summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libksba: update 1.6.2 -> 1.6.3Alexander Kanavin2023-01-262-4/+4
| | | | | | | | | | | | | | | | | Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "libksba: fix CVE-2022-47629"Steve Sakoman2023-01-262-74/+1
| | | | | | | | Prepare for stable version bump which includes this fix This reverts commit e4cb0bf273ea556db91699594046a47514c8583c. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lttng-modules: update 2.13.7 -> 2.13.8He Zhe2023-01-261-1/+1
| | | | | | | | (From OE-Core rev: 39ef525391d2d39a3431d319a20a5b5fc9a916a3) Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: fix CVE patches assigned wrong CVE numberQuentin Schulz2023-01-262-46/+46
| | | | | | | | | | | | | | | | | | | CVE-2019-6461 and CVE-2019-6462 are fixed, but the reporting is incorrect as the patch for CVE-2019-6461 is actually for CVE-2019-6462 and vice-versa. This swaps both files and edit the CVE field to report the correct identifier. Cc: Quentin Schulz <foss+yocto@0leil.net> (From OE-Core rev: 960f9a9243282da838da655d03bb34261e300498) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f12c2a5ac94cb29f473f3c7e335463c7fb6d8a6e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: write the cve manifest to IMGDEPLOYDIRJermain Horsman2023-01-261-3/+3
| | | | | | | | | | | | | | | | | | | When building an image cve_check_write_rootfs_manifest() would sometimes fail with a FileNotFoundError when writing the manifest.cve due to the parent directory (DEPLOY_DIR_IMAGE) not (yet) existing. The image task will provide the manifest in the deploy directory afterwards, so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should continue to function properly. (From OE-Core rev: 3e1ae171d89d0ac5487a8930bf6f8a97c43fdf57) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: show IP on failureRoss Burton2023-01-261-1/+4
| | | | | | | | | | | | | | | | | We get random SSL failures when fetching the CVE database, and it's notable that the NVD server is behind a DNS round-robin or geographically diverse servers. On a hunch that there is one misconfigured server, dump the IP that we connected to. (From OE-Core rev: 99f1a8971192f85fefad3cbc993b23a59627eb4c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91f46d431dc8f40e8c6475c800bb61cb08b82b0a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: avoid incomplete updatesMarta Rybczynska2023-01-261-22/+61
| | | | | | | | | | | | | | | | | | | | | The database update has been done on the original file. In case of network connection issues, temporary outage of the NVD server or a similar situation, the function could exit with incomplete data in the database. This patch solves the issue by performing the update on a copy of the database. It replaces the main one only if the whole update was successful. See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14929 Reported-by: Alberto Pianon <alberto@pianon.eu> (From OE-Core rev: 878988a67b488a01f53658bcc528b5d0422672ae) Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8efe99214d8b005f0ecac690ce5ba17b31758f92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: fix for CVE-2022-3341Narpat Mali2023-01-262-1/+69
| | | | | | | | | | | | avformat/nutdec: Add check for avformat_new_stream Check for failure of avformat_new_stream() and propagate the error code. (From OE-Core rev: e17ddd0fafb562ed7ebe7708dac9bcef2d6cecc1) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-41717 Excessive memory use in got serverHitendra Prajapati2023-01-262-0/+90
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (From OE-Core rev: f4d179aab7c8f55669ac652a0668644859ec2eb7) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gtk-icon-cache: Fix GTKIC_CMD if-else conditionDaniel Gomez2023-01-261-1/+1
| | | | | | | | | | | | | | | | | | | | GTKIC_CMD variable gets the wrong assignation leading into a post install script error. Fix if-else condition in GTKIC_CMD variable to assign gtk4-update-icon-cache when GTKIC_VERSION is 4 but gtk-update-icon-cache when is 3. Also, rename gtk-update-icon-cache-3.0.0 to gtk-update-icon-cache-3.0 to match the gtk-update-icon-cache binary name deployed in meta/recipes-gnome/gtk+/gtk+3.inc. (From OE-Core rev: 34de16fd86775c0f2ede1670fec90217e4d11776) Signed-off-by: Daniel Gomez <daniel@qtec.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* freetype:update mirror site.KARN JYE LAU2023-01-261-1/+1
| | | | | | | | | | | update SAVANNAH_NONGNU_MIRROR to SAVANNAH_GNU_MIRROR to resolve package fetching issues. (From OE-Core rev: 8f1de2127bd8f3f2a182a8532102ec0d3d44be70) Signed-off-by: KARN JYE LAU <karn.jye.lau@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: stable 2.35 branch updates.Yash Shinde2023-01-261-1/+1
| | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.35 stable branch are updated. 293211b6fd time: Use 64 bit time on tzfile 26c8278889 nscd: Use 64 bit time_t on libc nscd routines (BZ# 29402) f75f61b659 nis: Build libnsl with 64 bit time_t ca97201c24 Apply asm redirections in syslog.h before first use [BZ #27087] cad7947db7 elf: Fix wrong fscanf usage on tst-pldd e9eb987894 Allow for unpriviledged nested containers 2636fbb7ef elf: Fix wrong fscanf usage on tst-pldd e7019eeeb5 x86: Fix wcsnlen-avx2 page cross length comparison [BZ #29591] fb73a40981 elf: Fix rtld-audit trampoline for aarch64 (From OE-Core rev: 4db5727a0b44d471382c95c3897b68af5ab1a3b4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: fix CVE-2022-47629Yogita Urade2023-01-262-1/+74
| | | | | | | | | | | | | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE: CVE-2022-47926 References: https://nvd.nist.gov/vuln/detail/CVE-2022-47629 (From OE-Core rev: e4cb0bf273ea556db91699594046a47514c8583c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-git: fix for CVE-2022-24439Narpat Mali2023-01-263-0/+589
| | | | | | | | | | | | | | | | | | | | | | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. CVE: CVE-2022-24439 Upstream-Status: Backport Reference: https://github.com/gitpython-developers/GitPython/discussions/1529 https://github.com/gitpython-developers/GitPython/pull/1518 https://github.com/gitpython-developers/GitPython/pull/1521 (From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-wheel: fix for CVE-2022-40898Narpat Mali2023-01-262-1/+35
| | | | | | | | | | | | | | | An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE: CVE-2022-40898 Upstream-Status: Backport [https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0] (From OE-Core rev: 0974291e545aec68755dfb634c75dca37cca1ea9) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-setuptools: fix for CVE-2022-40897Narpat Mali2023-01-262-0/+32
| | | | | | | | | | | | | | | | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. CVE: CVE-2022-40897 Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be] (From OE-Core rev: f574d8d57ff3fbc38e350e7a90913993081c4fdf) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2022-4144Bhabu Bindu2023-01-262-0/+100
| | | | | | | | | | | | Add patch to fix CVE-2022-4144 Link: https://security-tracker.debian.org/tracker/CVE-2022-4144 (From OE-Core rev: 4cb3874abf4fdeb04337a48a14c765ba9b2269d4) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: refresh patches to apply cleanlyMartin Jansa2023-01-263-23/+15
| | | | | | | | | | | | | | | | | | | * the last patch added in: https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=874b72fe259cd3a23f4613fccfe2e9cc3f79cd6a doesn't apply cleanly. * fixes: ERROR: ffmpeg-5.0.1-r0 do_patch: Fuzz detected: Applying patch 0001-avcodec-vp3-Add-missing-check-for-av_malloc.patch patching file libavcodec/vp3.c Hunk #1 succeeded at 2677 with fuzz 1 (offset -2 lines). (From OE-Core rev: 6060dec1fc9d215f6b2ff9d6571bac802ac6a09b) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* devtool: process local files only for the main branchAlexander Kanavin2023-01-155-16/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | devtool modify/upgrade are not currently equipped to handle conditional local files in SRC_URI, and provide only the main no-override set in a workspace under source/component/oe-local-files/ (this is done via meta/classes/devtool-source.bbclass). On the other hand, updating the changes from workspace into a recipe is run iteratively against all overrides; this works for patches (as they all are directed into their own override branches in the workspace git source tree), but breaks down when trying to match local files in a workspace against local files in overridden SRC_URI lists, resulting in bad recipe breakage. (there's an additional twist here: existing code has a guard against this but the guard relies on metadata in workspace .bbappend that is only there in modify operations, but not upgrades. This commit replaces the guard with a general check that will work everywhere). Implementing multiple sets of local files is significant work; let's for now simply not touch local files in recipes except when on the no-override variant. Also, adjust the selftest cases to include conditional local files in sample recipes, so the situation is covered by the tests. (From OE-Core rev: 4760fac939a6204e3cb7dcd3699cd9a2508f9dee) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3a8654b860fa98f94e80c3c3fff359ffed14bbe7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gstreamer1.0: Fix race conditions in gstbin testsJose Quaresma2023-01-152-0/+301
| | | | | | | | | | (From OE-Core rev: ae00dd1175263dbdc7c2de5cd98baa44d5ba837e) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b57df3fe9c1623ba2f5a9a0e11a85dcdc77e76a5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "gstreamer1.0: disable flaky gstbin:test_watch_for_state_change test"Jose Quaresma2023-01-152-108/+0
| | | | | | | | | | | | | | | This reverts commit 220a527d269f146bdabd66040b5bee7de9e3fd3f. - Drop this patch and use the upstream solution https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643 (From OE-Core rev: 865ea5e122a0e6cbfab1c4fe722bb01509b1102a) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9660045d07a2b492ac48a1f1b08aa4288b45d64a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/rpm.py: Increase timeout and add debug outputPavel Zhukov2023-01-151-12/+11
| | | | | | | | | | | | | | | | | | | | | [Yocto #14346] Systemd may be slow in killing pam session sometimes [1][2]. It may cause rpm test to fail because there's process (sd_pam) running and own by "test1" user after timeout. Increasing timeout to 2 mins and assert earlier with debug output if there's such process(es). If increasing of timeout doesn't help we may want to force deletion of the user as [2] suggests. [1] https://github.com/systemd/systemd/issues/8598 [2] https://access.redhat.com/solutions/6969188 (From OE-Core rev: 36491639258c6f9f0bd1890ee68f8e2f44a77e72) Signed-off-by: Pavel Zhukov <pavel@zhukoff.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 972fcc0ed1e0d36c3470071a9c667c5327c1ef78) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rm_work.bbclass: use HOSTTOOLS 'rm' binary exclusivelyLuis2023-01-151-4/+11
| | | | | | | | | | | | | | | | | | | | The do_rm_work() task is using the first available 'rm' binary available in PATH to remove files and folders. However, depending on the PATH setup and RECIPE_SYSROOT_NATIVE contents, the function can be using the 'rm' binary available in RECIPE_SYSROOT_NATIVE, a folder that will get removed. This causes a sporadic race-condition when trying to access the 'rm' binary of a folder already deleted. Solve this by exclusively using the HOSTTOOLS 'rm' binary, as this folder will not get removed. (From OE-Core rev: 7ad7ba54916351f4fe2d0bd1542962539e5eb4bd) Signed-off-by: Luis Martins <luis.pinto.martins@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit edcd9ad333bc4e504594e8af83e8cb7007d2e35c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base.bbclass: Fix way to check ccache pathChangqing Li2023-01-151-1/+1
| | | | | | | | | | | | | | | | | | | The previous code had 2 issues: 1. make hosttools/ccache always link to host's ccache (/usr/bin/ccache) even we have one buildtools 2. make hosttools/gcc etc, link to host's gcc event we have one buildtools when keyword ccache in buildtools's path, eg: /mnt/ccache/bin/buildtools This patch is for fix above issues. (From OE-Core rev: 19f6849b161115161c025a0b435229d5097abb9e) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1b7c81414cf252a7203d95703810a770184d7e4d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.9 -> 9.18.10Wang Mingyu2023-01-1510-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== The key file IO locks objects would never get deleted from the hashtable due to off-by-one error. ANY responses could sometimes have the wrong TTL. Speed up the named shutdown time by explicitly canceling all recursing ns_client objects for Removing a catalog zone from catalog-zones without also removing the referenced zone could leave a dangling pointer. [GL #3683] nslookup and host were not honoring the selected port in TCP mode. [GL #3721] Deprecate alt-transfer-source, alt-transfer-source-v6 and use-alt-transfer-source. [GL #3694] Move the "final reference detached" log message from dns_zone unit to the DEBUG(1) log level. Fix assertion failure in isc_http API used by statschannel if the read callback would be called on HTTP request that has been already closed. Deduplicate time unit conversion factors. Copy TLS identifier when setting up primaries for catalog member zones. Deprecate 'auto-dnssec'. [GL #3667] The decompression implementation in dns_name_fromwire() is now smaller and faster. [GL #3655] Use the current domain name when checking answers from a dual-stack-server. Ensure 'named-checkconf -z' respects the check-wildcard option when loading a zone. [GL #1905] Deprecate 'coresize', 'datasize', 'files', and 'stacksize' named.conf options. The view's zone table was not locked when it should have been leading to race conditions when external extensions that manipulate the zone table where in use. Some browsers (Firefox) send more than 10 HTTP headers. Bump the number of allowed HTTP headers to 100. [GL #3670] NXDOMAIN cache records are no longer retained in the cache after expiry, even when serve-stale is in use. [GL #3386] (From OE-Core rev: 932546383875692c4cc9e05c75a4be64a6c3f0c7) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1c093c38e247b522f279f616d16373795a4cdf89) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 410d69c684ba4eb6dd279a40436043259f94b6b9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: upgrade 3.6.1 -> 3.6.2Alexander Kanavin2023-01-152-47/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Libarchive 3.6.2 is a bugfix and security release. Important security fixes: NULL pointer dereference vulnerability in archive_write.c (#1754, #1759, CVE-2022-36227) Important bug fixes: include ZSTD in Windows builds (#1688) SSL fixes on Windows (#1714, #1723, #1724) rar5 reader: fix possible garbled output with bsdtar -O (#1745) mtree reader: support reading mtree files with tabs (#1783) various small fixes for issues found by CodeQL Use --without-iconv as otherwise autotools write a bogus iconv dependency into .pc file. (From OE-Core rev: 41e1b4c29e45a9022eea8f89dfb09b6eb2eae60b) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit edce1bce81fe2f47fb2c5e2b94ebda73f95cbaea) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 93b972845a28b62ea01ee0f4a1e043bd58fc0892) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: fix for CVE-2022-3109Narpat Mali2023-01-152-1/+46
| | | | | | | | | | | | | | | An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability. CVE: CVE-2022-3109 Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568] (From OE-Core rev: 874b72fe259cd3a23f4613fccfe2e9cc3f79cd6a) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: backport another change from v252 to fix build with ↵Martin Jansa2023-01-152-0/+61
| | | | | | | | | | | | | | | | | | | | CVE-2022-45873.patch * CVE-2022-45873.patch was backported from systemd/main, but it doesn't build without another change from v252 when elfutils PACKAGECONFIG is enabled. * fixes: | ../git/src/shared/elf-util.c: In function 'parse_elf_object': | ../git/src/shared/elf-util.c:792:27: error: void value not ignored as it ought to be | 792 | r = json_variant_dump(package_metadata, JSON_FORMAT_FLUSH, json_out, NULL); | | ^ (From OE-Core rev: bc8501a5a2ffc5673bad50f744d78822525bea9d) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: CVE-2022-45873 deadlock in systemd-coredump via a crash with a long ↵Hitendra Prajapati2023-01-152-0/+125
| | | | | | | | | | | | backtrace Upstream-Status: Backport from https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437 (From OE-Core rev: 447d514037a234f181dbeca1a6e4af484461c9b6) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: document SPDX_PRETTY variableMichael Opdenacker2023-01-103-8/+20
| | | | | | | | | | Now that it has been backported to Kirkstone https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=99483cff5c358d847ceb077349321eb57d5143e4 (From yocto-docs rev: 5883e897c34f25401b358a597fb6e18d80f7f90b) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* docs: kernel-dev: faq: update tip on how to not include kernel in imageQuentin Schulz2023-01-061-1/+1
| | | | | | | | | | | | | | | Since commit f6d963fa6d0e ("kernel: make kernel-base recommend kernel-image, not depend"), present in Kirkstone 4.0, one should set RRECOMMENDS and not RDEPENDS to avoid including the kernel in the image, so let's update the documentation to reflect that. Reported-by: Konstantin Kletschke <konstantin.kletschke@inside-m2m.de> Cc: Quentin Schulz <foss+yocto@0leil.net> (From yocto-docs rev: b94956c7d416879f9e4c46102145ef478270c440) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* docs: migration-4.0: specify variable name change for kernel inclusion in ↵Quentin Schulz2023-01-061-0/+3
| | | | | | | | | | | | | | | | | image recipe Since commit f6d963fa6d0e ("kernel: make kernel-base recommend kernel-image, not depend"), present in Kirkstone 4.0, one should set RRECOMMENDS and not RDEPENDS to avoid including the kernel in the image, so let's update the documentation to reflect that. Reported-by: Konstantin Kletschke <konstantin.kletschke@inside-m2m.de> Cc: Quentin Schulz <foss+yocto@0leil.net> (From yocto-docs rev: 775a3c7c56562fa8dd6a426008bce06ca1140e04) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: add 4.0.5 and 4.0.6 release notesMichael Opdenacker2023-01-063-0/+511
| | | | | | | (From yocto-docs rev: 61b2f039f09282a271abc1c41ea09765ea08a2cb) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/concurrencytest: Add number of failures to summary outputRichard Purdie2023-01-061-1/+3
| | | | | | | | | | | | | | | When running oe-selftest and seeing the end of a running log, it is extremely helpful to know if there have been failures or not to save looking at the rest of the log. Add the number of failures to the summary line so that people monitoring builds have an easier time before the end totals are printed. (From OE-Core rev: 5fa9d58f59bebfc9eb495b50ef9a767a5c765b77) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6b23996911d91f7f99774646c6db9f3490b4cb62) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* valgrind: skip the boost_thread test on armRandy MacLeod2023-01-061-0/+1
| | | | | | | | | | | | | This test is failing on the arm workers only so skip there until the issue can be worked on and resolved. The bug #14311 will remain open for tracking. (From OE-Core rev: c35db8b7ac2eaeff36afb43a0c3f54b5866c8305) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d98deec9e4aed9e05343d2758f3a3892e2044616) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemuboot.bbclass: make sure runqemu boots bundled initramfs kernel imageJagadeesh Krishnanjanappa2023-01-061-1/+2
| | | | | | | | | | | | | | | | | | | | The QB_DEFAULT_KERNEL is set to pick bundled initramfs kernel image if the Linux kernel image is generated with INITRAMFS_IMAGE_BUNDLE="1". This makes runqemu to automatically pick bundled initramfs kernel image instead of explicitly mentioning bundled initramfs kernel image in runqemu. [YOCTO #14748] (From OE-Core rev: ce673bc9f74aff1b6ba06e7b1d90da529894dce3) Signed-off-by: Jagadeesh Krishnanjanappa <workjagadeesh@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 52371624313184e1a825519160c3833e282df8b9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* devtool/upgrade: correctly handle recipes where S is a subdir of upstream treeAlexander Kanavin2023-01-062-18/+19
| | | | | | | | | | | | | | | | | 'devtool modify' writes additional settings to workspace .bbappend so that this can be handled correctly, but 'devtool upgrade' does not. This adds the missing settings. In particular, local files should not anymore mysteriously disappear from SRC_URIs on upgrades. (From OE-Core rev: 22f210f9f4dfc9e13fdc229147fd1677db5a35ec) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 0817aa5537a8d7cc9591c53dfaa1d225f4c327f7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel.bbclass: remove empty module directories to prevent QA issuesOvidiu Panait2023-01-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | Currently, allyesconfig test runs for x86_64 fail with: ERROR: linux-yocto-5.19.17+gitAUTOINC+0cba9aa404_aaf4490d18-r0 do_package: QA Issue: linux-yocto: Files/directories were installed but not shipped in any package: /lib/modules/5.19.17/kernel/drivers/nvdimm With CONFIG_NVDIMM_TEST_BUILD=m, an empty nvdimm directory is created during modules_install, which triggers the QA issue. Extend kernel_do_install() to also remove inner empty directories that might get created by modules_install. (From OE-Core rev: 2f2abcb6d2394cdfd3985499ed882f43a5d2a299) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7120b09a33af4c9a18063c0f2e51fb598697e39c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: fix test data checksumsMartin Jansa2023-01-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | * switch from tar.gz to tar, because the tar.gz archives upstream are regular tar as well now https://www.w3.org/XML/Test/ still has 3 separate URLs for .zip, .tar and .tar.gz, but both tar links return the same file: xmlts20080827.tar: POSIX tar archive (GNU) xmlts20080827.tar.gz: POSIX tar archive (GNU) -rw-r--r-- 1 martin martin 5.7M Sep 1 2008 xmlts20080827.tar -rw-r--r-- 1 martin martin 5.7M Sep 1 2008 xmlts20080827.tar.gz 9b2c865aba66c6429ca301a7ef048d7eca2cdb7a9106184416710853c7b37d0d xmlts20080827.tar 9b2c865aba66c6429ca301a7ef048d7eca2cdb7a9106184416710853c7b37d0d xmlts20080827.tar.gz 96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c209286c03e9cc7 /OE/build/downloads/xmlts20080827.tar.gz (From OE-Core rev: 55f37f90dc2039fda085c66bb8c6095374b2947f) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add SPDX_PRETTY optionJoshua Watt2023-01-062-8/+18
| | | | | | | | | | | | | | Adds an option to make the SPDX more human-readable (at the expense of a larger files) (From OE-Core rev: e680a7402edec2803b03c56590c9d08d07497c73) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4799594b26f77ed259dc661bf077519b338390c8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libepoxy: remove upstreamed patchRoss Burton2023-01-062-30/+1
| | | | | | | | | | | | This patch was upstreamed in 6b09a8bc, 1.5.5 onwards. (From OE-Core rev: 50c27f5f98c6f1afca4893594c2c4950cf1b7b10) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 99b6e1ecb18d595e7b66344de882c1e1db6f35c3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-crosssdk: avoid host contamination by GOCACHERobert Andersson2023-01-061-0/+2
| | | | | | | | | | | | | | | | | | By default GOCACHE is set to $HOME/.cache. Same issue for all other go recipes had been fixed by commit 9a6d208b: [ go: avoid host contamination by GOCACHE ] but that commit missed go-crosssdk recipe. (From OE-Core rev: 803b754c64c8ee923cc02c17cf80798c93e3811c) Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com> Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit e5fd10c647ac4baad65f9efa964c3380aad7dd10) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* baremetal-image: Avoid overriding qemu variables from IMAGE_CLASSESAlejandro Hernandez Samaniego2023-01-061-0/+11
| | | | | | | | | | | | | | | | | | | Since qemuboot is part of IMAGE_CLASSES via qemu.inc it is being inherited before we set the QB_FOO variables. Since our variables have conditional definitions and at that point they've already been defined by qemuboot, we can no longer define them in our class. Move the IMAGE_CLASSES inherit to execute it after we set the QB_FOO variables to fix booting via runqemu. (From OE-Core rev: c588b05ed4bc6b46749e24e80300228df017c694) Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 8ed78ec262b2502dc3b673b24a868a3eec616a20) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove RRECOMMENDS to rng-tools for sshd packageXiangyu Chen2023-01-061-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It appears that rngd is not needed as of linux-5.6 and later[1] and should not be installed by default since the purpose of rngd is to provide additional trusted sources of entropy. We did some testing on real hardware, the result seems to support that we no longer need rngd by default on kernel v5.6 and later. Testing result as below: 1. observing the crng init stage. the "random: crng init done" always available before fs being mounted. 2. generating random number without rngd. testing command: dd if=/dev/random of=/dev/null status=progress on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block on NXP i.mx6q board, speed almost 31.9 MB/s without block on qemu x86-64, speed almost 2.6MB/s without block 3. using rngtest command without rngd testing command: rngtest -c 1000 </dev/random on Marvell CN96xx RDB board: rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s rngtest: Program run time: 418771 microseconds on NXP i.mx6q board: rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s rngtest: Program run time: 570229 microseconds on qemu x86-64: rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s rngtest: Program run time: 836800 microseconds 4. observing sshd service. using "systemctl disable rng-tools" disable service and reboot system. system boot up normal, sshd service also start in normal time without block. Reference: [1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32 (From OE-Core rev: 2ed579aa28194cf671e5d4f4c61dc38d05de4b0c) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 868dfb46d96a27ec9041cb902fb769330277257d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gstreamer1.0: upgrade 1.20.4 -> 1.20.5Wang Mingyu2023-01-0611-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== systemclock waiting fixes for certain 32-bit platforms/libcs alphacombine: robustness improvements for corner case scenarios avfvideosrc: Report latency when doing screen capture d3d11videosink: various thread-safety and stability fixes decklink: fix performance issue when HDMI signal has been lost for a long time flacparse: Fix handling of headers advertising 32 bits per sample mpegts: Handle when iconv doesn't support ISO 6937 (e.g. musl libc) opengl: fix automatic dispmanx detection for rpi4 and fix usage of eglCreate/DestroyImage opusdec: Various channel-related fixes textrender: event handling fixes, esp. for GAP event subparse: Fix non-closed tag handling videoscale: fix handling of unknown buffer metas videosink: reverse playback handling fixes qtmux: Prefill mode fixes, especially for raw audio multiudpsink: allow binding to IPv6 address rtspsrc: Fix usage of IPv6 connections in SETUP rtspsrc: Only EOS on timeout if all streams are timed out/EOS splitmuxsrc: fix playback stall if there are unlinked pads v4l2: Fix SIGSEGV on state change during format changes wavparse robustness fixes Fix static linking on macOS (opengl, vulkan) gstreamer-vaapi: fix headless build against mesa >= 22.3.0 GStreamer Editing Services library: Fix build with tools disabled webrtc example/demo fixes unit test fixes for aesdec and rtpjitterbuffer Cerbero: Fix ios cross-compile with cmake on M1; some recipe updates and other build fixes Binary packages: pkg-config file fixes for various recipes (ffmpeg, taglib, gstreamer) Binary packages: Enable high bitdepth support for libvpx (VP8/VP9 encoding/decoding) Binary packages: ship aes plugin Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements Performance improvements (From OE-Core rev: e9a05c026c6b1f39c4413abea9912542aa608cbe) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit fd8ab6052d88120c58cf84ad7d77d60c12ef3b8a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzdata: update 2022d -> 2022gAlexander Kanavin2023-01-061-4/+3
| | | | | | | | | | (From OE-Core rev: e9f8a4ce08b7abe1232e807949cf8fbd06a929cc) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2394a481db1b41ad4581e22ba901ac76fa7b3dcd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ruby: update 3.1.2 -> 3.1.3Alexander Kanavin2023-01-062-38/+1
| | | | | | | | | | (From OE-Core rev: 3e43f3925bce640999a25ceb855a77d8cd0afd26) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 402254a5f841520b132508c21465111d33b6eb1a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ruby: merge .inc into .bbAlexander Kanavin2023-01-062-44/+40
| | | | | | | | | | (From OE-Core rev: 22d6559bc30897a82f4519ac463f12f01fea18bc) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d88ff809b2e78ee49d5da42bb08ff5244e6101af) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libnewt: update 0.52.21 -> 0.52.23Alexander Kanavin2023-01-063-40/+7
| | | | | | | | | | (From OE-Core rev: 95a1668668ad962a3cb8676f08d1bb568f12436f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit ff12622451f1f8580f928c6771cd82daa632071c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* webkitgtk: 2.36.7 -> 2.36.8Kai Kang2023-01-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | webkitgtk 2.36.8 is a bug fix release in the stable 2.36 series. What’s new in the WebKitGTK 2.36.8 release? * Fix jumpy elements when scrolling GitLab and other web sites. * Fix WebKitWebView:web-process-terminated signal not being emitted for the first web view when sandboxing is enabled. * Fix hang when opening HTML <select> elements in GTK4 builds. * Fix kinetic scrolling with elements that use overflow scrolling. * Fix several crashes and rendering issues. It fixes CVES: CVE: CVE-2022-32886 CVE: CVE-2022-32891 CVE: CVE-2022-32912 Refs: * https://webkitgtk.org/2022/09/16/webkitgtk2.36.8-released.html * https://webkitgtk.org/security/WSA-2022-0009.html (From OE-Core rev: 94c4dc8d233a35270dfedd9739f36c7aca0a559f) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-17 05:19:25 +0000