* [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
@ 2026-10-26 19:09 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Fiona Klute via buildroot @ 2026-10-26 19:09 UTC (permalink / raw)
To: buildroot; +Cc: Jarkko Sakkinen, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
https://github.com/advisories/GHSA-gqrg-h59c-j4wj
Upstream changelog:
https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
package/swtpm/swtpm.hash | 3 ++-
package/swtpm/swtpm.mk | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
index ebad1ef4bf..4f6cbfd61d 100644
--- a/package/swtpm/swtpm.hash
+++ b/package/swtpm/swtpm.hash
@@ -1,2 +1,3 @@
-sha256 f8da11cadfed27e26d26c5f58a7b8f2d14d684e691927348906b5891f525c684 swtpm-0.10.1.tar.gz
+# locally calculated
+sha256 f61cf6f1e9bbcb4cefb30b70cafaf1c4df54c6961e65cfa63830e8ad0e220134 swtpm-0.10.2.tar.gz
sha256 19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b LICENSE
diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
index de7f2fa05e..d6559c22d6 100644
--- a/package/swtpm/swtpm.mk
+++ b/package/swtpm/swtpm.mk
@@ -4,7 +4,7 @@
#
################################################################################
-SWTPM_VERSION = 0.10.1
+SWTPM_VERSION = 0.10.2
SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
SWTPM_LICENSE = BSD-4-Clause
SWTPM_LICENSE_FILES = LICENSE
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] package/swtpm: fix license information
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
@ 2026-10-26 19:09 ` Fiona Klute via buildroot
2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 1 reply; 5+ messages in thread
From: Fiona Klute via buildroot @ 2026-10-26 19:09 UTC (permalink / raw)
To: buildroot; +Cc: Jarkko Sakkinen, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
The SPDX identifier matching the LICENSE file is BSD-3-Clause [1], not
BSD-4-Clause. The LICENSE file was last modified with upstream commit
5f1ef9565df074b918a39cb4885af4190c98edb7 in 2015, before release
0.1.0, so the fix applies to all Buildroot stable branches.
[1] https://spdx.org/licenses/BSD-3-Clause.html
[2] https://github.com/stefanberger/swtpm/commit/5f1ef9565df074b918a39cb4885af4190c98edb7
Fixes: 87b9b126d23be1e95b3d2b82438f65e28f554a87 "package/swtpm: add host package"
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
package/swtpm/swtpm.mk | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
index d6559c22d6..3357be9c39 100644
--- a/package/swtpm/swtpm.mk
+++ b/package/swtpm/swtpm.mk
@@ -6,7 +6,7 @@
SWTPM_VERSION = 0.10.2
SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
-SWTPM_LICENSE = BSD-4-Clause
+SWTPM_LICENSE = BSD-3-Clause
SWTPM_LICENSE_FILES = LICENSE
HOST_SWTPM_DEPENDENCIES = \
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
@ 2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 0 replies; 5+ messages in thread
From: Jarkko Sakkinen via buildroot @ 2026-10-26 19:42 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot
On Mon, Oct 26, 2026 at 08:09:55PM +0100, Fiona Klute wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
> https://github.com/advisories/GHSA-gqrg-h59c-j4wj
>
> Upstream changelog:
> https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
> ---
> package/swtpm/swtpm.hash | 3 ++-
> package/swtpm/swtpm.mk | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
> index ebad1ef4bf..4f6cbfd61d 100644
> --- a/package/swtpm/swtpm.hash
> +++ b/package/swtpm/swtpm.hash
> @@ -1,2 +1,3 @@
> -sha256 f8da11cadfed27e26d26c5f58a7b8f2d14d684e691927348906b5891f525c684 swtpm-0.10.1.tar.gz
> +# locally calculated
> +sha256 f61cf6f1e9bbcb4cefb30b70cafaf1c4df54c6961e65cfa63830e8ad0e220134 swtpm-0.10.2.tar.gz
> sha256 19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b LICENSE
> diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
> index de7f2fa05e..d6559c22d6 100644
> --- a/package/swtpm/swtpm.mk
> +++ b/package/swtpm/swtpm.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -SWTPM_VERSION = 0.10.1
> +SWTPM_VERSION = 0.10.2
> SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
> SWTPM_LICENSE = BSD-4-Clause
> SWTPM_LICENSE_FILES = LICENSE
> --
> 2.55.0
>
LGTM
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Br, Jarkko
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/swtpm: fix license information
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
@ 2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
0 siblings, 0 replies; 5+ messages in thread
From: Jarkko Sakkinen via buildroot @ 2026-10-26 19:42 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot
On Mon, Oct 26, 2026 at 08:09:56PM +0100, Fiona Klute wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> The SPDX identifier matching the LICENSE file is BSD-3-Clause [1], not
> BSD-4-Clause. The LICENSE file was last modified with upstream commit
> 5f1ef9565df074b918a39cb4885af4190c98edb7 in 2015, before release
> 0.1.0, so the fix applies to all Buildroot stable branches.
>
> [1] https://spdx.org/licenses/BSD-3-Clause.html
> [2] https://github.com/stefanberger/swtpm/commit/5f1ef9565df074b918a39cb4885af4190c98edb7
>
> Fixes: 87b9b126d23be1e95b3d2b82438f65e28f554a87 "package/swtpm: add host package"
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
> ---
> package/swtpm/swtpm.mk | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
> index d6559c22d6..3357be9c39 100644
> --- a/package/swtpm/swtpm.mk
> +++ b/package/swtpm/swtpm.mk
> @@ -6,7 +6,7 @@
>
> SWTPM_VERSION = 0.10.2
> SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
> -SWTPM_LICENSE = BSD-4-Clause
> +SWTPM_LICENSE = BSD-3-Clause
> SWTPM_LICENSE_FILES = LICENSE
>
> HOST_SWTPM_DEPENDENCIES = \
> --
> 2.55.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Br, Jarkko
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
@ 2026-10-26 20:41 ` Julien Olivain via buildroot
2 siblings, 0 replies; 5+ messages in thread
From: Julien Olivain via buildroot @ 2026-10-26 20:41 UTC (permalink / raw)
To: Fiona Klute; +Cc: buildroot, Jarkko Sakkinen
On 26/10/2026 20:09, Fiona Klute via buildroot wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
>
> CVE-2026-75900: Fix length check in SWTPM_NVRAM_CheckHeader()
> https://github.com/advisories/GHSA-gqrg-h59c-j4wj
>
> Upstream changelog:
> https://github.com/stefanberger/swtpm/releases/tag/v0.10.2
>
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-26 20:41 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-26 19:09 [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Fiona Klute via buildroot
2026-10-26 19:09 ` [Buildroot] [PATCH 2/2] package/swtpm: fix license information Fiona Klute via buildroot
2026-10-26 19:42 ` Jarkko Sakkinen via buildroot
2026-10-26 19:42 ` [Buildroot] [PATCH 1/2] package/swtpm: security bump version to 0.10.2 Jarkko Sakkinen via buildroot
2026-10-26 20:41 ` Julien Olivain via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox