From 691db781205184efba350ab24eae6871dad23796 Mon Sep 17 00:00:00 2001
From: Alex J Lennon <ajlenon@dynamicdevices.co.uk>
Date: Mon, 9 Feb 2026 00:11:36 +0000
Subject: [PATCH 01/27] Update release support: whinlatter, remove EOL branches

- README: remove walnascar (5.2, EOL Nov 2025) and styhead (5.1, EOL),
  add whinlatter (5.3, supported until May 2026), fix kirkstone LTS
  date to Apr. 2026, update status date to Feb 2026
- layer.conf: update LAYERSERIES_COMPAT_mono from styhead to whinlatter
- CI: test against whinlatter poky instead of styhead, remove
  feature/yocto-layer-compliance branch triggers (merged)

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/CI_github.yml | 8 +++-----
 README.md                       | 9 ++++-----
 conf/layer.conf                 | 2 +-
 3 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index bd050ec..7bac31a 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches:
       - master
-      - feature/yocto-layer-compliance
   pull_request:
     branches:
       - master
-      - feature/yocto-layer-compliance
     paths-ignore:
       - "**.md"
 jobs:
@@ -23,11 +21,11 @@ jobs:
       matrix:
         dotnet_version: [10.0.100, 8.0.406, 6.0.428]
         mono_version: [6.12.0.206]
-        branch: [styhead]
+        branch: [whinlatter]
         arch: [x86-64, arm, arm64]
         exclude:
-          # styhead GCC build broken for ARM32 - see README "Removal of support for ARM32" and discussions/234
-          - branch: styhead
+          # GCC build broken for ARM32 - see README and discussions/234
+          - branch: whinlatter
             arch: arm
     env:
       name: build-and-test
diff --git a/README.md b/README.md
index 2d192ee..ffd4efe 100644
--- a/README.md
+++ b/README.md
@@ -6,12 +6,11 @@ meta-mono is an OpenEmbedded layer that builds dotNet, the mono runtime and mono
 
 | Branch | Version | Support Status* | Status of Build & Tests |
 | ------ | ------- | --------------- | ----------------------- |
-| walnascar | 5.2	| Future (April 2025) | [![walnascar](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=walnascar&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
-| styhead   | 5.1	| Support for 7 months (May 2025) | [![styhead](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=styhead&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
-| scarthgap | 5.0	| Long Term Support (until Apr. 2028) | [![scarthgap](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=scarthgap&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
-| kirkstone | 4.0	| Long Term Support (minimum Apr. 2024)	 | [![kirkstone](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=kirkstone&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
+| whinlatter | 5.3 | Support for 6 months (until May 2026) | [![whinlatter](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=whinlatter&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
+| scarthgap | 5.0 | Long Term Support (until Apr. 2028) | [![scarthgap](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=scarthgap&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
+| kirkstone | 4.0 | Long Term Support (until Apr. 2026) | [![kirkstone](https://img.shields.io/github/actions/workflow/status/dynamicdevices/meta-mono/CI_github.yml?branch=kirkstone&label=build%20%26%20test)](https://github.com/DynamicDevices/meta-mono/actions/workflows/CI_github.yml) |
 
-*support status as of 21/03/25, follows main Yocto release support schedule [here](https://wiki.yoctoproject.org/wiki/Releases)
+*support status as of Feb 2026, follows main Yocto release support schedule [here](https://wiki.yoctoproject.org/wiki/Releases)
 
 ## Limitations
 
diff --git a/conf/layer.conf b/conf/layer.conf
index 61f503d..8457ce4 100644
--- a/conf/layer.conf
+++ b/conf/layer.conf
@@ -30,4 +30,4 @@ INSANE_SKIP:msbuild-dev += "buildpaths"
 INSANE_SKIP:python3-clr-loader += "buildpaths"
 INSANE_SKIP:python3-pythonnet += "buildpaths"
 
-LAYERSERIES_COMPAT_mono = "styhead"
+LAYERSERIES_COMPAT_mono = "whinlatter"

From ff62223e3791ac03cfbf0f004faac83cf4ce21ce Mon Sep 17 00:00:00 2001
From: Alex J Lennon <ajlenon@dynamicdevices.co.uk>
Date: Mon, 9 Feb 2026 00:13:32 +0000
Subject: [PATCH 02/27] CI: trigger builds on whinlatter branch

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/CI_github.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 7bac31a..7ec61a2 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - master
+      - whinlatter
   pull_request:
     branches:
       - master
+      - whinlatter
     paths-ignore:
       - "**.md"
 jobs:

From 1ea81fe96462f4ec52c6a2aa4df659356723d03c Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 12:51:16 +0000
Subject: [PATCH 03/27] wrynose,fix: assignment warnings

Signed-off-by: Marian Cingel <cingel.marian@gmail.com>
---
 recipes-mono/dotnet/dotnet.inc        | 2 +-
 recipes-mono/mono-xsp/mono-xsp_git.bb | 2 +-
 recipes-mono/mono/mono-4.xx.inc       | 2 +-
 recipes-mono/mono/mono-5.xx.inc       | 2 +-
 recipes-mono/mono/mono-6.xx.inc       | 2 +-
 recipes-mono/mono/mono-git.inc        | 2 +-
 recipes-mono/nuget/nuget.inc          | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/recipes-mono/dotnet/dotnet.inc b/recipes-mono/dotnet/dotnet.inc
index f20f8ce..856c038 100644
--- a/recipes-mono/dotnet/dotnet.inc
+++ b/recipes-mono/dotnet/dotnet.inc
@@ -120,7 +120,7 @@ mkdir -p "$HOME" 2>/dev/null || true
 export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=true
 export DOTNET_CLI_TELEMETRY_OPTOUT=1
 export DOTNET_NOLOGO=1
-SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
+SELF_DIR = "$(cd "$(dirname "$0")" && pwd)"
 exec "${SELF_DIR}/../share/dotnet/dotnet" "$@"
 WRAPPER
     chmod 0755 ${D}${bindir}/dotnet
diff --git a/recipes-mono/mono-xsp/mono-xsp_git.bb b/recipes-mono/mono-xsp/mono-xsp_git.bb
index 7def468..09a74f6 100644
--- a/recipes-mono/mono-xsp/mono-xsp_git.bb
+++ b/recipes-mono/mono-xsp/mono-xsp_git.bb
@@ -1,6 +1,6 @@
 require mono-xsp-3.x.inc
 
-SRCREV= "e272a2c006211b6b03be2ef5bbb9e3f8fefd0768"
+SRCREV = "e272a2c006211b6b03be2ef5bbb9e3f8fefd0768"
 SRC_URI = "git://github.com/mono/xsp.git;branch=main;protocol=https \
 	  "
 
diff --git a/recipes-mono/mono/mono-4.xx.inc b/recipes-mono/mono/mono-4.xx.inc
index fef220c..c7a6c5a 100644
--- a/recipes-mono/mono/mono-4.xx.inc
+++ b/recipes-mono/mono/mono-4.xx.inc
@@ -94,4 +94,4 @@ FILES:${PN}-staticdev			+= " ${libdir}/*.a"
 RDEPENDS:${PN}-dev =+ "bash"
 
 # Workaround for observed race in `make install`
-PARALLEL_MAKEINST=""
+PARALLEL_MAKEINST = ""
diff --git a/recipes-mono/mono/mono-5.xx.inc b/recipes-mono/mono/mono-5.xx.inc
index 46c69e8..b7054c0 100644
--- a/recipes-mono/mono/mono-5.xx.inc
+++ b/recipes-mono/mono/mono-5.xx.inc
@@ -106,7 +106,7 @@ RDEPENDS:${PN}-dev =+ "bash"
 RDEPENDS:${PN}-libs =+ "zlib"
 
 # Workaround for observed race in `make install`
-PARALLEL_MAKEINST=""
+PARALLEL_MAKEINST = ""
 
 # Otherwise the full path to bash is written to the first line of doltlibtool script
 # which causes build failures with deeply nested build directories
diff --git a/recipes-mono/mono/mono-6.xx.inc b/recipes-mono/mono/mono-6.xx.inc
index 71b5bfc..09c5804 100644
--- a/recipes-mono/mono/mono-6.xx.inc
+++ b/recipes-mono/mono/mono-6.xx.inc
@@ -127,7 +127,7 @@ INSANE_SKIP:${PN}-xbuild		= "file-rdeps"
 INSANE_SKIP:${PN}-configuration-crypto	= "file-rdeps"
 
 # Workaround for observed race in `make install`
-PARALLEL_MAKEINST=""
+PARALLEL_MAKEINST = ""
 
 # Otherwise the full path to bash is written to the first line of doltlibtool script
 # which causes build failures with deeply nested build directories
diff --git a/recipes-mono/mono/mono-git.inc b/recipes-mono/mono/mono-git.inc
index 5bc1aa3..fb6a635 100644
--- a/recipes-mono/mono/mono-git.inc
+++ b/recipes-mono/mono/mono-git.inc
@@ -83,4 +83,4 @@ FILES:${PN}-profiler			+= " ${datadir}/mono-2.0/mono/profiler/*"
 RDEPENDS:${PN} =+ "bash" 
 
 # Workaround for observed race in `make install`
-PARALLEL_MAKEINST=""
+PARALLEL_MAKEINST = ""
diff --git a/recipes-mono/nuget/nuget.inc b/recipes-mono/nuget/nuget.inc
index bc2a7ce..22bad44 100644
--- a/recipes-mono/nuget/nuget.inc
+++ b/recipes-mono/nuget/nuget.inc
@@ -4,7 +4,7 @@ LIC_FILES_CHKSUM = "file://Apache-LICENSE-2.0.txt;md5=3b83ef96387f14655fc854ddc3
 HOMEPAGE = "http://nuget.org/"
 
 # This package ships Mono EXE and a shell script
-PACKAGE_ARCH="all"
+PACKAGE_ARCH = "all"
 
 # Fully updated Fedora 33 and 34 say that dist.nuget.org cert is untrusted
 BB_CHECK_SSL_CERTS = "0"

From 31547b21f48d07c8d3d613730afb09dc1d00ae6d Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 12:51:50 +0000
Subject: [PATCH 04/27] wrynose,fix: error in do_unpack, "Recipes that set S =
 ${UNPACK_DIR}/git"

Signed-off-by: Marian Cingel <cingel.marian@gmail.com>
---
 recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb                  | 2 +-
 recipes-mono/libgdiplus/libgdiplus-common.inc                | 2 +-
 recipes-mono/mono-addins/mono-addins-xbuild.inc              | 2 +-
 recipes-mono/mono-addins/mono-addins.inc                     | 2 +-
 recipes-mono/mono-helloworld/mono-helloworld_git.bb.disabled | 2 +-
 recipes-mono/mono-upnp/mono-upnp.inc                         | 2 +-
 recipes-mono/mono-xsp/mono-xsp_git.bb                        | 2 +-
 recipes-mono/mono/mono-6.12.0.206.inc                        | 2 +-
 recipes-mono/mono/mono-git.inc                               | 2 +-
 recipes-mono/msbuild/msbuild_16.10.1.bb                      | 2 +-
 recipes-mono/taglib-sharp/taglib-sharp.inc                   | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
index 11542a1..8a21ea1 100644
--- a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
+++ b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
@@ -11,7 +11,7 @@ SRCREV = "9a72bb67fff7e4845b7bb430a608282668c3e4da"
 SRC_URI = "git://github.com/mono/gtk-sharp.git;protocol=https;branch=master \
            file://0001-fixup-gmcs-to-mcs.patch"
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 do_configure:prepend() {
   export PROFILER_CFLAGS="-D_REENTRANT -I${STAGING_DIR_TARGET}/usr/include/glib-2.0 -I${STAGING_DIR_TARGET}/usr/lib/glib-2.0 -I${STAGING_DIR_TARGET}/usr/lib/glib-2.0/include -I${STAGING_DIR_TARGET}/usr/include/mono-2.0"
diff --git a/recipes-mono/libgdiplus/libgdiplus-common.inc b/recipes-mono/libgdiplus/libgdiplus-common.inc
index 33db327..db93cf7 100644
--- a/recipes-mono/libgdiplus/libgdiplus-common.inc
+++ b/recipes-mono/libgdiplus/libgdiplus-common.inc
@@ -11,7 +11,7 @@ SRC_URI = " \
 	gitsm://github.com/mono/libgdiplus.git;protocol=https;branch=${BRANCH} \
 "
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 inherit autotools pkgconfig
 
diff --git a/recipes-mono/mono-addins/mono-addins-xbuild.inc b/recipes-mono/mono-addins/mono-addins-xbuild.inc
index 21bda78..f0af567 100644
--- a/recipes-mono/mono-addins/mono-addins-xbuild.inc
+++ b/recipes-mono/mono-addins/mono-addins-xbuild.inc
@@ -13,7 +13,7 @@ SRCBRANCH = "master"
 
 SRC_URI = "git://github.com/mono/mono-addins.git;protocol=https;branch=${SRCBRANCH}"
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 do_configure() {
 }
diff --git a/recipes-mono/mono-addins/mono-addins.inc b/recipes-mono/mono-addins/mono-addins.inc
index a1ad840..9472c32 100644
--- a/recipes-mono/mono-addins/mono-addins.inc
+++ b/recipes-mono/mono-addins/mono-addins.inc
@@ -14,7 +14,7 @@ SRCBRANCH = "master"
 SRC_URI = "git://github.com/mono/mono-addins.git;protocol=https;branch=${SRCBRANCH} \
 	   file://0001-configure-mcs.patch"
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 inherit autotools-brokensep pkgconfig
 inherit mono
diff --git a/recipes-mono/mono-helloworld/mono-helloworld_git.bb.disabled b/recipes-mono/mono-helloworld/mono-helloworld_git.bb.disabled
index 0dbab57..782f311 100644
--- a/recipes-mono/mono-helloworld/mono-helloworld_git.bb.disabled
+++ b/recipes-mono/mono-helloworld/mono-helloworld_git.bb.disabled
@@ -2,4 +2,4 @@ require mono-helloworld.inc
 
 SRCREV = "${AUTOREV}"
 SRC_URI =  "git://github.com/DynamicDevices/mono-helloworld.git" 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
diff --git a/recipes-mono/mono-upnp/mono-upnp.inc b/recipes-mono/mono-upnp/mono-upnp.inc
index 1cd3b7e..2b0fae7 100644
--- a/recipes-mono/mono-upnp/mono-upnp.inc
+++ b/recipes-mono/mono-upnp/mono-upnp.inc
@@ -16,7 +16,7 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}-${PV}:"
 SRC_URI = "git://github.com/mono/mono-upnp.git;protocol=https;branch=${SRCBRANCH} \
 "
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 inherit autotools-brokensep pkgconfig
 
diff --git a/recipes-mono/mono-xsp/mono-xsp_git.bb b/recipes-mono/mono-xsp/mono-xsp_git.bb
index 09a74f6..d71095e 100644
--- a/recipes-mono/mono-xsp/mono-xsp_git.bb
+++ b/recipes-mono/mono-xsp/mono-xsp_git.bb
@@ -4,4 +4,4 @@ SRCREV = "e272a2c006211b6b03be2ef5bbb9e3f8fefd0768"
 SRC_URI = "git://github.com/mono/xsp.git;branch=main;protocol=https \
 	  "
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
diff --git a/recipes-mono/mono/mono-6.12.0.206.inc b/recipes-mono/mono/mono-6.12.0.206.inc
index b444171..923fc02 100644
--- a/recipes-mono/mono/mono-6.12.0.206.inc
+++ b/recipes-mono/mono/mono-6.12.0.206.inc
@@ -1,3 +1,3 @@
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 DEPENDS += " cmake-native"
diff --git a/recipes-mono/mono/mono-git.inc b/recipes-mono/mono/mono-git.inc
index fb6a635..c6aca51 100644
--- a/recipes-mono/mono/mono-git.inc
+++ b/recipes-mono/mono/mono-git.inc
@@ -23,7 +23,7 @@ SRC_URI = "git://github.com/mono/mono.git;branch=${SRCBRANCH}\
 #	   file://0001-reintroduce-gmcs.patch \
 #
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 FILESPATH =. "${FILE_DIRNAME}/mono-4.xx:"
 FILESPATH =. "${FILE_DIRNAME}/mono-${PV}:"
diff --git a/recipes-mono/msbuild/msbuild_16.10.1.bb b/recipes-mono/msbuild/msbuild_16.10.1.bb
index 322cfc1..1a79e9c 100644
--- a/recipes-mono/msbuild/msbuild_16.10.1.bb
+++ b/recipes-mono/msbuild/msbuild_16.10.1.bb
@@ -21,7 +21,7 @@ SRC_URI = "git://github.com/mono/linux-packaging-msbuild.git;branch=main;protoco
            file://0001-Copy-hostfxr.patch \
            "
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 do_configure () {
     sed "s|%libhostfxr%|${STAGING_DIR_TARGET}${libdir}/libhostfxr.so|g" -i ${S}/eng/cibuild_bootstrapped_msbuild.sh
diff --git a/recipes-mono/taglib-sharp/taglib-sharp.inc b/recipes-mono/taglib-sharp/taglib-sharp.inc
index bc5fc05..474dbe6 100644
--- a/recipes-mono/taglib-sharp/taglib-sharp.inc
+++ b/recipes-mono/taglib-sharp/taglib-sharp.inc
@@ -10,7 +10,7 @@ DEPENDS = "mono"
 
 SRC_URI = "git://github.com/mono/taglib-sharp.git;protocol=https;branch=${SRCBRANCH}"
 
-S = "${UNPACKDIR}/git"
+S = "${UNPACKDIR}/${BP}"
 
 inherit autotools-brokensep pkgconfig
 

From c4c1da7fa9a64eafe5f1cea47adfeffa110ae234 Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 12:53:26 +0000
Subject: [PATCH 05/27] wrynose,fix: remove libglade dependency

---
 recipes-mono/gtk-sharp/gtk-sharp-native_2.12.45.bb | 2 +-
 recipes-mono/gtk-sharp/gtk-sharp3_2.99.3.bb        | 2 +-
 recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/recipes-mono/gtk-sharp/gtk-sharp-native_2.12.45.bb b/recipes-mono/gtk-sharp/gtk-sharp-native_2.12.45.bb
index 4a90d78..5fef150 100644
--- a/recipes-mono/gtk-sharp/gtk-sharp-native_2.12.45.bb
+++ b/recipes-mono/gtk-sharp/gtk-sharp-native_2.12.45.bb
@@ -2,7 +2,7 @@ require gtk-sharp.inc
 
 inherit pkgconfig native
 
-DEPENDS += " gtk+-native atk-native pango-native cairo-native glib-2.0-native libglade-native "
+DEPENDS += " gtk+-native atk-native pango-native cairo-native glib-2.0-native "
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=7fbc338309ac38fefcd64b04bb903e34"
 
diff --git a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.3.bb b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.3.bb
index 892c08d..f2083b6 100644
--- a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.3.bb
+++ b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.3.bb
@@ -2,7 +2,7 @@ require gtk-sharp.inc
 
 inherit pkgconfig
 
-DEPENDS += " gtk+3 atk pango cairo glib-2.0 libglade mono"
+DEPENDS += " gtk+3 atk pango cairo glib-2.0 mono"
 RDEPENDS:${PN} += " perl gtk+3"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=8754deb904d22254188cb67189b87f19"
diff --git a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
index 8a21ea1..e444ab9 100644
--- a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
+++ b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
@@ -2,7 +2,7 @@ require gtk-sharp.inc
 
 inherit pkgconfig
 
-DEPENDS += " gtk+3 atk pango cairo glib-2.0 libglade mono"
+DEPENDS += " gtk+3 atk pango cairo glib-2.0 mono"
 RDEPENDS:${PN} += " perl gtk+3"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=8754deb904d22254188cb67189b87f19"

From 972c588b17880b3a44951c04431bf9d951a54bc9 Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 13:13:37 +0000
Subject: [PATCH 06/27] wrynose: update layer compatibility string

---
 conf/layer.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/layer.conf b/conf/layer.conf
index 8457ce4..24794f1 100644
--- a/conf/layer.conf
+++ b/conf/layer.conf
@@ -30,4 +30,4 @@ INSANE_SKIP:msbuild-dev += "buildpaths"
 INSANE_SKIP:python3-clr-loader += "buildpaths"
 INSANE_SKIP:python3-pythonnet += "buildpaths"
 
-LAYERSERIES_COMPAT_mono = "whinlatter"
+LAYERSERIES_COMPAT_mono = "wrynose"

From 2dc93d5cbae6059e09b3c1659edc3989dde35ba6 Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 13:16:08 +0000
Subject: [PATCH 07/27] wrynose,fix: cmake compatibility

---
 .../0001-Btls-too-old-cmake-version.patch     | 30 +++++++++++++++++++
 .../boringssl-cmake-version.diff              | 10 +++++++
 recipes-mono/mono/mono-native_6.12.0.206.bb   |  2 ++
 recipes-mono/mono/mono_6.12.0.206.bb          |  2 ++
 4 files changed, 44 insertions(+)
 create mode 100644 recipes-mono/mono/mono-6.12.0.206/0001-Btls-too-old-cmake-version.patch
 create mode 100644 recipes-mono/mono/mono-6.12.0.206/boringssl-cmake-version.diff

diff --git a/recipes-mono/mono/mono-6.12.0.206/0001-Btls-too-old-cmake-version.patch b/recipes-mono/mono/mono-6.12.0.206/0001-Btls-too-old-cmake-version.patch
new file mode 100644
index 0000000..0ea0c66
--- /dev/null
+++ b/recipes-mono/mono/mono-6.12.0.206/0001-Btls-too-old-cmake-version.patch
@@ -0,0 +1,30 @@
+From ba1b408ff40e3770785a7774f2bf88758a33a49d Mon Sep 17 00:00:00 2001
+From: Marian Cingel <cingel.marian@gmail.com>
+Date: Mon, 18 May 2026 20:12:28 +0000
+Subject: [PATCH] Btls - too old cmake version
+
+Upstream-Status: Pending
+---
+ mono/btls/CMakeLists.txt | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mono/btls/CMakeLists.txt b/mono/btls/CMakeLists.txt
+index 992f41e4c7f..012b6d12669 100644
+--- a/mono/btls/CMakeLists.txt
++++ b/mono/btls/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 2.8.10)
++cmake_minimum_required (VERSION 4.0)
+ 
+ project (mono-btls)
+ 
+@@ -129,4 +129,4 @@ endif ()
+ 
+ if (CYGWIN)
+ 	target_link_libraries (mono-btls-shared wsock32 ws2_32)
+-endif ()
+\ No newline at end of file
++endif ()
+-- 
+2.53.0
+
diff --git a/recipes-mono/mono/mono-6.12.0.206/boringssl-cmake-version.diff b/recipes-mono/mono/mono-6.12.0.206/boringssl-cmake-version.diff
new file mode 100644
index 0000000..d7871a3
--- /dev/null
+++ b/recipes-mono/mono/mono-6.12.0.206/boringssl-cmake-version.diff
@@ -0,0 +1,10 @@
+Upstream-Status: Inappropriate [Yocto specific]
+
+--- mono-6.12.0.206/external/boringssl/CMakeLists.txt.orig	2026-05-18 22:51:14.239405666 +0000
++++ mono-6.12.0.206/external/boringssl/CMakeLists.txt	2026-05-18 22:51:21.634960290 +0000
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 2.8.10)
++cmake_minimum_required (VERSION 4.0)
+ 
+ # Defer enabling C and CXX languages.
+ project (BoringSSL NONE)
diff --git a/recipes-mono/mono/mono-native_6.12.0.206.bb b/recipes-mono/mono/mono-native_6.12.0.206.bb
index d9e65b0..5018293 100644
--- a/recipes-mono/mono/mono-native_6.12.0.206.bb
+++ b/recipes-mono/mono/mono-native_6.12.0.206.bb
@@ -12,6 +12,8 @@ SRC_URI = "gitsm://github.com/mono/mono.git;protocol=https;branch=2020-02 \
            file://shm_open-test-crosscompile.diff \
            file://disable-mmap-MAP_32BIT-support.patch \
            file://0001-Allow-passing-external-mapfile-C-build-options.patch \
+           file://0001-Btls-too-old-cmake-version.patch \
+           file://boringssl-cmake-version.diff \
 "
 
 addtask fixup_config after do_patch before do_configure
diff --git a/recipes-mono/mono/mono_6.12.0.206.bb b/recipes-mono/mono/mono_6.12.0.206.bb
index 2bf2963..99c9620 100644
--- a/recipes-mono/mono/mono_6.12.0.206.bb
+++ b/recipes-mono/mono/mono_6.12.0.206.bb
@@ -12,6 +12,8 @@ SRC_URI = "gitsm://github.com/mono/mono.git;protocol=https;branch=2020-02 \
            file://disable-mmap-MAP_32BIT-support.patch \
            file://0001-Allow-passing-external-mapfile-C-build-options.patch \
            file://0001-Add-libusb-1.0-mapping.patch \
+           file://0001-Btls-too-old-cmake-version.patch \
+           file://boringssl-cmake-version.diff \
 "
 
 

From 4a7d2ee249029fb30881d3376e2d8ae1c9797226 Mon Sep 17 00:00:00 2001
From: Marian Cingel <cingel.marian@gmail.com>
Date: Sun, 12 Jul 2026 16:27:40 +0000
Subject: [PATCH 08/27] wrynose,fix: replace nonexisting 'master' branch with
 'main'

- suppress github archive QA issue
- fix Upstream-Status in patches

Signed-off-by: Marian Cingel <cingel.marian@gmail.com>
---
 recipes-mono/dbus-sharp-glib/dbus-sharp-glib.inc               | 2 ++
 recipes-mono/dbus-sharp/dbus-sharp.inc                         | 3 +++
 recipes-mono/fsharp/fsharp.inc                                 | 3 +++
 recipes-mono/fsharp/fsharp_3.1.2.4.bb                          | 2 +-
 recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb                    | 3 ++-
 .../mono-addins/mono-addins-1.1/0001-configure-mcs.patch       | 2 ++
 recipes-mono/mono-addins/mono-addins-xbuild.inc                | 2 +-
 recipes-mono/mono-addins/mono-addins.inc                       | 2 +-
 recipes-mono/mono-addins/mono-addins_1.1.bb                    | 2 +-
 recipes-mono/mono-basic/mono-basic-4.xx.inc                    | 3 +++
 recipes-mono/mono-upnp/mono-upnp-0.1.2/0001-fixup-build.patch  | 2 ++
 .../mono-upnp/mono-upnp-0.1.2/0002-configure-use-mcs.patch     | 2 +-
 recipes-mono/mono/mono-git.inc                                 | 2 +-
 recipes-mono/taglib-sharp/taglib-sharp_2.1.0.0.bb              | 2 +-
 14 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/recipes-mono/dbus-sharp-glib/dbus-sharp-glib.inc b/recipes-mono/dbus-sharp-glib/dbus-sharp-glib.inc
index 8f1ef59..f507fdf 100644
--- a/recipes-mono/dbus-sharp-glib/dbus-sharp-glib.inc
+++ b/recipes-mono/dbus-sharp-glib/dbus-sharp-glib.inc
@@ -25,3 +25,5 @@ do_configure:prepend() {
   export DBUS_SHARP_LIBS="/r:${STAGING_LIBDIR}/mono/dbus-sharp-2.0/dbus-sharp.dll"
 }
 
+# suppress: SRC_URI uses unstable GitHub/GitLab archives
+INSANE_SKIP += "src-uri-bad"
diff --git a/recipes-mono/dbus-sharp/dbus-sharp.inc b/recipes-mono/dbus-sharp/dbus-sharp.inc
index 603f261..2fba32c 100644
--- a/recipes-mono/dbus-sharp/dbus-sharp.inc
+++ b/recipes-mono/dbus-sharp/dbus-sharp.inc
@@ -9,3 +9,6 @@ inherit pkgconfig
 inherit mono
 
 SRC_URI = "https://github.com/mono/dbus-sharp/archive/v${PV}.tar.gz"
+
+# suppress: SRC_URI uses unstable GitHub/GitLab archives
+INSANE_SKIP += "src-uri-bad"
diff --git a/recipes-mono/fsharp/fsharp.inc b/recipes-mono/fsharp/fsharp.inc
index 35e555a..0b630dc 100644
--- a/recipes-mono/fsharp/fsharp.inc
+++ b/recipes-mono/fsharp/fsharp.inc
@@ -17,3 +17,6 @@ FILES:${PN} += "\
   ${libdir}/mono/gac/*/*/*.optdata \
   ${libdir}/mono/gac/*/*/*.sigdata \
 "
+
+# suppress: SRC_URI uses unstable GitHub/GitLab archives
+INSANE_SKIP += "src-uri-bad"
diff --git a/recipes-mono/fsharp/fsharp_3.1.2.4.bb b/recipes-mono/fsharp/fsharp_3.1.2.4.bb
index e0dfe0e..f48ad13 100644
--- a/recipes-mono/fsharp/fsharp_3.1.2.4.bb
+++ b/recipes-mono/fsharp/fsharp_3.1.2.4.bb
@@ -2,4 +2,4 @@ require fsharp.inc
 
 inherit pkgconfig
 
-SRC_URI[sha256sum] = "cf3b5ea00fd13b9d35f5a4ffec6fbd8cecc2c4039d09a79fb0e3f7fa48da9429"
+SRC_URI[sha256sum] = "d846a4e0c8fb0186cc89445a4c1108f4ae683bd14da834a05634e316b233d61b"
diff --git a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
index e444ab9..49cb5ec 100644
--- a/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
+++ b/recipes-mono/gtk-sharp/gtk-sharp3_2.99.4.bb
@@ -8,10 +8,11 @@ RDEPENDS:${PN} += " perl gtk+3"
 LIC_FILES_CHKSUM = "file://COPYING;md5=8754deb904d22254188cb67189b87f19"
 
 SRCREV = "9a72bb67fff7e4845b7bb430a608282668c3e4da"
-SRC_URI = "git://github.com/mono/gtk-sharp.git;protocol=https;branch=master \
+SRC_URI = "git://github.com/mono/gtk-sharp.git;protocol=https;branch=main \
            file://0001-fixup-gmcs-to-mcs.patch"
 
 S = "${UNPACKDIR}/${BP}"
+TARGET_CFLAGS:append = " -Wno-error=implicit-function-declaration"
 
 do_configure:prepend() {
   export PROFILER_CFLAGS="-D_REENTRANT -I${STAGING_DIR_TARGET}/usr/include/glib-2.0 -I${STAGING_DIR_TARGET}/usr/lib/glib-2.0 -I${STAGING_DIR_TARGET}/usr/lib/glib-2.0/include -I${STAGING_DIR_TARGET}/usr/include/mono-2.0"
diff --git a/recipes-mono/mono-addins/mono-addins-1.1/0001-configure-mcs.patch b/recipes-mono/mono-addins/mono-addins-1.1/0001-configure-mcs.patch
index 3c74b6d..e3c4345 100644
--- a/recipes-mono/mono-addins/mono-addins-1.1/0001-configure-mcs.patch
+++ b/recipes-mono/mono-addins/mono-addins-1.1/0001-configure-mcs.patch
@@ -1,3 +1,5 @@
+Upstream-Status: Inappropriate [Yocto specific]
+
 diff -ur git.org/configure.ac git/configure.ac
 --- git.org/configure.ac	2015-07-20 11:50:50.151627671 +0100
 +++ git/configure.ac	2015-07-20 11:51:28.275628204 +0100
diff --git a/recipes-mono/mono-addins/mono-addins-xbuild.inc b/recipes-mono/mono-addins/mono-addins-xbuild.inc
index f0af567..4d376dc 100644
--- a/recipes-mono/mono-addins/mono-addins-xbuild.inc
+++ b/recipes-mono/mono-addins/mono-addins-xbuild.inc
@@ -9,7 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4e024d772d8266e3ff9747185842ca82"
 DEPENDS = "mono"
 
 SRCREV = "64a45d96f39d4714ec85adf0fe04b68ec7273ae1"
-SRCBRANCH = "master"
+SRCBRANCH = "main"
 
 SRC_URI = "git://github.com/mono/mono-addins.git;protocol=https;branch=${SRCBRANCH}"
 
diff --git a/recipes-mono/mono-addins/mono-addins.inc b/recipes-mono/mono-addins/mono-addins.inc
index 9472c32..59def24 100644
--- a/recipes-mono/mono-addins/mono-addins.inc
+++ b/recipes-mono/mono-addins/mono-addins.inc
@@ -9,7 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4e024d772d8266e3ff9747185842ca82"
 DEPENDS = "gtk-sharp"
 
 SRCREV = "64a45d96f39d4714ec85adf0fe04b68ec7273ae1"
-SRCBRANCH = "master"
+SRCBRANCH = "main"
 
 SRC_URI = "git://github.com/mono/mono-addins.git;protocol=https;branch=${SRCBRANCH} \
 	   file://0001-configure-mcs.patch"
diff --git a/recipes-mono/mono-addins/mono-addins_1.1.bb b/recipes-mono/mono-addins/mono-addins_1.1.bb
index 85f9d24..b16f785 100644
--- a/recipes-mono/mono-addins/mono-addins_1.1.bb
+++ b/recipes-mono/mono-addins/mono-addins_1.1.bb
@@ -1,5 +1,5 @@
 require mono-addins.inc
 
 SRCREV = "64a45d96f39d4714ec85adf0fe04b68ec7273ae1"
-SRCBRANCH = "master"
+SRCBRANCH = "main"
 
diff --git a/recipes-mono/mono-basic/mono-basic-4.xx.inc b/recipes-mono/mono-basic/mono-basic-4.xx.inc
index 36c45e2..b445635 100644
--- a/recipes-mono/mono-basic/mono-basic-4.xx.inc
+++ b/recipes-mono/mono-basic/mono-basic-4.xx.inc
@@ -19,3 +19,6 @@ do_install:append() {
  install -d "${D}${libdir}/mono/4.5"
  ln -sf ${libdir}/mono/4.0/Microsoft.VisualBasic.dll  ${D}${libdir}/mono/4.5/Microsoft.VisualBasic.dll
 }
+
+# suppress: SRC_URI uses unstable GitHub/GitLab archives
+INSANE_SKIP += "src-uri-bad"
diff --git a/recipes-mono/mono-upnp/mono-upnp-0.1.2/0001-fixup-build.patch b/recipes-mono/mono-upnp/mono-upnp-0.1.2/0001-fixup-build.patch
index 8256699..f0fd538 100644
--- a/recipes-mono/mono-upnp/mono-upnp-0.1.2/0001-fixup-build.patch
+++ b/recipes-mono/mono-upnp/mono-upnp-0.1.2/0001-fixup-build.patch
@@ -1,3 +1,5 @@
+Upstream-Status: Inappropriate [Yocto specific]
+
 diff -ur git.org/Makefile.am git/Makefile.am
 --- git.org/Makefile.am	2014-05-17 17:18:41.627941046 +0100
 +++ git/Makefile.am	2014-05-17 17:23:49.583941850 +0100
diff --git a/recipes-mono/mono-upnp/mono-upnp-0.1.2/0002-configure-use-mcs.patch b/recipes-mono/mono-upnp/mono-upnp-0.1.2/0002-configure-use-mcs.patch
index d290312..4a75f8b 100644
--- a/recipes-mono/mono-upnp/mono-upnp-0.1.2/0002-configure-use-mcs.patch
+++ b/recipes-mono/mono-upnp/mono-upnp-0.1.2/0002-configure-use-mcs.patch
@@ -2,7 +2,7 @@ mono-upnp: use mcs instead of gmcs
 
 as gmcs not present in recent mono releases
 
-Upstream-status: Submitted [https://github.com/mono/mono-upnp/pull/7]
+Upstream-Status: Submitted [https://github.com/mono/mono-upnp/pull/7]
 
 diff -ur git.org/configure.ac git/configure.ac
 --- git.org/configure.ac	2015-07-20 16:03:01.899839044 +0100
diff --git a/recipes-mono/mono/mono-git.inc b/recipes-mono/mono/mono-git.inc
index c6aca51..cc5d24c 100644
--- a/recipes-mono/mono/mono-git.inc
+++ b/recipes-mono/mono/mono-git.inc
@@ -7,7 +7,7 @@ LICENSE = "GPLv2"
 
 LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=80862f3fd0e11a5fa0318070c54461ce"
 
-SRCBRANCH = "master"
+SRCBRANCH = "main"
 SRCREV = "${AUTOREV}"
 
 SRC_URI = "git://github.com/mono/mono.git;branch=${SRCBRANCH}\
diff --git a/recipes-mono/taglib-sharp/taglib-sharp_2.1.0.0.bb b/recipes-mono/taglib-sharp/taglib-sharp_2.1.0.0.bb
index 1f9327f..266e652 100644
--- a/recipes-mono/taglib-sharp/taglib-sharp_2.1.0.0.bb
+++ b/recipes-mono/taglib-sharp/taglib-sharp_2.1.0.0.bb
@@ -1,6 +1,6 @@
 require taglib-sharp.inc
 
 SRCREV = "bbdc79138815c81151a5d03fc2dec0cf53044186"
-SRCBRANCH = "master"
+SRCBRANCH = "main"
 
 SRC_URI += "file://0001-configure-use-mcs.patch"

From 41c93f49cff6537486e978e62d87c235a2dc4e10 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 09:40:31 +0000
Subject: [PATCH 09/27] ci: clone Yocto layers over HTTPS and detect release
 from layer.conf

PR #282 failed at Update repo poky because git://git.yoctoproject.org
times out: the hostname is behind Cloudflare, which does not carry the
native git protocol. Switch clones to HTTPS, detect LAYERSERIES_COMPAT
from conf/layer.conf, and set up oe-core/bitbake/meta-yocto for
whinlatter and wrynose instead of hardcoding a styhead/whinlatter poky
matrix branch.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 151 +++++++++++++++++++++++---------
 1 file changed, 108 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 7ec61a2..6268d57 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -5,10 +5,12 @@ on:
     branches:
       - master
       - whinlatter
+      - wrynose
   pull_request:
     branches:
       - master
       - whinlatter
+      - wrynose
     paths-ignore:
       - "**.md"
 jobs:
@@ -23,56 +25,91 @@ jobs:
       matrix:
         dotnet_version: [10.0.100, 8.0.406, 6.0.428]
         mono_version: [6.12.0.206]
-        branch: [whinlatter]
-        arch: [x86-64, arm, arm64]
-        exclude:
-          # GCC build broken for ARM32 - see README and discussions/234
-          - branch: whinlatter
-            arch: arm
+        arch: [x86-64, arm64]
     env:
       name: build-and-test
       MONO_VERSION: ${{ matrix.mono_version }}
       DOTNET_VERSION: ${{ matrix.dotnet_version }}
       ARCH: ${{ matrix.arch }}
-      BRANCH: ${{ matrix.branch }}
+      WORK_ROOT: work
     steps:
     - name: Checkout meta-mono
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         clean: false
-        path: ${{ matrix.branch }}/meta-mono
-    - name: Update repo poky
+        path: work/meta-mono
+    - name: Detect Yocto release
       run: |
-        if [ ! -d ${BRANCH}/poky ]; then
-          git clone git://git.yoctoproject.org/poky -b ${BRANCH} ${BRANCH}/poky
-        else
-          cd ${BRANCH}/poky
-          git pull origin ${BRANCH}
-          cd ../..
+        compat=$(grep '^LAYERSERIES_COMPAT_mono' "${WORK_ROOT}/meta-mono/conf/layer.conf" | sed 's/.*"\([^"]*\)".*/\1/')
+        if [ -z "$compat" ]; then
+          echo "Could not read LAYERSERIES_COMPAT_mono from conf/layer.conf" >&2
+          exit 1
         fi
-    - name: Update repo meta-openembedded
+        echo "YOCTO_RELEASE=${compat}" >> "$GITHUB_ENV"
+        echo "Detected Yocto release: ${compat}"
+    - name: Setup base layers
       run: |
-        if [ ! -d ${BRANCH}/meta-openembedded ]; then
-          git clone https://github.com/openembedded/meta-openembedded.git -b ${BRANCH} ${BRANCH}/meta-openembedded
-        else
-          cd ${BRANCH}/meta-openembedded
-          git pull origin ${BRANCH}
-          cd ../..
-        fi
+        clone_or_update() {
+          local url="$1" branch="$2" dest="$3"
+          if [ ! -d "$dest" ]; then
+            git clone "$url" -b "$branch" "$dest"
+          else
+            cd "$dest"
+            git fetch origin "$branch"
+            git checkout "$branch"
+            git pull origin "$branch"
+            cd "$GITHUB_WORKSPACE"
+          fi
+        }
+
+        case "$YOCTO_RELEASE" in
+          whinlatter)
+            mkdir -p "${WORK_ROOT}/layers"
+            clone_or_update https://git.openembedded.org/bitbake 2.16 "${WORK_ROOT}/layers/bitbake"
+            clone_or_update https://git.openembedded.org/openembedded-core whinlatter "${WORK_ROOT}/layers/openembedded-core"
+            clone_or_update https://git.yoctoproject.org/meta-yocto whinlatter "${WORK_ROOT}/layers/meta-yocto"
+            clone_or_update https://github.com/openembedded/meta-openembedded.git whinlatter "${WORK_ROOT}/layers/meta-openembedded"
+            ;;
+          wrynose)
+            mkdir -p "${WORK_ROOT}/layers"
+            clone_or_update https://git.openembedded.org/bitbake 2.18 "${WORK_ROOT}/layers/bitbake"
+            clone_or_update https://git.openembedded.org/openembedded-core wrynose "${WORK_ROOT}/layers/openembedded-core"
+            clone_or_update https://git.yoctoproject.org/meta-yocto wrynose "${WORK_ROOT}/layers/meta-yocto"
+            clone_or_update https://github.com/openembedded/meta-openembedded.git wrynose "${WORK_ROOT}/layers/meta-openembedded"
+            ;;
+          *)
+            # Legacy releases still use the poky monorepo. Use HTTPS:
+            # git.yoctoproject.org is behind Cloudflare, which does not
+            # carry the native git:// protocol (port 9418) reliably.
+            clone_or_update https://git.yoctoproject.org/poky "$YOCTO_RELEASE" "${WORK_ROOT}/poky"
+            clone_or_update https://github.com/openembedded/meta-openembedded.git "$YOCTO_RELEASE" "${WORK_ROOT}/meta-openembedded"
+            ;;
+        esac
     - name: Configuring
       run: |
-        rm -f ${BRANCH}/build/conf/local.conf
-        rm -f ${BRANCH}/build/conf/bblayers.conf
-        . ./${BRANCH}/poky/oe-init-build-env ${BRANCH}/build
+        rm -f ${WORK_ROOT}/build/conf/local.conf
+        rm -f ${WORK_ROOT}/build/conf/bblayers.conf
+
+        case "$YOCTO_RELEASE" in
+          whinlatter|wrynose)
+            TEMPLATECONF=$GITHUB_WORKSPACE/${WORK_ROOT}/layers/meta-yocto/meta-poky/conf/templates/default \
+              . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            meta_oe="${WORK_ROOT}/layers/meta-openembedded"
+            ;;
+          *)
+            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
+            meta_oe="${WORK_ROOT}/meta-openembedded"
+            ;;
+        esac
 
-        # Append custom variables for regenerated local.conf and bblayers.conf samples
         echo "### Starting to configure local.conf and bblayers.conf ###"
+        echo "yocto release: $YOCTO_RELEASE"
         echo "mono version: $MONO_VERSION"
         echo "dotnet version: $DOTNET_VERSION"
 
-        echo "BBLAYERS += '$GITHUB_WORKSPACE/${BRANCH}/meta-mono'" >> conf/bblayers.conf
-        echo "BBLAYERS += '$GITHUB_WORKSPACE/${BRANCH}/meta-openembedded/meta-oe'" >> conf/bblayers.conf
-        echo "BBLAYERS += '$GITHUB_WORKSPACE/${BRANCH}/meta-openembedded/meta-python'" >> conf/bblayers.conf
+        echo "BBLAYERS += '$GITHUB_WORKSPACE/${WORK_ROOT}/meta-mono'" >> conf/bblayers.conf
+        echo "BBLAYERS += '$GITHUB_WORKSPACE/${meta_oe}/meta-oe'" >> conf/bblayers.conf
+        echo "BBLAYERS += '$GITHUB_WORKSPACE/${meta_oe}/meta-python'" >> conf/bblayers.conf
 
         echo "BB_DEFAULT_EVENTLOG = \"\"" >> conf/local.conf
         echo "MACHINE = \"qemu${ARCH}\"" >> conf/local.conf
@@ -95,32 +132,60 @@ jobs:
     # TODO: remove this step once all matrix jobs have rebuilt successfully.
     - name: Clean stale sstate
       run: |
-        . ./${BRANCH}/poky/oe-init-build-env ${BRANCH}/build
+        case "$YOCTO_RELEASE" in
+          whinlatter|wrynose)
+            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+          *)
+            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+        esac
         bitbake -c cleansstate dotnet dotnet-native python3-clr-loader python3-clr-loader-native dotnet-helloworld python3-pythonnet
     - name: Building Mono Test Image
       run: |
-        . ./${BRANCH}/poky/oe-init-build-env ${BRANCH}/build
+        case "$YOCTO_RELEASE" in
+          whinlatter|wrynose)
+            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+          *)
+            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+        esac
         bitbake test-image-mono
     - name: CVE Check Mono / dotNet
       run: |
-        . ./${BRANCH}/poky/oe-init-build-env ${BRANCH}/build
+        case "$YOCTO_RELEASE" in
+          whinlatter|wrynose)
+            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+          *)
+            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+        esac
         export TERM=linux
         bitbake mono -c cve_check
-        mv $GITHUB_WORKSPACE/${BRANCH}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${BRANCH}/build/tmp/log/cve/cve-summary-mono.json
+        mv $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary-mono.json
         bitbake dotnet -c cve_check
-        mv $GITHUB_WORKSPACE/${BRANCH}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${BRANCH}/build/tmp/log/cve/cve-summary-dotnet.json
+        mv $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary-dotnet.json
     - name: Testing
       run: |
-        . ./${BRANCH}/poky/oe-init-build-env ${BRANCH}/build
+        case "$YOCTO_RELEASE" in
+          whinlatter|wrynose)
+            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+          *)
+            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
+            ;;
+        esac
         export TERM=linux
         bitbake test-image-mono -c testimage
     - name: Store artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
-        name: test-image-mono-${{ matrix.branch }}-${{ matrix.mono_version }}-${{ matrix.dotnet_version }}-${{ github.sha }}-${{ matrix.arch }}
-        path: ./${{ matrix.branch }}/build/tmp/deploy/images/qemu${{ matrix.arch }}/
+        name: test-image-mono-${{ env.YOCTO_RELEASE }}-${{ matrix.mono_version }}-${{ matrix.dotnet_version }}-${{ github.sha }}-${{ matrix.arch }}
+        path: ./${{ env.WORK_ROOT }}/build/tmp/deploy/images/qemu${{ matrix.arch }}/
     - name: Store CVEs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
-        name: cve-summary-${{ matrix.branch }}-${{ matrix.mono_version }}-${{ matrix.dotnet_version }}-${{ github.sha }}-${{ matrix.arch }}
-        path: ./${{ matrix.branch }}/build/tmp/log/cve/*.json
+        name: cve-summary-${{ env.YOCTO_RELEASE }}-${{ matrix.mono_version }}-${{ matrix.dotnet_version }}-${{ github.sha }}-${{ matrix.arch }}
+        path: ./${{ env.WORK_ROOT }}/build/tmp/log/cve/*.json

From c0e170c69e9f4677b02d59115d842db87f04e6a9 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 09:47:42 +0000
Subject: [PATCH 10/27] ci: fix wrynose TEMPLATECONF after meta-poky template
 removal

Wrynose meta-poky no longer ships conf/templates/default, so oe-init
failed with a missing TEMPLATECONF path. Use oe-core defaults for
wrynose and add meta-poky, meta-yocto-bsp, and DISTRO=poky explicitly.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 6268d57..9567ef0 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -91,10 +91,23 @@ jobs:
         rm -f ${WORK_ROOT}/build/conf/bblayers.conf
 
         case "$YOCTO_RELEASE" in
-          whinlatter|wrynose)
+          whinlatter)
+            # meta-poky still ships conf/templates/default on whinlatter
             TEMPLATECONF=$GITHUB_WORKSPACE/${WORK_ROOT}/layers/meta-yocto/meta-poky/conf/templates/default \
               . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
             meta_oe="${WORK_ROOT}/layers/meta-openembedded"
+            meta_yocto="${WORK_ROOT}/layers/meta-yocto"
+            ;;
+          wrynose)
+            # wrynose meta-poky dropped conf/templates; use oe-core defaults
+            # and add poky layers + DISTRO explicitly.
+            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
+            meta_oe="${WORK_ROOT}/layers/meta-openembedded"
+            meta_yocto="${WORK_ROOT}/layers/meta-yocto"
+            echo "POKY_BBLAYERS_CONF_VERSION = \"2\"" >> conf/bblayers.conf
+            echo "BBLAYERS += '$GITHUB_WORKSPACE/${meta_yocto}/meta-poky'" >> conf/bblayers.conf
+            echo "BBLAYERS += '$GITHUB_WORKSPACE/${meta_yocto}/meta-yocto-bsp'" >> conf/bblayers.conf
+            echo "DISTRO = \"poky\"" >> conf/local.conf
             ;;
           *)
             . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build

From 63d4dcfef134a2356c407f0ee6c8ae095aa32fe3 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 09:50:11 +0000
Subject: [PATCH 11/27] ci: switch wrynose from cve-check to sbom-cve-check

Wrynose removed cve-check.bbclass, so INHERIT += cve-check fails parse.
Enable the core/yocto/sbom-cve-check fragment instead and collect the
image-level sbom-cve-check JSON reports after the test image build.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 36 ++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 9567ef0..ecd6b6b 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -134,7 +134,16 @@ jobs:
         echo "PREFERRED_VERSION_dotnet = \"${DOTNET_VERSION}\"" >> conf/local.conf
         echo "PREFERRED_VERSION_dotnet-native = \"${DOTNET_VERSION}\"" >> conf/local.conf
 
-        echo "INHERIT += \" create-spdx cve-check rm_work \"" >> conf/local.conf
+        case "$YOCTO_RELEASE" in
+          wrynose)
+            # cve-check was removed in wrynose; use sbom-cve-check fragment.
+            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check\"" >> conf/local.conf
+            echo "INHERIT += \"rm_work\"" >> conf/local.conf
+            ;;
+          *)
+            echo "INHERIT += \" create-spdx cve-check rm_work \"" >> conf/local.conf
+            ;;
+        esac
         sed -i 's/#IMAGE_CLASSES += "testimage testsdk"/IMAGE_CLASSES += "testimage "/' conf/local.conf
         echo "SPDX_PRETTY = \"1\"" >> conf/local.conf
 
@@ -176,10 +185,27 @@ jobs:
             ;;
         esac
         export TERM=linux
-        bitbake mono -c cve_check
-        mv $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary-mono.json
-        bitbake dotnet -c cve_check
-        mv $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary.json $GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve/cve-summary-dotnet.json
+        cve_dir="$GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/log/cve"
+        mkdir -p "$cve_dir"
+        case "$YOCTO_RELEASE" in
+          wrynose)
+            # Image-level sbom-cve-check runs during bitbake test-image-mono.
+            deploy="$GITHUB_WORKSPACE/${WORK_ROOT}/build/tmp/deploy/images/qemu${ARCH}"
+            found=$(ls "$deploy"/*.sbom-cve-check*.json 2>/dev/null | wc -l)
+            if [ "$found" -eq 0 ]; then
+              echo "No sbom-cve-check reports in $deploy" >&2
+              exit 1
+            fi
+            cp "$deploy"/*.sbom-cve-check*.json "$cve_dir/"
+            ls -la "$cve_dir"
+            ;;
+          *)
+            bitbake mono -c cve_check
+            mv "$cve_dir/cve-summary.json" "$cve_dir/cve-summary-mono.json"
+            bitbake dotnet -c cve_check
+            mv "$cve_dir/cve-summary.json" "$cve_dir/cve-summary-dotnet.json"
+            ;;
+        esac
     - name: Testing
       run: |
         case "$YOCTO_RELEASE" in

From 644e880868bb5be0874c3f598ea6ae31d97baa88 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 17:05:38 +0000
Subject: [PATCH 12/27] ci: reclaim runner disk and use Yocto sstate mirror on
 wrynose

The wrynose image build halted with BB_DISKMON HALT at ~0.1GB free while
compiling clang/llvm/rust. Clear leftover per-release trees from older
CI layouts and enable core/yocto/sstate-mirror-cdn so those natives can
come from the project sstate cache instead of filling the disk.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index ecd6b6b..ba3b0a9 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -33,6 +33,25 @@ jobs:
       ARCH: ${{ matrix.arch }}
       WORK_ROOT: work
     steps:
+    - name: Free disk space
+      run: |
+        set -x
+        df -h
+        # Prior CI layouts left per-release trees (styhead/, whinlatter/, …)
+        # on the persistent self-hosted workspace. A fresh wrynose build of
+        # clang/llvm/rust needs that space back.
+        for d in styhead whinlatter scarthgap kirkstone nanbield styhead-test \
+                 feature work/build/tmp work/build/cache work/build/tmp-glibc; do
+          if [ -e "$d" ]; then
+            echo "Removing $d"
+            rm -rf "$d"
+          fi
+        done
+        # Drop stale build tmp only; keep layers, downloads, and sstate.
+        if [ -d "${WORK_ROOT}/build/tmp" ]; then
+          rm -rf "${WORK_ROOT}/build/tmp"
+        fi
+        df -h
     - name: Checkout meta-mono
       uses: actions/checkout@v5
       with:
@@ -137,7 +156,9 @@ jobs:
         case "$YOCTO_RELEASE" in
           wrynose)
             # cve-check was removed in wrynose; use sbom-cve-check fragment.
-            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check\"" >> conf/local.conf
+            # sstate-mirror-cdn avoids rebuilding clang/llvm/rust from source
+            # (those natives filled the self-hosted runner disk).
+            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check core/yocto/sstate-mirror-cdn\"" >> conf/local.conf
             echo "INHERIT += \"rm_work\"" >> conf/local.conf
             ;;
           *)

From da7c3c3b6f4657f148c7597886ea0ca385b83fc8 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 19:01:57 +0000
Subject: [PATCH 13/27] ci: install websockets for hashserv; drop obsolete
 cleansstate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sstate-mirror-cdn sets BB_HASHSERVE_UPSTREAM=wss://..., which needs the
Python websockets module on the build host. Install it before bitbake.
Also remove the temporary cleansstate step — it is unnecessary for a
fresh wrynose build and only added parse overhead.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 28 ++++++++--------------------
 1 file changed, 8 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index ba3b0a9..b573d4d 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -35,23 +35,25 @@ jobs:
     steps:
     - name: Free disk space
       run: |
-        set -x
+        echo "=== disk before cleanup ==="
         df -h
         # Prior CI layouts left per-release trees (styhead/, whinlatter/, …)
         # on the persistent self-hosted workspace. A fresh wrynose build of
         # clang/llvm/rust needs that space back.
         for d in styhead whinlatter scarthgap kirkstone nanbield styhead-test \
-                 feature work/build/tmp work/build/cache work/build/tmp-glibc; do
+                 feature "${WORK_ROOT}/build/tmp" "${WORK_ROOT}/build/cache" \
+                 "${WORK_ROOT}/build/tmp-glibc"; do
           if [ -e "$d" ]; then
             echo "Removing $d"
             rm -rf "$d"
           fi
         done
-        # Drop stale build tmp only; keep layers, downloads, and sstate.
-        if [ -d "${WORK_ROOT}/build/tmp" ]; then
-          rm -rf "${WORK_ROOT}/build/tmp"
-        fi
+        echo "=== disk after cleanup ==="
         df -h
+    - name: Install host Python deps
+      run: |
+        # Required by BB_HASHSERVE_UPSTREAM (wss://) from sstate-mirror-cdn.
+        python3 -m pip install --user 'websockets>=10'
     - name: Checkout meta-mono
       uses: actions/checkout@v5
       with:
@@ -170,20 +172,6 @@ jobs:
 
         echo "BB_NUMBER_THREADS ?= \"\${@oe.utils.cpu_count()}\"" >> conf/local.conf
         echo "PARALLEL_MAKE ?= \"-j \${@oe.utils.cpu_count()} -l \${@oe.utils.cpu_count()*2}\"" >> conf/local.conf
-    # Flush stale sstate/sysroot to ensure fresh builds with corrected
-    # host/fxr layout and dotnet wrapper.
-    # TODO: remove this step once all matrix jobs have rebuilt successfully.
-    - name: Clean stale sstate
-      run: |
-        case "$YOCTO_RELEASE" in
-          whinlatter|wrynose)
-            . ./${WORK_ROOT}/layers/openembedded-core/oe-init-build-env ${WORK_ROOT}/build
-            ;;
-          *)
-            . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
-            ;;
-        esac
-        bitbake -c cleansstate dotnet dotnet-native python3-clr-loader python3-clr-loader-native dotnet-helloworld python3-pythonnet
     - name: Building Mono Test Image
       run: |
         case "$YOCTO_RELEASE" in

From daf6b74ab6643ba42c30fc9f9c782d72c3c3ef37 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 19:04:27 +0000
Subject: [PATCH 14/27] ci: install websockets into workspace for hashserv

$HOME/.local is not writable in the yocto-ci-build container, so pip
--user failed. Install into $GITHUB_WORKSPACE/.pip-packages and export
PYTHONPATH for later bitbake steps.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index b573d4d..6e82f65 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -53,7 +53,11 @@ jobs:
     - name: Install host Python deps
       run: |
         # Required by BB_HASHSERVE_UPSTREAM (wss://) from sstate-mirror-cdn.
-        python3 -m pip install --user 'websockets>=10'
+        # Install into the workspace: $HOME/.local is not writable in this container.
+        pip_target="${GITHUB_WORKSPACE}/.pip-packages"
+        python3 -m pip install --target "$pip_target" 'websockets>=10'
+        echo "PYTHONPATH=${pip_target}${PYTHONPATH:+:$PYTHONPATH}" >> "$GITHUB_ENV"
+        PYTHONPATH="${pip_target}${PYTHONPATH:+:$PYTHONPATH}" python3 -c 'import websockets; print(websockets.__version__)'
     - name: Checkout meta-mono
       uses: actions/checkout@v5
       with:

From d3c1606977fe15d550a04c47120f43c4281a6842 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 19:07:03 +0000
Subject: [PATCH 15/27] ci: use SSTATE_MIRRORS without hashserv on wrynose

The sstate-mirror-cdn fragment enables wss hashserv, which needs the
websockets module inside bitbake's Python. pip installs were not visible
to bitbake in this container. Keep the HTTP sstate mirror alone so
prebuilts can still be fetched without hashserv.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 6e82f65..005ff20 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -50,14 +50,6 @@ jobs:
         done
         echo "=== disk after cleanup ==="
         df -h
-    - name: Install host Python deps
-      run: |
-        # Required by BB_HASHSERVE_UPSTREAM (wss://) from sstate-mirror-cdn.
-        # Install into the workspace: $HOME/.local is not writable in this container.
-        pip_target="${GITHUB_WORKSPACE}/.pip-packages"
-        python3 -m pip install --target "$pip_target" 'websockets>=10'
-        echo "PYTHONPATH=${pip_target}${PYTHONPATH:+:$PYTHONPATH}" >> "$GITHUB_ENV"
-        PYTHONPATH="${pip_target}${PYTHONPATH:+:$PYTHONPATH}" python3 -c 'import websockets; print(websockets.__version__)'
     - name: Checkout meta-mono
       uses: actions/checkout@v5
       with:

From bff476951fee034e44119edaeda1f53b672a601f Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Thu, 16 Jul 2026 19:07:15 +0000
Subject: [PATCH 16/27] ci: set SSTATE_MIRRORS without hashserv fragment

Drop core/yocto/sstate-mirror-cdn (needs websockets for wss hashserv)
and configure the HTTP sstate mirror directly instead.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 005ff20..590a25b 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -154,10 +154,12 @@ jobs:
         case "$YOCTO_RELEASE" in
           wrynose)
             # cve-check was removed in wrynose; use sbom-cve-check fragment.
-            # sstate-mirror-cdn avoids rebuilding clang/llvm/rust from source
-            # (those natives filled the self-hosted runner disk).
-            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check core/yocto/sstate-mirror-cdn\"" >> conf/local.conf
+            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check\"" >> conf/local.conf
             echo "INHERIT += \"rm_work\"" >> conf/local.conf
+            # Use the project sstate mirror without BB_HASHSERVE_UPSTREAM:
+            # the CDN fragment's wss hashserv needs Python websockets, which
+            # this container does not provide in bitbake's runtime.
+            echo "SSTATE_MIRRORS ?= \"file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH\"" >> conf/local.conf
             ;;
           *)
             echo "INHERIT += \" create-spdx cve-check rm_work \"" >> conf/local.conf

From 9d4624a1c8de09730b9f5f7328010037e2241002 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 04:08:24 +0000
Subject: [PATCH 17/27] dotnet: fix native wrapper SELF_DIR assignment (shell
 vs bitbake)

The class-native dotnet wrapper used `SELF_DIR = "..."` which is invalid
shell (spaces around =), so sh treated SELF_DIR as a command and
dotnet-helloworld do_compile failed with exit 127. Use shell assignment
instead. Also add bitbake-required whitespace around recipe-level
export assignments for wrynose.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 classes/mono.bbclass                               |  6 +++---
 .../dotnet-helloworld/dotnet-helloworld_1.0.bb     | 14 +++++++-------
 recipes-mono/dotnet/dotnet.inc                     |  2 +-
 recipes-mono/msbuild/msbuild_16.10.1.bb            |  4 ++--
 .../python3-clr-loader/python3-clr-loader.bb       | 14 +++++++-------
 .../python3-pythonnet/python3-pythonnet.bb         |  4 ++--
 6 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/classes/mono.bbclass b/classes/mono.bbclass
index aa40cf4..3629a4f 100644
--- a/classes/mono.bbclass
+++ b/classes/mono.bbclass
@@ -31,12 +31,12 @@ FILES:${PN}-doc:append = " \
   ${libdir}/monodoc/* \
 "
 
-export MONO_CFG_DIR="${STAGING_ETCDIR_NATIVE}"
+export MONO_CFG_DIR = "${STAGING_ETCDIR_NATIVE}"
 
 # NuGet uses $HOME/.nuget/packages to store packages by default
 # but we should not use anything outside the build root of packages.
-export NUGET_PACKAGES="${UNPACKDIR}/mono-nuget-packages"
-export NUGET_HTTP_CACHE_PATH="${UNPACKDIR}/mono-nuget-http-cache"
+export NUGET_PACKAGES = "${UNPACKDIR}/mono-nuget-packages"
+export NUGET_HTTP_CACHE_PATH = "${UNPACKDIR}/mono-nuget-http-cache"
 
 do_configure:prepend() {
 	mkdir -p ${NUGET_PACKAGES} ${NUGET_HTTP_CACHE_PATH}
diff --git a/recipes-mono/dotnet-helloworld/dotnet-helloworld_1.0.bb b/recipes-mono/dotnet-helloworld/dotnet-helloworld_1.0.bb
index 8c22dc4..7d16e4a 100644
--- a/recipes-mono/dotnet-helloworld/dotnet-helloworld_1.0.bb
+++ b/recipes-mono/dotnet-helloworld/dotnet-helloworld_1.0.bb
@@ -19,13 +19,13 @@ COMPATIBLE_HOST ?= "(x86_64|aarch64|arm).*-linux"
 
 # NuGet MigrationRunner in .NET 6 hardcodes $HOME for migrations dir.
 # Override HOME so it's always writable (CI containers often have read-only HOME).
-export HOME="${WORKDIR}/dotnet-home"
-export DOTNET_CLI_HOME="${WORKDIR}/dotnet-home"
-export DOTNET_SKIP_FIRST_TIME_EXPERIENCE="true"
-export DOTNET_CLI_TELEMETRY_OPTOUT="1"
-export DOTNET_NOLOGO="1"
-export NUGET_PACKAGES="${UNPACKDIR}/nuget-packages"
-export NUGET_HTTP_CACHE_PATH="${UNPACKDIR}/nuget-http-cache"
+export HOME = "${WORKDIR}/dotnet-home"
+export DOTNET_CLI_HOME = "${WORKDIR}/dotnet-home"
+export DOTNET_SKIP_FIRST_TIME_EXPERIENCE = "true"
+export DOTNET_CLI_TELEMETRY_OPTOUT = "1"
+export DOTNET_NOLOGO = "1"
+export NUGET_PACKAGES = "${UNPACKDIR}/nuget-packages"
+export NUGET_HTTP_CACHE_PATH = "${UNPACKDIR}/nuget-http-cache"
 
 SRC_ARCH:aarch64 = "arm64"
 SRC_ARCH:arm = "arm"
diff --git a/recipes-mono/dotnet/dotnet.inc b/recipes-mono/dotnet/dotnet.inc
index 856c038..f20f8ce 100644
--- a/recipes-mono/dotnet/dotnet.inc
+++ b/recipes-mono/dotnet/dotnet.inc
@@ -120,7 +120,7 @@ mkdir -p "$HOME" 2>/dev/null || true
 export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=true
 export DOTNET_CLI_TELEMETRY_OPTOUT=1
 export DOTNET_NOLOGO=1
-SELF_DIR = "$(cd "$(dirname "$0")" && pwd)"
+SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
 exec "${SELF_DIR}/../share/dotnet/dotnet" "$@"
 WRAPPER
     chmod 0755 ${D}${bindir}/dotnet
diff --git a/recipes-mono/msbuild/msbuild_16.10.1.bb b/recipes-mono/msbuild/msbuild_16.10.1.bb
index 1a79e9c..dff45ef 100644
--- a/recipes-mono/msbuild/msbuild_16.10.1.bb
+++ b/recipes-mono/msbuild/msbuild_16.10.1.bb
@@ -35,8 +35,8 @@ do_configure () {
     sed "s|\$1/lib|${libdir}|g" -i ${S}/mono/build/gen_msbuild_wrapper.sh
 }
 
-export DOTNET_MSBUILD_SDK_RESOLVER_CLI_DIR="${STAGING_DATADIR_NATIVE}/dotnet"
-export CURL_CA_BUNDLE="${STAGING_DIR_NATIVE}/etc/ssl/certs/ca-certificates.crt"
+export DOTNET_MSBUILD_SDK_RESOLVER_CLI_DIR = "${STAGING_DATADIR_NATIVE}/dotnet"
+export CURL_CA_BUNDLE = "${STAGING_DIR_NATIVE}/etc/ssl/certs/ca-certificates.crt"
 
 do_compile[network] = "1"
 
diff --git a/recipes-python/python3-clr-loader/python3-clr-loader.bb b/recipes-python/python3-clr-loader/python3-clr-loader.bb
index 7cbc5b9..ac141cf 100644
--- a/recipes-python/python3-clr-loader/python3-clr-loader.bb
+++ b/recipes-python/python3-clr-loader/python3-clr-loader.bb
@@ -29,18 +29,18 @@ RDEPENDS:${PN} += " \
 # NuGet uses $HOME/.nuget/packages to store packages by default
 # but we should not use anything outside the build root of packages.
 # Use a separated folder for nuget downloads and cache in UNPACKDIR.
-export NUGET_PACKAGES="${UNPACKDIR}/nuget-packages"
-export NUGET_HTTP_CACHE_PATH="${UNPACKDIR}/nuget-http-cache"
+export NUGET_PACKAGES = "${UNPACKDIR}/nuget-packages"
+export NUGET_HTTP_CACHE_PATH = "${UNPACKDIR}/nuget-http-cache"
 
 # NuGet MigrationRunner.Run() in .NET 6 runs BEFORE the skip-first-time
 # check, and hardcodes $HOME/.local/share/NuGet/Migrations.  In CI
 # containers $HOME is often read-only.  Override HOME to a writable path
 # so NuGet, dotnet CLI, and any other $HOME consumer all get a writable dir.
-export HOME="${WORKDIR}/dotnet-home"
-export DOTNET_CLI_HOME="${WORKDIR}/dotnet-home"
-export DOTNET_SKIP_FIRST_TIME_EXPERIENCE="true"
-export DOTNET_CLI_TELEMETRY_OPTOUT="1"
-export DOTNET_NOLOGO="1"
+export HOME = "${WORKDIR}/dotnet-home"
+export DOTNET_CLI_HOME = "${WORKDIR}/dotnet-home"
+export DOTNET_SKIP_FIRST_TIME_EXPERIENCE = "true"
+export DOTNET_CLI_TELEMETRY_OPTOUT = "1"
+export DOTNET_NOLOGO = "1"
 
 # Workaround for dotnet restore issue, define custom proxy in a .bbappend
 # and/or in layer.conf or local.conf if dotnet restore was failed.
diff --git a/recipes-python/python3-pythonnet/python3-pythonnet.bb b/recipes-python/python3-pythonnet/python3-pythonnet.bb
index 5fa8b1b..650feb6 100644
--- a/recipes-python/python3-pythonnet/python3-pythonnet.bb
+++ b/recipes-python/python3-pythonnet/python3-pythonnet.bb
@@ -38,8 +38,8 @@ RDEPENDS:${PN} += " \
 # NuGet uses $HOME/.nuget/packages to store packages by default
 # but we should not use anything outside the build root of packages.
 # Use a separated folder for nuget downloads and cache in UNPACKDIR.
-export NUGET_PACKAGES="${UNPACKDIR}/nuget-packages"
-export NUGET_HTTP_CACHE_PATH="${UNPACKDIR}/nuget-http-cache"
+export NUGET_PACKAGES = "${UNPACKDIR}/nuget-packages"
+export NUGET_HTTP_CACHE_PATH = "${UNPACKDIR}/nuget-http-cache"
 
 # Workaround for dotnet restore issue, define custom proxy in a .bbappend
 # and/or in layer.conf or local.conf if dotnet restore was failed.

From bdebb8e618db86d156204e82f28ac31289b65a2c Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 04:08:30 +0000
Subject: [PATCH 18/27] recipes-python: fix export assignment whitespace for
 wrynose

BitBake warns on export FOO="bar"; use export FOO = "bar".

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 recipes-python/python3-clr-loader/python3-clr-loader.bb | 4 ++--
 recipes-python/python3-pythonnet/python3-pythonnet.bb   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/recipes-python/python3-clr-loader/python3-clr-loader.bb b/recipes-python/python3-clr-loader/python3-clr-loader.bb
index ac141cf..f58f01c 100644
--- a/recipes-python/python3-clr-loader/python3-clr-loader.bb
+++ b/recipes-python/python3-clr-loader/python3-clr-loader.bb
@@ -47,8 +47,8 @@ export DOTNET_NOLOGO = "1"
 # Override DOTNET_HTTP_PROXY and DOTNET_HTTPS_PROXY in layer.conf or local.conf if needed
 DOTNET_HTTP_PROXY ?= ""
 DOTNET_HTTPS_PROXY ?= ""
-export http_proxy="${DOTNET_HTTP_PROXY}"
-export https_proxy="${DOTNET_HTTPS_PROXY}"
+export http_proxy = "${DOTNET_HTTP_PROXY}"
+export https_proxy = "${DOTNET_HTTPS_PROXY}"
 
 do_configure:prepend() {
     if ! grep -Fq __version__ ${S}/clr_loader/__init__.py
diff --git a/recipes-python/python3-pythonnet/python3-pythonnet.bb b/recipes-python/python3-pythonnet/python3-pythonnet.bb
index 650feb6..4d512ad 100644
--- a/recipes-python/python3-pythonnet/python3-pythonnet.bb
+++ b/recipes-python/python3-pythonnet/python3-pythonnet.bb
@@ -46,8 +46,8 @@ export NUGET_HTTP_CACHE_PATH = "${UNPACKDIR}/nuget-http-cache"
 # Override DOTNET_HTTP_PROXY and DOTNET_HTTPS_PROXY in layer.conf or local.conf if needed
 DOTNET_HTTP_PROXY ?= ""
 DOTNET_HTTPS_PROXY ?= ""
-export http_proxy="${DOTNET_HTTP_PROXY}"
-export https_proxy="${DOTNET_HTTPS_PROXY}"
+export http_proxy = "${DOTNET_HTTP_PROXY}"
+export https_proxy = "${DOTNET_HTTPS_PROXY}"
 
 do_configure:prepend() {
     if ! grep -Fq __version__ ${S}/pythonnet/__init__.py

From 737ab992457861882a6a652e6e52d16a897fca90 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 07:52:05 +0000
Subject: [PATCH 19/27] ci: include DATETIME in image SBOM sstate hash

do_create_image_sbom_spdx excludes DATETIME from its task hash while the
deployed SPDX file is named with IMAGE_NAME (which includes DATETIME).
Setscene can restore a stale filename and do_sbom_cve_check fails looking
for the current IMAGE_NAME.spdx.json.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 590a25b..ce5fc3d 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -160,6 +160,11 @@ jobs:
             # the CDN fragment's wss hashserv needs Python websockets, which
             # this container does not provide in bitbake's runtime.
             echo "SSTATE_MIRRORS ?= \"file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH\"" >> conf/local.conf
+            # oe-core excludes DATETIME from do_create_image_sbom_spdx's hash, but
+            # the deployed file is ${IMAGE_NAME}.spdx.json (includes DATETIME).
+            # Cross-build setscene can restore a stale name; do_sbom_cve_check then
+            # fails with ENOENT. Keep DATETIME in the hash so the task re-runs.
+            echo "do_create_image_sbom_spdx[vardepsexclude]:remove = \"DATETIME\"" >> conf/local.conf
             ;;
           *)
             echo "INHERIT += \" create-spdx cve-check rm_work \"" >> conf/local.conf

From 08ebcebe24960bd9d91fb042f6b7a7dc596115bc Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 07:55:40 +0000
Subject: [PATCH 20/27] ci: force image SBOM task rebuild each wrynose run

local.conf rejects flag:remove syntax, so the previous DATETIME
vardepsexclude workaround failed to parse. Instead add a per-run
META_MONO_CI_BUILD_ID to do_create_image_sbom_spdx[vardeps] so setscene
cannot restore an SPDX file named with a prior IMAGE_NAME timestamp.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index ce5fc3d..89f0ba3 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -160,11 +160,13 @@ jobs:
             # the CDN fragment's wss hashserv needs Python websockets, which
             # this container does not provide in bitbake's runtime.
             echo "SSTATE_MIRRORS ?= \"file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH\"" >> conf/local.conf
-            # oe-core excludes DATETIME from do_create_image_sbom_spdx's hash, but
-            # the deployed file is ${IMAGE_NAME}.spdx.json (includes DATETIME).
-            # Cross-build setscene can restore a stale name; do_sbom_cve_check then
-            # fails with ENOENT. Keep DATETIME in the hash so the task re-runs.
-            echo "do_create_image_sbom_spdx[vardepsexclude]:remove = \"DATETIME\"" >> conf/local.conf
+            # IMAGE_VERSION_SUFFIX excludes DATETIME from task hashes, but
+            # do_create_image_sbom_spdx deploys ${IMAGE_NAME}.spdx.json (which
+            # includes DATETIME). Setscene can restore a previous filename while
+            # do_sbom_cve_check looks for the current one. Force that one task to
+            # re-run each CI build without invalidating the rest of image sstate.
+            echo "META_MONO_CI_BUILD_ID = \"${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\"" >> conf/local.conf
+            echo "do_create_image_sbom_spdx[vardeps] += \"META_MONO_CI_BUILD_ID\"" >> conf/local.conf
             ;;
           *)
             echo "INHERIT += \" create-spdx cve-check rm_work \"" >> conf/local.conf

From 59843fe74cd35445a71af42c63324c71b5801d7f Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 09:12:53 +0000
Subject: [PATCH 21/27] test-image-mono: enable qemu testimage root-login
 features

wrynose testimage requires allow-empty-password, empty-root-password,
and allow-root-login. Set them on the test image and enable the matching
OE fragment in CI so bitbake -c testimage can log in over qemu.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml        | 3 ++-
 recipes-mono/images/test-image-mono.bb | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 89f0ba3..b3256a7 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -154,7 +154,8 @@ jobs:
         case "$YOCTO_RELEASE" in
           wrynose)
             # cve-check was removed in wrynose; use sbom-cve-check fragment.
-            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check\"" >> conf/local.conf
+            # root-login fragment matches test-image-mono IMAGE_FEATURES for qemu testimage.
+            echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check core/yocto/root-login-with-empty-password\"" >> conf/local.conf
             echo "INHERIT += \"rm_work\"" >> conf/local.conf
             # Use the project sstate mirror without BB_HASHSERVE_UPSTREAM:
             # the CDN fragment's wss hashserv needs Python websockets, which
diff --git a/recipes-mono/images/test-image-mono.bb b/recipes-mono/images/test-image-mono.bb
index aea1fee..45625f8 100644
--- a/recipes-mono/images/test-image-mono.bb
+++ b/recipes-mono/images/test-image-mono.bb
@@ -10,5 +10,8 @@ IMAGE_INSTALL += "msbuild \
                   dotnet-helloworld \
 "
 
+# Required for qemu testimage (serial/ssh root login) on wrynose+.
+IMAGE_FEATURES += "allow-empty-password empty-root-password allow-root-login"
+
 IMAGE_BASENAME = "${PN}"
 

From 0aacb231fcbaae4ab1471dbc723f88bed9930ff2 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 16:04:28 +0000
Subject: [PATCH 22/27] ci: cancel superseded runs and harden disk cleanup

Add a concurrency group so a hung self-hosted matrix cell cannot pin
the runner until timeout. Disable fail-fast so one arch does not hide
others, reclaim deploy/tmp more aggressively between matrix cells, and
fail early when free disk is below 20GiB.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 39 +++++++++++++++++++++++++++------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index b3256a7..9ea590d 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -13,6 +13,13 @@ on:
       - wrynose
     paths-ignore:
       - "**.md"
+
+# Self-hosted runner is singular; cancel superseded PR/push runs so a hung
+# matrix cell cannot pin the runner until the job timeout elapses.
+concurrency:
+  group: meta-mono-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-and-test:
     runs-on: [self-hosted, linux, X64]
@@ -22,6 +29,9 @@ jobs:
       options: --privileged --platform linux/amd64  -v /dev/net/tun:/dev/net/tun -v /dev/kvm:/dev/kvm
     strategy:
       max-parallel: 1
+      # Keep going through the matrix after one cell fails so a flaky arch
+      # does not hide results from the others.
+      fail-fast: false
       matrix:
         dotnet_version: [10.0.100, 8.0.406, 6.0.428]
         mono_version: [6.12.0.206]
@@ -39,17 +49,32 @@ jobs:
         df -h
         # Prior CI layouts left per-release trees (styhead/, whinlatter/, …)
         # on the persistent self-hosted workspace. A fresh wrynose build of
-        # clang/llvm/rust needs that space back.
-        for d in styhead whinlatter scarthgap kirkstone nanbield styhead-test \
-                 feature "${WORK_ROOT}/build/tmp" "${WORK_ROOT}/build/cache" \
-                 "${WORK_ROOT}/build/tmp-glibc"; do
-          if [ -e "$d" ]; then
-            echo "Removing $d"
-            rm -rf "$d"
+        # clang/llvm/rust needs that space back. Also drop stale deploy/work
+        # trees from other MACHINE values so arm64/x86-64 matrix cells do not
+        # starve each other mid-build (hangs with no further bitbake output).
+        for path in styhead whinlatter scarthgap kirkstone nanbield styhead-test \
+                    feature \
+                    "${WORK_ROOT}/build/tmp" \
+                    "${WORK_ROOT}/build/cache" \
+                    "${WORK_ROOT}/build/tmp-glibc" \
+                    "${WORK_ROOT}/build/deploy"; do
+          if [ -e "$path" ]; then
+            echo "Removing $path"
+            rm -rf "$path"
           fi
         done
+        # Remove any alternate TMPDIR layouts left by older CI configs.
+        if [ -d "${WORK_ROOT}/build" ]; then
+          find "${WORK_ROOT}/build" -maxdepth 1 -type d -name 'tmp-*' -exec rm -rf {} +
+        fi
         echo "=== disk after cleanup ==="
         df -h
+        # Fail early if the runner is already too tight for a sato+mono image.
+        avail_kb=$(df -Pk . | awk 'NR==2 {print $4}')
+        if [ "$avail_kb" -lt 20971520 ]; then
+          echo "Only ${avail_kb}KB free; need at least 20GiB" >&2
+          exit 1
+        fi
     - name: Checkout meta-mono
       uses: actions/checkout@v5
       with:

From 4fbf8619dd1e00d874b31038fc4403e5d95b2e91 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 19:44:46 +0000
Subject: [PATCH 23/27] ci: bound hangs, prefer x86, cap arm64 parallelism

Lower job timeout to 480m, run x86-64 matrix cells first, cap arm64
thread counts, share BB_HASHSERVE_DB_DIR with SSTATE_DIR, and abort the
build if cooker logs go idle for an hour so a wedged do_package cannot
pin the self-hosted runner until the job timeout.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 62 +++++++++++++++++++++++++++++----
 1 file changed, 55 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 9ea590d..69fb157 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -23,7 +23,9 @@ concurrency:
 jobs:
   build-and-test:
     runs-on: [self-hosted, linux, X64]
-    timeout-minutes: 960
+    # Keep bounded so a wedged bitbake/container cannot pin the sole
+    # self-hosted runner for a full day (seen with arm64 do_package).
+    timeout-minutes: 480
     container:
       image: dynamicdevices/yocto-ci-build:latest
       options: --privileged --platform linux/amd64  -v /dev/net/tun:/dev/net/tun -v /dev/kvm:/dev/kvm
@@ -32,10 +34,16 @@ jobs:
       # Keep going through the matrix after one cell fails so a flaky arch
       # does not hide results from the others.
       fail-fast: false
+      # x86-64 first: native builds validate recipes quickly; arm64 cross
+      # builds are slower and have hung the runner when disk/RAM is tight.
       matrix:
-        dotnet_version: [10.0.100, 8.0.406, 6.0.428]
-        mono_version: [6.12.0.206]
-        arch: [x86-64, arm64]
+        include:
+          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: arm64}
+          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: arm64}
+          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: arm64}
     env:
       name: build-and-test
       MONO_VERSION: ${{ matrix.mono_version }}
@@ -201,8 +209,18 @@ jobs:
         sed -i 's/#IMAGE_CLASSES += "testimage testsdk"/IMAGE_CLASSES += "testimage "/' conf/local.conf
         echo "SPDX_PRETTY = \"1\"" >> conf/local.conf
 
-        echo "BB_NUMBER_THREADS ?= \"\${@oe.utils.cpu_count()}\"" >> conf/local.conf
-        echo "PARALLEL_MAKE ?= \"-j \${@oe.utils.cpu_count()} -l \${@oe.utils.cpu_count()*2}\"" >> conf/local.conf
+        # Share hash equivalency DB with SSTATE_DIR on the persistent runner.
+        echo "BB_HASHSERVE_DB_DIR = \"\${SSTATE_DIR}\"" >> conf/local.conf
+
+        # Cross-building qemuarm64 on the X64 runner has wedged under full
+        # parallelism (silent multi-hour stall in do_package). Cap threads.
+        if [ "$ARCH" = "arm64" ]; then
+          echo "BB_NUMBER_THREADS ?= \"\${@oe.utils.cpu_count(at_least=1, at_most=4)}\"" >> conf/local.conf
+          echo "PARALLEL_MAKE ?= \"-j \${@oe.utils.cpu_count(at_least=1, at_most=4)}\"" >> conf/local.conf
+        else
+          echo "BB_NUMBER_THREADS ?= \"\${@oe.utils.cpu_count()}\"" >> conf/local.conf
+          echo "PARALLEL_MAKE ?= \"-j \${@oe.utils.cpu_count()} -l \${@oe.utils.cpu_count()*2}\"" >> conf/local.conf
+        fi
     - name: Building Mono Test Image
       run: |
         case "$YOCTO_RELEASE" in
@@ -213,7 +231,37 @@ jobs:
             . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
             ;;
         esac
-        bitbake test-image-mono
+        # Heartbeat: surface disk pressure and fail if bitbake stops writing
+        # cooker logs for too long (the previous arm64 hang produced no output
+        # for hours while still holding the runner).
+        IDLE_LIMIT_SEC=3600
+        bitbake test-image-mono &
+        bbpid=$!
+        last_activity=$(date +%s)
+        last_sig=""
+        while kill -0 "$bbpid" 2>/dev/null; do
+          sleep 120
+          echo "=== build heartbeat $(date -u +%H:%M:%S) ==="
+          df -h . || true
+          sig=$(find "${WORK_ROOT}/build/tmp/log" -type f 2>/dev/null \
+            | xargs ls -lt 2>/dev/null | head -1 | awk '{print $5,$6,$7,$8,$9}')
+          now=$(date +%s)
+          if [ -n "$sig" ] && [ "$sig" != "$last_sig" ]; then
+            last_sig="$sig"
+            last_activity=$now
+          fi
+          if [ $((now - last_activity)) -ge "$IDLE_LIMIT_SEC" ]; then
+            echo "No bitbake log activity for ${IDLE_LIMIT_SEC}s; aborting hung build" >&2
+            kill -TERM "$bbpid" 2>/dev/null || true
+            sleep 10
+            kill -KILL "$bbpid" 2>/dev/null || true
+            # Also stop any leftover bitbake/cooker children.
+            pkill -TERM -P "$bbpid" 2>/dev/null || true
+            wait "$bbpid" 2>/dev/null || true
+            exit 1
+          fi
+        done
+        wait "$bbpid"
     - name: CVE Check Mono / dotNet
       run: |
         case "$YOCTO_RELEASE" in

From be3ad280a2acee3d0df8a0383bf3743c8c80e818 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 17 Jul 2026 19:47:44 +0000
Subject: [PATCH 24/27] ci: run x86-64 matrix only until arm64 runner hangs are
 resolved

qemuarm64 cross builds on the sole X64 self-hosted runner wedged for
10h+ with no bitbake output, blocking the queue. Keep hang watchdog and
timeouts, but limit the matrix to x86-64 so wrynose can clear CI.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 69fb157..52bfe58 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -31,19 +31,14 @@ jobs:
       options: --privileged --platform linux/amd64  -v /dev/net/tun:/dev/net/tun -v /dev/kvm:/dev/kvm
     strategy:
       max-parallel: 1
-      # Keep going through the matrix after one cell fails so a flaky arch
-      # does not hide results from the others.
       fail-fast: false
-      # x86-64 first: native builds validate recipes quickly; arm64 cross
-      # builds are slower and have hung the runner when disk/RAM is tight.
+      # arm64 (qemuarm64 cross on this X64 runner) previously wedged for 10h+
+      # in do_package with no log output, pinning the only self-hosted runner.
+      # Re-enable once the runner has enough disk/RAM headroom for cross builds.
       matrix:
-        include:
-          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: x86-64}
-          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: x86-64}
-          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: x86-64}
-          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: arm64}
-          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: arm64}
-          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: arm64}
+        dotnet_version: ["10.0.100", "8.0.406", "6.0.428"]
+        mono_version: ["6.12.0.206"]
+        arch: [x86-64]
     env:
       name: build-and-test
       MONO_VERSION: ${{ matrix.mono_version }}

From e137399c271b701a68be20d583e25342dc967f32 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sat, 18 Jul 2026 10:23:08 +0000
Subject: [PATCH 25/27] ci: disable BB_HASHSERVE with sstate mirrors; drop
 false hang watchdog

A local hash equivalence server prevents matching the Yocto sstate
mirror. Set BB_HASHSERVE=\"\" when using SSTATE_MIRRORS. Also remove the
idle-log watchdog that used a wrong path after oe-init-build-env and
aborted a healthy build during long compiles.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 39 ++++++++-------------------------
 1 file changed, 9 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 52bfe58..b147425 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -185,10 +185,12 @@ jobs:
             # root-login fragment matches test-image-mono IMAGE_FEATURES for qemu testimage.
             echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check core/yocto/root-login-with-empty-password\"" >> conf/local.conf
             echo "INHERIT += \"rm_work\"" >> conf/local.conf
-            # Use the project sstate mirror without BB_HASHSERVE_UPSTREAM:
-            # the CDN fragment's wss hashserv needs Python websockets, which
-            # this container does not provide in bitbake's runtime.
+            # Use the project sstate mirror. Do not enable a local hash
+            # equivalence server alongside it: that prevents sstate matches
+            # from the mirror. The CDN hashserv (wss) needs Python websockets,
+            # which this container does not provide in bitbake's runtime.
             echo "SSTATE_MIRRORS ?= \"file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH\"" >> conf/local.conf
+            echo "BB_HASHSERVE = \"\"" >> conf/local.conf
             # IMAGE_VERSION_SUFFIX excludes DATETIME from task hashes, but
             # do_create_image_sbom_spdx deploys ${IMAGE_NAME}.spdx.json (which
             # includes DATETIME). Setscene can restore a previous filename while
@@ -204,9 +206,6 @@ jobs:
         sed -i 's/#IMAGE_CLASSES += "testimage testsdk"/IMAGE_CLASSES += "testimage "/' conf/local.conf
         echo "SPDX_PRETTY = \"1\"" >> conf/local.conf
 
-        # Share hash equivalency DB with SSTATE_DIR on the persistent runner.
-        echo "BB_HASHSERVE_DB_DIR = \"\${SSTATE_DIR}\"" >> conf/local.conf
-
         # Cross-building qemuarm64 on the X64 runner has wedged under full
         # parallelism (silent multi-hour stall in do_package). Cap threads.
         if [ "$ARCH" = "arm64" ]; then
@@ -226,35 +225,15 @@ jobs:
             . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
             ;;
         esac
-        # Heartbeat: surface disk pressure and fail if bitbake stops writing
-        # cooker logs for too long (the previous arm64 hang produced no output
-        # for hours while still holding the runner).
-        IDLE_LIMIT_SEC=3600
+        # Disk heartbeat only. An earlier idle-log watchdog looked at the wrong
+        # path after oe-init-build-env (cwd is already the build dir) and killed
+        # a healthy build during long do_compile tasks. Job timeout covers hangs.
         bitbake test-image-mono &
         bbpid=$!
-        last_activity=$(date +%s)
-        last_sig=""
         while kill -0 "$bbpid" 2>/dev/null; do
-          sleep 120
+          sleep 300
           echo "=== build heartbeat $(date -u +%H:%M:%S) ==="
           df -h . || true
-          sig=$(find "${WORK_ROOT}/build/tmp/log" -type f 2>/dev/null \
-            | xargs ls -lt 2>/dev/null | head -1 | awk '{print $5,$6,$7,$8,$9}')
-          now=$(date +%s)
-          if [ -n "$sig" ] && [ "$sig" != "$last_sig" ]; then
-            last_sig="$sig"
-            last_activity=$now
-          fi
-          if [ $((now - last_activity)) -ge "$IDLE_LIMIT_SEC" ]; then
-            echo "No bitbake log activity for ${IDLE_LIMIT_SEC}s; aborting hung build" >&2
-            kill -TERM "$bbpid" 2>/dev/null || true
-            sleep 10
-            kill -KILL "$bbpid" 2>/dev/null || true
-            # Also stop any leftover bitbake/cooker children.
-            pkill -TERM -P "$bbpid" 2>/dev/null || true
-            wait "$bbpid" 2>/dev/null || true
-            exit 1
-          fi
         done
         wait "$bbpid"
     - name: CVE Check Mono / dotNet

From 3fd4af29d5d1558224e0bf8baeccb2c0253f4a4d Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sat, 18 Jul 2026 10:37:30 +0000
Subject: [PATCH 26/27] ci: restore arm64 matrix cells

Keep x86-64 first in the include list, but do not drop qemuarm64 from
the build matrix.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index b147425..95a091f 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -32,13 +32,16 @@ jobs:
     strategy:
       max-parallel: 1
       fail-fast: false
-      # arm64 (qemuarm64 cross on this X64 runner) previously wedged for 10h+
-      # in do_package with no log output, pinning the only self-hosted runner.
-      # Re-enable once the runner has enough disk/RAM headroom for cross builds.
+      # x86-64 first so native builds validate recipes before slower qemuarm64
+      # cross builds on this X64 runner.
       matrix:
-        dotnet_version: ["10.0.100", "8.0.406", "6.0.428"]
-        mono_version: ["6.12.0.206"]
-        arch: [x86-64]
+        include:
+          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: x86-64}
+          - {dotnet_version: "10.0.100", mono_version: "6.12.0.206", arch: arm64}
+          - {dotnet_version: "8.0.406", mono_version: "6.12.0.206", arch: arm64}
+          - {dotnet_version: "6.0.428", mono_version: "6.12.0.206", arch: arm64}
     env:
       name: build-and-test
       MONO_VERSION: ${{ matrix.mono_version }}

From 3c09af268340897f0b225d540556c270a8f9070c Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sat, 18 Jul 2026 11:05:28 +0000
Subject: [PATCH 27/27] ci: use BB_HASHSERVE=auto for OEEquivHash on wrynose

Empty BB_HASHSERVE fails immediately with \"OEEquivHash requires
BB_HASHSERVE to be set\". Keep a local hashserve with the DB on the
shared SSTATE_DIR, and make the build heartbeat non-blocking so bitbake
failures exit without waiting out the sleep interval.

Co-authored-by: Alex Lennon <ajlennon@dynamicdevices.co.uk>
---
 .github/workflows/CI_github.yml | 36 +++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/CI_github.yml b/.github/workflows/CI_github.yml
index 95a091f..669dd49 100644
--- a/.github/workflows/CI_github.yml
+++ b/.github/workflows/CI_github.yml
@@ -188,12 +188,14 @@ jobs:
             # root-login fragment matches test-image-mono IMAGE_FEATURES for qemu testimage.
             echo "OE_FRAGMENTS += \"core/yocto/sbom-cve-check core/yocto/root-login-with-empty-password\"" >> conf/local.conf
             echo "INHERIT += \"rm_work\"" >> conf/local.conf
-            # Use the project sstate mirror. Do not enable a local hash
-            # equivalence server alongside it: that prevents sstate matches
-            # from the mirror. The CDN hashserv (wss) needs Python websockets,
-            # which this container does not provide in bitbake's runtime.
+            # HTTP sstate mirror only: the CDN hashserv (wss) needs Python
+            # websockets, which this container does not provide to bitbake.
+            # wrynose defaults to OEEquivHash, which requires BB_HASHSERVE;
+            # use a local server with the DB on the shared SSTATE_DIR so
+            # persistent-runner reuse works across matrix cells.
             echo "SSTATE_MIRRORS ?= \"file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH\"" >> conf/local.conf
-            echo "BB_HASHSERVE = \"\"" >> conf/local.conf
+            echo "BB_HASHSERVE = \"auto\"" >> conf/local.conf
+            echo "BB_HASHSERVE_DB_DIR = \"\${SSTATE_DIR}\"" >> conf/local.conf
             # IMAGE_VERSION_SUFFIX excludes DATETIME from task hashes, but
             # do_create_image_sbom_spdx deploys ${IMAGE_NAME}.spdx.json (which
             # includes DATETIME). Setscene can restore a previous filename while
@@ -228,17 +230,25 @@ jobs:
             . ./${WORK_ROOT}/poky/oe-init-build-env ${WORK_ROOT}/build
             ;;
         esac
-        # Disk heartbeat only. An earlier idle-log watchdog looked at the wrong
-        # path after oe-init-build-env (cwd is already the build dir) and killed
-        # a healthy build during long do_compile tasks. Job timeout covers hangs.
+        # Disk heartbeat in the background; wait on bitbake so failures
+        # surface immediately (a foreground sleep loop delayed exit by 5m).
         bitbake test-image-mono &
         bbpid=$!
-        while kill -0 "$bbpid" 2>/dev/null; do
-          sleep 300
-          echo "=== build heartbeat $(date -u +%H:%M:%S) ==="
-          df -h . || true
-        done
+        (
+          while kill -0 "$bbpid" 2>/dev/null; do
+            sleep 300
+            echo "=== build heartbeat $(date -u +%H:%M:%S) ==="
+            df -h . || true
+          done
+        ) &
+        hb=$!
+        set +e
         wait "$bbpid"
+        rc=$?
+        set -e
+        kill "$hb" 2>/dev/null || true
+        wait "$hb" 2>/dev/null || true
+        exit "$rc"
     - name: CVE Check Mono / dotNet
       run: |
         case "$YOCTO_RELEASE" in