* [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
@ 2026-01-10 22:44 Peter Marko
2026-02-04 10:10 ` Yoann Congal
0 siblings, 1 reply; 11+ messages in thread
From: Peter Marko @ 2026-01-10 22:44 UTC (permalink / raw)
To: openembedded-core; +Cc: Peter Marko
From: Peter Marko <peter.marko@siemens.com>
Handles CVE-2025-68973.
Refresh patches.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
.../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
2 files changed, 8 insertions(+), 8 deletions(-)
rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} (97%)
diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch b/meta/recipes-support/gnupg/gnupg/relocate.patch
index ea0252026aa..655dd3d0ce1 100644
--- a/meta/recipes-support/gnupg/gnupg/relocate.patch
+++ b/meta/recipes-support/gnupg/gnupg/relocate.patch
@@ -17,7 +17,7 @@ diff --git a/common/homedir.c b/common/homedir.c
index 6f99f3e..f22aa9e 100644
--- a/common/homedir.c
+++ b/common/homedir.c
-@@ -1284,7 +1284,7 @@ gnupg_socketdir (void)
+@@ -1294,7 +1294,7 @@ gnupg_socketdir (void)
if (!name)
{
unsigned int dummy;
@@ -26,7 +26,7 @@ index 6f99f3e..f22aa9e 100644
gpgrt_annotate_leaked_object (name);
}
-@@ -1316,7 +1316,7 @@ gnupg_sysconfdir (void)
+@@ -1326,7 +1326,7 @@ gnupg_sysconfdir (void)
if (dir)
return dir;
else
@@ -35,7 +35,7 @@ index 6f99f3e..f22aa9e 100644
#endif /*!HAVE_W32_SYSTEM*/
}
-@@ -1352,7 +1352,7 @@ gnupg_bindir (void)
+@@ -1362,7 +1362,7 @@ gnupg_bindir (void)
return name;
}
else
@@ -44,7 +44,7 @@ index 6f99f3e..f22aa9e 100644
#endif /*!HAVE_W32_SYSTEM*/
}
-@@ -1379,7 +1379,7 @@ gnupg_libexecdir (void)
+@@ -1389,7 +1389,7 @@ gnupg_libexecdir (void)
return name;
}
else
@@ -53,7 +53,7 @@ index 6f99f3e..f22aa9e 100644
#endif /*!HAVE_W32_SYSTEM*/
}
-@@ -1409,7 +1409,7 @@ gnupg_libdir (void)
+@@ -1419,7 +1419,7 @@ gnupg_libdir (void)
return name;
}
else
@@ -62,7 +62,7 @@ index 6f99f3e..f22aa9e 100644
#endif /*!HAVE_W32_SYSTEM*/
}
-@@ -1440,7 +1440,7 @@ gnupg_datadir (void)
+@@ -1450,7 +1450,7 @@ gnupg_datadir (void)
return name;
}
else
@@ -71,7 +71,7 @@ index 6f99f3e..f22aa9e 100644
#endif /*!HAVE_W32_SYSTEM*/
}
-@@ -1472,7 +1472,7 @@ gnupg_localedir (void)
+@@ -1482,7 +1482,7 @@ gnupg_localedir (void)
return name;
}
else
diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
similarity index 97%
rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
index a6e777abf89..4f60a4e7b28 100644
--- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
@@ -23,7 +23,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-
file://relocate.patch"
SRC_URI:append:class-nativesdk = " file://relocate.patch"
-SRC_URI[sha256sum] = "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
+SRC_URI[sha256sum] = "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
EXTRA_OECONF = "--disable-ldap \
--disable-ccid-driver \
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
@ 2026-01-12 7:14 Vijay Anusuri
2026-01-12 7:17 ` Marko, Peter
0 siblings, 1 reply; 11+ messages in thread
From: Vijay Anusuri @ 2026-01-12 7:14 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri
This release includes fix for CVE-2025-68973
Changelog:
==========
* gpg: Fix possible memory corruption in the armor parser. [T7906]
* gpg: Avoid potential downgrade to SHA1 in 3rd party key
signatures. [rGddb012be7f]
* gpg: Error out on unverified output for non-detached signatures.
[rG9d302f978b]
* gpg: Do not allow compressed key packets on import. [T7014]
* scd: Fix a harmless read buffer over-read in a function used by
PKCS#15 cards. [T7662]
* dirmngr: Do not require a keyserver for "gpg --fetch-key".
[T7693]
* agent: Fix ssh-agent's request_identities for skipped Brainpool
keys. [rG6bf5696c85]
Release-info: https://dev.gnupg.org/T8001
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} (97%)
diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
similarity index 97%
rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
index a6e777abf8..4f60a4e7b2 100644
--- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
@@ -23,7 +23,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-
file://relocate.patch"
SRC_URI:append:class-nativesdk = " file://relocate.patch"
-SRC_URI[sha256sum] = "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
+SRC_URI[sha256sum] = "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
EXTRA_OECONF = "--disable-ldap \
--disable-ccid-driver \
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* RE: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
2026-01-12 7:14 [OE-core][scarthgap][patch] " Vijay Anusuri
@ 2026-01-12 7:17 ` Marko, Peter
2026-01-12 7:29 ` Vijay Anusuri
0 siblings, 1 reply; 11+ messages in thread
From: Marko, Peter @ 2026-01-12 7:17 UTC (permalink / raw)
To: vanusuri@mvista.com, openembedded-core@lists.openembedded.org
Sent already 2 days ago...
https://lists.openembedded.org/g/openembedded-core/message/229168
Peter
-----Original Message-----
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Vijay Anusuri via lists.openembedded.org
Sent: Monday, January 12, 2026 8:15
To: openembedded-core@lists.openembedded.org
Cc: Vijay Anusuri <vanusuri@mvista.com>
Subject: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
This release includes fix for CVE-2025-68973
Changelog:
==========
* gpg: Fix possible memory corruption in the armor parser. [T7906]
* gpg: Avoid potential downgrade to SHA1 in 3rd party key
signatures. [rGddb012be7f]
* gpg: Error out on unverified output for non-detached signatures.
[rG9d302f978b]
* gpg: Do not allow compressed key packets on import. [T7014]
* scd: Fix a harmless read buffer over-read in a function used by
PKCS#15 cards. [T7662]
* dirmngr: Do not require a keyserver for "gpg --fetch-key".
[T7693]
* agent: Fix ssh-agent's request_identities for skipped Brainpool
keys. [rG6bf5696c85]
Release-info: https://dev.gnupg.org/T8001
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} (97%)
diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
similarity index 97%
rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
index a6e777abf8..4f60a4e7b2 100644
--- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
@@ -23,7 +23,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-
file://relocate.patch"
SRC_URI:append:class-nativesdk = " file://relocate.patch"
-SRC_URI[sha256sum] = "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
+SRC_URI[sha256sum] = "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
EXTRA_OECONF = "--disable-ldap \
--disable-ccid-driver \
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
2026-01-12 7:17 ` Marko, Peter
@ 2026-01-12 7:29 ` Vijay Anusuri
2026-01-12 18:21 ` Yoann Congal
0 siblings, 1 reply; 11+ messages in thread
From: Vijay Anusuri @ 2026-01-12 7:29 UTC (permalink / raw)
To: Marko, Peter; +Cc: openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 2664 bytes --]
Hi Peter,
Thanks for letting me know. Sorry, I missed your earlier patch — I see it
now.
Steve,
Please ignore my patch.
Thanks & Regards,
Vijay
On Mon, Jan 12, 2026 at 12:47 PM Marko, Peter <Peter.Marko@siemens.com>
wrote:
> Sent already 2 days ago...
> https://lists.openembedded.org/g/openembedded-core/message/229168
>
> Peter
>
> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <
> openembedded-core@lists.openembedded.org> On Behalf Of Vijay Anusuri via
> lists.openembedded.org
> Sent: Monday, January 12, 2026 8:15
> To: openembedded-core@lists.openembedded.org
> Cc: Vijay Anusuri <vanusuri@mvista.com>
> Subject: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
>
> This release includes fix for CVE-2025-68973
>
> Changelog:
> ==========
> * gpg: Fix possible memory corruption in the armor parser. [T7906]
>
> * gpg: Avoid potential downgrade to SHA1 in 3rd party key
> signatures. [rGddb012be7f]
>
> * gpg: Error out on unverified output for non-detached signatures.
> [rG9d302f978b]
>
> * gpg: Do not allow compressed key packets on import. [T7014]
>
> * scd: Fix a harmless read buffer over-read in a function used by
> PKCS#15 cards. [T7662]
>
> * dirmngr: Do not require a keyserver for "gpg --fetch-key".
> [T7693]
>
> * agent: Fix ssh-agent's request_identities for skipped Brainpool
> keys. [rG6bf5696c85]
>
> Release-info: https://dev.gnupg.org/T8001
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
> (97%)
>
> diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
> b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
> similarity index 97%
> rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
> rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
> index a6e777abf8..4f60a4e7b2 100644
> --- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
> +++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
> @@ -23,7 +23,7 @@ SRC_URI:append:class-native = "
> file://0001-configure.ac-use-a-custom-value-for-
> file://relocate.patch"
> SRC_URI:append:class-nativesdk = " file://relocate.patch"
>
> -SRC_URI[sha256sum] =
> "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
> +SRC_URI[sha256sum] =
> "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
>
> EXTRA_OECONF = "--disable-ldap \
> --disable-ccid-driver \
> --
> 2.43.0
>
>
[-- Attachment #2: Type: text/html, Size: 4597 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
2026-01-12 7:29 ` Vijay Anusuri
@ 2026-01-12 18:21 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-01-12 18:21 UTC (permalink / raw)
To: vanusuri; +Cc: Marko, Peter, openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 3475 bytes --]
Hi,
Le lun. 12 janv. 2026 à 08:30, Vijay Anusuri via lists.openembedded.org
<vanusuri=mvista.com@lists.openembedded.org> a écrit :
> Hi Peter,
>
> Thanks for letting me know. Sorry, I missed your earlier patch — I see it
> now.
>
> Steve,
>
FYI, I took over Steve's role as Stable/LTS maintainer
> Please ignore my patch.
>
Will do! :-)
Thanks!
> Thanks & Regards,
> Vijay
>
> On Mon, Jan 12, 2026 at 12:47 PM Marko, Peter <Peter.Marko@siemens.com>
> wrote:
>
>> Sent already 2 days ago...
>> https://lists.openembedded.org/g/openembedded-core/message/229168
>>
>> Peter
>>
>> -----Original Message-----
>> From: openembedded-core@lists.openembedded.org <
>> openembedded-core@lists.openembedded.org> On Behalf Of Vijay Anusuri via
>> lists.openembedded.org
>> Sent: Monday, January 12, 2026 8:15
>> To: openembedded-core@lists.openembedded.org
>> Cc: Vijay Anusuri <vanusuri@mvista.com>
>> Subject: [OE-core][scarthgap][patch] gnupg: upgrade 2.4.8 -> 2.4.9
>>
>> This release includes fix for CVE-2025-68973
>>
>> Changelog:
>> ==========
>> * gpg: Fix possible memory corruption in the armor parser. [T7906]
>>
>> * gpg: Avoid potential downgrade to SHA1 in 3rd party key
>> signatures. [rGddb012be7f]
>>
>> * gpg: Error out on unverified output for non-detached signatures.
>> [rG9d302f978b]
>>
>> * gpg: Do not allow compressed key packets on import. [T7014]
>>
>> * scd: Fix a harmless read buffer over-read in a function used by
>> PKCS#15 cards. [T7662]
>>
>> * dirmngr: Do not require a keyserver for "gpg --fetch-key".
>> [T7693]
>>
>> * agent: Fix ssh-agent's request_identities for skipped Brainpool
>> keys. [rG6bf5696c85]
>>
>> Release-info: https://dev.gnupg.org/T8001
>>
>> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
>> ---
>> meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
>> (97%)
>>
>> diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
>> b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
>> similarity index 97%
>> rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
>> rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
>> index a6e777abf8..4f60a4e7b2 100644
>> --- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
>> +++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
>> @@ -23,7 +23,7 @@ SRC_URI:append:class-native = "
>> file://0001-configure.ac-use-a-custom-value-for-
>> file://relocate.patch"
>> SRC_URI:append:class-nativesdk = " file://relocate.patch"
>>
>> -SRC_URI[sha256sum] =
>> "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
>> +SRC_URI[sha256sum] =
>> "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
>>
>> EXTRA_OECONF = "--disable-ldap \
>> --disable-ccid-driver \
>> --
>> 2.43.0
>>
>>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#229186):
> https://lists.openembedded.org/g/openembedded-core/message/229186
> Mute This Topic: https://lists.openembedded.org/mt/117220079/4316185
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> yoann.congal@smile.fr]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 6758 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* RE: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
[not found] <1889800F45802F27.2902090@lists.openembedded.org>
@ 2026-02-04 7:20 ` Marko, Peter
2026-02-04 8:11 ` Yoann Congal
0 siblings, 1 reply; 11+ messages in thread
From: Marko, Peter @ 2026-02-04 7:20 UTC (permalink / raw)
To: Yoann Congal; +Cc: openembedded-core@lists.openembedded.org
Gentle ping
> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Peter Marko via
> lists.openembedded.org
> Sent: Saturday, January 10, 2026 23:45
> To: openembedded-core@lists.openembedded.org
> Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
>
> From: Peter Marko <peter.marko@siemens.com>
>
> Handles CVE-2025-68973.
>
> Refresh patches.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
> meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
> .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> 2 files changed, 8 insertions(+), 8 deletions(-)
> rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} (97%)
>
> diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch b/meta/recipes-
> support/gnupg/gnupg/relocate.patch
> index ea0252026aa..655dd3d0ce1 100644
> --- a/meta/recipes-support/gnupg/gnupg/relocate.patch
> +++ b/meta/recipes-support/gnupg/gnupg/relocate.patch
> @@ -17,7 +17,7 @@ diff --git a/common/homedir.c b/common/homedir.c
> index 6f99f3e..f22aa9e 100644
> --- a/common/homedir.c
> +++ b/common/homedir.c
> -@@ -1284,7 +1284,7 @@ gnupg_socketdir (void)
> +@@ -1294,7 +1294,7 @@ gnupg_socketdir (void)
> if (!name)
> {
> unsigned int dummy;
> @@ -26,7 +26,7 @@ index 6f99f3e..f22aa9e 100644
> gpgrt_annotate_leaked_object (name);
> }
>
> -@@ -1316,7 +1316,7 @@ gnupg_sysconfdir (void)
> +@@ -1326,7 +1326,7 @@ gnupg_sysconfdir (void)
> if (dir)
> return dir;
> else
> @@ -35,7 +35,7 @@ index 6f99f3e..f22aa9e 100644
> #endif /*!HAVE_W32_SYSTEM*/
> }
>
> -@@ -1352,7 +1352,7 @@ gnupg_bindir (void)
> +@@ -1362,7 +1362,7 @@ gnupg_bindir (void)
> return name;
> }
> else
> @@ -44,7 +44,7 @@ index 6f99f3e..f22aa9e 100644
> #endif /*!HAVE_W32_SYSTEM*/
> }
>
> -@@ -1379,7 +1379,7 @@ gnupg_libexecdir (void)
> +@@ -1389,7 +1389,7 @@ gnupg_libexecdir (void)
> return name;
> }
> else
> @@ -53,7 +53,7 @@ index 6f99f3e..f22aa9e 100644
> #endif /*!HAVE_W32_SYSTEM*/
> }
>
> -@@ -1409,7 +1409,7 @@ gnupg_libdir (void)
> +@@ -1419,7 +1419,7 @@ gnupg_libdir (void)
> return name;
> }
> else
> @@ -62,7 +62,7 @@ index 6f99f3e..f22aa9e 100644
> #endif /*!HAVE_W32_SYSTEM*/
> }
>
> -@@ -1440,7 +1440,7 @@ gnupg_datadir (void)
> +@@ -1450,7 +1450,7 @@ gnupg_datadir (void)
> return name;
> }
> else
> @@ -71,7 +71,7 @@ index 6f99f3e..f22aa9e 100644
> #endif /*!HAVE_W32_SYSTEM*/
> }
>
> -@@ -1472,7 +1472,7 @@ gnupg_localedir (void)
> +@@ -1482,7 +1482,7 @@ gnupg_localedir (void)
> return name;
> }
> else
> diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-
> support/gnupg/gnupg_2.4.9.bb
> similarity index 97%
> rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
> rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
> index a6e777abf89..4f60a4e7b28 100644
> --- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
> +++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
> @@ -23,7 +23,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-
> use-a-custom-value-for-
> file://relocate.patch"
> SRC_URI:append:class-nativesdk = " file://relocate.patch"
>
> -SRC_URI[sha256sum] =
> "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
> +SRC_URI[sha256sum] =
> "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
>
> EXTRA_OECONF = "--disable-ldap \
> --disable-ccid-driver \
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
2026-02-04 7:20 ` [OE-core][scarthgap][PATCH] " Marko, Peter
@ 2026-02-04 8:11 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-02-04 8:11 UTC (permalink / raw)
To: Marko, Peter; +Cc: openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 4220 bytes --]
Le mer. 4 févr. 2026 à 08:20, Marko, Peter <Peter.Marko@siemens.com> a
écrit :
> Gentle ping
>
Thanks, I had missed it,
I've now added it to the series under test/review.
> > -----Original Message-----
> > From: openembedded-core@lists.openembedded.org <openembedded-
> > core@lists.openembedded.org> On Behalf Of Peter Marko via
> > lists.openembedded.org
> > Sent: Saturday, January 10, 2026 23:45
> > To: openembedded-core@lists.openembedded.org
> > Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> > Subject: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
> >
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Handles CVE-2025-68973.
> >
> > Refresh patches.
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> > meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
> > .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> > 2 files changed, 8 insertions(+), 8 deletions(-)
> > rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
> (97%)
> >
> > diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch
> b/meta/recipes-
> > support/gnupg/gnupg/relocate.patch
> > index ea0252026aa..655dd3d0ce1 100644
> > --- a/meta/recipes-support/gnupg/gnupg/relocate.patch
> > +++ b/meta/recipes-support/gnupg/gnupg/relocate.patch
> > @@ -17,7 +17,7 @@ diff --git a/common/homedir.c b/common/homedir.c
> > index 6f99f3e..f22aa9e 100644
> > --- a/common/homedir.c
> > +++ b/common/homedir.c
> > -@@ -1284,7 +1284,7 @@ gnupg_socketdir (void)
> > +@@ -1294,7 +1294,7 @@ gnupg_socketdir (void)
> > if (!name)
> > {
> > unsigned int dummy;
> > @@ -26,7 +26,7 @@ index 6f99f3e..f22aa9e 100644
> > gpgrt_annotate_leaked_object (name);
> > }
> >
> > -@@ -1316,7 +1316,7 @@ gnupg_sysconfdir (void)
> > +@@ -1326,7 +1326,7 @@ gnupg_sysconfdir (void)
> > if (dir)
> > return dir;
> > else
> > @@ -35,7 +35,7 @@ index 6f99f3e..f22aa9e 100644
> > #endif /*!HAVE_W32_SYSTEM*/
> > }
> >
> > -@@ -1352,7 +1352,7 @@ gnupg_bindir (void)
> > +@@ -1362,7 +1362,7 @@ gnupg_bindir (void)
> > return name;
> > }
> > else
> > @@ -44,7 +44,7 @@ index 6f99f3e..f22aa9e 100644
> > #endif /*!HAVE_W32_SYSTEM*/
> > }
> >
> > -@@ -1379,7 +1379,7 @@ gnupg_libexecdir (void)
> > +@@ -1389,7 +1389,7 @@ gnupg_libexecdir (void)
> > return name;
> > }
> > else
> > @@ -53,7 +53,7 @@ index 6f99f3e..f22aa9e 100644
> > #endif /*!HAVE_W32_SYSTEM*/
> > }
> >
> > -@@ -1409,7 +1409,7 @@ gnupg_libdir (void)
> > +@@ -1419,7 +1419,7 @@ gnupg_libdir (void)
> > return name;
> > }
> > else
> > @@ -62,7 +62,7 @@ index 6f99f3e..f22aa9e 100644
> > #endif /*!HAVE_W32_SYSTEM*/
> > }
> >
> > -@@ -1440,7 +1440,7 @@ gnupg_datadir (void)
> > +@@ -1450,7 +1450,7 @@ gnupg_datadir (void)
> > return name;
> > }
> > else
> > @@ -71,7 +71,7 @@ index 6f99f3e..f22aa9e 100644
> > #endif /*!HAVE_W32_SYSTEM*/
> > }
> >
> > -@@ -1472,7 +1472,7 @@ gnupg_localedir (void)
> > +@@ -1482,7 +1482,7 @@ gnupg_localedir (void)
> > return name;
> > }
> > else
> > diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-
> > support/gnupg/gnupg_2.4.9.bb
> > similarity index 97%
> > rename from meta/recipes-support/gnupg/gnupg_2.4.8.bb
> > rename to meta/recipes-support/gnupg/gnupg_2.4.9.bb
> > index a6e777abf89..4f60a4e7b28 100644
> > --- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
> > +++ b/meta/recipes-support/gnupg/gnupg_2.4.9.bb
> > @@ -23,7 +23,7 @@ SRC_URI:append:class-native = "
> file://0001-configure.ac-
> > use-a-custom-value-for-
> > file://relocate.patch"
> > SRC_URI:append:class-nativesdk = " file://relocate.patch"
> >
> > -SRC_URI[sha256sum] =
> > "b58c80d79b04d3243ff49c1c3fc6b5f83138eb3784689563bcdd060595318616"
> > +SRC_URI[sha256sum] =
> > "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
> >
> > EXTRA_OECONF = "--disable-ldap \
> > --disable-ccid-driver \
>
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 6912 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
2026-01-10 22:44 [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9 Peter Marko
@ 2026-02-04 10:10 ` Yoann Congal
2026-02-18 21:28 ` Marko, Peter
0 siblings, 1 reply; 11+ messages in thread
From: Yoann Congal @ 2026-02-04 10:10 UTC (permalink / raw)
To: peter.marko, openembedded-core
On Sat Jan 10, 2026 at 11:44 PM CET, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> Handles CVE-2025-68973.
>
> Refresh patches.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
> meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
> .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> 2 files changed, 8 insertions(+), 8 deletions(-)
> rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} (97%)
Hello,
I've tested that on autobuilder but got an error in oe-selftest-debian:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
ERROR: autoconf-native-2.72e-r0 do_recipe_qa: GPG exited with code 2: gpg: signing failed: Corrupted protection
gpg: signing failed: Corrupted protection
ERROR: patch-native-2.7.6-r0 do_recipe_qa: GPG exited with code 2: gpg: signing failed: Corrupted protection
gpg: signing failed: Corrupted protection
I've started a build with this gnupg upgrade reverted to confirm that
this is indeed the cause:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3142
Can you look at this?
Thanks!
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* RE: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
2026-02-04 10:10 ` Yoann Congal
@ 2026-02-18 21:28 ` Marko, Peter
2026-02-19 13:54 ` Yoann Congal
0 siblings, 1 reply; 11+ messages in thread
From: Marko, Peter @ 2026-02-18 21:28 UTC (permalink / raw)
To: Yoann Congal, openembedded-core@lists.openembedded.org
> -----Original Message-----
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: Wednesday, February 4, 2026 11:10
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
>
> On Sat Jan 10, 2026 at 11:44 PM CET, Peter Marko via lists.openembedded.org
> wrote:
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Handles CVE-2025-68973.
> >
> > Refresh patches.
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> > meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
> > .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> > 2 files changed, 8 insertions(+), 8 deletions(-)
> > rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
> (97%)
>
> Hello,
>
> I've tested that on autobuilder but got an error in oe-selftest-debian:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
> ERROR: autoconf-native-2.72e-r0 do_recipe_qa: GPG exited with code 2: gpg:
> signing failed: Corrupted protection
> gpg: signing failed: Corrupted protection
> ERROR: patch-native-2.7.6-r0 do_recipe_qa: GPG exited with code 2: gpg:
> signing failed: Corrupted protection
> gpg: signing failed: Corrupted protection
>
> I've started a build with this gnupg upgrade reverted to confirm that
> this is indeed the cause:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3142
>
> Can you look at this?
> Thanks!
Unfortunately, I'm not able to reproduce this failure.
On my Debian 11 I have:
SANITY_TESTED_DISTROS = ""
PACKAGE_CLASSES = "package_rpm"
RPM_GPG_SIGN_CHUNK = "1"
IMAGE_CLASSES += 'testimage'
And run:
oe-selftest -r signing -j 16
And get:
oe-selftest - INFO - RESULTS - signing.LockedSignatures.test_locked_signatures: PASSED (122.35s)
oe-selftest - INFO - RESULTS - signing.Signing.test_signing_packages: PASSED (155.34s)
oe-selftest - INFO - RESULTS - signing.Signing.test_signing_sstate_archive: PASSED (121.11s)
oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=3, skipped=0, failures=0, errors=0)
So I guess I just backport the CVE fix instead of this upgrade.
Peter
>
> Regards,
>
> --
> Yoann Congal
> Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
2026-02-18 21:28 ` Marko, Peter
@ 2026-02-19 13:54 ` Yoann Congal
2026-02-22 20:53 ` Marko, Peter
0 siblings, 1 reply; 11+ messages in thread
From: Yoann Congal @ 2026-02-19 13:54 UTC (permalink / raw)
To: Marko, Peter, openembedded-core@lists.openembedded.org
On Wed Feb 18, 2026 at 10:28 PM CET, Peter Marko wrote:
>
>
>> -----Original Message-----
>> From: Yoann Congal <yoann.congal@smile.fr>
>> Sent: Wednesday, February 4, 2026 11:10
>> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
>> openembedded-core@lists.openembedded.org
>> Subject: Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
>>
>> On Sat Jan 10, 2026 at 11:44 PM CET, Peter Marko via lists.openembedded.org
>> wrote:
>> > From: Peter Marko <peter.marko@siemens.com>
>> >
>> > Handles CVE-2025-68973.
>> >
>> > Refresh patches.
>> >
>> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> > ---
>> > meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
>> > .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
>> > 2 files changed, 8 insertions(+), 8 deletions(-)
>> > rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
>> (97%)
>>
>> Hello,
>>
>> I've tested that on autobuilder but got an error in oe-selftest-debian:
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
>> ERROR: autoconf-native-2.72e-r0 do_recipe_qa: GPG exited with code 2: gpg:
>> signing failed: Corrupted protection
>> gpg: signing failed: Corrupted protection
>> ERROR: patch-native-2.7.6-r0 do_recipe_qa: GPG exited with code 2: gpg:
>> signing failed: Corrupted protection
>> gpg: signing failed: Corrupted protection
>>
>> I've started a build with this gnupg upgrade reverted to confirm that
>> this is indeed the cause:
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3142
>>
>> Can you look at this?
>> Thanks!
>
> Unfortunately, I'm not able to reproduce this failure.
>
> On my Debian 11 I have:
> SANITY_TESTED_DISTROS = ""
> PACKAGE_CLASSES = "package_rpm"
> RPM_GPG_SIGN_CHUNK = "1"
> IMAGE_CLASSES += 'testimage'
> And run:
> oe-selftest -r signing -j 16
> And get:
> oe-selftest - INFO - RESULTS - signing.LockedSignatures.test_locked_signatures: PASSED (122.35s)
> oe-selftest - INFO - RESULTS - signing.Signing.test_signing_packages: PASSED (155.34s)
> oe-selftest - INFO - RESULTS - signing.Signing.test_signing_sstate_archive: PASSED (121.11s)
> oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=3, skipped=0, failures=0, errors=0)
FYI, the failing build:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
... was on Debian 12
(It's the retry with this patch reverted that was on Debian 11)
Scarthgap has since been successfully retried on Debian 12 (without this
patch):
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3226
Can you check this on Debian 12?
Thanks!
> So I guess I just backport the CVE fix instead of this upgrade.
>
> Peter
>
>>
>> Regards,
>>
>> --
>> Yoann Congal
>> Smile ECS
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* RE: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
2026-02-19 13:54 ` Yoann Congal
@ 2026-02-22 20:53 ` Marko, Peter
0 siblings, 0 replies; 11+ messages in thread
From: Marko, Peter @ 2026-02-22 20:53 UTC (permalink / raw)
To: Yoann Congal, openembedded-core@lists.openembedded.org
> -----Original Message-----
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: Thursday, February 19, 2026 14:55
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
>
> On Wed Feb 18, 2026 at 10:28 PM CET, Peter Marko wrote:
> >
> >
> >> -----Original Message-----
> >> From: Yoann Congal <yoann.congal@smile.fr>
> >> Sent: Wednesday, February 4, 2026 11:10
> >> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> >> openembedded-core@lists.openembedded.org
> >> Subject: Re: [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9
> >>
> >> On Sat Jan 10, 2026 at 11:44 PM CET, Peter Marko via
> lists.openembedded.org
> >> wrote:
> >> > From: Peter Marko <peter.marko@siemens.com>
> >> >
> >> > Handles CVE-2025-68973.
> >> >
> >> > Refresh patches.
> >> >
> >> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> >> > ---
> >> > meta/recipes-support/gnupg/gnupg/relocate.patch | 14 +++++++-------
> >> > .../gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb} | 2 +-
> >> > 2 files changed, 8 insertions(+), 8 deletions(-)
> >> > rename meta/recipes-support/gnupg/{gnupg_2.4.8.bb => gnupg_2.4.9.bb}
> >> (97%)
> >>
> >> Hello,
> >>
> >> I've tested that on autobuilder but got an error in oe-selftest-debian:
> >> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
> >> ERROR: autoconf-native-2.72e-r0 do_recipe_qa: GPG exited with code 2:
> gpg:
> >> signing failed: Corrupted protection
> >> gpg: signing failed: Corrupted protection
> >> ERROR: patch-native-2.7.6-r0 do_recipe_qa: GPG exited with code 2: gpg:
> >> signing failed: Corrupted protection
> >> gpg: signing failed: Corrupted protection
> >>
> >> I've started a build with this gnupg upgrade reverted to confirm that
> >> this is indeed the cause:
> >> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3142
> >>
> >> Can you look at this?
> >> Thanks!
> >
> > Unfortunately, I'm not able to reproduce this failure.
> >
> > On my Debian 11 I have:
> > SANITY_TESTED_DISTROS = ""
> > PACKAGE_CLASSES = "package_rpm"
> > RPM_GPG_SIGN_CHUNK = "1"
> > IMAGE_CLASSES += 'testimage'
> > And run:
> > oe-selftest -r signing -j 16
> > And get:
> > oe-selftest - INFO - RESULTS -
> signing.LockedSignatures.test_locked_signatures: PASSED (122.35s)
> > oe-selftest - INFO - RESULTS - signing.Signing.test_signing_packages:
> PASSED (155.34s)
> > oe-selftest - INFO - RESULTS - signing.Signing.test_signing_sstate_archive:
> PASSED (121.11s)
> > oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=3,
> skipped=0, failures=0, errors=0)
>
> FYI, the failing build:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3138
> ... was on Debian 12
> (It's the retry with this patch reverted that was on Debian 11)
>
> Scarthgap has since been successfully retried on Debian 12 (without this
> patch):
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/3226
>
> Can you check this on Debian 12?
I have retested with Debian 12 and 13 and the tests were green.
I guess I'm missing some configuration from AB so I have no clue how to fix it...
So again, I'm just going to backport the CVE patch for now instead of upgrade...
Peter
>
> Thanks!
>
> > So I guess I just backport the CVE fix instead of this upgrade.
> >
> > Peter
> >
> >>
> >> Regards,
> >>
> >> --
> >> Yoann Congal
> >> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-02-22 20:53 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-10 22:44 [OE-core][scarthgap][PATCH] gnupg: upgrade 2.4.8 -> 2.4.9 Peter Marko
2026-02-04 10:10 ` Yoann Congal
2026-02-18 21:28 ` Marko, Peter
2026-02-19 13:54 ` Yoann Congal
2026-02-22 20:53 ` Marko, Peter
-- strict thread matches above, loose matches on Subject: below --
2026-01-12 7:14 [OE-core][scarthgap][patch] " Vijay Anusuri
2026-01-12 7:17 ` Marko, Peter
2026-01-12 7:29 ` Vijay Anusuri
2026-01-12 18:21 ` Yoann Congal
[not found] <1889800F45802F27.2902090@lists.openembedded.org>
2026-02-04 7:20 ` [OE-core][scarthgap][PATCH] " Marko, Peter
2026-02-04 8:11 ` Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox