summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ffmpeg: fix CVE-2024-31582Archana Polampalli2024-11-272-0/+35
| | | | | | | | | | | FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input. (From OE-Core rev: d675ceadf5844524e9f77c2c9b76b9ca42e699fc) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-50008Archana Polampalli2024-11-272-0/+30
| | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component. (From OE-Core rev: 433c84c528bb9920399abfe9e9461d26a929bc7a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-51793Archana Polampalli2024-11-272-0/+68
| | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane. (From OE-Core rev: be875832526636638a034680f837241c16e2b26d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-32230Archana Polampalli2024-11-272-0/+36
| | | | | | | | | | FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0 (From OE-Core rev: 6eb7dc3eecbbe115f95864d587fb3d5557321973) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: Backport fix for CVE-2024-52533Vijay Anusuri2024-11-272-0/+50
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/glib/-/commit/ec0b708b981af77fef8e4bbb603cde4de4cd2e29 Reference: https://security-tracker.debian.org/tracker/CVE-2024-52533 (From OE-Core rev: c7ecdd6530e18efd651e2ea57565481f66f7b1cf) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Backport fix for CVE-2024-52530 and CVE-2024-52532Vijay Anusuri2024-11-274-0/+230
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/04df03bc092ac20607f3e150936624d4f536e68b & https://gitlab.gnome.org/GNOME/libsoup/-/commit/6adc0e3eb74c257ed4e2a23eb4b2774fdb0d67be & https://gitlab.gnome.org/GNOME/libsoup/-/commit/29b96fab2512666d7241e46c98cc45b60b795c0c (From OE-Core rev: 87b0badcb1d10eddae31ac7b282a4e44778d63af) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix for CVE-2024-52530 and CVE-2024-52532Vijay Anusuri2024-11-274-1/+232
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/04df03bc092ac20607f3e150936624d4f536e68b & https://gitlab.gnome.org/GNOME/libsoup/-/commit/6adc0e3eb74c257ed4e2a23eb4b2774fdb0d67be & https://gitlab.gnome.org/GNOME/libsoup/-/commit/29b96fab2512666d7241e46c98cc45b60b795c0c (From OE-Core rev: 5c96ff64b5c29e589d776d23dbbed64ad526a997) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport fix for multiple CVE'sVijay Anusuri2024-11-276-0/+255
| | | | | | | | | | | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-46951 CVE-2024-46952 CVE-2024-46953 CVE-2024-46955 CVE-2024-46956 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/ghostscript/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ada21374f0c90cc3acf7ce0e96302394560c7aee & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1fb76aaddac34530242dfbb9579d9997dae41264 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ca1fc2aefe9796e321d0589afe7efb35063c8b2a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c] (From OE-Core rev: 21a81b592a33504d90f8c53842719cb1fcf96271) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.23kirkstone-4.0.23Steve Sakoman2024-11-151-1/+1
| | | | | | (From OE-Core rev: fb45c5cf8c2b663af293acb069d446610f77ff1a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 4.0.23Steve Sakoman2024-11-151-1/+1
| | | | | | (From meta-yocto rev: 20a38f21b26408d8b2598f0709ebc9cdcf1d05e2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "sphinx-static/switchers.js.in: do not refer to URL_ROOT anymore"Antonin Godard2024-11-151-6/+0
| | | | | | | | | This reverts commit 6c16f7481b8b175271072062925959bbaba2ec5f. (From yocto-docs rev: 188d4317fc7c6ebf0e6803e3240e9e3ba2024442) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "doc: Makefile: remove inkscape, replace by rsvg-convert"Antonin Godard2024-11-151-4/+4
| | | | | | | | | This reverts commit 1ecb50eacc6510e1b77215fd6af36b1f7ffdeabe. (From yocto-docs rev: fd710eb3f15ed4d6a50cab52ba25c62dcd445a96) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "doc: Makefile: add support for xelatex"Antonin Godard2024-11-152-10/+2
| | | | | | | | | This reverts commit 0a6944b9f90b4d3babbdec9dee18fb8195b0db06. (From yocto-docs rev: 08fae3c2dd1dbd898c028a4e713ca4d388ccee6b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "doc: Makefile: publish pdf and epub versions too"Antonin Godard2024-11-151-3/+1
| | | | | | | | | This reverts commit 96947b5c0e79fa0e9500388585cce5f2b91e69db. (From yocto-docs rev: 26b78e1c2f63280cf228bba7349a0ca8bfdd8fd2) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "doc: add a download page for epub and pdf"Antonin Godard2024-11-152-18/+0
| | | | | | | | | This reverts commit a9fc5432fdb568103ba9b719f71e66895f939792. (From yocto-docs rev: 0ba95ca4e2f714789022cafa28d582d91d50b9c3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: document how to provide confs from layer.confAntonin Godard2024-11-151-0/+90
| | | | | | | | | | | | | | | | | | | | | | | | Add a section on providing global level configuration from the layer.conf file. Since this file is parsed at an earlier stage in the parsing process, it's not possible to combine bb.utils.contains and {DISTRO,MACHINE}_FEATURES to conditionally set some configurations. This patch documents: - First that this file can be used for providing such configuration. - Then demonstrate how to conditionally provide them, using a technique that is currently used in meta-virtualization (https://git.yoctoproject.org/meta-virtualization/tree/conf/layer.conf#n50). Fixes [YOCTO #12688]. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: e49111c280927c922ab40547c02c11772787b731) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 31e5bd3e82e11f77da2abd96eb8c17a7c8194b7c) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* conf.py: add a bitbake_git extlinkAntonin Godard2024-11-151-0/+1
| | | | | | | | | | | | | To make references to the bitbake repo, add an extlink for it and use it in the docs with ":bitbake_git:`lib/bb/utils.py </tree/lib/bb/utils.py>`". Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 579da2e7222c1bd21948205f470d97435f3b2cc3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 8bf3c656ec54a582c75ca7c135121a15f8e4f631) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sphinx-static/switchers.js.in: do not refer to URL_ROOT anymoreAntonin Godard2024-11-151-0/+6
| | | | | | | | | | | | | | | | | This variable was removed from the Sphinx-generated documentation_options.js, thus breaking the current implementation of our switchers.js. Like searchtools.js, which is also generated by Sphinx, use document.documentElement.dataset.content_root as a replacement. To be backwards-compatible to get one or the other. (From yocto-docs rev: 6c16f7481b8b175271072062925959bbaba2ec5f) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 2849690abf94872e259e712128e90413f3b9a2f2) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* doc: add a download page for epub and pdfAntonin Godard2024-11-152-0/+18
| | | | | | | | | | | | | | These files are placed in the _static directory during publish. Note that Sphinx does not complain if files do not exist during compilation (since they are copied at the end). This is why this was used instead of the ":download:" role. (From yocto-docs rev: a9fc5432fdb568103ba9b719f71e66895f939792) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 38aa55418426227203fe3a106fa1e85494a57c12) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* doc: Makefile: publish pdf and epub versions tooMichael Opdenacker2024-11-151-1/+3
| | | | | | | | | | | | | | Copy the generated files in the special _static directory. Fixes [YOCTO #14357] (From yocto-docs rev: 96947b5c0e79fa0e9500388585cce5f2b91e69db) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b6974695993599959c0d5b7436aa290ee5d0dfca) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* doc: Makefile: add support for xelatexAntonin Godard2024-11-152-2/+10
| | | | | | | | | | | | | | | | | | | This patch makes the "latexpdf" target compile the documentation with xelatex instead of the default pdflatex engine. The reason behind this is stated in [YOCTO #14357]: pdflatex does not support compiling foreign characters, so we need to resort to another engine, here xelatex. It also increases the texmf config buf_size to 10000000 to avoid a compilation error. (From yocto-docs rev: 0a6944b9f90b4d3babbdec9dee18fb8195b0db06) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 93848842b3ad8aa6b9c9f46d60f2c2ad396c6971) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* doc: Makefile: remove inkscape, replace by rsvg-convertAntonin Godard2024-11-151-4/+4
| | | | | | | | | | | | Remove inkscape as it is not part of meta/, and use librsvg so we can ship it in a buildtools tarball for the autobuilder workers. (From yocto-docs rev: 1ecb50eacc6510e1b77215fd6af36b1f7ffdeabe) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 0caa432b888209bd80443df230143761e1faf415) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* doc/Makefile: fix epub and latexpdf targetsMichael Opdenacker2024-11-151-0/+2
| | | | | | | | | | | Fixing "make clean" followed by "make epub" or "make latexpdf" (From yocto-docs rev: 32ee0f8da7e367655e4c54b471ee93b6ddc0895b) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> (cherry picked from commit 0dac10fc3d170fb162f4df6547541071bfa7a94e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* contributor-guide: Remove duplicated wordsTalel BELHAJSALEM2024-11-151-1/+1
| | | | | | | | | | | | | Remove "and then" as it is duplicated. (From yocto-docs rev: 09ca306a8d5fc5306388f2093541ba4110f603ea) Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 52ed947120e400620277a58f895294b558a9324e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Fix envp bug and add posix_spawn wrapperRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | Fix pseudo with python 3.13 by adding a wrapper for posix_spawn and fixing a NULL pointer dereference in envp handling it uncovered. This fixes issues on Fedora 41. (From OE-Core rev: 89b64526ac2bf0609a18c4d44b4835028f686978) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to include open symlink handling bugfixRichard Purdie2024-11-151-1/+1
| | | | | | | | | Update to a new revision which includes "Bugfix for Linux open(O_CREAT|O_EXCL)" (From OE-Core rev: cc87b332c5d09d4d7aaa2569fa046a16012597d2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Fix to work with glibc 2.40Richard Purdie2024-11-151-2/+8
| | | | | | | | | | | glibc 2.40 renames some internal header variables. Update our hack to work with the new version. These kinds of problems illustrate we need to address the issue properly. (From OE-Core rev: 63d7c11b46119f0c97d08f2fa837c02e633ab75f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in python 3.12+ fixRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | Pull in a fix which avoids syntax warnings with python 3.12. (From OE-Core rev: 82526703823e252070dbf689e6f82a12ceb3b035) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in fchmodat fixRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | This is needed to work with coreutils 9.5. Also contains some README tweaks. (From OE-Core rev: c2549844031c30d2c1a6965ee66f163878d46fab) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in gcc14 fix and missing statvfs64 interceptRichard Purdie2024-11-152-14/+1
| | | | | | | | | | | | | | | | rpm 4.19 now builds with LFS64 support enabled by default, so it calls statvfs64() to get the space available on the filesystem it is installing packages into. This is not getting caught by pseudo, so rpm is checking the host's root filesystem, rather than the filesystem where the build is happening. Merge in that fix and a gcc14 fix. (From OE-Core rev: 1b181d1fcef45f969ef9147912995d80dbe87d87) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in syncfs probe fixRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | | | | | | | | Pulls in the changes: Eilís 'pidge' Ní Fhlannagáin (1): subports: Add _GNU_SOURCE for syncfs probe Richard Purdie (1): SECURITY.md: Add file Wu Zhenyu (1): pseudo.1: Fix a typo (From OE-Core rev: 40a013f7134aec1d0e953ad4906944072cfb2ca1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in fd leak fixAlexandre Belloni2024-11-151-1/+1
| | | | | | | | | | | | | | | | | Pull in: pseudo_util.c: Open file with O_CLOEXEC to avoid fd leak Use close-on-exec (O_CLOEXEC) flag when open log file to make sure its file descriptor is not leaked to parent process on fork/exec. Fixes [YOCTO #13311] (From OE-Core rev: b8445072f4009b3e912792931bd71a4201d541e9) Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to include logic fixRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | The logic in the previous commit was reversed, update to fix it. (From OE-Core rev: 9b06d2741191333c7b11c66e9ab5848f95cb4e42) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Switch back to the master branchRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | | | | OE is the main user of pseudo and we've had the changes in the oe-core branch around long enough that we're going to run with them. Swicth back to directly using the master branch. (From OE-Core rev: 198ff9141f94c551d2a29f3a036c209e3e554a37) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Luca: re-add 'branch' parameter to fix "does not set any branch parameter" warning] Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Disable LFS on 32bit archesKhem Raj2024-11-151-0/+7
| | | | | | | | | | | pseudo overrides certain libc functions which are aliases when LFS64 is enabled. In anycase pseudo may not be of much use on 32bit systems (From OE-Core rev: 215367b62ac1f48ba224e56e7b8862c0a7bdbcd0) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Update to pull in linux-libc-headers race fixRichard Purdie2024-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update to pull in: pseudo.c: Avoid patch mismatch errors for NAMELESS file entries In rare cases we see failures, often in linux-libc-headers for things like: | INSTALL /XXX/linux-libc-headers/6.1-r0/image/usr/include | abort()ing pseudo client by server request. See https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on this. Pseudo log: path mismatch [2 links]: ino 46662476 db 'NAMELESS FILE' req '/XXX/linux-libc-headers/6.1-r0/image/usr'. Setup complete, sending SIGUSR1 to pid 3630890. Whilst this doesn't easily reproduce, the issue is that multiple different processes are likely working on the directory and the creation in pseudo might not match accesses made by other processes. Ultimately, the "NAMELESS FILE" is harmless and pseudo will reconcile things so rather than error out, we should ignore this case. (From OE-Core rev: 77d018ce3b3a9390a5cc020bce9f9ea9017820dd) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4f30a1a74828e105cbe69677b3fbe5623f371543) Signed-off-by: Fabio Berton <fabio.berton@criticaltechworks.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Fix sporadic issues when determining compiler internalsPhilip Lorenz2024-11-152-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | When `-pipe` is enabled, GCC passes data between its different executables using pipes instead of temporary files. This leads to issues when cmake attempts to infer compiler internals via the `-v` parameter as each executable will print to `stderr` in parallel. In turn this may lead to compilation issues down the line as for example the system include directories could not be determined properly which may then propagate to issues such as: recipe-sysroot/usr/include/c++/11.3.0/cstdlib:75:15: fatal error: stdlib.h: No such file or directory | 75 | #include_next <stdlib.h> | | ^~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | WARNING: exit code 1 from a shell command. Fix this stripping `-pipe` from the command line used to determine compiler internals. (From OE-Core rev: 8e2233fd0509b9f20c19d5006dd7ef0c2260bdba) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* patch.py: Use shlex instead of deprecated pipeOla x Nilsson2024-11-151-6/+5
| | | | | | | | | | | | | | The pipe library is deprecated in Python 3.11 and will be removed in Python 3.13. pipe.quote is just an import of shlex.quote anyway. Clean up imports while we're at it. (From OE-Core rev: 8eec5c4417301ea3b38e6662e7b29c9071f233e1) Signed-off-by: Ola x Nilsson <olani@axis.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 5f33c7b99a991c380d1813da8248ba5470ca4d4e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: patch regression of CVE-2023-32665Peter Marko2024-11-152-0/+69
| | | | | | | | | | | | | | | | Official CVE-2023-32665 patch introduced a regression for big-endian architectures. This code was backported in CVE-2023-32665-0003.patch Reported in [1] and fixed by [2] where this patch is picked from. [1] https://gitlab.gnome.org/GNOME/glib/-/issues/2839 [2] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3136 (From OE-Core rev: 2400e143477cc93d4698df921bd89ef4b8b4692b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expat: patch CVE-2024-50602Peter Marko2024-11-153-0/+96
| | | | | | | | | | | | | Pick commits from https://github.com/libexpat/libexpat/pull/915 Not picking test is suboptimal, but test structure was changed meanwhile so we'd have to invent new code. Skipping tests was already done in previous expat/kirkstone CVE patches. (From OE-Core rev: 2cf8325876aa4d43151f5a327a21834db37bf0cb) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: ignore CVE-2024-0444Peter Marko2024-11-151-0/+3
| | | | | | | | | | This CVE is patched in gstreamer1.0-plugins-bad. cpe product is set to gstreamer, they share source git repository. (From OE-Core rev: e64d90d4c52f2e236dbe3b24b7deffce10452671) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: patch CVE-2024-9681Peter Marko2024-11-152-0/+86
| | | | | | | | | | | | Picked commit [1] per solution described in [2]. [1] https://github.com/curl/curl/commit/a94973805df96269bf [2] https://curl.se/docs/CVE-2024-9681.html (From OE-Core rev: fbb8928ea85980bb866febd66e5e18ad843dbef8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2023-46361Archana Polampalli2024-11-152-0/+33
| | | | | | | | | | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. (From OE-Core rev: 3e9018fb14466495be7472a8620918347c732e86) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: codeparser: Fix handling of string AST nodes with older Python versionsPhilip Lorenz2024-11-151-13/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Commits 4591011449212c8e494ea42348acb2d27a82a51b and 6c19b6cf105ac321ec89da1a876a317020c45ab7 unconditionally changed codeparser to rely on CPython 3.8 semantics. However, kirkstone continues to support CPython versions >= 3.6.0 and as such string AST nodes were no longer correctly identified. Fix this by continuing to use `ast.Str` for Python versions < 3.8.0 and only using the new code path for more recent versions. Detecting which version of the AST API to use seems to be non-trivial so the Python feature version is used instead. Instances of this issue can be identified when executing bitbake with debug logging: while parsing MACHINE_ARCH, in call of d.getVar, argument ''TUNE_PKGARCH'' is not a string literal As a consequence of these parsing issues, bitbake may assume that task inputs haven't changed and as such erroneously reuse sstate objects when it shouldn't. (Bitbake rev: fb73c495c45d1d4107cfd60b67a5b4f11a99647b) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: variables: add SIGGEN_LOCKEDSIGS* variablesJulien Stephan2024-11-111-0/+44
| | | | | | | | | | | | | | | | Variables SIGGEN_LOCKEDSIGS, SIGGEN_LOCKEDSIGS_TASKSIG_CHECK and SIGGEN_LOCKEDSIGS_TYPES are used to lock specific tasks to specific signatures. They are used by bitbake -S <lockedsigs> and bblock, so add documentation for them. (From yocto-docs rev: 1f61cd4a3e9c5bf75910559ddf2372f921c2a4ef) Signed-off-by: Julien Stephan <jstephan@baylibre.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 32e3995bed2836f549866ec3b8ad254bdda37dbf) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* styles: vocabularies: Yocto: add sstateJulien Stephan2024-11-111-0/+1
| | | | | | | | | | | | | | Add sstate as an accepted word to avoid errors when runnign make stylecheck. (From yocto-docs rev: 7bd247bb3d8ff78757de1dedf1f87d86b3e3e08b) Signed-off-by: Julien Stephan <jstephan@baylibre.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1c50726296e876747ea3f862729e953f025ce619) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation: Makefile: add SPHINXLINTDOCS to specify subset to sphinx-lintJulien Stephan2024-11-112-12/+21
| | | | | | | | | | | | | | | | | | | | | make sphinx-lint runs sphinx-lint on the whole documentation which can be long and reports a lot or errors/warnings. Let's add a new SHPINXLINTDOCS variable to allow specifying a subset, just as VALEDOCS does. Keep variable assignment aligned and also use $(SOURCEDIR) by default for SPHINXLINTDOCS and VALEDOCS variables. Also update the README file and fix a typo in Link checking section title. (From yocto-docs rev: ae46746897361d4177f3c4284f46753e3aa8c3c3) Signed-off-by: Julien Stephan <jstephan@baylibre.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Tested-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 3dfe7b5c746af31de74f67cf88214e5d52bdb65d) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* README: add instruction to run Vale on a subsetJulien Stephan2024-11-111-0/+8
| | | | | | | | | | | | | | | | make stylecheck runs Vale on the whole documentation which can be long and reports a lot of errors/warnings. We can run Vale on a subset using the VALEDOCS variable, so update documentation to highlight it. (From yocto-docs rev: 038cc992af79718787a70dd620eb195c84a847dd) Signed-off-by: Julien Stephan <jstephan@baylibre.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Tested-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 262237f72534c983e178231cb6839ed69709c443) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: add description for the "sysroot" termMichael Opdenacker2024-11-111-0/+25
| | | | | | | | | | This term is used throughout the manual but is not properly introduced anywhere. (From yocto-docs rev: ced1bbb88a8046b1307376cd88ea85110677c9fc) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* conf.py: rename :cve: role to :cve_nist:Antonin Godard2024-11-1130-466/+466
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Newer versions of Sphinx already define a :cve: role that points to cve.org, instead of the role we defined in conf.py that points to nvd.nist.gov. Rename our role to :cve_nist: to avoid warnings (treated as errors). This is also backwards compatible, meaning we can build the doc with an older Sphinx if needed. The file were automatically replaced with following command: find . -name '*.rst' -exec sed -i 's/:cve:/:cve_nist:/g' {} \+ Cherry pick: * Changes on following files removed from cherry pick (not part of kirkstone): documentation/migration-guides/release-notes-4.1.1.rst documentation/migration-guides/release-notes-4.1.2.rst documentation/migration-guides/release-notes-4.1.3.rst documentation/migration-guides/release-notes-4.1.4.rst documentation/migration-guides/release-notes-4.1.rst documentation/migration-guides/release-notes-4.2.1.rst documentation/migration-guides/release-notes-4.2.2.rst documentation/migration-guides/release-notes-4.2.3.rst documentation/migration-guides/release-notes-4.2.4.rst documentation/migration-guides/release-notes-4.2.rst documentation/migration-guides/release-notes-4.3.1.rst documentation/migration-guides/release-notes-4.3.2.rst documentation/migration-guides/release-notes-4.3.3.rst documentation/migration-guides/release-notes-4.3.4.rst documentation/migration-guides/release-notes-4.3.rst documentation/migration-guides/release-notes-5.0.2.rst documentation/migration-guides/release-notes-5.0.3.rst documentation/migration-guides/release-notes-5.0.rst documentation/migration-guides/release-notes-5.1.rst * Fix minor conflicts in following files: documentation/migration-guides/release-notes-3.4.2.rst: missing :term: before CVE_PRODUCT documentation/migration-guides/release-notes-4.0.2.rst: missing :term: before PACKAGECONFIG documentation/migration-guides/release-notes-4.0.7.rst: missing cve 2022-32912 on webkitgtk Suggested-By: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: f432e78fef82c5e5bfdfff08bb18757dc3479465) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 15fa3b7e85dde50d7236c1738ad607531cc654b8) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-12 21:26:10 +0000