Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
> patched in u-boot showed-up in CVE reports for u-boot-tools.
>
> It does not make much sense to share git repository but not share all
> patches on top of it, so move adding all patches from u-boot recipe to a
> common include file where also the git repository is defined.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>  3 files changed, 10 insertions(+), 14 deletions(-)

Hello Peter, Hetvi,

There is a bit of back-and-forth around u-boot-common.inc. So I thought I
would give my vision and get your thoughts.

Fundamentally, there is confusion about the usage of this .inc file:
* This is the common part of u-boot and u-boot-tools recipes (what the
  above patch uses)
* But, also, this may be used by downstream layers to reuse u-boot
  recipe parts. We basically did the revert of Peter's patch a few month
  ago for this reason[0].

With Paul, we would like to have a single set of patches common for both
u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
is a risk of breaking downstream layers.

Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
not attached to the name) that contains only SRC_URI += "CVE_*.patch"
and a big warning explaining that is file is only supposed to be
included from layer-local recipes (namely u-boot and u-boot-tools).

This whole situation is not ideal but think the above would solve our
issues and still be acceptable under stable policy.

What do you think?

Regards,

[0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
     https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
-- 
Yoann Congal
Smile ECS