* [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
@ 2026-10-26 19:09 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Fiona Klute via buildroot @ 2026-10-26 19:09 UTC (permalink / raw)
To: buildroot; +Cc: Jarkko Sakkinen, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
https://github.com/advisories/GHSA-gqrg-h59c-j4wj
Upstream changelog:
https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
package/swtpm/swtpm.hash | 3 ++-
package/swtpm/swtpm.mk | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
index ebad1ef4bf..4f6cbfd61d 100644
--- a/package/swtpm/swtpm.hash
+++ b/package/swtpm/swtpm.hash
@@ -1,2 +1,3 @@
-sha256 f8da11cadfed27e26d26c5f58a7b8f2d14d684e691927348906b5891f525c684 swtpm-0.10.1.tar.gz
+# locally calculated
+sha256 f61cf6f1e9bbcb4cefb30b70cafaf1c4df54c6961e65cfa63830e8ad0e220134 swtpm-0.10.2.tar.gz
sha256 19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b LICENSE
diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
index de7f2fa05e..d6559c22d6 100644
--- a/package/swtpm/swtpm.mk
+++ b/package/swtpm/swtpm.mk
@@ -4,7 +4,7 @@
#
################################################################################
-SWTPM_VERSION = 0.10.1
+SWTPM_VERSION = 0.10.2
SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
SWTPM_LICENSE = BSD-4-Clause
SWTPM_LICENSE_FILES = LICENSE
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] package/swtpm: fix license information
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
@ 2026-10-26 19:09 ` Fiona Klute via buildroot
2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 1 reply; 5+ messages in thread
From: Fiona Klute via buildroot @ 2026-10-26 19:09 UTC (permalink / raw)
To: buildroot; +Cc: Jarkko Sakkinen, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
The SPDX identifier matching the LICENSE file is BSD-3-Clause [1], not
BSD-4-Clause. The LICENSE file was last modified with upstream commit
5f1ef9565df074b918a39cb4885af4190c98edb7 in 2015, before release
0.1.0, so the fix applies to all Buildroot stable branches.
[1] https://spdx.org/licenses/BSD-3-Clause.html
[2] https://github.com/stefanberger/swtpm/commit/5f1ef9565df074b918a39cb4885af4190c98edb7
Fixes: 87b9b126d23be1e95b3d2b82438f65e28f554a87 "package/swtpm: add host package"
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
package/swtpm/swtpm.mk | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
index d6559c22d6..3357be9c39 100644
--- a/package/swtpm/swtpm.mk
+++ b/package/swtpm/swtpm.mk
@@ -6,7 +6,7 @@
SWTPM_VERSION = 0.10.2
SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
-SWTPM_LICENSE = BSD-4-Clause
+SWTPM_LICENSE = BSD-3-Clause
SWTPM_LICENSE_FILES = LICENSE
HOST_SWTPM_DEPENDENCIES = \
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
@ 2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 0 replies; 5+ messages in thread
From: Jarkko Sakkinen via buildroot @ 2026-10-26 19:42 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot
On Mon, Oct 26, 2026 at 08:09:55PM +0100, Fiona Klute wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
> https://github.com/advisories/GHSA-gqrg-h59c-j4wj
>
> Upstream changelog:
> https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
> ---
> package/swtpm/swtpm.hash | 3 ++-
> package/swtpm/swtpm.mk | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
> index ebad1ef4bf..4f6cbfd61d 100644
> --- a/package/swtpm/swtpm.hash
> +++ b/package/swtpm/swtpm.hash
> @@ -1,2 +1,3 @@
> -sha256 f8da11cadfed27e26d26c5f58a7b8f2d14d684e691927348906b5891f525c684 swtpm-0.10.1.tar.gz
> +# locally calculated
> +sha256 f61cf6f1e9bbcb4cefb30b70cafaf1c4df54c6961e65cfa63830e8ad0e220134 swtpm-0.10.2.tar.gz
> sha256 19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b LICENSE
> diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
> index de7f2fa05e..d6559c22d6 100644
> --- a/package/swtpm/swtpm.mk
> +++ b/package/swtpm/swtpm.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -SWTPM_VERSION = 0.10.1
> +SWTPM_VERSION = 0.10.2
> SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
> SWTPM_LICENSE = BSD-4-Clause
> SWTPM_LICENSE_FILES = LICENSE
> --
> 2.55.0
>
LGTM
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Br, Jarkko
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/swtpm: fix license information
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
@ 2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
0 siblings, 0 replies; 5+ messages in thread
From: Jarkko Sakkinen via buildroot @ 2026-10-26 19:42 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot
On Mon, Oct 26, 2026 at 08:09:56PM +0100, Fiona Klute wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> The SPDX identifier matching the LICENSE file is BSD-3-Clause [1], not
> BSD-4-Clause. The LICENSE file was last modified with upstream commit
> 5f1ef9565df074b918a39cb4885af4190c98edb7 in 2015, before release
> 0.1.0, so the fix applies to all Buildroot stable branches.
>
> [1] https://spdx.org/licenses/BSD-3-Clause.html
> [2] https://github.com/stefanberger/swtpm/commit/5f1ef9565df074b918a39cb4885af4190c98edb7
>
> Fixes: 87b9b126d23be1e95b3d2b82438f65e28f554a87 "package/swtpm: add host package"
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
> ---
> package/swtpm/swtpm.mk | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
> index d6559c22d6..3357be9c39 100644
> --- a/package/swtpm/swtpm.mk
> +++ b/package/swtpm/swtpm.mk
> @@ -6,7 +6,7 @@
>
> SWTPM_VERSION = 0.10.2
> SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
> -SWTPM_LICENSE = BSD-4-Clause
> +SWTPM_LICENSE = BSD-3-Clause
> SWTPM_LICENSE_FILES = LICENSE
>
> HOST_SWTPM_DEPENDENCIES = \
> --
> 2.55.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Br, Jarkko
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
@ 2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 0 replies; 5+ messages in thread
From: Julien Olivain via buildroot @ 2026-10-26 20:41 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot, Jarkko Sakkinen
On 26/10/2026 20:09, Fiona Klute via buildroot wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
> https://github.com/advisories/GHSA-gqrg-h59c-j4wj
>
> Upstream changelog:
> https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-26 20:41 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.