0001-Add-parameter-signatures-for-getenv-and-getopt.patch
removed since it's included in 5.3.2
0001-configure.ac-re-enable-disabled-printf-features.patch
refreshed for 5.3.2`
(From OE-Core rev: a8773ae9d866063e0562589af44b90a89b5cd93c)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adds cve_check.py to BBIMPORTS so the functions it exposes will be
correctly scanned for dependencies in the dependency scanner
(From OE-Core rev: 52ead33c6b6e2532c57b7b28b862ba38b575f9e3)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
New releases are no longer made to SourceForge and the GitHub releases
are considered official according to https://libjpeg-turbo.org, so
inherit github-releases and update the SRC_URI.
This now reports that we need to upgrade to 3.1.0.
(From OE-Core rev: e7e11ab30a40ba8862e62c4cc1a0af91ff93b6e5)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
According to [1], EDK2 contains a vulnerability in BIOS where a user may
cause an Integer Overflow or Wraparound by network means. A successful
exploitation of this vulnerability may lead to denial of service.
Refer debian [2], backport a patch from edk2 [3] to fix CVE-2025-2295
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-2295
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100594
[3] 17cdc512f0
(From OE-Core rev: 0f59dec939cf0d313b1b01b1e7bf10e059d9d0ac)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
NVD responses changed to an invalid json between:
* April 5, 2025 at 3:03:44 AM GMT+2
* April 5, 2025 at 4:19:48 AM GMT+2
The last response is since then in format
{
"resultsPerPage": 625,
"startIndex": 288000,
"totalResults": 288625,
"format": "NVD_CVE",
"version": "2.0",
"timestamp": "2025-04-07T07:17:17.534",
"vulnerabilities": [
{...},
...
{...},
]
}
Json does not allow trailing , in responses, that is json5 format.
So cve-update-nvd2-native do_Fetch task fails with log backtrace ending:
...
File: '/builds/ccp/meta-siemens/projects/ccp/../../poky/meta/recipes-core/meta/cve-update-nvd2-native.bb', lineno: 234, function: update_db_file
0230: if raw_data is None:
0231: # We haven't managed to download data
0232: return False
0233:
*** 0234: data = json.loads(raw_data)
0235:
0236: index = data["startIndex"]
0237: total = data["totalResults"]
0238: per_page = data["resultsPerPage"]
...
File: '/usr/lib/python3.11/json/decoder.py', lineno: 355, function: raw_decode
0351: """
0352: try:
0353: obj, end = self.scan_once(s, idx)
0354: except StopIteration as err:
*** 0355: raise JSONDecodeError("Expecting value", s, err.value) from None
0356: return obj, end
Exception: json.decoder.JSONDecodeError: Expecting value: line 1 column 1442633 (char 1442632)
...
There was no announcement about json format of API v2.0 by nvd.
Also this happens only if whole database is queried (database update is
fine, even when multiple pages as queried).
And lastly it's only the cve list, all other lists inside are fine.
So this looks like a bug in NVD 2.0 introduced with some update.
Patch this with simple character deletion for now and let's monitor the
situation and possibly switch to json5 in the future.
Note that there is no native json5 support in python, we'd have to use
one of external libraries for it.
(From OE-Core rev: 6e526327f5c9e739ac7981e4a43a4ce53a908945)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It's not clear what the intent was: libtool executable is present
in the native sysroot and can be used to obtain versions
during build time.
(From OE-Core rev: 9d16c45ed4caea9b0e3fe6e5dad983707dd10c65)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This update has been tested with glibc/musl and gcc/clang in all four
combinations.
Drop patches:
0001-Use-CC-to-check-for-implicit-fallthrough-warning-sup.patch
0001-fix-gcc-8-format-truncation-warning.patch
0001-util.c-add-limits.h-include-for-NAME_MAX-definition.patch
mdadm-3.3.2_x32_abi_time_t.patch
(issue fixed upstream)
0001-include-libgen.h-for-basename-API.patch
0001-mdadm.h-Undefine-dprintf-before-redefining.patch
(issue no longer occurs)
0001-mdadm-add-option-y-for-use-syslog-to-recive-event-re.patch
(service file significantly rewritten, the need for the tweak
should be reassessed)
debian-no-Werror.patch
(replaced with setting CWFLAGS to an empty string in the recipe;
we already set correct flags via CC/CFLAGS, and upstream's only
get in the way)
(From OE-Core rev: 913312b5b544ce804656fe3a297e09bafb5838fc)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has released a new version (4.4) but not the tarball for it.
Adjust one of the devtool selftests, as it requires that the recipe
under test is using a tarball. Another selftest also needs to be
tweaked to correctly clean up its modifications to that same recipe on
test completion.
(From OE-Core rev: de635a9bc0392689ff36b50e7f91572d3fbaac09)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The recipe unconditionally disables seccomp, so the code isn't
even compiled. If this needs to come back in the future please
submit upstream first.
(From OE-Core rev: 9d058504213f79979a7f1f59527172b71df95a71)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
At some point the problematic define ceased to be used anywhere,
and so we can simply patch it out (and remove the associated
option setting from the recipe).
(From OE-Core rev: 4acbb1b92b9e51d6a741458d6cbd0c48ab55f6ca)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
was using a non-standard environment variable, and was replaced
with a patch that adds a command line option (and then this
was submitted upstream). ca-certificates recipe was tweaked accordingly,
and nothing else in core or meta-oe is using update-ca-certificates.
Drop default-sysroot.patch as the use case is unclear: sysroot
is explicitly specified in all known invocations of update-ca-certificate,
and if there's a place where it isn't, then update-ca-certificates
will error out trying to write to /etc, and should be fixed to
explicitly specify the sysroot.
(From OE-Core rev: 90d9f0ba674d4fe8e9291f0513c13dff3775c545)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original linking issues seem to be long gone.
(From OE-Core rev: 71b56605f95d87f48a25bc42aa7f830c2ef298fc)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original linking issues seem to be long gone.
(From OE-Core rev: 16868477597125296c8618177cd4f61baacd878b)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream submission should be done for tcl 9.x patches.
(From OE-Core rev: 2671c3183a74617e79f6879b228f2df8055397fb)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The now-removed patch was added for clang compatibility, but over time
started fixing problems that do not exist, and got its description
to mismatch the content.
The new patch is fixing the only problem with clang that still
occurs. I verified that all files that were patched before still
build without errors.
If you find other issues (this would be with non-default
options probably), please fix them similarly.
(From OE-Core rev: 6b8bd203180375a6b97345ddaa5fef7f68219ea6)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
python3-pdm and python3-pdm-backend are dependencies of python3-webcolors
python3-pdm itself depends on python3-pdm-build-locked
(From OE-Core rev: 6d064f60275b294dc6fc0e6480a0e5b0e7820934)
Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Apply fix in libc that are needed for rustix-0.38 to build.
(From OE-Core rev: c21fd6f1c0b6a9df9950c541025f24e342b7a118)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The issue is no longer present. Tested BlueZ 5.80 and 5.82
The issue has likely been gone for quite a while.
(From OE-Core rev: 87ab9c39c497c2a8b558e8d6ce673a931a5887b2)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rather than reporting each invalid PACKAGECONFIG with a separate error
message, report them all with one error message.
(From OE-Core rev: bf9366583f53fe2498d7aa9192ebfe6562887cf3)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This makes sure invalid PACKAGECONFIGs are reported also for recipes
that have no do_configure task, e.g., packagegroups.
(From OE-Core rev: d3325c384a7df54c564cae093659cf7b692629f2)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When using xinet.d to limit rsync connections, it can't handle changes
in system time. When time is set back, the connection limit is reached
very quickly and rsync gets deactivated, if time is changed again, rsync
is never reactivated.
The current timer of xinet.d is based on the time() and is affected by
the system time. Use clock_gettime() with CLOCK_MONOTONIC as the new
timer because CLOCK_MONOTONIC clock is not affected by discontinuous
jumps in the system time.
(From OE-Core rev: e4bfd2cc66c4b5614513ec50806492efc8df75be)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
Fix issue with handling BAP state transitions.
Fix issue with handling D-Bus interface removal.
Fix issue with handling MAP and supported features.
Fix issue with handling SDP record for Phonebook Access Client.
Fix issue with handling AVRCP PDU parameters length mismatch.
Fix issue with handling AVRCP PDU for SetAbsoluteVolume.
Fix issue with handling AVDTP bad media transport format.
Fix issue with handling support for LL Privacy setting.
Full Changelog: https://github.com/bluez/bluez/compare/5.80...5.82
(From OE-Core rev: f42ee87abcfca80a803bf44fb91b41f29a2c7d70)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop patch to exclusively disable it in code
It seems to be fixed upstream [1]
[1] https://github.com/rust-lang/cmake-rs/pull/158
(From OE-Core rev: 60b4b0808a3b961917ed8abe16b9f7df2a311952)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE_STATUS can be also "Unknown" since oe-core commit
d25f1817752bc8a84c40dcbef75f7559801ce15e
When this status type is used, build fails with e.g.
ERROR: openssl-3.4.1-r0 do_create_spdx: Unknown CVE-2025-0001 status 'Unknown'
Since this is now a valid status, it needs to be handled.
It cannot be mapped to any VEX status (see below), so just skip it.
Possible VEX statuses are: NOT AFFECTED, AFFECTED, FIXED, and UNDER INVESTIGATION.
(From OE-Core rev: 2d3081ef63c8a54df62a2a08bd36008c20eed65a)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
cc: Marta Rybczynska <rybczynska@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Just like the "init" version this script, pass $DROPBEAR_RSAKEY_ARGS to the
'dropbearkey' program when generating a host key.
This allows to speed up SSH connections on read-only root systems by adding
the line DROPBEAR_RSAKEY_ARGS="-s 1024" into /etc/default/dropbear.
See also: c0efbcb47ab3 ("dropbear/init: Allow extra arguments for key generation")
(From OE-Core rev: 3ae2c70fe83bc242b7a13655bc38431c81033c66)
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The runtime version of time is determined by:
build-aux/git-version-gen .tarball-version
But there's no .tarball-version in the tarball. So we add this file
manually with ${PV} as the content if it does not exist.
Note that there's a patch for upstream:
https://lists.gnu.org/archive/html/bug-time/2021-01/msg00000.html
So it's possible that when this time recipe is upgraded to a new
version, we won't need such adjust any more.
Before the fix, time --version:
time (GNU Time) UNKNOWN
After the fix, time --version:
time (GNU Time) 1.9
(From OE-Core rev: 201d1851666d558124226c871754a581cf427530)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We encountered a newgrp regression in shadow 4.17.3:
root@qemux86-64:~# groupadd g1
root@qemux86-64:~# useradd t1
root@qemux86-64:~# gpasswd g1
Changing the password for group g1
New Password:
Re-enter new password:
root@qemux86-64:~# sudo -u t1 newgrp g1
Password:
Invalid password.
root@qemux86-64:~#
In versions prior to shadow 4.17.3, shadow used an internal
implementation to support shadow group because it could not correctly
detect whether glibc supports shadow group in a cross-compilation
environment. In 4.17.3, it can correctly check whether glibc supports
shadow group even in a cross-compilation environment[1]. If supported,
shadow will use it instead of its own internal implementation.
Shadow group support in glibc requires adding a gshadow entry in
nsswitch.conf.
After the patch:
root@qemux86-64:~# groupadd g1
root@qemux86-64:~# useradd t1
root@qemux86-64:~# gpasswd g1
Changing the password for group g1
New Password:
Re-enter new password:
root@qemux86-64:~# sudo -u t1 newgrp g1
Password:
t1@qemux86-64:/home/root$
[1] da6b9cff02
(From OE-Core rev: 0cb122f17cf264ef904880351db1c0bb325fe5a6)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These variables control the flags for the assembler, compiler and
linker, but depend on the context.
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 8f070b788c9cd6cc16e03505d978177b4c82de03)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f8eb33569a5e8cadc036855e2d95eee77e627cb4)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These variables control the flags for the assembler, compiler and linker
when building for nativesdk recipes.
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 978300e5f14874f2586efa3474c6f3803e3d9031)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit c08f6d3c8aee86264c069b7c30850cb02de76076)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These toolchain variables are used in a native context. Some of the
BUILD_* variables missed documentation. Also, some of the base commands
were also not there so document them.
Some of existing BUILD_* variable documentation were missing the note
about their usage in a native context, so add it too so that all BUILD_*
variables are documented the same way.
[YOCTO #15719]
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: e42d49218945a030f300dbb608e7cfb0611f5733)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 87103afa1cb6690e9aaa87ca1f23e45eaaa359ac)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
