https://umair-as.github.io/blog/tags/yocto/Recent content in Yocto on Umair's Systems NotebookHugoen-usThu, 07 May 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/uboot-bootm-len-silent-ab-fallback/Thu, 07 May 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/uboot-bootm-len-silent-ab-fallback/A debug-info kernel overshoots U-Boot’s decompression buffer by 1.85 MiB. The bundle verifies at every layer, RAUC reports success, and the board silently falls back to the old slot, because the one property that mattered is only observable at bootm time on the device.https://umair-as.github.io/blog/posts/rauc-streaming-key-tpm2-pkcs11/Thu, 23 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-streaming-key-tpm2-pkcs11/Migrating RAUC’s mTLS client key from a file on disk to a TPM2-backed PKCS#11 URI. The recipe wiring was straightforward; the URI was not. module-path is a p11-kit URI extension that libp11 — the parser RAUC’s streaming path actually uses — rejects outright.https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Tue, 21 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.https://umair-as.github.io/blog/posts/telegraf-yocto-recipe/Wed, 15 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/telegraf-yocto-recipe/No OE recipe for Telegraf exists upstream. What looked like a straightforward packaging task turned into a Go linker collision, a PIE/CGO conflict, and a credential problem that ruled out the obvious solution entirely.https://umair-as.github.io/blog/posts/otbr-systemd-hardening/Tue, 14 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/otbr-systemd-hardening/Part 1 got OTBR running as a non-root user with three capabilities. Part 2 covers the hardening block in the service file — what each directive does, why one had to be an exception, and how to use systemd-analyze security as a decision tool rather than a score to chase. Part 2 of 2.https://umair-as.github.io/blog/posts/running-otbr-as-non-root/Tue, 14 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/running-otbr-as-non-root/OpenThread Border Router assumes it runs as root. Getting it down to a least-privilege non-root user means figuring out exactly what it needs — which turned out to be a source code problem, not a trial-and-error problem. Part 1 of 2.