Re: [OE-core] [scarthgap 09/11] glibc: fix CVE-2025-8058

[Gyorgy Sarvari <skandigraun@gmail.com>]

On 9/26/25 10:06, Wang, Jinfeng (CN) via lists.openembedded.org wrote:
> Hi all,
>  
> With this patch, after I add INHERIT += "buildhistory" in
> conf/local.conf, I found the following build errors:
>   ERROR: glibc-2.39+git-r0.wr2413 do_packagedata: QA Issue: Package
> version for package ldconfig went backwards which would break package
> feeds (from 0:2.39+git0+cff1042cce-r0.wr2408.0 to  
> 0:2.39+git0+b027d5b145-r0.wr2413.0) [version-going-backwards]
>   ERROR: glibc-2.39+git-r0.wr2413 do_packagedata: QA Issue: Package
> version for package ldd went backwards which would break package feeds
> (from 0:2.39+git0+cff1042cce-r0.wr2408.0 to
> 0:2.39+git0+b027d5b145-r0.wr2413.0) [version-going-backwards]
>   ERROR: glibc-2.39+git-r0.wr2413 do_packagedata: QA Issue: Package
> version for package ldso went backwards which would break package
> feeds (from 0:2.39+git0+cff1042cce-r0.wr2408.0 to 
> I found in the buildhistory.bbclass, bb.utils.vercmp((pkge, pkgv,
> pkgr), (last_pkge, last_pkgv, last_pkgr)) will compare the version,
> the hash is part of the version.
> The commit(d9b992de0da6be8e9bc26c39c4e5aa7bb9c2049e) in oe-core glibc,
> upgrade from cff1042cce to b027d5b145. c < b, so it is thought as
> version-going-backwards. How to deal with this situation?

I think this is more like a general behavior with all packages using the
+git PV postfix. I suspect using buildhistory has an implied requirement
of using pr service too? That supposed set an increasing number in the
"git0" part (instead of the static 0), which should ensure that it's a
monotonic sequence.