[OE-core][styhead 0/4] Patch review

[OE-core][styhead 0/4] Patch review

[Steve Sakoman]

Please review this set of changes for styhead and have comments back by
end of day Thursday, February 13

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/998

The following changes since commit e475321e933e9c58e88dd445328f9228c417b4ff:

  lrzsz: update SRC_URI to avoid redirect (2025-02-10 08:06:16 -0800)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/styhead-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/styhead-nut

Bruce Ashfield (1):
  linux-yocto/6.6: update to v6.6.75

Peter Marko (3):
  python3: upgrade 3.12.8 -> 3.12.9
  go: upgrade 1.22.11 -> 1.22.12
  cmake: apply parallel build settings to ptest tasks

 meta/classes-recipe/cmake.bbclass             |  2 +
 .../go/{go-1.22.11.inc => go-1.22.12.inc}     |  2 +-
 ...1.22.11.bb => go-binary-native_1.22.12.bb} |  6 +--
 ....22.11.bb => go-cross-canadian_1.22.12.bb} |  0
 ...o-cross_1.22.11.bb => go-cross_1.22.12.bb} |  0
 ...ssdk_1.22.11.bb => go-crosssdk_1.22.12.bb} |  0
 ...ntime_1.22.11.bb => go-runtime_1.22.12.bb} |  0
 .../go/{go_1.22.11.bb => go_1.22.12.bb}       |  0
 ...shebang-overflow-on-python-config.py.patch |  2 +-
 ...sts-due-to-load-variability-on-YP-AB.patch |  4 +-
 ...001-ctypes-correct-gcc-check-in-test.patch | 53 +++++++++++++++++++
 ...asename-to-replace-CC-for-checking-c.patch | 10 ++--
 ...t_readline-skip-limited-history-test.patch |  4 +-
 ...up.py-do-not-add-a-curses-include-pa.patch |  2 +-
 .../python/python3/makerace.patch             |  2 +-
 .../{python3_3.12.8.bb => python3_3.12.9.bb}  |  3 +-
 .../linux/linux-yocto-rt_6.6.bb               |  6 +--
 .../linux/linux-yocto-tiny_6.6.bb             |  6 +--
 meta/recipes-kernel/linux/linux-yocto_6.6.bb  | 28 +++++-----
 19 files changed, 93 insertions(+), 37 deletions(-)
 rename meta/recipes-devtools/go/{go-1.22.11.inc => go-1.22.12.inc} (89%)
 rename meta/recipes-devtools/go/{go-binary-native_1.22.11.bb => go-binary-native_1.22.12.bb} (78%)
 rename meta/recipes-devtools/go/{go-cross-canadian_1.22.11.bb => go-cross-canadian_1.22.12.bb} (100%)
 rename meta/recipes-devtools/go/{go-cross_1.22.11.bb => go-cross_1.22.12.bb} (100%)
 rename meta/recipes-devtools/go/{go-crosssdk_1.22.11.bb => go-crosssdk_1.22.12.bb} (100%)
 rename meta/recipes-devtools/go/{go-runtime_1.22.11.bb => go-runtime_1.22.12.bb} (100%)
 rename meta/recipes-devtools/go/{go_1.22.11.bb => go_1.22.12.bb} (100%)
 create mode 100644 meta/recipes-devtools/python/python3/0001-ctypes-correct-gcc-check-in-test.patch
 rename meta/recipes-devtools/python/{python3_3.12.8.bb => python3_3.12.9.bb} (99%)

-- 
2.43.0

[OE-core][styhead 0/4] Patch review

[Steve Sakoman]

Please review this set of changes for styhead and have comments back by
end of day Tuesday, March 11

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1138

The following changes since commit 35ffa0ed523ba95f069dff5b7df3f819ef031015:

  build-appliance-image: Update to styhead head revision (2025-02-21 14:06:37 -0800)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/styhead-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/styhead-nut

Alessio Cascone (1):
  tzcode-native: Fix compiler setting from 2023d version

Peter Marko (2):
  subversion: ignore CVE-2024-45720
  libxml2: upgrade 2.13.3 -> 2.13.6

Priyal Doshi (1):
  tzdata/tzcode-native: upgrade 2024b -> 2025a

 meta/recipes-core/libxml/libxml2/install-tests.patch        | 4 ++--
 .../libxml/{libxml2_2.13.3.bb => libxml2_2.13.6.bb}         | 2 +-
 meta/recipes-devtools/subversion/subversion_1.14.3.bb       | 2 ++
 meta/recipes-extended/timezone/timezone.inc                 | 6 +++---
 meta/recipes-extended/timezone/tzcode-native.bb             | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)
 rename meta/recipes-core/libxml/{libxml2_2.13.3.bb => libxml2_2.13.6.bb} (97%)

-- 
2.43.0

[OE-core][styhead 1/4] subversion: ignore CVE-2024-45720

[Steve Sakoman]

From: Peter Marko <peter.marko@siemens.com>

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45720

This CVE is relevant only for subversion running on Windows.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Reviewed-by: Sofiane Hamam <sofiane.hamam@smile.fr>
---
 meta/recipes-devtools/subversion/subversion_1.14.3.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/subversion/subversion_1.14.3.bb b/meta/recipes-devtools/subversion/subversion_1.14.3.bb
index 1cf4e1734b..b93c7ee5f8 100644
--- a/meta/recipes-devtools/subversion/subversion_1.14.3.bb
+++ b/meta/recipes-devtools/subversion/subversion_1.14.3.bb
@@ -18,6 +18,8 @@ inherit autotools pkgconfig gettext python3native
 
 CVE_PRODUCT = "apache:subversion"
 
+CVE_STATUS[CVE-2024-45720] = "not-applicable-platform: Issue only applies on Windows"
+
 PACKAGECONFIG ?= ""
 
 PACKAGECONFIG[boost] = "--with-boost=${RECIPE_SYSROOT}${exec_prefix},--without-boost,boost"
-- 
2.43.0

[OE-core][styhead 2/4] libxml2: upgrade 2.13.3 -> 2.13.6

[Steve Sakoman]

From: Peter Marko <peter.marko@siemens.com>

Handle CVE-2025-24928, CVE-2024-56171 and CVE-2025-27113.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-core/libxml/libxml2/install-tests.patch          | 4 ++--
 .../libxml/{libxml2_2.13.3.bb => libxml2_2.13.6.bb}           | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-core/libxml/{libxml2_2.13.3.bb => libxml2_2.13.6.bb} (97%)

diff --git a/meta/recipes-core/libxml/libxml2/install-tests.patch b/meta/recipes-core/libxml/libxml2/install-tests.patch
index 478eeea81b..1c8c13ab5c 100644
--- a/meta/recipes-core/libxml/libxml2/install-tests.patch
+++ b/meta/recipes-core/libxml/libxml2/install-tests.patch
@@ -1,4 +1,4 @@
-From 0779511838a8cbd1e0f431c22f28f286a2a37b1b Mon Sep 17 00:00:00 2001
+From 8c1054eacb430472068f21e4840749c384e8e866 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Mon, 5 Dec 2022 17:02:32 +0000
 Subject: [PATCH] add yocto-specific install-ptest target
@@ -12,7 +12,7 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
  1 file changed, 10 insertions(+)
 
 diff --git a/Makefile.am b/Makefile.am
-index 0a49d37..1097c63 100644
+index 4cb9a5c..8adcd7e 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -27,6 +27,16 @@ check_PROGRAMS = \
diff --git a/meta/recipes-core/libxml/libxml2_2.13.3.bb b/meta/recipes-core/libxml/libxml2_2.13.6.bb
similarity index 97%
rename from meta/recipes-core/libxml/libxml2_2.13.3.bb
rename to meta/recipes-core/libxml/libxml2_2.13.6.bb
index df24f3031c..3b3ca87e96 100644
--- a/meta/recipes-core/libxml/libxml2_2.13.3.bb
+++ b/meta/recipes-core/libxml/libxml2_2.13.6.bb
@@ -19,7 +19,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://install-tests.patch \
            "
 
-SRC_URI[archive.sha256sum] = "0805d7c180cf09caad71666c7a458a74f041561a532902454da5047d83948138"
+SRC_URI[archive.sha256sum] = "f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96"
 SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
 
 # Disputed as a security issue, but fixed in d39f780
-- 
2.43.0

[OE-core][styhead 3/4] tzdata/tzcode-native: upgrade 2024b -> 2025a

[Steve Sakoman]

From: Priyal Doshi <pdoshi@mvista.com>

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a15c4e6793c55c8084a61298ef3695e1db2f60cd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/timezone/timezone.inc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index adf095280f..f1dbd7ba81 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -6,7 +6,7 @@ SECTION = "base"
 LICENSE = "PD & BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
 
-PV = "2024b"
+PV = "2025a"
 
 SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \
            http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \
@@ -16,5 +16,5 @@ S = "${WORKDIR}/tz"
 
 UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
 
-SRC_URI[tzcode.sha256sum] = "5e438fc449624906af16a18ff4573739f0cda9862e5ec28d3bcb19cbaed0f672"
-SRC_URI[tzdata.sha256sum] = "70e754db126a8d0db3d16d6b4cb5f7ec1e04d5f261255e4558a67fe92d39e550"
+SRC_URI[tzcode.sha256sum] = "119679d59f76481eb5e03d3d2a47d7870d592f3999549af189dbd31f2ebf5061"
+SRC_URI[tzdata.sha256sum] = "4d5fcbc72c7c450ebfe0b659bd0f1c02fbf52fd7f517a9ea13fe71c21eb5f0d0"
-- 
2.43.0

[OE-core][styhead 4/4] tzcode-native: Fix compiler setting from 2023d version

[Steve Sakoman]

From: Alessio Cascone <alessio.cascone@vimar.com>

Starting from 2023d version, tzcode makefile does not use anymore "cc"
variable for C compiler, due to Makefile refactoring.
Replacing "cc" with "CC" fixes the issue.

Signed-off-by: Alessio Cascone <alessio.cascone@vimar.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b3cdfca5ef84ed2054faef9abddef3aeed930e17)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/timezone/tzcode-native.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/timezone/tzcode-native.bb b/meta/recipes-extended/timezone/tzcode-native.bb
index d0b23a9d80..dc9f076377 100644
--- a/meta/recipes-extended/timezone/tzcode-native.bb
+++ b/meta/recipes-extended/timezone/tzcode-native.bb
@@ -4,7 +4,7 @@ SUMMARY = "tzcode, timezone zoneinfo utils -- zic, zdump, tzselect"
 
 inherit native
 
-EXTRA_OEMAKE += "cc='${CC}'"
+EXTRA_OEMAKE += "CC='${CC}'"
 
 do_install () {
         install -d ${D}${bindir}/
-- 
2.43.0

[OE-core][styhead 0/4] Patch review

[Steve Sakoman]

Please review this set of changes for styhead and have comments back by
end of day Friday, March 21

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1213

The following changes since commit a0989930949689dd971dea61e851b548af86a1bf:

  xserver-xorg: upgrade 21.1.15 -> 21.1.16 (2025-03-12 07:10:58 -0700)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/styhead-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/styhead-nut

Makarios Christakis (1):
  icu: Adjust ICU_DATA_DIR path on big endian targets

Peter Marko (3):
  openssh: patch CVE-2025-26466
  openssh: patch CVE-2025-26465
  xserver-xorg: mark CVEs fixed in 21.1.16 as fixed

 .../openssh/openssh/CVE-2025-26465.patch      | 166 ++++++++++++++++++
 .../openssh/openssh/CVE-2025-26466.patch      |  36 ++++
 .../openssh/openssh_9.8p1.bb                  |   2 +
 .../xorg-xserver/xserver-xorg.inc             |   4 +
 meta/recipes-support/icu/icu_75-1.bb          |   2 +-
 5 files changed, 209 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26466.patch

-- 
2.43.0