[honister][PATCH 1/2] util-linux: update 2.37.2 -> 2.37.3

[honister][PATCH 1/2] util-linux: update 2.37.2 -> 2.37.3

[Quentin Schulz]

From: Alexander Kanavin <alex.kanavin@gmail.com>

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e543d4407fdc91559a77d6c5cd41bcb75bc8c73c)
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
---
 ...til-linux-libuuid_2.37.2.bb => util-linux-libuuid_2.37.3.bb} | 0
 meta/recipes-core/util-linux/util-linux.inc                     | 2 +-
 .../util-linux/{util-linux_2.37.2.bb => util-linux_2.37.3.bb}   | 0
 3 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/util-linux/{util-linux-libuuid_2.37.2.bb => util-linux-libuuid_2.37.3.bb} (100%)
 rename meta/recipes-core/util-linux/{util-linux_2.37.2.bb => util-linux_2.37.3.bb} (100%)

diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.37.2.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.37.3.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux-libuuid_2.37.2.bb
rename to meta/recipes-core/util-linux/util-linux-libuuid_2.37.3.bb
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 1e3cd28801..0309332722 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -37,4 +37,4 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
            file://avoid_parallel_tests.patch \
            "
 
-SRC_URI[sha256sum] = "6a0764c1aae7fb607ef8a6dd2c0f6c47d5e5fd27aa08820abaad9ec14e28e9d9"
+SRC_URI[sha256sum] = "590c592e58cd6bf38519cb467af05ce6a1ab18040e3e3418f24bcfb2f55f9776"
diff --git a/meta/recipes-core/util-linux/util-linux_2.37.2.bb b/meta/recipes-core/util-linux/util-linux_2.37.3.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux_2.37.2.bb
rename to meta/recipes-core/util-linux/util-linux_2.37.3.bb
-- 
2.35.1

[honister][PATCH 2/2] util-linux: upgrade 2.37.3 -> 2.37.4

[Quentin Schulz]

From: Alexander Kanavin <alex.kanavin@gmail.com>

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6a3289c4786c4d278e2bf0ec1a5e04363772d8bc)
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
---
 ...til-linux-libuuid_2.37.3.bb => util-linux-libuuid_2.37.4.bb} | 0
 meta/recipes-core/util-linux/util-linux.inc                     | 2 +-
 .../util-linux/{util-linux_2.37.3.bb => util-linux_2.37.4.bb}   | 0
 3 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/util-linux/{util-linux-libuuid_2.37.3.bb => util-linux-libuuid_2.37.4.bb} (100%)
 rename meta/recipes-core/util-linux/{util-linux_2.37.3.bb => util-linux_2.37.4.bb} (100%)

diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.37.3.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.37.4.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux-libuuid_2.37.3.bb
rename to meta/recipes-core/util-linux/util-linux-libuuid_2.37.4.bb
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 0309332722..c48f9572f5 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -37,4 +37,4 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
            file://avoid_parallel_tests.patch \
            "
 
-SRC_URI[sha256sum] = "590c592e58cd6bf38519cb467af05ce6a1ab18040e3e3418f24bcfb2f55f9776"
+SRC_URI[sha256sum] = "634e6916ad913366c3536b6468e7844769549b99a7b2bf80314de78ab5655b83"
diff --git a/meta/recipes-core/util-linux/util-linux_2.37.3.bb b/meta/recipes-core/util-linux/util-linux_2.37.4.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux_2.37.3.bb
rename to meta/recipes-core/util-linux/util-linux_2.37.4.bb
-- 
2.35.1

Re: [OE-core] [honister][PATCH 2/2] util-linux: upgrade 2.37.3 -> 2.37.4

[Quentin Schulz]

Hi all,

On 3/7/22 12:21, Quentin Schulz wrote:
> From: Alexander Kanavin <alex.kanavin@gmail.com>
> 
> Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> (cherry picked from commit 6a3289c4786c4d278e2bf0ec1a5e04363772d8bc)
> Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
> ---

https://www.spinics.net/lists/util-linux-ng/msg17037.html 2.37.3 fixes 
two CVEs (not listed on nvdist database for some reason).

https://www.spinics.net/lists/util-linux-ng/msg17087.html 2.37.4 fixes 
one CVE (not listed on bvdist for some reason).

I think it might be useful for release maintainer(s) if we mention in 
the commit log or commit title if it's a security bump or not when 
sending patches for version bumps to master? What do you think? (FYI, 
Buildroot seems to do it regularly and it helps me with keeping my 
vendor tree somewhat up-to-date security wise).

Cheers,
Quentin

Re: [OE-core] [honister][PATCH 2/2] util-linux: upgrade 2.37.3 -> 2.37.4

[Richard Purdie]

On Mon, 2022-03-07 at 12:26 +0100, Quentin Schulz wrote:
> Hi all,
> 
> On 3/7/22 12:21, Quentin Schulz wrote:
> > From: Alexander Kanavin <alex.kanavin@gmail.com>
> > 
> > Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > (cherry picked from commit 6a3289c4786c4d278e2bf0ec1a5e04363772d8bc)
> > Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
> > ---
> 
> https://www.spinics.net/lists/util-linux-ng/msg17037.html 2.37.3 fixes 
> two CVEs (not listed on nvdist database for some reason).
> 
> https://www.spinics.net/lists/util-linux-ng/msg17087.html 2.37.4 fixes 
> one CVE (not listed on bvdist for some reason).
> 
> I think it might be useful for release maintainer(s) if we mention in 
> the commit log or commit title if it's a security bump or not when 
> sending patches for version bumps to master? What do you think? (FYI, 
> Buildroot seems to do it regularly and it helps me with keeping my 
> vendor tree somewhat up-to-date security wise).

I'm happy if people do mention it (I did for expat recently) but I'm not going
to block upgrades on the information being missing (how would I tell?).

We're struggling to get people to submit upgrades so I'm reluctant to make it
harder for them.

Cheers,

Richard

Re: [OE-core] [honister][PATCH 2/2] util-linux: upgrade 2.37.3 -> 2.37.4

[Quentin Schulz]

Hi Richard,

On 3/7/22 12:44, Richard Purdie wrote:
> On Mon, 2022-03-07 at 12:26 +0100, Quentin Schulz wrote:
>> Hi all,
>>
>> On 3/7/22 12:21, Quentin Schulz wrote:
>>> From: Alexander Kanavin <alex.kanavin@gmail.com>
>>>
>>> Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
>>> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>>> (cherry picked from commit 6a3289c4786c4d278e2bf0ec1a5e04363772d8bc)
>>> Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
>>> ---
>>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.spinics.net_lists_util-2Dlinux-2Dng_msg17037.html&d=DwICaQ&c=_sEr5x9kUWhuk4_nFwjJtA&r=LYjLexDn7rXIzVmkNPvw5ymA1XTSqHGq8yBP6m6qZZ4njZguQhZhkI_-172IIy1t&m=U4eCQXCHnTmgAB4bLm1IJBHGUvY0OlzZwRhwZUecFxMBJMnqgAgrTpTz0IrWUJTR&s=Z_Fk9dO_TkdYJYl46pu81nr28SBx_F4uwjA-u2QRndg&e=  2.37.3 fixes
>> two CVEs (not listed on nvdist database for some reason).
>>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.spinics.net_lists_util-2Dlinux-2Dng_msg17087.html&d=DwICaQ&c=_sEr5x9kUWhuk4_nFwjJtA&r=LYjLexDn7rXIzVmkNPvw5ymA1XTSqHGq8yBP6m6qZZ4njZguQhZhkI_-172IIy1t&m=U4eCQXCHnTmgAB4bLm1IJBHGUvY0OlzZwRhwZUecFxMBJMnqgAgrTpTz0IrWUJTR&s=FoMkkE5_1EdZcBKwKLGT1JehXLRN8KwCdyEAunBBJIw&e=  2.37.4 fixes
>> one CVE (not listed on bvdist for some reason).
>>
>> I think it might be useful for release maintainer(s) if we mention in
>> the commit log or commit title if it's a security bump or not when
>> sending patches for version bumps to master? What do you think? (FYI,
>> Buildroot seems to do it regularly and it helps me with keeping my
>> vendor tree somewhat up-to-date security wise).
> 
> I'm happy if people do mention it (I did for expat recently) but I'm not going
> to block upgrades on the information being missing (how would I tell?).
> 
> We're struggling to get people to submit upgrades so I'm reluctant to make it
> harder for them.
> 

Impossible to enforce anyway, as you just mentioned. But making people 
aware that it's a nice thing to do should be doable, e.g. adding a few 
words in 
https://docs.yoctoproject.org/dev-manual/common-tasks.html#submitting-a-change-to-the-yocto-project 
and 
https://www.openembedded.org/wiki/How_to_submit_a_patch_to_OpenEmbedded ?

It was not my intention to suggest add additional rules, sorry if it 
came across this way.

Cheers,
Quentin

Re: [OE-core] [honister][PATCH 2/2] util-linux: upgrade 2.37.3 -> 2.37.4

[Richard Purdie]

On Mon, 2022-03-07 at 12:51 +0100, Quentin Schulz wrote:
> Hi Richard,
> 
> On 3/7/22 12:44, Richard Purdie wrote:
> > On Mon, 2022-03-07 at 12:26 +0100, Quentin Schulz wrote:
> > > Hi all,
> > > 
> > > On 3/7/22 12:21, Quentin Schulz wrote:
> > > > From: Alexander Kanavin <alex.kanavin@gmail.com>
> > > > 
> > > > Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
> > > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > > > (cherry picked from commit 6a3289c4786c4d278e2bf0ec1a5e04363772d8bc)
> > > > Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
> > > > ---
> > > 
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.spinics.net_lists_util-2Dlinux-2Dng_msg17037.html&d=DwICaQ&c=_sEr5x9kUWhuk4_nFwjJtA&r=LYjLexDn7rXIzVmkNPvw5ymA1XTSqHGq8yBP6m6qZZ4njZguQhZhkI_-172IIy1t&m=U4eCQXCHnTmgAB4bLm1IJBHGUvY0OlzZwRhwZUecFxMBJMnqgAgrTpTz0IrWUJTR&s=Z_Fk9dO_TkdYJYl46pu81nr28SBx_F4uwjA-u2QRndg&e=  2.37.3 fixes
> > > two CVEs (not listed on nvdist database for some reason).
> > > 
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.spinics.net_lists_util-2Dlinux-2Dng_msg17087.html&d=DwICaQ&c=_sEr5x9kUWhuk4_nFwjJtA&r=LYjLexDn7rXIzVmkNPvw5ymA1XTSqHGq8yBP6m6qZZ4njZguQhZhkI_-172IIy1t&m=U4eCQXCHnTmgAB4bLm1IJBHGUvY0OlzZwRhwZUecFxMBJMnqgAgrTpTz0IrWUJTR&s=FoMkkE5_1EdZcBKwKLGT1JehXLRN8KwCdyEAunBBJIw&e=  2.37.4 fixes
> > > one CVE (not listed on bvdist for some reason).
> > > 
> > > I think it might be useful for release maintainer(s) if we mention in
> > > the commit log or commit title if it's a security bump or not when
> > > sending patches for version bumps to master? What do you think? (FYI,
> > > Buildroot seems to do it regularly and it helps me with keeping my
> > > vendor tree somewhat up-to-date security wise).
> > 
> > I'm happy if people do mention it (I did for expat recently) but I'm not going
> > to block upgrades on the information being missing (how would I tell?).
> > 
> > We're struggling to get people to submit upgrades so I'm reluctant to make it
> > harder for them.
> > 
> 
> Impossible to enforce anyway, as you just mentioned. But making people 
> aware that it's a nice thing to do should be doable, e.g. adding a few 
> words in 
> https://docs.yoctoproject.org/dev-manual/common-tasks.html#submitting-a-change-to-the-yocto-project 
> and 
> https://www.openembedded.org/wiki/How_to_submit_a_patch_to_OpenEmbedded ?
> 
> It was not my intention to suggest add additional rules, sorry if it 
> came across this way.

Highlighting in the docs sounds like a great idea :)

Cheers,

Richard