When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the
source code files that are used during compilation.
It uses debugsource information generated during do_package.
This enables an external tool to use the SPDX information to disregard
vulnerabilities that are not compiled.
As example, when used with the default config with linux-yocto, the spdx size is
reduced from 156MB to 61MB.
Tested with bitbake world on oe-core.
CC: Quentin Schulz <quentin.schulz@cherry.de>
CC: Joshua Watt <JPEWhacker@gmail.com>
CC: Peter Marko <peter.marko@siemens.com>
(From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Exein is a platinum member and has primary support
(https://www.yoctoproject.org/members).
(From yocto-docs rev: b13bccbf3fb1890ac428a396f8c5081057edf555)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
And mention the new supported features document.
Suggested-by: Robert P. J. Day <rpjday@crashcourse.ca>
(From yocto-docs rev: d852a2d20e876440a48a240ca68d5f440ef2cfbe)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Set the contact address for meta-arm.
(From yocto-docs rev: 8ad91366ed89204affef6a72bd403b0d0a4525fa)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As currently written, the PREFERRED_PROVIDER entries don't work with multilib
since they are added after the manipulations by multilib_global at ConfigParsed
time. We therefore need to spell out the configs correctly for multilib.
To avoid variable overwritten warnings from the expansion, we then have to
expand out the nativesdk providers usng class overrides.
(From OE-Core rev: 1f69850b62d1e022055d0f3b93ad270c2980462e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This change implements a toolchain selection mechanism. Selection is
made using a set of variables, primarily PREFERRED_TOOLCHAIN_TARGET which
defaults to gcc.
It uses the familiar name for toolchain e.g. "gcc" which selects GNU
compiler + binutils as default C/C++ toolchain or "clang" which will
use LLVM/Clang Compiler. Layers an add their own toolchain definitions
too.
There are also PREFERRED_TOOLCHAIN_NATIVE and PREFERRED_TOOLCHAIN_SDK
which will ulitmately allow selection of the toolchain used for the
native/cross and nativesdk/crosssdk compilers. This currently isn't
functional but is essential to the patch to ensure things are set
to the existing gcc support in those cases.
Users would most commonly want to set:
PREFERRED_TOOLCHAIN_TARGET ?= "clang"
in local.conf or other distro specific global configuration metadata.
It is also selectable at recipe scope, since not all packages are
buildable with either clang or gcc, a recipe can explicitly require
a given toolchain using the TOOLCAHIN variable, e.g. glibc can not
be built with clang therefore glibc recipe sets:
TOOLCHAIN = "gcc"
The TOOLCHAIN variable is distinct from the user preference so recipes
with specific requirements can be identified. This also allows different
polcies to be be specified for native/SDK cases in the future.
(From OE-Core rev: 45bdedd213aff8df3214b95ef2a8551c0abd93a0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Use the new deferred class event to set the class overrides earlier.
This improves interaction of the override with PACKAGECONFIG values
that control conditional inherits (such as python support).
This also allows toolchain configuration in an easier and more user
friendly way.
(From OE-Core rev: d58f94d5684332bd4fac3747688558bb261b9c63)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This brings in the features we need to toolchain selection.
(From OE-Core rev: 78c1061dc3916677bd9c2825820a1bab7e75f28a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update version to 2.15.0 for the development series and features needed for
toolchain selection in OE.
(Bitbake rev: c2f29c9475c4b9cdd12af1f8610f2675f8fdd964)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Calling oe-debuginfod in a build failed:
...
$ oe-debuginfod
|Getting sysroot...
|Error: NOTE: Reconnecting to bitbake server...
|NOTE: Retrying server connection (#1)... (18:55:53.009687)
|path-to-build/tmp/work/x86_64-linux/elfutils-native/0.192/recipe-sysroot-native doesn't exist.
|Have you run 'bitbake elfutils-native -caddto_recipe_sysroot'?
...
The script oe-debuginfod calls bitbake-getvar to get sysroot, the
output of bitbake-getvar was mixed with info output of bitbake
...
NOTE: Reconnecting to bitbake server...
NOTE: Retrying server connection (#1)... (18:55:53.009687)
...
Set logger level to logging.WARNING to skip info output
for quiet
(Bitbake rev: 873c524e1a33846df8f34b7c87b298349277b3d5)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add support for automatically promoting class inherits to deferred inherits
by listing them in the BB_DEFER_BBCLASSES variable.
(Bitbake rev: 8e741b2e885a12d119788d04aa4efcd724dd6bfa)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that deferred inherits are extension specific, we can pass this
list to an event, which our metadata can use to set class overrides
earlier (as an example).
There are limitations to this, the list of classes is unexpanded and
recursive classes are not visible. There isn't much that can be done
about this, the ones we are interested in would usually be visible
at the top level (such as class extensions).
(Bitbake rev: 205d461c05fc7b4a7c81039af3bc3fd71cbb982c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently deferred inherits get processed once for all class extensions
as a minor speed optimisation. Unfortunately this limits our options for
being able to report deferred classes to our code.
There are two challenges with using our deferred classes in OE at present.
One is that PACKAGECONFIG values don't work well with class overrides like
class-native if there are deferred classes based on PACKAGECONFIG, such
as python support. The second is that toolchain selection is proving
problematic to implement due to interactions between the toolchain deferred
inherit, the class extensions and class overrides being very late.
By changing deferred inherits to be recipe extension specific, we open
the way to generate events and "peek" at where things will end up,
allowing the class overrides to be set earlier.
The class extension code is updated to use a deferred inherit for the
class extension inheriting so that it is still inherited last.
(Bitbake rev: 29277cf4d88eb4dfa9572851177d009eab5afd0c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update the plugin names to account for the "-" to "_" plugin name change.
(From meta-yocto rev: ff4a8af7917d2e7c862d381577219f2c7beff669)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remap "-" characters in plugin names to "_" so wic plugins
can be extended using standard python class inheritance.
This change means wic files can be incrementally updated over time
to the correct name rather than breaking everything. Actual plugin
module files will need to be renamed as done in previous patches.
Also remove a double call to get_plugins() which isn't needed.
(From OE-Core rev: 6d9c76196ffad39e628aff76d53d6ecbb517cfa1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update the plugin names to account for the "-" to "_" plugin name change.
(From OE-Core rev: afa1b5c9f6ed17c021e37a54d0d6abee50a60bf9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Python not support importing modules with - so change to _.
(From OE-Core rev: 2de444fc3ef450f45f8f93403544e8f7461657b0)
Signed-off-by: Anibal Limon <anibal@limonsoftware.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To support extensions on wic plugins, the load order needs
to be grauntee matching BBLAYERS variable.
Fix cases when try to import a plugin from another layer,
example of the case to fix,
```
Traceback (most recent call last):
File "/workspaces/ls/linux/layers/openembedded-core/scripts/wic",line
547, in <module>
sys.exit(main(sys.argv[1:]))
^^^^^^^^^^^^^^^^^^
...
File "/workspaces/ls/linux/layers/openembedded-core/scripts/lib/wic/
engine.py", line 137, in list_source_plugins
plugins = PluginMgr.get_plugins('source')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/workspaces/ls/linux/layers/openembedded-core/scripts/lib/wic/
pluginbase.py", line 73, in get_plugins
spec.loader.exec_module(module)
File "<frozen importlib._bootstrap_external>", line 940, in exec_module
File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
File "/workspaces/ls/linux/limonsoftware/bsp/scripts/lib/wic/plugins/
source/bootimg_rpi_autoboot_partition.py", line 1, in <module>
from wic.plugins.source.bootimg_partition import BootimgPartitionPlugin
ModuleNotFoundError: No module named 'wic.plugins.source.bootimg_partition'
```
(From OE-Core rev: 16c8251e5272510ad96613b8c6623550c5a72a34)
Signed-off-by: Anibal Limon <anibal@limonsoftware.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
=============
- Fix duplicated dependencies added to the lock file when the same dependency with extras is requested.
- Stabilize order of the extras and dependency-groups fields in pylock output.
- Fix Windows 11 install pdm error, which is because of msgpack install failure.
- Change the return type of array_of_inline_tables to list[dict] from list[str]
- Ensure uv resolver to include hash for package files.
- Avoid infinite recursion when reading pyproject.toml with circular file dependencies.
- Support pylock as alternative lock format and make it opt-in by config.
- Search for package metadata in lock file first when reuse strategy is used.
(From OE-Core rev: 121c609e91dd7eb72670513eef8c31a5f2271c89)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: Copyright year updated to 2025
(From OE-Core rev: 2ac6a959f32214d958a7a0cf1973a9bc66839a9b)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
===========
- Fix a longstanding ordering issue with extracting type information
from properties which have a reference to another property. 'mac-mode'
is the one in the Linux kernel.
- Fix a false positive warning about missing
unevaluatedProperties/additionalProperties
(From OE-Core rev: e36601ca6454ec62ad2dd0db47724e2ad4c240cd)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bugs fixed
----------
* Attribute lookups failed on the "bool" builtin type.
* Type checks on or-ed union types could incorrectly return false.
* Negative list indexing could accidentally wrap around twice in PyPy and the Limited API.
* Iterating over literal sequences with starred (unpacked) items could infer a wrong
type for the loop variable and fail to assign the values.
* Calls to C functions taking exception types failed to check for a 'None' argument.
* Fused functions had an incorrect "__module__" attribute.
* The type of Cython implemented functions had an incorrect "__module__" attribute.
* Errors while indexing into "bytearray" or "str" in "nogil" sections could crash.
* "bytearray.append()" could silently accept some invalid character numbers.
* The C++11 "<type_traits>" header was included regardless of the C++ version.
* "PyDict_GetItemStringRef()" was accidentally used in older Limited API versions.
* "abort()" was used but not always available in the Limited API.
* Some dependencies were missing from the "depfile".
* Embedded function signatures were not always separated from the existing docstring.
* "numpy.math" was missing from "Cython/Includes/" and could not be cimported.
* Some tests were adapted for NumPy 2.x.
* Some C compiler warnings were fixed.
* "Cython.Build" was not officially exposing the "cythonize" function.
(From OE-Core rev: ad9e2ba3d7c1af3f7084427eb9ddb0822460b108)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
===========
* Fix missing override when CONFIG_COMPAT_OLD_SIGACTION is not defined
* fix: writeback: 'balance_dirty_pages' Respect 'CONFIG_CGROUP_WRITEBACK'
* Fix: scsi: RESERVE and RELEASE renamed in Linux v6.15-rc1
* Fix: del_timer[_sync] deleted in linux v6.15-rc1
* Fix: Use 'nonseekable_open' for proc files
* Fix: trace_balance_dirty_pages in Linux v6.14.2
* fix: version constraint for building lttng-probe-9p
(From OE-Core rev: 8f8b8e72ff4ea562630b428ff8ab7f163d0c7084)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
===========
- selected bug fixes:
* improve transaction ordering by allowing more uninst->uninst
edges
* implement color filtering when adding update targets
- new features:
* support orderwithrequires dependencies in susedata.xml
(From OE-Core rev: 000d105135c6ae871bfa8699d9008a1f4324c7f7)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
- Hardened the libjpeg API against hypothetical calling applications that may
erroneously change the value of the 'data_precision' field in
'jpeg_compress_struct' or 'jpeg_decompress_struct' after calling
'jpeg_start_compress()' or 'jpeg_start_decompress()'.
(From OE-Core rev: 49a69532bc2b4a7d6ae8136123e92b10b5e657f5)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: Copyright year updated to 2025
not-win32.patch
refreshed for 3.5.1
(From OE-Core rev: 4c32496a8b89cb1355672d6b7159aff09c69797b)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bugs fixed:
- Wrong behavior of GdkKeymap on macOS
- cups: NULL-terminate array of choices
- Fix the android build
- icontheme: Load the missing image icon from the theme
(From OE-Core rev: 1a31f269130429b7c690340c688c1f503f6473d3)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
According to [1]
A flaw was found in libxml2's xmlBuildQName function, where integer overflows
in buffer size calculations can lead to a stack-based buffer overflow. This
issue can result in memory corruption or a denial of service when processing
crafted input.
Refer debian [2], backport a fix [3] from upstream
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6021
[2] https://security-tracker.debian.org/tracker/CVE-2025-6021
[3] acbbeef9f5
(From OE-Core rev: e3a6bf785656243b5adc0775f7480a1eb0e4ae4c)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When using the license finder the caller might know some more license
hashes, for example if it is updating existing metadata.
Allow the caller to pass more hashes that can be used when identifying
licenses.
(From OE-Core rev: 9011bc307fcdccb144b75d77b36bbc5c8d4bd96d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rewrite the license checksum generation and loading of CSV files to be
clearer.
This also expands the scan of COMMON_LICENSE_DIR to include LICENSE_PATH,
which can be extended by layers to provide more license texts.
(From OE-Core rev: 417240ba7a9b3985530988940a222b079b503b64)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
crunch_license() will perform some basic text manipulation to try and
canonicalise the license texts. It also returns the new license text but
none of the callers use this, and as a slightly mangled version of the
original it has no real purpose.
Remove this return value and clean up the callers.
(From OE-Core rev: 34603ed3b4919dcfba19ef57db11a6d3bb2704f1)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
get_license_md5sums() has two optional arguments:
- static_only: if set, don't checksum the licenses in COMMON_LICENSE_DIR
- linenumbers: if set, the CSV file can contain begin/end/md5 values as
used in LIC_FILES_CHKSUM.
Neither of these are used and complicate the logic, so remove them.
(From OE-Core rev: 148e501bd4fe65e7bed68d086ba98180a9b2483c)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are two locations where mappings of checksums to license names
are: the license-hashes.csv file and a hard-coded set of assignments in
the code.
There's no need for two, so remove the assignments and move the hashes
into the CSV file.
(From OE-Core rev: a775c6cb5a2bf1f30a94ba3b88af9aa491e98b1a)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It may be desired to find only the "top-level" license file instead of
every potential candidate, so add a first_only argument (defaulting to
False to preserve existing behaviour) to return just the first license
found.
(From OE-Core rev: 995936ffda02a1def1863490ec315783a7470c72)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Shell scripts are not licenses, so skip them.
(From OE-Core rev: 0ce9ad80d3b90edc1d1e690763e8f3d9f0cd523d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
