[meta-security][PATCH 0/4] Assorted updates 11/02

[meta-security][PATCH 0/4] Assorted updates 11/02

[Scott Murray]

This got a bit hung up a bit getting through CI, there are a couple
of recently submitted fixes, as well as a couple of build fixes
from myself.  I have pushed them to master-next if you want to try
them locally, and plan to merge to master by end of day tomorrow
(11/03, EST) if there are no objections.

Scott


Changes:

Leonard Anderweit (1):
  tpm2-tss: update to 4.2.0

Scott Murray (3):
  ding-libs: update to 0.7.0
  swtpm: Add missing useradd inherit
  python3-tpm2-pytss: Upgrade 2.3.0 -> 3.0.0

 meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb    |  2 +-
 ...0001-Handle-CC-values-with-arguments.patch | 51 +++++++++++++++++++
 ...s_2.3.0.bb => python3-tpm2-pytss_3.0.0.bb} |  5 +-
 .../tpm2-tss/tpm2-tss/fixup_hosttools.patch   | 13 ++---
 .../{tpm2-tss_4.1.3.bb => tpm2-tss_4.2.0.bb}  |  4 +-
 recipes-security/ding-libs/ding-libs_0.7.0.bb | 11 ++++
 recipes-security/libdhash/ding-libs_0.6.1.bb  | 12 -----
 7 files changed, 74 insertions(+), 24 deletions(-)
 create mode 100644 meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss/0001-Handle-CC-values-with-arguments.patch
 rename meta-tpm/recipes-tpm2/tpm2-pytss/{python3-tpm2-pytss_2.3.0.bb => python3-tpm2-pytss_3.0.0.bb} (80%)
 rename meta-tpm/recipes-tpm2/tpm2-tss/{tpm2-tss_4.1.3.bb => tpm2-tss_4.2.0.bb} (94%)
 create mode 100644 recipes-security/ding-libs/ding-libs_0.7.0.bb
 delete mode 100644 recipes-security/libdhash/ding-libs_0.6.1.bb

-- 
2.47.3

[meta-security][PATCH 1/4] ding-libs: update to 0.7.0

[Scott Murray]

The download URL being used for a ding-libs 0.6.1 tarfile is no
longer valid, so update to 0.7.0 using the actual upstream location
on github.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 recipes-security/ding-libs/ding-libs_0.7.0.bb | 11 +++++++++++
 recipes-security/libdhash/ding-libs_0.6.1.bb  | 12 ------------
 2 files changed, 11 insertions(+), 12 deletions(-)
 create mode 100644 recipes-security/ding-libs/ding-libs_0.7.0.bb
 delete mode 100644 recipes-security/libdhash/ding-libs_0.6.1.bb

diff --git a/recipes-security/ding-libs/ding-libs_0.7.0.bb b/recipes-security/ding-libs/ding-libs_0.7.0.bb
new file mode 100644
index 0000000..ba612ab
--- /dev/null
+++ b/recipes-security/ding-libs/ding-libs_0.7.0.bb
@@ -0,0 +1,11 @@
+SUMMARY = "'DING is not GNU' helper libraries for SSSD and FreeIPA"
+HOMEPAGE = "https://github.com/SSSD/ding-libs"
+SECTION = "base"
+LICENSE = "GPL-3.0-or-later AND LGPL-3.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
+
+SRC_URI = "https://github.com/SSSD/${BPN}/releases/download/${PV}/${BP}.tar.gz"
+
+inherit autotools pkgconfig gettext
+
+SRC_URI[sha256sum] = "5df2f202f892b4c1a6caf87f0056398a8288b281da9d7e65cd7637978ec20ef3"
diff --git a/recipes-security/libdhash/ding-libs_0.6.1.bb b/recipes-security/libdhash/ding-libs_0.6.1.bb
deleted file mode 100644
index 843850f..0000000
--- a/recipes-security/libdhash/ding-libs_0.6.1.bb
+++ /dev/null
@@ -1,12 +0,0 @@
-SUMMARY = "Dynamic hash table implementation"
-DESCRIPTION = "Dynamic hash table implementation"
-HOMEPAGE = "https://fedorahosted.org/released/ding-libs"
-SECTION = "base"
-LICENSE = "GPL-3.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
-
-SRC_URI = "https://fedorahosted.org/released/${BPN}/${BP}.tar.gz"
-
-inherit autotools pkgconfig
-
-SRC_URI[sha256sum] = "a319a327deb81f2dfab9ce4a4926e80e1dac5dcfc89f4c7e548cec2645af27c1"
-- 
2.47.3

[meta-security][PATCH 2/4] swtpm: Add missing useradd inherit

[Scott Murray]

The swtpm recipe has USERADD and GROUPADD definitions, but has never
inherited the useradd bbclass, fix that.

Reported-by: Ehsan Emami <ehsan@emami.net>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb b/meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb
index 8472f02..8488d01 100644
--- a/meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb
+++ b/meta-tpm/recipes-tpm/swtpm/swtpm_0.10.0.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://github.com/stefanberger/swtpm.git;branch=stable-0.10;protocol=h
 PE = "2"
 
 PARALLEL_MAKE = ""
-inherit autotools pkgconfig perlnative
+inherit autotools pkgconfig perlnative useradd
 
 TSS_USER = "tss"
 TSS_GROUP = "tss"
-- 
2.47.3

[meta-security][PATCH 3/4] tpm2-tss: update to 4.2.0

[Scott Murray]

From: Leonard Anderweit <L.Anderweit@phytec.de>

Update to version 4.2.0 and rebase the patch accordingly.
Also, remove the CVE_STATUS for CVE-2024-29040 because it is now
properly detected as fixed.

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 .../tpm2-tss/tpm2-tss/fixup_hosttools.patch         | 13 +++++++------
 .../{tpm2-tss_4.1.3.bb => tpm2-tss_4.2.0.bb}        |  4 +---
 2 files changed, 8 insertions(+), 9 deletions(-)
 rename meta-tpm/recipes-tpm2/tpm2-tss/{tpm2-tss_4.1.3.bb => tpm2-tss_4.2.0.bb} (94%)

diff --git a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/fixup_hosttools.patch b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/fixup_hosttools.patch
index 8822d1b..798a0c7 100644
--- a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/fixup_hosttools.patch
+++ b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/fixup_hosttools.patch
@@ -1,4 +1,4 @@
-From ab120a9642516cdfdae5c5b8a91e42e2c9898172 Mon Sep 17 00:00:00 2001
+From 8913c8c4b207ae6dfd3ae58d886e2074d53cc268 Mon Sep 17 00:00:00 2001
 From: Valentin Kunin <kunin@google.com>
 Date: Mon, 20 May 2024 21:09:27 +0000
 Subject: [PATCH] revert configure: add checks for all tools used by make
@@ -15,10 +15,10 @@ Signed-off-by: Valentin Kunin <kunin@google.com>
  1 file changed, 11 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index eb6051ea..a52c4725 100644
+index 4a1f1b022772..5a745e9c5c22 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -663,17 +663,6 @@ AM_CONDITIONAL([SYSD_SYSUSERS], [test "x$systemd_sysusers" = "xyes" && test "x$s
+@@ -658,17 +658,6 @@ AM_CONDITIONAL([SYSD_SYSUSERS], [test "x$systemd_sysusers" = "xyes" && test "x$s
  AC_CHECK_PROG(systemd_tmpfiles, systemd-tmpfiles, yes)
  AM_CONDITIONAL([SYSD_TMPFILES], [test "x$systemd_tmpfiles" = "xyes" && test "x$tmpfilesdir" != "xno"])
  
@@ -29,12 +29,13 @@ index eb6051ea..a52c4725 100644
 -      AC_CHECK_PROG(adduser, adduser, yes)
 -      AC_CHECK_PROG(addgroup, addgroup, yes)
 -      AS_IF([test "x$addgroup" != "xyes" && test "x$groupadd" != "xyes" ],
--         [AC_MSG_ERROR([addgroup or groupadd are needed.])])
+-         [AC_MSG_WARN([addgroup or groupadd are needed for install.])])
 -      AS_IF([test "x$adduser" != "xyes" && test "x$useradd" != "xyes" ],
--         [AC_MSG_ERROR([adduser or useradd are needed.])])])
+-         [AC_MSG_WARN([adduser or useradd are needed for install.])])])
 -
  AC_SUBST([PATH])
  
  dnl --------- Doxy Gen -----------------------
 -- 
-2.45.0.rc1.225.g2a3ae87e7f-goog
+2.43.0
+
diff --git a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.1.3.bb b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.2.0.bb
similarity index 94%
rename from meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.1.3.bb
rename to meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.2.0.bb
index 30e984e..0d5b36a 100644
--- a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.1.3.bb
+++ b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.2.0.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/${PV}/${BPN
            file://fixup_hosttools.patch \
            "
 
-SRC_URI[sha256sum] = "37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8"
+SRC_URI[sha256sum] = "b53f0c5c8c4ce17f05701a410ca9688f725ca380c9bc4640eacd0eadb1fea124"
 
 UPSTREAM_CHECK_URI = "https://github.com/tpm2-software/${BPN}/releases"
 
@@ -94,5 +94,3 @@ FILES:${PN} = "\
     ${sysconfdir}/sysusers.d"
 
 BBCLASSEXTEND = "native nativesdk"
-
-CVE_STATUS[CVE-2024-29040] = "fixed-version: Fixed since version 4.1.0"
-- 
2.47.3

[meta-security][PATCH 4/4] python3-tpm2-pytss: Upgrade 2.3.0 -> 3.0.0

[Scott Murray]

To fix build issues from the new version of python3-pycparser in
oe-core, upgrade to 3.0.0.  This uncovered a new pycparser related
issue, so a patch has been added to fix building under OE.

Changelog at:
https://github.com/tpm2-software/tpm2-pytss/releases/tag/3.0.0

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
---
 ...0001-Handle-CC-values-with-arguments.patch | 51 +++++++++++++++++++
 ...s_2.3.0.bb => python3-tpm2-pytss_3.0.0.bb} |  5 +-
 2 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss/0001-Handle-CC-values-with-arguments.patch
 rename meta-tpm/recipes-tpm2/tpm2-pytss/{python3-tpm2-pytss_2.3.0.bb => python3-tpm2-pytss_3.0.0.bb} (80%)

diff --git a/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss/0001-Handle-CC-values-with-arguments.patch b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss/0001-Handle-CC-values-with-arguments.patch
new file mode 100644
index 0000000..432c350
--- /dev/null
+++ b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss/0001-Handle-CC-values-with-arguments.patch
@@ -0,0 +1,51 @@
+From 39f87887bcdf037fe077e04f582db927cb35d2bc Mon Sep 17 00:00:00 2001
+From: Scott Murray <scott.murray@konsulko.com>
+Date: Thu, 29 Oct 2026 19:46:41 +0200
+Subject: [PATCH] Handle CC values with arguments
+
+OpenEmbedded / Yocto Project builds pass a value for CC that includes
+several arguments (e.g. --sysroot).  The embedded spaces in the value
+break pycparser's expectation for the value of the cpp_path argument to
+its API calls.  To handle this, add logic to split the value of CC for
+use in cpp_path and cpp_args.  shlex is used to hopefully handle quoted
+spaces or potentially spaces in the compiler path, but this has not
+been tested.
+
+Upstream-Status: Pending
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+---
+ setup.py | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index 1216065..0160a76 100644
+--- a/setup.py
++++ b/setup.py
+@@ -2,6 +2,7 @@ import site
+ import sys
+ import os
+ import platform
++import shlex
+ from setuptools import setup
+ from setuptools.command.build_ext import build_ext
+ from pkgconfig import pkgconfig
+@@ -22,11 +23,17 @@ site.ENABLE_USER_SITE = "--user" in sys.argv[1:]
+ 
+ 
+ def cpp_path():
+-    return os.environ.get("CC", "cc")
++    cc = os.environ.get("CC", "cc")
++    return shlex.split(cc)[0]
+ 
+ 
+ def cpp_args(args=[]):
+-    return ["-E"] + args
++    cc = os.environ.get("CC", "cc")
++    split = shlex.split(cc)
++    cc_args = ["-E"]
++    if len(split) > 1:
++        cc_args = split[1:] + ["-E"]
++    return cc_args + args
+ 
+ 
+ class type_generator(build_ext):
diff --git a/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_3.0.0.bb
similarity index 80%
rename from meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb
rename to meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_3.0.0.bb
index 60de4a6..1ce8cf6 100644
--- a/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb
+++ b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_3.0.0.bb
@@ -4,9 +4,10 @@ HOMEPAGE = "https://github.com/tpm2-software/tpm2-pytss"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=500b2e742befc3da00684d8a1d5fd9da"
 
-PYPI_PACKAGE_SDIST = "tpm2-pytss"
+PYPI_PACKAGE_SDIST = "tpm2_pytss"
 
-SRC_URI[sha256sum] = "20071129379656f5f3c3bc16d364612672b147d81191fb4eb9f9ff9fbee48410"
+SRC_URI += "file://0001-Handle-CC-values-with-arguments.patch"
+SRC_URI[sha256sum] = "c193cf1908b482f93c4aa464132920fe3a37d4b9d802e267974ff2dfe37d4433"
 
 inherit autotools pkgconfig pypi python_setuptools_build_meta
 
-- 
2.47.3