How to verify the metalayers SHA when using Yocto

How to verify the metalayers SHA when using Yocto

When working with Yocto Project, maintaining a reliable and reproducible build environment is essential.

One of the simplest yet most important steps in ensuring this integrity is verifying the SHA of the metalayers you are using during the build.

Whether you're synchronizing your project with upstream layers, checking for unexpected changes, or documenting the exact state of your build environment, validating the commit hashes helps guarantee consistency and traceability.

Below you can find a command that can help you to point out the layers list and the respective SHA verification without starting a bitbake build.

The goal of this command is to avoid to touch an existing build.

 bitbake --dry-run os-release
   
   Build Configuration:
   BB_VERSION           = "2.8.1"
   BUILD_SYS            = "x86_64-linux"
   NATIVELSBSTRING      = "universal"
   TARGET_SYS           = "arm-poky-linux-gnueabi"
   MACHINE              = "beaglebone"
   DISTRO               = "poky"
   DISTRO_VERSION       = "5.0.14"
   TUNE_FEATURES        = "arm armv7a vfp thumb neon callconvention-hard"
   TARGET_FPU           = "hard"
   meta                 
   meta-poky            
   meta-yocto-bsp       = "scarthgap:7e8674996b0164b07e56bc066d0fba790e627061"
   meta-oe              = "scarthgap:f1f248262d662315159ee96c604f97415d1dbe6a"
   meta-arm-toolchain   
   meta-arm             = "scarthgap:a81c19915b5b9e71ed394032e9a50fd06919e1cd"
   meta-ti-bsp          
   meta-beagle          = "scarthgap:f483464c72055cdcb81853e06afc89719e73073f"