swegener-rtp · Aug 7, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
@@ -57,3 +57,9 @@
 	path = platforms/nxp-conformance-yocto/doc/test-report-pdf
 	url = https://github.com/savoirfairelinux/test-report-pdf
 	branch = master
+[submodule "platforms/nxp-imx93-yocto/sources/meta-clang"]
+	path = platforms/nxp-imx93-yocto/sources/meta-clang
+	url = https://github.com/kraj/meta-clang.git
+[submodule "platforms/nxp-imx93-yocto/sources/meta-security"]
+	path = platforms/nxp-imx93-yocto/sources/meta-security
+	url = https://git.yoctoproject.org/meta-security
@@ -186,29 +186,29 @@ a tag; to reproduce that release, check out its tag before building. Use
 
 ## Release Profiles
 
-The default release is `nxp-6.6.52-2.2.2`.
+The default supported release is `nxp-6.6.52-2.2.2`.
 
-Use the existing build command for the default release:
+The experimental `nxp-6.12.34-2.1.0` release uses Walnascar / Yocto 5.2 and
+the FRDM-i.MX93 machine provided by the main NXP `meta-imx` release. It also
+uses `meta-clang` and `meta-security/meta-parsec`. The older
+`meta-imx-frdm` layer is used only by the 6.6 release.
 
-```
-ACCEPT_FSL_EULA=1 ./scripts/build.sh development
-```
+Select a release with `--release`:
 
-To select it explicitly:
+```sh
+ACCEPT_FSL_EULA=1 ./scripts/build.sh development \
+    --release nxp-6.6.52-2.2.2 -- bitbake geisa-dev-image
 
-```
-./scripts/setup-sources.sh --release nxp-6.6.52-2.2.2
 ACCEPT_FSL_EULA=1 ./scripts/build.sh development \
-    --release nxp-6.6.52-2.2.2
-```
+    --release nxp-6.12.34-2.1.0 -- bitbake geisa-dev-image
 
-The `nxp-6.12.34-2.1.0` profile is reserved for the newer NXP BSP. Its source
-revisions and release-specific recipe changes have not yet been added, so it
-cannot currently be selected for setup or build.
+### Experimental 6.12 status
 
-Source setup verifies the selected release against the checked-out submodule
-revisions. It stops if a submodule contains local changes or does not match the
-selected profile.
+The 6.12 image builds with Linux 6.12.34 and U-Boot 2025.04. Walnascar support
+includes unpack-path compatibility, explicit development image features,
+TensorFlow Lite 2.19, and read-only application-container handling. Removable-
+media validation is still required. Keep the known-good 6.6 eMMC image until it
+passes.
 
 ## NXP License Acceptance
 
@@ -237,17 +237,30 @@ build:
 
     ACCEPT_FSL_EULA=1 ./scripts/build.sh development -- bitbake -p
 
-Deployment artifacts are written under:
+Deployment artifacts are written under the selected release's build directory:
+
+    <build-directory>/tmp/deploy/images/geisa-imx93/
+
+For example:
 
     build-development/tmp/deploy/images/geisa-imx93/
+    build-development-nxp-6.12.34-2.1.0/tmp/deploy/images/geisa-imx93/
 
 The compressed disk image is named similarly to:
 
     geisa-dev-image-geisa-imx93.rootfs-<timestamp>.wic.zst
 
-The deployment directory also contains the kernel, device tree,
-installed-package manifest, license information, SPDX output, and related build
-artifacts.
+The deployment directory also contains the `.wic.bmap`, package manifest,
+testdata JSON, image-manifest JSON, kernel, device trees, license information,
+and SPDX output.
+
+The testdata JSON records the selected release, the GEISA Community repository
+revision and dirty state, the expected and actual source revisions, and the
+expected kernel and U-Boot revisions. `GEISA_SOURCE_REVISION` identifies the
+GEISA Community repository revision, not an NXP layer revision.
+
+An image built with uncommitted repository changes records a dirty source state
+and should be used for development validation rather than publication.
 
 For general sanity, you should calculate the WIC SHA-256 before writing the
 image:
@@ -582,6 +595,15 @@ warning-log details.
 The script tolerates missing optional tools and reports the information
 available on the currently running image.
 
+The output summarizes systemd state, LXC containers, network interfaces, and
+available thermal readings. Missing optional tools and command failures are
+reported rather than silently omitted.
+
+Set `GEISA_LXC_LS_PATH` to use a specific `lxc-ls` executable.
+
+The output is intended for simple status checks and quick diagnostics, including
+use on smaller displays such as a 10-inch Raspberry Pi display.
+
 Usage:
 
     geisa-system-state [--once] [--debug]

@@ -15,19 +15,4 @@ BBLAYERS ?= " \
   @PLATFORM_ROOT@/sources/meta-arm/meta-arm-systemready \
   @PLATFORM_ROOT@/sources/meta-freescale \
   @PLATFORM_ROOT@/sources/meta-geisa-community \
-  @PLATFORM_ROOT@/sources/meta-imx/meta-imx-ml \
-  @PLATFORM_ROOT@/sources/meta-imx/meta-imx-bsp \
-  @PLATFORM_ROOT@/sources/meta-imx-frdm/meta-imx-bsp \
-  @PLATFORM_ROOT@/sources/meta-imx-frdm/meta-imx-sdk \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-webserver \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-gnome \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-filesystems \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-networking \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-initramfs \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-oe \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-xfce \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-python \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-multimedia \
-  @PLATFORM_ROOT@/sources/meta-openembedded/meta-perl \
-  @PLATFORM_ROOT@/sources/meta-virtualization \
   "
@@ -140,13 +140,11 @@ DISTRO ?= "poky"
 #  "eclipse-debug"  - add Eclipse remote debugging support
 #  "tools-profile"  - add profiling tools (oprofile, lttng, valgrind)
 #  "tools-testapps" - add useful testing tools (ts_print, aplay, arecord etc.)
-#  "debug-tweaks"   - make an image suitable for development
-#                     e.g. ssh root access has a blank password
 # There are other application targets that can be used here too, see
 # meta/classes-recipe/image.bbclass and
 # meta/classes-recipe/core-image.bbclass for more details.
-# We default to enabling the debugging tweaks.
-EXTRA_IMAGE_FEATURES ?= "debug-tweaks"
+# Explicit development access features preserve the historical development image behavior.
+EXTRA_IMAGE_FEATURES ?= "allow-empty-password empty-root-password allow-root-login"
 
 #
 # Additional image features

@@ -1,12 +1,25 @@
 RELEASE_ID="nxp-6.12.34-2.1.0"
 STATUS="experimental"
 NXP_BSP_VERSION="6.12.34-2.1.0"
-YOCTO_SERIES="unresolved"
+YOCTO_SERIES="walnascar"
 BUILD_DIR="build-development-nxp-6.12.34-2.1.0"
 MACHINE="geisa-imx93"
 DISTRO="geisa-dev"
 IMAGE="geisa-dev-image"
-KERNEL_VERSION="unresolved"
-KERNEL_SRCREV="unresolved"
-UBOOT_VERSION="unresolved"
-UBOOT_SRCREV="unresolved"
+SOURCE_IDS="poky meta-arm meta-freescale meta-imx meta-openembedded meta-virtualization meta-clang meta-security"
+LAYER_PATHS="sources/meta-clang sources/meta-imx/meta-imx-ml sources/meta-imx/meta-imx-bsp sources/meta-openembedded/meta-webserver sources/meta-openembedded/meta-gnome sources/meta-openembedded/meta-filesystems sources/meta-openembedded/meta-networking sources/meta-openembedded/meta-initramfs sources/meta-openembedded/meta-oe sources/meta-openembedded/meta-xfce sources/meta-openembedded/meta-python sources/meta-openembedded/meta-multimedia sources/meta-openembedded/meta-perl sources/meta-security/meta-parsec sources/meta-virtualization"
+BBMASK_PATHS="meta-geisa-community/recipes-kernel/linux/linux-imx_6\.6\.bbappend meta-geisa-community/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2\.16\.2\.bbappend"
+GEISA_NXP_MACHINE_INCLUDE="conf/machine/imx93-11x11-lpddr4x-frdm.conf"
+GEISA_MACHINE_INCLUDE="conf/machine/geisa-imx93-6.12.inc"
+KERNEL_VERSION="6.12.34"
+KERNEL_SRCREV="be78e49cb4339fd38c9a40019df49b72fbb8bcb7"
+UBOOT_VERSION="2025.04"
+UBOOT_SRCREV="44898b9f3cfe5ff881c11ab1c44b714041f2b4ac"
+SOURCE_POKY="b642d6a4a93a23d5b99886844ff7b224aa7e13bf"
+SOURCE_META_ARM="2de04c3d31e119d4bedbea24b9c63a8c113a1ce3"
+SOURCE_META_FREESCALE="167ff4ddb79299cf5477e94620a9e598659c407b"
+SOURCE_META_IMX="4d4651bec66c22aa91f1f8897140e77e20773ec4"
+SOURCE_META_OPENEMBEDDED="dca497d728792e3cb655c78455c2d649af312ce8"
+SOURCE_META_VIRTUALIZATION="898239e810acbb7db93299f20deec8afe434f11b"
+SOURCE_META_CLANG="003cba92e982bdd565a6889f28799f8bba14957e"
+SOURCE_META_SECURITY="784ca4b6584101e971b2d5d76ec7b716ad1301b5"
@@ -6,6 +6,11 @@ BUILD_DIR="build-development"
 MACHINE="geisa-imx93"
 DISTRO="geisa-dev"
 IMAGE="geisa-dev-image"
+SOURCE_IDS="poky meta-arm meta-freescale meta-imx meta-imx-frdm meta-openembedded meta-virtualization"
+LAYER_PATHS="sources/meta-imx/meta-imx-ml sources/meta-imx/meta-imx-bsp sources/meta-imx-frdm/meta-imx-bsp sources/meta-imx-frdm/meta-imx-sdk sources/meta-openembedded/meta-webserver sources/meta-openembedded/meta-gnome sources/meta-openembedded/meta-filesystems sources/meta-openembedded/meta-networking sources/meta-openembedded/meta-initramfs sources/meta-openembedded/meta-oe sources/meta-openembedded/meta-xfce sources/meta-openembedded/meta-python sources/meta-openembedded/meta-multimedia sources/meta-openembedded/meta-perl sources/meta-virtualization"
+BBMASK_PATHS="meta-geisa-community/recipes-kernel/linux/linux-imx_6\.12\.bbappend meta-geisa-community/recipes-bsp/u-boot/u-boot-imx_2025\.04\.bbappend meta-geisa-community/recipes-core/systemd/systemd_257\.6\.bbappend meta-geisa-community/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2\.19\.0\.bbappend meta-geisa-community/recipes-libraries/tensorflow-lite/tensorflow-lite_2\.19\.0\.bbappend meta-geisa-community/recipes-support/geisa-ethosu-smoke-test/geisa-ethosu-smoke-test_1\.0\.bbappend"
+GEISA_NXP_MACHINE_INCLUDE="conf/machine/imx93frdm.conf"
+GEISA_MACHINE_INCLUDE="conf/machine/geisa-imx93-6.6.inc"
 KERNEL_VERSION="6.6.52"
 KERNEL_SRCREV="5a0a5e71d2bd130577c7330cbb3764c68ebcb3dc"
 UBOOT_VERSION="2024.04"

@@ -59,6 +59,35 @@ release_profile_check_sources --check
 build="$root/$BUILD_DIR"
 mkdir -p "$build/conf"
 sed "s|@PLATFORM_ROOT@|$root|g" "$root/build-configuration/templates/bblayers.conf" > "$build/conf/bblayers.conf"
+layer_fragment="$build/conf/geisa-release-layers.conf"
+: > "$layer_fragment"
+printf '# Generated for %s (%s)\nBBLAYERS += " \\\n' "$RELEASE_ID" "$RELEASE_PROFILE_STATUS" >> "$layer_fragment"
+declare -A layer_seen=()
+for layer_path in $LAYER_PATHS; do
+    [ -z "${layer_seen[$layer_path]+x}" ] || {
+        echo "duplicate layer path for $RELEASE_ID: $layer_path" >&2
+        exit 1
+    }
+    layer_seen[$layer_path]=1
+    [ -d "$root/$layer_path" ] || {
+        echo "missing layer path for $RELEASE_ID: $root/$layer_path" >&2
+        exit 1
+    }
+    printf '  %s/%s \\\n' "$root" "$layer_path" >> "$layer_fragment"
+done
+printf '  "\n' >> "$layer_fragment"
+printf '\nBBMASK:append = " \\\n' >> "$layer_fragment"
+declare -A mask_seen=()
+for mask_path in $BBMASK_PATHS; do
+    [ -z "${mask_seen[$mask_path]+x}" ] || {
+        echo "duplicate BBMASK path for $RELEASE_ID: $mask_path" >&2
+        exit 1
+    }
+    mask_seen[$mask_path]=1
+    printf '  %s \\\n' "$mask_path" >> "$layer_fragment"
+done
+printf '  "\n' >> "$layer_fragment"
+printf '\ninclude conf/geisa-release-layers.conf\n' >> "$build/conf/bblayers.conf"
 cp "$root/build-configuration/templates/local.conf" "$build/conf/local.conf"
 state_file="$build/conf/geisa-source-state.conf"
 rm -f "$state_file"
@@ -69,6 +98,8 @@ DL_DIR = "${DL_DIR:-$HOME/yocto-cache/downloads}"
 SSTATE_DIR = "${SSTATE_DIR:-$HOME/yocto-cache/sstate}"
 MACHINE = "$MACHINE"
 DISTRO = "$DISTRO"
+GEISA_NXP_MACHINE_INCLUDE = "$GEISA_NXP_MACHINE_INCLUDE"
+GEISA_MACHINE_INCLUDE = "$GEISA_MACHINE_INCLUDE"
 EOF
 set +u
 . "$root/sources/poky/oe-init-build-env" "$build" >/dev/null

@@ -56,7 +56,7 @@ outer_status_filtered() {
         [ -n "$line" ] || continue
         path="${line:3}"
         case "$path" in
-            "${prefix}"sources/poky|"${prefix}"sources/meta-arm|"${prefix}"sources/meta-freescale|"${prefix}"sources/meta-imx|"${prefix}"sources/meta-imx-frdm|"${prefix}"sources/meta-openembedded|"${prefix}"sources/meta-virtualization)
+            "${prefix}"sources/poky|"${prefix}"sources/meta-arm|"${prefix}"sources/meta-freescale|"${prefix}"sources/meta-imx|"${prefix}"sources/meta-imx-frdm|"${prefix}"sources/meta-openembedded|"${prefix}"sources/meta-virtualization|"${prefix}"sources/meta-clang|"${prefix}"sources/meta-security)
                 ;;
             *) printf '%s\n' "$line" ;;
         esac
@@ -71,6 +71,8 @@ outer_excludes=(
     ":(exclude)${prefix}sources/meta-imx-frdm"
     ":(exclude)${prefix}sources/meta-openembedded"
     ":(exclude)${prefix}sources/meta-virtualization"
+    ":(exclude)${prefix}sources/meta-clang"
+    ":(exclude)${prefix}sources/meta-security"
 )
 
 source_dirty=false

@@ -10,14 +10,17 @@ set -euo pipefail
 GEISA_PLATFORM_ROOT="${GEISA_PLATFORM_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)}"
 release_profile_error() { printf 'release profile error: %s\n' "$*" >&2; return 1; }
 
-release_profile_source_ids=(poky meta-arm meta-freescale meta-imx meta-imx-frdm meta-openembedded meta-virtualization)
+release_profile_known_source_ids=(poky meta-arm meta-freescale meta-imx meta-imx-frdm meta-openembedded meta-virtualization meta-clang meta-security)
+release_profile_source_ids=()
+release_profile_mask_paths=()
 release_profile_source_path() {
     case "$1" in
         poky) echo sources/poky;; meta-arm) echo sources/meta-arm;;
         meta-freescale) echo sources/meta-freescale;; meta-imx) echo sources/meta-imx;;
         meta-imx-frdm) echo sources/meta-imx-frdm;;
         meta-openembedded) echo sources/meta-openembedded;;
         meta-virtualization) echo sources/meta-virtualization;;
+        meta-clang) echo sources/meta-clang;; meta-security) echo sources/meta-security;;
         *) release_profile_error "unknown source id: $1";;
     esac
 }
@@ -28,9 +31,63 @@ release_profile_source_var() {
         meta-imx-frdm) echo SOURCE_META_IMX_FRDM;;
         meta-openembedded) echo SOURCE_META_OPENEMBEDDED;;
         meta-virtualization) echo SOURCE_META_VIRTUALIZATION;;
+        meta-clang) echo SOURCE_META_CLANG;; meta-security) echo SOURCE_META_SECURITY;;
         *) release_profile_error "unknown source id: $1";;
     esac
 }
+release_profile_validate_inventory() {
+    local source_id var value
+    local -A seen=()
+    release_profile_source_ids=()
+    [ -n "${SOURCE_IDS:-}" ] || { release_profile_error "SOURCE_IDS is empty"; return 1; }
+    for source_id in $SOURCE_IDS; do
+        [ -z "${seen[$source_id]+x}" ] || {
+            release_profile_error "duplicate source ID: $source_id"; return 1;
+        }
+        release_profile_source_path "$source_id" >/dev/null || return 1
+        seen[$source_id]=1
+        release_profile_source_ids+=("$source_id")
+    done
+    for source_id in "${release_profile_known_source_ids[@]}"; do
+        var="$(release_profile_source_var "$source_id")"; value="${!var:-}"
+        if [ -n "${seen[$source_id]+x}" ]; then
+            [[ "$value" =~ ^[0-9a-fA-F]{40}$ ]] || {
+                release_profile_error "$var must be a full commit for selected source $source_id"; return 1;
+            }
+        elif [ -n "$value" ]; then
+            release_profile_error "$var is set for unselected source $source_id"; return 1
+        fi
+    done
+}
+release_profile_validate_layer_paths() {
+    local layer_path
+    local -A seen=()
+    [ -n "${LAYER_PATHS:-}" ] || { release_profile_error "LAYER_PATHS is empty"; return 1; }
+    for layer_path in $LAYER_PATHS; do
+        [ -z "${seen[$layer_path]+x}" ] || {
+            release_profile_error "duplicate layer path: $layer_path"; return 1;
+        }
+        seen[$layer_path]=1
+        [[ "$layer_path" != /* && "$layer_path" != *..* ]] || {
+            release_profile_error "unsafe layer path: $layer_path"; return 1;
+        }
+    done
+}
+release_profile_validate_mask_paths() {
+    local mask_path
+    local -A seen=()
+    release_profile_mask_paths=()
+    for mask_path in ${BBMASK_PATHS:-}; do
+        [ -z "${seen[$mask_path]+x}" ] || {
+            release_profile_error "duplicate BBMASK path: $mask_path"; return 1;
+        }
+        [[ "$mask_path" =~ ^[A-Za-z0-9_./:+\\-]+$ && "$mask_path" != /* && "$mask_path" != *..* ]] || {
+            release_profile_error "unsafe BBMASK path: $mask_path"; return 1;
+        }
+        seen[$mask_path]=1
+        release_profile_mask_paths+=("$mask_path")
+    done
+}
 release_profile_default_id() {
     local line file="$GEISA_PLATFORM_ROOT/releases/default"
     [ -r "$file" ] || { release_profile_error "missing default release: $file"; return 1; }
@@ -46,18 +103,33 @@ release_profile_default_id() {
 release_profile_load() {
     local file="$1" line key value
     [ -r "$file" ] || { release_profile_error "missing profile: $file"; return 1; }
-    unset RELEASE_ID STATUS NXP_BSP_VERSION YOCTO_SERIES BUILD_DIR MACHINE DISTRO IMAGE KERNEL_VERSION KERNEL_SRCREV UBOOT_VERSION UBOOT_SRCREV SOURCE_POKY SOURCE_META_ARM SOURCE_META_FREESCALE SOURCE_META_IMX SOURCE_META_IMX_FRDM SOURCE_META_OPENEMBEDDED SOURCE_META_VIRTUALIZATION
+    unset RELEASE_ID STATUS NXP_BSP_VERSION YOCTO_SERIES BUILD_DIR MACHINE DISTRO IMAGE KERNEL_VERSION KERNEL_SRCREV UBOOT_VERSION UBOOT_SRCREV SOURCE_IDS LAYER_PATHS BBMASK_PATHS GEISA_NXP_MACHINE_INCLUDE GEISA_MACHINE_INCLUDE SOURCE_POKY SOURCE_META_ARM SOURCE_META_FREESCALE SOURCE_META_IMX SOURCE_META_IMX_FRDM SOURCE_META_OPENEMBEDDED SOURCE_META_VIRTUALIZATION SOURCE_META_CLANG SOURCE_META_SECURITY
     while IFS= read -r line || [ -n "$line" ]; do
         [ -z "$line" ] || [[ "$line" == \#* ]] && continue
         [[ "$line" =~ ^([A-Z][A-Z0-9_]*)=\"([^\"]*)\"$ ]] || {
             release_profile_error "invalid profile line in $file: $line"; return 1;
         }
         key="${BASH_REMATCH[1]}"; value="${BASH_REMATCH[2]}"
-        [[ "$value" =~ ^[A-Za-z0-9._:/+-]+$ ]] || {
-            release_profile_error "unsafe value for $key in $file"; return 1;
-        }
         case "$key" in
-            RELEASE_ID|STATUS|NXP_BSP_VERSION|YOCTO_SERIES|BUILD_DIR|MACHINE|DISTRO|IMAGE|KERNEL_VERSION|KERNEL_SRCREV|UBOOT_VERSION|UBOOT_SRCREV|SOURCE_POKY|SOURCE_META_ARM|SOURCE_META_FREESCALE|SOURCE_META_IMX|SOURCE_META_IMX_FRDM|SOURCE_META_OPENEMBEDDED|SOURCE_META_VIRTUALIZATION) ;;
+            SOURCE_IDS|LAYER_PATHS)
+                [[ "$value" =~ ^[A-Za-z0-9._:/+\ -]+$ ]] || {
+                    release_profile_error "unsafe value for $key in $file: $value"; return 1;
+                }
+                ;;
+           BBMASK_PATHS)
+                mask_value_re="^[-A-Za-z0-9._:/+\\ ]*$"
+                [[ "$value" =~ $mask_value_re ]] || {
+                    release_profile_error "unsafe value for $key in $file: $value"; return 1;
+                }
+                ;;
+            *)
+                [[ "$value" =~ ^[A-Za-z0-9._:/+-]+$ ]] || {
+                    release_profile_error "unsafe value for $key in $file"; return 1;
+                }
+                ;;
+        esac
+        case "$key" in
+            RELEASE_ID|STATUS|NXP_BSP_VERSION|YOCTO_SERIES|BUILD_DIR|MACHINE|DISTRO|IMAGE|KERNEL_VERSION|KERNEL_SRCREV|UBOOT_VERSION|UBOOT_SRCREV|SOURCE_IDS|LAYER_PATHS|BBMASK_PATHS|GEISA_NXP_MACHINE_INCLUDE|GEISA_MACHINE_INCLUDE|SOURCE_POKY|SOURCE_META_ARM|SOURCE_META_FREESCALE|SOURCE_META_IMX|SOURCE_META_IMX_FRDM|SOURCE_META_OPENEMBEDDED|SOURCE_META_VIRTUALIZATION|SOURCE_META_CLANG|SOURCE_META_SECURITY) ;;
             *) release_profile_error "unknown key $key in $file"; return 1;;
         esac
         printf -v "$key" '%s' "$value"
@@ -67,6 +139,13 @@ release_profile_load() {
     for key in RELEASE_ID NXP_BSP_VERSION YOCTO_SERIES BUILD_DIR MACHINE DISTRO IMAGE; do
         [ -n "${!key:-}" ] || { release_profile_error "missing $key in $file"; return 1; }
     done
+    for key in SOURCE_IDS LAYER_PATHS GEISA_NXP_MACHINE_INCLUDE GEISA_MACHINE_INCLUDE; do
+        [ -n "${!key:-}" ] || { release_profile_error "missing $key in $file"; return 1; }
+    done
+    [ "${BBMASK_PATHS+x}" = x ] || { release_profile_error "missing BBMASK_PATHS in $file"; return 1; }
+    release_profile_validate_inventory
+    release_profile_validate_layer_paths
+    release_profile_validate_mask_paths
     # shellcheck disable=SC2034
     RELEASE_PROFILE_FILE="$file"
     # shellcheck disable=SC2034