Re: [OE-core] [PATCH 4/4] libxml2: upgrade 2.14.3 -> 2.14.5

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Tue Jul 22, 2025 at 3:18 PM CEST, Richard Purdie via lists.openembedded.org wrote:
> On Mon, 2025-07-21 at 16:21 +0800, hongxu via lists.openembedded.org wrote:
>> diff --git a/meta/recipes-core/libxml/libxml2_2.14.3.bb b/meta/recipes-core/libxml/libxml2_2.14.5.bb
>> similarity index 97%
>> rename from meta/recipes-core/libxml/libxml2_2.14.3.bb
>> rename to meta/recipes-core/libxml/libxml2_2.14.5.bb
>> index 4baab59186e..52b2040122b 100644
>> --- a/meta/recipes-core/libxml/libxml2_2.14.3.bb
>> +++ b/meta/recipes-core/libxml/libxml2_2.14.5.bb
>> @@ -21,7 +21,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
>>             file://CVE-2025-6021.patch \
>>             "
>>  
>> -SRC_URI[archive.sha256sum] = "6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833"
>> +SRC_URI[archive.sha256sum] = "24175ec30a97cfa86bdf9befb7ccf4613f8f4b2713c5103e0dd0bc9c711a2773"
>>  SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
>>  
>>  # Disputed as a security issue, but fixed in d39f780
>> 
>
> $ wget https://download.gnome.org/sources//libxml2/2.14/libxml2-2.14.5.tar.xz
> $ sha256sum libxml2-2.14.5.tar.xz 
> 03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b  libxml2-2.14.5.tar.xz
>
> which would match the failure on:
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2060
>
> Any idea what happened here?
>
> Cheers,
>
> Richard

It looks like the file changed on the remote, my build this morning did
succeed but not the next ones.

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com