* [OE-core][scarthgap 00/10] Patch review
@ 2024-06-11 13:07 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-06-11 13:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, June 13.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7024
The following changes since commit a3f5ac9f9fee2c8e10fec7c3f758e49513fef724:
git: set --with-gitconfig=/etc/gitconfig for -native builds (2024-05-31 14:02:17 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepthi Hemraj (1):
gcc : upgrade to v13.3
Lei Maohui (1):
run-postinsts.service: Removed --no-reload to fix reload warning when
users execute systemctl in the first boot.
Mark Hatle (1):
binutils: Fix aarch64 disassembly abort
Martin Hundeb?ll (1):
classes: image_types: quote variable assignment needed by dash
Robert Joslyn (1):
libgloss: Do not apply non-existent patch
Ross Burton (1):
gdk-pixbuf: upgrade 2.42.11 -> 2.42.12
Siddharth (1):
openssl: Upgrade 3.2.1 -> 3.2.2
Soumya Sambu (2):
util-linux: Fix CVE-2024-28085
git: upgrade 2.44.0 -> 2.44.1
Wang Mingyu (1):
gdk-pixbuf: upgrade 2.42.10 -> 2.42.11
meta/classes-recipe/image_types.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 2 +-
.../openssl/openssl/CVE-2024-2511.patch | 120 -
.../openssl/openssl/CVE-2024-4603.patch | 179 -
.../openssl/openssl/bti.patch | 58 -
.../{openssl_3.2.1.bb => openssl_3.2.2.bb} | 5 +-
meta/recipes-core/newlib/libgloss_git.bb | 1 -
meta/recipes-core/util-linux/util-linux.inc | 2 +
.../util-linux/CVE-2024-28085-0001.patch | 36 +
.../util-linux/CVE-2024-28085-0002.patch | 34 +
.../binutils/binutils-2.42.inc | 1 +
...sserts-from-operand-qualifier-decode.patch | 382 ++
.../gcc/{gcc-13.2.inc => gcc-13.3.inc} | 9 +-
...ian_13.2.bb => gcc-cross-canadian_13.3.bb} | 0
.../{gcc-cross_13.2.bb => gcc-cross_13.3.bb} | 0
...-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} | 0
...cc-runtime_13.2.bb => gcc-runtime_13.3.bb} | 0
...itizers_13.2.bb => gcc-sanitizers_13.3.bb} | 0
...{gcc-source_13.2.bb => gcc-source_13.3.bb} | 0
...AMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch | 9 +-
...ch64-Fix-loose-ldpstp-check-PR111411.patch | 117 -
.../gcc/gcc/CVE-2023-4039.patch | 3093 -----------------
.../gcc/gcc/CVE-2024-0151.patch | 315 --
.../gcc/{gcc_13.2.bb => gcc_13.3.bb} | 0
...initial_13.2.bb => libgcc-initial_13.3.bb} | 0
.../gcc/{libgcc_13.2.bb => libgcc_13.3.bb} | 0
...ibgfortran_13.2.bb => libgfortran_13.3.bb} | 0
.../git/{git_2.44.0.bb => git_2.44.1.bb} | 2 +-
.../run-postinsts/run-postinsts.service | 2 +-
...w-a-subset-of-tests-in-cross-compile.patch | 10 +-
.../gdk-pixbuf/gdk-pixbuf/fatal-loader.patch | 7 +-
...ixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} | 2 +-
32 files changed, 479 insertions(+), 3909 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-4603.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/bti.patch
rename meta/recipes-connectivity/openssl/{openssl_3.2.1.bb => openssl_3.2.2.bb} (97%)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0001.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0002.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-aarch64-Remove-asserts-from-operand-qualifier-decode.patch
rename meta/recipes-devtools/gcc/{gcc-13.2.inc => gcc-13.3.inc} (94%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_13.2.bb => gcc-cross-canadian_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_13.2.bb => gcc-cross_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_13.2.bb => gcc-runtime_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_13.2.bb => gcc-sanitizers_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_13.2.bb => gcc-source_13.3.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0026-aarch64-Fix-loose-ldpstp-check-PR111411.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2024-0151.patch
rename meta/recipes-devtools/gcc/{gcc_13.2.bb => gcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_13.2.bb => libgcc-initial_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_13.2.bb => libgcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_13.2.bb => libgfortran_13.3.bb} (100%)
rename meta/recipes-devtools/git/{git_2.44.0.bb => git_2.44.1.bb} (98%)
rename meta/recipes-gnome/gdk-pixbuf/{gdk-pixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} (98%)
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-08-08 2:28 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-08-08 2:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, August 9
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7220
with the exception of a load related parsing failure on qemuarm64-armhost
which passed on subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/97/builds/8717
The following changes since commit 136a25567499191b23a4d000a06bf83a473224ca:
rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS (2024-08-03 11:45:57 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (1):
ffmpeg: fix CVE-2024-31582
Ashish Sharma (1):
bind: Upgrade 9.18.25 -> 9.18.28
Changqing Li (2):
curl: correct the PACKAGECONFIG for native/nativesdk
libpng: update SRC_URI
Peter Marko (4):
curl: Patch CVE-2024-6197
glibc: cleanup old cve status
qemu: set cve status for CVE-2023-6683
libmnl: explicitly disable doxygen
Richard Purdie (1):
nasm: Upgrade 2.16.01 -> 2.16.03
Wang Mingyu (1):
orc: upgrade 0.4.38 -> 0.4.39
.../bind/{bind_9.18.25.bb => bind_9.18.28.bb} | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 --
.../nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} | 2 +-
.../orc/{orc_0.4.38.bb => orc_0.4.39.bb} | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 2 ++
meta/recipes-extended/libmnl/libmnl_1.0.5.bb | 2 ++
.../ffmpeg/ffmpeg/CVE-2024-31582.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
.../libpng/libpng_1.6.42.bb | 2 +-
.../curl/curl/CVE-2024-6197.patch | 24 +++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 5 +--
11 files changed, 70 insertions(+), 8 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.25.bb => bind_9.18.28.bb} (97%)
rename meta/recipes-devtools/nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} (88%)
rename meta/recipes-devtools/orc/{orc_0.4.38.bb => orc_0.4.39.bb} (92%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-6197.patch
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-10-07 1:54 Steve Sakoman
2024-10-07 3:23 ` Khem Raj
0 siblings, 1 reply; 22+ messages in thread
From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, October 8
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepesh Varatharajan (1):
glibc: stable 2.39 branch updates.
Hitendra Prajapati (1):
webkitgtk: upgrade 2.44.1 -> 2.44.3
Khem Raj (2):
gnupg: Document CVE-2022-3219 and mark wontfix
openssh: Mark CVE-2023-51767 as wont-fix
Martin Jansa (2):
populate_sdk_base: inherit nopackages
meta-world-pkgdata: Inherit nopackages
Peter Marko (3):
wpa-supplicant: Ignore CVE-2024-5290
wpa-supplicant: Patch CVE-2024-3596
wpa-supplicant: Patch security advisory 2024-2
Wang Mingyu (1):
cryptodev: upgrade 1.13 -> 1.14
meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
.../openssh/openssh_9.6p1.bb | 1 +
...valid-Rejected-Groups-element-length.patch | 52 ++++++
...valid-Rejected-Groups-element-length.patch | 50 ++++++
...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
.../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
.../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
.../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
.../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
.../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
.../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
.../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
.../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
.../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
.../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
...ng-header-file-provided-by-another-p.patch | 25 ---
...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
...spection.cmake-prefix-variables-obta.patch | 2 +-
...fic-declarations-in-FELighting.h-unn.patch | 44 -----
...icDowncast-adoption-in-platform-code.patch | 65 -------
...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
.../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
.../webkit/webkitgtk/reproducibility.patch | 2 +-
.../webkit/webkitgtk/t6-not-declared.patch | 12 +-
...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
33 files changed, 786 insertions(+), 190 deletions(-)
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [OE-core][scarthgap 00/10] Patch review
2024-10-07 1:54 Steve Sakoman
@ 2024-10-07 3:23 ` Khem Raj
0 siblings, 0 replies; 22+ messages in thread
From: Khem Raj @ 2024-10-07 3:23 UTC (permalink / raw)
To: steve; +Cc: openembedded-core
series looks ok to me.
On Sun, Oct 6, 2024 at 6:55 PM Steve Sakoman via
lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
wrote:
>
> Please review this set of changes for scarthgap and have comments back by
> end of day Tuesday, October 8
>
> Passed a-full on autobuilder:
>
> https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
>
> The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
>
> makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
>
> are available in the Git repository at:
>
> https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
> https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
>
> Deepesh Varatharajan (1):
> glibc: stable 2.39 branch updates.
>
> Hitendra Prajapati (1):
> webkitgtk: upgrade 2.44.1 -> 2.44.3
>
> Khem Raj (2):
> gnupg: Document CVE-2022-3219 and mark wontfix
> openssh: Mark CVE-2023-51767 as wont-fix
>
> Martin Jansa (2):
> populate_sdk_base: inherit nopackages
> meta-world-pkgdata: Inherit nopackages
>
> Peter Marko (3):
> wpa-supplicant: Ignore CVE-2024-5290
> wpa-supplicant: Patch CVE-2024-3596
> wpa-supplicant: Patch security advisory 2024-2
>
> Wang Mingyu (1):
> cryptodev: upgrade 1.13 -> 1.14
>
> meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
> .../openssh/openssh_9.6p1.bb | 1 +
> ...valid-Rejected-Groups-element-length.patch | 52 ++++++
> ...valid-Rejected-Groups-element-length.patch | 50 ++++++
> ...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
> .../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
> .../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
> .../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
> .../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
> .../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
> .../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
> .../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
> .../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
> .../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
> .../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
> ...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
> ...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
> ...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
> meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
> ...ng-header-file-provided-by-another-p.patch | 25 ---
> ...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
> ...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
> ...spection.cmake-prefix-variables-obta.patch | 2 +-
> ...fic-declarations-in-FELighting.h-unn.patch | 44 -----
> ...icDowncast-adoption-in-platform-code.patch | 65 -------
> ...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
> .../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
> .../webkit/webkitgtk/reproducibility.patch | 2 +-
> .../webkit/webkitgtk/t6-not-declared.patch | 12 +-
> ...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
> meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
> 33 files changed, 786 insertions(+), 190 deletions(-)
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
> rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
> rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
> rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
> delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
> delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
> delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
> delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
> rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
>
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#205248): https://lists.openembedded.org/g/openembedded-core/message/205248
> Mute This Topic: https://lists.openembedded.org/mt/108861069/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-11-07 3:37 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for scarthgap and have comments back by
end of day Friday, November 8
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/400
The following changes since commit bcd4e6d77dc7455a453e69b6d37769ec94cc02ad:
lsb-release: fix Distro Codename shell escaping (2024-10-24 06:09:29 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Aditya Tayade (1):
e2fsprogs: removed 'sed -u' option
Deepthi Hemraj (1):
rust-llvm: Fix CVE-2024-0151
Hiago De Franco (1):
weston: backport patch to allow neatvnc < v0.9.0
Martin Jansa (1):
python3-lxml=v5.0.2
Peter Marko (3):
cve-check: add support for cvss v4.0
go: upgrade 1.22.6 -> 1.22.7
go: upgrade 1.22.7 -> 1.22.8
Richard Purdie (1):
cve_check: Use a local copy of the database during builds
Vijay Anusuri (1):
xserver-xorg: upgrade 21.1.13 -> 21.1.14
Wang Mingyu (1):
orc: upgrade 0.4.39 -> 0.4.40
meta/classes/cve-check.bbclass | 16 +-
.../meta/cve-update-nvd2-native.bb | 32 +-
.../e2fsprogs/e2fsprogs/run-ptest | 3 +-
.../go/{go-1.22.6.inc => go-1.22.8.inc} | 2 +-
...e_1.22.6.bb => go-binary-native_1.22.8.bb} | 6 +-
..._1.22.6.bb => go-cross-canadian_1.22.8.bb} | 0
...{go-cross_1.22.6.bb => go-cross_1.22.8.bb} | 0
...osssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} | 0
...runtime_1.22.6.bb => go-runtime_1.22.8.bb} | 0
.../go/{go_1.22.6.bb => go_1.22.8.bb} | 0
.../orc/{orc_0.4.39.bb => orc_0.4.40.bb} | 2 +-
...n3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} | 3 +-
.../0004-llvm-Fix-CVE-2024-0151.patch | 1086 +++++++++++++++++
.../recipes-devtools/rust/rust-llvm_1.75.0.bb | 3 +-
...1-vnc-Allow-neatvnc-in-version-0.8.0.patch | 27 +
.../recipes-graphics/wayland/weston_13.0.1.bb | 1 +
...org_21.1.13.bb => xserver-xorg_21.1.14.bb} | 2 +-
17 files changed, 1158 insertions(+), 25 deletions(-)
rename meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.8.inc} (89%)
rename meta/recipes-devtools/go/{go-binary-native_1.22.6.bb => go-binary-native_1.22.8.bb} (78%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.22.6.bb => go-cross-canadian_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.22.6.bb => go-cross_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.22.6.bb => go-runtime_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.8.bb} (100%)
rename meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} (92%)
rename meta/recipes-devtools/python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} (94%)
create mode 100644 meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} (92%)
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-12-18 22:02 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 01/10] binutils: Fix CVE-2024-53589 Steve Sakoman
` (9 more replies)
0 siblings, 10 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, December 20
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/674
The following changes since commit b19b1e905d966443c4e4d17dfaeb299ae2526575:
cve-update-nvd2-native: Tweak to work better with NFS DL_DIR (2024-12-18 06:41:14 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Alexander Kanavin (1):
rust: add reproducibility patch to eliminate host leakage
Archana Polampalli (3):
ffmpeg: fix CVE-2024-35366
ffmpeg: fix CVE-2024-35367
ffmpeg: fix CVE-2024-35368
Hongxu Jia (1):
kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12
Jiaying Song (1):
subversion: fix CVE-2024-46901
Khem Raj (1):
python3: Drop empty patch
Ross Burton (1):
python3: add dependency on -compression to -core
Sunil Dora (1):
gcc: Fix c++: tweak for Wrange-loop-construct
Yash Shinde (1):
binutils: Fix CVE-2024-53589
.../binutils/binutils-2.42.inc | 1 +
.../binutils/0016-CVE-2024-53589.patch | 92 ++++++++++
meta/recipes-devtools/gcc/gcc-13.3.inc | 1 +
...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ++++++++++++
...lize-struct-termios-before-calling-t.patch | 26 ---
.../python/python3/python3-manifest.json | 2 +-
.../recipes-devtools/python/python3_3.12.6.bb | 1 -
...te-host-information-into-compilation.patch | 51 ++++++
meta/recipes-devtools/rust/rust-source.inc | 1 +
.../subversion/CVE-2024-46901.patch | 161 ++++++++++++++++++
.../subversion/subversion_1.14.3.bb | 3 +-
...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++
.../kern-tools/kern-tools-native_git.bb | 4 +-
.../ffmpeg/ffmpeg/CVE-2024-35366.patch | 35 ++++
.../ffmpeg/ffmpeg/CVE-2024-35367.patch | 47 +++++
.../ffmpeg/ffmpeg/CVE-2024-35368.patch | 41 +++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 3 +
17 files changed, 612 insertions(+), 30 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch
create mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
delete mode 100644 meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch
create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch
create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 01/10] binutils: Fix CVE-2024-53589
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 02/10] subversion: fix CVE-2024-46901 Steve Sakoman
` (8 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Yash Shinde <Yash.Shinde@windriver.com>
A buffer overflow vulnerability exists in GNU Binutils’ objdump utility
when processing tekhex format files. The vulnerability occurs in the
Binary File Descriptor (BFD) library’s tekhex parser during format identification.
Specifically, the issue manifests when attempting to read 8 bytes at an address
that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read.
Backport a patch from upstream to fix CVE-2024-53589.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88]
Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../binutils/binutils-2.42.inc | 1 +
.../binutils/0016-CVE-2024-53589.patch | 92 +++++++++++++++++++
2 files changed, 93 insertions(+)
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc
index bff97b50c3..41ed39632d 100644
--- a/meta/recipes-devtools/binutils/binutils-2.42.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.42.inc
@@ -36,5 +36,6 @@ SRC_URI = "\
file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \
file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \
file://0015-gprofng-change-use-of-bignum-to-bigint.patch \
+ file://0016-CVE-2024-53589.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch b/meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch
new file mode 100644
index 0000000000..380112a3ba
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch
@@ -0,0 +1,92 @@
+Author: Alan Modra <amodra@gmail.com>
+Date: Mon Nov 11 10:24:09 2024 +1030
+
+ Re: tekhex object file output fixes
+
+ Commit 8b5a212495 supported *ABS* symbols by allowing "section" to be
+ bfd_abs_section, but bfd_abs_section needs to be treated specially.
+ In particular, bfd_get_next_section_by_name (.., bfd_abs_section_ptr)
+ is invalid.
+
+ PR 32347
+ * tekhex.c (first_phase): Guard against modification of
+ _bfd_std_section[] entries.
+
+Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88]
+CVE: CVE-2024-53589
+
+Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
+
+diff --git a/bfd/tekhex.c b/bfd/tekhex.c
+index aea2ebb23df..b305c1f96f1 100644
+--- a/bfd/tekhex.c
++++ b/bfd/tekhex.c
+@@ -361,6 +361,7 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
+ {
+ asection *section, *alt_section;
+ unsigned int len;
++ bfd_vma addr;
+ bfd_vma val;
+ char sym[17]; /* A symbol can only be 16chars long. */
+
+@@ -368,20 +369,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
+ {
+ case '6':
+ /* Data record - read it and store it. */
+- {
+- bfd_vma addr;
+-
+- if (!getvalue (&src, &addr, src_end))
+- return false;
+-
+- while (*src && src < src_end - 1)
+- {
+- insert_byte (abfd, HEX (src), addr);
+- src += 2;
+- addr++;
+- }
+- return true;
+- }
++ if (!getvalue (&src, &addr, src_end))
++ return false;
++
++ while (*src && src < src_end - 1)
++ {
++ insert_byte (abfd, HEX (src), addr);
++ src += 2;
++ addr++;
++ }
++ return true;
+
+ case '3':
+ /* Symbol record, read the segment. */
+@@ -406,13 +403,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
+ {
+ case '1': /* Section range. */
+ src++;
+- if (!getvalue (&src, §ion->vma, src_end))
++ if (!getvalue (&src, &addr, src_end))
+ return false;
+ if (!getvalue (&src, &val, src_end))
+ return false;
+- if (val < section->vma)
+- val = section->vma;
+- section->size = val - section->vma;
++ if (bfd_is_const_section (section))
++ break;
++ section->vma = addr;
++ if (val < addr)
++ val = addr;
++ section->size = val - addr;
+ /* PR 17512: file: objdump-s-endless-loop.tekhex.
+ Check for overlarge section sizes. */
+ if (section->size & 0x80000000)
+@@ -455,6 +455,8 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
+ new_symbol->symbol.flags = BSF_LOCAL;
+ if (stype == '2' || stype == '6')
+ new_symbol->symbol.section = bfd_abs_section_ptr;
++ else if (bfd_is_const_section (section))
++ ;
+ else if (stype == '3' || stype == '7')
+ {
+ if ((section->flags & SEC_DATA) == 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 02/10] subversion: fix CVE-2024-46901
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 01/10] binutils: Fix CVE-2024-53589 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 03/10] ffmpeg: fix CVE-2024-35366 Steve Sakoman
` (7 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Jiaying Song <jiaying.song.cn@windriver.com>
Insufficient validation of filenames against control characters in
Apache Subversion repositories served via mod_dav_svn allows
authenticated users with commit access to commit a corrupted revision,
leading to disruption for users of the repository. All versions of
Subversion up to and including Subversion 1.14.4 are affected if serving
repositories via mod_dav_svn. Users are recommended to upgrade to
version 1.14.5, which fixes this issue. Repositories served via other
access methods are not affected.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-46901
Upstream patches:
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../subversion/CVE-2024-46901.patch | 161 ++++++++++++++++++
.../subversion/subversion_1.14.3.bb | 3 +-
2 files changed, 163 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch
diff --git a/meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch b/meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch
new file mode 100644
index 0000000000..4b28a58507
--- /dev/null
+++ b/meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch
@@ -0,0 +1,161 @@
+From 149e299cd7eaadc8248480300b6e13b097c5b3fa Mon Sep 17 00:00:00 2001
+From: Jiaying Song <jiaying.song.cn@windriver.com>
+Date: Fri, 13 Dec 2024 12:19:43 +0800
+Subject: [PATCH] Fix CVE-2024-46901
+
+It has been discovered that the patch for CVE-2013-1968 was incomplete and unintentionally left mod_dav_svn vulnerable to control characters in filenames.
+
+Upstream-Status: Backport
+[https://subversion.apache.org/security/CVE-2024-46901-advisory.txt]
+
+CVE: CVE-2024-46901
+
+Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
+---
+ .../include/private/svn_repos_private.h | 8 +++++
+ subversion/libsvn_repos/commit.c | 3 +-
+ subversion/libsvn_repos/repos.c | 10 +++++++
+ subversion/mod_dav_svn/lock.c | 7 +++++
+ subversion/mod_dav_svn/repos.c | 29 +++++++++++++++++++
+ 5 files changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/subversion/include/private/svn_repos_private.h b/subversion/include/private/svn_repos_private.h
+index 1fd34e8..1d5fc9c 100644
+--- a/subversion/include/private/svn_repos_private.h
++++ b/subversion/include/private/svn_repos_private.h
+@@ -390,6 +390,14 @@ svn_repos__get_dump_editor(const svn_delta_editor_t **editor,
+ const char *update_anchor_relpath,
+ apr_pool_t *pool);
+
++/* Validate that the given PATH is a valid pathname that can be stored in
++ * a Subversion repository, according to the name constraints used by the
++ * svn_repos_* layer.
++ */
++svn_error_t *
++svn_repos__validate_new_path(const char *path,
++ apr_pool_t *scratch_pool);
++
+ #ifdef __cplusplus
+ }
+ #endif /* __cplusplus */
+diff --git a/subversion/libsvn_repos/commit.c b/subversion/libsvn_repos/commit.c
+index 515600d..aad37ee 100644
+--- a/subversion/libsvn_repos/commit.c
++++ b/subversion/libsvn_repos/commit.c
+@@ -308,8 +308,7 @@ add_file_or_directory(const char *path,
+ svn_boolean_t was_copied = FALSE;
+ const char *full_path, *canonicalized_path;
+
+- /* Reject paths which contain control characters (related to issue #4340). */
+- SVN_ERR(svn_path_check_valid(path, pool));
++ SVN_ERR(svn_repos__validate_new_path(path, pool));
+
+ SVN_ERR(svn_relpath_canonicalize_safe(&canonicalized_path, NULL, path,
+ pool, pool));
+diff --git a/subversion/libsvn_repos/repos.c b/subversion/libsvn_repos/repos.c
+index 2189de8..119f04b 100644
+--- a/subversion/libsvn_repos/repos.c
++++ b/subversion/libsvn_repos/repos.c
+@@ -2092,3 +2092,13 @@ svn_repos__fs_type(const char **fs_type,
+ svn_dirent_join(repos_path, SVN_REPOS__DB_DIR, pool),
+ pool);
+ }
++
++svn_error_t *
++svn_repos__validate_new_path(const char *path,
++ apr_pool_t *scratch_pool)
++{
++ /* Reject paths which contain control characters (related to issue #4340). */
++ SVN_ERR(svn_path_check_valid(path, scratch_pool));
++
++ return SVN_NO_ERROR;
++}
+diff --git a/subversion/mod_dav_svn/lock.c b/subversion/mod_dav_svn/lock.c
+index 7e9c94b..d2a6aa9 100644
+--- a/subversion/mod_dav_svn/lock.c
++++ b/subversion/mod_dav_svn/lock.c
+@@ -36,6 +36,7 @@
+ #include "svn_pools.h"
+ #include "svn_props.h"
+ #include "private/svn_log.h"
++#include "private/svn_repos_private.h"
+
+ #include "dav_svn.h"
+
+@@ -717,6 +718,12 @@ append_locks(dav_lockdb *lockdb,
+
+ /* Commit a 0-byte file: */
+
++ if ((serr = svn_repos__validate_new_path(resource->info->repos_path,
++ resource->pool)))
++ return dav_svn__convert_err(serr, HTTP_BAD_REQUEST,
++ "Request specifies an invalid path.",
++ resource->pool);
++
+ if ((serr = dav_svn__get_youngest_rev(&rev, repos, resource->pool)))
+ return dav_svn__convert_err(serr, HTTP_INTERNAL_SERVER_ERROR,
+ "Could not determine youngest revision",
+diff --git a/subversion/mod_dav_svn/repos.c b/subversion/mod_dav_svn/repos.c
+index 8cbd5e7..778ae9b 100644
+--- a/subversion/mod_dav_svn/repos.c
++++ b/subversion/mod_dav_svn/repos.c
+@@ -2928,6 +2928,15 @@ open_stream(const dav_resource *resource,
+
+ if (kind == svn_node_none) /* No existing file. */
+ {
++ serr = svn_repos__validate_new_path(resource->info->repos_path,
++ resource->pool);
++
++ if (serr != NULL)
++ {
++ return dav_svn__convert_err(serr, HTTP_BAD_REQUEST,
++ "Request specifies an invalid path.",
++ resource->pool);
++ }
+ serr = svn_fs_make_file(resource->info->root.root,
+ resource->info->repos_path,
+ resource->pool);
+@@ -4120,6 +4129,14 @@ create_collection(dav_resource *resource)
+ return err;
+ }
+
++ if ((serr = svn_repos__validate_new_path(resource->info->repos_path,
++ resource->pool)) != NULL)
++ {
++ return dav_svn__convert_err(serr, HTTP_BAD_REQUEST,
++ "Request specifies an invalid path.",
++ resource->pool);
++ }
++
+ if ((serr = svn_fs_make_dir(resource->info->root.root,
+ resource->info->repos_path,
+ resource->pool)) != NULL)
+@@ -4193,6 +4210,12 @@ copy_resource(const dav_resource *src,
+ if (err)
+ return err;
+ }
++
++ serr = svn_repos__validate_new_path(dst->info->repos_path, dst->pool);
++ if (serr)
++ return dav_svn__convert_err(serr, HTTP_BAD_REQUEST,
++ "Request specifies an invalid path.",
++ dst->pool);
+
+ src_repos_path = svn_repos_path(src->info->repos->repos, src->pool);
+ dst_repos_path = svn_repos_path(dst->info->repos->repos, dst->pool);
+@@ -4430,6 +4453,12 @@ move_resource(dav_resource *src,
+ if (err)
+ return err;
+
++ serr = svn_repos__validate_new_path(dst->info->repos_path, dst->pool);
++ if (serr)
++ return dav_svn__convert_err(serr, HTTP_BAD_REQUEST,
++ "Request specifies an invalid path.",
++ dst->pool);
++
+ /* Copy the src to the dst. */
+ serr = svn_fs_copy(src->info->root.root, /* the root object of src rev*/
+ src->info->repos_path, /* the relative path of src */
+--
+2.25.1
+
diff --git a/meta/recipes-devtools/subversion/subversion_1.14.3.bb b/meta/recipes-devtools/subversion/subversion_1.14.3.bb
index 1cf4e1734b..1ef3d498a5 100644
--- a/meta/recipes-devtools/subversion/subversion_1.14.3.bb
+++ b/meta/recipes-devtools/subversion/subversion_1.14.3.bb
@@ -10,7 +10,8 @@ DEPENDS:append:class-native = " file-replacement-native"
SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
file://serfmacro.patch \
- "
+ file://CVE-2024-46901.patch \
+ "
SRC_URI[sha256sum] = "949efd451a09435f7e8573574c71c7b71b194d844890fa49cd61d2262ea1a440"
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 03/10] ffmpeg: fix CVE-2024-35366
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 01/10] binutils: Fix CVE-2024-53589 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 02/10] subversion: fix CVE-2024-46901 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 04/10] ffmpeg: fix CVE-2024-35367 Steve Sakoman
` (6 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options
function of sbgdec.c within the libavformat module. When parsing certain options,
the software does not adequately validate the input. This allows for negative
duration values to be accepted without proper bounds checking.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2024-35366.patch | 35 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 36 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch
new file mode 100644
index 0000000000..f7f16a5b92
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch
@@ -0,0 +1,35 @@
+From 0bed22d597b78999151e3bde0768b7fe763fc2a6 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Tue, 26 Mar 2024 00:39:49 +0100
+Subject: [PATCH] avformat/sbgdec: Check for negative duration
+
+Fixes: signed integer overflow: 9223372036854775807 - -8000000 cannot be represented in type 'long'
+Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5133181743136768
+
+Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2024-35366
+
+Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavformat/sbgdec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
+index b2662ea..281fe62 100644
+--- a/libavformat/sbgdec.c
++++ b/libavformat/sbgdec.c
+@@ -386,7 +386,7 @@ static int parse_options(struct sbg_parser *p)
+ case 'L':
+ FORWARD_ERROR(parse_optarg(p, opt, &oarg));
+ r = str_to_time(oarg.s, &p->scs.opt_duration);
+- if (oarg.e != oarg.s + r) {
++ if (oarg.e != oarg.s + r || p->scs.opt_duration < 0) {
+ snprintf(p->err_msg, sizeof(p->err_msg),
+ "syntax error for option -L");
+ return AVERROR_INVALIDDATA;
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index 8f4a8d34c0..dd95629648 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -37,6 +37,7 @@ SRC_URI = " \
file://CVE-2023-50007.patch \
file://CVE-2023-49528.patch \
file://CVE-2024-7055.patch \
+ file://CVE-2024-35366.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 04/10] ffmpeg: fix CVE-2024-35367
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (2 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 03/10] ffmpeg: fix CVE-2024-35366 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 05/10] ffmpeg: fix CVE-2024-35368 Steve Sakoman
` (5 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c,
static const vec_s8 h_subpel_filters_outer
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2024-35367.patch | 47 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
new file mode 100644
index 0000000000..a1bec43c66
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
@@ -0,0 +1,47 @@
+From 09e6840cf7a3ee07a73c3ae88a020bf27ca1a667 Mon Sep 17 00:00:00 2001
+From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+Date: Wed, 13 Mar 2024 02:10:26 +0100
+Subject: [PATCH] avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access
+
+h_subpel_filters_inner[i] and h_subpel_filters_outer[i / 2]
+belong together and the former allows the range 0..6,
+so the latter needs to support 0..3. But it has only three
+elements. Add another one.
+The value for the last element has been guesstimated
+from subpel_filters in libavcodec/vp8dsp.c.
+
+This is also intended to fix FATE-failures with UBSan here:
+https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-13.2-ubsan-altivec-qemu
+
+Tested-by: Sean McGovern <gseanmcg@gmail.com>
+Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+
+CVE: CVE-2024-35367
+
+Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavcodec/ppc/vp8dsp_altivec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libavcodec/ppc/vp8dsp_altivec.c b/libavcodec/ppc/vp8dsp_altivec.c
+index 12dac8b..061914f 100644
+--- a/libavcodec/ppc/vp8dsp_altivec.c
++++ b/libavcodec/ppc/vp8dsp_altivec.c
+@@ -50,11 +50,12 @@ static const vec_s8 h_subpel_filters_inner[7] =
+ // for 6tap filters, these are the outer two taps
+ // The zeros mask off pixels 4-7 when filtering 0-3
+ // and vice-versa
+-static const vec_s8 h_subpel_filters_outer[3] =
++static const vec_s8 h_subpel_filters_outer[4] =
+ {
+ REPT4(0, 0, 2, 1),
+ REPT4(0, 0, 3, 3),
+ REPT4(0, 0, 1, 2),
++ REPT4(0, 0, 0, 0),
+ };
+
+ #define LOAD_H_SUBPEL_FILTER(i) \
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index dd95629648..94d4cb82d5 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -38,6 +38,7 @@ SRC_URI = " \
file://CVE-2023-49528.patch \
file://CVE-2024-7055.patch \
file://CVE-2024-35366.patch \
+ file://CVE-2024-35367.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 05/10] ffmpeg: fix CVE-2024-35368
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (3 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 04/10] ffmpeg: fix CVE-2024-35367 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 06/10] gcc: Fix c++: tweak for Wrange-loop-construct Steve Sakoman
` (4 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame
function within libavcodec/rkmppdec.c.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2024-35368.patch | 41 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
new file mode 100644
index 0000000000..7b802762eb
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
@@ -0,0 +1,41 @@
+From 4513300989502090c4fd6560544dce399a8cd53c Mon Sep 17 00:00:00 2001
+From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+Date: Sun, 24 Sep 2023 13:15:48 +0200
+Subject: [PATCH] avcodec/rkmppdec: Fix double-free on error
+
+After having created the AVBuffer that is put into frame->buf[0],
+ownership of several objects (namely an AVDRMFrameDescriptor,
+an MppFrame and some AVBufferRefs framecontextref and decoder_ref)
+has passed to the AVBuffer and therefore to the frame.
+Yet it has nevertheless been freed manually on error
+afterwards, which would lead to a double-free as soon
+as the AVFrame is unreferenced.
+
+Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+
+CVE: CVE-2024-35368
+
+Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavcodec/rkmppdec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libavcodec/rkmppdec.c b/libavcodec/rkmppdec.c
+index 5768568..2ca368e 100644
+--- a/libavcodec/rkmppdec.c
++++ b/libavcodec/rkmppdec.c
+@@ -462,8 +462,8 @@ static int rkmpp_retrieve_frame(AVCodecContext *avctx, AVFrame *frame)
+
+ frame->hw_frames_ctx = av_buffer_ref(decoder->frames_ref);
+ if (!frame->hw_frames_ctx) {
+- ret = AVERROR(ENOMEM);
+- goto fail;
++ av_frame_unref(frame);
++ return AVERROR(ENOMEM);
+ }
+
+ return 0;
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index 94d4cb82d5..c3cfc87669 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -39,6 +39,7 @@ SRC_URI = " \
file://CVE-2024-7055.patch \
file://CVE-2024-35366.patch \
file://CVE-2024-35367.patch \
+ file://CVE-2024-35368.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 06/10] gcc: Fix c++: tweak for Wrange-loop-construct
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (4 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 05/10] ffmpeg: fix CVE-2024-35368 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 07/10] python3: Drop empty patch Steve Sakoman
` (3 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Sunil Dora <sunilkumar.dora@windriver.com>
This commit updates the warning to use a check for "trivially constructible" instead of
"trivially copyable." The original check was incorrect, as "trivially copyable" only applies
to types that can be copied trivially, whereas "trivially constructible" is the correct check
for types that can be trivially default-constructed.
This change ensures the warning is more accurate and aligns with the proper type traits.
LLVM accepted a similar fix:
https://github.com/llvm/llvm-project/issues/47355
PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731]
Signed-off-by: Marek Polacek <polacek@redhat.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/gcc/gcc-13.3.inc | 1 +
...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ++++++++++++++++++
2 files changed, 114 insertions(+)
create mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
diff --git a/meta/recipes-devtools/gcc/gcc-13.3.inc b/meta/recipes-devtools/gcc/gcc-13.3.inc
index ffe90c7188..8b6c2a5938 100644
--- a/meta/recipes-devtools/gcc/gcc-13.3.inc
+++ b/meta/recipes-devtools/gcc/gcc-13.3.inc
@@ -66,6 +66,7 @@ SRC_URI = "${BASEURI} \
file://0024-Avoid-hardcoded-build-paths-into-ppc-libgcc.patch \
file://0025-gcc-testsuite-tweaks-for-mips-OE.patch \
file://0027-Fix-gcc-vect-module-testcases.patch \
+ file://0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch \
file://gcc.git-ab884fffe3fc82a710bea66ad651720d71c938b8.patch \
"
SRC_URI[sha256sum] = "0845e9621c9543a13f484e94584a49ffc0129970e9914624235fc1d061a0c083"
diff --git a/meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch b/meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
new file mode 100644
index 0000000000..745b38f7f1
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
@@ -0,0 +1,113 @@
+From 66aa69e2add2b8641a652768b0eac30f00427145 Mon Sep 17 00:00:00 2001
+From: Sunil Dora <sunilkumar.dora@windriver.com>
+Date: Wed, 11 Dec 2024 09:48:16 -0800
+Subject: [PATCH] gcc: Fix c++: tweak for Wrange-loop-construct
+
+This commit updates the warning to use a check for "trivially constructible" instead of
+"trivially copyable." The original check was incorrect, as "trivially copyable" only applies
+to types that can be copied trivially, whereas "trivially constructible" is the correct check
+for types that can be trivially default-constructed.
+
+This change ensures the warning is more accurate and aligns with the proper type traits.
+
+LLVM accepted a similar fix:
+https://github.com/llvm/llvm-project/issues/47355
+
+PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731]
+
+Upstream-Status: Backport [https://gcc.gnu.org/g:179dc0f0fe01012675c1b430591b9891ce96c26e]
+
+Signed-off-by: Marek Polacek <polacek@redhat.com>
+Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
+---
+ gcc/cp/parser.cc | 7 ++-
+ .../g++.dg/warn/Wrange-loop-construct3.C | 57 +++++++++++++++++++
+ 2 files changed, 61 insertions(+), 3 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/warn/Wrange-loop-construct3.C
+
+diff --git a/gcc/cp/parser.cc b/gcc/cp/parser.cc
+index 4e67da6ff..5dd94357d 100644
+--- a/gcc/cp/parser.cc
++++ b/gcc/cp/parser.cc
+@@ -13854,11 +13854,12 @@ warn_for_range_copy (tree decl, tree expr)
+ else if (!CP_TYPE_CONST_P (type))
+ return;
+
+- /* Since small trivially copyable types are cheap to copy, we suppress the
+- warning for them. 64B is a common size of a cache line. */
++ /* Since small trivially constructible types are cheap to construct, we
++ suppress the warning for them. 64B is a common size of a cache line. */
++ tree list = build_tree_list (NULL_TREE, TREE_TYPE (expr));
+ if (TREE_CODE (TYPE_SIZE_UNIT (type)) != INTEGER_CST
+ || (tree_to_uhwi (TYPE_SIZE_UNIT (type)) <= 64
+- && trivially_copyable_p (type)))
++ && is_trivially_xible (INIT_EXPR, type, list)))
+ return;
+
+ /* If we can initialize a reference directly, suggest that to avoid the
+diff --git a/gcc/testsuite/g++.dg/warn/Wrange-loop-construct3.C b/gcc/testsuite/g++.dg/warn/Wrange-loop-construct3.C
+new file mode 100644
+index 000000000..3d9d0c908
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/warn/Wrange-loop-construct3.C
+@@ -0,0 +1,57 @@
++// PR c++/116731
++// { dg-do compile { target c++11 } }
++// { dg-options "-Wrange-loop-construct" }
++
++void
++f0 ()
++{
++ struct S {
++ char a[64];
++ S& operator=(const S&) { return *this; };
++ };
++
++ S arr[8];
++ for (const auto r : arr)
++ (void) r;
++}
++
++void
++f1 ()
++{
++ struct S {
++ char a[65];
++ S& operator=(const S&) { return *this; };
++ };
++
++ S arr[8];
++ for (const auto r : arr) // { dg-warning "creates a copy" }
++ (void) r;
++}
++
++void
++f2 ()
++{
++ struct S {
++ char a[64];
++ S& operator=(const S&) { return *this; };
++ ~S() { }
++ };
++
++ S arr[8];
++ for (const auto r : arr) // { dg-warning "creates a copy" }
++ (void) r;
++}
++
++void
++f3 ()
++{
++ struct S {
++ char a[65];
++ S& operator=(const S&) { return *this; };
++ ~S() { }
++ };
++
++ S arr[8];
++ for (const auto r : arr) // { dg-warning "creates a copy" }
++ (void) r;
++}
+--
+2.43.0
+
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 07/10] python3: Drop empty patch
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (5 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 06/10] gcc: Fix c++: tweak for Wrange-loop-construct Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 08/10] python3: add dependency on -compression to -core Steve Sakoman
` (2 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
The fix brought by this patch is already part of python 3.12.3
therefore drop it.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...lize-struct-termios-before-calling-t.patch | 26 -------------------
.../recipes-devtools/python/python3_3.12.6.bb | 1 -
2 files changed, 27 deletions(-)
delete mode 100644 meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch
diff --git a/meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch b/meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch
deleted file mode 100644
index 8406ef30a2..0000000000
--- a/meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 439aa02f42d6e6715c172076261757fcb89a936a Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Tue, 23 Jan 2024 23:02:02 +0100
-Subject: [PATCH] gh-114492: Initialize struct termios before calling
- tcgetattr() (GH-114495) (GH-114502)
-
-On Alpine Linux it could leave some field non-initialized.
-(cherry picked from commit d22c066b802592932f9eb18434782299e80ca42e)
-
-Upstream-Status: Backport [https://github.com/python/cpython/commit/386c72d9928c51aa2c855ce592bd8022da3b407f]
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- .../next/Library/2024-01-23-21-20-40.gh-issue-114492.vKxl5o.rst | 2 ++
- 1 file changed, 2 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Library/2024-01-23-21-20-40.gh-issue-114492.vKxl5o.rst
-
-diff --git a/Misc/NEWS.d/next/Library/2024-01-23-21-20-40.gh-issue-114492.vKxl5o.rst b/Misc/NEWS.d/next/Library/2024-01-23-21-20-40.gh-issue-114492.vKxl5o.rst
-new file mode 100644
-index 0000000..8df8299
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-01-23-21-20-40.gh-issue-114492.vKxl5o.rst
-@@ -0,0 +1,2 @@
-+Make the result of :func:`termios.tcgetattr` reproducible on Alpine Linux.
-+Previously it could leave a random garbage in some fields.
diff --git a/meta/recipes-devtools/python/python3_3.12.6.bb b/meta/recipes-devtools/python/python3_3.12.6.bb
index ae69f0e781..63a3134b36 100644
--- a/meta/recipes-devtools/python/python3_3.12.6.bb
+++ b/meta/recipes-devtools/python/python3_3.12.6.bb
@@ -29,7 +29,6 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-Update-test_sysconfig-for-posix_user-purelib.patch \
file://0001-skip-no_stdout_fileno-test-due-to-load-variability.patch \
file://0001-test_storlines-skip-due-to-load-variability.patch \
- file://0001-gh-114492-Initialize-struct-termios-before-calling-t.patch \
file://0001-test_shutdown-skip-problematic-test.patch \
file://0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch \
file://0001-test_deadlock-skip-problematic-test.patch \
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 08/10] python3: add dependency on -compression to -core
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (6 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 07/10] python3: Drop empty patch Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage Steve Sakoman
9 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
importlib.metadata is part of -core, but that will import zipfile which
is part of -compression.
Obviously this shows that our packaging of the Python modules is not
optimal. I plan to follow up with a redesign of the splitting which
focuses on simply pulling out the larger or esoteric modules and
having a more featureful core.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/python/python3/python3-manifest.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/python/python3/python3-manifest.json b/meta/recipes-devtools/python/python3/python3-manifest.json
index 46092d4004..292c5bbc5d 100644
--- a/meta/recipes-devtools/python/python3/python3-manifest.json
+++ b/meta/recipes-devtools/python/python3/python3-manifest.json
@@ -216,7 +216,7 @@
},
"core": {
"summary": "Python interpreter and core modules",
- "rdepends": [],
+ "rdepends": ["compression"],
"files": [
"${bindir}/python${PYTHON_MAJMIN}",
"${bindir}/python${PYTHON_MAJMIN}.real",
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (7 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 08/10] python3: add dependency on -compression to -core Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-19 4:04 ` Bruce Ashfield
2024-12-18 22:02 ` [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage Steve Sakoman
9 siblings, 1 reply; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
Python 3.12 emmits a SyntaxWarning when using unescaped
character inside a RegEx string.
'''
recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid escape sequence '\.'
if re.match( ".*\.config", opt ):
recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid escape sequence '\w'
x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid escape sequence '\s'
if re.search( "^#\s*CONFIG_", option ):
'''
According to [1], use raw strings for regular expression
[1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++++++++++++++
.../kern-tools/kern-tools-native_git.bb | 4 +-
2 files changed, 63 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
diff --git a/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
new file mode 100644
index 0000000000..e87067c8ac
--- /dev/null
+++ b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
@@ -0,0 +1,60 @@
+From 1f64368e4e82e47cd0e0dfe37b0e1b8958566d21 Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Tue, 17 Dec 2024 01:25:29 -0800
+Subject: [PATCH] symbol_why: fix SyntaxWarning for RegEx calls on Python 3.12
+
+Python 3.12 emmits a SyntaxWarning when using unescaped
+character inside a RegEx string.
+'''
+recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid escape sequence '\.'
+ if re.match( ".*\.config", opt ):
+recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid escape sequence '\w'
+ x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
+recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid escape sequence '\s'
+ if re.search( "^#\s*CONFIG_", option ):
+'''
+
+According to [1], use raw strings for regular expression
+
+[1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
+
+Upstream-Status: Submitted [linux-yocto@lists.yoctoproject.org]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ tools/symbol_why.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/symbol_why.py b/tools/symbol_why.py
+index 326e84f..4864378 100755
+--- a/tools/symbol_why.py
++++ b/tools/symbol_why.py
+@@ -158,7 +158,7 @@ for opt in args.args:
+ elif re.match( "--ksrc=*", opt):
+ temp, ksrc = opt.split('=', 2)
+ else:
+- if re.match( ".*\.config", opt ):
++ if re.match( r".*\.config", opt ):
+ dotconfig=opt
+ elif not ksrc:
+ ksrc=opt
+@@ -213,7 +213,7 @@ if not os.getenv("KERNELVERSION"):
+ hconfig = open( dotconfig )
+ for line in hconfig:
+ line = line.rstrip()
+- x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
++ x = re.match( r"^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
+ if x:
+ os.environ["KERNELVERSION"] = x.group(1)
+ if verbose:
+@@ -492,7 +492,7 @@ def split_option( config_option_str ):
+ opt = m.group(1)
+ val = m.group(2)
+ except:
+- if re.search( "^#\s*CONFIG_", option ):
++ if re.search( r"^#\s*CONFIG_", option ):
+ # print( "option is a is not set!!! %s" % option )
+ m = re.match(r"# (CONFIG_[^ ]+) is not set", option )
+ if m:
+--
+2.25.1
+
diff --git a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
index 8eff00821a..7d11889eda 100644
--- a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
+++ b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
@@ -16,7 +16,9 @@ PV = "0.3+git"
inherit native
-SRC_URI = "git://git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https"
+SRC_URI = "git://git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https \
+ file://0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch \
+"
S = "${WORKDIR}/git"
do_configure() {
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (8 preceding siblings ...)
2024-12-18 22:02 ` [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Steve Sakoman
@ 2024-12-18 22:02 ` Steve Sakoman
2024-12-19 9:16 ` Martin Jansa
9 siblings, 1 reply; 22+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
[YOCTO #15185]
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 924df18b47e9a69fa295bafe37bdb39d8eaea2bb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...te-host-information-into-compilation.patch | 51 +++++++++++++++++++
meta/recipes-devtools/rust/rust-source.inc | 1 +
2 files changed, 52 insertions(+)
create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
diff --git a/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch b/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
new file mode 100644
index 0000000000..a6ee867605
--- /dev/null
+++ b/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
@@ -0,0 +1,51 @@
+From 065d7c263091118437465d714d8a29dbb6296921 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex@linutronix.de>
+Date: Mon, 13 May 2024 14:57:54 +0200
+Subject: [PATCH] cargo: do not write host information into compilation unit
+ hashes
+
+This breaks reproducibility in cross-builds where the cross-target
+can be the same, but build hosts are different, as seen with
+"rustc --version -v":
+...
+host: x86_64-unknown-linux-gnu
+
+vs.
+
+host: aarch64-unknown-linux-gnu
+
+This can possibly be improved by only hashing host info if the build
+is a native one (e.g. there's no --target option passed to cargo
+invocation) but I'm not sure how.
+
+Upstream-Status: Inappropriate [reported at https://github.com/rust-lang/cargo/issues/13922]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ .../src/cargo/core/compiler/context/compilation_files.rs | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs b/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
+index d83dbf10c..b2ad8d9f3 100644
+--- a/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
++++ b/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
+@@ -652,7 +652,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher) {
+ if vers.pre.is_empty() || bcx.config.cli_unstable().separate_nightlies {
+ // For stable, keep the artifacts separate. This helps if someone is
+ // testing multiple versions, to avoid recompiles.
+- bcx.rustc().verbose_version.hash(hasher);
++ //bcx.rustc().verbose_version.hash(hasher);
+ return;
+ }
+ // On "nightly"/"beta"/"dev"/etc, keep each "channel" separate. Don't hash
+@@ -665,7 +665,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher) {
+ // Keep "host" since some people switch hosts to implicitly change
+ // targets, (like gnu vs musl or gnu vs msvc). In the future, we may want
+ // to consider hashing `unit.kind.short_name()` instead.
+- bcx.rustc().host.hash(hasher);
++ //bcx.rustc().host.hash(hasher);
+ // None of the other lines are important. Currently they are:
+ // binary: rustc <-- or "rustdoc"
+ // commit-hash: 38114ff16e7856f98b2b4be7ab4cd29b38bed59a
+--
+2.39.2
+
diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc
index 8a8e48b8ca..55ea1b77e6 100644
--- a/meta/recipes-devtools/rust/rust-source.inc
+++ b/meta/recipes-devtools/rust/rust-source.inc
@@ -13,6 +13,7 @@ SRC_URI += "https://static.rust-lang.org/dist/rustc-${RUST_VERSION}-src.tar.xz;n
file://target-build-value.patch;patchdir=${RUSTSRC} \
file://0001-Handle-vendored-sources-when-remapping-paths.patch;patchdir=${RUSTSRC} \
file://repro-issue-fix-with-v175.patch;patchdir=${RUSTSRC} \
+ file://0001-cargo-do-not-write-host-information-into-compilation.patch;patchdir=${RUSTSRC} \
"
SRC_URI[rust.sha256sum] = "4526f786d673e4859ff2afa0bab2ba13c918b796519a25c1acce06dba9542340"
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12
2024-12-18 22:02 ` [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Steve Sakoman
@ 2024-12-19 4:04 ` Bruce Ashfield
2024-12-19 13:36 ` Steve Sakoman
0 siblings, 1 reply; 22+ messages in thread
From: Bruce Ashfield @ 2024-12-19 4:04 UTC (permalink / raw)
To: steve; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 5890 bytes --]
Please don't take this patch in this format.
Once I've approved and merged the changes into the kern-tools, there will
be a SRCREV update.
So this is a NACK/
Bruce
On Wed, Dec 18, 2024 at 5:02 PM Steve Sakoman via lists.openembedded.org
<steve=sakoman.com@lists.openembedded.org> wrote:
> From: Hongxu Jia <hongxu.jia@windriver.com>
>
> Python 3.12 emmits a SyntaxWarning when using unescaped
> character inside a RegEx string.
> '''
> recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid
> escape sequence '\.'
> if re.match( ".*\.config", opt ):
> recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid
> escape sequence '\w'
> x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel
> Configuration", line )
> recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid
> escape sequence '\s'
> if re.search( "^#\s*CONFIG_", option ):
> '''
>
> According to [1], use raw strings for regular expression
>
> [1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
>
> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> Signed-off-by: Steve Sakoman <steve@sakoman.com>
> ---
> ...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++++++++++++++
> .../kern-tools/kern-tools-native_git.bb | 4 +-
> 2 files changed, 63 insertions(+), 1 deletion(-)
> create mode 100644
> meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
>
> diff --git
> a/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
> b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
> new file mode 100644
> index 0000000000..e87067c8ac
> --- /dev/null
> +++
> b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
> @@ -0,0 +1,60 @@
> +From 1f64368e4e82e47cd0e0dfe37b0e1b8958566d21 Mon Sep 17 00:00:00 2001
> +From: Hongxu Jia <hongxu.jia@windriver.com>
> +Date: Tue, 17 Dec 2024 01:25:29 -0800
> +Subject: [PATCH] symbol_why: fix SyntaxWarning for RegEx calls on Python
> 3.12
> +
> +Python 3.12 emmits a SyntaxWarning when using unescaped
> +character inside a RegEx string.
> +'''
> +recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid
> escape sequence '\.'
> + if re.match( ".*\.config", opt ):
> +recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid
> escape sequence '\w'
> + x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel
> Configuration", line )
> +recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid
> escape sequence '\s'
> + if re.search( "^#\s*CONFIG_", option ):
> +'''
> +
> +According to [1], use raw strings for regular expression
> +
> +[1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
> +
> +Upstream-Status: Submitted [linux-yocto@lists.yoctoproject.org]
> +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> +---
> + tools/symbol_why.py | 6 +++---
> + 1 file changed, 3 insertions(+), 3 deletions(-)
> +
> +diff --git a/tools/symbol_why.py b/tools/symbol_why.py
> +index 326e84f..4864378 100755
> +--- a/tools/symbol_why.py
> ++++ b/tools/symbol_why.py
> +@@ -158,7 +158,7 @@ for opt in args.args:
> + elif re.match( "--ksrc=*", opt):
> + temp, ksrc = opt.split('=', 2)
> + else:
> +- if re.match( ".*\.config", opt ):
> ++ if re.match( r".*\.config", opt ):
> + dotconfig=opt
> + elif not ksrc:
> + ksrc=opt
> +@@ -213,7 +213,7 @@ if not os.getenv("KERNELVERSION"):
> + hconfig = open( dotconfig )
> + for line in hconfig:
> + line = line.rstrip()
> +- x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel
> Configuration", line )
> ++ x = re.match( r"^#
> .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
> + if x:
> + os.environ["KERNELVERSION"] = x.group(1)
> + if verbose:
> +@@ -492,7 +492,7 @@ def split_option( config_option_str ):
> + opt = m.group(1)
> + val = m.group(2)
> + except:
> +- if re.search( "^#\s*CONFIG_", option ):
> ++ if re.search( r"^#\s*CONFIG_", option ):
> + # print( "option is a is not set!!! %s" % option )
> + m = re.match(r"# (CONFIG_[^ ]+) is not set", option )
> + if m:
> +--
> +2.25.1
> +
> diff --git a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
> b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
> index 8eff00821a..7d11889eda 100644
> --- a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
> +++ b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
> @@ -16,7 +16,9 @@ PV = "0.3+git"
>
> inherit native
>
> -SRC_URI = "git://
> git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https"
> +SRC_URI = "git://
> git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https \
> +
> file://0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch \
> +"
> S = "${WORKDIR}/git"
>
> do_configure() {
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#208889):
> https://lists.openembedded.org/g/openembedded-core/message/208889
> Mute This Topic: https://lists.openembedded.org/mt/110188794/1050810
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
--
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II
[-- Attachment #2: Type: text/html, Size: 9273 bytes --]
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage
2024-12-18 22:02 ` [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage Steve Sakoman
@ 2024-12-19 9:16 ` Martin Jansa
0 siblings, 0 replies; 22+ messages in thread
From: Martin Jansa @ 2024-12-19 9:16 UTC (permalink / raw)
To: steve; +Cc: openembedded-core
Small reminder for people doing incremental builds and having
similarly short memory as me.
This might cause errors like:
error[E0464]: multiple candidates for `rmeta` dependency `core` found
|
= note: candidate #1:
lib32-python3-bcrypt/4.1.2/lib32-recipe-sysroot/usr/lib/rustlib/armv7-webosmllib32-linux-gnueabi/lib/libcore-0efa44efb479c482.rmeta
= note: candidate #2:
lib32-python3-bcrypt/4.1.2/lib32-recipe-sysroot/usr/lib/rustlib/armv7-webosmllib32-linux-gnueabi/lib/libcore-6dc2d356d81e0fd8.rmeta
in all recipes using rust.
If you see this, then easiest work around is to cleansstate libstd-rs
(lib32-libstd-rs with multilib) and all failing recipes and start
again. Ideally help to fix it properly.
From:
#yocto/2024-05-29.log
13:24 < JaMa> anyone seeing "error[E0464]: multiple candidates for
`rmeta` dependency `core` found" for various dependencies in rust
recipes (after the update from yesterday), libstd-rs now provides
multiple versions in incremental build (unless you explicitly rebuild
from scratch after -c cleansstate) kanavin_ have you seen this before?
13:24 < JaMa> buildhistory-diff -p buildhistory
13:24 < JaMa> packages/raspberrypi4_64-webos-linux/libstd-rs/libstd-rs-dev:
PKGSIZE changed from 304061571 to 160359626 (-47%)
13:24 < kanavin_> JaMa, incremental builds in rust are broken
13:25 < JaMa> whole buildhistory-diff after rebuilding with
cleansstate https://dpaste.com/EZGZ4PAYT
13:25 < kanavin_> it doesn't clean itself properly
13:25 < JaMa> ok, haven't seen this one before, so I guess I was lucky, thanks
13:36 < RP> kanavin_: do we know what isn't cleaned properly in the rust builds?
13:42 < kanavin_> RP: I'm not sure. If JaMa can provide a reproducer I
can take a look.
14:07 < JaMa> in my case today it was libstd-rs (I had to cleansstate
all its users as well after rebuilding it, but the culprint was
duplicated files installed and staged by libstd-rs)
14:08 < RP> I've seen this kind of issue before but couldn't reproduce it :/
14:09 < JaMa> I'll try, because I'm pretty sure I've built libstd-rs
from scratch yesterday and today it was rebuilt because of the last 4
commits currently in master (so I guess if I checkout HEAD~5, build
libstd-rs, checkout master, build it again than I might see the issue)
14:28 < JaMa> hmm this trivial reproducer didn't work
14:29 < JaMa> libstd-rs-1.75.0-r0 was rebuilt from do_fetch after
updating oe-core (and cleaning dirs while doing so)
14:58 < RP> JaMa: sounds like what I ran into last time :/
Cheers,
On Wed, Dec 18, 2024 at 11:03 PM Steve Sakoman via
lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
wrote:
>
> From: Alexander Kanavin <alex@linutronix.de>
>
> [YOCTO #15185]
>
> Signed-off-by: Alexander Kanavin <alex@linutronix.de>
> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> (cherry picked from commit 924df18b47e9a69fa295bafe37bdb39d8eaea2bb)
> Signed-off-by: Steve Sakoman <steve@sakoman.com>
> ---
> ...te-host-information-into-compilation.patch | 51 +++++++++++++++++++
> meta/recipes-devtools/rust/rust-source.inc | 1 +
> 2 files changed, 52 insertions(+)
> create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
>
> diff --git a/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch b/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
> new file mode 100644
> index 0000000000..a6ee867605
> --- /dev/null
> +++ b/meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
> @@ -0,0 +1,51 @@
> +From 065d7c263091118437465d714d8a29dbb6296921 Mon Sep 17 00:00:00 2001
> +From: Alexander Kanavin <alex@linutronix.de>
> +Date: Mon, 13 May 2024 14:57:54 +0200
> +Subject: [PATCH] cargo: do not write host information into compilation unit
> + hashes
> +
> +This breaks reproducibility in cross-builds where the cross-target
> +can be the same, but build hosts are different, as seen with
> +"rustc --version -v":
> +...
> +host: x86_64-unknown-linux-gnu
> +
> +vs.
> +
> +host: aarch64-unknown-linux-gnu
> +
> +This can possibly be improved by only hashing host info if the build
> +is a native one (e.g. there's no --target option passed to cargo
> +invocation) but I'm not sure how.
> +
> +Upstream-Status: Inappropriate [reported at https://github.com/rust-lang/cargo/issues/13922]
> +Signed-off-by: Alexander Kanavin <alex@linutronix.de>
> +---
> + .../src/cargo/core/compiler/context/compilation_files.rs | 4 ++--
> + 1 file changed, 2 insertions(+), 2 deletions(-)
> +
> +diff --git a/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs b/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
> +index d83dbf10c..b2ad8d9f3 100644
> +--- a/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
> ++++ b/src/tools/cargo/src/cargo/core/compiler/context/compilation_files.rs
> +@@ -652,7 +652,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher) {
> + if vers.pre.is_empty() || bcx.config.cli_unstable().separate_nightlies {
> + // For stable, keep the artifacts separate. This helps if someone is
> + // testing multiple versions, to avoid recompiles.
> +- bcx.rustc().verbose_version.hash(hasher);
> ++ //bcx.rustc().verbose_version.hash(hasher);
> + return;
> + }
> + // On "nightly"/"beta"/"dev"/etc, keep each "channel" separate. Don't hash
> +@@ -665,7 +665,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher) {
> + // Keep "host" since some people switch hosts to implicitly change
> + // targets, (like gnu vs musl or gnu vs msvc). In the future, we may want
> + // to consider hashing `unit.kind.short_name()` instead.
> +- bcx.rustc().host.hash(hasher);
> ++ //bcx.rustc().host.hash(hasher);
> + // None of the other lines are important. Currently they are:
> + // binary: rustc <-- or "rustdoc"
> + // commit-hash: 38114ff16e7856f98b2b4be7ab4cd29b38bed59a
> +--
> +2.39.2
> +
> diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc
> index 8a8e48b8ca..55ea1b77e6 100644
> --- a/meta/recipes-devtools/rust/rust-source.inc
> +++ b/meta/recipes-devtools/rust/rust-source.inc
> @@ -13,6 +13,7 @@ SRC_URI += "https://static.rust-lang.org/dist/rustc-${RUST_VERSION}-src.tar.xz;n
> file://target-build-value.patch;patchdir=${RUSTSRC} \
> file://0001-Handle-vendored-sources-when-remapping-paths.patch;patchdir=${RUSTSRC} \
> file://repro-issue-fix-with-v175.patch;patchdir=${RUSTSRC} \
> + file://0001-cargo-do-not-write-host-information-into-compilation.patch;patchdir=${RUSTSRC} \
> "
> SRC_URI[rust.sha256sum] = "4526f786d673e4859ff2afa0bab2ba13c918b796519a25c1acce06dba9542340"
>
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#208890): https://lists.openembedded.org/g/openembedded-core/message/208890
> Mute This Topic: https://lists.openembedded.org/mt/110188795/3617156
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [martin.jansa@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12
2024-12-19 4:04 ` Bruce Ashfield
@ 2024-12-19 13:36 ` Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2024-12-19 13:36 UTC (permalink / raw)
To: Bruce Ashfield; +Cc: openembedded-core
On Wed, Dec 18, 2024 at 8:04 PM Bruce Ashfield <bruce.ashfield@gmail.com> wrote:
>
> Please don't take this patch in this format.
>
> Once I've approved and merged the changes into the kern-tools, there will
> be a SRCREV update.
>
> So this is a NACK/
Got it! Thanks for reviewing.
Steve
> On Wed, Dec 18, 2024 at 5:02 PM Steve Sakoman via lists.openembedded.org <steve=sakoman.com@lists.openembedded.org> wrote:
>>
>> From: Hongxu Jia <hongxu.jia@windriver.com>
>>
>> Python 3.12 emmits a SyntaxWarning when using unescaped
>> character inside a RegEx string.
>> '''
>> recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid escape sequence '\.'
>> if re.match( ".*\.config", opt ):
>> recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid escape sequence '\w'
>> x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
>> recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid escape sequence '\s'
>> if re.search( "^#\s*CONFIG_", option ):
>> '''
>>
>> According to [1], use raw strings for regular expression
>>
>> [1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
>>
>> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
>> Signed-off-by: Steve Sakoman <steve@sakoman.com>
>> ---
>> ...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++++++++++++++
>> .../kern-tools/kern-tools-native_git.bb | 4 +-
>> 2 files changed, 63 insertions(+), 1 deletion(-)
>> create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
>>
>> diff --git a/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
>> new file mode 100644
>> index 0000000000..e87067c8ac
>> --- /dev/null
>> +++ b/meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
>> @@ -0,0 +1,60 @@
>> +From 1f64368e4e82e47cd0e0dfe37b0e1b8958566d21 Mon Sep 17 00:00:00 2001
>> +From: Hongxu Jia <hongxu.jia@windriver.com>
>> +Date: Tue, 17 Dec 2024 01:25:29 -0800
>> +Subject: [PATCH] symbol_why: fix SyntaxWarning for RegEx calls on Python 3.12
>> +
>> +Python 3.12 emmits a SyntaxWarning when using unescaped
>> +character inside a RegEx string.
>> +'''
>> +recipe-sysroot-native/usr/bin/symbol_why.py:161: SyntaxWarning: invalid escape sequence '\.'
>> + if re.match( ".*\.config", opt ):
>> +recipe-sysroot-native/usr/bin/symbol_why.py:216: SyntaxWarning: invalid escape sequence '\w'
>> + x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
>> +recipe-sysroot-native/usr/bin/symbol_why.py:495: SyntaxWarning: invalid escape sequence '\s'
>> + if re.search( "^#\s*CONFIG_", option ):
>> +'''
>> +
>> +According to [1], use raw strings for regular expression
>> +
>> +[1] https://docs.python.org/dev/whatsnew/3.12.html#other-language-changes
>> +
>> +Upstream-Status: Submitted [linux-yocto@lists.yoctoproject.org]
>> +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
>> +---
>> + tools/symbol_why.py | 6 +++---
>> + 1 file changed, 3 insertions(+), 3 deletions(-)
>> +
>> +diff --git a/tools/symbol_why.py b/tools/symbol_why.py
>> +index 326e84f..4864378 100755
>> +--- a/tools/symbol_why.py
>> ++++ b/tools/symbol_why.py
>> +@@ -158,7 +158,7 @@ for opt in args.args:
>> + elif re.match( "--ksrc=*", opt):
>> + temp, ksrc = opt.split('=', 2)
>> + else:
>> +- if re.match( ".*\.config", opt ):
>> ++ if re.match( r".*\.config", opt ):
>> + dotconfig=opt
>> + elif not ksrc:
>> + ksrc=opt
>> +@@ -213,7 +213,7 @@ if not os.getenv("KERNELVERSION"):
>> + hconfig = open( dotconfig )
>> + for line in hconfig:
>> + line = line.rstrip()
>> +- x = re.match( "^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
>> ++ x = re.match( r"^# .*Linux/\w*\s*([0-9]*\.[0-9]*\.[0-9]*).*Kernel Configuration", line )
>> + if x:
>> + os.environ["KERNELVERSION"] = x.group(1)
>> + if verbose:
>> +@@ -492,7 +492,7 @@ def split_option( config_option_str ):
>> + opt = m.group(1)
>> + val = m.group(2)
>> + except:
>> +- if re.search( "^#\s*CONFIG_", option ):
>> ++ if re.search( r"^#\s*CONFIG_", option ):
>> + # print( "option is a is not set!!! %s" % option )
>> + m = re.match(r"# (CONFIG_[^ ]+) is not set", option )
>> + if m:
>> +--
>> +2.25.1
>> +
>> diff --git a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
>> index 8eff00821a..7d11889eda 100644
>> --- a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
>> +++ b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
>> @@ -16,7 +16,9 @@ PV = "0.3+git"
>>
>> inherit native
>>
>> -SRC_URI = "git://git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https"
>> +SRC_URI = "git://git.yoctoproject.org/yocto-kernel-tools.git;branch=master;protocol=https \
>> + file://0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch \
>> +"
>> S = "${WORKDIR}/git"
>>
>> do_configure() {
>> --
>> 2.34.1
>>
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#208889): https://lists.openembedded.org/g/openembedded-core/message/208889
>> Mute This Topic: https://lists.openembedded.org/mt/110188794/1050810
>> Group Owner: openembedded-core+owner@lists.openembedded.org
>> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [bruce.ashfield@gmail.com]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
>
>
> --
> - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-02-25 20:56 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, February 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1081
The following changes since commit fc46705cc629a151f85717a57f7d789de8fd9b64:
icu: remove host references in nativesdk to fix reproducibility (2025-02-19 06:28:10 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Etienne Cordonnier (1):
python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES
Hitendra Prajapati (1):
libcap: fix CVE-2025-1390
Hongxu Jia (6):
u-boot: fix CVE-2024-57254
u-boot: fix CVE-2024-57255
u-boot: fix CVE-2024-57256
u-boot: fix CVE-2024-57257
u-boot: fix CVE-2024-57258
u-boot: fix CVE-2024-57259
Peter Marko (1):
libxml2: upgrade 2.12.9 -> 2.12.10
Vijay Anusuri (1):
bind: Upgrade 9.18.28 -> 9.18.33
.../u-boot/files/CVE-2024-57254.patch | 47 ++++
.../u-boot/files/CVE-2024-57255.patch | 53 ++++
.../u-boot/files/CVE-2024-57256.patch | 51 ++++
.../u-boot/files/CVE-2024-57257.patch | 227 ++++++++++++++++++
.../u-boot/files/CVE-2024-57258-1.patch | 47 ++++
.../u-boot/files/CVE-2024-57258-2.patch | 43 ++++
.../u-boot/files/CVE-2024-57258-3.patch | 40 +++
.../u-boot/files/CVE-2024-57259.patch | 41 ++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 11 +-
.../bind/{bind_9.18.28.bb => bind_9.18.33.bb} | 2 +-
.../{libxml2_2.12.9.bb => libxml2_2.12.10.bb} | 2 +-
...0001-respect-GIT_CEILING_DIRECTORIES.patch | 36 +++
.../python/python3-setuptools-scm_8.0.4.bb | 1 +
.../libcap/files/CVE-2025-1390.patch | 36 +++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
15 files changed, 635 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
rename meta/recipes-connectivity/bind/{bind_9.18.28.bb => bind_9.18.33.bb} (97%)
rename meta/recipes-core/libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} (97%)
create mode 100644 meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2025-1390.patch
--
2.43.0
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-03-27 19:44 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2025-03-27 19:44 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Monday, March 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1283
The following changes since commit a720df7ad77af1f8b1c00a211c88537e5f23edbc:
nativesdk-libtool: sanitize the script, remove buildpaths (2025-03-20 12:51:41 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Bruce Ashfield (6):
linux-yocto/6.6: update to v6.6.77
linux-yocto/6.6: update to v6.6.78
linux-yocto/6.6: update to v6.6.80
linux-yocto/6.6: update to v6.6.82
linux-yocto/6.6: update to v6.6.83
linux-yocto/6.6: update to v6.6.84
Divya Chellam (1):
ruby: fix CVE-2025-27220
Madhu Marri (1):
qemu 8.2.7: ignore CVE-2023-1386
Stefan Mueller-Klieser (1):
kernel-arch: add macro-prefix-map in KERNEL_CC
Vijay Anusuri (1):
vim: Upgrade 9.1.1115 -> 9.1.1198
meta/classes-recipe/kernel-arch.bbclass | 8 +-
meta/recipes-devtools/qemu/qemu.inc | 2 +
.../ruby/ruby/CVE-2025-27220.patch | 78 +++++++++++++++++++
meta/recipes-devtools/ruby/ruby_3.3.5.bb | 1 +
.../linux/linux-yocto-rt_6.6.bb | 6 +-
.../linux/linux-yocto-tiny_6.6.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++----
meta/recipes-support/vim/vim.inc | 4 +-
8 files changed, 110 insertions(+), 23 deletions(-)
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch
--
2.43.0
^ permalink raw reply [flat|nested] 22+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-08-19 20:07 Steve Sakoman
0 siblings, 0 replies; 22+ messages in thread
From: Steve Sakoman @ 2025-08-19 20:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, August 21
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2234
The following changes since commit fa45d6d5bec8fe503ff6b9166a3b4af31ea95369:
go-helloworld: fix license (2025-08-14 07:34:07 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Daniel Turull (2):
xz: ignore CVE-2024-47611
libxml2: ignore CVE-2025-8732
Khem Raj (3):
e2fsprogs: Fix build failure with gcc 15
parted: Fix build with GCC 15
bash: Stick to C17 std
Martin Jansa (2):
cairo: fix build with gcc-15 on host
bash: use -std=gnu17 also for native CFLAGS
Peter Marko (2):
dropbear: patch CVE-2025-47203
glib-2.0: ignore CVE-2025-4056
Philip Lorenz (1):
cve-check: Add missing call to exit_if_errors
meta/classes/cve-check.bbclass | 1 +
...iable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch | 27 ++
...-length-paths-and-commands-in-multih.patch | 63 +++
...and-also-forward-this-when-multihop-.patch | 81 ++++
...add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch | 29 ++
.../dropbear/dropbear/CVE-2025-47203.patch | 367 ++++++++++++++++++
.../recipes-core/dropbear/dropbear_2022.83.bb | 5 +
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 +
meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 +
...-libext2fs-fix-std-c23-build-failure.patch | 42 ++
.../e2fsprogs/e2fsprogs_1.47.0.bb | 1 +
meta/recipes-extended/bash/bash_5.2.21.bb | 5 +
...CH-parted-fix-do_version-declaration.patch | 40 ++
meta/recipes-extended/parted/parted_3.6.bb | 1 +
meta/recipes-extended/xz/xz_5.4.7.bb | 2 +
.../cairo/cairo/0001-Require-C11.patch | 25 ++
.../cairo/cairo/0002-Meson-Require-C-11.patch | 22 ++
meta/recipes-graphics/cairo/cairo_1.18.0.bb | 2 +
18 files changed, 719 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-add-o-BatchMode-and-also-forward-this-when-multihop-.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2025-47203.patch
create mode 100644 meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-std-c23-build-failure.patch
create mode 100644 meta/recipes-extended/parted/files/0001-bug-74444-PATCH-parted-fix-do_version-declaration.patch
create mode 100644 meta/recipes-graphics/cairo/cairo/0001-Require-C11.patch
create mode 100644 meta/recipes-graphics/cairo/cairo/0002-Meson-Require-C-11.patch
--
2.43.0
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2025-08-19 20:08 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-18 22:02 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 01/10] binutils: Fix CVE-2024-53589 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 02/10] subversion: fix CVE-2024-46901 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 03/10] ffmpeg: fix CVE-2024-35366 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 04/10] ffmpeg: fix CVE-2024-35367 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 05/10] ffmpeg: fix CVE-2024-35368 Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 06/10] gcc: Fix c++: tweak for Wrange-loop-construct Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 07/10] python3: Drop empty patch Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 08/10] python3: add dependency on -compression to -core Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 09/10] kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Steve Sakoman
2024-12-19 4:04 ` Bruce Ashfield
2024-12-19 13:36 ` Steve Sakoman
2024-12-18 22:02 ` [OE-core][scarthgap 10/10] rust: add reproducibility patch to eliminate host leakage Steve Sakoman
2024-12-19 9:16 ` Martin Jansa
-- strict thread matches above, loose matches on Subject: below --
2025-08-19 20:07 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2025-03-27 19:44 Steve Sakoman
2025-02-25 20:56 Steve Sakoman
2024-11-07 3:37 Steve Sakoman
2024-10-07 1:54 Steve Sakoman
2024-10-07 3:23 ` Khem Raj
2024-08-08 2:28 Steve Sakoman
2024-06-11 13:07 Steve Sakoman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.