Openembedded Core Discussions
 help / color / mirror / Atom feed
* [OE-core][kirkstone 00/28] Patch review
@ 2023-07-06 15:06 Steve Sakoman
  2023-07-06 15:06 ` [OE-core][kirkstone 01/28] go: fix CVE-2023-29400 html/template improper handling of empty HTML attributes Steve Sakoman
                   ` (27 more replies)
  0 siblings, 28 replies; 31+ messages in thread
From: Steve Sakoman @ 2023-07-06 15:06 UTC (permalink / raw)
  To: openembedded-core

Please review this set of changes for kirkstone and have comments back by
end of day Monday.

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5564

The following changes since commit f20a12ead2d5890e88e7f4ce149a777de47edc48:

  blktrace: ask for python3 specifically (2023-06-27 12:49:55 -1000)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
  http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut

Alexander Kanavin (6):
  scripts/runqemu: split lock dir creation into a reusable function
  scripts/runqemu: allocate unfsd ports in a way that doesn't race or
    clash with unrelated processes
  maintainers.inc: unassign Adrian Bunk from wireless-regdb
  maintainers.inc: unassign Alistair Francis from opensbi
  maintainers.inc: unassign Ricardo Neri from ovmf
  grub: submit determinism.patch upstream

BELOUARGA Mohamed (1):
  meta: lib: oe: npm_registry: Add more safe caracters

Bruce Ashfield (6):
  linux-yocto/5.15: update to v5.15.114
  linux-yocto/5.15: update to v5.15.115
  linux-yocto/5.15: update to v5.15.116
  linux-yocto/5.15: update to v5.15.117
  linux-yocto/5.15: update to v5.15.118
  linux-yocto/5.15: cfg: fix DECNET configuration warning

Charlie Wu (1):
  devtool: Fix the wrong variable in srcuri_entry

Etienne Cordonnier (1):
  libxcrypt: fix hard-coded ".so" extension

Fabien Mahot (1):
  oeqa/selftest/bbtests: add non-existent prefile/postfile tests

Frieder Paape (1):
  image_types: Fix reproducible builds for initramfs and UKI img

Khem Raj (1):
  babeltrace2: Always use BFD linker when building tests with ld-is-lld
    distro feature

Marek Vasut (1):
  cpio: Replace fix wrong CRC with ASCII CRC for large files with
    upstream backport

Mikko Rapeli (1):
  useradd-staticids.bbclass: improve error message

Richard Purdie (4):
  v86d: Improve kernel dependency
  strace: Disable failing test
  strace: Merge two similar patches
  strace: Update patches/tests with upstream fixes

Rusty Howell (1):
  oe-depends-dot: Handle new format for task-depends.dot

Vivek Kumbhar (3):
  go: fix CVE-2023-29400 html/template improper handling of empty HTML
    attributes
  libcap: fix CVE-2023-2603 Integer Overflow in _libcap_strdup()
  cups: fix CVE-2023-34241 use-after-free in cupsdAcceptClient() in
    scheduler/client.c

 meta/classes/image_types.bbclass              |   5 +-
 meta/classes/useradd-staticids.bbclass        |   2 +-
 meta/conf/distro/include/maintainers.inc      |   8 +-
 meta/lib/oe/npm_registry.py                   |   2 +-
 meta/lib/oeqa/selftest/cases/bbtests.py       |   8 +
 meta/recipes-bsp/grub/files/determinism.patch |   2 +-
 meta/recipes-bsp/v86d/v86d_0.1.10.bb          |   1 -
 meta/recipes-core/libxcrypt/libxcrypt.inc     |   6 -
 meta/recipes-devtools/go/go-1.17.13.inc       |   1 +
 .../go/go-1.18/CVE-2023-29400.patch           |  99 ++++++
 ...0001-caps-abbrev.awk-fix-gawk-s-path.patch |  47 ---
 ...b541b258baec9eba674b5d8dc30007a61542.patch |  50 +++
 ...2f4494779e5c5f170ad10539bfc2dfafe967.patch |  50 +++
 .../strace/strace/update-gawk-paths.patch     |  30 ++
 meta/recipes-devtools/strace/strace_5.16.bb   |   3 +-
 ...g-CRC-with-ASCII-CRC-for-large-files.patch |  39 ---
 ...-calculation-of-CRC-in-copy-out-mode.patch |  58 ++++
 ...appending-to-archives-bigger-than-2G.patch | 312 ++++++++++++++++++
 meta/recipes-extended/cpio/cpio_2.13.bb       |   3 +-
 meta/recipes-extended/cups/cups.inc           |   1 +
 .../cups/cups/CVE-2023-34241.patch            |  68 ++++
 .../linux/linux-yocto-rt_5.15.bb              |   6 +-
 .../linux/linux-yocto-tiny_5.15.bb            |   6 +-
 meta/recipes-kernel/linux/linux-yocto_5.15.bb |  26 +-
 .../recipes-kernel/lttng/babeltrace2_2.0.5.bb |   1 +
 .../libcap/files/CVE-2023-2603.patch          |  60 ++++
 meta/recipes-support/libcap/libcap_2.66.bb    |   1 +
 scripts/lib/devtool/standard.py               |   2 +-
 scripts/lib/wic/plugins/source/bootimg-efi.py |   2 +
 scripts/oe-depends-dot                        |  21 +-
 scripts/runqemu                               |  48 ++-
 31 files changed, 816 insertions(+), 152 deletions(-)
 create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-29400.patch
 delete mode 100644 meta/recipes-devtools/strace/strace/0001-caps-abbrev.awk-fix-gawk-s-path.patch
 create mode 100644 meta/recipes-devtools/strace/strace/3bbfb541b258baec9eba674b5d8dc30007a61542.patch
 create mode 100644 meta/recipes-devtools/strace/strace/f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch
 delete mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
 create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0003-Fix-calculation-of-CRC-in-copy-out-mode.patch
 create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0004-Fix-appending-to-archives-bigger-than-2G.patch
 create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-34241.patch
 create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2603.patch

-- 
2.34.1



^ permalink raw reply	[flat|nested] 31+ messages in thread
* [OE-core][kirkstone 00/28] Patch review
@ 2022-08-23 22:35 Steve Sakoman
  0 siblings, 0 replies; 31+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
  To: openembedded-core

Please review this set of patches for kirkstone and have comments back by
end of day Thursday.

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4121

with the exception of a known autobuilder intermittent issue on qemux86-64-ltp:

https://bugzilla.yoctoproject.org/show_bug.cgi?id=14789

which passed on subsequent retest:

https://autobuilder.yoctoproject.org/typhoon/#/builders/95/builds/3699

The following changes since commit 10891d4d955f347c328cf8c099031f05f5c855a2:

  lttng-modules: replace mips compaction fix with upstream change (2022-08-17 04:55:49 -1000)

are available in the Git repository at:

  git://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
  http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut

Alexander Kanavin (9):
  bluez5: update 5.64 -> 5.65
  libwpe: upgrade 1.12.0 -> 1.12.2
  ell: upgrade 0.49 -> 0.50
  iso-codes: upgrade 4.10.0 -> 4.11.0
  libcap: upgrade 2.64 -> 2.65
  libwebp: upgrade 1.2.2 -> 1.2.3
  mobile-broadband-provider-info: upgrade 20220511 -> 20220725
  webkitgtk: upgrade 2.36.4 -> 2.36.5
  weston: upgrade 10.0.1 -> 10.0.2

Beniamin Sandu (1):
  libpam: use /run instead of /var/run in systemd tmpfiles

Changqing Li (1):
  apt: fix nativesdk-apt build failure during the second time build

Daiane Angolini (1):
  python3-pip: Fix RDEPENDS after the update

Ernst Sjöstrand (1):
  cve-check: Don't use f-strings

Hitendra Prajapati (1):
  libtiff: CVE-2022-34526 A stack overflow was discovered

Jose Quaresma (2):
  archiver.bbclass: some recipes that uses the kernelsrc bbclass uses
    the shared source
  linux-yocto: prepend the the value with a space when append to
    KERNEL_EXTRA_ARGS

Kai Kang (1):
  packagegroup-self-hosted: update for strace

Khem Raj (4):
  libxml2: Ignore CVE-2016-3709
  connman: Backports for security fixes
  cracklib: Drop using register keyword
  tcp-wrappers: Fix implicit-function-declaration warnings

Peter Marko (1):
  create-spdx: handle links to inaccessible locations

Richard Purdie (1):
  perf: Fix reproducibility issues with 5.19 onwards

Sakib Sajal (3):
  u-boot: fix CVE-2022-30552
  u-boot: fix CVE-2022-33967
  go: update v1.17.12 -> v1.17.13

Yongxin Liu (1):
  grub2: fix several CVEs

wangmy (1):
  libcap: upgrade 2.63 -> 2.64

 meta/classes/archiver.bbclass                 |   4 +-
 meta/classes/create-spdx.bbclass              |   2 +-
 meta/lib/oe/cve_check.py                      |   2 +-
 ...g-Drop-greyscale-support-to-fix-heap.patch | 179 +++++
 ...ng-Avoid-heap-OOB-R-W-inserting-huff.patch |  50 ++
 ...peg-Block-int-underflow-wild-pointer.patch |  84 +++
 ...3-net-ip-Do-IP-fragment-maths-safely.patch |  63 ++
 ...or-out-on-headers-with-LF-without-CR.patch |  58 ++
 ...Fix-OOB-write-for-split-http-headers.patch |  56 ++
 ...ct-non-kernel-files-in-the-shim_lock.patch | 111 +++
 .../video-Remove-trailing-whitespaces.patch   | 693 ++++++++++++++++++
 ...eg-Abort-sooner-if-a-read-operation-.patch | 264 +++++++
 ...eg-Refuse-to-handle-multiple-start-o.patch |  53 ++
 meta/recipes-bsp/grub/grub2.inc               |  10 +
 ...s-squashfs-Use-kcalloc-when-relevant.patch |  64 ++
 ...e-minimum-IP-fragmented-datagram-siz.patch | 207 ++++++
 meta/recipes-bsp/u-boot/u-boot_2022.01.bb     |   2 +
 meta/recipes-connectivity/bluez5/bluez5.inc   |   1 -
 .../bluez5/bluez5/fix_service.patch           |  30 -
 .../bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} |   2 +-
 .../connman/connman/CVE-2022-32292.patch      |  37 +
 .../connman/connman/CVE-2022-32293_p1.patch   | 141 ++++
 .../connman/connman/CVE-2022-32293_p2.patch   | 174 +++++
 .../connman/connman_1.41.bb                   |   3 +
 .../mobile-broadband-provider-info_git.bb     |   4 +-
 .../ell/{ell_0.49.bb => ell_0.50.bb}          |   2 +-
 meta/recipes-core/libxml/libxml2_2.9.14.bb    |   4 +
 .../packagegroups/packagegroup-self-hosted.bb |   5 +-
 meta/recipes-devtools/apt/apt_2.4.5.bb        |   2 +-
 .../go/{go-1.17.12.inc => go-1.17.13.inc}     |   2 +-
 ...1.17.12.bb => go-binary-native_1.17.13.bb} |   4 +-
 ....17.12.bb => go-cross-canadian_1.17.13.bb} |   0
 ...o-cross_1.17.12.bb => go-cross_1.17.13.bb} |   0
 ...ssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} |   0
 ...native_1.17.12.bb => go-native_1.17.13.bb} |   0
 ...ntime_1.17.12.bb => go-runtime_1.17.13.bb} |   0
 .../go/{go_1.17.12.bb => go_1.17.13.bb}       |   0
 .../python/python3-pip_22.0.3.bb              |   2 +
 ...01-rules-Drop-using-register-keyword.patch | 278 +++++++
 ...rrect-parameter-types-to-Debug-calls.patch |  40 +
 .../cracklib/cracklib_2.9.7.bb                |   5 +-
 meta/recipes-extended/pam/libpam/99_pam       |   2 +-
 ...plicit-function-declaration-warnings.patch | 109 +++
 .../tcp-wrappers/tcp-wrappers_7.6.bb          |   1 +
 .../weston/dont-use-plane-add-prop.patch      |  32 -
 .../{weston_10.0.1.bb => weston_10.0.2.bb}    |   4 +-
 meta/recipes-kernel/linux/linux-yocto.inc     |   2 +-
 meta/recipes-kernel/perf/perf.bb              |   2 +-
 .../libtiff/tiff/CVE-2022-34526.patch         |  29 +
 meta/recipes-multimedia/libtiff/tiff_4.3.0.bb |   1 +
 .../{libwebp_1.2.2.bb => libwebp_1.2.3.bb}    |   2 +-
 ...ure-due-to-libc-using-libc-functions.patch |  42 ++
 .../{libwpe_1.12.0.bb => libwpe_1.12.2.bb}    |   6 +-
 ...ebkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} |   2 +-
 ...so-codes_4.10.0.bb => iso-codes_4.11.0.bb} |   2 +-
 ...-Raise-the-size-of-arrays-containing.patch |   2 +-
 .../libcap/{libcap_2.63.bb => libcap_2.65.bb} |   2 +-
 57 files changed, 2789 insertions(+), 89 deletions(-)
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch
 create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
 create mode 100644 meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch
 create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
 create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/fix_service.patch
 rename meta/recipes-connectivity/bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} (95%)
 create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
 create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
 create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
 rename meta/recipes-core/ell/{ell_0.49.bb => ell_0.50.bb} (89%)
 rename meta/recipes-devtools/go/{go-1.17.12.inc => go-1.17.13.inc} (92%)
 rename meta/recipes-devtools/go/{go-binary-native_1.17.12.bb => go-binary-native_1.17.13.bb} (83%)
 rename meta/recipes-devtools/go/{go-cross-canadian_1.17.12.bb => go-cross-canadian_1.17.13.bb} (100%)
 rename meta/recipes-devtools/go/{go-cross_1.17.12.bb => go-cross_1.17.13.bb} (100%)
 rename meta/recipes-devtools/go/{go-crosssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} (100%)
 rename meta/recipes-devtools/go/{go-native_1.17.12.bb => go-native_1.17.13.bb} (100%)
 rename meta/recipes-devtools/go/{go-runtime_1.17.12.bb => go-runtime_1.17.13.bb} (100%)
 rename meta/recipes-devtools/go/{go_1.17.12.bb => go_1.17.13.bb} (100%)
 create mode 100644 meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
 create mode 100644 meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
 create mode 100644 meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch
 delete mode 100644 meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch
 rename meta/recipes-graphics/wayland/{weston_10.0.1.bb => weston_10.0.2.bb} (97%)
 create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch
 rename meta/recipes-multimedia/webp/{libwebp_1.2.2.bb => libwebp_1.2.3.bb} (95%)
 create mode 100644 meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
 rename meta/recipes-sato/webkit/{libwpe_1.12.0.bb => libwpe_1.12.2.bb} (72%)
 rename meta/recipes-sato/webkit/{webkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} (98%)
 rename meta/recipes-support/iso-codes/{iso-codes_4.10.0.bb => iso-codes_4.11.0.bb} (94%)
 rename meta/recipes-support/libcap/{libcap_2.63.bb => libcap_2.65.bb} (96%)

-- 
2.25.1


^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2023-07-07  8:59 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-06 15:06 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 01/28] go: fix CVE-2023-29400 html/template improper handling of empty HTML attributes Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 02/28] libcap: fix CVE-2023-2603 Integer Overflow in _libcap_strdup() Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 03/28] cpio: Replace fix wrong CRC with ASCII CRC for large files with upstream backport Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 04/28] libxcrypt: fix hard-coded ".so" extension Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 05/28] oe-depends-dot: Handle new format for task-depends.dot Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 06/28] cups: fix CVE-2023-34241 use-after-free in cupsdAcceptClient() in scheduler/client.c Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 07/28] linux-yocto/5.15: update to v5.15.114 Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 08/28] linux-yocto/5.15: update to v5.15.115 Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 09/28] linux-yocto/5.15: update to v5.15.116 Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 10/28] linux-yocto/5.15: update to v5.15.117 Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 11/28] linux-yocto/5.15: update to v5.15.118 Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 12/28] linux-yocto/5.15: cfg: fix DECNET configuration warning Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 13/28] v86d: Improve kernel dependency Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 14/28] image_types: Fix reproducible builds for initramfs and UKI img Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 15/28] meta: lib: oe: npm_registry: Add more safe caracters Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 16/28] scripts/runqemu: split lock dir creation into a reusable function Steve Sakoman
2023-07-07  8:59   ` Philippe Mathieu-Daudé
2023-07-06 15:06 ` [OE-core][kirkstone 17/28] scripts/runqemu: allocate unfsd ports in a way that doesn't race or clash with unrelated processes Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 18/28] oeqa/selftest/bbtests: add non-existent prefile/postfile tests Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 19/28] maintainers.inc: unassign Adrian Bunk from wireless-regdb Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 20/28] maintainers.inc: unassign Alistair Francis from opensbi Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 21/28] maintainers.inc: unassign Ricardo Neri from ovmf Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 22/28] babeltrace2: Always use BFD linker when building tests with ld-is-lld distro feature Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 23/28] useradd-staticids.bbclass: improve error message Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 24/28] devtool: Fix the wrong variable in srcuri_entry Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 25/28] grub: submit determinism.patch upstream Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 26/28] strace: Disable failing test Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 27/28] strace: Merge two similar patches Steve Sakoman
2023-07-06 15:06 ` [OE-core][kirkstone 28/28] strace: Update patches/tests with upstream fixes Steve Sakoman
  -- strict thread matches above, loose matches on Subject: below --
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox