Skip to content

kas Configuration

Complete reference for the kas configuration layout used by ToloMEO integration projects: the role of each file, the integration contract exposed by meta-tolomeo's kas fragments, and the merge semantics that determine what ends up in bblayers.conf and local.conf.

For a guided walkthrough that builds this configuration from scratch, see Build Your Own BSP Layer.


File layout

<project-root>/
├── kas/
│   ├── base.yml                          # layer stack and global configuration
│   ├── common.yml                        # build paths and mirrors for local builds
│   ├── <feature>.yml                     # optional, self-contained setting groups
│   └── <machine>_<distro>_<image>.yml    # build targets
└── kas-ci/
    ├── common.yml                        # build paths and mirrors for CI builds
    ├── <machine>.yml                     # machine axis
    └── <distro>.yml                      # distribution axis

File roles

File Includes Declares Never declares
kas/base.yml meta-tolomeo layer fragments repos:, bblayers_conf_header, machine-independent local_conf_header blocks machine, distro, target, paths
kas/common.yml kas/base.yml, feature files TMPDIR, DL_DIR, SSTATE_DIR, SSTATE_MIRRORS, signature handler machine, distro, target
kas/<feature>.yml nothing one cohesive local_conf_header block repos:, targets
kas/<target>.yml kas/common.yml machine, distro, target — nothing else anything else
kas-ci/common.yml kas/base.yml, feature files CI paths, SSTATE_MIRRORS, PREMIRRORS, CI_JOB_TOKEN SRC_URI overrides machine, distro, target
kas-ci/<machine>.yml kas-ci/common.yml machine distro, target
kas-ci/<distro>.yml nothing distro everything else

kas-ci/<distro>.yml carries no includes so that it can be appended to any machine fragment. With m machines and n distributions the CI matrix costs m + n files rather than m × n.

File naming

Pattern Use Example
<machine>_<distro>_<image>.yml an image build acme-mx8mp-prod_acme-prod_acme-image-prod.yml
<machine>_<purpose>.yml a non-image target; distribution is implied acme-mx8mp-prod_imgen-update-full.yml
<feature>.yml a reusable settings group secure-boot.yml, mfg-settings.yml
kas-ci/<machine>.yml CI machine axis kas-ci/acme-mx8mp-prod.yml
kas-ci/<distro>.yml CI distribution axis kas-ci/acme-prod.yml

meta-tolomeo kas fragments

Each meta-tolomeo layer ships <layer>/kas/common.yml declaring what that layer needs. Include the fragments rather than restating their contents, so that dependency changes arrive with a commit bump:

header:
  version: 14
  includes:
    - repo: meta-tolomeo
      file: meta-tolomeo-app/kas/common.yml
    - repo: meta-tolomeo
      file: meta-tolomeo-bsp/kas/common.yml
    - repo: meta-tolomeo
      file: meta-tolomeo-distro/kas/common.yml

The repo: key resolves file: inside the named repository instead of the working repository.

meta-tolomeo-app/kas/common.yml

Adds Value
Repositories none
Config blocks none
env passthrough DEFAULT_ROOT_PASSWORD, DEFAULT_ADMIN_PASSWORD

meta-tolomeo-bsp/kas/common.yml

Adds Value
Repositories none
Config block common-secure-bootUBOOT_SIGN_KEYDIR ?= "${BSPDIR}/keys", UBOOT_SIGN_KEYNAME ?= "fitImage-sign"
env passthrough UBOOT_SIGN_KEYDIR, UBOOT_SIGN_KEYNAME

meta-tolomeo-distro/kas/common.yml

Adds Value
Repositories meta-security (with meta-hardening, meta-integrity), meta-swupdate, meta-vulnscout, meta-virtualization
Config block common-swupdateSWUPDATE_KEYDIR ?= "${BSPDIR}/keys", SWUPDATE_SIGN_KEYNAME ?= "swupdate-sign", SWUPDATE_ENC_KEYNAME ?= "swupdate-enc"
Config block common-cve-nvd-updateNVDCVE_API_KEY, CVE_DB_UPDATE_INTERVAL, CVE_DB_INCR_UPDATE_AGE_THRES, CVE_DB_BACKUP_URL
env passthrough SWUPDATE_KEYDIR, SWUPDATE_SIGN_KEYNAME, SWUPDATE_ENC_KEYNAME, NVDCVE_API_KEY, CVE_DB_UPDATE_INTERVAL, CVE_DB_INCR_UPDATE_AGE_THRES, CVE_DB_BACKUP_URL, BUILD_VERSION, FIRMWARE_NAME, VERSION_FROM, VERSION_TO

meta-tolomeo-nxp/kas/common.yml

Include only for NXP i.MX targets. Requires the NXP vendor layers (meta-freescale, meta-freescale-distro, meta-imx, meta-arm) in your own repos:, and an ACCEPT_FSL_EULA = "1" config block.

meta-tolomeo-qemu/kas/common.yml

Adds Value
Config block buildinfo — reference FIRMWARE_NAME and BUILD_VERSION

The meta-tolomeo-qemu layer provides the tolomeo-qemux86-64, tolomeo-qemuarm64 and tolomeo-qemuarm machines and the tolomeo-devel / tolomeo-prod reference distributions. Enable it in your meta-tolomeo layer list to keep a hardware-independent build available, and read its machine configurations as the worked example of the machine contract — see Machine Configuration. Do not derive your distributions from tolomeo-devel or tolomeo-prod; derive them from tolomeo.inc.


Feature fragments

kas/ also ships reusable feature fragments. The offline fragments below are special: unlike a plain kas/<feature>.yml (which carries only a local_conf_header block), they enable a layer and forward credentials.

kas/gitlab-auth.yml

Reusable GitLab credentials for fetching private DAVE repositories over HTTPS.

Adds Value
env passthrough TLM_GITLAB_USER (default oauth2), TLM_GITLAB_TOKEN (no default)

kas/offline.yml

Opt-in fragment enabling ToloMEO offline capabilities.

Adds Value
Includes kas/gitlab-auth.yml
Repositories enables the meta-tolomeo-offline layer in the meta-tolomeo repo

Append it to a target to build with offline support; the private tlm-bridge fetch uses the credentials from kas/gitlab-auth.yml. See Enable Offline Capabilities.


Merge semantics

Include resolution

header.includes entries are processed in order, depth-first, before the including file's own keys. A file therefore always wins over what it includes, and the last include wins over earlier ones.

Include form Resolved against
- kas/base.yml the working repository
- repo: <name>
file: <path>
repository <name> in repos:

local_conf_header blocks

local_conf_header is a mapping of block name to a literal chunk of local.conf text. Blocks are merged by name across all includes and concatenated into build/conf/local.conf.

  • Reusing a block name replaces the earlier block entirely.
  • A new block name adds content.
  • Block ordering in the generated file is not guaranteed; never write a block that depends on another block's position.

Prefix your own block names with your project slug (common-acme, common-acme-ci) so they cannot collide with meta-tolomeo's. Reuse a meta-tolomeo block name only when you intend to replace it — buildinfo is the usual case.

repos merging

Repository entries merge by key. A later file may add layers to a repository declared earlier without restating its url, branch or commit:

# kas/base.yml
repos:
  meta-tolomeo:
    url: https://gitlab.com/DAVEEmbeddedSystems/public/tolomeo-public-projects/edge/tolomeo-edge/meta-tolomeo
    branch: scarthgap
    commit: <sha>
    path: sources/meta-tolomeo
    layers:
      meta-tolomeo-app:

# kas/common.yml — adds one more layer from the same repository
repos:
  meta-tolomeo:
    layers:
      meta-tolomeo-qemu:

env passthrough

env:
  SWUPDATE_KEYDIR: null

A null value declares the variable as forwarded from the environment into BitBake's datastore with no default. A non-null value supplies a default that the environment can still override. This is how CI injects secrets without writing them into any tracked file.


Repository declaration

Key Required Notes
url no Omit for the working repository — the project you are building from
branch yes* Documents the upstream line; use with commit
tag no Alternative to branch for vendor releases; use with commit
commit yes* The pin that makes the build reproducible
path yes* Conventionally sources/<name>
layers no Enables exactly the listed sub-layers. Omit to enable the repository root as a single layer

* for fetched repositories; not applicable to the working repository.

Pinning policy: always give both a branch (or tag) and a commit. The commit determines what is built; the branch or tag records where it came from and gives a bump a target. A branch without a commit makes builds non-reproducible.

bblayers_conf_header

bblayers_conf_header:
  env: |
    BSPDIR := "${@os.path.abspath(os.path.dirname(d.getVar('FILE', True)) + '/../..')}"

BSPDIR resolves to the project root. meta-tolomeo uses it to default UBOOT_SIGN_KEYDIR and SWUPDATE_KEYDIR to ${BSPDIR}/keys, so a keys symlink or directory at the project root is all that is needed to supply signing material.

Signature handling with mirrors

BB_HASHSERVE = ""
BB_SIGNATURE_HANDLER = "OEBasicHash"

These two settings are a pair, and they are a precondition for the sstate mirrors being useful. The default equivalence-hash handler derives task signatures from a hash-equivalence server's local history, which cannot match the signatures a shared mirror was populated with. OEBasicHash makes signatures a pure function of the metadata, producing cache hits instead of misses.


Commands

Command Effect
kas build <file> Check out repositories, generate the build configuration, build
kas checkout <file> Check out and generate configuration only, no build
kas dump <file> Print the merged configuration; nothing is fetched or built
kas dump --resolve-refs <file> As above, with every ref resolved to a concrete commit
kas shell <file> -c '<cmd>' Run a command inside the configured BitBake environment
kas build <a>.yml:<b>.yml Merge multiple configuration files, left to right

Use kas dump --resolve-refs to validate a new configuration before starting a build: confirm that every repository has a concrete commit, that the expected layers are present, and that your local_conf_header blocks appear once each.


See also