* [OE-core][walnascar 00/11] Patch review
@ 2025-07-01 13:37 Steve Sakoman
2025-07-01 13:37 ` [OE-core][walnascar 01/11] python3-urllib3: fix CVE-2025-50181 Steve Sakoman
` (10 more replies)
0 siblings, 11 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for walnascar and have comments back by
end of day Thursday, July 4
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1914
The following changes since commit ead0d06d6335fb74c1ae0dc7bdcf414c66b3e4ab:
cmake: Correctly handle cost data of tests with arbitrary chars in name (2025-06-20 09:36:36 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/walnascar-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/walnascar-nut
Colin Pinnell McAllister (1):
libarchive: fix CVE-2025-5914
Guocai He (1):
tcf-agent: correct the SRC_URI
Guðni Már Gilbert (1):
python3: drop old nis module dependencies
Praveen Kumar (1):
python3-setuptools: fix CVE-2025-47273
Rasmus Villemoes (1):
sstate: apply proper umask when fetching from SSTATE_MIRROR
Richard Purdie (3):
xwayland: Add missing libtirpc dependency
oeqa/sstatetests: Fix NATIVELSBSTRING handling
oeqa/sstatetests: Improve/fix sstate creation tests
Robert Yang (1):
package_rpm.bbclass: Remove empty build directory
Yogita Urade (2):
python3-urllib3: fix CVE-2025-50181
python3-urllib3: fix CVE-2025-50182
meta/classes-global/package_rpm.bbclass | 1 +
meta/classes-global/sstate.bbclass | 22 +-
meta/lib/oeqa/selftest/cases/sstatetests.py | 97 +++---
.../CVE-2025-47273-pre1.patch | 55 ++++
.../python3-setuptools/CVE-2025-47273.patch | 60 ++++
.../python/python3-setuptools_76.0.0.bb | 5 +-
.../python3-urllib3/CVE-2025-50181.patch | 283 ++++++++++++++++++
.../python3-urllib3/CVE-2025-50182.patch | 125 ++++++++
.../python/python3-urllib3_2.3.0.bb | 5 +
.../recipes-devtools/python/python3_3.13.4.bb | 2 -
.../tcf-agent/tcf-agent_git.bb | 4 +-
.../libarchive/libarchive/CVE-2025-5914.patch | 46 +++
.../libarchive/libarchive_3.7.9.bb | 4 +-
.../xwayland/xwayland_24.1.6.bb | 2 +-
14 files changed, 639 insertions(+), 72 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273-pre1.patch
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-50181.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-50182.patch
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch
--
2.43.0
^ permalink raw reply [flat|nested] 12+ messages in thread
* [OE-core][walnascar 01/11] python3-urllib3: fix CVE-2025-50181
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
@ 2025-07-01 13:37 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 02/11] python3-urllib3: fix CVE-2025-50182 Steve Sakoman
` (9 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:37 UTC (permalink / raw)
To: openembedded-core
From: Yogita Urade <yogita.urade@windriver.com>
urllib3 is a user-friendly HTTP client library for Python. Prior to
2.5.0, it is possible to disable redirects for all requests by
instantiating a PoolManager and specifying retries in a way that
disable redirects. By default, requests and botocore users are not
affected. An application attempting to mitigate SSRF or open redirect
vulnerabilities by disabling redirects at the PoolManager level will
remain vulnerable. This issue has been patched in version 2.5.0.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-50181
Upstream patch:
https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../python3-urllib3/CVE-2025-50181.patch | 283 ++++++++++++++++++
.../python/python3-urllib3_2.3.0.bb | 4 +
2 files changed, 287 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-50181.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50181.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50181.patch
new file mode 100644
index 0000000000..a8cea0a020
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50181.patch
@@ -0,0 +1,283 @@
+From f05b1329126d5be6de501f9d1e3e36738bc08857 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 18 Jun 2025 16:25:01 +0300
+Subject: [PATCH] Merge commit from fork
+
+* Apply Quentin's suggestion
+
+Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
+
+* Add tests for disabled redirects in the pool manager
+
+* Add a possible fix for the issue with not raised `MaxRetryError`
+
+* Make urllib3 handle redirects instead of JS when JSPI is used
+
+* Fix info in the new comment
+
+* State that redirects with XHR are not controlled by urllib3
+
+* Remove excessive params from new test requests
+
+* Add tests reaching max non-0 redirects
+
+* Test redirects with Emscripten
+
+* Fix `test_merge_pool_kwargs`
+
+* Add a changelog entry
+
+* Parametrize tests
+
+* Drop a fix for Emscripten
+
+* Apply Seth's suggestion to docs
+
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+
+* Use a minor release instead of the patch one
+
+---------
+
+Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+
+CVE: CVE-2025-50181
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857]
+
+Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
+---
+ docs/reference/contrib/emscripten.rst | 2 +-
+ dummyserver/app.py | 1 +
+ src/urllib3/poolmanager.py | 18 +++-
+ test/contrib/emscripten/test_emscripten.py | 16 ++++
+ test/test_poolmanager.py | 5 +-
+ test/with_dummyserver/test_poolmanager.py | 101 +++++++++++++++++++++
+ 6 files changed, 139 insertions(+), 4 deletions(-)
+
+diff --git a/docs/reference/contrib/emscripten.rst b/docs/reference/contrib/emscripten.rst
+index 99fb20f..a8f1cda 100644
+--- a/docs/reference/contrib/emscripten.rst
++++ b/docs/reference/contrib/emscripten.rst
+@@ -65,7 +65,7 @@ Features which are usable with Emscripten support are:
+ * Timeouts
+ * Retries
+ * Streaming (with Web Workers and Cross-Origin Isolation)
+-* Redirects
++* Redirects (determined by browser/runtime, not restrictable with urllib3)
+ * Decompressing response bodies
+
+ Features which don't work with Emscripten:
+diff --git a/dummyserver/app.py b/dummyserver/app.py
+index 97b1b23..0eeb93f 100644
+--- a/dummyserver/app.py
++++ b/dummyserver/app.py
+@@ -227,6 +227,7 @@ async def encodingrequest() -> ResponseReturnValue:
+
+
+ @hypercorn_app.route("/redirect", methods=["GET", "POST", "PUT"])
++@pyodide_testing_app.route("/redirect", methods=["GET", "POST", "PUT"])
+ async def redirect() -> ResponseReturnValue:
+ "Perform a redirect to ``target``"
+ values = await request.values
+diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py
+index 085d1db..5763fea 100644
+--- a/src/urllib3/poolmanager.py
++++ b/src/urllib3/poolmanager.py
+@@ -203,6 +203,22 @@ class PoolManager(RequestMethods):
+ **connection_pool_kw: typing.Any,
+ ) -> None:
+ super().__init__(headers)
++ if "retries" in connection_pool_kw:
++ retries = connection_pool_kw["retries"]
++ if not isinstance(retries, Retry):
++ # When Retry is initialized, raise_on_redirect is based
++ # on a redirect boolean value.
++ # But requests made via a pool manager always set
++ # redirect to False, and raise_on_redirect always ends
++ # up being False consequently.
++ # Here we fix the issue by setting raise_on_redirect to
++ # a value needed by the pool manager without considering
++ # the redirect boolean.
++ raise_on_redirect = retries is not False
++ retries = Retry.from_int(retries, redirect=False)
++ retries.raise_on_redirect = raise_on_redirect
++ connection_pool_kw = connection_pool_kw.copy()
++ connection_pool_kw["retries"] = retries
+ self.connection_pool_kw = connection_pool_kw
+
+ self.pools: RecentlyUsedContainer[PoolKey, HTTPConnectionPool]
+@@ -456,7 +472,7 @@ class PoolManager(RequestMethods):
+ kw["body"] = None
+ kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
+
+- retries = kw.get("retries")
++ retries = kw.get("retries", response.retries)
+ if not isinstance(retries, Retry):
+ retries = Retry.from_int(retries, redirect=redirect)
+
+diff --git a/test/contrib/emscripten/test_emscripten.py b/test/contrib/emscripten/test_emscripten.py
+index 9317a09..5eaa674 100644
+--- a/test/contrib/emscripten/test_emscripten.py
++++ b/test/contrib/emscripten/test_emscripten.py
+@@ -944,6 +944,22 @@ def test_retries(
+ pyodide_test(selenium_coverage, testserver_http.http_host, find_unused_port())
+
+
++def test_redirects(
++ selenium_coverage: typing.Any, testserver_http: PyodideServerInfo
++) -> None:
++ @run_in_pyodide # type: ignore[misc]
++ def pyodide_test(selenium_coverage: typing.Any, host: str, port: int) -> None:
++ from urllib3 import request
++
++ redirect_url = f"http://{host}:{port}/redirect"
++ response = request("GET", redirect_url)
++ assert response.status == 200
++
++ pyodide_test(
++ selenium_coverage, testserver_http.http_host, testserver_http.http_port
++ )
++
++
+ def test_insecure_requests_warning(
+ selenium_coverage: typing.Any, testserver_http: PyodideServerInfo
+ ) -> None:
+diff --git a/test/test_poolmanager.py b/test/test_poolmanager.py
+index ab5f203..b481a19 100644
+--- a/test/test_poolmanager.py
++++ b/test/test_poolmanager.py
+@@ -379,9 +379,10 @@ class TestPoolManager:
+
+ def test_merge_pool_kwargs(self) -> None:
+ """Assert _merge_pool_kwargs works in the happy case"""
+- p = PoolManager(retries=100)
++ retries = retry.Retry(total=100)
++ p = PoolManager(retries=retries)
+ merged = p._merge_pool_kwargs({"new_key": "value"})
+- assert {"retries": 100, "new_key": "value"} == merged
++ assert {"retries": retries, "new_key": "value"} == merged
+
+ def test_merge_pool_kwargs_none(self) -> None:
+ """Assert false-y values to _merge_pool_kwargs result in defaults"""
+diff --git a/test/with_dummyserver/test_poolmanager.py b/test/with_dummyserver/test_poolmanager.py
+index af77241..7f163ab 100644
+--- a/test/with_dummyserver/test_poolmanager.py
++++ b/test/with_dummyserver/test_poolmanager.py
+@@ -84,6 +84,89 @@ class TestPoolManager(HypercornDummyServerTestCase):
+ assert r.status == 200
+ assert r.data == b"Dummy server!"
+
++ @pytest.mark.parametrize(
++ "retries",
++ (0, Retry(total=0), Retry(redirect=0), Retry(total=0, redirect=0)),
++ )
++ def test_redirects_disabled_for_pool_manager_with_0(
++ self, retries: typing.Literal[0] | Retry
++ ) -> None:
++ """
++ Check handling redirects when retries is set to 0 on the pool
++ manager.
++ """
++ with PoolManager(retries=retries) as http:
++ with pytest.raises(MaxRetryError):
++ http.request("GET", f"{self.base_url}/redirect")
++
++ # Setting redirect=True should not change the behavior.
++ with pytest.raises(MaxRetryError):
++ http.request("GET", f"{self.base_url}/redirect", redirect=True)
++
++ # Setting redirect=False should not make it follow the redirect,
++ # but MaxRetryError should not be raised.
++ response = http.request("GET", f"{self.base_url}/redirect", redirect=False)
++ assert response.status == 303
++
++ @pytest.mark.parametrize(
++ "retries",
++ (
++ False,
++ Retry(total=False),
++ Retry(redirect=False),
++ Retry(total=False, redirect=False),
++ ),
++ )
++ def test_redirects_disabled_for_pool_manager_with_false(
++ self, retries: typing.Literal[False] | Retry
++ ) -> None:
++ """
++ Check that setting retries set to False on the pool manager disables
++ raising MaxRetryError and redirect=True does not change the
++ behavior.
++ """
++ with PoolManager(retries=retries) as http:
++ response = http.request("GET", f"{self.base_url}/redirect")
++ assert response.status == 303
++
++ response = http.request("GET", f"{self.base_url}/redirect", redirect=True)
++ assert response.status == 303
++
++ response = http.request("GET", f"{self.base_url}/redirect", redirect=False)
++ assert response.status == 303
++
++ def test_redirects_disabled_for_individual_request(self) -> None:
++ """
++ Check handling redirects when they are meant to be disabled
++ on the request level.
++ """
++ with PoolManager() as http:
++ # Check when redirect is not passed.
++ with pytest.raises(MaxRetryError):
++ http.request("GET", f"{self.base_url}/redirect", retries=0)
++ response = http.request("GET", f"{self.base_url}/redirect", retries=False)
++ assert response.status == 303
++
++ # Check when redirect=True.
++ with pytest.raises(MaxRetryError):
++ http.request(
++ "GET", f"{self.base_url}/redirect", retries=0, redirect=True
++ )
++ response = http.request(
++ "GET", f"{self.base_url}/redirect", retries=False, redirect=True
++ )
++ assert response.status == 303
++
++ # Check when redirect=False.
++ response = http.request(
++ "GET", f"{self.base_url}/redirect", retries=0, redirect=False
++ )
++ assert response.status == 303
++ response = http.request(
++ "GET", f"{self.base_url}/redirect", retries=False, redirect=False
++ )
++ assert response.status == 303
++
+ def test_cross_host_redirect(self) -> None:
+ with PoolManager() as http:
+ cross_host_location = f"{self.base_url_alt}/echo?a=b"
+@@ -138,6 +221,24 @@ class TestPoolManager(HypercornDummyServerTestCase):
+ pool = http.connection_from_host(self.host, self.port)
+ assert pool.num_connections == 1
+
++ # Check when retries are configured for the pool manager.
++ with PoolManager(retries=1) as http:
++ with pytest.raises(MaxRetryError):
++ http.request(
++ "GET",
++ f"{self.base_url}/redirect",
++ fields={"target": f"/redirect?target={self.base_url}/"},
++ )
++
++ # Here we allow more retries for the request.
++ response = http.request(
++ "GET",
++ f"{self.base_url}/redirect",
++ fields={"target": f"/redirect?target={self.base_url}/"},
++ retries=2,
++ )
++ assert response.status == 200
++
+ def test_redirect_cross_host_remove_headers(self) -> None:
+ with PoolManager() as http:
+ r = http.request(
+--
+2.40.0
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb b/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
index fe913e6b73..218a226431 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
@@ -7,6 +7,10 @@ SRC_URI[sha256sum] = "f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96
inherit pypi python_hatchling
+SRC_URI += " \
+ file://CVE-2025-50181.patch \
+"
+
DEPENDS += " \
python3-hatch-vcs-native \
"
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 02/11] python3-urllib3: fix CVE-2025-50182
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
2025-07-01 13:37 ` [OE-core][walnascar 01/11] python3-urllib3: fix CVE-2025-50181 Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 03/11] python3-setuptools: fix CVE-2025-47273 Steve Sakoman
` (8 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Yogita Urade <yogita.urade@windriver.com>
urllib3 is a user-friendly HTTP client library for Python. Prior
to 2.5.0, urllib3 does not control redirects in browsers and
Node.js. urllib3 supports being used in a Pyodide runtime utilizing
the JavaScript Fetch API or falling back on XMLHttpRequest. This
means Python libraries can be used to make HTTP requests from a
browser or Node.js. Additionally, urllib3 provides a mechanism to
control redirects, but the retries and redirect parameters are
ignored with Pyodide; the runtime itself determines redirect
behavior. This issue has been patched in version 2.5.0.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-50182
Upstream patch:
https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../python3-urllib3/CVE-2025-50182.patch | 125 ++++++++++++++++++
.../python/python3-urllib3_2.3.0.bb | 1 +
2 files changed, 126 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-50182.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50182.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50182.patch
new file mode 100644
index 0000000000..2f6ba478d5
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-50182.patch
@@ -0,0 +1,125 @@
+From 7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 18 Jun 2025 16:30:35 +0300
+Subject: [PATCH] Merge commit from fork
+
+CVE: CVE-2025-50182
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f]
+
+Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
+---
+ docs/reference/contrib/emscripten.rst | 2 +-
+ src/urllib3/contrib/emscripten/fetch.py | 20 ++++++++++
+ test/contrib/emscripten/test_emscripten.py | 46 ++++++++++++++++++++++
+ 3 files changed, 67 insertions(+), 1 deletion(-)
+
+diff --git a/docs/reference/contrib/emscripten.rst b/docs/reference/contrib/emscripten.rst
+index a8f1cda..4670757 100644
+--- a/docs/reference/contrib/emscripten.rst
++++ b/docs/reference/contrib/emscripten.rst
+@@ -65,7 +65,7 @@ Features which are usable with Emscripten support are:
+ * Timeouts
+ * Retries
+ * Streaming (with Web Workers and Cross-Origin Isolation)
+-* Redirects (determined by browser/runtime, not restrictable with urllib3)
++* Redirects (urllib3 controls redirects in Node.js but not in browsers where behavior is determined by runtime)
+ * Decompressing response bodies
+
+ Features which don't work with Emscripten:
+diff --git a/src/urllib3/contrib/emscripten/fetch.py b/src/urllib3/contrib/emscripten/fetch.py
+index a514306..6695821 100644
+--- a/src/urllib3/contrib/emscripten/fetch.py
++++ b/src/urllib3/contrib/emscripten/fetch.py
+@@ -573,6 +573,11 @@ def send_jspi_request(
+ "method": request.method,
+ "signal": js_abort_controller.signal,
+ }
++ # Node.js returns the whole response (unlike opaqueredirect in browsers),
++ # so urllib3 can set `redirect: manual` to control redirects itself.
++ # https://stackoverflow.com/a/78524615
++ if _is_node_js():
++ fetch_data["redirect"] = "manual"
+ # Call JavaScript fetch (async api, returns a promise)
+ fetcher_promise_js = js.fetch(request.url, _obj_from_dict(fetch_data))
+ # Now suspend WebAssembly until we resolve that promise
+@@ -693,6 +698,21 @@ def has_jspi() -> bool:
+ return False
+
+
++def _is_node_js() -> bool:
++ """
++ Check if we are in Node.js.
++
++ :return: True if we are in Node.js.
++ :rtype: bool
++ """
++ return (
++ hasattr(js, "process")
++ and hasattr(js.process, "release")
++ # According to the Node.js documentation, the release name is always "node".
++ and js.process.release.name == "node"
++ )
++
++
+ def streaming_ready() -> bool | None:
+ if _fetcher:
+ return _fetcher.streaming_ready
+diff --git a/test/contrib/emscripten/test_emscripten.py b/test/contrib/emscripten/test_emscripten.py
+index 5eaa674..fbf89fc 100644
+--- a/test/contrib/emscripten/test_emscripten.py
++++ b/test/contrib/emscripten/test_emscripten.py
+@@ -960,6 +960,52 @@ def test_redirects(
+ )
+
+
++@pytest.mark.with_jspi
++def test_disabled_redirects(
++ selenium_coverage: typing.Any, testserver_http: PyodideServerInfo
++) -> None:
++ """
++ Test that urllib3 can control redirects in Node.js.
++ """
++
++ @run_in_pyodide # type: ignore[misc]
++ def pyodide_test(selenium_coverage: typing.Any, host: str, port: int) -> None:
++ import pytest
++
++ from urllib3 import PoolManager, request
++ from urllib3.contrib.emscripten.fetch import _is_node_js
++ from urllib3.exceptions import MaxRetryError
++
++ if not _is_node_js():
++ pytest.skip("urllib3 does not control redirects in browsers.")
++
++ redirect_url = f"http://{host}:{port}/redirect"
++
++ with PoolManager(retries=0) as http:
++ with pytest.raises(MaxRetryError):
++ http.request("GET", redirect_url)
++
++ response = http.request("GET", redirect_url, redirect=False)
++ assert response.status == 303
++
++ with PoolManager(retries=False) as http:
++ response = http.request("GET", redirect_url)
++ assert response.status == 303
++
++ with pytest.raises(MaxRetryError):
++ request("GET", redirect_url, retries=0)
++
++ response = request("GET", redirect_url, redirect=False)
++ assert response.status == 303
++
++ response = request("GET", redirect_url, retries=0, redirect=False)
++ assert response.status == 303
++
++ pyodide_test(
++ selenium_coverage, testserver_http.http_host, testserver_http.http_port
++ )
++
++
+ def test_insecure_requests_warning(
+ selenium_coverage: typing.Any, testserver_http: PyodideServerInfo
+ ) -> None:
+--
+2.40.0
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb b/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
index 218a226431..c5e3751255 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.3.0.bb
@@ -9,6 +9,7 @@ inherit pypi python_hatchling
SRC_URI += " \
file://CVE-2025-50181.patch \
+ file://CVE-2025-50182.patch \
"
DEPENDS += " \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 03/11] python3-setuptools: fix CVE-2025-47273
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
2025-07-01 13:37 ` [OE-core][walnascar 01/11] python3-urllib3: fix CVE-2025-50181 Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 02/11] python3-urllib3: fix CVE-2025-50182 Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 04/11] libarchive: fix CVE-2025-5914 Steve Sakoman
` (7 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Praveen Kumar <praveen.kumar@windriver.com>
setuptools is a package that allows users to download, build, install,
upgrade, and uninstall Python packages. A path traversal vulnerability
in `PackageIndex` is present in setuptools prior to version 78.1.1. An
attacker would be allowed to write files to arbitrary locations on the
filesystem with the permissions of the process running the Python code,
which could escalate to remote code execution depending on the context.
Version 78.1.1 fixes the issue.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47273
Upstream-patch:
https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a
https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../CVE-2025-47273-pre1.patch | 55 +++++++++++++++++
.../python3-setuptools/CVE-2025-47273.patch | 60 +++++++++++++++++++
.../python/python3-setuptools_76.0.0.bb | 5 +-
3 files changed, 119 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273-pre1.patch
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273.patch
diff --git a/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273-pre1.patch b/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273-pre1.patch
new file mode 100644
index 0000000000..d75f05fc68
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273-pre1.patch
@@ -0,0 +1,55 @@
+From d8390feaa99091d1ba9626bec0e4ba7072fc507a Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <jaraco@jaraco.com>
+Date: Sat, 19 Apr 2025 12:49:55 -0400
+Subject: [PATCH] Extract _resolve_download_filename with test.
+
+CVE: CVE-2025-47273 #Dependency Patch
+
+Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ setuptools/package_index.py | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index 1a6abeb..b317735 100644
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -807,9 +807,16 @@ class PackageIndex(Environment):
+ else:
+ raise DistutilsError(f"Download error for {url}: {v}") from v
+
+- def _download_url(self, url, tmpdir):
+- # Determine download filename
+- #
++ @staticmethod
++ def _resolve_download_filename(url, tmpdir):
++ """
++ >>> du = PackageIndex._resolve_download_filename
++ >>> root = getfixture('tmp_path')
++ >>> url = 'https://files.pythonhosted.org/packages/a9/5a/0db.../setuptools-78.1.0.tar.gz'
++ >>> import pathlib
++ >>> str(pathlib.Path(du(url, root)).relative_to(root))
++ 'setuptools-78.1.0.tar.gz'
++ """
+ name, _fragment = egg_info_for_url(url)
+ if name:
+ while '..' in name:
+@@ -820,8 +827,13 @@ class PackageIndex(Environment):
+ if name.endswith('.egg.zip'):
+ name = name[:-4] # strip the extra .zip before download
+
+- filename = os.path.join(tmpdir, name)
++ return os.path.join(tmpdir, name)
+
++ def _download_url(self, url, tmpdir):
++ """
++ Determine the download filename.
++ """
++ filename = self._resolve_download_filename(url, tmpdir)
+ return self._download_vcs(url, filename) or self._download_other(url, filename)
+
+ @staticmethod
+--
+2.40.0
diff --git a/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273.patch b/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273.patch
new file mode 100644
index 0000000000..3c44a2a321
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-setuptools/CVE-2025-47273.patch
@@ -0,0 +1,60 @@
+From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <jaraco@jaraco.com>
+Date: Sat, 19 Apr 2025 13:03:47 -0400
+Subject: [PATCH] Add a check to ensure the name resolves relative to the
+ tmpdir.
+
+Closes #4946
+
+CVE: CVE-2025-47273
+
+Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ setuptools/package_index.py | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index b317735..a8f868e 100644
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -810,12 +810,20 @@ class PackageIndex(Environment):
+ @staticmethod
+ def _resolve_download_filename(url, tmpdir):
+ """
++ >>> import pathlib
+ >>> du = PackageIndex._resolve_download_filename
+ >>> root = getfixture('tmp_path')
+ >>> url = 'https://files.pythonhosted.org/packages/a9/5a/0db.../setuptools-78.1.0.tar.gz'
+- >>> import pathlib
+ >>> str(pathlib.Path(du(url, root)).relative_to(root))
+ 'setuptools-78.1.0.tar.gz'
++
++ Ensures the target is always in tmpdir.
++
++ >>> url = 'https://anyhost/%2fhome%2fuser%2f.ssh%2fauthorized_keys'
++ >>> du(url, root)
++ Traceback (most recent call last):
++ ...
++ ValueError: Invalid filename...
+ """
+ name, _fragment = egg_info_for_url(url)
+ if name:
+@@ -827,7 +835,13 @@ class PackageIndex(Environment):
+ if name.endswith('.egg.zip'):
+ name = name[:-4] # strip the extra .zip before download
+
+- return os.path.join(tmpdir, name)
++ filename = os.path.join(tmpdir, name)
++
++ # ensure path resolves within the tmpdir
++ if not filename.startswith(str(tmpdir)):
++ raise ValueError(f"Invalid filename {filename}")
++
++ return filename
+
+ def _download_url(self, url, tmpdir):
+ """
+--
+2.40.0
diff --git a/meta/recipes-devtools/python/python3-setuptools_76.0.0.bb b/meta/recipes-devtools/python/python3-setuptools_76.0.0.bb
index 71c8eb1a1f..91d8fdd73b 100644
--- a/meta/recipes-devtools/python/python3-setuptools_76.0.0.bb
+++ b/meta/recipes-devtools/python/python3-setuptools_76.0.0.bb
@@ -11,7 +11,10 @@ CVE_PRODUCT = "python3-setuptools python:setuptools"
SRC_URI:append:class-native = " file://0001-conditionally-do-not-fetch-code-by-easy_install.patch"
SRC_URI += " \
- file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch"
+ file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch \
+ file://CVE-2025-47273-pre1.patch \
+ file://CVE-2025-47273.patch \
+"
SRC_URI[sha256sum] = "43b4ee60e10b0d0ee98ad11918e114c70701bc6051662a9a675a0496c1a158f4"
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 04/11] libarchive: fix CVE-2025-5914
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 03/11] python3-setuptools: fix CVE-2025-47273 Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 05/11] python3: drop old nis module dependencies Steve Sakoman
` (6 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Colin Pinnell McAllister <colin.mcallister@garmin.com>
Adds patch to backport fix for CVE-2025-5914.
Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libarchive/libarchive/CVE-2025-5914.patch | 46 +++++++++++++++++++
.../libarchive/libarchive_3.7.9.bb | 4 +-
2 files changed, 49 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch
new file mode 100644
index 0000000000..4d95dba209
--- /dev/null
+++ b/meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch
@@ -0,0 +1,46 @@
+From 72a83b2885c31254687702e3a8429e3e0523221c Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <stoeckmann@users.noreply.github.com>
+Date: Sun, 11 May 2025 02:17:19 +0200
+Subject: [PATCH] rar: Fix double free with over 4 billion nodes (#2598)
+
+If a system is capable of handling 4 billion nodes in memory, a double
+free could occur because of an unsigned integer overflow leading to a
+realloc call with size argument of 0. Eventually, the client will
+release that memory again, triggering a double free.
+
+Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
+
+CVE: CVE-2025-5914
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/09685126fcec664e2b8ca595e1fc371bd494d209]
+Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com>
+---
+ libarchive/archive_read_support_format_rar.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
+index 9d155c66..9eb3c848 100644
+--- a/libarchive/archive_read_support_format_rar.c
++++ b/libarchive/archive_read_support_format_rar.c
+@@ -335,8 +335,8 @@ struct rar
+ int found_first_header;
+ char has_endarc_header;
+ struct data_block_offsets *dbo;
+- unsigned int cursor;
+- unsigned int nodes;
++ size_t cursor;
++ size_t nodes;
+ char filename_must_match;
+
+ /* LZSS members */
+@@ -1186,7 +1186,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
+ int whence)
+ {
+ int64_t client_offset, ret;
+- unsigned int i;
++ size_t i;
+ struct rar *rar = (struct rar *)(a->format->data);
+
+ if (rar->compression_method == COMPRESS_METHOD_STORE)
+--
+2.49.0
+
diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
index 9d134f7d38..1fa61c3218 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
@@ -29,7 +29,9 @@ PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd,"
EXTRA_OECONF += "--enable-largefile --without-iconv"
-SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz"
+SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \
+ file://CVE-2025-5914.patch \
+ "
UPSTREAM_CHECK_URI = "http://libarchive.org/"
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 05/11] python3: drop old nis module dependencies
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 04/11] libarchive: fix CVE-2025-5914 Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 06/11] package_rpm.bbclass: Remove empty build directory Steve Sakoman
` (5 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Guðni Már Gilbert <gudni.m.g@gmail.com>
libnsl2 and libtirpc were build dependencies for the nis module.
The nis module was deprecated in Python 3.11 and removed in Python 3.13
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/python/python3_3.13.4.bb | 2 --
1 file changed, 2 deletions(-)
diff --git a/meta/recipes-devtools/python/python3_3.13.4.bb b/meta/recipes-devtools/python/python3_3.13.4.bb
index 5d904d6207..5b49fee3bf 100644
--- a/meta/recipes-devtools/python/python3_3.13.4.bb
+++ b/meta/recipes-devtools/python/python3_3.13.4.bb
@@ -72,8 +72,6 @@ DEPENDS = "\
bzip2-replacement-native \
expat \
libffi \
- libnsl2 \
- libtirpc \
ncurses \
openssl \
sqlite3 \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 06/11] package_rpm.bbclass: Remove empty build directory
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 05/11] python3: drop old nis module dependencies Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 07/11] xwayland: Add missing libtirpc dependency Steve Sakoman
` (4 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Robert Yang <liezhi.yang@windriver.com>
Fixed:
$ bitbake acl
$ ls tmp/work/core2-64-poky-linux/acl/2.3.2/build/acl-2.3.2-build/
This empty directory is created by rpmbuild, just remove it like others above.
Note, master branch doesn't have this problem after upgrade to rpm 4.20.1, but
it's not easy to find which patch(es) fixed the problem, and the issues haven't
been fixed completely, there is still an empty SRPMS directory, so just remove
the build directory as others above.
If we don't fix this, there might be warnings when a recipe uses:
install -m 0644 ${B}/* ${DEPLOYDIR}/boot.bin-extracted/
install: omitting directory '${B}/xilinx-bootbin-1.0-build'
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes-global/package_rpm.bbclass | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/classes-global/package_rpm.bbclass b/meta/classes-global/package_rpm.bbclass
index f383ed140e..c6541d141b 100644
--- a/meta/classes-global/package_rpm.bbclass
+++ b/meta/classes-global/package_rpm.bbclass
@@ -728,6 +728,7 @@ python do_package_rpm () {
# rpm 4 creates various empty directories in _topdir, let's clean them up
cleanupcmd = "rm -rf %s/BUILDROOT %s/SOURCES %s/SPECS %s/SRPMS" % (workdir, workdir, workdir, workdir)
+ cleanupcmd += " %s/%s-build" % (d.getVar('B'), d.getVar('P'))
# Build the rpm package!
d.setVar('BUILDSPEC', cmd + "\n" + cleanupcmd + "\n")
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 07/11] xwayland: Add missing libtirpc dependency
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 06/11] package_rpm.bbclass: Remove empty build directory Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 08/11] sstate: apply proper umask when fetching from SSTATE_MIRROR Steve Sakoman
` (3 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
This was being pulled in through python by accident. It no longer needs
it but exposes this missing dependency.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-graphics/xwayland/xwayland_24.1.6.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-graphics/xwayland/xwayland_24.1.6.bb b/meta/recipes-graphics/xwayland/xwayland_24.1.6.bb
index 0774c1bbf5..c0b5dee4c0 100644
--- a/meta/recipes-graphics/xwayland/xwayland_24.1.6.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_24.1.6.bb
@@ -17,7 +17,7 @@ UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar"
inherit meson features_check pkgconfig
REQUIRED_DISTRO_FEATURES = "x11 opengl"
-DEPENDS += "xorgproto xtrans pixman libxkbfile libxfont2 wayland wayland-native wayland-protocols libdrm libepoxy libxcvt"
+DEPENDS += "xorgproto xtrans pixman libxkbfile libxfont2 wayland wayland-native wayland-protocols libdrm libepoxy libxcvt libtirpc"
OPENGL_PKGCONFIGS = "glx glamor dri3"
PACKAGECONFIG ??= "${XORG_CRYPTO} ${XWAYLAND_EI} \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 08/11] sstate: apply proper umask when fetching from SSTATE_MIRROR
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 07/11] xwayland: Add missing libtirpc dependency Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 09/11] oeqa/sstatetests: Fix NATIVELSBSTRING handling Steve Sakoman
` (2 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Rasmus Villemoes <ravi@prevas.dk>
Currently, files and directories created under ${SSTATE_DIR} when
fetching from an sstate mirror are not created with group write,
unlike when the sstate artifacts are generated locally. That's
inconsistent, and problematic when the local sstate dir is shared
among multiple users.
Wrap the fetching in a bb.utils.umask() context manager, and for simplicity
move the mkdir of SSTATE_DIR inside that.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a6038553aaef3b88b834a09018c524c4fa41e625)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes-global/sstate.bbclass | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/meta/classes-global/sstate.bbclass b/meta/classes-global/sstate.bbclass
index 2c259a6657..b98fbba982 100644
--- a/meta/classes-global/sstate.bbclass
+++ b/meta/classes-global/sstate.bbclass
@@ -726,7 +726,6 @@ def pstaging_fetch(sstatefetch, d):
localdata = bb.data.createCopy(d)
dldir = localdata.expand("${SSTATE_DIR}")
- bb.utils.mkdirhier(dldir)
localdata.delVar('MIRRORS')
localdata.setVar('FILESPATH', dldir)
@@ -746,16 +745,19 @@ def pstaging_fetch(sstatefetch, d):
if bb.utils.to_boolean(d.getVar("SSTATE_VERIFY_SIG"), False):
uris += ['file://{0}.sig;downloadfilename={0}.sig'.format(sstatefetch)]
- for srcuri in uris:
- localdata.delVar('SRC_URI')
- localdata.setVar('SRC_URI', srcuri)
- try:
- fetcher = bb.fetch2.Fetch([srcuri], localdata, cache=False)
- fetcher.checkstatus()
- fetcher.download()
+ with bb.utils.umask(0o002):
+ bb.utils.mkdirhier(dldir)
- except bb.fetch2.BBFetchException:
- pass
+ for srcuri in uris:
+ localdata.delVar('SRC_URI')
+ localdata.setVar('SRC_URI', srcuri)
+ try:
+ fetcher = bb.fetch2.Fetch([srcuri], localdata, cache=False)
+ fetcher.checkstatus()
+ fetcher.download()
+
+ except bb.fetch2.BBFetchException:
+ pass
def sstate_setscene(d):
shared_state = sstate_state_fromvars(d)
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 09/11] oeqa/sstatetests: Fix NATIVELSBSTRING handling
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 08/11] sstate: apply proper umask when fetching from SSTATE_MIRROR Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 10/11] oeqa/sstatetests: Improve/fix sstate creation tests Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 11/11] tcf-agent: correct the SRC_URI Steve Sakoman
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
The NATIVELSBSTRING variable changes value once a BuildStarted event occurs in a build
directory. This meant running some of the tests directly in a fresh build directory
would fail but they'd pass when run as a group of tests. This is clearly suboptimal.
Move the NATIVELSBSTRING handling to a location where the value is consistent
and a comment about the interesting behaviour of the variable so it hopefully doesn't
catch out others in future.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e1c46fdb44fed18909d9ff4b43b4e445c5a22d33)
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/selftest/cases/sstatetests.py | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/meta/lib/oeqa/selftest/cases/sstatetests.py b/meta/lib/oeqa/selftest/cases/sstatetests.py
index 487995acc3..7231115a6b 100644
--- a/meta/lib/oeqa/selftest/cases/sstatetests.py
+++ b/meta/lib/oeqa/selftest/cases/sstatetests.py
@@ -27,17 +27,15 @@ class SStateBase(OESelftestTestCase):
def setUpLocal(self):
super(SStateBase, self).setUpLocal()
self.temp_sstate_location = None
- needed_vars = ['SSTATE_DIR', 'NATIVELSBSTRING', 'TCLIBC', 'TUNE_ARCH',
+ needed_vars = ['SSTATE_DIR', 'TCLIBC', 'TUNE_ARCH',
'TOPDIR', 'TARGET_VENDOR', 'TARGET_OS']
bb_vars = get_bb_vars(needed_vars)
self.sstate_path = bb_vars['SSTATE_DIR']
- self.hostdistro = bb_vars['NATIVELSBSTRING']
self.tclibc = bb_vars['TCLIBC']
self.tune_arch = bb_vars['TUNE_ARCH']
self.topdir = bb_vars['TOPDIR']
self.target_vendor = bb_vars['TARGET_VENDOR']
self.target_os = bb_vars['TARGET_OS']
- self.distro_specific_sstate = os.path.join(self.sstate_path, self.hostdistro)
def track_for_cleanup(self, path):
if not keep_temp_files:
@@ -52,10 +50,7 @@ class SStateBase(OESelftestTestCase):
config_temp_sstate = "SSTATE_DIR = \"%s\"" % temp_sstate_path
self.append_config(config_temp_sstate)
self.track_for_cleanup(temp_sstate_path)
- bb_vars = get_bb_vars(['SSTATE_DIR', 'NATIVELSBSTRING'])
- self.sstate_path = bb_vars['SSTATE_DIR']
- self.hostdistro = bb_vars['NATIVELSBSTRING']
- self.distro_specific_sstate = os.path.join(self.sstate_path, self.hostdistro)
+ self.sstate_path = get_bb_var('SSTATE_DIR')
if add_local_mirrors:
config_set_sstate_if_not_set = 'SSTATE_MIRRORS ?= ""'
@@ -65,8 +60,16 @@ class SStateBase(OESelftestTestCase):
config_sstate_mirror = "SSTATE_MIRRORS += \"file://.* file:///%s/PATH\"" % local_mirror
self.append_config(config_sstate_mirror)
+ def set_hostdistro(self):
+ # This needs to be read after a BuildStarted event in case it gets changed by event
+ # handling in uninative.bbclass
+ self.hostdistro = get_bb_var('NATIVELSBSTRING')
+ self.distro_specific_sstate = os.path.join(self.sstate_path, self.hostdistro)
+
# Returns a list containing sstate files
def search_sstate(self, filename_regex, distro_specific=True, distro_nonspecific=True):
+ self.set_hostdistro()
+
result = []
for root, dirs, files in os.walk(self.sstate_path):
if distro_specific and re.search(r"%s/%s/[a-z0-9]{2}/[a-z0-9]{2}$" % (self.sstate_path, self.hostdistro), root):
@@ -153,6 +156,8 @@ class SStateBase(OESelftestTestCase):
bitbake(['-ccleansstate'] + targets)
+ self.set_hostdistro()
+
bitbake(targets)
results = self.search_sstate('|'.join(map(str, [s + r'.*?\.tar.zst$' for s in targets])), distro_specific=False, distro_nonspecific=True)
filtered_results = []
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 10/11] oeqa/sstatetests: Improve/fix sstate creation tests
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 09/11] oeqa/sstatetests: Fix NATIVELSBSTRING handling Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 11/11] tcf-agent: correct the SRC_URI Steve Sakoman
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
There are multiple problems with the sstate creation tests. They currently both execute
twice, once to check one set of files, then another. We can do this together in one
test which makes the code easier to follow.
The common test function also has parameters which were always the same value, so
those can be simplified.
We can use the umask context manager from bb.utils to simplfy the umask code.
The badperms test was actually broken, it was detecting bad permissions, then
ignoring them. This patch fixes that regression too and allows the check to
operate (relying on a separate fix to sstate umask handling).
The result should be an easier to understand couple of test cases which should
also function correctly and be more reliable.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5b9263040013199c5cb480125d5ca349f5d6dc55)
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/selftest/cases/sstatetests.py | 78 ++++++++-------------
1 file changed, 30 insertions(+), 48 deletions(-)
diff --git a/meta/lib/oeqa/selftest/cases/sstatetests.py b/meta/lib/oeqa/selftest/cases/sstatetests.py
index 7231115a6b..08f94b168a 100644
--- a/meta/lib/oeqa/selftest/cases/sstatetests.py
+++ b/meta/lib/oeqa/selftest/cases/sstatetests.py
@@ -83,55 +83,43 @@ class SStateBase(OESelftestTestCase):
return result
# Test sstate files creation and their location and directory perms
- def run_test_sstate_creation(self, targets, distro_specific=True, distro_nonspecific=True, temp_sstate_location=True, should_pass=True):
- self.config_sstate(temp_sstate_location, [self.sstate_path])
+ def run_test_sstate_creation(self, targets, hostdistro_specific):
+ self.config_sstate(True, [self.sstate_path])
+
+ bitbake(['-cclean'] + targets)
- if self.temp_sstate_location:
- bitbake(['-cclean'] + targets)
- else:
- bitbake(['-ccleansstate'] + targets)
-
- # We need to test that the env umask have does not effect sstate directory creation
- # So, first, we'll get the current umask and set it to something we know incorrect
- # See: sstate_task_postfunc for correct umask of os.umask(0o002)
- import os
- def current_umask():
- current_umask = os.umask(0)
- os.umask(current_umask)
- return current_umask
-
- orig_umask = current_umask()
# Set it to a umask we know will be 'wrong'
- os.umask(0o022)
+ with bb.utils.umask(0o022):
+ bitbake(targets)
- bitbake(targets)
- file_tracker = []
- results = self.search_sstate('|'.join(map(str, targets)), distro_specific, distro_nonspecific)
- if distro_nonspecific:
- for r in results:
- if r.endswith(("_populate_lic.tar.zst", "_populate_lic.tar.zst.siginfo", "_fetch.tar.zst.siginfo", "_unpack.tar.zst.siginfo", "_patch.tar.zst.siginfo")):
- continue
- file_tracker.append(r)
- else:
- file_tracker = results
+ # Distro specific files
+ distro_specific_files = self.search_sstate('|'.join(map(str, targets)), True, False)
- if should_pass:
- self.assertTrue(file_tracker , msg="Could not find sstate files for: %s" % ', '.join(map(str, targets)))
+ # Distro non-specific
+ distro_non_specific_files = []
+ results = self.search_sstate('|'.join(map(str, targets)), False, True)
+ for r in results:
+ if r.endswith(("_populate_lic.tar.zst", "_populate_lic.tar.zst.siginfo", "_fetch.tar.zst.siginfo", "_unpack.tar.zst.siginfo", "_patch.tar.zst.siginfo")):
+ continue
+ distro_non_specific_files.append(r)
+
+ if hostdistro_specific:
+ self.assertTrue(distro_specific_files , msg="Could not find sstate files for: %s" % ', '.join(map(str, targets)))
+ self.assertFalse(distro_non_specific_files, msg="Found sstate files in the wrong place for: %s (found %s)" % (', '.join(map(str, targets)), str(distro_non_specific_files)))
else:
- self.assertTrue(not file_tracker , msg="Found sstate files in the wrong place for: %s (found %s)" % (', '.join(map(str, targets)), str(file_tracker)))
+ self.assertTrue(distro_non_specific_files , msg="Could not find sstate files for: %s" % ', '.join(map(str, targets)))
+ self.assertFalse(distro_specific_files, msg="Found sstate files in the wrong place for: %s (found %s)" % (', '.join(map(str, targets)), str(distro_specific_files)))
# Now we'll walk the tree to check the mode and see if things are incorrect.
badperms = []
for root, dirs, files in os.walk(self.sstate_path):
for directory in dirs:
- if (os.stat(os.path.join(root, directory)).st_mode & 0o777) != 0o775:
- badperms.append(os.path.join(root, directory))
+ mode = os.stat(os.path.join(root, directory)).st_mode & 0o777
+ if mode != 0o775:
+ badperms.append("%s: %s vs %s" % (os.path.join(root, directory), mode, 0o775))
- # Return to original umask
- os.umask(orig_umask)
-
- if should_pass:
- self.assertTrue(badperms , msg="Found sstate directories with the wrong permissions: %s (found %s)" % (', '.join(map(str, targets)), str(badperms)))
+ # Check badperms is empty
+ self.assertFalse(badperms , msg="Found sstate directories with the wrong permissions: %s (found %s)" % (', '.join(map(str, targets)), str(badperms)))
# Test the sstate files deletion part of the do_cleansstate task
def run_test_cleansstate_task(self, targets, distro_specific=True, distro_nonspecific=True, temp_sstate_location=True):
@@ -256,17 +244,11 @@ class SStateTests(SStateBase):
bitbake("dbus-wait-test -c unpack")
class SStateCreation(SStateBase):
- def test_sstate_creation_distro_specific_pass(self):
- self.run_test_sstate_creation(['binutils-cross-'+ self.tune_arch, 'binutils-native'], distro_specific=True, distro_nonspecific=False, temp_sstate_location=True)
-
- def test_sstate_creation_distro_specific_fail(self):
- self.run_test_sstate_creation(['binutils-cross-'+ self.tune_arch, 'binutils-native'], distro_specific=False, distro_nonspecific=True, temp_sstate_location=True, should_pass=False)
-
- def test_sstate_creation_distro_nonspecific_pass(self):
- self.run_test_sstate_creation(['linux-libc-headers'], distro_specific=False, distro_nonspecific=True, temp_sstate_location=True)
+ def test_sstate_creation_distro_specific(self):
+ self.run_test_sstate_creation(['binutils-cross-'+ self.tune_arch, 'binutils-native'], hostdistro_specific=True)
- def test_sstate_creation_distro_nonspecific_fail(self):
- self.run_test_sstate_creation(['linux-libc-headers'], distro_specific=True, distro_nonspecific=False, temp_sstate_location=True, should_pass=False)
+ def test_sstate_creation_distro_nonspecific(self):
+ self.run_test_sstate_creation(['linux-libc-headers'], hostdistro_specific=False)
class SStateCleanup(SStateBase):
def test_cleansstate_task_distro_specific_nonspecific(self):
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 11/11] tcf-agent: correct the SRC_URI
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-07-01 13:38 ` [OE-core][walnascar 10/11] oeqa/sstatetests: Improve/fix sstate creation tests Steve Sakoman
@ 2025-07-01 13:38 ` Steve Sakoman
10 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-01 13:38 UTC (permalink / raw)
To: openembedded-core
From: Guocai He <guocai.he.cn@windriver.com>
The SRC_URI is changed to git://gitlab.eclipse.org/eclipse/tcf/tcf.agent.git
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/tcf-agent/tcf-agent_git.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/tcf-agent/tcf-agent_git.bb b/meta/recipes-devtools/tcf-agent/tcf-agent_git.bb
index e1ac0a29a7..cd5a00fcbc 100644
--- a/meta/recipes-devtools/tcf-agent/tcf-agent_git.bb
+++ b/meta/recipes-devtools/tcf-agent/tcf-agent_git.bb
@@ -1,5 +1,5 @@
SUMMARY = "Target Communication Framework for the Eclipse IDE"
-HOMEPAGE = "http://wiki.eclipse.org/TCF"
+HOMEPAGE = "https://gitlab.eclipse.org/eclipse/tcf/"
DESCRIPTION = "TCF is a vendor-neutral, lightweight, extensible network protocol mainly for communicating with embedded systems (targets)."
BUGTRACKER = "https://bugs.eclipse.org/bugs/"
@@ -10,7 +10,7 @@ SRCREV = "1f11747e83ebf4f53e8d17f430136f92ec378709"
PV = "1.8.0+git"
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>(\d+(\.\d+)+))"
-SRC_URI = "git://git.eclipse.org/r/tcf/org.eclipse.tcf.agent.git;protocol=https;branch=master \
+SRC_URI = "git://gitlab.eclipse.org/eclipse/tcf/tcf.agent.git;protocol=https;branch=master \
file://ldflags.patch \
file://tcf-agent.init \
file://tcf-agent.service \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-07-01 13:38 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-01 13:37 [OE-core][walnascar 00/11] Patch review Steve Sakoman
2025-07-01 13:37 ` [OE-core][walnascar 01/11] python3-urllib3: fix CVE-2025-50181 Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 02/11] python3-urllib3: fix CVE-2025-50182 Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 03/11] python3-setuptools: fix CVE-2025-47273 Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 04/11] libarchive: fix CVE-2025-5914 Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 05/11] python3: drop old nis module dependencies Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 06/11] package_rpm.bbclass: Remove empty build directory Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 07/11] xwayland: Add missing libtirpc dependency Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 08/11] sstate: apply proper umask when fetching from SSTATE_MIRROR Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 09/11] oeqa/sstatetests: Fix NATIVELSBSTRING handling Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 10/11] oeqa/sstatetests: Improve/fix sstate creation tests Steve Sakoman
2025-07-01 13:38 ` [OE-core][walnascar 11/11] tcf-agent: correct the SRC_URI Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox