[OE-core][PATCH] libarchive: upgrade 3.8.4 -> 3.8.5

[OE-core][PATCH] libarchive: upgrade 3.8.4 -> 3.8.5

[Peter Marko]

From: Peter Marko <peter.marko@siemens.com>

Fixes regression of fix for CVE-2025-60753

Release notes [1]:
Libarchive 3.8.5 is a bugfix release.
Notable bugxies:
* bsdtar: fix regression from 3.8.4 zero-length pattern issue bugfix (#2809)
* various small bugfixes in code and documentation

[1] https://github.com/libarchive/libarchive/releases/tag/v3.8.5

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-extended/libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb} (96%)

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
similarity index 96%
rename from meta/recipes-extended/libarchive/libarchive_3.8.4.bb
rename to meta/recipes-extended/libarchive/libarchive_3.8.5.bb
index e89638f5c6..fcfaf5d231 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
@@ -32,7 +32,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
 SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz"
 UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
 
-SRC_URI[sha256sum] = "b2c75b132a0ec43274d2867221befcb425034cd038e465afbfad09911abb1abb"
+SRC_URI[sha256sum] = "8a60f3a7bfd59c54ce82ae805a93dba65defd04148c3333b7eaa2102f03b7ffd"
 
 inherit autotools update-alternatives pkgconfig
 

Re: [OE-core][PATCH] libarchive: upgrade 3.8.4 -> 3.8.5

[Antonin Godard]

Hi,

On Sat Jan 10, 2026 at 1:27 PM CET, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> Fixes regression of fix for CVE-2025-60753
>
> Release notes [1]:
> Libarchive 3.8.5 is a bugfix release.
> Notable bugxies:
> * bsdtar: fix regression from 3.8.4 zero-length pattern issue bugfix (#2809)
> * various small bugfixes in code and documentation
>
> [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.5
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  .../libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb}     | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-extended/libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb} (96%)
>
> diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> similarity index 96%
> rename from meta/recipes-extended/libarchive/libarchive_3.8.4.bb
> rename to meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> index e89638f5c6..fcfaf5d231 100644
> --- a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
> +++ b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> @@ -32,7 +32,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
>  SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz"
>  UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
>  
> -SRC_URI[sha256sum] = "b2c75b132a0ec43274d2867221befcb425034cd038e465afbfad09911abb1abb"
> +SRC_URI[sha256sum] = "8a60f3a7bfd59c54ce82ae805a93dba65defd04148c3333b7eaa2102f03b7ffd"
>  
>  inherit autotools update-alternatives pkgconfig
>  

After bisecting, I identified this patch to trigger errors on the Autobuilder,
such as:

  Exception: subprocess.CalledProcessError: Command 'tar --exclude=./sysroot-only -cf - -C /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/image -p -S . | tar -xf - -C /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/package' returned non-zero exit status 2.

  Subprocess output:
  got *at() syscall for unknown directory, fd 4
  unknown base path for fd 4, path share
  couldn't allocate absolute path for 'share'.
  tar: ./usr/share: Cannot mkdir: Bad address
  got *at() syscall for unknown directory, fd 4
  unknown base path for fd 4, path share
  couldn't allocate absolute path for 'share'.
  ...

https://autobuilder.yoctoproject.org/valkyrie/api/v2/logs/4904276/raw_inline
https://autobuilder.yoctoproject.org/valkyrie/#/builders/93/builds/3005

Full build:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/3034

Can you have a look?

Antonin

-- 
Antonin Godard, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core][PATCH] libarchive: upgrade 3.8.4 -> 3.8.5

[Yoann Congal]

[-- Attachment #1: Type: text/plain, Size: 4034 bytes --]

Le lun. 12 janv. 2026 à 17:17, Antonin Godard via lists.openembedded.org
<antonin.godard=bootlin.com@lists.openembedded.org> a écrit :

> Hi,
>

Hello,


> On Sat Jan 10, 2026 at 1:27 PM CET, Peter Marko via lists.openembedded.org
> wrote:
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Fixes regression of fix for CVE-2025-60753
> >
> > Release notes [1]:
> > Libarchive 3.8.5 is a bugfix release.
> > Notable bugxies:
> > * bsdtar: fix regression from 3.8.4 zero-length pattern issue bugfix
> (#2809)
> > * various small bugfixes in code and documentation
> >
> > [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.5
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> >  .../libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb}     | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >  rename meta/recipes-extended/libarchive/{libarchive_3.8.4.bb =>
> libarchive_3.8.5.bb} (96%)
> >
> > diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
> b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> > similarity index 96%
> > rename from meta/recipes-extended/libarchive/libarchive_3.8.4.bb
> > rename to meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> > index e89638f5c6..fcfaf5d231 100644
> > --- a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
> > +++ b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
> > @@ -32,7 +32,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
> >  SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz"
> >  UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
> >
> > -SRC_URI[sha256sum] =
> "b2c75b132a0ec43274d2867221befcb425034cd038e465afbfad09911abb1abb"
> > +SRC_URI[sha256sum] =
> "8a60f3a7bfd59c54ce82ae805a93dba65defd04148c3333b7eaa2102f03b7ffd"
> >
> >  inherit autotools update-alternatives pkgconfig
> >
>
> After bisecting, I identified this patch to trigger errors on the
> Autobuilder,
> such as:
>
>   Exception: subprocess.CalledProcessError: Command 'tar
> --exclude=./sysroot-only -cf - -C
> /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/image
> -p -S . | tar -xf - -C
> /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/package'
> returned non-zero exit status 2.
>
>   Subprocess output:
>   got *at() syscall for unknown directory, fd 4
>   unknown base path for fd 4, path share
>   couldn't allocate absolute path for 'share'.
>   tar: ./usr/share: Cannot mkdir: Bad address
>   got *at() syscall for unknown directory, fd 4
>   unknown base path for fd 4, path share
>   couldn't allocate absolute path for 'share'.
>   ...
>
>
> https://autobuilder.yoctoproject.org/valkyrie/api/v2/logs/4904276/raw_inline
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/93/builds/3005
>
> Full build:
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/3034
>
> Can you have a look?
>

FYI, that is bug 16117 – AB-INT: do_package: Error executing a python
function in exec_func_python() autogenerated
https://bugzilla.yoctoproject.org/show_bug.cgi?id=16117
And it is not linked to this patch (for example, I have this on whinlatter
which does not have this patch)

If you retry your build on any worker but stream9-vk-1 it should not have
this error.

Antonin
>
> --
> Antonin Godard, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#229212):
> https://lists.openembedded.org/g/openembedded-core/message/229212
> Mute This Topic: https://lists.openembedded.org/mt/117190089/4316185
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> yoann.congal@smile.fr]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
Yoann Congal
Smile ECS

[-- Attachment #2: Type: text/html, Size: 7535 bytes --]

Re: [OE-core][PATCH] libarchive: upgrade 3.8.4 -> 3.8.5

[Antonin Godard]

On Mon Jan 12, 2026 at 5:23 PM CET, Yoann Congal via lists.openembedded.org wrote:
> Le lun. 12 janv. 2026 à 17:17, Antonin Godard via lists.openembedded.org
> <antonin.godard=bootlin.com@lists.openembedded.org> a écrit :
>
>> Hi,
>>
>
> Hello,
>
>
>> On Sat Jan 10, 2026 at 1:27 PM CET, Peter Marko via lists.openembedded.org
>> wrote:
>> > From: Peter Marko <peter.marko@siemens.com>
>> >
>> > Fixes regression of fix for CVE-2025-60753
>> >
>> > Release notes [1]:
>> > Libarchive 3.8.5 is a bugfix release.
>> > Notable bugxies:
>> > * bsdtar: fix regression from 3.8.4 zero-length pattern issue bugfix
>> (#2809)
>> > * various small bugfixes in code and documentation
>> >
>> > [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.5
>> >
>> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> > ---
>> >  .../libarchive/{libarchive_3.8.4.bb => libarchive_3.8.5.bb}     | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> >  rename meta/recipes-extended/libarchive/{libarchive_3.8.4.bb =>
>> libarchive_3.8.5.bb} (96%)
>> >
>> > diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
>> b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
>> > similarity index 96%
>> > rename from meta/recipes-extended/libarchive/libarchive_3.8.4.bb
>> > rename to meta/recipes-extended/libarchive/libarchive_3.8.5.bb
>> > index e89638f5c6..fcfaf5d231 100644
>> > --- a/meta/recipes-extended/libarchive/libarchive_3.8.4.bb
>> > +++ b/meta/recipes-extended/libarchive/libarchive_3.8.5.bb
>> > @@ -32,7 +32,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
>> >  SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz"
>> >  UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
>> >
>> > -SRC_URI[sha256sum] =
>> "b2c75b132a0ec43274d2867221befcb425034cd038e465afbfad09911abb1abb"
>> > +SRC_URI[sha256sum] =
>> "8a60f3a7bfd59c54ce82ae805a93dba65defd04148c3333b7eaa2102f03b7ffd"
>> >
>> >  inherit autotools update-alternatives pkgconfig
>> >
>>
>> After bisecting, I identified this patch to trigger errors on the
>> Autobuilder,
>> such as:
>>
>>   Exception: subprocess.CalledProcessError: Command 'tar
>> --exclude=./sysroot-only -cf - -C
>> /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/image
>> -p -S . | tar -xf - -C
>> /srv/pokybuild/yocto-worker/genericx86-64-alt/build/build/tmp/work/all-poky-linux/wayland-protocols/1.47/package'
>> returned non-zero exit status 2.
>>
>>   Subprocess output:
>>   got *at() syscall for unknown directory, fd 4
>>   unknown base path for fd 4, path share
>>   couldn't allocate absolute path for 'share'.
>>   tar: ./usr/share: Cannot mkdir: Bad address
>>   got *at() syscall for unknown directory, fd 4
>>   unknown base path for fd 4, path share
>>   couldn't allocate absolute path for 'share'.
>>   ...
>>
>>
>> https://autobuilder.yoctoproject.org/valkyrie/api/v2/logs/4904276/raw_inline
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/93/builds/3005
>>
>> Full build:
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/3034
>>
>> Can you have a look?
>>
>
> FYI, that is bug 16117 – AB-INT: do_package: Error executing a python
> function in exec_func_python() autogenerated
> https://bugzilla.yoctoproject.org/show_bug.cgi?id=16117
> And it is not linked to this patch (for example, I have this on whinlatter
> which does not have this patch)
>
> If you retry your build on any worker but stream9-vk-1 it should not have
> this error.

Oh ok, thanks. I was told this was limited to stream9, and since some of my
builds also failed on rocky9 and alma9, I did not make the connection.

Sorry for the false alarm, Peter.

Antonin

-- 
Antonin Godard, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com