summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* devtool: ide-sdk remove the plugin from eSDK installerAdrian Freihofer2025-02-031-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ide-sdk command bootstraps the SDK from the bitbake environment before the IDE configuration is generated. In the case of the eSDK installer, the bootstrapping is performed during the installation of the eSDK installer. Running the ide-sdk plugin from an eSDK installer based setup would require skipping the bootstrapping and probably taking some other differences into account when generating the IDE configurations. This would be possible. But it will probably never be implemented, as running devtool ide-sdk directly from the bitbake environment is much more flexible. Also, some of the recent improvements that have made it into the core have the potential to make the eSDK installer obsolete at some point in the future: - bitbake-layers create-layers-setup replicates the layers - bitbake-config-build replicates the build configuration - The new sstate mirror features replicate the sstate - bblock locks the sstate more flexible than the eSDK installer - devtool ide-sdk bootstraps the SDK directly from the bitbake environment. The same environment-setup... file is provided with --mode=shared. The devtool modify based workflow is supported since always by devtool and also the default --mode of devtool ide-sdk. These functions essentially cover what the eSDK installer does without a need for the current implementation of the eSDK installer and the populate_sdk_ext, which is hard to maintain and takes a lot of time to build. This means that instead of making the ide-sdk plugin compatible with the eSDK installer, we should rather replace the current implementation of the eSDK installer and populate_sdk_ext with an implementation that can replicate a normal bitbake environment in a convenient way where the ide-sdk plugin also just works without additional complexity. (From OE-Core rev: f50306ea3e174b8db46b20b68a7ac4299a69f50d) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oe-selftest: devtool ide-sdk use modify debug-buildAdrian Freihofer2025-02-031-1/+1
| | | | | | | | (From OE-Core rev: 1528d6aa060811402eaecb1a9fe16bfec0417c98) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* devtool: ide-sdk recommend DEBUG_BUILDAdrian Freihofer2025-02-031-41/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The debug_build_config function was never called. Compiling with debug optimized compiler flags was not working. Even with the --debug-build-config flag set, the build configuration from the recipe was used. The devtool ide-sdk --debug-build-config approach didn't work very well anyway. The problem is that changing the bbappend file doesn't work while bitbake uses the bbappend file. As a workaround, it would be possible to parse the recipe, get DEBUG_BUILD and the path to the append file, exit tinfoil, change the bbappend file, reopen tinfoil and do what ide-sdk is supposed to do. Such an implementation would be complicated and slow. Therefore, the code that was originally supposed to implement this is removed from ide-sdk and the new --debug-build function of devtool modify is used instead. Additionally, a hint should be given on how to manually add DEBUG_BUILD = '1' to bbappend. This is compatible with the VSCode Bitbake plug-in, which does not support this parameter anyway. (From OE-Core rev: 23795962683c792347a17854fb0521734497d4a8) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* devtool: ide-sdk sort cmake presetAdrian Freihofer2025-02-031-2/+2
| | | | | | | | | | | Sort the keys of the generated CMakeUserPreset.json file to make it easier to search and compare. (From OE-Core rev: b12dbde1ea30dd0fc1dd9352de948b8377c347fa) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* devtool: modify support debug-buildsAdrian Freihofer2025-02-031-0/+3
| | | | | | | | | | | | | Add a new option --debug-builds to automatically add DEBUG_BUILD = “1” to the bbappend file of this recipe. This is especially useful when invoking devtool modify before invoking devtool ide-sdk to perform a remote debugging session. (From OE-Core rev: fa30d8dd71393e10aa678c6e938c23d486b336c6) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and ↵Marek Vasut2025-02-033-64/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UBOOT_ENV enabled In case both UBOOT_SIGN_ENABLE and UBOOT_ENV are enabled and kernel-fitimage.bbclass is in use to generate signed kernel fitImage, there is a circular dependency between uboot-sign and kernel-fitimage bbclasses . The loop looks like this: kernel-fitimage.bbclass: - do_populate_sysroot depends on do_assemble_fitimage - do_assemble_fitimage depends on virtual/bootloader:do_populate_sysroot - virtual/bootloader:do_populate_sysroot depends on virtual/bootloader:do_install => The virtual/bootloader:do_install installs and the virtual/bootloader:do_populate_sysroot places into sysroot an U-Boot environment script embedded into kernel fitImage during do_assemble_fitimage run . uboot-sign.bbclass: - DEPENDS on KERNEL_PN, which is really virtual/kernel. More accurately - do_deploy depends on do_uboot_assemble_fitimage - do_install depends on do_uboot_assemble_fitimage - do_uboot_assemble_fitimage depends on virtual/kernel:do_populate_sysroot => do_install depends on virtual/kernel:do_populate_sysroot => virtual/bootloader:do_install depends on virtual/kernel:do_populate_sysroot virtual/kernel:do_populate_sysroot depends on virtual/bootloader:do_install Attempt to resolve the loop. Pull fitimage configuration options into separate new configuration file image-fitimage.conf so these configuration options can be shared by both uboot-sign.bbclass and kernel-fitimage.bbclass, and make use of mkimage -f auto-conf / mkimage -f auto option to insert /signature node key-* subnode into U-Boot control DT without depending on the layout of kernel fitImage itself. This is perfectly valid to do, because the U-Boot /signature node key-* subnodes 'required' property can contain either of two values, 'conf' or 'image' to authenticate either selected configuration or all of images when booting the fitImage. For details of the U-Boot fitImage signing process, see: https://docs.u-boot.org/en/latest/usage/fit/signature.html For details of mkimage -f auto-conf and -f auto, see: https://manpages.debian.org/experimental/u-boot-tools/mkimage.1.en.html#EXAMPLES (From OE-Core rev: 259bfa86f384206f0d0a96a5b84887186c5f689e) Fixes: 5e12dc911d0c ("u-boot: Rework signing to remove interdependencies") Reviewed-by: Adrian Freihofer <adrian.freihofer@siemens.com> (From OE-Core rev: d7bd9c6276611c8c8de0c2a24947783eae5d932a) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.10 -> 1.22.11Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.10..go1.22.11 f072884354 (tag: go1.22.11) [release-branch.go1.22] go1.22.11 b72d56f98d [release-branch.go1.22] net/http: persist header stripping across repeated redirects 19d2103415 [release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in URIs ae9996f965 [release-branch.go1.22] runtime: hold traceAcquire across casgstatus in injectglist 223260bc63 [release-branch.go1.22] crypto/tls: fix Config.Time in tests using expired certificates Fixes CVE-2024-45336 and CVE-2024-45341 [1] https://github.com/golang/go/compare/go1.22.10...go1.22.11 (From OE-Core rev: 4589986602319f9ed61e381b333bb53b731eb8d8) (From OE-Core rev: 35bf053cd41d53a764ef3a2de3e7cb1e6c81109f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.9 -> 1.22.10Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.9..go1.22.10 8f3f22eef8 (tag: go1.22.10) [release-branch.go1.22] go1.22.10 6d7a95abca [release-branch.go1.22] runtime: reserve 4kB for system stack on windows-386 6f05fa7a4f [release-branch.go1.22] syscall: mark SyscallN as noescape 3355db9690 [release-branch.go1.22] time: accept "+01" in TestLoadFixed on OpenBSD [1] https://github.com/golang/go/compare/go1.22.9...go1.22.10 (From OE-Core rev: e357c93b39df938dc36195dbd779a58b2951b8e6) (From OE-Core rev: 4d35279eed634f5e2b25c23dddbfb213c4943c30) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.8 -> 1.22.9Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.8..go1.22.9 8af39d30a4 (tag: go1.22.9) [release-branch.go1.22] go1.22.9 c19e5887f4 [release-branch.go1.22] cmd/cgo/internal/testcarchive: remove 1-minute timeout e3fd4ba7f9 [release-branch.go1.22] cmd/link: generate Mach-O UUID when -B flag is specified 29252e4c5a [release-branch.go1.22] runtime: fix TestGdbAutotmpTypes on gdb version 15 [1] https://github.com/golang/go/compare/go1.22.8...go1.22.9 (From OE-Core rev: 4f2f202506bcefb4d6c46a11738e159e261a4a4b) (From OE-Core rev: a424422df978e267f21938bb290f35035e658d0a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: upgrade 255.13 -> 255.17Guðni Már Gilbert2025-02-0328-63/+68
| | | | | | | | | | | | | | | The update includes 156 commits. Full list of changes can be found on Github [1] All patches were refreshed with devtool. One patch had to be manually rebased to resolve a merge conflict introduced with 255.14 [2]. [1] https://github.com/systemd/systemd-stable/compare/v255.13...v255.17 [2] 0003-src-basic-missing.h-check-for-missing-strndupa.patch (From OE-Core rev: 57ca5a2c912fcc4836f263ff2b98c9de2130f324) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: patch CVE-2024-13176Peter Marko2025-02-032-0/+127
| | | | | | | | | | | | Picked [1] per link in [2] [1] https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-13176 (From OE-Core rev: 7f9bb49394185fea268397db4fc7d96afae53f28) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.7scarthgap-5.0.7Steve Sakoman2025-01-261-1/+1
| | | | | | (From OE-Core rev: 62cb12967391db709315820d48853ffa4c6b4740) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: correctly link rust-snapshot into build/stage0Alexander Kanavin2025-01-263-42/+2
| | | | | | | | | | | | | | | | | | | | This does not seem to be used in regular builds, but is beneficial in rust selftest, where it allows dropping a custom patch that is unsuitable for upstream (and was rejected by them). Also remove an obsolete comment that seems related to the code but describes something that was resolved long time ago. I have confirmed that the rust selftest continues to pass with just this one commit on top of master (as the following changes do break the selftest). (From OE-Core rev: 9b23f995fbc1886c36f02b0c6e1ccaf2ee0f6daa) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bf5732e2b235ce06fa1f24fe8f0dbcbc068500e3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: use rust-snapshot binaries only in rust-nativeAlexander Kanavin2025-01-261-2/+12
| | | | | | | | | | | | | | | | | | | | | | Otherwise, use rust-native and cargo-native binaries as that allows our native tweaks in them to be used for target/nativesdk rust - same as for everything else written in rust. In particular, this allows building target rust with cargo-native that includes important reproducibility tweaks. Unfortunately, this also breaks rust selftest, and that is partially addressed by the following commit. [YOCTO #15185] (From OE-Core rev: d592bc02b0846411796c1d481c09833559d1d29f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8f2230cb51fe22ef4711a56fecfab4858c04e35b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: build the default set of toolsAlexander Kanavin2025-01-262-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Setting it explicitly replaces rust's default choice which is rustdoc (needed for example in selftests and otherwise expected to be present in typical rust installations): https://github.com/rust-lang/rust/blob/master/config.example.toml#L320 This addresses some of the rust selftest failures but not all. Help is appreciate to restore the selftest. Unfortunately, this also breaks rust reproducibility (or rather exposes that it was never properly fixed, as explained here: https://lists.openembedded.org/g/openembedded-core/message/199288 ) (From OE-Core rev: 4d739fe248d1023eb2c3c040fc4d33273dd16bc1) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 58eaf2ee6c0809bf0a0d3c1d177e62bda7241651) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS"Steve Sakoman2025-01-261-5/+1
| | | | | | This reverts commit 136a25567499191b23a4d000a06bf83a473224ca. Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to scarthgap head revisionSteve Sakoman2025-01-251-1/+1
| | | | | | (From OE-Core rev: 3c31639dd53e32e57af64d50ad168f5c3911c299) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.0.7Steve Sakoman2025-01-251-1/+1
| | | | | | (From meta-yocto rev: 03c7935bcdb15fd903d26828085d49c00267b8d9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* boost: fix do_fetch errorJiaying Song2025-01-251-1/+1
| | | | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: boost-native-1.84.0-r0 do_fetch: Checksum failure encountered with download of https://boostorg.jfrog.io/artifactory/main/release/1.84.0/source/boost_1_84_0.tar.bz2 - will attempt other sources if available (From OE-Core rev: 7ecd0d5584b7692b58ac8039b4107c4e0836d553) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-target-config: Fix TARGET_C_INT_WIDTH with correct sizeHarish Sadineni2025-01-251-5/+5
| | | | | | | | | | | | | | | | | | [YOCTO #15600] The TARGET_C_INT_WIDTH value was incorrectly set to 64 instead of 32. It is updated for PPC, Mips, and riscv64 architectures. Discussion links for solution: https://lists.openembedded.org/g/openembedded-core/message/207486 https://lists.openembedded.org/g/openembedded-core/message/207496 (From OE-Core rev: 0e02d0feba8bd48a27c41db875dcd33d46e4dc0d) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b9df8cd8b29064d115dab3bfd1ea14f94a5c0238) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12747Archana Polampalli2025-01-252-0/+193
| | | | | | | | | | | | | | A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. (From OE-Core rev: e85beb88add5e94567d7221e00cabfb3d5010be7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12088Archana Polampalli2025-01-252-0/+142
| | | | | | | | | | | | A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. (From OE-Core rev: dad4a83c011310872cce07fc4141e66a98439cb1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12087Archana Polampalli2025-01-254-0/+123
| | | | | | | | | | | | | | | | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. (From OE-Core rev: c34cbef572e18c60bb7600fda370d6c46688c7b3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12086Archana Polampalli2025-01-255-0/+303
| | | | | | | | | | | | | | | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. (From OE-Core rev: 19f4e7bd965c63f19cc756e6e2bf8f58d9e1dc8d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12085Archana Polampalli2025-01-252-0/+33
| | | | | | | | | | | | A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. (From OE-Core rev: fb8439e856d5ea10d12180020a14442c3b101e56) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12084Archana Polampalli2025-01-253-0/+201
| | | | | | | | | | | | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. (From OE-Core rev: ad0e13912b17ca19ffbd7ea6a366f7c968517fb2) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: tests/fetch: Fix git shallow test failure with git >= 2.48Richard Purdie2025-01-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | >From git 2.48 release notes: """ When "git fetch $remote" notices that refs/remotes/$remote/HEAD is missing and discovers what branch the other side points with its HEAD, refs/remotes/$remote/HEAD is updated to point to it. """ This means with git 2.48 onwards, there is a mystery "HEAD" revision appearing in some of our shallow clone tests. We can avoid this by using the same canonicalization as used for the reference revisions. This resolves autobuilder failures on the Fedora 40 workers. (Bitbake rev: aa0e540fc31a1c26839efd2c7785a751ce24ebfb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c83444d1210740e27b1744d3aa7c5cad4e28db2f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* test-manual/reproducible-builds: fix reproducible linksAntonin Godard2025-01-241-6/+2
| | | | | | | | | | | | | | We don't run reproducible-builds on specific distros anymore, but on a distro at random depending on what is available on the Autobuilder. Fix the link to this builder and remove distro specific ones. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: bb9e018adcc10c642f87d0b95432783b5eb8057b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 8bd2bc3c00ca80f4c000a2a8d618a9f8ea3aa54b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Update autobuilder URLs to valkyrieAntonin Godard2025-01-245-8/+7
| | | | | | | | | | | | | | | | | | We have moved to Valkyrie which is hosted on https://autobuilder.yoctoproject.org/valkyrie. Update the URL in the documentation. Also, the YOCTO_AB_URL macro was used in a single location in the documentation so replace it by the :yocto_ab: custom extlink and remove the macro. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: b02e90b6eb32ce57a98e0e3720848e5cdfbb69d0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 0b0ed55d909dd11cdc9b29b105473271627c025e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 5.0.6Lee Chee Yang2025-01-242-0/+224
| | | | | | | | | | (From yocto-docs rev: 5fda58d48fe0321ea3cdefd31c3c6b9702cd8f5d) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 6a22014cd1a7b147d352640088d3b8b724547ac6) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libgfortran: fix buildpath QA issueChen Qi2025-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The '-fdebug-prefix-map' options are used to map source files locations, otherwise, DW_AT_comp_dir will contain buildpath. The '-gno-record-gcc-switches' option is used to fix the buildpath introduced by '-fintrinsic-modules-path' option, which is automatically added by fortran. Here's some output from 'readelf --debug-dump libgfortran.so.5.0.0' when this option is not added: """ <0><1a37d3>: Abbrev Number: 4 (DW_TAG_compile_unit) <1a37d4> DW_AT_producer : (indirect string, offset: 0xd653): GNU Fortran2008 14.2.0 -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse -mshstk -g -O2 -O2 -fstack-protector-strong -fimplicit-none -fno-repack-arrays -fno-underscoring -fcf-protection=full -fallow-leading-underscore -fbuilding-libgfortran -fPIC -fintrinsic-modules-path /ala-lpggp72/qichen/Yocto/builds/build-poky/tmp/work/ core2-64-poky-linux/libgfortran/14.2.0/recipe-sysroot-native/usr/bin/x86_64-poky-linux /../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/14.2.0/finclude -fpre-include=../../../../recipe-sysroot/usr/include/finclude/math-vector-fortran.h """ See https://gcc.gnu.org/pipermail/fortran/2024-October/061204.html for more detailed information. (From OE-Core rev: 660e00469f9c99fe733cc8b37f67438a96ff2e97) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: fix webrtc audio depdencyEsben Haabendal2025-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | Since pulseaudio v16.99.1, the library needed is webrtc-audio-processing-1. This fixes Run-time dependency webrtc-audio-processing-1 found: NO (tried pkgconfig and cmake) Looking for a fallback subproject for the dependency webrtc-audio-processing-1 ../pulseaudio-17.0/meson.build:730:15: ERROR: Automatic wrap-based subproject downloading is disabled The library is available in meta-openembedded/meta-multimedia. (cherry picked from commit 4661c49eb4f0ed89a3d027d9a003c40744baaf38) (From OE-Core rev: e80c3ca36f08a259e13fd94f1c87a7f5bf485a8b) Signed-off-by: Esben Haabendal <esben@geanix.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Esben Haabendal <esben@geanix.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architectureRoss Burton2025-01-242-8/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Using the package architecture to select the right qemu options to pass to qemu-user is incorrect, and fails for recipes that set PACKAGE_ARCH to MACHINE_ARCH (as the qemuppc workarounds suggest) because there are not typically any options set for the machine name. Solve this by using TUNE_PKGARCH instead: for the majority of recipes this is the same value, but for machine-specific recipes it remains the same instead of changing to the machine name. This means we can remove the qemuppc workarounds, as they're obsolete. Also update the gcc-testsuite recipe which uses the same pattern to use TUNE_PKGARCH, and generalise the else codepath to avoid needing to update the list of architectures. [ YOCTO #15647 ] (From OE-Core rev: 972ca555ff3aa41d32980477850c92915b6395ed) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 414b754a6cbb9cc354b1180efd5c3329568a2537) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/nativesdk: also override TUNE_PKGARCHRoss Burton2025-01-241-0/+1
| | | | | | | | | | | | | | | | The nativesdk class overrides PACKAGE_ARCH and unsets TUNE_FEATURES, but as recipes might want to look at TUNE_PKGARCH too (for example, when setting QEMU_EXTRAOPTIONS) we should also override that variable. Otherwise, a nativesdk recipe will have the TUNE_PKGARCH of the target, which leads to errors (eg passing mips arguments to an arm qemu). (From OE-Core rev: 812cf123af5821c300c630cda35be8faed73b9d5) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 05322beb290e1db30bef49b4364f8a8e6e9f7408) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "bluez5: remove configuration files from install task"Catalin Popescu2025-01-241-0/+8
| | | | | | | | | | | | | | | | | | | | | | This reverts commit 49391fdcf71b32c5fd3c7b134c1d1c45cc1db388 which introduced a bluetooth regression on systems with read-only rootfs. When configuration files are missing, bluez tries to generate them which fails on a read-only rootfs. As a result bluetooth service fails to start and bluetooth is broken. Hence, configuration files need to be installed in the rootfs in a way or another. Bluez commit be0e79629 (build: ship all config files with --enable-datafiles, 2024-02-12) introduced configuration files installation in bluez version 5.73. However, scarthgap pulls in version 5.72, so it is responsible of the installation of configuration files until bluez is upgraded. Scarthgap commit 49391fdcf71b32c5fd3c7b134c1d1c45cc1db388 removed installation of configuration files too early, hence the revert. (From OE-Core rev: 54a7014a801ddbda2a7dfe1ab560a154064ad47e) Signed-off-by: Catalin Popescu <catalin.popescu@leica-geosystems.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/ssh: allow to retrieve raw, unformatted ouputAlexis Lothoré2025-01-241-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | The ssh target is currently well tailored to easily retrieve textual output from a command run on a remote target. It could also be used to retrieve raw data from a command run onto a remote target (for example, to feed this data directly to another program), but it currently suffers two minor issues preventing such use case: - stderr is piped to stdout, so any error log will be mixed in the program output - the final output is decoded as utf-8 and stripped Allow to return the raw, unmodified output by adding an optional "raw" parameter. Keep it to False by default to preserve the current behavior. When enabled, do not return a string but the raw output as bytes. (From OE-Core rev: 8d05dc6e2284b7ed7c32a8215b9c8bf6f7dabf00) (From OE-Core rev: d09187db648053a763036a5209efd584b352cf31) Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 5.0.6Aleksandar Nikolic2025-01-241-2/+2
| | | | | | | | | Update to the 5.0.6 release of the 5.0 series for buildtools. (From OE-Core rev: 6c0372a67b410b8f7ba9b43ffd17efd2f3b439aa) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2023-4235Peter Marko2025-01-242-0/+39
| | | | | | | | | | Cherry-pick commit https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=02aa0f9bad3d9e47a152fc045d0f51874d901d7e (From OE-Core rev: 5adbece7dcbb547ea44207fa1a9ddc7d56766b1b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2023-4232Peter Marko2025-01-242-0/+32
| | | | | | | | | | Cherry-pick commit https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=2ff2da7ac374a790f8b2a0216bcb4e3126498225 (From OE-Core rev: 476ef12ab91aada032ea0e6acc5a0044497ace25) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2024-7540, CVE-2024-7541, CVE-2024-7542Peter Marko2025-01-242-0/+53
| | | | | | | | | | Cherry-pick commit https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=29ff6334b492504ace101be748b256e6953d2c2f (From OE-Core rev: 6f55cecbff1e5be7dda7484b8b04f7ccfbdceb1b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* socat: patch CVE-2024-54661Peter Marko2025-01-242-0/+114
| | | | | | | | | | | | | Picked upstream commit https://repo.or.cz/socat.git/commitdiff/4ee1f31cf80019c5907876576d6dfd49368d660f Since this was the only commit in 1.8.0.2 it also contained release changes which were dropped. (From OE-Core rev: efa7a5e5a8448ae52152ee8ebbf5c51d691a34d2) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52616Zhang Peng2025-01-242-0/+105
| | | | | | | | | | | | | | | | | | | | CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (From OE-Core rev: 28de3f131b17dc4165df927060ee51f0de3ada90) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: Fix multiple CVEsHitendra Prajapati2025-01-247-0/+245
| | | | | | | | | | | | | | | | Backport fixes for: * CVE-2024-7539 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc * CVE-2024-7543 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7 * CVE-2024-7544 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a * CVE-2024-7545 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5 * CVE-2024-7546 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63 * CVE-2024-7547 - Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0 (From OE-Core rev: d244d4d48615a7b08f1ab0231f074caa31790247) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wget: fix CVE-2024-10524Divya Chellam2025-01-242-0/+198
| | | | | | | | | | | | | | | | | | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-10524 Upstream-patch: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 (From OE-Core rev: 425c3f55bd316a563597ff6ff95f8104848e2f10) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: cooker: Make cooker 'skiplist' per-multiconfig/mcChris Laplante2025-01-244-19/+43
| | | | | | | | | | | | | | | | | | | Previously, the cooker skiplist was shared across multiconfigs (including default ''). If you had a recipe that was incompatible with several multiconfigs for different reasons, then the displayed reason (i.e. the "ERROR: Nothing PROVIDES" and "* was skipped" messages) might vary across invocations of bitbake. This was caused by the random order in which recipes are parsed under different multiconfig contexts, with each skip reason overwriting the previously assigned reason. I hit this specificially when using COMPATIBLE_MACHINE, but COMPATIBLE_HOST (or anything using bb.parse.SkipRecipe) would have done it too. (Bitbake rev: 7dde14582bfd104c6da26e3f5ecf2ef37a1494ce) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: ui/knotty: respect NO_COLOR & check for tty; rename print_hyperlink ↵Chris Laplante2025-01-241-5/+9
| | | | | | | | | => format_hyperlink (Bitbake rev: 72a334d5d5763476d5421a902fabb303f3f84bd8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: ui/knotty: print log paths for failed tasks in summaryChris Laplante2025-01-241-3/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When tasks fail, it's very frustrating to have to scroll up to find the log path(s). Many of us have the muscle memory to navigate to the 'temp' directories under tmp/work/, but new users do not. This change enhances the final summary to include log paths (reported via bb.build.TaskFailed events). Here's an example: NOTE: Tasks Summary: Attempted 856 tasks of which 853 didn't need to be rerun and 3 failed. Summary: 3 tasks failed: virtual:native:/home/chris/repos/poky/meta/recipes-core/ncurses/ncurses_6.5.bb:do_fetch log: /home/chris/repos/poky/build/tmp/work/x86_64-linux/ncurses-native/6.5/temp/log.do_fetch.1253462 /home/chris/repos/poky/meta/recipes-core/ncurses/ncurses_6.5.bb:do_fetch log: /home/chris/repos/poky/build/tmp/work/core2-64-poky-linux/ncurses/6.5/temp/log.do_fetch.1253466 virtual:nativesdk:/home/chris/repos/poky/meta/recipes-core/ncurses/ncurses_6.5.bb:do_fetch log: /home/chris/repos/poky/build/tmp/work/x86_64-nativesdk-pokysdk-linux/nativesdk-ncurses/6.5/temp/log.do_fetch.1253467 Summary: There were 3 WARNING messages. Summary: There were 6 ERROR messages, returning a non-zero exit code. Each log is rendered as a clickable hyperlink in the terminal. See https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda (Bitbake rev: 9c020cc314bfd0702bb1d457d94925c6e9613268) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: enable create-log-dirsChangqing Li2025-01-181-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default, create-log-dirs is enabled in systemd, and a link /var/log/README will be created, point to {{DOC_DIR}}/README.logs, but, for oe, there are two problems here, firstly, DOC_DIR is packaged in another package systemd-doc, so /var/log/README is a dead link when systemd-doc is not installed, secondly, even systemd-doc is installed, when volatile log is used, DOC_DIR is a wrong relateive path, Refer [1]. So in commit [2], we disable create-log-dirs for above issue. with this change, /var/log/journal is not created, and /run/log is used, this makes systemd log always non persistent, refer [3][4]. if user need persistent log, they need to disable volatile log, and also change journald.conf, make "Storage" to "persistent". This is a behavoir change. Previously, to make systemd log persistent, user only need to disable volatile log. This commit reenable create-log-dirs to revert the behavior change, and since README is not very userful, just remove it. [ YOCTO #15678 ] [1] https://github.com/systemd/systemd/blob/main/tmpfiles.d/legacy.conf.in#L16 [2] https://git.openembedded.org/openembedded-core/commit/?id=18d46e11d85da1f6feaba5a135931e43060024d6 [3] https://github.com/systemd/systemd/blob/main/src/journal/meson.build#L189 [4] https://www.freedesktop.org/software/systemd/man/journald.conf.html [5] https://bugzilla.yoctoproject.org/show_bug.cgi?id=15678 (From OE-Core rev: 92eea72a25e553c698bee9e3f551a5880bd4631c) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f82d9c997ba8cc23b472d44a43489c597bf452af) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bluez5: backport patch to fix address type when loading keysHiago De Franco2025-01-182-0/+53
| | | | | | | | | | | | | | | | | | | With Linux kernel v6.6, due to commit 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"), an error might occur when trying to automatically repair a bluetooth device, as the key might store using a wrong/invalid address type. This happens only with bluez5 version 5.72: HCI Event: Link Key Request (0x17) plen 6 bdaddr 8C:98:6B:7A:BD:F0 HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6 bdaddr 8C:98:6B:7A:BD:F0 This was already solved upstream, therefore backport the patch to fix this issue. (From OE-Core rev: d719d02f2f3ce8f54de0e10d89a8d389edb61fed) Signed-off-by: Hiago De Franco <hiago.franco@toradex.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* groff: Fix race issues for parallel buildRobert Yang2025-01-182-0/+32
| | | | | | | | | | | | | | Fixed race issues for parallel build: groff: error: couldn't exec soelim: Permission And: groff: error: couldn't exec grn: Permission denied (From OE-Core rev: 44b625a820a22c99f4fa1d4ed6b6de98c5d75884) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> (cherry picked from commit b9ee7ea9ab05a1887c863dc9fccc65cb9e6850df) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-03 19:15:42 +0000