Enhance security by limiting read access for /etc/sshd_config to user root as it
may reveal unsecure configurations.
Reading access is limited in the install append as the default value 0644 is
hardcoded in the openssh makefile and is not configurable. Therefore the
permissions are modified in the install append.
(From OE-Core rev: 99c09d29d56cb98f749c2283b5b800de9af98745)
Signed-off-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Debug builds fail with a panic in build.rs when attempting
to create rpm-sequoia.pc in a non-existent target/debug directory:
process didn't exit successfully: `TOPDIR/tmp/work/core2-32-wrs-linux/rpm-sequoia/1.7.0/build/target/debug/build/rpm-sequoia-d2609670a855c0b5/build-script-build` (exit status: 101)
— stderr
thread 'main' panicked at build.rs:125:36:
Creating "TOPDIR/tmp/work/core2-32-wrs-linux/rpm-sequoia/1.7.0/sources-unpack/git/target/debug/rpm-sequoia.pc" (CARGO_TARGET_DIR: None): Os
{ code: 2, kind: NotFound, message: "No such file or directory" }
This was caused by the build and install logic assuming a fixed release directory
in rpm-sequoia recipe.
Update build and install steps to use the ${BUILD_DIR} variable,
which is set based on the value of DEBUG_BUILD from cargo.bbclass.
(rpm-sequoia inherits cargo)
This ensures paths used for rpm-sequoia.pc generation and installation
are valid in both debug and release configurations.
(From OE-Core rev: 2d21762d6f163c7fb8796d1035b0e25e21a3350b)
Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Allow the risc-v TUNE_FEATURES to select specific ISA (kconfig) selections
via config fragments.
This allows the following items to be selected dynamically:
CONFIG_RISCV_ISA_C
CONFIG_RISCV_ISA_F
CONFIG_RISCV_ISA_D
CONFIG_RISCV_ISA_ZBB
CONFIG_RISCV_ISA_A
CONFIG_RISCV_ISA_ZICBOM
(From OE-Core rev: de890297b392fcf7f5bd2d25d3c173373b93dd36)
Signed-off-by: Mark Hatle <mark.hatle@amd.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If a multiconfig recipe is passed to devtool, find the correct workspace
name by removing the multiconfig prefix
(From OE-Core rev: 42c0c25428be329101a920d31c5fa8cf1e04ee38)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
externalsrc_configure_prefunc assumed that the .git directory is
${S}/.git. This isn't true for submodules at least.
srctree_hash_files already contained code to ask Git for the correct
path to the .git directory. Let's move that code to a new find_git_dir
function and call it from both places and make the behaviour consistent.
(From OE-Core rev: 47891e200e92ba34a6ff2df2fba1032738f52f98)
Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
=============
- Fix a bug that local file package metadata was missing when reading the lockfile.
- Extract dependency-groups and extras markers from marker value when parsing pylock.toml.
(From OE-Core rev: 81bdaa7dca8715d94f230b3698f519743765210e)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
============
- Fix codecs deprecation in Python 3.14.
- Fix issue with unclosed comment parsing in Python 3.14.
- Fix issue with unclosed declarations in Python 3.14.
- Fix issue with unclosed HTML tag < foo and Python 3.14.
- Ensure incomplete markup declaration in raw HTML doesn't crash parser (#1534).
- Fixed dropped content in md_in_html (#1526).
- Fixed HTML handling corner case that prevented some content from not being rendered
(From OE-Core rev: 665b9720b0f5630090f0345abf6b49a3eda77608)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If build target has set TEST_SUITES, then that should
be the default test modules to execute. Fixes testexport.bbclass
to run same tests as testimage.bbclass which already
uses TEST_SUITES.
(From OE-Core rev: c66b1dc0a2f973a84dc38b7cc27ae823e0f0a916)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some license were part of the linux-firmware but were not added to the
recipe, so adding those missing license
(From OE-Core rev: 45361e2e6cafbaf60d1e3b815b96e4874214d49c)
Signed-off-by: Vivek Puar <vpuar@qti.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While search queries already handled words with hyphens correctly, they
did not do so for words with dots.
To fix this, we
- enhance the word tokenizer to treat both dots ('.') and hyphens ('-')
as valid characters within words.
(For robustness, explicitly exclude dots/hyphens at the start or end
of a word from indexing.)
- adjust query processing to avoid splitting on dots in search input
This allows search queries to correctly match terms such as
'local.conf', 'site.conf', and similar ones now.
Fixes: [YOCTO #14534]
(From yocto-docs rev: 80084a4cabdf7f61c7e93eda8ddbd5bc7d54e041)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Replace 'git branch -al' with 'git branch -a' to correctly show both
local and remote branches. The '-l' option is unnecessary and may cause
confusion.
(From yocto-docs rev: 46aa3bb398c50af0f29acd2c1a05ee232d0de5b9)
Signed-off-by: Bo Sun <bo@mboxify.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update the meta-intel BSP layer reference to point to README.md
instead of README, reflecting the actual file name in the repository.
(From yocto-docs rev: 32eb132ad69a0722e0075404f809bfe9df06adee)
Signed-off-by: Bo Sun <bo@mboxify.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add documentation for the new recipe-naming recipe QA test.
(From yocto-docs rev: 8f9ad9681c18412e9eedc014e686b1b72e458687)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
use TOOLCHAIN_NATIVE variable for selecting native compiler
Default it to PREFERRED_TOOLCHAIN_NATIVE, a recipe which wants
to enforce a toolchain can do so with
for cross toolchains ( e.g. target, nativesdk )
TOOLCHAIN = "gcc"
For native
TOOLCHAIN_NATIVE = "gcc"
This helps build native recipe with clang as native compiler.
(From OE-Core rev: 546baa210acacff5dde6ce55e9842b90277bc9a8)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
compiler-rt configure calls for c++ compiler which can cause C++ runtime to
not be detected on some Yocto autobuilder workers running ubuntu 24.04
therefore let it use gcc for native version
Set TOOLCHAIN_NATIVE for using clang for libcxx
(From OE-Core rev: d54512c1c0a98516077b77d5414af47d8c2b8c39)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If recipe inherits bbclass kernelsrc to use kernel sources,
the recipe should explicitly set ${KERNEL_VERSION} to ${PKGV}
in task do_package, otherwise package version (${PV} is usually
default 1.0) is not consistent with kernel source.
For example, there are 5 recipes in meta-openembedded to inherit
kernelsrc, but 4 recipes explicitly set PKGV.
meta-openembedded$ grep -e "setVar(.*PKGV.*KERNEL_VERSION" -e kernelsrc -rn *
meta-oe/recipes-kernel/intel-speed-select/intel-speed-select.bb:9:inherit kernelsrc
meta-oe/recipes-kernel/bpftool/bpftool.bb:8:inherit bash-completion kernelsrc kernel-arch
meta-oe/recipes-kernel/bpftool/bpftool.bb:44: d.setVar('PKGV', d.getVar("KERNEL_VERSION").split("-")[0])
meta-oe/recipes-kernel/cpupower/cpupower.bb:8:inherit kernelsrc kernel-arch bash-completion
meta-oe/recipes-kernel/cpupower/cpupower.bb:32: d.setVar('PKGV', d.getVar("KERNEL_VERSION").split("-")[0])
meta-oe/recipes-kernel/turbostat/turbostat.bb:98: d.setVar('PKGV', d.getVar("KERNEL_VERSION").split("-")[0])
meta-oe/recipes-kernel/usbip-tools/usbip-tools.bb:25:inherit kernelsrc autotools-brokensep
meta-oe/recipes-kernel/usbip-tools/usbip-tools.bb:68: d.setVar('PKGV', d.getVar("KERNEL_VERSION").split("-")[0])
meta-oe/recipes-kernel/spidev-test/spidev-test.bb:7:inherit bash-completion kernelsrc kernel-arch
meta-oe/recipes-kernel/spidev-test/spidev-test.bb:26: d.setVar('PKGV', d.getVar("KERNEL_VERSION").split("-")[0])
This commit clean up the setting of PKGV, move it to kernelsrc.bbclass
for common use, the recipe (such as intel-speed-select) that inherited
kernelsrc will not be required to explicitly set ${PKGV} with
${KERNEL_VERSION}
(From OE-Core rev: 77a93e8cf1da4231341c56f64f9d4d474f9f2bb7)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The package version of kernel-devsrc is 1.0 which is not consistent
with kernel source
$ bitbake kernel-devsrc
$ ls tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-*
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-1.0-r0.qemux86_64.rpm
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-dbg-1.0-r0.qemux86_64.rpm
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-dev-1.0-r0.qemux86_64.rpm
After commit [kernelsrc.bbclass/perf: make package version consistent
with kernel source] applied, it moved the setting of PKGV to
kernelsrc.bbclass for common use. And bbclass kernelsrc has already
inherited linux-kernel-base, this commit uses bbclass kernelsrc to
instead of linux-kernel-base, and remove duplicated settings.
After applying this commit:
$ ls tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-*
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-6.12.31-r0.qemux86_64.rpm
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-dbg-6.12.31-r0.qemux86_64.rpm
tmp/work/qemux86_64-poky-linux/kernel-devsrc/1.0/deploy-rpms/qemux86_64/kernel-devsrc-dev-6.12.31-r0.qemux86_64.rpm
(From OE-Core rev: ceff363630ac0397c40be4a5ce54a6c20f901c40)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When building for qemuarm-secureboot in meta-arn with musl and clang,
the following compile error is seen:
- | ../sources/libucontext-1.3.2/arch/arm/swapcontext.S:23:11: error: unknown token in expression
- | ldr r4, =#0x56465001
- | ^
This is happening because 1.3 added ifdefs for assembly code for both
hard and soft float, and bcause neither is being defined, it is taking
this path with the issue.
Since we can tell if soft or hard float is being used via the TARGET_FPU
variable, use that and set the relevant makefile flag.
(From OE-Core rev: 61c54f169db74b818f587b3147c9abb611f64e0d)
Signed-off-by: Jon Mason <jon.mason@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This release has:
- New parameter in top-level Makefile for reproducible builds
- Added MIPS P8700 platform support
- Allow arbitrary path in LLVM parameter of top-level Makefile
- Improved SBI v3.0 extensions to match frozen specification
- Emulate AMO instructions when Zaamo is not available
- Stop the harts waiting for HSM start from supervisor software
- Improved generic platform overrides to use common fdt_driver helpers
- Improved SBI MPXY framework to use per-domain data
- Added support for control transfer records (CTR) ISA extension
- Use LR and SC when Zaamo ISA extension is not available
- Added PXA UART support
- Added support for double-trap ISA extensions
- Optimized hartid and scratch lookup
- Added unit tests for bitwise operations
- Added unit tests for SBI ecall functionality
- Constify various FDT driver definitions
- Added MPXY RPMI mailbox driver for System MSI service group
- Improved RPMI drivers to match frozen specifications
- Initialize miscellaneous early drivers in one pass
- Use fdt_driver helpers for irqchip driver framework
- Allow adding SSE events dynamically at boot-time
- Simple singly linked list implementation
Overall, this release adds more ISA extensions and does many device driver
improvements.
(From OE-Core rev: 4278b9dde47957393fee46dfcc6620c3838cc73d)
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The directory index is missing the latest release:
https://www.libarchive.org/downloads/
Ticket (which I do not believe will be quickly fixed, considering
other similar open tickets):
https://github.com/libarchive/libarchive/issues/2693
(From OE-Core rev: e3b3c85f026ffba772c1cc6918113274e13002e5)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of hard coding the VEX justifications for "Ignored" CVE status,
add a map that configures what justification should be used for each
status.
This allows other justifications to be easily added, and also ensures
that status fields added externally (by downstream) can set an
appropriate justification if necessary.
(From OE-Core rev: c0fa3d92cefa74fa57c6c48c94acc64aa454e781)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
==========
- kde: Support Proxy Config Script value without scheme
- Create codeql.yml
- Add MATE and Cinnamon check to gnome plugin
- Support -M option for Solaris/illumos ld
- Fix symbol versioning with LLD
- Create SECURITY.md
(From OE-Core rev: 0a5d1049f9cce5bb1d0217fb1c6eea7fbf469aee)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes:
-----------
module_index test now passes if RPM library is built without bzip2 or xz
compression support and libmodulemd is configured to support decompression
using the RPM library.
(From OE-Core rev: e5b3a65b88bd0546d6082d59d1c41505c4efc32d)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adapt the sed command that edits TCL_SRC_DIR in tclConfig.sh
This is needed so that tk in meta-oe is capable of reading
the required header file
Remove buildpath from TCL_BUILD_STUB_LIB_PATH in tclConfig.sh
(From OE-Core rev: f04b0b2b42f4b4e689b9cf1b6e394159f0710122)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some recipes demand full clang/llvm builds e.g. chromium we need to use
clang as native toolchain. This class collects all needed bits to enable
OE built clang to provide the clang native toolchain
Setting
TOOLCHAIN_NATIVE = "clang"
in recipe will chose clang for native toolchain
(From OE-Core rev: 43ba5ed17e069b13cd43c36650524a0113c81955)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Reproduce steps(Under the same project dir):
1. enable DISTRO_FEATURES usrmerge, bitbake mingetty
2. disable DISTRO_FEATURES usrmerge, bitbake mingetty
Result in step 2:
WARNING: mingetty-1.08-r3 do_package: mingetty: NOT adding alternative provide /usr/sbin/getty: /usr/sbin/mingetty does not exist
WARNING: mingetty-1.08-r3 do_package: QA Issue: mingetty: Files/directories were installed but not shipped in any package:
/sbin
/usr/sbin
In step1, Line SBINDIR=/sbin is replaced to SBINDIR=/usr/sbin, in step2,
since do_fetch does not rerun, Makefile still has SBINDIR=/usr/sbin, so
sed not works as expected, SBINDIR still equal to /usr/sbin when disable
usrmerge. And cause above two warnings.
(From OE-Core rev: 12539d529c6af3d4a56ff4f1e1420e7e4d169804)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Set default self.runner to None. qemu target sets
the runner to qemu. Then handle self.runner None in
run_network_serialdebug(). This way ssh runner
and failing ping or ssh tests handle the error cases.
(From OE-Core rev: 39f72147ef402bea54a66abf984315c1f93aa141)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
