Re: [OE-core] [PATCH 4/4] libxml2: upgrade 2.14.3 -> 2.14.5

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Tue, 2025-07-22 at 15:45 +0200, Mathieu Dubois-Briand wrote:
> On Tue Jul 22, 2025 at 3:18 PM CEST, Richard Purdie via lists.openembedded.org wrote:
> > On Mon, 2025-07-21 at 16:21 +0800, hongxu via lists.openembedded.org wrote:
> > > diff --git a/meta/recipes-core/libxml/libxml2_2.14.3.bb b/meta/recipes-core/libxml/libxml2_2.14.5.bb
> > > similarity index 97%
> > > rename from meta/recipes-core/libxml/libxml2_2.14.3.bb
> > > rename to meta/recipes-core/libxml/libxml2_2.14.5.bb
> > > index 4baab59186e..52b2040122b 100644
> > > --- a/meta/recipes-core/libxml/libxml2_2.14.3.bb
> > > +++ b/meta/recipes-core/libxml/libxml2_2.14.5.bb
> > > @@ -21,7 +21,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
> > >             file://CVE-2025-6021.patch \
> > >             "
> > >  
> > > -SRC_URI[archive.sha256sum] = "6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833"
> > > +SRC_URI[archive.sha256sum] = "24175ec30a97cfa86bdf9befb7ccf4613f8f4b2713c5103e0dd0bc9c711a2773"
> > >  SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
> > >  
> > >  # Disputed as a security issue, but fixed in d39f780
> > > 
> > 
> > $ wget https://download.gnome.org/sources//libxml2/2.14/libxml2-2.14.5.tar.xz
> > $ sha256sum libxml2-2.14.5.tar.xz 
> > 03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b  libxml2-2.14.5.tar.xz
> > 
> > which would match the failure on:
> > 
> > https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2060
> > 
> > Any idea what happened here?
> > 
> > Cheers,
> > 
> > Richard
> 
> It looks like the file changed on the remote, my build this morning did
> succeed but not the next ones.

https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.4.sha256sum

suggests that checksum is for 2.14.4. Whether the wrong file was in
place on the server or quite what happened, I'm not sure...

Cheers,

Richard