Re: [OE-core] [PATCH][dunfell] zlib: backport the fix for CVE-2018-25032

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Wed, 2022-04-13 at 11:39 -1000, Steve Sakoman wrote:
> On Wed, Apr 13, 2022 at 9:05 AM Ralph Siemsen <ralph.siemsen@linaro.org> wrote:
> > 
> > On Wed, Apr 13, 2022 at 2:19 PM Steve Sakoman <steve@sakoman.com> wrote:
> > 
> > > Yes, and it appears they had a quite similar bug in the past!
> > > 
> > > https://lists.debian.org/deity/2006/07/msg00074.html
> > 
> > Interesting find... though it seems that is in a different sha256
> > implementation than the one being used here ("Gifford").
> 
> I did another experiment, where I disabled generation of the sha256
> entries in Release (by adding --no-sha256 to the apt-ftparchive
> command)
> 
> As a result we get past this first hash mismatch in Release, but then
> get later hash mismatches when it tries to download .debs.
> 
> https://errors.yoctoproject.org/Errors/Details/654717/
> 
> So it really does seem that apt sha256 generation is broken on
> non-debian distros.
> 
> > The other factor is that it behaves on ubuntu, but not fedora. Do the
> > native packages get built with the host gcc (11.2 on fedora 35,
> > whereas 9.3 on ubuntu 20.x)? Or does yocto also build a native
> > toolchain to build host packages with?
> 
> Perhaps Richard can answer this question!

Native recipes are built using the host gcc so this could be host gcc dependent.
We do use buildtools-tarball on some hosts where the gcc is too old. You can see
what is used where in config.json in autobuilder-helper near the end.

Cheers,

Richard