summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* expat: upgrade 2.6.3 -> 2.6.4Peter Marko2025-01-131-1/+1
| | | | | | | | | | | Handle CVE-2024-50602 (From OE-Core rev: 690874991ca51b37bc0af262ba6c366ff72af13f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5dc22afe3d2ea767f084b7c6e3625cb6edd66522) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Handle BB_NO_NETWORK and missing dbMark Hatle2025-01-131-0/+5
| | | | | | | | | | | | | | | | | | | The custom do_fetch routine is ignoring BB_NO_NETWORK, add a check for this as the correct behavior for the user is to set: CVE_DB_UPDATE_INTERVAL = "-1" If CVE_DB_UPDATE_INTERNAL is set to -1, check that a DB file exists, if not we need to error so the user can deal with this. Note, MIRRORs are NOT handled by this code. (From OE-Core rev: 2bc4623a910dfa3a22cd054ea1e0f2dd59d74eea) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 337c0806d2784d74bee8d6420fb8b4d48795d5fa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* populate_sdk_ext: write_local_conf add shutil importMark Hatle2025-01-091-0/+2
| | | | | | | | | | | | | | Add shutil import to resolve error: Exception: NameError: name 'shutil' is not defined, Did you forget to import 'shutil' (From OE-Core rev: 6f0d75ed7bbae03301bd41db1076ce926c5e742c) Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b64263a43b4d82f1ebba13815bccb8a8cd3127f9) Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: upgrade 1.24.9 -> 1.24.10Wang Mingyu2025-01-0910-10/+10
| | | | | | | | | | | (From OE-Core rev: 42104c010fc6f9bdee84625604777974ad2b70a5) (From OE-Core rev: 6a871d3166775d95a8a50cb79bec6a2e158b5674) Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: upgrade 1.24.6 -> 1.24.9Alexander Kanavin2025-01-0922-23/+58
| | | | | | | | | | | (From OE-Core rev: e01f9c79725388437d52096701416b61d9a0aa7d) (From OE-Core rev: e30a79d4ee30b51cdc83fc13121d548fde3b1e7a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: run ptests in parallelRoss Burton2025-01-092-2/+2
| | | | | | | | | | | | | | | Run the ptests in four parallel jobs (reduces runtime from ~80s to ~20s on my machine), and also pass any arguments in the scripts to make it easier to run individual tests. (From OE-Core rev: 87a9fadc71c8d3c1eb841c84c96146d5c56f1241) (From OE-Core rev: 4a5b169abf171754217458d1615f9fb8bddc4a2b) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-libav: explicitly disable documentationRoss Burton2025-01-091-0/+1
| | | | | | | | | | | | | | We can't build documentation when doing a cross build, so disable it explicitly to be clear. (From OE-Core rev: 2706062d3a711ff0b2c03bee40b908ad329ebd6d) (From OE-Core rev: f60e311ebbbc7230471b6b9d6036d5e8d6c21c3d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2024-53589Yash Shinde2025-01-092-0/+93
| | | | | | | | | | | | | | | | A buffer overflow vulnerability exists in GNU Binutils’ objdump utility when processing tekhex format files. The vulnerability occurs in the Binary File Descriptor (BFD) library’s tekhex parser during format identification. Specifically, the issue manifests when attempting to read 8 bytes at an address that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read. Backport a patch from upstream to fix CVE-2024-53589. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] (From OE-Core rev: 04c6b181bf9b1babd647c642ba8598b837f1263b) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix c++: tweak for Wrange-loop-constructSunil Dora2025-01-092-0/+115
| | | | | | | | | | | | | | | | | | | | This commit updates the warning to use a check for "trivially constructible" instead of "trivially copyable." The original check was incorrect, as "trivially copyable" only applies to types that can be copied trivially, whereas "trivially constructible" is the correct check for types that can be trivially default-constructed. This change ensures the warning is more accurate and aligns with the proper type traits. LLVM accepted a similar fix: https://github.com/llvm/llvm-project/issues/47355 PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731] (From OE-Core rev: b8260e5aca93a7000001013f8a950fb040141588) Signed-off-by: Marek Polacek <polacek@redhat.com> Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* buildtools-docs-tarball: Add rsvg so we can handle svg files in docsAntonin Godard2025-01-091-0/+1
| | | | | | | | | | | We need to convert svg into png in the docs build so add rsvg tools to handle this. (From OE-Core rev: 5dd1fdf4c3e8596c4e7c8cd57d371c2c1d4b0843) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.7 -> 3.12.8Guðni Már Gilbert2025-01-0923-53/+53
| | | | | | | | | | Changelog: https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8 (From OE-Core rev: 751cf7a576dbb949763703e655e951bcd583f251) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.6 -> 3.12.7Guðni Már Gilbert2025-01-0923-87/+65
| | | | | | | | | | Changelog: https://docs.python.org/release/3.12.7/whatsnew/changelog.html#python-3-12-7 (From OE-Core rev: 103cb3a5390214bd95a75c4db4b00f64b456b7f1) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Tweak to work better with NFS DL_DIRRichard Purdie2024-12-181-0/+2
| | | | | | | | | | | | | | | | | After much debugging, the corruption issues on the autobuilder appear to be due to the way sqlite accesses database files. It doesn't change the file timestamp after making changes, which for reasons unknown, confuses NFS. As soon as the file is touched, NFS becomes fine again accross the whole cluster, as if by magic. We could try and debug further but putting a "touch" call into the code is easy and harmless. Lets hope this removes this annoying source of errors. (From OE-Core rev: 6e517366cda4c22547ed097ee58126f7dfc56a57) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* shadow: use update-alternatives to handle su.1 and nologin.8Sid-Ali2024-12-171-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the following error at do_rootfs: update-alternatives: Error: not linking /PATH/TO/rootfs/usr/share/man/man1/su.1 to /usr/share/man/man1/su.1.util-linux since /PATH/TO/rootfs/usr/share/man/man1/su.1 exists and is not a link update-alternatives: Error: not linking /PATH/TO/rootfs/usr/share/man/man8/nologin.8 to /usr/share/man/man8/nologin.8.util-linux since /PATH/TO/rootfs/usr/share/man/man8/nologin.8 exists and is not a link The problem can be reproduced by adding the following lines to local.conf and then building an image: EXTRA_IMAGE_FEATURES:append = " doc-pkgs" IMAGE_INSTALL:append = " shadow util-linux" su.1 and nologin.8 are handled by update-alternatives in util-linux recipe, so do it in shadow recipe too. (From OE-Core rev: a12be809144cbca43576d15c0f0f1781eeaf5a27) Signed-off-by: Sid-Ali Teir <sidali.teir@cysec.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 198c4582c6391ac87c49e09882189235c44b60e9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dnf: drop python3-iniparse from DEPENDS and RDEPENDSGuðni Már Gilbert2024-12-171-2/+1
| | | | | | | | | | | | | | | python3-iniparse dependency was dropped 2019, see the following commit as reference: https://github.com/rpm-software-management/dnf/pull/1329/commits/d7d0e0e2f9d8c7d021c794821ad0b56a39ebc01f When looking at the Git history, this happened around tag 4.2.1 (From OE-Core rev: 82b1c8fb497f74bbc67cc6763116fa96267acc4a) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-poetry-core: drop python3-six from RDEPENDSGuðni Már Gilbert2024-12-171-1/+0
| | | | | | | | | | | | | | | | Looking at the history, python3-six was removed as a dependency in the poetry.lock file in v1.5.2 Even before v1.5.2 and until now (v1.9.1) there is no code in the package which imports the six module. So it can be safely dropped from the recipe. (From OE-Core rev: 01a938f176c1eb2f753c2df50ef966cc175a2d18) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-boot: drop intltool-native from DEPENDSGuðni Már Gilbert2024-12-171-1/+1
| | | | | | | | | | | | intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: 0df327ea64ec6a9e99c8f96e1dab52d3db3711b3) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: drop intltool-native from DEPENDSGuðni Már Gilbert2024-12-171-1/+1
| | | | | | | | | | | | intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: 5c6254279c8b7faf76809024ebbc02856030179e) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: upgrade 10.03.1 -> 10.04.0Hitendra Prajapati2024-12-172-4/+4
| | | | | | | | | | | | | | | | | | | | | | | avoid-host-contamination.patch refreshed for 10.04.0 Changelog: =========== - addresses CVEs: CVE-2024-46951, CVE-2024-46952, CVE-2024-46953, CVE-2024-46954, CVE-2024-46955, CVE-2024-46956 - add protection for device selection from PostScript input. - efforts in code hygiene and maintainability continue. - The usual round of bug fixes, compatibility changes, and incremental improvements. - add the capability to build with the Tesseract OCR engine. (From OE-Core rev: a0c802e9b1d8400589aede20e52f40d10a344314) (From OE-Core rev: 067e769ada6c8cd5783c6d32f24cea9f0e4ed666) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: patch CVE-2024-9681Peter Marko2024-12-172-0/+86
| | | | | | | | | | | | | | | | Picked commit [1] per solution described in [2]. [1] https://github.com/curl/curl/commit/a94973805df96269bf [2] https://curl.se/docs/CVE-2024-9681.html (From OE-Core rev: 19663c559b72a0d14ddd0792be325284a6e16edc) (From OE-Core rev: c8282f5f79a38be0672c68c9e8f11bc072b77b56) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: ignore CVE-2024-43402Peter Marko2024-12-171-0/+1
| | | | | | | | | | | | | | | | This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 (From OE-Core rev: 6ed9968bf3e35aca316227ee23294c683f77055d) (From OE-Core rev: 10abc451f37be9d7d6b9482dbd5666a2bf8e9736) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsndfile1: backport the fix for CVE-2024-50612Ross Burton2024-12-172-0/+410
| | | | | | | | | | | | | | Backport the fix from upstream. (From OE-Core rev: 2fc6b711a6a7252ddf13587927c06333f5a38d71) (From OE-Core rev: 4d76d2f2affb95f25f1882f33305b1489a392f65) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix CVE-2024-48957 & CVE-2024-48958Hitendra Prajapati2024-12-173-1/+80
| | | | | | | | | | | | | | | | Backport fixes for: * CVE-2024-48957 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/3006bc5d02ad3ae3c4f9274f60c1f9d2d834734b * CVE-2024-48958 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/a1cb648d52f5b6d3f31184d9b6a7cbca628459b7 (From OE-Core rev: 8b520c3cea136591128f6601718c23334afd7a55) (From OE-Core rev: 4f6a2eea1476bc7be1d55b6b6051c4b65d4d97fa) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: patch CVE-2024-6505Peter Marko2024-12-172-0/+41
| | | | | | | | | | | | | Backport patch [3] as linked from [1] via [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760 [3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb (From OE-Core rev: ded62bdb5ce9da62aaaa53ac20203bd87a7b1197) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* builder: set CVE_PRODUCTPeter Marko2024-12-171-1/+2
| | | | | | | | | | | | | | | | Builder is a common word and there are many other builder components which makes us to ignore CVEs for all of them. There is already 1 ignored and currently 3 new ones. Instead, set product to yocto to filter them. (From OE-Core rev: fd4ec5a5318b36af0a9a0a097a5b1f1de44a8edf) (From OE-Core rev: 18773170492fc01ce7123ba0fac88e58750a3b93) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/utils/gitarchive: Return tag name and improve exclude handlingRichard Purdie2024-12-091-1/+3
| | | | | | | | | | | | | Tweak the gitarchive exclude handling not to error if excluded files don't match. Also return the tagname created so that other code can then use it. (From OE-Core rev: bde2cf92e1a968e7272a194b887c331742f94d5b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1adba3430faffdf6217b6a00533a3b48a9388abc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* resulttool: Use single space indentation in json outputRichard Purdie2024-12-091-1/+1
| | | | | | | | | | | | | Using 4 space indentation in resulted in hundreds of megabytes of extra file size in general use. Reduce this to make filesizes more managable and reduce the processing cost. Some level of indentation and spacing does make the files more readable and allows use of git diff so we need to retain some of it. (From OE-Core rev: b8be3ac506bb39665390c770f72de2ca359670b1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a274cdcaf852cca9497f0358f44dda99c06aacbe) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/reproducible: Clean up pathnamesRichard Purdie2024-12-091-1/+1
| | | | | | | | | | | | | | | | | | | There are several problems with these paths. Firstly they contain full system paths which depend upon where the test was run. These are pretty pointless and just take up a lot of space making the results files large. Secondly, they contain the same path twice. The reference and target path will always be the same thing in two different locations. Strip off the prefix and remove the duplication. This does change the output data but that can't really be avoided. It does shrink the results data and makes it more readable. (From OE-Core rev: 40b422edd954eeb917464e6baa0e952d2ed4184c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81a44de36e864b08687451fd85aeba7c529fd7f7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/reproducible: Drop rawlogsRichard Purdie2024-12-091-6/+0
| | | | | | | | | | | | | | | The "rawlogs" data consists of a long string of results data which is already in a structured data format. I can't see this is adding much value in duplciating the data but it does create a huge string with a lot of long problematic pathnames and inflates the results data size. I suggest we drop this data as obsolete and not necessary. (From OE-Core rev: d35e96785a07bba29a76c96f91751be12497f50c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5b2c70fab2ffa409b861d83f048b65d458d03a90) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* do_package/sstate/sstatesig: Change timestamp clamping to hash output onlyRichard Purdie2024-12-092-17/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code was changing the timestamps of the files in the do_package output, particularly the files added for debug sources. This was to do two things: a) make do_package sstate more reproducible b) ensure better hash equivalence matching Unfortuately the debug source files are hardlinks into the source tree for efficiency so touching these, touches a lot of files in ${B} and ${S}. This causes unpredictable effects if compile is run again for example, or could cause compiling in the install task. The hash equivalence matching is of key importance but we can mimic that using clamping of the file timestamps in the depsig output used to generate the hashes. This patch drops the global timestamp clamping, instead allowing the files to retain their creation timestamps into sstate. This makes do_package sstate slightly less reproducibile. We could clamp the sstate timestamps but that would lead to two different sets of timestamps depending on whether the data came from sstate or not. I'd prefer to have consistent code behaviour, rather than differing behavhour depending on whether data came from sstate or not. If we wanted to have reproducibiliy and fix the "corruption" of S/B and have consistent codepaths, the only other option would be two copies of the sources, which could end up huge and seems the least desireable option. This patch therefore drops the timestamp clamping in the sstate files and tweaks the depsig data generation to clamp the timestamps for do_package instead since this seems the best compromise. I validated that rpm/deb/ipk files still generate correctly as before. (From OE-Core rev: 0e6b2c761f6d727fe21a0ce2803a0f0aef236f59) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 475759fdab7200488b2a568b2ba1aa31a456d113) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rxvt-unicode.inc: disable the terminfo installation by setting TIC to :Changqing Li2024-12-091-1/+2
| | | | | | | | | | | | | | | | | | | Without this change, TIC is the native tic in recipe-sysroot-native. By default, native tic has set its default terminfo path to native path: ${datadir}/terminfo; $HOME/.terminfo When sstate cache is used, the cached native tic's terminfo path could be a path not exist on current host, then native tic will try to install terminfo to HOME dir, cause host contamination. Disable the terminfo installation by setting TIC to : (From OE-Core rev: 571e50db36d2b4bac075d4025efbdfdb8548468b) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fe35ead2c3135a18c346e7baa31d34b15c3e2d95) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.40 branch updates.Deepthi Hemraj2024-12-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.40 stable branch are updated. 626c048f32 elf: handle addition overflow in _dl_find_object_update_1 [BZ #32245] efb710034e linux: sparc: Fix clone for LEON/sparcv8 (BZ 31394) 2344580243 Mitigation for "clone on sparc might fail with -EFAULT for no valid reason" (bz 31394) 3a34851103 elf: Change ldconfig auxcache magic number (bug 32231) 85e5850f2f Make tst-strtod-underflow type-generic 5c06c6e0b5 libio: Set _vtable_offset before calling _IO_link_in [BZ #32148] cc256952ec Add tests of more strtod special cases 8f40dfbe2a Add more tests of strtod end pointer 4a9b6cdc88 Make tst-strtod2 and tst-strtod5 type-generic 5a10d05c39 powerpc64le: Build new strtod tests with long double ABI flags (bug 32145) c4cc72d2ef Do not set errno for overflowing NaN payload in strtod/nan (bug 32045) ad93c2047d Improve NaN payload testing cac10d88c6 Make __strtod_internal tests type-generic d0c1792ad2 Fix strtod subnormal rounding (bug 30220) e06153665f More thoroughly test underflow / errno in tst-strtod-round 9bc76c7ca4 Test errno setting on strtod overflow in tst-strtod-round 61b6464f8d Add tests of fread 77018fd9f9 stdio-common: Add new test for fdopen Testresults: After update |Before update |Difference PASS: 4947 |PASS: 4945 |PASS: +2 FAIL: 224 |FAIL: 224 |FAIL: 0 XPASS: 4 |XPASS: 4 |XPASS: 0 XFAIL: 16 |XFAIL: 16 |XFAIL: 0 UNSUPPORTED: 229|UNSUPPORTED: 229|UNSUPPORTED: 0 (From OE-Core rev: e773465484dbcae693b75ea1a61006a0cedb79cc) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to styhead head revisionyocto-5.1.1styhead-5.1.1Steve Sakoman2024-11-301-2/+2
| | | | | | (From OE-Core rev: b511d0146a2e8f316f4aecc90c853215674013ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* package_rpm: restrict rpm to 4 threadsAlexander Kanavin2024-11-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TL;DR version: with this, and the previous compression level changes I am seeing drastic speedups in package_write_rpm completion times: webkitgtk goes from 78 seconds to 37 seconds glibc-locale goes from 399 seconds to 58 seconds (!) The long version: rpm uses multithreading for two purposes: - spawning compressors (which are nowadays themselves multi-threaded, so the feature is not as useful as it once was) - parallel file classification While the former behaves well on massively parallel CPUs (it was written and verified here :), the latter was then added by upstream and only benchmarked on their very old, slow laptop, apparently: https://github.com/rpm-software-management/rpm/commit/41f0e214f2266f02d6185ba11f797716de8125d4 On anything more capable it starts showing pathologic behavior, presumably from spawning massive amount of very short-lived threads, and then having to synchronize them. For example classifying glibc-locale takes 5m20s with 256 threads (default on my machine!) 1m49s with 64 threads 59s with 16 threads 48s with 8 threads Even a more typical recipe like webkitgtk is affected: 47s with 256 threads 32s with 64 threads 27s with 16 or 8 threads I have found that the optimal amount is actually four: this also means that only four compressors are running at a time, but as they're themselves using threads, and typical recipes are dominated by just two or three large packages, this does not affect overall completion time. (From OE-Core rev: ac480775440fba812fd5aa9da73e0e5bc60d46d6) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* package_rpm: use zstd's default compression levelAlexander Kanavin2024-11-301-1/+1
| | | | | | | | | | | | | | | | | | zstd uses 3 by default, while 19 is the highest and slowest. It's not clear why 19 was picked to begin with, possibly I copy-pasted it from rpm's examples without thinking: https://git.yoctoproject.org/poky/commit/?h=master-next&id=4a4d5f78a6962dda5f63e9891825c80a8a87bf66 This brings significant speedups in rpm's compression step: for example compressing webkitgtk takes 11s instead of 36s. The rpm size increases from 175648k to 234860k. I think it's a worthy default tradeoff. (From OE-Core rev: 9ec8b99470ed744c8eca0b23f99ba54210984080) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: add a backport patch to fix an issue with tzdata 2024bMarkus Volk2024-11-302-0/+550
| | | | | | | | | | | | | | | There is an issue in the std::chrono::tzdb parser that causes problems since the tzdata-2024b release started using %z in the main format. As a real world problem I encounter an issue with the waybar clock module, which ignores the timezone setting and only shows system time. (From OE-Core rev: 08dfd3849bd804f4760ebeca226645e65709a65a) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 39018429f05511053ab12e23e7f4487ea25ee529) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kexec-tools: update COMPATIBLE_HOST because of makedumpfileKai Kang2024-11-302-0/+4
| | | | | | | | | | | | | | makedumpfile is not compatible with mipsarcho32 and riscv32, so set for kexec-tools accordingly. And update packagegroup-core-tools-testapps too. (From OE-Core rev: 6922821ab9a0e72e666e57e4b941e5821503509e) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9107d9c09c7dab385c6034778cefadca3613be9c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/sstatetests: run CDN mirror check only onceAlexander Kanavin2024-11-301-2/+0
| | | | | | | | | | | | | The first no-fail check was an attempt to work around the old CDN's instability (and it didn't really help); it should not be necessary with the new CDN, and only delays a-full completion. (From OE-Core rev: 6ffde2643e6ee8a2a0eddca173a254dbdc4a79bb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7f75c42b7fcf60a9ca58d3ded9047df675d76dc2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix SDK environment script to avoid unbound variableRichard Purdie2024-11-301-1/+1
| | | | | | | | | | | | | | Avoid errors like: buildtools/sysroots/x86_64-pokysdk-linux/environment-setup.d/openssl.sh: line 6: BB_ENV_PASSTHROUGH_ADDITIONS: unbound variable by setting an explicit empty default value. (From OE-Core rev: a57192131cbcb65e17b11f47aa0f90ef63258280) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5a2a4910a22668f25679a47deaa9e2ed28665efa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* shadow: use update-alternatives to handle groups.1Chen Qi2024-11-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the following error at do_rootfs: update-alternatives: Error: not linking /PATH/TO/rootfs/usr/share /man/man1/groups.1 to /usr/share/man/man1/groups.1.coreutils since /PATH/TO/rootfs/usr/share/man/man1/groups.1 exists and is not a link The problem can be reproduced by adding the following lines to local.conf and then building an image: EXTRA_IMAGE_FEATURES:append = " doc-pkgs" IMAGE_INSTALL:append = " shadow coreutils" groups.1 is handled by update-alternatives in coreutils recipe, so do it in shadow recipe too. (From OE-Core rev: 822d70b7ccc2e5922de99a7703ec7eb3f814e29f) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 78c8eb60097df2e16c699464c39ff9142fc1ae69) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix packaging examplesMartin Jansa2024-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | | * I've noticed that ffmpeg package isn't created in my builds, due to --disable-programs in EXTRA_OECONF added by our .bbappend, but was surprised that lib32-ffmpeg is created. * lib32-ffmpeg was created only because it contained the examples which are installed in /usr/share/ffmpeg even when PN is lib32-ffmpeg as we pass --datadir=${datadir}/ffmpeg in EXTRA_OECONF here * --disable-programs controls ${bindir}/ffprobe ${bindir}/ffmpeg and ${datadir}/ffmpeg/ffprobe.xsd ${datadir}/ffmpeg/libvpx-*.ffpreset (From OE-Core rev: 24bf3ad245fa2dba14a59477279c6db3c8bcd088) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d7bf828b6431a254201675e41047f53da47912f5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: fix broken links for sysvinit-compatible commandsYi Zhao2024-11-301-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit[1], PACKAGECONFIG[sysvinit] is not enabled by default when sysvinit is not in DISTRO_FEATURES, which causes the following sysvinit-compatible commands/services to not be built and installed: runlevel telinit rc-local.service systemd-initctl systemd-initctl.service systemd-rc-local-generator systemd-sysv-generator systemd-update-utmp-runlevel.service Therefore, links to these commands/services should only be created when PACKAGECONFIG[sysvinit] is enabled. [1] https://git.openembedded.org/openembedded-core/commit/?id=3668235fd60a9027608f37251c4b453ed21b3687 (From OE-Core rev: 681e3d20c2ac16778e302b468ec278aed9562639) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a20b698f1acdee972cf1ff570b09a2e2c36bef1a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto/6.10: bsp/genericarm64: disable ARM64_SMEBruce Ashfield2024-11-303-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Integrating the following commit(s) to linux-yocto/.: 1/1 [ Author: Ross Burton Email: ross.burton@arm.com Subject: bsp/genericarm64: disable ARM64_SME Date: Thu, 21 Nov 2024 15:53:35 +0000 From upstream: arm64: Kconfig: Make SME depend on BROKEN for now commit 81235ae0c846e1fb46a2c6fe9283fe2b2b24f7dc upstream. Although support for SME was merged in v5.19, we've since uncovered a number of issues with the implementation, including issues which might corrupt the FPSIMD/SVE/SME state of arbitrary tasks. While there are patches to address some of these issues, ongoing review has highlighted additional functional problems, and more time is necessary to analyse and fix these. For now, mark SME as BROKEN in the hope that we can fix things properly in the near future. As SME is an OPTIONAL part of ARMv9.2+, and there is very little extant hardware, this should not adversely affect the vast majority of users. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> ] (From OE-Core rev: 3a6e6639b0dc4a49adfba15e720bb884d9859aa7) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 022f9814cb9d6d420e9d89a746f4c67b452c498f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto/6.10: cfg: gpio: allow to re-enable the deprecated GPIO sysfs ↵Bruce Ashfield2024-11-303-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | interface Integrating the following commit(s) to linux-yocto/.: 1/1 [ Author: Bartosz Golaszewski Email: bartosz.golaszewski@linaro.org Subject: gpio: allow to re-enable the deprecated GPIO sysfs interface Date: Mon, 11 Nov 2024 14:08:23 +0100 The GPIO sysfs interface is disabled in standard linux config and in general users should use the character device instead but there are still programs out there that depend on it so for the time being add a kernel feature allowing to enable it. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> ] (From OE-Core rev: b286e3dd8624cab0c57fe85c457b617e402ff6b9) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ae19861bfc336d869a7a84b13ab3e7b318e1b560) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto/6.10: genericarm64.cfg: enable CONFIG_DMA_CMABruce Ashfield2024-11-303-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Integrating the following commit(s) to linux-yocto/.: 1/1 [ Author: Mikko Rapeli Email: mikko.rapeli@linaro.org Subject: genericarm64.cfg: enable CONFIG_DMA_CMA Date: Thu, 24 Oct 2024 08:49:29 +0300 It's needed for graphics on AMD KV260. Cc: Bill Mills <bill.mills@linaro.org> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> ] (From OE-Core rev: 0b5476e41714ba1290bad711d9adfe894c3a70e3) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7d1572bce914ff67c3e08f95dfd8504b00b9a8e0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: upgrade 24.1.3 -> 24.1.4Vijay Anusuri2024-11-301-1/+1
| | | | | | | | | | | | | Includes security fix CVE-2024-9632 Ref: https://lists.x.org/archives/xorg/2024-October/061766.html (From OE-Core rev: 95a4db564feff2c0dd21dad735b7a95a03c2a647) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3fdc716d1260b4a92a46cfd2059ce044447f9172) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: upgrade 24.1.2 -> 24.1.3Wang Mingyu2024-11-301-1/+1
| | | | | | | | | (From OE-Core rev: 38a09bff16c85b10386435eca88358aec0159ba5) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b42744482d5b883c04e81b4be56ef19bc27caa3f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata/tzcode-native: upgrade 2024a -> 2024bJinfeng Wang2024-11-301-3/+3
| | | | | | | | | (From OE-Core rev: eae95be63db899ab2e247d823149e89aea6170f7) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b84b29b1827624270cc1698feda2ee87d55c01e4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: fix malformed cve status description with : charactersPeter Marko2024-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When CPE is not provided and character ":" is in cve status description, current code takes only last part of split function. This works only if there is no ":" in description, otherwise it drops the other split parts. Do a new split of the original string to take the whole description unchanged. This fixes following entries from world build of poky+meta-oe+meta-python: tiff-4.6.0-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2015-7313 CVE_STATUS: fixed-version: Tested with check from https://security-tracker.debian.org/tracker/CVE-2015-7313 and already 4.3.0 doesn't have the issue description: //security-tracker.debian.org/tracker/CVE-2015-7313 and already 4.3.0 doesn't have the issue corrected: Tested with check from https://security-tracker.debian.org/tracker/CVE-2015-7313 and already 4.3.0 doesn't have the issue gnupg-2.5.0-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2022-3219 CVE_STATUS: upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993 description: //dev.gnupg.org/T5993 corrected: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993 libyaml-0.2.5-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2024-35325 CVE_STATUS: upstream-wontfix: Upstream thinks this is a misuse (or wrong use) of the libyaml API - https://github.com/yaml/libyaml/issues/303 description: //github.com/yaml/libyaml/issues/303 corrected: Upstream thinks this is a misuse (or wrong use) of the libyaml API - https://github.com/yaml/libyaml/issues/303 libyaml-0.2.5-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2024-35326 CVE_STATUS: upstream-wontfix: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302 description: //github.com/yaml/libyaml/issues/302 corrected: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302 libyaml-0.2.5-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2024-35328 CVE_STATUS: upstream-wontfix: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302 description: //github.com/yaml/libyaml/issues/302 corrected: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302 cpio-2.15-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2023-7216 CVE_STATUS: disputed: intended behaviour, see https://lists.gnu.org/archive/html/bug-cpio/2024-03/msg00000.html description: //lists.gnu.org/archive/html/bug-cpio/2024-03/msg00000.html corrected: intended behaviour, see https://lists.gnu.org/archive/html/bug-cpio/2024-03/msg00000.html openssh-9.9p1-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2023-51767 CVE_STATUS: upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1. description: //bugzilla.mindrot.org/show_bug.cgi?id=3656#c1. corrected: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1. cups-2.4.10-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2021-25317 CVE_STATUS: not-applicable-config: This concerns /var/log/cups having lp ownership, our /var/log/cups is root:root, so this doesn't apply. description: root, so this doesn't apply. corrected: This concerns /var/log/cups having lp ownership, our /var/log/cups is root:root, so this doesn't apply. unzip-1_6.0-r0 do_cve_check: CVE_STATUS with 3 parts for CVE-2008-0888 CVE_STATUS: fixed-version: Patch from https://bugzilla.redhat.com/attachment.cgi?id=293893&action=diff applied to 6.0 source description: //bugzilla.redhat.com/attachment.cgi?id=293893&action=diff applied to 6.0 source corrected: Patch from https://bugzilla.redhat.com/attachment.cgi?id=293893&action=diff applied to 6.0 source syslog-ng-4.7.0-r0 do_cve_check: CVE_STATUS with 6 parts for CVE-2022-38725 CVE_STATUS: cpe-incorrect: cve-check wrongly matches cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:premium:*:*:* < 7.0.32 description: syslog-ng:*:*:*:*:premium:*:*:* < 7.0.32 corrected: cve-check wrongly matches cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:premium:*:*:* < 7.0.32 (From OE-Core rev: 5cd34a34879ad424f3b1637b48892d6fa037861d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cc33dd9176726cb4b2d2f142ed1bc655da8e0a9f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: do not skip cve status description after :Peter Marko2024-11-301-1/+1
| | | | | | | | | | | | | | | | | | Correct maxsplit parameter from 5 to 4 to not drop text if description contains ":". Example: >>> "detail: cpe:vendor:product:description:cont".split(':', 5) ['detail', ' cpe', 'vendor', 'product', 'description', 'xxx'] >>> "detail: cpe:vendor:product:description:cont".split(':', 4) ['detail', ' cpe', 'vendor', 'product', 'description:xxx'] (From OE-Core rev: 4921605aab4c9588e5c96de3afe08e9d35f51145) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3c4d8ca41ac0b429af92bf0ea84f1dfd0cda9e1f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 20:42:40 +0000