Re: [OE-core][wrynose 00/35] Patch review

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Nov 11, 2026 at 10:02 AM CET, Yoann Congal wrote:
> Please review this set of changes for wrynose and have comments back by
> end of day Thursday, November 12.
>
> Passed a-full on autobuilder:
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/5102
> * qemuarm64-musl-ptest failed with 15814 – qemuarm64 musl ptest failures
>   retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1543
>
> The following changes since commit 2285da08068a6d1b4a64c9a52d85a58be50e4679:
>
>   openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-06 17:15:59 +0100)
>
> are available in the Git repository at:
>
>   https://git.openembedded.org/openembedded-core-contrib stable/wrynose-review
>   https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
>
> for you to fetch changes up to 33a6bd6cc8a9a976902081642414bd67adc74879:
>
>   populate_sdk_ext: Fix locale error handling in SDK (2026-11-11 00:22:27 +0100)

I forgot to highlight 2 patches:
* "dropbear: add follow-up patches for CVE-2019-6111"
  I think this is a worthy fix but it has user-visible consequences:
  `scp -r host:dir <existing dir>` now exits 1 instead of overwriting
  files (which is the vulnerability being fixed).
* "python3-urllib3: Fix CVE-2026-97687"
  May throw a new warning in a unsecure configuration (related to TLS
  and proxies) that will be dropped in futur version. User code fix might
  be needed to avoid the warning (but the code will still work).

> ----------------------------------------------------------------
>
> Adrian Freihofer (1):
>   kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps
>
> Benjamin Robin (4):
>   spdx_common: simplify get_patched_src() implementation
>   spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
>   spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
>   package: no longer modify paths in save_debugsources_info()
>
> Bruce Ashfield (3):
>   linux-yocto/6.18: aufs: refresh to upstream aufs6.18
>   linux-yocto/6.18: update to v6.18.57
>   linux-yocto/6.18: update to v6.18.59
>
> Deepak Rathore (1):
>   gnupg: Fix CVE-2026-105712
>
> Jaipaul Cheernam (1):
>   bind: upgrade 9.20.29 -> 9.20.30
>
> Jeroen Hofstee (1):
>   python3-pip: patch the vendored python3-certifi
>
> Jinwang Li (5):
>   bluez5: Fix error handling for AVDTP_OPEN cmd
>   bluez5: Fix GET_CONFIGURATION cmd
>   bluez5: Return correct error when SEP is inuse
>   bluez5: Fix ABORT response being discarded
>   bluez5: Fix u128_to_string skipping data[4]
>
> Peter Marko (7):
>   boost: patch CVE-2023-34399
>   go: upgrade 1.26.9 -> 1.26.10
>   glib-2.0: patch CVE-2026-16118
>   python3: upgrade 3.14.9 -> 3.14.10
>   systemd: add iproute2-devlink runtime dependency to udev
>   dropbear: add follow-up patches for CVE-2019-6111
>   dropbear: patch CVE-2026-35385
>
> Richard Purdie (2):
>   recipe_sanity: Drop rename overwrite detection
>   populate_sdk_ext: Fix locale error handling in SDK
>
> Ross Burton (4):
>   python3: upgrade 3.14.7 -> 3.14.9
>   python3: skip test.test_readline.TestHistoryManipulation on musl
>   piglit: fix build with Python 3.14.9
>   groff: build less in groff-native
>
> Shantanu Majumdar (1):
>   gstreamer1.0-plugins-bad: use gtk+3 dependency name
>
> Theo Gaige (Schneider Electric) (1):
>   python3-pyelftools: add missing runtime dependencies
>
> Yoann Congal (1):
>   scripts/install-buildtools: Update to 6.0.4
>
> Yogita Urade (3):
>   python3-urllib3: Fix CVE-2026-44432
>   python3-urllib3: Fix CVE-2026-97687
>   python3-urllib3: Fix CVE-2026-97688
>
>  meta/classes-recipe/kernel-fit-image.bbclass  |  14 +-
>  meta/classes-recipe/populate_sdk_ext.bbclass  |   2 +-
>  meta/classes/recipe_sanity.bbclass            |  21 -
>  meta/lib/oe/package.py                        |  54 +--
>  meta/lib/oe/spdx30_tasks.py                   |   1 -
>  meta/lib/oe/spdx_common.py                    | 125 +++--
>  ...1-avoid-start-failure-with-bind-user.patch |   2 +-
>  ...kport-ax_prog_cc_for_build.m4-macros.patch |   2 +-
>  ...d-V-and-start-log-hide-build-options.patch |   4 +-
>  ...ching-for-json-headers-searches-sysr.patch |   4 +-
>  .../recipes-connectivity/bind/bind/conf.patch |   2 +-
>  ...t.d-add-support-for-read-only-rootfs.patch |   2 +-
>  .../bind/make-etc-initd-bind-stop-work.patch  |   2 +-
>  .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} |   2 +-
>  meta/recipes-connectivity/bluez5/bluez5.inc   |   5 +
>  ...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch |  36 ++
>  ...ix-error-handling-for-AVDTP_OPEN-cmd.patch |  48 ++
>  ...turn-correct-error-when-SEP-is-inuse.patch |  32 ++
>  ...x-Fix-ABORT-response-being-discarded.patch |  44 ++
>  ...p-Fix-u128_to_string-skipping-data-4.patch |  33 ++
>  .../dropbear/dropbear/CVE-2019-6111-01.patch  | 364 ++++++++++++++
>  .../dropbear/dropbear/CVE-2019-6111-02.patch  |  43 ++
>  .../dropbear/dropbear/CVE-2019-6111-03.patch  |  34 ++
>  .../dropbear/dropbear/CVE-2019-6111-04.patch  |  43 ++
>  .../dropbear/dropbear/CVE-2026-35385.patch    |  42 ++
>  .../recipes-core/dropbear/dropbear_2025.89.bb |   5 +
>  .../glib-2.0/files/CVE-2026-16118.patch       |  48 ++
>  meta/recipes-core/glib-2.0/glib.inc           |   1 +
>  meta/recipes-core/systemd/systemd_259.5.bb    |   1 +
>  .../go/{go-1.26.9.inc => go-1.26.10.inc}      |   2 +-
>  ..._1.26.9.bb => go-binary-native_1.26.10.bb} |   6 +-
>  ...1.26.9.bb => go-cross-canadian_1.26.10.bb} |   0
>  ...go-cross_1.26.9.bb => go-cross_1.26.10.bb} |   0
>  ...sssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} |   0
>  ...untime_1.26.9.bb => go-runtime_1.26.10.bb} |   0
>  .../go/{go_1.26.9.bb => go_1.26.10.bb}        |   0
>  .../python3-pip/0001-Remove-emsign-437.patch  | 142 ++++++
>  ...tore-unaffected-emSign-roots-439-440.patch | 108 +++++
>  .../python/python3-pip_26.0.1.bb              |   2 +
>  .../python/python3-pyelftools_0.32.bb         |   8 +-
>  .../python3-urllib3/CVE-2026-44432.patch      | 157 ++++++
>  .../python3-urllib3/CVE-2026-97687_p1.patch   | 277 +++++++++++
>  .../python3-urllib3/CVE-2026-97687_p2.patch   | 450 ++++++++++++++++++
>  .../CVE-2026-97688-regression.patch           |  29 ++
>  .../python3-urllib3/CVE-2026-97688.patch      | 107 +++++
>  .../python/python3-urllib3_2.6.3.bb           |   5 +
>  ...shebang-overflow-on-python-config.py.patch |   2 +-
>  ...-use-prefix-value-from-build-configu.patch |   2 +-
>  ...-qemu-wrapper-when-gathering-profile.patch |   2 +-
>  ...est_sysconfig-for-posix_user-purelib.patch |   2 +-
>  .../python/python3/makerace.patch             |   2 +-
>  .../{python3_3.14.7.bb => python3_3.14.10.bb} |   7 +-
>  .../groff/files/build-less.patch              |  24 +
>  meta/recipes-extended/groff/groff_1.24.1.bb   |   8 +-
>  ...-reproducible_mtime-should-be-an-int.patch |  33 ++
>  meta/recipes-graphics/piglit/piglit_git.bb    |   1 +
>  .../linux/linux-yocto-rt_6.18.bb              |   6 +-
>  .../linux/linux-yocto-tiny_6.18.bb            |   6 +-
>  meta/recipes-kernel/linux/linux-yocto_6.18.bb |  24 +-
>  .../gstreamer1.0-plugins-bad_1.28.5.bb        |   2 +-
>  .../boost/boost/CVE-2023-34399.patch          |  35 ++
>  meta/recipes-support/boost/boost_1.90.0.bb    |   1 +
>  .../gnupg/CVE-2026-105712-regression.patch    |  39 ++
>  .../gnupg/gnupg/CVE-2026-105712.patch         | 194 ++++++++
>  meta/recipes-support/gnupg/gnupg_2.5.17.bb    |   2 +
>  scripts/install-buildtools                    |   4 +-
>  66 files changed, 2554 insertions(+), 151 deletions(-)
>  rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%)
>  create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
>  create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
>  create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
>  create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
>  create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
>  create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
>  create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
>  create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
>  create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
>  create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
>  create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
>  rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%)
>  rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%)
>  rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%)
>  rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%)
>  rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%)
>  rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%)
>  rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%)
>  create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
>  create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
>  create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
>  create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
>  create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
>  create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
>  create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
>  rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.10.bb} (98%)
>  create mode 100644 meta/recipes-extended/groff/files/build-less.patch
>  create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
>  create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch
>  create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
>  create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch


-- 
Yoann Congal
Smile ECS