diff --git a/meta-flatpak/conf/distro/include/flatpak.inc b/meta-flatpak/conf/distro/include/flatpak.inc
index dc1323ed65..72a88a5fc8 100644
--- a/meta-flatpak/conf/distro/include/flatpak.inc
+++ b/meta-flatpak/conf/distro/include/flatpak.inc
@@ -6,4 +6,4 @@ REFKIT_DEFAULT_DISTRO_FEATURES += " \
 "
 
 # Enable D-Bus session bus support, needed by flatpak.
-PACKAGECONFIG_append_pn-dbus_refkit-config = " user-session"
+PACKAGECONFIG_append_pn-dbus_df-refkit-config = " user-session"
diff --git a/meta-refkit-computervision/recipes-computervision/librealsense/librealsense_%.bbappend b/meta-refkit-computervision/recipes-computervision/librealsense/librealsense_%.bbappend
index 11c03fe533..d4e398817a 100644
--- a/meta-refkit-computervision/recipes-computervision/librealsense/librealsense_%.bbappend
+++ b/meta-refkit-computervision/recipes-computervision/librealsense/librealsense_%.bbappend
@@ -1,15 +1,15 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
-EXTRA_OECMAKE_refkit-computervision = " \
+EXTRA_OECMAKE_df-refkit-computervision = " \
        -DBUILD_SHARED_LIBS:BOOL=ON -DBUILD_UNIT_TESTS:BOOL=OFF -DBUILD_EXAMPLES:BOOL=ON \
        -DBUILD_GRAPHICAL_EXAMPLES:BOOL=${@bb.utils.contains('DISTRO_FEATURES', 'x11 opengl', 'ON', 'OFF', d)} \
 "
  
-PACKAGES_refkit-computervision = "${PN} ${PN}-dbg ${PN}-dev ${PN}-examples ${@bb.utils.contains('DISTRO_FEATURES', 'x11 opengl', '${PN}-graphical-examples', '', d)}"
+PACKAGES_df-refkit-computervision = "${PN} ${PN}-dbg ${PN}-dev ${PN}-examples ${@bb.utils.contains('DISTRO_FEATURES', 'x11 opengl', '${PN}-graphical-examples', '', d)}"
 
-SRC_URI_append_refkit-computervision = " \
+SRC_URI_append_df-refkit-computervision = " \
     file://0001-scripts-removed-bashisms.patch \
     file://0001-examples-control-building-of-the-graphical-examples.patch \
 "
 
-RDEPENDS_${PN}_remove_refkit-computervision = "bash"
+RDEPENDS_${PN}_remove_df-refkit-computervision = "bash"
diff --git a/meta-refkit-computervision/recipes-computervision/opencv/opencv_%.bbappend b/meta-refkit-computervision/recipes-computervision/opencv/opencv_%.bbappend
index 8f4dec8366..cf8e086854 100644
--- a/meta-refkit-computervision/recipes-computervision/opencv/opencv_%.bbappend
+++ b/meta-refkit-computervision/recipes-computervision/opencv/opencv_%.bbappend
@@ -1,11 +1,11 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
-SRC_URI_append_refkit-computervision = " \
+SRC_URI_append_df-refkit-computervision = " \
     file://0001-opencv-link-dynamically-against-OpenCL-library.patch \
 "
 
-DEPENDS_remove_refkit-computervision = "python"
-DEPENDS_append_refkit-computervision = " python3"
+DEPENDS_remove_df-refkit-computervision = "python"
+DEPENDS_append_df-refkit-computervision = " python3"
 
 python () {
     if bb.utils.contains('DISTRO_FEATURES', 'refkit-computervision', True, False, d):
diff --git a/meta-refkit-core/bbappends/meta-clang/.keepme b/meta-refkit-core/bbappends/meta-clang/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-flatpak/.keepme b/meta-refkit-core/bbappends/meta-flatpak/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-intel-realsense/.keepme b/meta-refkit-core/bbappends/meta-intel-realsense/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-intel/.keepme b/meta-refkit-core/bbappends/meta-intel/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-intel/meta-tlk/.keepme b/meta-refkit-core/bbappends/meta-intel/meta-tlk/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-iot-web/.keepme b/meta-refkit-core/bbappends/meta-iot-web/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-iotqa/.keepme b/meta-refkit-core/bbappends/meta-iotqa/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-oic/.keepme b/meta-refkit-core/bbappends/meta-oic/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-efl/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-efl/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-filesystems/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-filesystems/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-gnome/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-gnome/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-gpe/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-gpe/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-initramfs/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-initramfs/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-multimedia/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-multimedia/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-networking/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-networking/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-networking/recipes-filter/nftables/nftables_%.bbappend b/meta-refkit-core/bbappends/meta-openembedded/meta-networking/recipes-filter/nftables/nftables_%.bbappend
new file mode 100644
index 0000000000..5b64825ba1
--- /dev/null
+++ b/meta-refkit-core/bbappends/meta-openembedded/meta-networking/recipes-filter/nftables/nftables_%.bbappend
@@ -0,0 +1,7 @@
+# remove readline dependency from nftables
+DEPENDS_remove_df-refkit-config = "readline"
+EXTRA_OECONF_append_df-refkit-config = " --without-cli"
+
+# make nftables require a settings package
+VIRTUAL-RUNTIME_nftables-settings ?= "nftables-settings-default"
+RDEPENDS_nftables_append_df-refkit-config = " ${VIRTUAL-RUNTIME_nftables-settings}"
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-oe/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-oe/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-oe/recipes-graphics/gphoto2/libgphoto2_%.bbappend b/meta-refkit-core/bbappends/meta-openembedded/meta-oe/recipes-graphics/gphoto2/libgphoto2_%.bbappend
new file mode 100644
index 0000000000..535e09aa70
--- /dev/null
+++ b/meta-refkit-core/bbappends/meta-openembedded/meta-oe/recipes-graphics/gphoto2/libgphoto2_%.bbappend
@@ -0,0 +1,3 @@
+# usbutils depends directly on libusb1, not the obsolete compatibility. This removes dependency on libusb-compat.
+DEPENDS_remove_df-refkit-config = "virtual/libusb0"
+DEPENDS_append_df-refkit-config = " libusb1"
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-perl/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-perl/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-python/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-python/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-ruby/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-ruby/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-systemd/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-systemd/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-webserver/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-webserver/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-openembedded/meta-xfce/.keepme b/meta-refkit-core/bbappends/meta-openembedded/meta-xfce/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-security-isafw/.keepme b/meta-refkit-core/bbappends/meta-security-isafw/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-security/.keepme b/meta-refkit-core/bbappends/meta-security/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/bbappends/meta-security/recipes-tpm/swtpm/swtpm-wrappers-native.bbappend b/meta-refkit-core/bbappends/meta-security/recipes-tpm/swtpm/swtpm-wrappers-native.bbappend
new file mode 100644
index 0000000000..a31ed690fb
--- /dev/null
+++ b/meta-refkit-core/bbappends/meta-security/recipes-tpm/swtpm/swtpm-wrappers-native.bbappend
@@ -0,0 +1,4 @@
+# Temporary workaround (needs to be fixed in meta-security once the
+# necessary patch "net-tools: enable native and nativesdk variant"
+# is in OE-core): swtpm_setup.sh needs netstat command.
+DEPENDS_append_df-refkit-config = " net-tools-native"
diff --git a/meta-refkit-core/bbappends/meta-security/recipes-tpm/trousers/trousers_%.bbappend b/meta-refkit-core/bbappends/meta-security/recipes-tpm/trousers/trousers_%.bbappend
new file mode 100644
index 0000000000..bb3fb80d8b
--- /dev/null
+++ b/meta-refkit-core/bbappends/meta-security/recipes-tpm/trousers/trousers_%.bbappend
@@ -0,0 +1,7 @@
+# The upstream recipe does not start tcsd automatically, but we
+# want that because the installer image calls the TPM tools
+# without starting tcsd first (it shouldn't have to!), and
+# without tcsd already running, the tools just fail. A better
+# solution would be socket-activation, but tcsd does not support
+# that. Does not matter, tcsd is only installed when needed.
+SYSTEMD_AUTO_ENABLE_df-refkit-config = "enable"
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/.keepme b/meta-refkit-core/bbappends/openembedded-core/meta/.keepme
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/meta-refkit-core/recipes-bsp/systemd-boot/systemd-boot_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-bsp/systemd-boot/systemd-boot_%.bbappend
similarity index 55%
rename from meta-refkit-core/recipes-bsp/systemd-boot/systemd-boot_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-bsp/systemd-boot/systemd-boot_%.bbappend
index 1542dc240a..373f19c94d 100644
--- a/meta-refkit-core/recipes-bsp/systemd-boot/systemd-boot_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-bsp/systemd-boot/systemd-boot_%.bbappend
@@ -1,7 +1,7 @@
-do_compile_append_refkit-config () {
+do_compile_append_df-refkit-config () {
 	oe_runmake linux${SYSTEMD_BOOT_EFI_ARCH}.efi.stub
 }
 
-do_deploy_append_refkit-config () {
+do_deploy_append_df-refkit-config () {
 	install ${B}/linux*.efi.stub ${DEPLOYDIR}
 }
diff --git a/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/avahi/avahi_%.bbappend
similarity index 54%
rename from meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/avahi/avahi_%.bbappend
index 9eda74e8d2..229f2675c8 100644
--- a/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/avahi/avahi_%.bbappend
@@ -1,34 +1,34 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
 # libnss-mdns is not supported, so remove it from the RRECOMMENDS
-RRECOMMENDS_avahi-daemon_remove_libc-glibc_refkit-config = " libnss-mdns"
-RRECOMMENDS_${PN}_remove_libc-glibc_refkit-config = " libnss-mdns"
+RRECOMMENDS_avahi-daemon_remove_libc-glibc_df-refkit-config = " libnss-mdns"
+RRECOMMENDS_${PN}_remove_libc-glibc_df-refkit-config = " libnss-mdns"
 
 # provide libdns_sd.so and dns_sd.h header
-EXTRA_OECONF_append_refkit-config = " --enable-compat-libdns_sd"
+EXTRA_OECONF_append_df-refkit-config = " --enable-compat-libdns_sd"
 
-FILES_${PN}_append_refkit-config = " \
+FILES_${PN}_append_df-refkit-config = " \
     ${libdir}/libdns_sd.* \
 "
 
 # add firewall support
-RDEPENDS_${PN}_append_refkit-firewall += " nftables"
+RDEPENDS_${PN}_append_df-refkit-firewall += " nftables"
 
-SRC_URI_append_refkit-firewall = "\
+SRC_URI_append_df-refkit-firewall = "\
     file://avahi.ruleset \
 "
 
-do_install_append_refkit-config() {
+do_install_append_df-refkit-config() {
     install -d ${D}${includedir}/avahi-compat-libdns_sd
     install -m 0644 ${S}/avahi-compat-libdns_sd/dns_sd.h ${D}${includedir}/avahi-compat-libdns_sd/
 
 }
-do_install_append_refkit-firewall() {
+
+do_install_append_df-refkit-firewall() {
     install -d ${D}${libdir}/firewall/services
     install -m 0644 ${WORKDIR}/avahi.ruleset ${D}${libdir}/firewall/services/
-
 }
 
-FILES_${PN}_append_refkit-firewall = " \
+FILES_${PN}_append_df-refkit-firewall = " \
     ${libdir}/firewall/services/avahi.ruleset \
 "
diff --git a/meta-refkit-core/recipes-connectivity/avahi/files/avahi.ruleset b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/avahi/files/avahi.ruleset
similarity index 100%
rename from meta-refkit-core/recipes-connectivity/avahi/files/avahi.ruleset
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/avahi/files/avahi.ruleset
diff --git a/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/bluez5/bluez5_5%.bbappend
similarity index 58%
rename from meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/bluez5/bluez5_5%.bbappend
index 0865d65a96..28367b9cab 100644
--- a/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-connectivity/bluez5/bluez5_5%.bbappend
@@ -1,7 +1,7 @@
 # libusb is not required. This removes dependency on libusb-compat.
-DEPENDS_remove_refkit-config = "libusb"
+DEPENDS_remove_df-refkit-config = "libusb"
 
 # split bluetoothctl into a subpackage
-PACKAGES_prepend_refkit-config = "${PN}-client "
+PACKAGES_prepend_df-refkit-config = "${PN}-client "
 FILES_${PN}-client = "${@bb.utils.contains('PACKAGECONFIG', 'readline', '${bindir}/bluetoothctl', '', d)}"
-RRECOMMENDS_${PN}_append_refkit-config = " ${PN}-client"
+RRECOMMENDS_${PN}_append_df-refkit-config = " ${PN}-client"
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/busybox/busybox_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/busybox/busybox_%.bbappend
new file mode 100644
index 0000000000..2b90ca444d
--- /dev/null
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/busybox/busybox_%.bbappend
@@ -0,0 +1,11 @@
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+# refkit.cfg disables CONFIG_SYSLOGD so the corresponding packaging
+# needs to be dropped as well.
+SYSTEMD_PACKAGES_df-refkit-config = ""
+PACKAGES_remove_df-refkit-config = "${PN}-syslog"
+RRECOMMENDS_${PN}_remove_df-refkit-config = "${PN}-syslog"
+
+SRC_URI_append_df-refkit-config = "\
+    file://refkit.cfg \
+"
diff --git a/meta-refkit-core/recipes-core/busybox/files/refkit.cfg b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/busybox/files/refkit.cfg
similarity index 100%
rename from meta-refkit-core/recipes-core/busybox/files/refkit.cfg
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/busybox/files/refkit.cfg
diff --git a/meta-refkit-core/recipes-core/os-release/os-release.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/os-release/os-release.bbappend
similarity index 65%
rename from meta-refkit-core/recipes-core/os-release/os-release.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/os-release/os-release.bbappend
index 926c2f2a57..f0642afce9 100644
--- a/meta-refkit-core/recipes-core/os-release/os-release.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/os-release/os-release.bbappend
@@ -3,5 +3,5 @@
 # like BUILD_ID (includes ${DATETIME}) get patched to the current values in
 # refkit-image.bbclass.
 
-BUILD_ID_refkit-config = "build-id-to-be-added-during-image-creation"
-OS_RELEASE_FIELDS_append_refkit-config = " BUILD_ID"
+BUILD_ID_df-refkit-config = "build-id-to-be-added-during-image-creation"
+OS_RELEASE_FIELDS_append_df-refkit-config = " BUILD_ID"
diff --git a/meta-refkit-core/recipes-core/systemd/files/0001-unit-service-allow-rerunning-reload-tasks.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/files/0001-unit-service-allow-rerunning-reload-tasks.patch
similarity index 100%
rename from meta-refkit-core/recipes-core/systemd/files/0001-unit-service-allow-rerunning-reload-tasks.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/files/0001-unit-service-allow-rerunning-reload-tasks.patch
diff --git a/meta-refkit-core/recipes-core/systemd/files/0002-path-add-ReloadOnTrigger-option.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/files/0002-path-add-ReloadOnTrigger-option.patch
similarity index 100%
rename from meta-refkit-core/recipes-core/systemd/files/0002-path-add-ReloadOnTrigger-option.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/files/0002-path-add-ReloadOnTrigger-option.patch
diff --git a/meta-refkit-core/recipes-core/systemd/systemd_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/systemd_%.bbappend
similarity index 82%
rename from meta-refkit-core/recipes-core/systemd/systemd_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/systemd_%.bbappend
index 13854bc5fd..21f7042ffc 100644
--- a/meta-refkit-core/recipes-core/systemd/systemd_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/systemd/systemd_%.bbappend
@@ -1,6 +1,6 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
-SRC_URI_append_refkit-config = "\
+SRC_URI_append_df-refkit-config = "\
     file://0001-unit-service-allow-rerunning-reload-tasks.patch \
     file://0002-path-add-ReloadOnTrigger-option.patch \
 "
diff --git a/meta-refkit-core/recipes-core/util-linux/util-linux_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/util-linux/util-linux_%.bbappend
similarity index 73%
rename from meta-refkit-core/recipes-core/util-linux/util-linux_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/util-linux/util-linux_%.bbappend
index 4ae1c1a00b..66d9ee97cb 100644
--- a/meta-refkit-core/recipes-core/util-linux/util-linux_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-core/util-linux/util-linux_%.bbappend
@@ -3,10 +3,10 @@
 #
 # Upstream-Status: Inappropriate [Downstream configuration] 
 
-DEPENDS_remove_class-native_refkit-config = "lzo-native"
-DEPENDS_remove_class-nativesdk_refkit-config = "lzo-native"
-DEPENDS_append_class-native_refkit-config = " lz4-native"
-DEPENDS_append_class-nativesdk_refkit-config = " lz4-native"
+DEPENDS_remove_class-native_df-refkit-config = "lzo-native"
+DEPENDS_remove_class-nativesdk_df-refkit-config = "lzo-native"
+DEPENDS_append_class-native_df-refkit-config = " lz4-native"
+DEPENDS_append_class-nativesdk_df-refkit-config = " lz4-native"
 
 # nologin can come from two separate sources, shadow and util-linux.
 # Normally these do not conflict, the one from shadow goes into /sbin,
@@ -18,7 +18,7 @@ DEPENDS_append_class-nativesdk_refkit-config = " lz4-native"
 # Ideally we probably should make sure first that shadow is enabled to
 # ensure we don't end up without any /{usr/,}sbin/nologin.
 
-do_install_append_refkit-config () {
+do_install_append_df-refkit-config () {
     if [ -n "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', 'y', '', d)}" ];
     then
         rm -f ${D}${sbindir}/nologin
diff --git a/meta-refkit-core/recipes-devtools/bmap-tools/classes/bmap-tools-deploy.bbclass b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/bmap-tools/bmap-tools-deploy.inc
similarity index 100%
rename from meta-refkit-core/recipes-devtools/bmap-tools/classes/bmap-tools-deploy.bbclass
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/bmap-tools/bmap-tools-deploy.inc
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/bmap-tools/bmap-tools_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/bmap-tools/bmap-tools_%.bbappend
new file mode 100644
index 0000000000..0b0d5126da
--- /dev/null
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/bmap-tools/bmap-tools_%.bbappend
@@ -0,0 +1 @@
+require ${@ oe.utils.any_distro_features(d, "refkit-config", "bmap-tools-deploy.inc")}
diff --git a/meta-refkit-core/recipes-devtools/python/python3_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python3_%.bbappend
similarity index 86%
rename from meta-refkit-core/recipes-devtools/python/python3_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python3_%.bbappend
index a2faabda15..427b35efb9 100644
--- a/meta-refkit-core/recipes-devtools/python/python3_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python3_%.bbappend
@@ -2,8 +2,8 @@ require refkit-python.inc
 
 # This is a temporary solution until OE-core upstream supports alternatives for python
 inherit ${@bb.utils.contains('DISTRO_FEATURES', 'refkit-config', 'update-alternatives', '', d)}
-ALTERNATIVE_PRIORITY_refkit-config = "80"
-ALTERNATIVE_${PN}-core_refkit-config = "python python_config"
+ALTERNATIVE_PRIORITY_df-refkit-config = "80"
+ALTERNATIVE_${PN}-core_df-refkit-config = "python python_config"
 
 python () {
     if bb.utils.contains('DISTRO_FEATURES', 'refkit-config', True, False, d):
diff --git a/meta-refkit-core/recipes-devtools/python/python_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python_%.bbappend
similarity index 81%
rename from meta-refkit-core/recipes-devtools/python/python_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python_%.bbappend
index 3e09aaa0ce..19bf90c63b 100644
--- a/meta-refkit-core/recipes-devtools/python/python_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/python_%.bbappend
@@ -2,8 +2,8 @@ require refkit-python.inc
 
 # This is a temporary solution until OE-core upstream supports alternatives for python
 inherit ${@bb.utils.contains('DISTRO_FEATURES', 'refkit-config', 'update-alternatives', '', d)}
-ALTERNATIVE_PRIORITY_refkit-config = "100"
-ALTERNATIVE_${PN}-core_refkit-config = "python python_config"
+ALTERNATIVE_PRIORITY_df-refkit-config = "100"
+ALTERNATIVE_${PN}-core_df-refkit-config = "python python_config"
 
 python () {
     if bb.utils.contains('DISTRO_FEATURES', 'refkit-config', True, False, d):
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/refkit-python.inc b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/refkit-python.inc
new file mode 100644
index 0000000000..2ac916ee61
--- /dev/null
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/python/refkit-python.inc
@@ -0,0 +1,9 @@
+# Recipe changes not yet upstream which are needed to build images
+# with no GPLv3-licenses components. Upstream OE-core changes will
+# have this configurable, here it only depends on the "refkit-config"
+# distro feature.
+DEPENDS_remove_df-refkit-config = "readline gdbm db"
+PACKAGES_remove_df-refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
+PROVIDES_remove_df-refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
+RRECOMMENDS_${PN}-core_remove_df-refkit-config = "${PN}-readline"
+RDEPENDS_${PN}-modules_remove_df-refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0001-tpm-backend-Remove-unneeded-member-variable-from-bac.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0001-tpm-backend-Remove-unneeded-member-variable-from-bac.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0001-tpm-backend-Remove-unneeded-member-variable-from-bac.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0001-tpm-backend-Remove-unneeded-member-variable-from-bac.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0002-tpm-backend-Move-thread-handling-inside-TPMBackend.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0002-tpm-backend-Move-thread-handling-inside-TPMBackend.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0002-tpm-backend-Move-thread-handling-inside-TPMBackend.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0002-tpm-backend-Move-thread-handling-inside-TPMBackend.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0003-tpm-backend-Initialize-and-free-data-members-in-it-s.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0003-tpm-backend-Initialize-and-free-data-members-in-it-s.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0003-tpm-backend-Initialize-and-free-data-members-in-it-s.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0003-tpm-backend-Initialize-and-free-data-members-in-it-s.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0004-tpm-backend-Made-few-interface-methods-optional.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0004-tpm-backend-Made-few-interface-methods-optional.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0004-tpm-backend-Made-few-interface-methods-optional.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0004-tpm-backend-Made-few-interface-methods-optional.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0005-tmp-backend-Add-new-api-to-read-backend-TpmInfo.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0005-tmp-backend-Add-new-api-to-read-backend-TpmInfo.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0005-tmp-backend-Add-new-api-to-read-backend-TpmInfo.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0005-tmp-backend-Add-new-api-to-read-backend-TpmInfo.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0006-tpm-backend-Remove-unneeded-destroy-method-from-TpmD.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0006-tpm-backend-Remove-unneeded-destroy-method-from-TpmD.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0006-tpm-backend-Remove-unneeded-destroy-method-from-TpmD.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0006-tpm-backend-Remove-unneeded-destroy-method-from-TpmD.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0007-tpm-backend-Move-realloc_buffer-implementation-to-ba.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0007-tpm-backend-Move-realloc_buffer-implementation-to-ba.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0007-tpm-backend-Move-realloc_buffer-implementation-to-ba.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0007-tpm-backend-Move-realloc_buffer-implementation-to-ba.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0008-tpm-passthrough-move-reusable-code-to-utils.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0008-tpm-passthrough-move-reusable-code-to-utils.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0008-tpm-passthrough-move-reusable-code-to-utils.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0008-tpm-passthrough-move-reusable-code-to-utils.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu/0009-tpm-Added-support-for-TPM-emulator.patch b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0009-tpm-Added-support-for-TPM-emulator.patch
similarity index 100%
rename from meta-refkit-core/recipes-devtools/qemu/qemu/0009-tpm-Added-support-for-TPM-emulator.patch
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu/0009-tpm-Added-support-for-TPM-emulator.patch
diff --git a/meta-refkit-core/recipes-devtools/qemu/qemu_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu_%.bbappend
similarity index 93%
rename from meta-refkit-core/recipes-devtools/qemu/qemu_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu_%.bbappend
index 34b2d9c5f2..5d472322e3 100644
--- a/meta-refkit-core/recipes-devtools/qemu/qemu_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/qemu/qemu_%.bbappend
@@ -1,13 +1,13 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/qemu:"
 
 # Replace CUSE backend with socket backend.
-SRC_URI_remove_refkit-config = " \
+SRC_URI_remove_df-refkit-config = " \
     file://0001-Provide-support-for-the-CUSE-TPM.patch \
     file://0002-Introduce-condition-to-notify-waiters-of-completed-c.patch \
     file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \
     file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \
 "
-SRC_URI_append_refkit-config = " \
+SRC_URI_append_df-refkit-config = " \
     file://0001-tpm-backend-Remove-unneeded-member-variable-from-bac.patch \
     file://0002-tpm-backend-Move-thread-handling-inside-TPMBackend.patch \
     file://0003-tpm-backend-Initialize-and-free-data-members-in-it-s.patch \
diff --git a/meta-refkit-core/recipes-devtools/quilt/quilt_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/quilt/quilt_%.bbappend
similarity index 57%
rename from meta-refkit-core/recipes-devtools/quilt/quilt_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/quilt/quilt_%.bbappend
index aefd6dfed5..dc8e8e7ec7 100644
--- a/meta-refkit-core/recipes-devtools/quilt/quilt_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-devtools/quilt/quilt_%.bbappend
@@ -1,4 +1,4 @@
-EXTRA_OECONF_append_refkit-config = " \
+EXTRA_OECONF_append_df-refkit-config = " \
     --without-sendmail \
     --with-awk=/usr/bin/awk \
 "
diff --git a/meta-refkit-core/recipes-extended/shadow/shadow_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-extended/shadow/shadow_%.bbappend
similarity index 89%
rename from meta-refkit-core/recipes-extended/shadow/shadow_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-extended/shadow/shadow_%.bbappend
index 6934744f20..fdbf059c9b 100644
--- a/meta-refkit-core/recipes-extended/shadow/shadow_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-extended/shadow/shadow_%.bbappend
@@ -1,4 +1,4 @@
-do_install_append_refkit-config () {
+do_install_append_df-refkit-config () {
     # The base recipe sets GROUP=100="users" as shared group for all
     # users. In IoT Reference OS Kit, each user gets its own group (more secure default
     # because it prevents accidental data sharing when setting something
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend
new file mode 100644
index 0000000000..c8fd087638
--- /dev/null
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend
@@ -0,0 +1,2 @@
+PACKAGECONFIG_remove_df-refkit-config = "glx"
+EXTRA_OECONF_append_df-refkit-config = " --disable-egl"
diff --git a/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend
new file mode 100644
index 0000000000..a85d2c5cae
--- /dev/null
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend
@@ -0,0 +1,2 @@
+DEPENDS_remove_df-refkit-config = "gconf"
+EXTRA_OECONF_append_df-refkit-config = " --disable-gconf"
diff --git a/meta-refkit-core/recipes-security/openssh/files/openssh-sshd.ruleset b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-security/openssh/files/openssh-sshd.ruleset
similarity index 100%
rename from meta-refkit-core/recipes-security/openssh/files/openssh-sshd.ruleset
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-security/openssh/files/openssh-sshd.ruleset
diff --git a/meta-refkit-core/recipes-security/openssh/openssh_%.bbappend b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-security/openssh/openssh_%.bbappend
similarity index 60%
rename from meta-refkit-core/recipes-security/openssh/openssh_%.bbappend
rename to meta-refkit-core/bbappends/openembedded-core/meta/recipes-security/openssh/openssh_%.bbappend
index 9d64390dd1..56baf4601c 100644
--- a/meta-refkit-core/recipes-security/openssh/openssh_%.bbappend
+++ b/meta-refkit-core/bbappends/openembedded-core/meta/recipes-security/openssh/openssh_%.bbappend
@@ -1,16 +1,16 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
-RDEPENDS_${PN}-sshd_append_refkit-firewall = " nftables"
+RDEPENDS_${PN}-sshd_append_df-refkit-firewall = " nftables"
 
-SRC_URI_append_refkit-firewall = "\
+SRC_URI_append_df-refkit-firewall = "\
     file://openssh-sshd.ruleset \
 "
 
-do_install_append_refkit-firewall() {
+do_install_append_df-refkit-firewall() {
     install -d ${D}${libdir}/firewall/services
     install -m 0644 ${WORKDIR}/openssh-sshd.ruleset ${D}${libdir}/firewall/services/
 }
 
-FILES_${PN}_append_refkit-firewall = " \
+FILES_${PN}_append_df-refkit-firewall = " \
     ${libdir}/firewall/services/openssh-sshd.ruleset \
 "
diff --git a/meta-refkit-core/classes/distrooverrides.bbclass b/meta-refkit-core/classes/distrooverrides.bbclass
deleted file mode 100644
index 17b02897b8..0000000000
--- a/meta-refkit-core/classes/distrooverrides.bbclass
+++ /dev/null
@@ -1,23 +0,0 @@
-# Turns certain DISTRO_FEATURES into overrides of the same name
-# or (optionally) some other name. Ensures that these special
-# distro features remain set also for native and nativesdk
-# recipes, so that these overrides can also be used there.
-#
-# This makes it simpler to write .bbappends that only change the
-# task signatures of the recipe if the change is really enabled,
-# for example with:
-#   do_install_append_foobar () { ... }
-# where "foobar" is an optional DISTRO_FEATURE.
-#
-# TODO: is renaming useful? It makes the code more complex and potentially slower (untested).
-
-DISTROFEATURES2OVERRIDES ?= ""
-DISTROFEATURES2OVERRIDES[doc] = "A space-separated list of <feature>[=<override>] entries. \
-Each entry is added to DISTROOVERRIDES with the <feature> name or the optional <override> name, \
-but only when <feature> is in DISTRO_FEATURES."
-
-DISTROOVERRIDES_FEATURES = "${@ ' '.join([x.split('=', 1)[0] for x in d.getVar('DISTROFEATURES2OVERRIDES').split()]) }"
-DISTRO_FEATURES_FILTER_NATIVE_append = " ${DISTROOVERRIDES_FEATURES}"
-DISTRO_FEATURES_FILTER_NATIVESDK_append = " ${DISTROOVERRIDES_FEATURES}"
-
-DISTROOVERRIDES .= "${@ ''.join([':' + (x.split('=')[1] if '=' in x else x) for x in d.getVar('DISTROFEATURES2OVERRIDES').split() if bb.utils.contains('DISTRO_FEATURES', x.split('=', 1)[0], True, False, d)]) }"
diff --git a/meta-refkit-core/classes/refkit-sanity.bbclass b/meta-refkit-core/classes/refkit-sanity.bbclass
index 322a740037..5a2faa63d9 100644
--- a/meta-refkit-core/classes/refkit-sanity.bbclass
+++ b/meta-refkit-core/classes/refkit-sanity.bbclass
@@ -4,6 +4,8 @@ REFKIT_QA_IMAGE_SYMLINK_WHITELIST = " \
     /proc/mounts \
     /run/lock \
     /run/resolv.conf \
+    /run/systemd/resolve/resolv.conf \
+    /run/connman/resolv.conf \
     /var/volatile/log \
     /var/volatile/tmp \
 "
diff --git a/meta-refkit-core/conf/distro/include/refkit-config.inc b/meta-refkit-core/conf/distro/include/refkit-config.inc
index eb558ffee1..ba9cc320b7 100644
--- a/meta-refkit-core/conf/distro/include/refkit-config.inc
+++ b/meta-refkit-core/conf/distro/include/refkit-config.inc
@@ -58,19 +58,25 @@ REFKIT_DEFAULT_DISTRO_FEATURES += "refkit-config"
 # Remove currently unsupported distro features from global defaults
 REFKIT_DEFAULT_DISTRO_FEATURES_REMOVE += "x11 3g"
 
-
-########################################################################
-# additional includes
-########################################################################
-
-# Turns DISTRO_FEATURES into the corresponding overrides.
-require conf/distro/include/refkit-overrides.inc
-
+# Turns these DISTRO_FEATURES into overrides of the same name, for use
+# in conditional variable operations.
+INHERIT += "distrooverrides"
+DISTRO_FEATURES_OVERRIDES += " \
+    refkit-config \
+    refkit-firewall \
+    refkit-computervision \
+    refkit-gateway \
+    refkit-industrial \
+"
 
 #########################################################################
 # Global distro settings.
 #########################################################################
 
+# Several components that refkit depends on aren't ready for gcc7 yet.
+# Can be overridden in local.conf with GCCVERSION_df-refkit-config = "7.%"
+GCCVERSION_df-refkit-config ??= "6.3%"
+
 # refkit images distinguish between development and production mode.
 # Features that are useful only for development and dangerous
 # when used on real devices are not enabled in production mode (example:
@@ -84,7 +90,7 @@ REFKIT_IMAGE_MODE_VALID ??= "development production"
 # Depending on the distro features we need certain kernel features. The assumption
 # here is that all kernels we use support KERNEL_FEATURES *and* have these
 # features.
-KERNEL_FEATURES_append_refkit-config = " \
+KERNEL_FEATURES_append_df-refkit-config = " \
     ${@ bb.utils.contains('DISTRO_FEATURES', 'dm-verity', ' features/device-mapper/dm-verity.scc', '', d) } \
     ${@ bb.utils.contains('DISTRO_FEATURES', 'tpm1.2', ' features/tpm/tpm.scc', '', d) } \
     ${@ bb.utils.contains('DISTRO_FEATURES', 'refkit-firewall', ' features/nf_tables/nf_tables.scc', '', d) } \
@@ -94,77 +100,44 @@ KERNEL_FEATURES_append_refkit-config = " \
 # Defined here because it influences several different recipes.
 REFKIT_USE_DSK_IMAGES ?= "${@bb.utils.contains_any('MACHINE', 'intel-core2-32 intel-corei7-64 intel-quark', 'True', 'False', d)}"
 
-PREFERRED_PROVIDER_virtual/opencl-headers_refkit-config = "opencl-headers"
-PREFERRED_PROVIDER_virtual/opencl-headers-cxx_refkit-config = "opencl-headers-cxx"
+PREFERRED_PROVIDER_virtual/opencl-headers_df-refkit-config = "opencl-headers"
+PREFERRED_PROVIDER_virtual/opencl-headers-cxx_df-refkit-config = "opencl-headers-cxx"
 
 # remove readline support from Bluez to reduce GPLv3 dependencies
-BAD_RECOMMENDATIONS_append_refkit-config = " bluez5-client"
+BAD_RECOMMENDATIONS_append_df-refkit-config = " bluez5-client"
 
 ########################################################################
 # Changes that can be done via PACKAGECONFIG are meant to be done
 # here instead of via .bbappends. SECURITY_* changes go into
-# refkit_security_flags.inc. Everything else is in .bbappends,
-# except when this could lead to a .bbappend without a corresponding
-# .bb file.
+# refkit_security_flags.inc. Everything else is in .bbappends
+# under the "bbappends" directory hierarchy.
 #######################################################################
 
 # Prefer systemd way of creating getty@.service symlinks using
 # systemd-getty-generator (instead of the Yocto default
 # systemd-serialgetty that creates everything in do_install).
-PACKAGECONFIG_append_pn-systemd_refkit-config = " serial-getty-generator"
+PACKAGECONFIG_append_pn-systemd_df-refkit-config = " serial-getty-generator"
 
 # OE-core 7355a3c4f665e066925ea6327ac72365ab1f2f39 added a PACKAGECONFIG
 # to configure cairo/python3-cairo and enabled it by default. It used to
 # be unconditionally disabled and that worked OK for us so we'll restore
 # that to avoid additional build dependencies/supported recipes.
-PACKAGECONFIG_pn-python3-pygobject_refkit-config = ""
+PACKAGECONFIG_pn-python3-pygobject_df-refkit-config = ""
 
 # pango, a graphical text rendering library, is not needed by us.
-PACKAGECONFIG_remove_pn-gstreamer1.0-plugins-base_refkit-config = "pango"
+PACKAGECONFIG_remove_pn-gstreamer1.0-plugins-base_df-refkit-config = "pango"
 
-PACKAGECONFIG_remove_pn-pulseaudio_refkit-config = "avahi"
+PACKAGECONFIG_remove_pn-pulseaudio_df-refkit-config = "avahi"
 
 # build ovmf.secboot (secureboot enabled ovmf BIOS)
-PACKAGECONFIG_append_pn-ovmf_refkit-config = " secureboot"
+PACKAGECONFIG_append_pn-ovmf_df-refkit-config = " secureboot"
 
 # only build minimal gstreamer1.0-plugins-bad
-PACKAGECONFIG_pn-gstreamer1.0-plugins-bad_refkit-config ?= ""
+PACKAGECONFIG_pn-gstreamer1.0-plugins-bad_df-refkit-config ?= ""
 
 # Enable OpenCL.
-PACKAGECONFIG_append_pn-opencv_refkit-config = " opencl"
+PACKAGECONFIG_append_pn-opencv_df-refkit-config = " opencl"
 
 # Use nftables instead of iptables.
-PACKAGECONFIG_remove_pn-connman_refkit-config = "iptables"
-PACKAGECONFIG_append_pn-connman_refkit-config = " nftables"
-
-#########################################################################
-# Changes that normally are better suited for a .bbappend have
-# to be done here if the corresponding .bb file is not guaranteed
-# to be present (i.e. outside of OE-core).
-#########################################################################
-
-# Temporary workaround (needs to be fixed in meta-security once the
-# necessary patch "net-tools: enable native and nativesdk variant"
-# is in OE-core): swtpm_setup.sh needs netstat command.
-DEPENDS_append_pn-swtpm-wrappers-native_refkit-config = " net-tools-native"
-
-# The upstream recipe does not start tcsd automatically, but we
-# want that because the installer image calls the TPM tools
-# without starting tcsd first (it shouldn't have to!), and
-# without tcsd already running, the tools just fail. A better
-# solution would be socket-activation, but tcsd does not support
-# that. Does not matter, tcsd is only installed when needed.
-SYSTEMD_AUTO_ENABLE_forcevariable_pn-trousers_refkit-config = "enable"
-
-# usbutils depends directly on libusb1, not the obsolete compatibility. This removes dependency on libusb-compat.
-DEPENDS_remove_pn-libgphoto2_refkit-config = "virtual/libusb0"
-DEPENDS_append_pn-libgphoto2_refkit-config = " libusb1"
-
-# remove readline dependency from nftables
-DEPENDS_remove_pn-nftables_refkit-config = "readline"
-EXTRA_OECONF_append_pn-nftables_refkit-config = " --without-cli"
-
-# make nftables require a settings package
-VIRTUAL-RUNTIME_nftables-settings ?= "nftables-settings-default"
-RDEPENDS_nftables_append_refkit-config = " ${VIRTUAL-RUNTIME_nftables-settings}"
-
+PACKAGECONFIG_remove_pn-connman_df-refkit-config = "iptables"
+PACKAGECONFIG_append_pn-connman_df-refkit-config = " nftables"
diff --git a/meta-refkit-core/conf/distro/include/refkit-overrides.inc b/meta-refkit-core/conf/distro/include/refkit-overrides.inc
deleted file mode 100644
index 51cfacf732..0000000000
--- a/meta-refkit-core/conf/distro/include/refkit-overrides.inc
+++ /dev/null
@@ -1,14 +0,0 @@
-# Turns certain refkit DISTRO_FEATURES into overrides of the same name.
-# This makes it simpler to write .bbappends that only change the
-# task signatures of the recipe if the change is really enabled,
-# for example with:
-# do_install_append_refkit-firewall () { ... }
-DISTROFEATURES2OVERRIDES += " \
-    refkit-config \
-    refkit-firewall \
-    refkit-computervision \
-    refkit-gateway \
-    refkit-industrial \
-"
-
-INHERIT += "distrooverrides"
diff --git a/meta-refkit-core/conf/layer.conf b/meta-refkit-core/conf/layer.conf
index 4f005d3ca3..f51fd1062b 100644
--- a/meta-refkit-core/conf/layer.conf
+++ b/meta-refkit-core/conf/layer.conf
@@ -2,8 +2,41 @@
 BBPATH .= ":${LAYERDIR}"
 
 # We have recipes-* directories, add to BBFILES
-BBFILES += "${LAYERDIR}/recipes-*/*/*.bb \
-	${LAYERDIR}/recipes-*/*/*.bbappend"
+BBFILES += "${LAYERDIR}/recipes-*/*/*.bb"
+
+# All our .bbappends for other layers are in a separate
+# "bbappends/<layer>" hierarchy. We activate only those
+# bbappends for which the layer they apply to is actually
+# present.
+#
+# Sorted by layer path to keep related layers together.
+BBFILES_DYNAMIC += " \
+    clang-layer:${LAYERDIR}/bbappends/meta-clang/*/*/*.bbappend \
+    flatpak:${LAYERDIR}/bbappends/meta-flatpak/*/*/*.bbappend \
+    intel:${LAYERDIR}/bbappends/meta-intel/*/*/*.bbappend \
+    tlk:${LAYERDIR}/bbappends/meta-intel/meta-tlk/*/*/*.bbappend \
+    librealsense:${LAYERDIR}/bbappends/meta-intel-realsense/*/*/*.bbappend \
+    iotqa:${LAYERDIR}/bbappends/meta-iotqa/*/*/*.bbappend \
+    iotweb:${LAYERDIR}/bbappends/meta-iot-web/*/*/*.bbappend \
+    oic:${LAYERDIR}/bbappends/meta-oic/*/*/*.bbappend \
+    efl-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-efl/*/*/*.bbappend \
+    filesystems-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-filesystems/*/*/*.bbappend \
+    gnome-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-gnome/*/*/*.bbappend \
+    gpe-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-gpe/*/*/*.bbappend \
+    meta-initramfs:${LAYERDIR}/bbappends/meta-openembedded/meta-initramfs/*/*/*.bbappend \
+    multimedia-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-multimedia/*/*/*.bbappend \
+    networking-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-networking/*/*/*.bbappend \
+    openembedded-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-oe/*/*/*.bbappend \
+    perl-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-perl/*/*/*.bbappend \
+    meta-python:${LAYERDIR}/bbappends/meta-openembedded/meta-python/*/*/*.bbappend \
+    ruby-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-ruby/*/*/*.bbappend \
+    systemd-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-systemd/*/*/*.bbappend \
+    webserver:${LAYERDIR}/bbappends/meta-openembedded/meta-webserver/*/*/*.bbappend \
+    xfce-layer:${LAYERDIR}/bbappends/meta-openembedded/meta-xfce/*/*/*.bbappend \
+    security:${LAYERDIR}/bbappends/meta-security/*/*/*.bbappend \
+    security-isafw:${LAYERDIR}/bbappends/meta-security-isafw/*/*/*.bbappend \
+    core:${LAYERDIR}/bbappends/openembedded-core/meta/*/*/*.bbappend \
+"
 
 # Set a variable to get to the top of the IoT Reference OS Kit metadata location.
 META_REFKIT_CORE_BASE := '${LAYERDIR}'
diff --git a/meta-refkit-core/recipes-core/busybox/busybox_%.bbappend b/meta-refkit-core/recipes-core/busybox/busybox_%.bbappend
deleted file mode 100644
index e142e3dadd..0000000000
--- a/meta-refkit-core/recipes-core/busybox/busybox_%.bbappend
+++ /dev/null
@@ -1,11 +0,0 @@
-FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
-
-# refkit.cfg disables CONFIG_SYSLOGD so the corresponding packaging
-# needs to be dropped as well.
-SYSTEMD_PACKAGES_refkit-config = ""
-PACKAGES_remove_refkit-config = "${PN}-syslog"
-RRECOMMENDS_${PN}_remove_refkit-config = "${PN}-syslog"
-
-SRC_URI_append_refkit-config = "\
-    file://refkit.cfg \
-"
diff --git a/meta-refkit-core/recipes-core/packagegroups/packagegroup-core-connectivity.bb b/meta-refkit-core/recipes-core/packagegroups/packagegroup-core-connectivity.bb
index d77d695bc4..bd2d098c2c 100644
--- a/meta-refkit-core/recipes-core/packagegroups/packagegroup-core-connectivity.bb
+++ b/meta-refkit-core/recipes-core/packagegroups/packagegroup-core-connectivity.bb
@@ -11,4 +11,4 @@ RDEPENDS_${PN} = "\
     connman \
     "
 # Poky doesn't feature systemd so add libnss-myhostname conditionally
-RDEPENDS_${PN}_append_refkit-config = " libnss-myhostname"
+RDEPENDS_${PN}_append_df-refkit-config = " libnss-myhostname"
diff --git a/meta-refkit-core/recipes-devtools/bmap-tools/bmap-tools_%.bbappend b/meta-refkit-core/recipes-devtools/bmap-tools/bmap-tools_%.bbappend
deleted file mode 100644
index 3667bd2f67..0000000000
--- a/meta-refkit-core/recipes-devtools/bmap-tools/bmap-tools_%.bbappend
+++ /dev/null
@@ -1 +0,0 @@
-inherit ${@bb.utils.contains('DISTRO_FEATURES', 'refkit-config', 'bmap-tools-deploy', '', d)}
diff --git a/meta-refkit-core/recipes-devtools/python/refkit-python.inc b/meta-refkit-core/recipes-devtools/python/refkit-python.inc
deleted file mode 100644
index 71fe0e5dcd..0000000000
--- a/meta-refkit-core/recipes-devtools/python/refkit-python.inc
+++ /dev/null
@@ -1,9 +0,0 @@
-# Recipe changes not yet upstream which are needed to build images
-# with no GPLv3-licenses components. Upstream OE-core changes will
-# have this configurable, here it only depends on the "refkit-config"
-# distro feature.
-DEPENDS_remove_refkit-config = "readline gdbm db"
-PACKAGES_remove_refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
-PROVIDES_remove_refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
-RRECOMMENDS_${PN}-core_remove_refkit-config = "${PN}-readline"
-RDEPENDS_${PN}-modules_remove_refkit-config = "${PN}-readline ${PN}-gdbm ${PN}-db"
diff --git a/meta-refkit-core/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend b/meta-refkit-core/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend
deleted file mode 100644
index bed404cebc..0000000000
--- a/meta-refkit-core/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_%.bbappend
+++ /dev/null
@@ -1,2 +0,0 @@
-PACKAGECONFIG_remove_refkit-config = "glx"
-EXTRA_OECONF_append_refkit-config = " --disable-egl"
diff --git a/meta-refkit-core/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend b/meta-refkit-core/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend
deleted file mode 100644
index a93e070b5a..0000000000
--- a/meta-refkit-core/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend
+++ /dev/null
@@ -1,2 +0,0 @@
-DEPENDS_remove_refkit-config = "gconf"
-EXTRA_OECONF_append_refkit-config = " --disable-gconf"
diff --git a/meta-refkit-core/recipes-sensors/upm/files/ads1x15-fixed-case-logic-in-getThresh-function.patch b/meta-refkit-core/recipes-sensors/upm/files/ads1x15-fixed-case-logic-in-getThresh-function.patch
new file mode 100644
index 0000000000..c617d14a1b
--- /dev/null
+++ b/meta-refkit-core/recipes-sensors/upm/files/ads1x15-fixed-case-logic-in-getThresh-function.patch
@@ -0,0 +1,54 @@
+From c64d04d084f47b4cb3e1cdee6e96348fcc6a756e Mon Sep 17 00:00:00 2001
+From: Mihai Tudor Panu <mihai.tudor.panu@intel.com>
+Date: Tue, 30 May 2017 15:14:09 -0700
+Subject: [PATCH 1/1] ads1x15: fixed case logic in getThresh() function
+
+Signed-off-by: Mihai Tudor Panu <mihai.tudor.panu@intel.com>
+
+Upstream-Status: Backported [c64d04d084f47b4cb3e1cdee6e96348fcc6a756e]
+
+Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
+
+---
+ src/ads1x15/ads1x15.cxx | 4 ++--
+ src/ads1x15/ads1x15.hpp | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/ads1x15/ads1x15.cxx b/src/ads1x15/ads1x15.cxx
+index 35782709..47701b2a 100644
+--- a/src/ads1x15/ads1x15.cxx
++++ b/src/ads1x15/ads1x15.cxx
+@@ -116,7 +116,7 @@ ADS1X15::setContinuous(bool mode){
+ 
+ float
+ ADS1X15::getThresh(ADSTHRESH reg){
+-     if( THRESH_HIGH && THRESH_LOW) return getLastSample(reg);
++     if(reg == THRESH_HIGH || reg == THRESH_LOW) return getLastSample(reg);
+      else return 0.0;
+ }
+ 
+@@ -137,7 +137,7 @@ ADS1X15::setThresh(ADSTHRESH reg, float value){
+      case 2:
+      case 3:
+           set_value = value / getMultiplier();
+-         set_value = set_value << m_bitShift;
++          set_value = set_value << m_bitShift;
+           if(i2c->writeWordReg(reg, swapWord(set_value)) != mraa::SUCCESS){
+             throw std::runtime_error(std::string(__FUNCTION__) + ": I2c.write() failed");
+             return;
+diff --git a/src/ads1x15/ads1x15.hpp b/src/ads1x15/ads1x15.hpp
+index 7524572d..efd8c8ec 100644
+--- a/src/ads1x15/ads1x15.hpp
++++ b/src/ads1x15/ads1x15.hpp
+@@ -390,7 +390,7 @@ namespace upm {
+              * @param reg ADSTHRES enum value.
+              * Returns 0.0 unless THRESH_HIGH or THRESH_LOW requested.
+              */
+-            float getThresh(ADSTHRESH reg = THRESH_LOW);
++            float getThresh(ADSTHRESH reg = THRESH_DEFAULT);
+ 
+             /**
+              * Sets threshold levels or configures for conversion ready
+-- 
+2.11.0
+
diff --git a/meta-refkit-core/recipes-sensors/upm/upm_git.bb b/meta-refkit-core/recipes-sensors/upm/upm_git.bb
index b38b486feb..d3cd43e88b 100644
--- a/meta-refkit-core/recipes-sensors/upm/upm_git.bb
+++ b/meta-refkit-core/recipes-sensors/upm/upm_git.bb
@@ -10,7 +10,10 @@ DEPENDS = "libjpeg-turbo mraa"
 SRCREV = "106b6c706268522ab0168a4ddb19e89ce832e084"
 PV = "1.3.0-git${SRCPV}"
 
-SRC_URI = "git://github.com/intel-iot-devkit/${BPN}.git;protocol=http"
+SRC_URI = " \
+    git://github.com/intel-iot-devkit/${BPN}.git;protocol=http \
+    file://ads1x15-fixed-case-logic-in-getThresh-function.patch \
+"
 
 S = "${WORKDIR}/git"
 
diff --git a/meta-refkit-extra/doc/README b/meta-refkit-extra/README
similarity index 100%
rename from meta-refkit-extra/doc/README
rename to meta-refkit-extra/README
diff --git a/meta-refkit-industrial/recipes-ros/cmake-modules/cmake-modules_%.bbappend b/meta-refkit-industrial/recipes-ros/cmake-modules/cmake-modules_%.bbappend
index b292afa1ab..7a4cbde088 100644
--- a/meta-refkit-industrial/recipes-ros/cmake-modules/cmake-modules_%.bbappend
+++ b/meta-refkit-industrial/recipes-ros/cmake-modules/cmake-modules_%.bbappend
@@ -1,6 +1,6 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
     file://0001-Add-FindTinyXML2-module.patch \
 "
 
diff --git a/meta-refkit-industrial/recipes-ros/cv-bridge/cv-bridge_%.bbappend b/meta-refkit-industrial/recipes-ros/cv-bridge/cv-bridge_%.bbappend
index 389e41a53a..ee25385475 100644
--- a/meta-refkit-industrial/recipes-ros/cv-bridge/cv-bridge_%.bbappend
+++ b/meta-refkit-industrial/recipes-ros/cv-bridge/cv-bridge_%.bbappend
@@ -1,3 +1,3 @@
 # TODO: This way cv_bridge doesn't require libboost_python, but this tweak
 #       should be dropped after ROS drops compatibility with python2.
-EXTRA_OECMAKE_append_refkit-industrial = " -DANDROID=ON"
+EXTRA_OECMAKE_append_df-refkit-industrial = " -DANDROID=ON"
diff --git a/meta-refkit-industrial/recipes-ros/kdl-parser/kdl-parser_1.11.14.bbappend b/meta-refkit-industrial/recipes-ros/kdl-parser/kdl-parser_1.11.14.bbappend
index e597aca5de..c3548124ff 100644
--- a/meta-refkit-industrial/recipes-ros/kdl-parser/kdl-parser_1.11.14.bbappend
+++ b/meta-refkit-industrial/recipes-ros/kdl-parser/kdl-parser_1.11.14.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/moveit/moveit-ros-planning_0.7.9.bbappend b/meta-refkit-industrial/recipes-ros/moveit/moveit-ros-planning_0.7.9.bbappend
index 409405f1ca..091bf3fa0a 100644
--- a/meta-refkit-industrial/recipes-ros/moveit/moveit-ros-planning_0.7.9.bbappend
+++ b/meta-refkit-industrial/recipes-ros/moveit/moveit-ros-planning_0.7.9.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0002-moveit_ros-planning-Use-TinyXML2-instead-of-TinyXML.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/pluginlib/pluginlib_1.10.5.bbappend b/meta-refkit-industrial/recipes-ros/pluginlib/pluginlib_1.10.5.bbappend
index e597aca5de..c3548124ff 100644
--- a/meta-refkit-industrial/recipes-ros/pluginlib/pluginlib_1.10.5.bbappend
+++ b/meta-refkit-industrial/recipes-ros/pluginlib/pluginlib_1.10.5.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/robot-model/urdf_1.11.13.bbappend b/meta-refkit-industrial/recipes-ros/robot-model/urdf_1.11.13.bbappend
index e597aca5de..c3548124ff 100644
--- a/meta-refkit-industrial/recipes-ros/robot-model/urdf_1.11.13.bbappend
+++ b/meta-refkit-industrial/recipes-ros/robot-model/urdf_1.11.13.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/rospack/rospack_%.bbappend b/meta-refkit-industrial/recipes-ros/rospack/rospack_%.bbappend
index 76e6b5a563..b744fb508d 100644
--- a/meta-refkit-industrial/recipes-ros/rospack/rospack_%.bbappend
+++ b/meta-refkit-industrial/recipes-ros/rospack/rospack_%.bbappend
@@ -1,8 +1,8 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
     file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
     file://0001-Fixed-inverted-result-code-check.patch \
 "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/srdfdom/srdfdom_0.3.5.bbappend b/meta-refkit-industrial/recipes-ros/srdfdom/srdfdom_0.3.5.bbappend
index 27e37abab2..27f6de3683 100644
--- a/meta-refkit-industrial/recipes-ros/srdfdom/srdfdom_0.3.5.bbappend
+++ b/meta-refkit-industrial/recipes-ros/srdfdom/srdfdom_0.3.5.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0002-rewrite-to-use-TinyXML2-instead-of-TinyXML.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit-industrial/recipes-ros/urdfdom-headers/urdfdom-headers_0.3.0.bbappend b/meta-refkit-industrial/recipes-ros/urdfdom-headers/urdfdom-headers_0.3.0.bbappend
index ff5f46c220..a0414e88eb 100644
--- a/meta-refkit-industrial/recipes-ros/urdfdom-headers/urdfdom-headers_0.3.0.bbappend
+++ b/meta-refkit-industrial/recipes-ros/urdfdom-headers/urdfdom-headers_0.3.0.bbappend
@@ -1,5 +1,5 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
             "
diff --git a/meta-refkit-industrial/recipes-ros/urdfdom/urdfdom_0.3.0.bbappend b/meta-refkit-industrial/recipes-ros/urdfdom/urdfdom_0.3.0.bbappend
index e597aca5de..c3548124ff 100644
--- a/meta-refkit-industrial/recipes-ros/urdfdom/urdfdom_0.3.0.bbappend
+++ b/meta-refkit-industrial/recipes-ros/urdfdom/urdfdom_0.3.0.bbappend
@@ -1,7 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
-SRC_URI_append_refkit-industrial = "\
+SRC_URI_append_df-refkit-industrial = "\
             file://0001-Switch-from-TinyXML-to-TinyXML2.patch \
             "
-DEPENDS_remove_refkit-industrial = "libtinyxml"
-DEPENDS_append_refkit-industrial = " libtinyxml2"
+DEPENDS_remove_df-refkit-industrial = "libtinyxml"
+DEPENDS_append_df-refkit-industrial = " libtinyxml2"
diff --git a/meta-refkit/conf/distro/include/refkit-ci.inc b/meta-refkit/conf/distro/include/refkit-ci.inc
index 34f003c923..c190c0fefa 100644
--- a/meta-refkit/conf/distro/include/refkit-ci.inc
+++ b/meta-refkit/conf/distro/include/refkit-ci.inc
@@ -52,7 +52,7 @@ REFKIT_VM_IMAGE_TYPES ?= "wic.xz wic.bmap"
 #
 REFKIT_CI_PREBUILD_SELFTESTS="iotsstatetests.SStateTests.test_sstate_samesigs"
 # NB: run image-installer last until YOCTO #11443 gets fixed.
-REFKIT_CI_POSTBUILD_SELFTESTS="secureboot refkit_poky refkit_license_check image_installer"
+REFKIT_CI_POSTBUILD_SELFTESTS="secureboot refkit_poky meta-refkit-extra refkit_license_check image_installer"
 #
 # Automated build targets
 # Those targets should be space separated list of items,
diff --git a/meta-refkit/lib/oeqa/selftest/cases/meta_refkit_extra.py b/meta-refkit/lib/oeqa/selftest/cases/meta_refkit_extra.py
new file mode 100644
index 0000000000..92d99c445a
--- /dev/null
+++ b/meta-refkit/lib/oeqa/selftest/cases/meta_refkit_extra.py
@@ -0,0 +1,86 @@
+#!/usr/bin/env python
+# ex:ts=4:sw=4:sts=4:et
+# -*- tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*-
+#
+# Copyright (c) 2017, Intel Corporation.
+# All rights reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# AUTHORS
+# Patrick Ohly <patrick.ohly@intel.com>
+
+"""
+Test cases that verify certain aspects of meta-refkit-extra
+in relation to meta-refkit. They need to be here because
+meta-refkit-extra is not enabled by default and thus
+tests defined there wouldn't be found.
+"""
+
+import re
+
+from oeqa.selftest.case import OESelftestTestCase
+from oeqa.utils.commands import runCmd, bitbake, get_bb_var
+
+class MetaRefkitExtra(OESelftestTestCase):
+    """
+    These tests must run in a build configuration that does *not* have
+    meta-refkit-extra.
+    """
+
+    def setUpLocal(self):
+        """
+        This code is executed before each test method.
+        It verifies that meta-refkit-extra is not active.
+        """
+
+        result = runCmd('bitbake-layers show-layers')
+        for layer, path, pri in re.findall(r'^(\S+)\s+(.*?)\s+(\d+)$', result.output, re.MULTILINE):
+            if layer == 'meta-refkit-extra':
+                self.skipTest('meta-refkit-extra already in bblayers.conf')
+            if layer == 'meta-refkit':
+                self.refkit_extra_path = path + '/../meta-refkit-extra'
+        self.extra_conf = "require conf/distro/include/refkit-extra.conf"
+        self.image_dir = get_bb_var('DEPLOY_DIR_IMAGE')
+        self.machine = get_bb_var('MACHINE')
+
+    def enable_refkit_extra(self):
+        '''
+        Adds the meta-refkit-extra layer and enables its content.
+        Will be undone after the test completes.
+        '''
+        self.write_bblayers_config('REFKIT_LAYERS += "%s"' % self.refkit_extra_path)
+        self.write_config(self.extra_conf)
+
+    def test_build_computervision(self):
+        """
+        Build an image with the extra packages mentioned in meta-refkit-extra/doc/computervision.rst.
+        """
+        self.enable_refkit_extra()
+        image = 'refkit-image-common'
+        packages = 'caffe-imagenet-model python3-pyrealsense opencv'
+        result = bitbake(image, postconfig='''
+REFKIT_IMAGE_EXTRA_INSTALL = "%s"
+        ''' % packages)
+
+        # Ensure that the packages really were installed.
+        manifest = os.path.join(self.image_dir, '%s-%s.manifest' % (image, self.machine))
+        with open(manifest) as f:
+            content = f.read()
+            missing = []
+            for package in packages.split():
+                if not package in content.split():
+                    missing.append(package)
+            if missing:
+                self.fail('%s not installed in %s:\n%s' % (missing, manifest, content))
diff --git a/meta-refkit/lib/oeqa/selftest/cases/refkit_poky.py b/meta-refkit/lib/oeqa/selftest/cases/refkit_poky.py
index abd710bb15..a1276bad49 100644
--- a/meta-refkit/lib/oeqa/selftest/cases/refkit_poky.py
+++ b/meta-refkit/lib/oeqa/selftest/cases/refkit_poky.py
@@ -31,12 +31,30 @@
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, bitbake, get_bb_var, get_bb_vars, runqemu
 
+def find_layers():
+    layers = {}
+    result = runCmd('bitbake-layers show-layers')
+    for layer, path, pri in re.findall(r'^(\S+) +([^\n]*?) +(\d+)$', result.output, re.MULTILINE):
+        layers[layer] = path
+    # meta-poky should not be active. We expect it next to the meta-refkit layer.
+    if not 'meta-poky' in layers:
+        layers['meta-poky'] = os.path.join(os.path.dirname(layers['meta-refkit']), 'meta-yocto', 'meta-poky')
+    return layers
+
+class RefkitLayers():
+    """
+    Locates existing layers as part of the class construction. Useful for
+    sharing that information across different other classes.
+    """
+
+    layers = find_layers()
+
 class RefkitPokyMeta(type):
     """
     Generates different instances of test_compat_meta_<layer> for each refkit layer.
     """
     def __new__(mcs, name, bases, dict):
-        def gen_test(refkit_layer):
+        def add_test(dict, refkit_layer, path):
             def test(self):
                 """
                 Test Yocto Compatible 2.0 status of each refkit layer.
@@ -48,7 +66,7 @@ def test(self):
                 cmd = "%s/scripts/yocto-compat-layer.py --dependency %s -- %s" % (
                     self.layers['meta-refkit'],
                     ' '.join(self.layers.values()),
-                    self.layers[refkit_layer])
+                    path)
                 # "world" does not include images. We need to enable them explicitly, otherwise
                 # their dependencies won't be checked. Only "development" mode is guaranteed to
                 # work out-of-the-box. However, images change their signatures when adding
@@ -75,22 +93,23 @@ def test(self):
                 if 'INFO: FAILED' in result.output:
                     self.fail(result.output)
                 self.logger.info('%s:\n%s' % (cmd, result.output))
-            return test
-
-        layers = {}
-        result = runCmd('bitbake-layers show-layers')
-        for layer, path, pri in re.findall(r'^(\S+) +([^\n]*?) +(\d+)$', result.output, re.MULTILINE):
-            layers[layer] = path
-        # meta-poky should not be active. We expect it next to the meta-refkit layer.
-        if not 'meta-poky' in layers:
-            layers['meta-poky'] = os.path.join(os.path.dirname(layers['meta-refkit']), 'meta-yocto', 'meta-poky')
-        dict['layers'] = layers
-        for refkit_layer in [x for x in layers.keys() if x.startswith('meta-refkit')]:
+
             test_name = 'test_compat_%s' % refkit_layer.replace('-', '_')
-            dict[test_name] = gen_test(refkit_layer)
+            dict[test_name] = test
+
+        # Test all active refkit layers.
+        for refkit_layer in [x for x in RefkitLayers.layers.keys() if x.startswith('meta-refkit')]:
+            add_test(dict, refkit_layer, RefkitLayers.layers[refkit_layer])
+
+        # And also all inactive ones that we find next to meta-refkit.
+        root_dir = os.path.dirname(RefkitLayers.layers['meta-refkit'])
+        for entry in os.listdir(root_dir):
+            if entry.startswith('meta-refkit') and entry not in RefkitLayers.layers:
+                add_test(dict, entry, os.path.join(root_dir, entry))
+
         return type.__new__(mcs, name, bases, dict)
 
-class TestRefkitPoky(OESelftestTestCase, metaclass=RefkitPokyMeta):
+class TestRefkitPokyBase(OESelftestTestCase, RefkitLayers):
     """
     Tests content from refkit against Poky. We do not want to depend on the
     combined poky repo, though, so Poky in this context is OE-core + meta-poky.
@@ -121,8 +140,8 @@ class TestRefkitPoky(OESelftestTestCase, metaclass=RefkitPokyMeta):
 
     @classmethod
     def setUpClass(cls):
-        super(TestRefkitPoky, cls).setUpClass()
         """Queries the local configuration to find the relevant directories."""
+        super(TestRefkitPokyBase, cls).setUpClass()
         cls.build_dir = os.getcwd()
         cls.poky_dir = os.path.join(cls.build_dir, 'refkit-poky')
         cls.poky_conf_dir = os.path.join(cls.poky_dir, 'conf')
@@ -199,9 +218,16 @@ def tearDownLocal(self):
         self.testinc_bblayers_path = self.old_testinc_bblayers_path
 
 
-    def add_refkit_layers(self):
+    def add_refkit_layers(self, filter=[]):
         """Add all layers also active in the parent refkit build dir."""
-        self.append_bblayers_config('BBLAYERS += "%s"' % (' '.join([self.layers[x] for x in self.layers.keys() if x not in self.poky_layers])))
+        self.append_bblayers_config('BBLAYERS += "%s"' % (' '.join([self.layers[x] for x in self.layers.keys() if x not in self.poky_layers and (not filter or x in filter)])))
+
+
+class TestRefkitPokySignatures(TestRefkitPokyBase, metaclass=RefkitPokyMeta):
+    """
+    Test that signatures are not changed. Most of the tests are generated
+    dynamically by RefkitPokyMeta.
+    """
 
     def test_refkit_conf_signature(self):
         """Ensure that including the refkit config does not change the signature of other layers."""
@@ -223,16 +249,26 @@ def test_refkit_conf_signature(self):
         finally:
             sys.path = old_path
 
+
+class TestRefkitPokyBuilds(TestRefkitPokyBase):
+    """
+    Test actual image building with Poky as base distribution.
+    """
+
     def test_common_poky_config(self):
         """
         A full image build test of the common image,
-        without the refkit-config.inc.
+        without the refkit-config.inc. We cannot guarantee that content from other
+        layers than OE-core and meta-refkit-core actually builds in such
+        a configuration (additional layers might not be compatible with
+        OE-core master yet), so we limit testing to OE-core and our own
+        additional content.
 
         Poky uses sysvinit. Actually building an image runs
         also postinst and various rootfs manipulation code,
         and some of that might assume that systemd is used.
         """
-        self.add_refkit_layers()
+        self.add_refkit_layers(filter=['meta-refkit-core'])
 
         # We need an image that we can log into, so zap the root password.
         self.append_config('''
diff --git a/meta-refkit/recipes-core/ovmf/ovmf_%.bbappend b/meta-refkit/recipes-core/ovmf/ovmf_%.bbappend
index a19ffa7476..7c39b04956 100644
--- a/meta-refkit/recipes-core/ovmf/ovmf_%.bbappend
+++ b/meta-refkit/recipes-core/ovmf/ovmf_%.bbappend
@@ -1,6 +1,6 @@
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
-SRC_URI_append_class-target_refkit-config = " \
+SRC_URI_append_class-target_df-refkit-config = " \
 	file://0001-ovmf-RefkitTestCA-TEST-UEFI-SecureBoot.patch \
 "
diff --git a/openembedded-core b/openembedded-core
index b51383e526..1d9a88f635 160000
--- a/openembedded-core
+++ b/openembedded-core
@@ -1 +1 @@
-Subproject commit b51383e5268ff33e43a39862814e065afbbd10ca
+Subproject commit 1d9a88f635549e68562de681e297b9270ad02d4e