Report from the Buildroot Developers Meeting at FOSDEM 2023

With the FOSDEM conference taking place on-site again after 2 years of virtual conference, this month of February also saw the return of the traditional Buildroot Developers Meeting from the Buildroot project.

This meeting is traditionnally held twice a year, around FOSDEM and around the Embedded Linux Conference Europe, and allows maintainers and contributors to the Buildroot project to gather for a few days and make progress on various tasks/topics.

This year, the post-FOSDEM Buildroot Developers Meeting took place on February 6, 7 and 8 in Brussels, and was hosted at the Smile offices, who kindly sponsored the location for the meeting.

The four maintainers of Buildroot were present: Peter Korsgaard, Arnout Vandecappelle, Yann E. Morin and Thomas Petazzoni, as well as a group of contributors from various companies: Angelo Compagnucci, Vincent Fazio, Sebastian Weyer, Jordan Speicher, Heiko Thiery, Michael Walle and Jochen Baltes.

The main goal of this Buildroot Developers Meeting was to handle some of the backlog of contributions that were awaiting review and decision (merging, requesting changes, or less often rejecting). At the start of the meeting, the patchwork patch-tracking tool used by the Buildroot community had no less than 450 patches that needed action, and the meeting concluded with 250 patches left in the queue, meaning that about 200 patches have been handled, and indeed a total of 191 commits have been made during the meeting.

Some of the changes are not necessarily impressive, but it’s not always the most impressive changes that require the biggest amount of work and discussion.

Here is a brief summary of the most relevant things that have been merged:

• The website has been updated with new functional Javascript code to show the recent commits and mailing list activity
• Version update of many packages: libcamera-apps, gpsd, thermald, iwd, tmux, xmrig, iputils, gdal, mesa3d-demos, libcamera, docker-cli, docker-engine, uuu, mcelog, balena-engine, busybox, rust, rust-bin, libgtk3, systemd, perl-mail-dkim, php, libva, libva-utils, intel-mediadriver, intel-mediasdk, timescaledb, libressl, osm2pgsql, pipewire, neon-2-sse, gstd, zxing-cp, qt6, libopenssl, nginx-modsecurity
• New packages added: libunibreak, python-h11, python-hkdf, python-spake2, python-magic-wormhole, python-magic-wormhole-mailbox-server, python-magic-wormhole-transit-relay, cli11, termcolor, tl-expected, libsolv, reproc, sway, open-iscsi
• Some packages were dropped: python-bunch, docker-proxy, gummiboot, xdriver_xf86-video-imx-viv
• Improve reproducibility of barebox images
• The packaging of Qt6 made a lot of progress: we can now build the GUI module, the Widgets module, with a number of options, and the Qt6SerialBus library has also been added.
• Allowing using out of tree Device Tree files when building OP-TEE
• The random number generator seeding logic at boot time was improved using the new seedrng applet from Busybox, based on feedback and code from Linux kernel RNG maintainer Jason A. Donenfeld
• A new verification script, check-symbols was added: it does a number of consistency checks on the configuration symbols defined in Config.in files, such as verifying that all symbols are used, that symbols referenced do exist, and more.
• The existing check-package utility was extended with an ignore list mechanism, which allows to ignore specific warnings for specific files, and then the scope of the tool was extended to cover more files and more situations. This will avoid introducing warnings in new code, without needing a flag day requiring to fix all such warnings in existing code.
• The uclibc package was tuned to allow building uClibc with debugging symbols
• The Docker image based on Debian used to run the Gitlab CI jobs of the project has been updated. This required a few fixes due to a change in the behavior of Git.

In addition, a number of topics have been discussed:

• Heiko Thiery demonstrated his website that allows to nagivate in the Buildroot package set, and which aims at being a replacement for http://autobuild.buildroot.org. We pointed a few missing things: handling of several branches, and navigation in the CVEs of packages.
• Handling of the Y2038 issue on 32-bit architectures, following a patch proposed by Thomas Petazzoni. The situation for uClibc and musl is simple: uClibc does not support 64-bit time_t, musl always uses 64-bit time_t. The situation for glibc is more complicated, and requires passing a -D_TIME_BITS=64 to use a 64-bit time_t. That however causes some breakage with a number of package. We discussed the approach to tackle this problem.
• There’s also been discussion on the download infrastructure. First, about the fact that we download auto-generated tarballs from Github, a feature that was broken on January 30, 2023 by a change on Github’s side, causing the tarball to have a different hash and therefore breaking downloads for Buildroot for packages fetched from Github. In the mean time, Github had reverted, and so far the consensus seems to be that there is no need to change anything on Buildroot side in the short term. The other topic discussed was related to packages that use a language-specific vendoring logic: Buildroot supports that for both Go and Cargo/Rust packages: we run the go or cargo tool to retrieve the dependencies of a package, during its download step. However, we do the hash integrity validation only after doing the vendoring, which means we are running locally a vendoring tool on untrusted/unverified source, which isn’t a good idea. On this topic, the consensus seems to be that we want to do hash verification of the source before and after vendoring. Yann E. Morin volunteered to prototype a solution for this.
• The Buildroot project is mostly a self-organized community-driven project, but since a few years a legal entity, called the Buidroot Association has been created. This legal entity is a non-profit incorporated in France, and the meeting was an opportunity to organize the General Assembly of this organization. The goal of the organization is mainly to manage the funds of the project: receive sponsorship from individuals and companies, and fund domain names, servers, travel and other expenses related to the project.
• We discussed the date of the next Buildroot Developers Meeting. Even though the dates don’t look ideal, it might happen on June 28-29 in Prague, right after the Embedded Linux Conference Europe.

Overall, it was as usual a good moment for the Buildroot community, that allowed to make meaningful progress for the project, while also spending interesting time with other embedded Linux developers.