[meta-security][PATCH 0/4] Assorted updates 01/07

[meta-security][PATCH 0/4] Assorted updates 01/07

[Scott Murray]

This patch series rolls up the contributed patches from the past few weeks,
plus some clean up changes from myself.  These changes are queued on the
master-next branch if you would like to check them out to test yourself.
I intend to merge these to master branch at end of day tomorrow (Eastern
Time, Jan. 8) unless there are objections.

I have not yet created the whinlatter branch due to some distractions over the
holidays, but that should happen by tomorrow as well now that some CI hiccups
have been fixed up.

Scott


Changes:

Clayton Casciato (2):
  suricata: drop trailing whitespace
  suricata: update PACKAGECONFIG[jansson] option to required

Scott Murray (2):
  meta-parsec: Remove meta-clang dependency
  Update kas configuration

 kas/kas-security-alt.yml                |  2 +-
 kas/kas-security-base.yml               | 18 +++++++++---------
 kas/kas-security-dm.yml                 |  2 +-
 kas/kas-security-parsec.yml             |  6 +-----
 meta-parsec/README.md                   |  6 ++----
 meta-parsec/conf/layer.conf             |  2 +-
 recipes-ids/suricata/suricata_7.0.13.bb | 20 +++++++++++---------
 7 files changed, 26 insertions(+), 30 deletions(-)

-- 
2.51.0

[meta-security][PATCH 1/4] suricata: drop trailing whitespace

[Scott Murray]

From: Clayton Casciato <majortomtosourcecontrol@gmail.com>

Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 recipes-ids/suricata/suricata_7.0.13.bb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/recipes-ids/suricata/suricata_7.0.13.bb b/recipes-ids/suricata/suricata_7.0.13.bb
index 0635bf3..7298f1b 100644
--- a/recipes-ids/suricata/suricata_7.0.13.bb
+++ b/recipes-ids/suricata/suricata_7.0.13.bb
@@ -40,18 +40,18 @@ B = "${S}"
 PACKAGECONFIG ??= "jansson file pcre2 yaml python pcap cap-ng net"
 PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}"
 
-PACKAGECONFIG[pcre2] = "--with-libpcre2-includes=${STAGING_INCDIR} --with-libpcre2-libraries=${STAGING_LIBDIR}, ,libpcre2 ," 
+PACKAGECONFIG[pcre2] = "--with-libpcre2-includes=${STAGING_INCDIR} --with-libpcre2-libraries=${STAGING_LIBDIR}, ,libpcre2 ,"
 PACKAGECONFIG[yaml] = "--with-libyaml-includes=${STAGING_INCDIR} --with-libyaml-libraries=${STAGING_LIBDIR}, ,libyaml ,"
-PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-libraries=${STAGING_LIBDIR}, ,libpcap" 
+PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-libraries=${STAGING_LIBDIR}, ,libpcap"
 PACKAGECONFIG[cap-ng] = "--with-libcap_ng-includes=${STAGING_INCDIR} --with-libcap_ng-libraries=${STAGING_LIBDIR}, ,libcap-ng , "
-PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet," 
+PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet,"
 PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ,"
 PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue,"
 
 PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson"
 PACKAGECONFIG[file] = ",,file, file"
-PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3-core" 
-PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests," 
+PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3-core"
+PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests,"
 
 export logdir = "${localstatedir}/log"
 
@@ -81,7 +81,7 @@ oe_cargo_build () {
 }
 
 do_compile () {
-    # we do this to bypass the make provided by this pkg 
+    # we do this to bypass the make provided by this pkg
     # patches Makefile to skip the subdir
     cargo_do_compile
 
-- 
2.51.0

[meta-security][PATCH 2/4] suricata: update PACKAGECONFIG[jansson] option to required

[Scott Murray]

From: Clayton Casciato <majortomtosourcecontrol@gmail.com>

jansson is required as of Suricata 5.0:
https://github.com/OISF/suricata/commit/e49c40428e1b9f7e5dcdb5857c3978d5cb859fd9

This is still required in the latest release:
https://github.com/OISF/suricata/blob/suricata-8.0.2/configure.ac#L828

On exclusion attempt:
[...]
| checking for jansson.h... no
| checking for json_dump_callback in -ljansson... no
|
|     ERROR: Jansson is now required.
|
|     Go get it from your distribution or from:
|       http://www.digip.org/jansson/
|
|     Ubuntu/Debian: apt install libjansson-dev
|     CentOS: yum install jansson-devel
|     Fedora: dnf install jansson-devel
|
| NOTE: The following config.log files may provide further information.
| NOTE: [...]/poky-whinlatter/build/tmp/work/cortexa57-poky-linux/suricata/7.0.13/sources/suricata-7.0.13/config.log
| ERROR: configure failed
| WARNING: exit code 1 from a shell command.
ERROR: Task ([...]/poky-whinlatter/layers/meta-security/recipes-ids/suricata/suricata_7.0.13.bb:do_configure) failed with exit code '1'

Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 recipes-ids/suricata/suricata_7.0.13.bb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/recipes-ids/suricata/suricata_7.0.13.bb b/recipes-ids/suricata/suricata_7.0.13.bb
index 7298f1b..469e42d 100644
--- a/recipes-ids/suricata/suricata_7.0.13.bb
+++ b/recipes-ids/suricata/suricata_7.0.13.bb
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd
 SRC_URI = "http://www.openinfosecfoundation.org/download/suricata-${PV}.tar.gz"
 SRC_URI[sha256sum] = "bbc94cf0a297f4560c64569ed72867c799287defdaf6e6572ce769f48dd2559b"
 
-DEPENDS = "lz4 libhtp"
+DEPENDS = "jansson lz4 libhtp"
 
 SRC_URI += " \
     file://volatiles.03_suricata \
@@ -27,6 +27,7 @@ EXTRA_OECONF += " --disable-debug \
     --enable-non-bundled-htp \
     --disable-suricata-update \
     --with-libhtp-includes=${STAGING_INCDIR} --with-libhtp-libraries=${STAGING_LIBDIR} \
+    --with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR} \
     "
 
 CARGO_SRC_DIR = "rust"
@@ -37,7 +38,7 @@ CARGO_BUILD_FLAGS:append = " --offline"
 B = "${S}"
 
 # nfnetlink has a dependancy to meta-networking
-PACKAGECONFIG ??= "jansson file pcre2 yaml python pcap cap-ng net"
+PACKAGECONFIG ??= "file pcre2 yaml python pcap cap-ng net"
 PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}"
 
 PACKAGECONFIG[pcre2] = "--with-libpcre2-includes=${STAGING_INCDIR} --with-libpcre2-libraries=${STAGING_LIBDIR}, ,libpcre2 ,"
@@ -48,7 +49,6 @@ PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-lib
 PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ,"
 PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue,"
 
-PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson"
 PACKAGECONFIG[file] = ",,file, file"
 PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3-core"
 PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests,"
@@ -138,4 +138,6 @@ PACKAGES =+ "${PN}-python"
 FILES:${PN} += "${systemd_unitdir} ${sysconfdir}/tmpfiles.d"
 FILES:${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
 
+RDEPENDS:${PN} += "jansson"
+
 CONFFILES:${PN} = "${sysconfdir}/suricata/suricata.yaml"
-- 
2.51.0

[meta-security][PATCH 3/4] meta-parsec: Remove meta-clang dependency

[Scott Murray]

Since clang is in openembedded-core now, meta-parsec no longer needs
meta-clang.  Also updated maintainers in meta-parsec README.md since
it had previously been missed.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 kas/kas-security-parsec.yml | 4 ----
 meta-parsec/README.md       | 6 ++----
 meta-parsec/conf/layer.conf | 2 +-
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/kas/kas-security-parsec.yml b/kas/kas-security-parsec.yml
index 9a009be..c44a280 100644
--- a/kas/kas-security-parsec.yml
+++ b/kas/kas-security-parsec.yml
@@ -8,10 +8,6 @@ repos:
     layers:
       meta-parsec:
 
-  meta-clang:
-    url: https://github.com/kraj/meta-clang.git
-    refspec: master
-
 local_conf_header:
   meta-parsec: |
     IMAGE_INSTALL:append = " parsec-service parsec-tool"
diff --git a/meta-parsec/README.md b/meta-parsec/README.md
index a5472ae..913bba7 100644
--- a/meta-parsec/README.md
+++ b/meta-parsec/README.md
@@ -14,9 +14,6 @@ This layer depends on:
     URI git://git.yoctoproject.org/meta-security
     branch: master
 
-    URI https://github.com/kraj/meta-clang.git
-    branch: master
-
 Adding the meta-parsec layer to your build
 ==========================================
 
@@ -32,7 +29,6 @@ other layers needed. e.g.:
       /path/to/yocto/meta-yocto-bsp \
       /path/to/meta-openembedded/meta-oe \
       /path/to/meta-openembedded/meta-python \
-      /path/to/meta-clang \
       /path/to/meta-security/meta-tpm \
       /path/to/meta-security/meta-parsec \
       "
@@ -257,6 +253,8 @@ $ git config format.subjectPrefix meta-parsec][PATCH
 Now you can just do 'git send-email origin/master' to send all local patches.
 
 Maintainers:    Anton Antonov <Anton.Antonov@arm.com>
+                Scott Murray <scott.murray@konsulko.com>
+                Marta Rybczynska <rybczynska@gmail.com>
 
 
 License
diff --git a/meta-parsec/conf/layer.conf b/meta-parsec/conf/layer.conf
index 29a8f11..39d1265 100644
--- a/meta-parsec/conf/layer.conf
+++ b/meta-parsec/conf/layer.conf
@@ -10,7 +10,7 @@ BBFILE_PRIORITY_parsec-layer = "5"
 
 LAYERSERIES_COMPAT_parsec-layer = "whinlatter walnascar scarthgap"
 
-LAYERDEPENDS_parsec-layer = "core clang-layer"
+LAYERDEPENDS_parsec-layer = "core"
 BBLAYERS_LAYERINDEX_NAME_parsec-layer = "meta-parsec"
 
 addpylib ${LAYERDIR}/lib oeqa
-- 
2.51.0

[meta-security][PATCH 4/4] Update kas configuration

[Scott Murray]

Changes to catch up with current kas and future-proof a bit:
* Update the kas configuration file versions to 19 to match kas 4.8.x.
* Change refspec to branch to remove deprecation warnings.
* Add quoting around URLs to match upstream examples.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 kas/kas-security-alt.yml    |  2 +-
 kas/kas-security-base.yml   | 18 +++++++++---------
 kas/kas-security-dm.yml     |  2 +-
 kas/kas-security-parsec.yml |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/kas/kas-security-alt.yml b/kas/kas-security-alt.yml
index 8f754ac..2a449c5 100644
--- a/kas/kas-security-alt.yml
+++ b/kas/kas-security-alt.yml
@@ -1,5 +1,5 @@
 header:
-    version: 9
+    version: 19
     includes: 
         - kas-security-base.yml
 
diff --git a/kas/kas-security-base.yml b/kas/kas-security-base.yml
index 8954896..2ab81aa 100644
--- a/kas/kas-security-base.yml
+++ b/kas/kas-security-base.yml
@@ -1,5 +1,5 @@
 header:
-  version: 9
+  version: 19
 
 distro: poky
 
@@ -12,27 +12,27 @@ repos:
       meta-hardening:
 
   bitbake:
-    url: https://git.openembedded.org/bitbake
-    refspec: master
+    url: "https://git.openembedded.org/bitbake"
+    branch: master
     layers:
       .: disabled
 
   openembedded-core:
-    url: https://git.openembedded.org/openembedded-core
-    refspec: master
+    url: "https://git.openembedded.org/openembedded-core"
+    branch: master
     layers:
       meta:
 
   poky:
-    url: https://git.yoctoproject.org/git/meta-yocto
-    refspec: master
+    url: "https://git.yoctoproject.org/git/meta-yocto"
+    branch: master
     layers:
       meta-poky:
       meta-yocto-bsp:
 
   meta-openembedded:
-    url: http://git.openembedded.org/meta-openembedded
-    refspec: master
+    url: "http://git.openembedded.org/meta-openembedded"
+    branch: master
     layers:
       meta-oe:
       meta-perl:
diff --git a/kas/kas-security-dm.yml b/kas/kas-security-dm.yml
index c03b336..fe74d25 100644
--- a/kas/kas-security-dm.yml
+++ b/kas/kas-security-dm.yml
@@ -1,5 +1,5 @@
 header:
-    version: 9
+    version: 19
     includes: 
         - kas-security-base.yml
 
diff --git a/kas/kas-security-parsec.yml b/kas/kas-security-parsec.yml
index c44a280..54bf96e 100644
--- a/kas/kas-security-parsec.yml
+++ b/kas/kas-security-parsec.yml
@@ -1,5 +1,5 @@
 header:
-    version: 9
+    version: 19
     includes:
         - kas-security-base.yml
 
-- 
2.51.0