[PATCH 1/4] readline: rename patch to contain CVE reference

[PATCH 1/4] readline: rename patch to contain CVE reference

[Ross Burton]

To help automated scanning of CVEs, put the CVE ID in the filename.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 .../readline-6.3/{readline63-003.patch => readline-cve-2014-2524.patch} | 0
 meta/recipes-core/readline/readline_6.3.bb                              | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/readline/readline-6.3/{readline63-003.patch => readline-cve-2014-2524.patch} (100%)

diff --git a/meta/recipes-core/readline/readline-6.3/readline63-003.patch b/meta/recipes-core/readline/readline-6.3/readline-cve-2014-2524.patch
similarity index 100%
rename from meta/recipes-core/readline/readline-6.3/readline63-003.patch
rename to meta/recipes-core/readline/readline-6.3/readline-cve-2014-2524.patch
diff --git a/meta/recipes-core/readline/readline_6.3.bb b/meta/recipes-core/readline/readline_6.3.bb
index 6ba1c18..fc362ae 100644
--- a/meta/recipes-core/readline/readline_6.3.bb
+++ b/meta/recipes-core/readline/readline_6.3.bb
@@ -1,6 +1,6 @@
 require readline.inc
 
-SRC_URI += "file://readline63-003.patch;striplevel=0 \
+SRC_URI += "file://readline-cve-2014-2524.patch;striplevel=0 \
             file://readline-dispatch-multikey.patch"
 
 SRC_URI[archive.md5sum] = "33c8fb279e981274f485fd91da77e94a"
-- 
2.1.4

[PATCH 2/4] unzip: rename patch to reflect CVE fix

[Ross Burton]

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 .../unzip/unzip/{unzip-6.0_overflow3.diff => cve-2014-9636.patch}       | 0
 meta/recipes-extended/unzip/unzip_6.0.bb                                | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-extended/unzip/unzip/{unzip-6.0_overflow3.diff => cve-2014-9636.patch} (100%)

diff --git a/meta/recipes-extended/unzip/unzip/unzip-6.0_overflow3.diff b/meta/recipes-extended/unzip/unzip/cve-2014-9636.patch
similarity index 100%
rename from meta/recipes-extended/unzip/unzip/unzip-6.0_overflow3.diff
rename to meta/recipes-extended/unzip/unzip/cve-2014-9636.patch
diff --git a/meta/recipes-extended/unzip/unzip_6.0.bb b/meta/recipes-extended/unzip/unzip_6.0.bb
index 9e63d3a..b386323 100644
--- a/meta/recipes-extended/unzip/unzip_6.0.bb
+++ b/meta/recipes-extended/unzip/unzip_6.0.bb
@@ -10,7 +10,7 @@ SRC_URI = "ftp://ftp.info-zip.org/pub/infozip/src/unzip60.tgz \
 	file://avoid-strip.patch \
 	file://define-ldflags.patch \
 	file://06-unzip60-alt-iconv-utf8_CVE-2015-1315.patch \
-	file://unzip-6.0_overflow3.diff \
+	file://cve-2014-9636.patch \
 	file://09-cve-2014-8139-crc-overflow.patch \
 	file://10-cve-2014-8140-test-compr-eb.patch \
 	file://11-cve-2014-8141-getzip64data.patch \
-- 
2.1.4

[PATCH 3/4] gcr: remove Vala dependency

[Ross Burton]

The Vala support in GCR requires gobject-introspection so even with the build
dependency on Vala it isn't enabled, so remove the build dependency and
explicitly disable Vala support.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 meta/recipes-gnome/gcr/gcr_3.16.0.bb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-gnome/gcr/gcr_3.16.0.bb b/meta/recipes-gnome/gcr/gcr_3.16.0.bb
index 057c815..cf4be84 100644
--- a/meta/recipes-gnome/gcr/gcr_3.16.0.bb
+++ b/meta/recipes-gnome/gcr/gcr_3.16.0.bb
@@ -5,7 +5,7 @@ BUGTRACKER = "https://bugzilla.gnome.org/"
 LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://COPYING;md5=55ca817ccb7d5b5b66355690e9abc605"
 
-DEPENDS = "gtk+3 p11-kit glib-2.0 libgcrypt vala"
+DEPENDS = "gtk+3 p11-kit glib-2.0 libgcrypt"
 
 inherit autotools gnomebase gtk-icon-cache gtk-doc distro_features_check
 # depends on gtk+3
@@ -14,6 +14,8 @@ ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
 SRC_URI[archive.md5sum] = "d5835680be0b6a838e02a528d5378d9c"
 SRC_URI[archive.sha256sum] = "ecfe8df41cc88158364bb15addc670b11e539fe844742983629ba2323888d075"
 
+EXTRA_OECONF = "--disable-vala"
+
 FILES_${PN} += " \
     ${datadir}/dbus-1 \
     ${datadir}/gcr-3 \
-- 
2.1.4

[PATCH 4/4] at: modify sources in do_patch

[Ross Burton]

Instead of copying the forked source files into ${S} in do_compile_prepend(), do
it in a do_patch() postfunc.  This ensures that the source archiver sees the
changes for compliance and legal verification.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 meta/recipes-extended/at/at_3.1.16.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-extended/at/at_3.1.16.bb b/meta/recipes-extended/at/at_3.1.16.bb
index 0512bcb..b11b587 100644
--- a/meta/recipes-extended/at/at_3.1.16.bb
+++ b/meta/recipes-extended/at/at_3.1.16.bb
@@ -47,10 +47,10 @@ INITSCRIPT_PARAMS = "defaults"
 
 SYSTEMD_SERVICE_${PN} = "atd.service"
 
-
-do_compile_prepend () {
+copy_sources() {
 	cp -f ${WORKDIR}/posixtm.[ch] ${S}
 }
+do_patch[postfuncs] += "copy_sources"
 
 do_install () {
 	oe_runmake -e "IROOT=${D}" install
-- 
2.1.4

Re: [PATCH 3/4] gcr: remove Vala dependency

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 1520 bytes --]

Retracting this, gcr needs vala's m4 file.  Back to wondering if we should
have a vala-stub too...

Ross

On 4 November 2015 at 19:47, Ross Burton <ross.burton@intel.com> wrote:

> The Vala support in GCR requires gobject-introspection so even with the
> build
> dependency on Vala it isn't enabled, so remove the build dependency and
> explicitly disable Vala support.
>
> Signed-off-by: Ross Burton <ross.burton@intel.com>
> ---
>  meta/recipes-gnome/gcr/gcr_3.16.0.bb | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/meta/recipes-gnome/gcr/gcr_3.16.0.bb
> b/meta/recipes-gnome/gcr/gcr_3.16.0.bb
> index 057c815..cf4be84 100644
> --- a/meta/recipes-gnome/gcr/gcr_3.16.0.bb
> +++ b/meta/recipes-gnome/gcr/gcr_3.16.0.bb
> @@ -5,7 +5,7 @@ BUGTRACKER = "https://bugzilla.gnome.org/"
>  LICENSE = "GPLv2"
>  LIC_FILES_CHKSUM = "file://COPYING;md5=55ca817ccb7d5b5b66355690e9abc605"
>
> -DEPENDS = "gtk+3 p11-kit glib-2.0 libgcrypt vala"
> +DEPENDS = "gtk+3 p11-kit glib-2.0 libgcrypt"
>
>  inherit autotools gnomebase gtk-icon-cache gtk-doc distro_features_check
>  # depends on gtk+3
> @@ -14,6 +14,8 @@ ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
>  SRC_URI[archive.md5sum] = "d5835680be0b6a838e02a528d5378d9c"
>  SRC_URI[archive.sha256sum] =
> "ecfe8df41cc88158364bb15addc670b11e539fe844742983629ba2323888d075"
>
> +EXTRA_OECONF = "--disable-vala"
> +
>  FILES_${PN} += " \
>      ${datadir}/dbus-1 \
>      ${datadir}/gcr-3 \
> --
> 2.1.4
>
>

[-- Attachment #2: Type: text/html, Size: 2535 bytes --]

Re: [PATCH 3/4] gcr: remove Vala dependency

[Alexander Kanavin]

On 11/04/2015 10:20 PM, Burton, Ross wrote:
> Retracting this, gcr needs vala's m4 file.  Back to wondering if we
> should have a vala-stub too...

Upcoming introspection patchset also adds a bonus vapigen support, so 
you don't really need to do these disable-vala fixes.


Alex