feat: harden Jaguar Screen Waydroid with host SELinux

.gitattributes

@@ -1,5 +1,7 @@
 # Shell scripts: enforce LF (avoid CRLF syntax errors on target)
 *.sh text eol=lf
+# Unified-diff context lines intentionally contain a single trailing space.
+*.patch whitespace=-blank-at-eol
 
 *.pdf filter=lfs diff=lfs merge=lfs -text
 *.bin filter=lfs diff=lfs merge=lfs -text

.github/actionlint.yaml

@@ -1,3 +1,4 @@
 self-hosted-runner:
   labels:
     - yocto
+    - ai-tools

.github/workflows/layer-adoption-gate.yml

@@ -3,17 +3,23 @@ name: Layer Adoption Gate
 on:
   pull_request:
     branches: [main, develop]
+  merge_group:
+    types: [checks_requested]
   push:
     branches: [main, develop]
   workflow_dispatch:
     inputs:
       base_sha:
         description: Baseline commit to compare
         required: true
+      tuple_id:
+        description: One protected tuple to build for focused development
+        required: true
+        default: imx8mm-jaguar-screen-waydroid-image
 
 concurrency:
-  group: layer-adoption-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: layer-adoption-${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha || github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
 
 defaults:
   run:
@@ -22,7 +28,7 @@ defaults:
 jobs:
   detect:
     name: Detect material layer change
-    runs-on: [self-hosted, Linux, X64, yocto, ai-tools]
+    runs-on: [self-hosted, Linux, X64, yocto, dd-esl-proxmox]
     outputs:
       material: ${{ steps.detect.outputs.material }}
       base_sha: ${{ steps.base.outputs.sha }}
@@ -35,10 +41,11 @@ jobs:
         name: Resolve immutable baseline
         env:
           PR_BASE: ${{ github.event.pull_request.base.sha }}
+          MERGE_BASE: ${{ github.event.merge_group.base_sha }}
           PUSH_BASE: ${{ github.event.before }}
           INPUT_BASE: ${{ inputs.base_sha }}
         run: |
-          sha="${PR_BASE:-${INPUT_BASE:-${PUSH_BASE:-}}}"
+          sha="${PR_BASE:-${MERGE_BASE:-${INPUT_BASE:-${PUSH_BASE:-}}}}"
           if [ -z "$sha" ] || printf '%s' "$sha" | grep -Eq '^0+$'; then
             sha=$(git rev-parse HEAD^)
           fi
@@ -59,10 +66,14 @@ jobs:
             --base '${{ steps.base.outputs.sha }}' \
             --head '${{ github.sha }}' \
             --github-output "$GITHUB_OUTPUT"
-          tuple_ids=$(python3 -c 'import json; print(json.dumps([entry["id"] for entry in json.load(open("ci/layer-adoption-tuples.json"))["tuples"]], separators=(",", ":")))')
+          if [ '${{ github.event_name }}' = workflow_dispatch ]; then
+            tuple_ids=$(python3 -c 'import json,sys; ids=[entry["id"] for entry in json.load(open("ci/layer-adoption-tuples.json"))["tuples"]]; requested=sys.argv[1]; requested in ids or sys.exit(f"unknown protected tuple: {requested}"); print(json.dumps([requested],separators=(",",":")))' '${{ inputs.tuple_id }}')
+          else
+            tuple_ids=$(python3 -c 'import json; print(json.dumps([entry["id"] for entry in json.load(open("ci/layer-adoption-tuples.json"))["tuples"]], separators=(",", ":")))')
+          fi
           echo "tuple_ids=$tuple_ids" >> "$GITHUB_OUTPUT"
   regression:
-    name: Existing product regression (${{ matrix.tuple_id }})
+    name: ${{ github.event_name == 'workflow_dispatch' && 'Development validation — baseline comparison' || 'Product readiness validation — baseline comparison' }} (${{ matrix.tuple_id }})
     needs: detect
     if: needs.detect.outputs.material == 'true'
     strategy:
@@ -72,12 +83,12 @@ jobs:
     # Each tuple is an independent shard so one failure cannot hide later
     # product failures. The final Layer Adoption Gate remains the single
     # branch-protection contract, and local driver runs still cover all tuples.
-    runs-on: [self-hosted, Linux, X64, yocto, ai-tools]
+    runs-on: [self-hosted, Linux, X64, yocto, dd-esl-proxmox]
     container:
       image: ghcr.io/siemens/kas/kas@sha256:d989add57fc441fe9e27bb2dd6ed98c5597b44c807928e35a72dc1cfbdda9abe
-      # Match the dedicated ai-tools runner account so BitBake's root-user
-      # sanity check remains active and bind-mounted cache files stay writable.
-      options: --privileged --platform linux/amd64 --user 1002:1002 -v /home/ghrunner/yocto-layer-adoption:/var/cache/layer-adoption
+      # Match the dedicated DD registration on CT101 so BitBake's root-user
+      # sanity check remains active and the /yocto cache stays writable.
+      options: --privileged --platform linux/amd64 --user 999:995 -v /yocto/yocto-layer-adoption:/var/cache/layer-adoption
     env:
       LAYER_ADOPTION_CACHE: /var/cache/layer-adoption
     steps:
@@ -119,7 +130,7 @@ jobs:
             candidate/scripts/validation/generate-layer-adoption-test-keys.sh "$temporary"
             mv "$temporary" "$keys"
           fi
-      - name: Build and compare every protected tuple
+      - name: Build and compare selected protected tuple
         run: |
           python3 candidate/scripts/validation/run-layer-adoption-regression.py \
             --baseline baseline \
@@ -151,10 +162,10 @@ jobs:
           done
 
   required:
-    name: Layer Adoption Gate
+    name: ${{ github.event_name == 'workflow_dispatch' && 'Development Validation' || 'Layer Adoption Gate' }}
     needs: [detect, regression]
     if: always()
-    runs-on: [self-hosted, Linux, X64, yocto, ai-tools]
+    runs-on: [self-hosted, Linux, X64, yocto, dd-esl-proxmox]
     steps:
       - name: Enforce gate result
         env:

.gitignore

@@ -1,5 +1,6 @@
 # Build outputs and layers (these are downloaded by KAS)
 build/
+**/out/
 tmp/
 tmp-glibc/
 cache/

ci/layer-adoption-contract.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "reason": "Adopt the isolated NXP i.MX95 partner layer without changing any pre-existing Dynamic Devices build tuple.",
+  "reason": "Adopt the exact-pinned Scarthgap meta-selinux layer and enable enforcing host SELinux only for product-feature Android containers, while preserving every existing Foundries platform, signing, recovery and manufacturing tuple.",
   "baseline_repairs": [
     {
       "base_sha": "dda54409ee27e29612c01cc1ff0eb88233ca1da5",
@@ -19,7 +19,7 @@
         "recipes-bsp/upd72020x-load/upd72020x-load/LicenseRef-markusj-upd72020x-load",
         "recipes-bsp/upd72020x-load/upd72020x-load_git.bb"
       ],
-      "reason": "The immutable baseline has two stale U-Boot patch contexts, mishandles intentionally empty board-scripts packages, carries three product DTS files that no longer compile against the pinned kernel, and does not expose the Phasora loader's custom license text to SPDX generation. Build both sides with the focused eight-file backport while auditing the exact old-to-new submodule transition."
+      "reason": "The immutable mainline baseline has two stale U-Boot patch contexts, mishandles intentionally empty board-scripts packages, carries three product DTS files that no longer compile against the pinned kernel, and does not expose the Phasora loader's custom license text to SPDX generation. Build both sides with the focused eight-file backport; the candidate BSP must contain this exact repair commit before its product-specific changes."
     }
   ],
   "allowed_deltas": {}

ci/layer-adoption-tuples.json

@@ -1,7 +1,13 @@
 {
   "schema": 1,
+  "source": {
+    "repository": "https://source.foundries.io/factories/dynamic-devices/ci-scripts.git",
+    "commit": "520e5c11dede126bd1bd35184293c20addeda380",
+    "file": "factory-config.yml"
+  },
   "tuples": [
-    {"id": "imx8mm-jaguar-screen-image", "machine": "imx8mm-jaguar-screen", "distro": "lmp-dynamicdevices", "image": "lmp-factory-image", "config": "kas/lmp-dynamicdevices.yml", "product_features": "display flutter godot"},
-    {"id": "imx8mm-jaguar-screen-mfgtool", "machine": "imx8mm-jaguar-screen", "distro": "lmp-mfgtool", "image": "mfgtool-files", "config": "kas/lmp-dynamicdevices-mfgtool.yml", "product_features": ""}
+    {"id":"imx8mm-jaguar-screen-image","machine":"imx8mm-jaguar-screen","distro":"lmp-dynamicdevices","image":"lmp-factory-image","config":"kas/lmp-dynamicdevices.yml","product_features":"display flutter godot","variables":{}},
+    {"id":"imx8mm-jaguar-screen-mfgtool","machine":"imx8mm-jaguar-screen","distro":"lmp-mfgtool","image":"mfgtool-files","config":"kas/lmp-dynamicdevices-mfgtool.yml","product_features":"","variables":{}},
+    {"id":"imx8mm-jaguar-screen-waydroid-image","machine":"imx8mm-jaguar-screen","distro":"lmp-dynamicdevices","image":"lmp-factory-image","config":"kas/lmp-dynamicdevices.yml","product_features":"display android-container","variables":{"ACCEPT_FSL_EULA":"1","ASSEMBLE_SYSTEM_IMAGE":"0","DEV_MODE":"1","DOCKER_COMPOSE_APP":"1","PATCHTOOL":"git","WAYDROID_SELINUX_DEVELOPMENT_PERMISSIVE":"1","WAYDROID_SELINUX_POLICY_DISCOVERY":"1"}}
   ]
 }

conf/layer.conf

@@ -24,6 +24,7 @@ BBFILES_DYNAMIC += " \
   rust-bin-layer:${LAYERDIR}/bbappends/meta-rust-bin/*/*/*.bb rust-bin-layer:${LAYERDIR}/bbappends/meta-rust-bin/*/*/*.bbappend \
   meta-tensorflow:${LAYERDIR}/bbappends/meta-tensorflow/*/*/*.bbappend \
   nxp-zigbee-rcp:${LAYERDIR}/bbappends/meta-nxp-zigbee-rcp/*/*/*.bbappend \
+  selinux:${LAYERDIR}/dynamic-layers/selinux/recipes-*/*/*.bbappend \
 "
 
 LAYERDEPENDS_meta-dynamicdevices = "meta-lmp-base meta-dynamicdevices-bsp meta-dynamicdevices-distro"

demos/jaguar-waydroid-gpu-demo/README.md

@@ -0,0 +1,45 @@
+# Jaguar Waydroid GPU demo
+
+An offline OpenGL ES 2.0 starfield benchmark for the Jaguar Screen Waydroid
+image. It displays the renderer reported by Android, live FPS, and particle
+count. Tap the screen to cycle through 2,000, 10,000, 40,000, and 80,000
+particles.
+
+## Build
+
+```sh
+./build.sh
+```
+
+The build uses the latest Android SDK platform and build-tools installed under
+`ANDROID_SDK_ROOT` or `~/Android/Sdk`. It compiles directly with the SDK
+tools, so Gradle and network access are not required. The result is
+`out/jaguar-gpu-demo.apk`, signed with the standard local Android debug key.
+
+## Install on Jaguar Screen
+
+Run the Waydroid commands as the same `weston` user that owns the graphical
+session:
+
+```sh
+sudo -u weston env \
+  HOME=/var/rootdirs/home/weston \
+  XDG_RUNTIME_DIR=/run/user/63 \
+  DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/63/bus \
+  WAYLAND_DISPLAY=wayland-1 \
+  waydroid app install /tmp/jaguar-gpu-demo.apk
+
+sudo -u weston env \
+  HOME=/var/rootdirs/home/weston \
+  XDG_RUNTIME_DIR=/run/user/63 \
+  DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/63/bus \
+  WAYLAND_DISPLAY=wayland-1 \
+  waydroid app launch com.dynamicdevices.jaguargpu
+```
+
+The v1.0.0 bench baseline rendered 10,000 particles at approximately 13 fps at
+the panel's full 1920x1200 logical resolution. The overlay identified
+`Vivante GC600 rev 4653` and `OpenGL ES 2.0`.
+
+The APK uses only Android platform APIs and has no network permission or
+external runtime dependency.

demos/jaguar-waydroid-gpu-demo/app/src/main/AndroidManifest.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- SPDX-License-Identifier: GPL-3.0-only -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.dynamicdevices.jaguargpu">
+    <uses-feature android:glEsVersion="0x00020000" android:required="true" />
+    <application
+        android:theme="@android:style/Theme.Material.NoActionBar"
+        android:label="Jaguar GPU Drive"
+        android:allowBackup="false"
+        android:supportsRtl="true">
+        <activity
+            android:name=".MainActivity"
+            android:screenOrientation="landscape"
+            android:configChanges="orientation|screenSize"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>