platform_package_overrides and package names in rules

[steffenolsen]

I am trying to see whether we can use OpenSCAP to perform configuration benchmark test on systems running embedded linux distribution produced by Yocto/Openembedded. One particular problem I have is the naming of packages seems somewhat different in yocto than other "bigger" distos.

One basic example is 'openssh-server'. The package name for that component in yocto would be 'openssh-sshd'. Typically this means that a lot of the ssh server benchmark tests gives false positives, as oscap belives there is no openssh server installed.

I tried adding this into my product.yml (openembedded)

platform_package_overrides:
  openssh-server: openssh-sshd

but that does not seem to fix the problem for me. Is this supposed to work? I struggle a bit to find the documentation in how the platform_package_overrides actually works, or if I am missing something.

The only way I could get the tests to behave correctly was to modify the rules in linux_os and add to the vars list in the template, like:

template:
    name: package_installed
    vars:
        pkgname: openssh-server
        packagename@openembedded: openssh-sshd
        pkgname@openembedded: openssh-sshd

Is that the recommended approach? Feels like these overrides should be defined in the product and not the individual services/components.

If anyone could give some pointers to where I could find some more info on the topic, that would be highly appreciated

[dodys]

Basically you need both.
The changes to the rule.yml makes sure that you are passing the correct package name to the underlying bash, ansible and oval scripts. It should be only pkgname@openembedded: openssh-sshd
The changes to the product.yml in the platform_package_overrides, is to make sure that the tests pass when you have in the test file an entry like:
# packages=openssh-server

Let us know if you have still doubts.