT image signing |