nss postinst requires nss-native during rootfs generation

We've recently added nss to our image and have started to see rootfs generation anomalies. We use IMAGE_FEATURES = "read-only-rootfs" so postinsts run at rootfs generation time.

nss's postinst calls shlibsign. Under normal circumstances with read-only-rootfs, this appears to come from nss-native being in the native sysroot during the build.

We're finding that nss-native isn't in the native sysroot at the time the postinst runs if nss and nss-native come from the sstate cache.

I've simplied the problem enough to reproduce it with stock oe-core and core-image-minimal. Add "nss" to IMAGE_INSTALL and "read-only-rootfs" to IMAGE_FEATURES and then run:

# First populate the sstate cache
bitbake core-image-minimal

# Then build again using the sstate cache
rm -rf tmp-glibc
bitbake -c rootfs core-image-minimal

I get:

ERROR: core-image-minimal-1.0-r0 do_rootfs: The following packages could not be configured offline and rootfs is read-only: ['nss']

This could be because the image dependencies are incorrectly expressed. task-depends.dot contains:

"core-image-minimal.do_build" -> "nss-native.do_build"

Since I'm explicitly running do_rootfs this dependency is never taken into account. I believe that a better dependency would be:

"core-image-minimal.do_rootfs" -> "nss-native.do_build"

I can avoid the problem by running core-image-minimal.do_build rather than core-image-minimal.do_rootfs but I'm worried that this opens the possibility of a race since there's no guarantee that all of core-image-minimal.do_build's dependencies have been satisfied before core-image-minimal.do_rootfs runs.

Alternatively, perhaps nss's postinst isn't supposed to be relying on nss-native at all in its postinst?

Any ideas?

Thanks.

Mike.