* [OE-core][scarthgap 01/19] curl: ignore CVE-2025-10966
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 02/19] go: fix CVE-2025-58185 Steve Sakoman
` (17 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Per [1] this CVE applies only when wolfssl backed is used.
8.17.0 removed WolfSSL support completely.
[1] https://curl.se/docs/CVE-2025-10966.html
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 713d90a378..6c02746394 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -39,6 +39,7 @@ CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on go
CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older"
CVE_STATUS[CVE-2025-5025] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}"
+CVE_STATUS[CVE-2025-10966] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}"
inherit autotools pkgconfig binconfig multilib_header ptest
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 02/19] go: fix CVE-2025-58185
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 01/19] curl: ignore CVE-2025-10966 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 03/19] go: fix CVE-2025-58187 Steve Sakoman
` (16 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
Parsing a maliciously crafted DER payload could allocate large amounts of memory,
causing memory exhaustion.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-58185.patch | 142 ++++++++++++++++++
2 files changed, 143 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-58185.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index a364e1aae8..38992219c8 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -21,6 +21,7 @@ SRC_URI += "\
file://CVE-2025-47907-pre.patch \
file://CVE-2025-47907.patch \
file://CVE-2025-47906.patch \
+ file://CVE-2025-58185.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-58185.patch b/meta/recipes-devtools/go/go/CVE-2025-58185.patch
new file mode 100644
index 0000000000..63250614ce
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-58185.patch
@@ -0,0 +1,142 @@
+From 5c3d61c886f7ecfce9a6d6d3c97e6d5a8afb17d1 Mon Sep 17 00:00:00 2001
+From: Nicholas Husin <husin@google.com>
+Date: Wed, 3 Sep 2025 09:30:56 -0400
+Subject: [PATCH] [release-branch.go1.24] encoding/asn1: prevent memory
+ exhaustion when parsing using internal/saferio
+
+Within parseSequenceOf,
+reflect.MakeSlice is being used to pre-allocate a slice that is needed in
+order to fully validate the given DER payload. The size of the slice
+allocated are also multiple times larger than the input DER:
+
+- When using asn1.Unmarshal directly, the allocated slice is ~28x
+ larger.
+- When passing in DER using x509.ParseCertificateRequest, the allocated
+ slice is ~48x larger.
+- When passing in DER using ocsp.ParseResponse, the allocated slice is
+ ~137x larger.
+
+As a result, a malicious actor can craft a big empty DER payload,
+resulting in an unnecessary large allocation of memories. This can be a
+way to cause memory exhaustion.
+
+To prevent this, we now use SliceCapWithSize within internal/saferio to
+enforce a memory allocation cap.
+
+Thanks to Jakub Ciolek for reporting this issue.
+
+For #75671
+Fixes #75704
+Fixes CVE-2025-58185
+
+Change-Id: Id50e76187eda43f594be75e516b9ca1d2ae6f428
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2700
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2984
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709841
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+
+CVE: CVE-2025-58185
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/5c3d61c886f7ecfce9a6d6d3c97e6d5a8afb17d1]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/encoding/asn1/asn1.go | 10 ++++++++-
+ src/encoding/asn1/asn1_test.go | 38 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/src/encoding/asn1/asn1.go b/src/encoding/asn1/asn1.go
+index 781ab87..16c7138 100644
+--- a/src/encoding/asn1/asn1.go
++++ b/src/encoding/asn1/asn1.go
+@@ -22,6 +22,7 @@ package asn1
+ import (
+ "errors"
+ "fmt"
++ "internal/saferio"
+ "math"
+ "math/big"
+ "reflect"
+@@ -643,10 +644,17 @@ func parseSequenceOf(bytes []byte, sliceType reflect.Type, elemType reflect.Type
+ offset += t.length
+ numElements++
+ }
+- ret = reflect.MakeSlice(sliceType, numElements, numElements)
++ elemSize := uint64(elemType.Size())
++ safeCap := saferio.SliceCapWithSize(elemSize, uint64(numElements))
++ if safeCap < 0 {
++ err = SyntaxError{fmt.Sprintf("%s slice too big: %d elements of %d bytes", elemType.Kind(), numElements, elemSize)}
++ return
++ }
++ ret = reflect.MakeSlice(sliceType, 0, safeCap)
+ params := fieldParameters{}
+ offset := 0
+ for i := 0; i < numElements; i++ {
++ ret = reflect.Append(ret, reflect.Zero(elemType))
+ offset, err = parseField(ret.Index(i), bytes, offset, params)
+ if err != nil {
+ return
+diff --git a/src/encoding/asn1/asn1_test.go b/src/encoding/asn1/asn1_test.go
+index 9a605e2..249d4e4 100644
+--- a/src/encoding/asn1/asn1_test.go
++++ b/src/encoding/asn1/asn1_test.go
+@@ -7,10 +7,12 @@ package asn1
+ import (
+ "bytes"
+ "encoding/hex"
++ "errors"
+ "fmt"
+ "math"
+ "math/big"
+ "reflect"
++ "runtime"
+ "strings"
+ "testing"
+ "time"
+@@ -1175,3 +1177,39 @@ func BenchmarkObjectIdentifierString(b *testing.B) {
+ _ = oidPublicKeyRSA.String()
+ }
+ }
++
++func TestParsingMemoryConsumption(t *testing.T) {
++ // Craft a syntatically valid, but empty, ~10 MB DER bomb. A successful
++ // unmarshal of this bomb should yield ~280 MB. However, the parsing should
++ // fail due to the empty content; and, in such cases, we want to make sure
++ // that we do not unnecessarily allocate memories.
++ derBomb := make([]byte, 10_000_000)
++ for i := range derBomb {
++ derBomb[i] = 0x30
++ }
++ derBomb = append([]byte{0x30, 0x83, 0x98, 0x96, 0x80}, derBomb...)
++
++ var m runtime.MemStats
++ runtime.GC()
++ runtime.ReadMemStats(&m)
++ memBefore := m.TotalAlloc
++
++ var out []struct {
++ Id []int
++ Critical bool `asn1:"optional"`
++ Value []byte
++ }
++ _, err := Unmarshal(derBomb, &out)
++ if !errors.As(err, &SyntaxError{}) {
++ t.Fatalf("Incorrect error result: want (%v), but got (%v) instead", &SyntaxError{}, err)
++ }
++
++ runtime.ReadMemStats(&m)
++ memDiff := m.TotalAlloc - memBefore
++
++ // Ensure that the memory allocated does not exceed 10<<21 (~20 MB) when
++ // the parsing fails.
++ if memDiff > 10<<21 {
++ t.Errorf("Too much memory allocated while parsing DER: %v MiB", memDiff/1024/1024)
++ }
++}
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 03/19] go: fix CVE-2025-58187
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 01/19] curl: ignore CVE-2025-10966 Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 02/19] go: fix CVE-2025-58185 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 04/19] go: fix CVE-2025-58188 Steve Sakoman
` (15 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
Due to the design of the name constraint checking algorithm, the processing
time of some inputs scals non-linearly with respect to the size of the certificate.
This affects programs which validate arbitrary certificate chains.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-58187.patch | 349 ++++++++++++++++++
2 files changed, 350 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-58187.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index 38992219c8..a1c14ea684 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -22,6 +22,7 @@ SRC_URI += "\
file://CVE-2025-47907.patch \
file://CVE-2025-47906.patch \
file://CVE-2025-58185.patch \
+ file://CVE-2025-58187.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-58187.patch b/meta/recipes-devtools/go/go/CVE-2025-58187.patch
new file mode 100644
index 0000000000..d3b7dd5264
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-58187.patch
@@ -0,0 +1,349 @@
+From f334417e71f8b078ad64035bddb6df7f8910da6c Mon Sep 17 00:00:00 2001
+From: Neal Patel <nealpatel@google.com>
+Date: Mon, 15 Sep 2025 16:31:22 -0400
+Subject: [PATCH] [release-branch.go1.24] crypto/x509: improve domain name
+ verification
+
+Don't use domainToReverseLabels to check if domain names are
+valid, since it is not particularly performant, and can contribute to DoS
+vectors. Instead just iterate over the name and enforce the properties we
+care about.
+
+This also enforces that DNS names, both in SANs and name constraints,
+are valid. We previously allowed invalid SANs, because some
+intermediates had these weird names (see #23995), but there are
+currently no trusted intermediates that have this property, and since we
+target the web PKI, supporting this particular case is not a high
+priority.
+
+Thank you to Jakub Ciolek for reporting this issue.
+
+Fixes CVE-2025-58187
+For #75681
+Fixes #75714
+
+Change-Id: I6ebce847dcbe5fc63ef2f9a74f53f11c4c56d3d1
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2820
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2982
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709839
+Auto-Submit: Michael Pratt <mpratt@google.com>
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+
+CVE: CVE-2025-58187
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/f334417e71f8b078ad64035bddb6df7f8910da6c]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/crypto/x509/name_constraints_test.go | 66 ++------------------
+ src/crypto/x509/parser.go | 77 ++++++++++++++----------
+ src/crypto/x509/parser_test.go | 43 +++++++++++++
+ src/crypto/x509/verify.go | 1 +
+ 4 files changed, 95 insertions(+), 92 deletions(-)
+
+diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go
+index 78263fc..9aaa6d7 100644
+--- a/src/crypto/x509/name_constraints_test.go
++++ b/src/crypto/x509/name_constraints_test.go
+@@ -1456,63 +1456,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ expectedError: "incompatible key usage",
+ },
+
+- // An invalid DNS SAN should be detected only at validation time so
+- // that we can process CA certificates in the wild that have invalid SANs.
+- // See https://github.com/golang/go/issues/23995
+-
+- // #77: an invalid DNS or mail SAN will not be detected if name constraint
+- // checking is not triggered.
+- {
+- roots: make([]constraintsSpec, 1),
+- intermediates: [][]constraintsSpec{
+- {
+- {},
+- },
+- },
+- leaf: leafSpec{
+- sans: []string{"dns:this is invalid", "email:this @ is invalid"},
+- },
+- },
+-
+- // #78: an invalid DNS SAN will be detected if any name constraint checking
+- // is triggered.
+- {
+- roots: []constraintsSpec{
+- {
+- bad: []string{"uri:"},
+- },
+- },
+- intermediates: [][]constraintsSpec{
+- {
+- {},
+- },
+- },
+- leaf: leafSpec{
+- sans: []string{"dns:this is invalid"},
+- },
+- expectedError: "cannot parse dnsName",
+- },
+-
+- // #79: an invalid email SAN will be detected if any name constraint
+- // checking is triggered.
+- {
+- roots: []constraintsSpec{
+- {
+- bad: []string{"uri:"},
+- },
+- },
+- intermediates: [][]constraintsSpec{
+- {
+- {},
+- },
+- },
+- leaf: leafSpec{
+- sans: []string{"email:this @ is invalid"},
+- },
+- expectedError: "cannot parse rfc822Name",
+- },
+-
+- // #80: if several EKUs are requested, satisfying any of them is sufficient.
++ // #77: if several EKUs are requested, satisfying any of them is sufficient.
+ {
+ roots: make([]constraintsSpec, 1),
+ intermediates: [][]constraintsSpec{
+@@ -1527,7 +1471,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ requestedEKUs: []ExtKeyUsage{ExtKeyUsageClientAuth, ExtKeyUsageEmailProtection},
+ },
+
+- // #81: EKUs that are not asserted in VerifyOpts are not required to be
++ // #78: EKUs that are not asserted in VerifyOpts are not required to be
+ // nested.
+ {
+ roots: make([]constraintsSpec, 1),
+@@ -1546,7 +1490,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #82: a certificate without SANs and CN is accepted in a constrained chain.
++ // #79: a certificate without SANs and CN is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+ {
+@@ -1563,7 +1507,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #83: a certificate without SANs and with a CN that does not parse as a
++ // #80: a certificate without SANs and with a CN that does not parse as a
+ // hostname is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+@@ -1582,7 +1526,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #84: a certificate with SANs and CN is accepted in a constrained chain.
++ // #81: a certificate with SANs and CN is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+ {
+diff --git a/src/crypto/x509/parser.go b/src/crypto/x509/parser.go
+index 812b0d2..9a3bcd6 100644
+--- a/src/crypto/x509/parser.go
++++ b/src/crypto/x509/parser.go
+@@ -378,10 +378,14 @@ func parseSANExtension(der cryptobyte.String) (dnsNames, emailAddresses []string
+ if err := isIA5String(email); err != nil {
+ return errors.New("x509: SAN rfc822Name is malformed")
+ }
++ parsed, ok := parseRFC2821Mailbox(email)
++ if !ok || (ok && !domainNameValid(parsed.domain, false)) {
++ return errors.New("x509: SAN rfc822Name is malformed")
++ }
+ emailAddresses = append(emailAddresses, email)
+ case nameTypeDNS:
+ name := string(data)
+- if err := isIA5String(name); err != nil {
++ if err := isIA5String(name); err != nil || (err == nil && !domainNameValid(name, false)) {
+ return errors.New("x509: SAN dNSName is malformed")
+ }
+ dnsNames = append(dnsNames, string(name))
+@@ -391,14 +395,9 @@ func parseSANExtension(der cryptobyte.String) (dnsNames, emailAddresses []string
+ return errors.New("x509: SAN uniformResourceIdentifier is malformed")
+ }
+ uri, err := url.Parse(uriStr)
+- if err != nil {
++ if err != nil || (err == nil && uri.Host != "" && !domainNameValid(uri.Host, false)) {
+ return fmt.Errorf("x509: cannot parse URI %q: %s", uriStr, err)
+ }
+- if len(uri.Host) > 0 {
+- if _, ok := domainToReverseLabels(uri.Host); !ok {
+- return fmt.Errorf("x509: cannot parse URI %q: invalid domain", uriStr)
+- }
+- }
+ uris = append(uris, uri)
+ case nameTypeIP:
+ switch len(data) {
+@@ -538,15 +537,7 @@ func parseNameConstraintsExtension(out *Certificate, e pkix.Extension) (unhandle
+ return nil, nil, nil, nil, errors.New("x509: invalid constraint value: " + err.Error())
+ }
+
+- trimmedDomain := domain
+- if len(trimmedDomain) > 0 && trimmedDomain[0] == '.' {
+- // constraints can have a leading
+- // period to exclude the domain
+- // itself, but that's not valid in a
+- // normal domain name.
+- trimmedDomain = trimmedDomain[1:]
+- }
+- if _, ok := domainToReverseLabels(trimmedDomain); !ok {
++ if !domainNameValid(domain, true) {
+ return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse dnsName constraint %q", domain)
+ }
+ dnsNames = append(dnsNames, domain)
+@@ -587,12 +578,7 @@ func parseNameConstraintsExtension(out *Certificate, e pkix.Extension) (unhandle
+ return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse rfc822Name constraint %q", constraint)
+ }
+ } else {
+- // Otherwise it's a domain name.
+- domain := constraint
+- if len(domain) > 0 && domain[0] == '.' {
+- domain = domain[1:]
+- }
+- if _, ok := domainToReverseLabels(domain); !ok {
++ if !domainNameValid(constraint, true) {
+ return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse rfc822Name constraint %q", constraint)
+ }
+ }
+@@ -608,15 +594,7 @@ func parseNameConstraintsExtension(out *Certificate, e pkix.Extension) (unhandle
+ return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse URI constraint %q: cannot be IP address", domain)
+ }
+
+- trimmedDomain := domain
+- if len(trimmedDomain) > 0 && trimmedDomain[0] == '.' {
+- // constraints can have a leading
+- // period to exclude the domain itself,
+- // but that's not valid in a normal
+- // domain name.
+- trimmedDomain = trimmedDomain[1:]
+- }
+- if _, ok := domainToReverseLabels(trimmedDomain); !ok {
++ if !domainNameValid(domain, true) {
+ return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse URI constraint %q", domain)
+ }
+ uriDomains = append(uriDomains, domain)
+@@ -1197,3 +1175,40 @@ func ParseRevocationList(der []byte) (*RevocationList, error) {
+
+ return rl, nil
+ }
++
++// domainNameValid does minimal domain name validity checking. In particular it
++// enforces the following properties:
++// - names cannot have the trailing period
++// - names can only have a leading period if constraint is true
++// - names must be <= 253 characters
++// - names cannot have empty labels
++// - names cannot labels that are longer than 63 characters
++//
++// Note that this does not enforce the LDH requirements for domain names.
++func domainNameValid(s string, constraint bool) bool {
++ if len(s) == 0 && constraint {
++ return true
++ }
++ if len(s) == 0 || (!constraint && s[0] == '.') || s[len(s)-1] == '.' || len(s) > 253 {
++ return false
++ }
++ lastDot := -1
++ if constraint && s[0] == '.' {
++ s = s[1:]
++ }
++
++ for i := 0; i <= len(s); i++ {
++ if i == len(s) || s[i] == '.' {
++ labelLen := i
++ if lastDot >= 0 {
++ labelLen -= lastDot + 1
++ }
++ if labelLen == 0 || labelLen > 63 {
++ return false
++ }
++ lastDot = i
++ }
++ }
++
++ return true
++}
+diff --git a/src/crypto/x509/parser_test.go b/src/crypto/x509/parser_test.go
+index b31f9cd..a6cdfb8 100644
+--- a/src/crypto/x509/parser_test.go
++++ b/src/crypto/x509/parser_test.go
+@@ -6,6 +6,7 @@ package x509
+
+ import (
+ "encoding/asn1"
++ "strings"
+ "testing"
+
+ cryptobyte_asn1 "golang.org/x/crypto/cryptobyte/asn1"
+@@ -101,3 +102,45 @@ func TestParseASN1String(t *testing.T) {
+ })
+ }
+ }
++
++func TestDomainNameValid(t *testing.T) {
++ for _, tc := range []struct {
++ name string
++ dnsName string
++ constraint bool
++ valid bool
++ }{
++ {"empty name, name", "", false, false},
++ {"empty name, constraint", "", true, true},
++ {"empty label, name", "a..a", false, false},
++ {"empty label, constraint", "a..a", true, false},
++ {"period, name", ".", false, false},
++ {"period, constraint", ".", true, false}, // TODO(roland): not entirely clear if this is a valid constraint (require at least one label?)
++ {"valid, name", "a.b.c", false, true},
++ {"valid, constraint", "a.b.c", true, true},
++ {"leading period, name", ".a.b.c", false, false},
++ {"leading period, constraint", ".a.b.c", true, true},
++ {"trailing period, name", "a.", false, false},
++ {"trailing period, constraint", "a.", true, false},
++ {"bare label, name", "a", false, true},
++ {"bare label, constraint", "a", true, true},
++ {"254 char label, name", strings.Repeat("a.a", 84) + "aaa", false, false},
++ {"254 char label, constraint", strings.Repeat("a.a", 84) + "aaa", true, false},
++ {"253 char label, name", strings.Repeat("a.a", 84) + "aa", false, false},
++ {"253 char label, constraint", strings.Repeat("a.a", 84) + "aa", true, false},
++ {"64 char single label, name", strings.Repeat("a", 64), false, false},
++ {"64 char single label, constraint", strings.Repeat("a", 64), true, false},
++ {"63 char single label, name", strings.Repeat("a", 63), false, true},
++ {"63 char single label, constraint", strings.Repeat("a", 63), true, true},
++ {"64 char label, name", "a." + strings.Repeat("a", 64), false, false},
++ {"64 char label, constraint", "a." + strings.Repeat("a", 64), true, false},
++ {"63 char label, name", "a." + strings.Repeat("a", 63), false, true},
++ {"63 char label, constraint", "a." + strings.Repeat("a", 63), true, true},
++ } {
++ t.Run(tc.name, func(t *testing.T) {
++ if tc.valid != domainNameValid(tc.dnsName, tc.constraint) {
++ t.Errorf("domainNameValid(%q, %t) = %v; want %v", tc.dnsName, tc.constraint, !tc.valid, tc.valid)
++ }
++ })
++ }
++}
+diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
+index 2d2a271..4502d4c 100644
+--- a/src/crypto/x509/verify.go
++++ b/src/crypto/x509/verify.go
+@@ -360,6 +360,7 @@ func parseRFC2821Mailbox(in string) (mailbox rfc2821Mailbox, ok bool) {
+ // domainToReverseLabels converts a textual domain name like foo.example.com to
+ // the list of labels in reverse order, e.g. ["com", "example", "foo"].
+ func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) {
++ reverseLabels = make([]string, 0, strings.Count(domain, ".")+1)
+ for len(domain) > 0 {
+ if i := strings.LastIndexByte(domain, '.'); i == -1 {
+ reverseLabels = append(reverseLabels, domain)
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 04/19] go: fix CVE-2025-58188
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 03/19] go: fix CVE-2025-58187 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 05/19] go: fix CVE-2025-58189 Steve Sakoman
` (14 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
Validating certificate chains which contain DSA public keys can cause
programs to panic, due to a interface cast that assumes they implement
the Equal method. This affects programs which validate arbitrary certificate chains.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-58188.patch | 194 ++++++++++++++++++
2 files changed, 195 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-58188.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index a1c14ea684..b619fc48f4 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -23,6 +23,7 @@ SRC_URI += "\
file://CVE-2025-47906.patch \
file://CVE-2025-58185.patch \
file://CVE-2025-58187.patch \
+ file://CVE-2025-58188.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-58188.patch b/meta/recipes-devtools/go/go/CVE-2025-58188.patch
new file mode 100644
index 0000000000..5787527414
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-58188.patch
@@ -0,0 +1,194 @@
+From f9f198ab05e3282cbf6b13251d47d9141981e401 Mon Sep 17 00:00:00 2001
+From: Neal Patel <nealpatel@google.com>
+Date: Thu, 11 Sep 2025 16:27:04 -0400
+Subject: [PATCH] [release-branch.go1.24] crypto/x509: mitigate DoS vector when
+ intermediate certificate contains DSA public key An attacker could craft an
+ intermediate X.509 certificate containing a DSA public key and can crash a
+ remote host with an unauthenticated call to any endpoint that verifies the
+ certificate chain.
+
+Thank you to Jakub Ciolek for reporting this issue.
+
+Fixes CVE-2025-58188
+For #75675
+Fixes #75702
+
+Change-Id: I2ecbb87b9b8268dbc55c8795891e596ab60f0088
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2780
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2964
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709836
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+
+CVE: CVE-2025-58188
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/f9f198ab05e3282cbf6b13251d47d9141981e401]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/crypto/x509/verify.go | 5 +-
+ src/crypto/x509/verify_test.go | 126 +++++++++++++++++++++++++++++++++
+ 2 files changed, 130 insertions(+), 1 deletion(-)
+
+diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
+index 4502d4c..14cd23f 100644
+--- a/src/crypto/x509/verify.go
++++ b/src/crypto/x509/verify.go
+@@ -868,7 +868,10 @@ func alreadyInChain(candidate *Certificate, chain []*Certificate) bool {
+ if !bytes.Equal(candidate.RawSubject, cert.RawSubject) {
+ continue
+ }
+- if !candidate.PublicKey.(pubKeyEqual).Equal(cert.PublicKey) {
++ // We enforce the canonical encoding of SPKI (by only allowing the
++ // correct AI paremeter encodings in parseCertificate), so it's safe to
++ // directly compare the raw bytes.
++ if !bytes.Equal(candidate.RawSubjectPublicKeyInfo, cert.RawSubjectPublicKeyInfo) {
+ continue
+ }
+ var certSAN *pkix.Extension
+diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
+index 8a7a5f6..4a7d8da 100644
+--- a/src/crypto/x509/verify_test.go
++++ b/src/crypto/x509/verify_test.go
+@@ -6,6 +6,7 @@ package x509
+
+ import (
+ "crypto"
++ "crypto/dsa"
+ "crypto/ecdsa"
+ "crypto/elliptic"
+ "crypto/rand"
+@@ -2811,3 +2812,128 @@ func TestVerifyNilPubKey(t *testing.T) {
+ t.Fatalf("buildChains returned unexpected error, got: %v, want %v", err, UnknownAuthorityError{})
+ }
+ }
++func TestCertificateChainSignedByECDSA(t *testing.T) {
++ caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
++ if err != nil {
++ t.Fatal(err)
++ }
++ root := &Certificate{
++ SerialNumber: big.NewInt(1),
++ Subject: pkix.Name{CommonName: "X"},
++ NotBefore: time.Now().Add(-time.Hour),
++ NotAfter: time.Now().Add(365 * 24 * time.Hour),
++ IsCA: true,
++ KeyUsage: KeyUsageCertSign | KeyUsageCRLSign,
++ BasicConstraintsValid: true,
++ }
++ caDER, err := CreateCertificate(rand.Reader, root, root, &caKey.PublicKey, caKey)
++ if err != nil {
++ t.Fatal(err)
++ }
++ root, err = ParseCertificate(caDER)
++ if err != nil {
++ t.Fatal(err)
++ }
++
++ leafKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
++ leaf := &Certificate{
++ SerialNumber: big.NewInt(42),
++ Subject: pkix.Name{CommonName: "leaf"},
++ NotBefore: time.Now().Add(-10 * time.Minute),
++ NotAfter: time.Now().Add(24 * time.Hour),
++ KeyUsage: KeyUsageDigitalSignature,
++ ExtKeyUsage: []ExtKeyUsage{ExtKeyUsageServerAuth},
++ BasicConstraintsValid: true,
++ }
++ leafDER, err := CreateCertificate(rand.Reader, leaf, root, &leafKey.PublicKey, caKey)
++ if err != nil {
++ t.Fatal(err)
++ }
++ leaf, err = ParseCertificate(leafDER)
++ if err != nil {
++ t.Fatal(err)
++ }
++
++ inter, err := ParseCertificate(dsaSelfSignedCNX(t))
++ if err != nil {
++ t.Fatal(err)
++ }
++
++ inters := NewCertPool()
++ inters.AddCert(root)
++ inters.AddCert(inter)
++
++ wantErr := "certificate signed by unknown authority"
++ _, err = leaf.Verify(VerifyOptions{Intermediates: inters, Roots: NewCertPool()})
++ if !strings.Contains(err.Error(), wantErr) {
++ t.Errorf("got %v, want %q", err, wantErr)
++ }
++}
++
++// dsaSelfSignedCNX produces DER-encoded
++// certificate with the properties:
++//
++// Subject=Issuer=CN=X
++// DSA SPKI
++// Matching inner/outer signature OIDs
++// Dummy ECDSA signature
++func dsaSelfSignedCNX(t *testing.T) []byte {
++ t.Helper()
++ var params dsa.Parameters
++ if err := dsa.GenerateParameters(¶ms, rand.Reader, dsa.L1024N160); err != nil {
++ t.Fatal(err)
++ }
++
++ var dsaPriv dsa.PrivateKey
++ dsaPriv.Parameters = params
++ if err := dsa.GenerateKey(&dsaPriv, rand.Reader); err != nil {
++ t.Fatal(err)
++ }
++ dsaPub := &dsaPriv.PublicKey
++
++ type dsaParams struct{ P, Q, G *big.Int }
++ paramDER, err := asn1.Marshal(dsaParams{dsaPub.P, dsaPub.Q, dsaPub.G})
++ if err != nil {
++ t.Fatal(err)
++ }
++ yDER, err := asn1.Marshal(dsaPub.Y)
++ if err != nil {
++ t.Fatal(err)
++ }
++
++ spki := publicKeyInfo{
++ Algorithm: pkix.AlgorithmIdentifier{
++ Algorithm: oidPublicKeyDSA,
++ Parameters: asn1.RawValue{FullBytes: paramDER},
++ },
++ PublicKey: asn1.BitString{Bytes: yDER, BitLength: 8 * len(yDER)},
++ }
++
++ rdn := pkix.Name{CommonName: "X"}.ToRDNSequence()
++ b, err := asn1.Marshal(rdn)
++ if err != nil {
++ t.Fatal(err)
++ }
++ rawName := asn1.RawValue{FullBytes: b}
++
++ algoIdent := pkix.AlgorithmIdentifier{Algorithm: oidSignatureDSAWithSHA256}
++ tbs := tbsCertificate{
++ Version: 0,
++ SerialNumber: big.NewInt(1002),
++ SignatureAlgorithm: algoIdent,
++ Issuer: rawName,
++ Validity: validity{NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(24 * time.Hour)},
++ Subject: rawName,
++ PublicKey: spki,
++ }
++ c := certificate{
++ TBSCertificate: tbs,
++ SignatureAlgorithm: algoIdent,
++ SignatureValue: asn1.BitString{Bytes: []byte{0}, BitLength: 8},
++ }
++ dsaDER, err := asn1.Marshal(c)
++ if err != nil {
++ t.Fatal(err)
++ }
++ return dsaDER
++}
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 05/19] go: fix CVE-2025-58189
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 04/19] go: fix CVE-2025-58188 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 06/19] go: fix CVE-2025-47912 Steve Sakoman
` (13 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
When Conn.Handshake fails during ALPN negotiation the error contains attacker
controlled information (the ALPN protocols sent by the client) which is not escaped.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-58189.patch | 50 +++++++++++++++++++
2 files changed, 51 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-58189.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index b619fc48f4..1e4139148e 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -24,6 +24,7 @@ SRC_URI += "\
file://CVE-2025-58185.patch \
file://CVE-2025-58187.patch \
file://CVE-2025-58188.patch \
+ file://CVE-2025-58189.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-58189.patch b/meta/recipes-devtools/go/go/CVE-2025-58189.patch
new file mode 100644
index 0000000000..4908cf6400
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-58189.patch
@@ -0,0 +1,50 @@
+From 2e1e356e33b9c792a9643749a7626a1789197bb9 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <roland@golang.org>
+Date: Mon, 29 Sep 2025 10:11:56 -0700
+Subject: [PATCH] crypto/tls: quote protocols in ALPN error message
+
+Quote the protocols sent by the client when returning the ALPN
+negotiation error message.
+
+Fixes CVE-2025-58189
+Updates #75652
+Fixes #75660
+
+Change-Id: Ie7b3a1ed0b6efcc1705b71f0f1e8417126661330
+Reviewed-on: https://go-review.googlesource.com/c/go/+/707776
+Auto-Submit: Roland Shoemaker <roland@golang.org>
+Reviewed-by: Neal Patel <nealpatel@google.com>
+Reviewed-by: Nicholas Husin <nsh@golang.org>
+Auto-Submit: Nicholas Husin <nsh@golang.org>
+Reviewed-by: Nicholas Husin <husin@google.com>
+TryBot-Bypass: Roland Shoemaker <roland@golang.org>
+Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
+(cherry picked from commit 4e9006a716533fe1c7ee08df02dfc73078f7dc19)
+Reviewed-on: https://go-review.googlesource.com/c/go/+/708096
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+
+CVE: CVE-2025-58189
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/2e1e356e33b9c792a9643749a7626a1789197bb9]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/crypto/tls/handshake_server.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/crypto/tls/handshake_server.go b/src/crypto/tls/handshake_server.go
+index 4e84aa9..17b6891 100644
+--- a/src/crypto/tls/handshake_server.go
++++ b/src/crypto/tls/handshake_server.go
+@@ -312,7 +312,7 @@ func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, erro
+ if http11fallback {
+ return "", nil
+ }
+- return "", fmt.Errorf("tls: client requested unsupported application protocols (%s)", clientProtos)
++ return "", fmt.Errorf("tls: client requested unsupported application protocols (%q)", clientProtos)
+ }
+
+ // supportsECDHE returns whether ECDHE key exchanges can be used with this
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 06/19] go: fix CVE-2025-47912
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 05/19] go: fix CVE-2025-58189 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 07/19] go: fix CVE-2025-61723 Steve Sakoman
` (12 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
The Parse function permits values other than IPv6 addresses to be included
in square brackets within the host component of a URL. RFC 3986 permits
IPv6 addresses to be included within the host component, enclosed within
square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames
must not appear within square brackets. Parse did not enforce this requirement.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-47912.patch | 226 ++++++++++++++++++
2 files changed, 227 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-47912.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index 1e4139148e..2be5c8b519 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -25,6 +25,7 @@ SRC_URI += "\
file://CVE-2025-58187.patch \
file://CVE-2025-58188.patch \
file://CVE-2025-58189.patch \
+ file://CVE-2025-47912.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-47912.patch b/meta/recipes-devtools/go/go/CVE-2025-47912.patch
new file mode 100644
index 0000000000..bc63b323ca
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-47912.patch
@@ -0,0 +1,226 @@
+From d6d2f7bf76718f1db05461cd912ae5e30d7b77ea Mon Sep 17 00:00:00 2001
+From: Ethan Lee <ethanalee@google.com>
+Date: Fri, 29 Aug 2025 17:35:55 +0000
+Subject: [PATCH] [release-branch.go1.24] net/url: enforce stricter parsing of
+
+ bracketed IPv6 hostnames - Previously, url.Parse did not enforce validation
+ of hostnames within square brackets. - RFC 3986 stipulates that only IPv6
+ hostnames can be embedded within square brackets in a URL. - Now, the
+ parsing logic should strictly enforce that only IPv6 hostnames can be
+ resolved when in square brackets. IPv4, IPv4-mapped addresses and other
+ input will be rejected. - Update url_test to add test cases that cover the
+ above scenarios.
+
+Thanks to Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua
+University for reporting this issue.
+
+Fixes CVE-2025-47912
+Fixes #75678
+Fixes #75712
+
+Change-Id: Iaa41432bf0ee86de95a39a03adae5729e4deb46c
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2680
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2968
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709838
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+
+CVE: CVE-2025-47912
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/d6d2f7bf76718f1db05461cd912ae5e30d7b77ea]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/go/build/deps_test.go | 9 ++++++---
+ src/net/url/url.go | 42 +++++++++++++++++++++++++++++----------
+ src/net/url/url_test.go | 39 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 77 insertions(+), 13 deletions(-)
+
+diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
+index 7ce8d34..9f2663f 100644
+--- a/src/go/build/deps_test.go
++++ b/src/go/build/deps_test.go
+@@ -209,7 +209,6 @@ var depsRules = `
+ internal/types/errors,
+ mime/quotedprintable,
+ net/internal/socktest,
+- net/url,
+ runtime/trace,
+ text/scanner,
+ text/tabwriter;
+@@ -252,6 +251,12 @@ var depsRules = `
+ FMT
+ < text/template/parse;
+
++ internal/bytealg, internal/itoa, math/bits, slices, strconv, unique
++ < net/netip;
++
++ FMT, net/netip
++ < net/url;
++
+ net/url, text/template/parse
+ < text/template
+ < internal/lazytemplate;
+@@ -367,8 +372,6 @@ var depsRules = `
+ internal/godebug
+ < internal/intern;
+
+- internal/bytealg, internal/intern, internal/itoa, math/bits, sort, strconv
+- < net/netip;
+
+ # net is unavoidable when doing any networking,
+ # so large dependencies must be kept out.
+diff --git a/src/net/url/url.go b/src/net/url/url.go
+index f362958..d2ae032 100644
+--- a/src/net/url/url.go
++++ b/src/net/url/url.go
+@@ -13,6 +13,7 @@ package url
+ import (
+ "errors"
+ "fmt"
++ "net/netip"
+ "path"
+ "sort"
+ "strconv"
+@@ -621,40 +622,61 @@ func parseAuthority(authority string) (user *Userinfo, host string, err error) {
+ // parseHost parses host as an authority without user
+ // information. That is, as host[:port].
+ func parseHost(host string) (string, error) {
+- if strings.HasPrefix(host, "[") {
++ if openBracketIdx := strings.LastIndex(host, "["); openBracketIdx != -1 {
+ // Parse an IP-Literal in RFC 3986 and RFC 6874.
+ // E.g., "[fe80::1]", "[fe80::1%25en0]", "[fe80::1]:80".
+- i := strings.LastIndex(host, "]")
+- if i < 0 {
++ closeBracketIdx := strings.LastIndex(host, "]")
++ if closeBracketIdx < 0 {
+ return "", errors.New("missing ']' in host")
+ }
+- colonPort := host[i+1:]
++
++ colonPort := host[closeBracketIdx+1:]
+ if !validOptionalPort(colonPort) {
+ return "", fmt.Errorf("invalid port %q after host", colonPort)
+ }
++ unescapedColonPort, err := unescape(colonPort, encodeHost)
++ if err != nil {
++ return "", err
++ }
+
++ hostname := host[openBracketIdx+1 : closeBracketIdx]
++ var unescapedHostname string
+ // RFC 6874 defines that %25 (%-encoded percent) introduces
+ // the zone identifier, and the zone identifier can use basically
+ // any %-encoding it likes. That's different from the host, which
+ // can only %-encode non-ASCII bytes.
+ // We do impose some restrictions on the zone, to avoid stupidity
+ // like newlines.
+- zone := strings.Index(host[:i], "%25")
+- if zone >= 0 {
+- host1, err := unescape(host[:zone], encodeHost)
++ zoneIdx := strings.Index(hostname, "%25")
++ if zoneIdx >= 0 {
++ hostPart, err := unescape(hostname[:zoneIdx], encodeHost)
+ if err != nil {
+ return "", err
+ }
+- host2, err := unescape(host[zone:i], encodeZone)
++ zonePart, err := unescape(hostname[zoneIdx:], encodeZone)
+ if err != nil {
+ return "", err
+ }
+- host3, err := unescape(host[i:], encodeHost)
++ unescapedHostname = hostPart + zonePart
++ } else {
++ var err error
++ unescapedHostname, err = unescape(hostname, encodeHost)
+ if err != nil {
+ return "", err
+ }
+- return host1 + host2 + host3, nil
+ }
++
++ // Per RFC 3986, only a host identified by a valid
++ // IPv6 address can be enclosed by square brackets.
++ // This excludes any IPv4 or IPv4-mapped addresses.
++ addr, err := netip.ParseAddr(unescapedHostname)
++ if err != nil {
++ return "", fmt.Errorf("invalid host: %w", err)
++ }
++ if addr.Is4() || addr.Is4In6() {
++ return "", errors.New("invalid IPv6 host")
++ }
++ return "[" + unescapedHostname + "]" + unescapedColonPort, nil
+ } else if i := strings.LastIndex(host, ":"); i != -1 {
+ colonPort := host[i:]
+ if !validOptionalPort(colonPort) {
+diff --git a/src/net/url/url_test.go b/src/net/url/url_test.go
+index 4aa20bb..fef236e 100644
+--- a/src/net/url/url_test.go
++++ b/src/net/url/url_test.go
+@@ -383,6 +383,16 @@ var urltests = []URLTest{
+ },
+ "",
+ },
++ // valid IPv6 host with port and path
++ {
++ "https://[2001:db8::1]:8443/test/path",
++ &URL{
++ Scheme: "https",
++ Host: "[2001:db8::1]:8443",
++ Path: "/test/path",
++ },
++ "",
++ },
+ // host subcomponent; IPv6 address with zone identifier in RFC 6874
+ {
+ "http://[fe80::1%25en0]/", // alphanum zone identifier
+@@ -707,6 +717,24 @@ var parseRequestURLTests = []struct {
+ // RFC 6874.
+ {"http://[fe80::1%en0]/", false},
+ {"http://[fe80::1%en0]:8080/", false},
++
++ // Tests exercising RFC 3986 compliance
++ {"https://[1:2:3:4:5:6:7:8]", true}, // full IPv6 address
++ {"https://[2001:db8::a:b:c:d]", true}, // compressed IPv6 address
++ {"https://[fe80::1%25eth0]", true}, // link-local address with zone ID (interface name)
++ {"https://[fe80::abc:def%254]", true}, // link-local address with zone ID (interface index)
++ {"https://[2001:db8::1]/path", true}, // compressed IPv6 address with path
++ {"https://[fe80::1%25eth0]/path?query=1", true}, // link-local with zone, path, and query
++
++ {"https://[::ffff:192.0.2.1]", false},
++ {"https://[:1] ", false},
++ {"https://[1:2:3:4:5:6:7:8:9]", false},
++ {"https://[1::1::1]", false},
++ {"https://[1:2:3:]", false},
++ {"https://[ffff::127.0.0.4000]", false},
++ {"https://[0:0::test.com]:80", false},
++ {"https://[2001:db8::test.com]", false},
++ {"https://[test.com]", false},
+ }
+
+ func TestParseRequestURI(t *testing.T) {
+@@ -1635,6 +1663,17 @@ func TestParseErrors(t *testing.T) {
+ {"cache_object:foo", true},
+ {"cache_object:foo/bar", true},
+ {"cache_object/:foo/bar", false},
++
++ {"http://[192.168.0.1]/", true}, // IPv4 in brackets
++ {"http://[192.168.0.1]:8080/", true}, // IPv4 in brackets with port
++ {"http://[::ffff:192.168.0.1]/", true}, // IPv4-mapped IPv6 in brackets
++ {"http://[::ffff:192.168.0.1]:8080/", true}, // IPv4-mapped IPv6 in brackets with port
++ {"http://[::ffff:c0a8:1]/", true}, // IPv4-mapped IPv6 in brackets (hex)
++ {"http://[not-an-ip]/", true}, // invalid IP string in brackets
++ {"http://[fe80::1%foo]/", true}, // invalid zone format in brackets
++ {"http://[fe80::1", true}, // missing closing bracket
++ {"http://fe80::1]/", true}, // missing opening bracket
++ {"http://[test.com]/", true}, // domain name in brackets
+ }
+ for _, tt := range tests {
+ u, err := Parse(tt.in)
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 07/19] go: fix CVE-2025-61723
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 06/19] go: fix CVE-2025-47912 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 08/19] go: fix CVE-2025-61724 Steve Sakoman
` (11 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
The processing time for parsing some invalid inputs scales non-linearly with
respect to the size of the input. This affects programs which parse untrusted PEM inputs.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-61723.patch | 223 ++++++++++++++++++
2 files changed, 224 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-61723.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index 2be5c8b519..9996cfb870 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -26,6 +26,7 @@ SRC_URI += "\
file://CVE-2025-58188.patch \
file://CVE-2025-58189.patch \
file://CVE-2025-47912.patch \
+ file://CVE-2025-61723.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-61723.patch b/meta/recipes-devtools/go/go/CVE-2025-61723.patch
new file mode 100644
index 0000000000..b1664e701d
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-61723.patch
@@ -0,0 +1,223 @@
+From 74d4d836b91318a8764b94bc2b4b66ff599eb5f2 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Tue, 30 Sep 2025 11:16:56 -0700
+Subject: [PATCH] encoding/pem: make Decode complexity linear
+
+Because Decode scanned the input first for the first BEGIN line, and
+then the first END line, the complexity of Decode is quadratic. If the
+input contained a large number of BEGINs and then a single END right at
+the end of the input, we would find the first BEGIN, and then scan the
+entire input for the END, and fail to parse the block, so move onto the
+next BEGIN, scan the entire input for the END, etc.
+
+Instead, look for the first END in the input, and then the first BEGIN
+that precedes the found END. We then process the bytes between the BEGIN
+and END, and move onto the bytes after the END for further processing.
+This gives us linear complexity.
+
+Fixes CVE-2025-61723
+For #75676
+Fixes #75708
+
+Change-Id: I813c4f63e78bca4054226c53e13865c781564ccf
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2921
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2986
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709842
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+
+CVE: CVE-2025-61723
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/74d4d836b91318a8764b94bc2b4b66ff599eb5f2]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/encoding/pem/pem.go | 67 ++++++++++++++++++++----------------
+ src/encoding/pem/pem_test.go | 13 +++----
+ 2 files changed, 44 insertions(+), 36 deletions(-)
+
+diff --git a/src/encoding/pem/pem.go b/src/encoding/pem/pem.go
+index 4b4f749..d365012 100644
+--- a/src/encoding/pem/pem.go
++++ b/src/encoding/pem/pem.go
+@@ -37,7 +37,7 @@ type Block struct {
+ // line bytes. The remainder of the byte array (also not including the new line
+ // bytes) is also returned and this will always be smaller than the original
+ // argument.
+-func getLine(data []byte) (line, rest []byte) {
++func getLine(data []byte) (line, rest []byte, consumed int) {
+ i := bytes.IndexByte(data, '\n')
+ var j int
+ if i < 0 {
+@@ -49,7 +49,7 @@ func getLine(data []byte) (line, rest []byte) {
+ i--
+ }
+ }
+- return bytes.TrimRight(data[0:i], " \t"), data[j:]
++ return bytes.TrimRight(data[0:i], " \t"), data[j:], j
+ }
+
+ // removeSpacesAndTabs returns a copy of its input with all spaces and tabs
+@@ -90,20 +90,32 @@ func Decode(data []byte) (p *Block, rest []byte) {
+ // pemStart begins with a newline. However, at the very beginning of
+ // the byte array, we'll accept the start string without it.
+ rest = data
++
+ for {
+- if bytes.HasPrefix(rest, pemStart[1:]) {
+- rest = rest[len(pemStart)-1:]
+- } else if _, after, ok := bytes.Cut(rest, pemStart); ok {
+- rest = after
+- } else {
++ // Find the first END line, and then find the last BEGIN line before
++ // the end line. This lets us skip any repeated BEGIN lines that don't
++ // have a matching END.
++ endIndex := bytes.Index(rest, pemEnd)
++ if endIndex < 0 {
++ return nil, data
++ }
++ endTrailerIndex := endIndex + len(pemEnd)
++ beginIndex := bytes.LastIndex(rest[:endIndex], pemStart[1:])
++ if beginIndex < 0 || beginIndex > 0 && rest[beginIndex-1] != '\n' {
+ return nil, data
+ }
++ rest = rest[beginIndex+len(pemStart)-1:]
++ endIndex -= beginIndex + len(pemStart) - 1
++ endTrailerIndex -= beginIndex + len(pemStart) - 1
+
+ var typeLine []byte
+- typeLine, rest = getLine(rest)
++ var consumed int
++ typeLine, rest, consumed = getLine(rest)
+ if !bytes.HasSuffix(typeLine, pemEndOfLine) {
+ continue
+ }
++ endIndex -= consumed
++ endTrailerIndex -= consumed
+ typeLine = typeLine[0 : len(typeLine)-len(pemEndOfLine)]
+
+ p = &Block{
+@@ -117,7 +129,7 @@ func Decode(data []byte) (p *Block, rest []byte) {
+ if len(rest) == 0 {
+ return nil, data
+ }
+- line, next := getLine(rest)
++ line, next, consumed := getLine(rest)
+
+ key, val, ok := bytes.Cut(line, colon)
+ if !ok {
+@@ -129,21 +141,13 @@ func Decode(data []byte) (p *Block, rest []byte) {
+ val = bytes.TrimSpace(val)
+ p.Headers[string(key)] = string(val)
+ rest = next
++ endIndex -= consumed
++ endTrailerIndex -= consumed
+ }
+
+- var endIndex, endTrailerIndex int
+-
+- // If there were no headers, the END line might occur
+- // immediately, without a leading newline.
+- if len(p.Headers) == 0 && bytes.HasPrefix(rest, pemEnd[1:]) {
+- endIndex = 0
+- endTrailerIndex = len(pemEnd) - 1
+- } else {
+- endIndex = bytes.Index(rest, pemEnd)
+- endTrailerIndex = endIndex + len(pemEnd)
+- }
+-
+- if endIndex < 0 {
++ // If there were headers, there must be a newline between the headers
++ // and the END line, so endIndex should be >= 0.
++ if len(p.Headers) > 0 && endIndex < 0 {
+ continue
+ }
+
+@@ -163,21 +167,24 @@ func Decode(data []byte) (p *Block, rest []byte) {
+ }
+
+ // The line must end with only whitespace.
+- if s, _ := getLine(restOfEndLine); len(s) != 0 {
++ if s, _, _ := getLine(restOfEndLine); len(s) != 0 {
+ continue
+ }
+
+- base64Data := removeSpacesAndTabs(rest[:endIndex])
+- p.Bytes = make([]byte, base64.StdEncoding.DecodedLen(len(base64Data)))
+- n, err := base64.StdEncoding.Decode(p.Bytes, base64Data)
+- if err != nil {
+- continue
++ p.Bytes = []byte{}
++ if endIndex > 0 {
++ base64Data := removeSpacesAndTabs(rest[:endIndex])
++ p.Bytes = make([]byte, base64.StdEncoding.DecodedLen(len(base64Data)))
++ n, err := base64.StdEncoding.Decode(p.Bytes, base64Data)
++ if err != nil {
++ continue
++ }
++ p.Bytes = p.Bytes[:n]
+ }
+- p.Bytes = p.Bytes[:n]
+
+ // the -1 is because we might have only matched pemEnd without the
+ // leading newline if the PEM block was empty.
+- _, rest = getLine(rest[endIndex+len(pemEnd)-1:])
++ _, rest, _ = getLine(rest[endIndex+len(pemEnd)-1:])
+ return p, rest
+ }
+ }
+diff --git a/src/encoding/pem/pem_test.go b/src/encoding/pem/pem_test.go
+index 56a7754..7025277 100644
+--- a/src/encoding/pem/pem_test.go
++++ b/src/encoding/pem/pem_test.go
+@@ -34,7 +34,7 @@ var getLineTests = []GetLineTest{
+
+ func TestGetLine(t *testing.T) {
+ for i, test := range getLineTests {
+- x, y := getLine([]byte(test.in))
++ x, y, _ := getLine([]byte(test.in))
+ if string(x) != test.out1 || string(y) != test.out2 {
+ t.Errorf("#%d got:%+v,%+v want:%s,%s", i, x, y, test.out1, test.out2)
+ }
+@@ -46,6 +46,7 @@ func TestDecode(t *testing.T) {
+ if !reflect.DeepEqual(result, certificate) {
+ t.Errorf("#0 got:%#v want:%#v", result, certificate)
+ }
++
+ result, remainder = Decode(remainder)
+ if !reflect.DeepEqual(result, privateKey) {
+ t.Errorf("#1 got:%#v want:%#v", result, privateKey)
+@@ -68,7 +69,7 @@ func TestDecode(t *testing.T) {
+ }
+
+ result, remainder = Decode(remainder)
+- if result == nil || result.Type != "HEADERS" || len(result.Headers) != 1 {
++ if result == nil || result.Type != "VALID HEADERS" || len(result.Headers) != 1 {
+ t.Errorf("#5 expected single header block but got :%v", result)
+ }
+
+@@ -381,15 +382,15 @@ ZWAaUoVtWIQ52aKS0p19G99hhb+IVANC4akkdHV4SP8i7MVNZhfUmg==
+
+ # This shouldn't be recognised because of the missing newline after the
+ headers.
+------BEGIN HEADERS-----
++-----BEGIN INVALID HEADERS-----
+ Header: 1
+------END HEADERS-----
++-----END INVALID HEADERS-----
+
+ # This should be valid, however.
+------BEGIN HEADERS-----
++-----BEGIN VALID HEADERS-----
+ Header: 1
+
+------END HEADERS-----`)
++-----END VALID HEADERS-----`)
+
+ var certificate = &Block{Type: "CERTIFICATE",
+ Headers: map[string]string{},
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 08/19] go: fix CVE-2025-61724
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 07/19] go: fix CVE-2025-61723 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 09/19] webkitgtk: upgrade 2.44.3 -> 2.44.4 Steve Sakoman
` (10 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
The Reader.ReadResponse function constructs a response string through
repeated string concatenation of lines. When the number of lines in a
response is large, this can cause excessive CPU consumption.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2025-61724.patch | 75 +++++++++++++++++++
2 files changed, 76 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-61724.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index 9996cfb870..825b8f4d68 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -27,6 +27,7 @@ SRC_URI += "\
file://CVE-2025-58189.patch \
file://CVE-2025-47912.patch \
file://CVE-2025-61723.patch \
+ file://CVE-2025-61724.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2025-61724.patch b/meta/recipes-devtools/go/go/CVE-2025-61724.patch
new file mode 100644
index 0000000000..a91c24508e
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2025-61724.patch
@@ -0,0 +1,75 @@
+From a402f4ad285514f5f3db90516d72047d591b307a Mon Sep 17 00:00:00 2001
+From: Damien Neil <dneil@google.com>
+Date: Tue, 30 Sep 2025 15:11:16 -0700
+Subject: [PATCH] net/textproto: avoid quadratic complexity in
+ Reader.ReadResponse
+
+Reader.ReadResponse constructed a response string from repeated
+string concatenation, permitting a malicious sender to cause excessive
+memory allocation and CPU consumption by sending a response consisting
+of many short lines.
+
+Use a strings.Builder to construct the string instead.
+
+Thanks to Jakub Ciolek for reporting this issue.
+
+Fixes CVE-2025-61724
+For #75716
+Fixes #75717
+
+Change-Id: I1a98ce85a21b830cb25799f9ac9333a67400d736
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2940
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2980
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/709837
+Reviewed-by: Carlos Amedee <carlos@golang.org>
+TryBot-Bypass: Michael Pratt <mpratt@google.com>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+
+CVE: CVE-2025-61724
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/a402f4ad285514f5f3db90516d72047d591b307a]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ src/net/textproto/reader.go | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go
+index 7930211..0027efe 100644
+--- a/src/net/textproto/reader.go
++++ b/src/net/textproto/reader.go
+@@ -283,8 +283,10 @@ func (r *Reader) ReadCodeLine(expectCode int) (code int, message string, err err
+ //
+ // An expectCode <= 0 disables the check of the status code.
+ func (r *Reader) ReadResponse(expectCode int) (code int, message string, err error) {
+- code, continued, message, err := r.readCodeLine(expectCode)
++ code, continued, first, err := r.readCodeLine(expectCode)
+ multi := continued
++ var messageBuilder strings.Builder
++ messageBuilder.WriteString(first)
+ for continued {
+ line, err := r.ReadLine()
+ if err != nil {
+@@ -295,12 +297,15 @@ func (r *Reader) ReadResponse(expectCode int) (code int, message string, err err
+ var moreMessage string
+ code2, continued, moreMessage, err = parseCodeLine(line, 0)
+ if err != nil || code2 != code {
+- message += "\n" + strings.TrimRight(line, "\r\n")
++ messageBuilder.WriteByte('\n')
++ messageBuilder.WriteString(strings.TrimRight(line, "\r\n"))
+ continued = true
+ continue
+ }
+- message += "\n" + moreMessage
++ messageBuilder.WriteByte('\n')
++ messageBuilder.WriteString(moreMessage)
+ }
++ message = messageBuilder.String()
+ if err != nil && multi && message != "" {
+ // replace one line error message with all lines (full message)
+ err = &Error{code, message}
+--
+2.40.0
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 09/19] webkitgtk: upgrade 2.44.3 -> 2.44.4
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 08/19] go: fix CVE-2025-61724 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 10/19] wireless-regdb: upgrade 2024.10.07 -> 2025.10.07 Steve Sakoman
` (9 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Bug fixes only:
https://www.webkitgtk.org/release/webkitgtk-2.44.4.html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../webkit/{webkitgtk_2.44.3.bb => webkitgtk_2.44.4.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-sato/webkit/{webkitgtk_2.44.3.bb => webkitgtk_2.44.4.bb} (98%)
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.44.3.bb b/meta/recipes-sato/webkit/webkitgtk_2.44.4.bb
similarity index 98%
rename from meta/recipes-sato/webkit/webkitgtk_2.44.3.bb
rename to meta/recipes-sato/webkit/webkitgtk_2.44.4.bb
index a8f825e164..ac9ff41c91 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.44.3.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.44.4.bb
@@ -17,7 +17,7 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BPN}-${PV}.tar.xz \
file://t6-not-declared.patch \
file://30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch \
"
-SRC_URI[sha256sum] = "dc82d042ecaca981a4852357c06e5235743319cf10a94cd36ad41b97883a0b54"
+SRC_URI[sha256sum] = "2ce4ec1b78413035037aba8326b31ed72696626b7bea7bace5e46ac0d8cbe796"
inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 10/19] wireless-regdb: upgrade 2024.10.07 -> 2025.10.07
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 09/19] webkitgtk: upgrade 2.44.3 -> 2.44.4 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 11/19] ca-certificates: update 20211016 -> 20240203 Steve Sakoman
` (8 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...ireless-regdb_2024.10.07.bb => wireless-regdb_2025.10.07.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2024.10.07.bb => wireless-regdb_2025.10.07.bb} (94%)
diff --git a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2024.10.07.bb b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb
similarity index 94%
rename from meta/recipes-kernel/wireless-regdb/wireless-regdb_2024.10.07.bb
rename to meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb
index 0e4100fba7..68ae3b0464 100644
--- a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2024.10.07.bb
+++ b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb
@@ -5,7 +5,7 @@ LICENSE = "ISC"
LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "f76f2bd79a653e9f9dd50548d99d03a4a4eb157da056dfd5892f403ec28fb3d5"
+SRC_URI[sha256sum] = "d4c872a44154604c869f5851f7d21d818d492835d370af7f58de8847973801c3"
inherit bin_package allarch
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 11/19] ca-certificates: update 20211016 -> 20240203
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 10/19] wireless-regdb: upgrade 2024.10.07 -> 2025.10.07 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 12/19] ca-certificates: Add comment for provenance of SRCREV Steve Sakoman
` (7 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: "Theodore A. Roth" <troth@openavr.org>
The 20240203 version is the same as used in Ubuntu >= 24.04 and Debian
Trixie (testing).
Signed-off-by: Theodore A. Roth <troth@openavr.org>
Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ce19168885a04b0d77e81c1fd1c4262b195a47d4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...mozilla-certdata2pem.py-print-a-warning-for-e.patch | 10 +++++-----
...ca-certificates-don-t-use-Debianisms-in-run-p.patch | 6 +++---
...ficates_20211016.bb => ca-certificates_20240203.bb} | 2 +-
3 files changed, 9 insertions(+), 9 deletions(-)
rename meta/recipes-support/ca-certificates/{ca-certificates_20211016.bb => ca-certificates_20240203.bb} (98%)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
index 5c4a32f526..78898f5150 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
@@ -19,7 +19,7 @@ diff --git a/debian/changelog b/debian/changelog
index 531e4d0..4006509 100644
--- a/debian/changelog
+++ b/debian/changelog
-@@ -37,7 +37,6 @@ ca-certificates (20211004) unstable; urgency=low
+@@ -120,7 +120,6 @@ ca-certificates (20211004) unstable; urgency=low
- "Trustis FPS Root CA"
- "Staat der Nederlanden Root CA - G3"
* Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
@@ -37,9 +37,9 @@ index 4434b7a..5c6ba24 100644
Build-Depends: debhelper-compat (= 13), po-debconf
-Build-Depends-Indep: python3, openssl, python3-cryptography
+Build-Depends-Indep: python3, openssl
- Standards-Version: 4.5.0.2
+ Standards-Version: 4.6.2
+ Rules-Requires-Root: no
Vcs-Git: https://salsa.debian.org/debian/ca-certificates.git
- Vcs-Browser: https://salsa.debian.org/debian/ca-certificates
diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
index ede23d4..7d796f1 100644
--- a/mozilla/certdata2pem.py
@@ -66,8 +66,8 @@ index ede23d4..7d796f1 100644
if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
continue
-
-- cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
-- if cert.not_valid_after < datetime.datetime.now():
+- cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
+- if cert.not_valid_after < datetime.datetime.utcnow():
- print('!'*74)
- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
- print('!'*74)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
index 4a8ae5f4b5..1feefeb96a 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
@@ -21,14 +21,14 @@ Index: git/sbin/update-ca-certificates
===================================================================
--- git.orig/sbin/update-ca-certificates
+++ git/sbin/update-ca-certificates
-@@ -191,9 +191,7 @@ if [ -d "$HOOKSDIR" ]
+@@ -202,9 +202,7 @@ if [ -d "$HOOKSDIR" ]
then
echo "Running hooks in $HOOKSDIR..."
- VERBOSE_ARG=
- [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose"
-- eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read hook
-+ eval run-parts --test "$HOOKSDIR" | while read hook
+- eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read -r hook
++ eval run-parts --test "$HOOKSDIR" | while read -r hook
do
( cat "$ADDED"
cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?."
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20211016.bb b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
similarity index 98%
rename from meta/recipes-support/ca-certificates/ca-certificates_20211016.bb
rename to meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
index 99abe60613..b198ea77a9 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20211016.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
@@ -14,7 +14,7 @@ DEPENDS:class-nativesdk = "openssl-native"
# Need rehash from openssl and run-parts from debianutils
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
-SRCREV = "07de54fdcc5806bde549e1edf60738c6bccf50e8"
+SRCREV = "ee6e0484031314090a11c04ee82689acb73d7ad8"
SRC_URI = "git://salsa.debian.org/debian/ca-certificates.git;protocol=https;branch=master \
file://0002-update-ca-certificates-use-SYSROOT.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 12/19] ca-certificates: Add comment for provenance of SRCREV
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (10 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 11/19] ca-certificates: update 20211016 -> 20240203 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 13/19] ca-certificates: get sources from debian tarballs Steve Sakoman
` (6 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: "Theodore A. Roth" <troth@openavr.org>
Provide references for how the SRCREV was arrived at for the 20240203
release.
Signed-off-by: Theodore A. Roth <troth@openavr.org>
Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6916cdb0f05f6644edb1e432a9421595abb9f0ca)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ca-certificates/ca-certificates_20240203.bb | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
index b198ea77a9..ac0756471c 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
@@ -14,6 +14,13 @@ DEPENDS:class-nativesdk = "openssl-native"
# Need rehash from openssl and run-parts from debianutils
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
+# Since there is no TAG in the git repository, the SRCREV was determined
+# through comparison of the git repository and the data on the following
+# package informatin pages:
+#
+# * https://packages.debian.org/trixie/ca-certificates
+# * https://packages.ubuntu.com/noble/ca-certificates
+#
SRCREV = "ee6e0484031314090a11c04ee82689acb73d7ad8"
SRC_URI = "git://salsa.debian.org/debian/ca-certificates.git;protocol=https;branch=master \
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 13/19] ca-certificates: get sources from debian tarballs
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (11 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 12/19] ca-certificates: Add comment for provenance of SRCREV Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 14/19] ca-certificates: upgrade 20240203 -> 20241223 Steve Sakoman
` (5 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
git repo no longer has tags for recent versions which means
we had missed several of them, and wouldn't be able to get
notifications about any future releases.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 81f013fd1312551628701bf36ac62746a2606dbd)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ca-certificates/ca-certificates_20240203.bb | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
index ac0756471c..eff1d97bc5 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
@@ -14,26 +14,15 @@ DEPENDS:class-nativesdk = "openssl-native"
# Need rehash from openssl and run-parts from debianutils
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
-# Since there is no TAG in the git repository, the SRCREV was determined
-# through comparison of the git repository and the data on the following
-# package informatin pages:
-#
-# * https://packages.debian.org/trixie/ca-certificates
-# * https://packages.ubuntu.com/noble/ca-certificates
-#
-SRCREV = "ee6e0484031314090a11c04ee82689acb73d7ad8"
-
-SRC_URI = "git://salsa.debian.org/debian/ca-certificates.git;protocol=https;branch=master \
+SRC_URI[sha256sum] = "3286d3fc42c4d11b7086711a85f865b44065ce05cf1fb5376b2abed07622a9c6"
+SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
file://0002-update-ca-certificates-use-SYSROOT.patch \
file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
file://default-sysroot.patch \
file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \
file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \
"
-UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+)"
-
-S = "${WORKDIR}/git"
-
+S = "${WORKDIR}/ca-certificates"
inherit allarch
EXTRA_OEMAKE = "\
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 14/19] ca-certificates: upgrade 20240203 -> 20241223
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (12 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 13/19] ca-certificates: get sources from debian tarballs Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 15/19] ca-certificates: submit sysroot patch upstream, drop default-sysroot.patch Steve Sakoman
` (4 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48a236c2f78fee5e6db19c6be23b4a18df025607)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...certdata2pem.py-print-a-warning-for-e.patch | 13 +++++--------
...ficates-don-t-use-Debianisms-in-run-p.patch | 14 +++++++++-----
...02-update-ca-certificates-use-SYSROOT.patch | 18 +++++++++---------
...ficates-use-relative-symlinks-from-ET.patch | 4 ++--
.../ca-certificates/default-sysroot.patch | 16 ++++++++++++----
...20240203.bb => ca-certificates_20241223.bb} | 2 +-
6 files changed, 38 insertions(+), 29 deletions(-)
rename meta/recipes-support/ca-certificates/{ca-certificates_20240203.bb => ca-certificates_20241223.bb} (97%)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
index 78898f5150..da2a247e51 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
@@ -1,4 +1,4 @@
-From cb43ec15b700b25f3c4fe44043a1a021aaf5b768 Mon Sep 17 00:00:00 2001
+From 630736f427c0a1bd0be0b5a2f6d51d63b2c4c9fd Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex@linutronix.de>
Date: Mon, 18 Oct 2021 12:05:49 +0200
Subject: [PATCH] Revert "mozilla/certdata2pem.py: print a warning for expired
@@ -16,10 +16,10 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
3 files changed, 1 insertion(+), 13 deletions(-)
diff --git a/debian/changelog b/debian/changelog
-index 531e4d0..4006509 100644
+index 52d41ca..bdb2c8a 100644
--- a/debian/changelog
+++ b/debian/changelog
-@@ -120,7 +120,6 @@ ca-certificates (20211004) unstable; urgency=low
+@@ -138,7 +138,6 @@ ca-certificates (20211004) unstable; urgency=low
- "Trustis FPS Root CA"
- "Staat der Nederlanden Root CA - G3"
* Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
@@ -28,7 +28,7 @@ index 531e4d0..4006509 100644
-- Julien Cristau <jcristau@debian.org> Thu, 07 Oct 2021 17:12:47 +0200
diff --git a/debian/control b/debian/control
-index 4434b7a..5c6ba24 100644
+index b5f2ab0..d0e830e 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: misc
@@ -41,7 +41,7 @@ index 4434b7a..5c6ba24 100644
Rules-Requires-Root: no
Vcs-Git: https://salsa.debian.org/debian/ca-certificates.git
diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
-index ede23d4..7d796f1 100644
+index 4df86a2..7d796f1 100644
--- a/mozilla/certdata2pem.py
+++ b/mozilla/certdata2pem.py
@@ -21,16 +21,12 @@
@@ -75,6 +75,3 @@ index ede23d4..7d796f1 100644
bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
.replace(' ', '_')\
.replace('(', '=')\
---
-2.20.1
-
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
index 1feefeb96a..cad30929f5 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
@@ -1,3 +1,8 @@
+From 348163df412e53b1b7ec3e81ae5f22caa0227c37 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@intel.com>
+Date: Mon, 6 Jul 2015 15:19:41 +0100
+Subject: [PATCH] ca-certificates: remove Debianism in run-parts invocation
+
ca-certificates is a package from Debian, but some host distros such as Fedora
have a leaner run-parts provided by cron which doesn't support --verbose or the
-- separator between arguments and paths.
@@ -9,7 +14,6 @@ This solves errors such as
| [...]/usr/sbin/update-ca-certificates: line 230: Not a directory: --: command not found
| E: Not a directory: -- exited with code 127.
-
Upstream-Status: Inappropriate
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Maciej Borzecki <maciej.borzecki@rndity.com>
@@ -17,10 +21,10 @@ Signed-off-by: Maciej Borzecki <maciej.borzecki@rndity.com>
sbin/update-ca-certificates | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
-Index: git/sbin/update-ca-certificates
-===================================================================
---- git.orig/sbin/update-ca-certificates
-+++ git/sbin/update-ca-certificates
+diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
+index 36cdd9a..2d3e1fe 100755
+--- a/sbin/update-ca-certificates
++++ b/sbin/update-ca-certificates
@@ -202,9 +202,7 @@ if [ -d "$HOOKSDIR" ]
then
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch b/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
index 792b4030b2..48c69f0cbc 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
@@ -1,19 +1,19 @@
-Upstream-Status: Pending
-
-From 724cb153ca0f607fb38b3a8db3ebb2742601cd81 Mon Sep 17 00:00:00 2001
+From cdb53438bae194c1281c31374a901ad7ee460408 Mon Sep 17 00:00:00 2001
From: Andreas Oberritter <obi@opendreambox.org>
Date: Tue, 19 Mar 2013 17:14:33 +0100
-Subject: [PATCH 2/2] update-ca-certificates: use $SYSROOT
+Subject: [PATCH] update-ca-certificates: use $SYSROOT
+
+Upstream-Status: Pending
Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
---
- sbin/update-ca-certificates | 14 +++++++-------
+ sbin/update-ca-certificates | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
-Index: git/sbin/update-ca-certificates
-===================================================================
---- git.orig/sbin/update-ca-certificates
-+++ git/sbin/update-ca-certificates
+diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
+index 5a0a1da..36cdd9a 100755
+--- a/sbin/update-ca-certificates
++++ b/sbin/update-ca-certificates
@@ -24,12 +24,12 @@
verbose=0
fresh=0
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch b/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
index 4bd967f788..214f88909a 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
@@ -1,4 +1,4 @@
-From a9fc13b2aee55655d58fcb77a3180fa99f96438a Mon Sep 17 00:00:00 2001
+From 38d47c53749c6f16d5d7993410b256116e0ee0b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@jci.com>
Date: Wed, 28 Mar 2018 16:45:05 +0100
Subject: [PATCH] update-ca-certificates: use relative symlinks from
@@ -45,7 +45,7 @@ Signed-off-by: André Draszik <andre.draszik@jci.com>
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index 00f80c7..7e911a9 100755
+index f7d0dbf..97a589c 100755
--- a/sbin/update-ca-certificates
+++ b/sbin/update-ca-certificates
@@ -29,6 +29,7 @@ CERTSDIR=$SYSROOT/usr/share/ca-certificates
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch b/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
index f8b0791bea..c2a54c0096 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
@@ -1,13 +1,21 @@
+From 50aadd3eb1c4be43d3decdeb60cede2de5a687be Mon Sep 17 00:00:00 2001
+From: Christopher Larson <chris_larson@mentor.com>
+Date: Fri, 23 Aug 2013 12:26:14 -0700
+Subject: [PATCH] ca-certificates: add recipe (version 20130610)
+
Upstream-Status: Pending
update-ca-certificates: find SYSROOT relative to its own location
This makes the script relocatable.
+---
+ sbin/update-ca-certificates | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
-Index: git/sbin/update-ca-certificates
-===================================================================
---- git.orig/sbin/update-ca-certificates
-+++ git/sbin/update-ca-certificates
+diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
+index 2d3e1fe..f7d0dbf 100755
+--- a/sbin/update-ca-certificates
++++ b/sbin/update-ca-certificates
@@ -66,6 +66,39 @@ do
shift
done
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
similarity index 97%
rename from meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
rename to meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
index eff1d97bc5..bbdc7dd68d 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20240203.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
@@ -14,7 +14,7 @@ DEPENDS:class-nativesdk = "openssl-native"
# Need rehash from openssl and run-parts from debianutils
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
-SRC_URI[sha256sum] = "3286d3fc42c4d11b7086711a85f865b44065ce05cf1fb5376b2abed07622a9c6"
+SRC_URI[sha256sum] = "dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03"
SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
file://0002-update-ca-certificates-use-SYSROOT.patch \
file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 15/19] ca-certificates: submit sysroot patch upstream, drop default-sysroot.patch
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (13 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 14/19] ca-certificates: upgrade 20240203 -> 20241223 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 16/19] ca-certificates: upgrade 20241223 -> 20250419 Steve Sakoman
` (3 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
was using a non-standard environment variable, and was replaced
with a patch that adds a command line option (and then this
was submitted upstream). ca-certificates recipe was tweaked accordingly,
and nothing else in core or meta-oe is using update-ca-certificates.
Drop default-sysroot.patch as the use case is unclear: sysroot
is explicitly specified in all known invocations of update-ca-certificate,
and if there's a place where it isn't, then update-ca-certificates
will error out trying to write to /etc, and should be fixed to
explicitly specify the sysroot.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 90d9f0ba674d4fe8e9291f0513c13dff3775c545)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...ca-certificates-add-a-sysroot-option.patch | 36 ++++++++++++
...2-update-ca-certificates-use-SYSROOT.patch | 46 ---------------
...icates-use-relative-symlinks-from-ET.patch | 18 +++---
.../ca-certificates/default-sysroot.patch | 58 -------------------
.../ca-certificates_20241223.bb | 9 ++-
5 files changed, 49 insertions(+), 118 deletions(-)
create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
delete mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
delete mode 100644 meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch b/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
new file mode 100644
index 0000000000..ba5bb69657
--- /dev/null
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
@@ -0,0 +1,36 @@
+From d6bb773745c2e95fd1a414e916fbed64e0d8df66 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex@linutronix.de>
+Date: Mon, 31 Mar 2025 17:42:25 +0200
+Subject: [PATCH] sbin/update-ca-certificates: add a --sysroot option
+
+This allows using the script in cross-compilation environments
+where the script needs to prefix the sysroot to every other
+directory it operates on. There are individual options
+to set those directories, but using a common prefix option
+instead is a lot less clutter and more robust.
+
+Upstream-Status: Submitted [https://salsa.debian.org/debian/ca-certificates/-/merge_requests/13]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ sbin/update-ca-certificates | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
+index 4bb77a0..1e737b9 100755
+--- a/sbin/update-ca-certificates
++++ b/sbin/update-ca-certificates
+@@ -59,6 +59,14 @@ do
+ --hooksdir)
+ shift
+ HOOKSDIR="$1";;
++ --sysroot)
++ shift
++ SYSROOT="$1"
++ CERTSCONF="$1/${CERTSCONF}"
++ CERTSDIR="$1/${CERTSDIR}"
++ LOCALCERTSDIR="$1/${LOCALCERTSDIR}"
++ ETCCERTSDIR="$1/${ETCCERTSDIR}"
++ HOOKSDIR="$1/${HOOKSDIR}";;
+ --help|-h|*)
+ echo "$0: [--verbose] [--fresh]"
+ exit;;
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch b/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
deleted file mode 100644
index 48c69f0cbc..0000000000
--- a/meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From cdb53438bae194c1281c31374a901ad7ee460408 Mon Sep 17 00:00:00 2001
-From: Andreas Oberritter <obi@opendreambox.org>
-Date: Tue, 19 Mar 2013 17:14:33 +0100
-Subject: [PATCH] update-ca-certificates: use $SYSROOT
-
-Upstream-Status: Pending
-
-Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
----
- sbin/update-ca-certificates | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index 5a0a1da..36cdd9a 100755
---- a/sbin/update-ca-certificates
-+++ b/sbin/update-ca-certificates
-@@ -24,12 +24,12 @@
- verbose=0
- fresh=0
- default=0
--CERTSCONF=/etc/ca-certificates.conf
--CERTSDIR=/usr/share/ca-certificates
--LOCALCERTSDIR=/usr/local/share/ca-certificates
-+CERTSCONF=$SYSROOT/etc/ca-certificates.conf
-+CERTSDIR=$SYSROOT/usr/share/ca-certificates
-+LOCALCERTSDIR=$SYSROOT/usr/local/share/ca-certificates
- CERTBUNDLE=ca-certificates.crt
--ETCCERTSDIR=/etc/ssl/certs
--HOOKSDIR=/etc/ca-certificates/update.d
-+ETCCERTSDIR=$SYSROOT/etc/ssl/certs
-+HOOKSDIR=$SYSROOT/etc/ca-certificates/update.d
-
- while [ $# -gt 0 ];
- do
-@@ -92,9 +92,9 @@ add() {
- PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
- -e 's/[()]/=/g' \
- -e 's/,/_/g').pem"
-- if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
-+ if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "${CERT##$SYSROOT}" ]
- then
-- ln -sf "$CERT" "$PEM"
-+ ln -sf "${CERT##$SYSROOT}" "$PEM"
- echo "+$PEM" >> "$ADDED"
- fi
- # Add trailing newline to certificate, if it is missing (#635570)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch b/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
index 214f88909a..929945b56f 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0003-update-ca-certificates-use-relative-symlinks-from-ET.patch
@@ -1,4 +1,4 @@
-From 38d47c53749c6f16d5d7993410b256116e0ee0b8 Mon Sep 17 00:00:00 2001
+From a69933f96a8675369de702bdb55e57dc21f65e7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@jci.com>
Date: Wed, 28 Mar 2018 16:45:05 +0100
Subject: [PATCH] update-ca-certificates: use relative symlinks from
@@ -45,26 +45,26 @@ Signed-off-by: André Draszik <andre.draszik@jci.com>
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index f7d0dbf..97a589c 100755
+index 1e737b9..8510082 100755
--- a/sbin/update-ca-certificates
+++ b/sbin/update-ca-certificates
-@@ -29,6 +29,7 @@ CERTSDIR=$SYSROOT/usr/share/ca-certificates
- LOCALCERTSDIR=$SYSROOT/usr/local/share/ca-certificates
+@@ -30,6 +30,7 @@ LOCALCERTSDIR=/usr/local/share/ca-certificates
CERTBUNDLE=ca-certificates.crt
- ETCCERTSDIR=$SYSROOT/etc/ssl/certs
+ ETCCERTSDIR=/etc/ssl/certs
+ HOOKSDIR=/etc/ca-certificates/update.d
+FSROOT=../../../ # to get from $ETCCERTSDIR to the root of the file system
- HOOKSDIR=$SYSROOT/etc/ca-certificates/update.d
while [ $# -gt 0 ];
-@@ -125,9 +126,10 @@ add() {
+ do
+@@ -100,9 +101,10 @@ add() {
PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
-e 's/[()]/=/g' \
-e 's/,/_/g').pem"
-- if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "${CERT##$SYSROOT}" ]
+- if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
+ DST="$(echo ${CERT} | sed -e "s|^$SYSROOT||" -e "s|^/|$FSROOT|" )"
+ if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "${DST}" ]
then
-- ln -sf "${CERT##$SYSROOT}" "$PEM"
+- ln -sf "$CERT" "$PEM"
+ ln -sf "${DST}" "$PEM"
echo "+$PEM" >> "$ADDED"
fi
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch b/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
deleted file mode 100644
index c2a54c0096..0000000000
--- a/meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 50aadd3eb1c4be43d3decdeb60cede2de5a687be Mon Sep 17 00:00:00 2001
-From: Christopher Larson <chris_larson@mentor.com>
-Date: Fri, 23 Aug 2013 12:26:14 -0700
-Subject: [PATCH] ca-certificates: add recipe (version 20130610)
-
-Upstream-Status: Pending
-
-update-ca-certificates: find SYSROOT relative to its own location
-
-This makes the script relocatable.
----
- sbin/update-ca-certificates | 33 +++++++++++++++++++++++++++++++++
- 1 file changed, 33 insertions(+)
-
-diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index 2d3e1fe..f7d0dbf 100755
---- a/sbin/update-ca-certificates
-+++ b/sbin/update-ca-certificates
-@@ -66,6 +66,39 @@ do
- shift
- done
-
-+if [ -z "$SYSROOT" ]; then
-+ local_which () {
-+ if [ $# -lt 1 ]; then
-+ return 1
-+ fi
-+
-+ (
-+ IFS=:
-+ for entry in $PATH; do
-+ if [ -x "$entry/$1" ]; then
-+ echo "$entry/$1"
-+ exit 0
-+ fi
-+ done
-+ exit 1
-+ )
-+ }
-+
-+ case "$0" in
-+ */*)
-+ sbindir=$(cd ${0%/*} && pwd)
-+ ;;
-+ *)
-+ sbindir=$(cd $(dirname $(local_which $0)) && pwd)
-+ ;;
-+ esac
-+ prefix=${sbindir%/*}
-+ SYSROOT=${prefix%/*}
-+ if [ ! -d "$SYSROOT/usr/share/ca-certificates" ]; then
-+ SYSROOT=
-+ fi
-+fi
-+
- if [ ! -s "$CERTSCONF" ]
- then
- fresh=1
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
index bbdc7dd68d..676e9e0c78 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
@@ -16,9 +16,8 @@ PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
SRC_URI[sha256sum] = "dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03"
SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
- file://0002-update-ca-certificates-use-SYSROOT.patch \
file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
- file://default-sysroot.patch \
+ file://0002-sbin-update-ca-certificates-add-a-sysroot-option.patch \
file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \
file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \
"
@@ -62,7 +61,7 @@ do_install:append:class-target () {
}
pkg_postinst:${PN}:class-target () {
- SYSROOT="$D" $D${sbindir}/update-ca-certificates
+ $D${sbindir}/update-ca-certificates --sysroot $D
}
CONFFILES:${PN} += "${sysconfdir}/ca-certificates.conf"
@@ -71,11 +70,11 @@ CONFFILES:${PN} += "${sysconfdir}/ca-certificates.conf"
# we just run update-ca-certificate from do_install() for nativesdk.
CONFFILES:${PN}:append:class-nativesdk = " ${sysconfdir}/ssl/certs/ca-certificates.crt"
do_install:append:class-nativesdk () {
- SYSROOT="${D}${SDKPATHNATIVE}" ${D}${sbindir}/update-ca-certificates
+ ${D}${sbindir}/update-ca-certificates --sysroot ${D}${SDKPATHNATIVE}
}
do_install:append:class-native () {
- SYSROOT="${D}${base_prefix}" ${D}${sbindir}/update-ca-certificates
+ ${D}${sbindir}/update-ca-certificates --sysroot ${D}${base_prefix}
}
RDEPENDS:${PN}:append:class-target = " openssl-bin openssl"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 16/19] ca-certificates: upgrade 20241223 -> 20250419
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (14 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 15/19] ca-certificates: submit sysroot patch upstream, drop default-sysroot.patch Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 17/19] ca-certificates: fix on-target postinstall script Steve Sakoman
` (2 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Wang Mingyu <wangmy@fujitsu.com>
0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
refreshed for 20250419
0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
removed since it's included in 20250419
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e39cc1fb7234bf2b37856296d3c0d10ddf8cae64)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...ertdata2pem.py-print-a-warning-for-e.patch | 6 ++--
...icates-don-t-use-Debianisms-in-run-p.patch | 6 ++--
...ca-certificates-add-a-sysroot-option.patch | 36 -------------------
...0241223.bb => ca-certificates_20250419.bb} | 3 +-
4 files changed, 7 insertions(+), 44 deletions(-)
delete mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
rename meta/recipes-support/ca-certificates/{ca-certificates_20241223.bb => ca-certificates_20250419.bb} (94%)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
index da2a247e51..1226508c98 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
@@ -1,4 +1,4 @@
-From 630736f427c0a1bd0be0b5a2f6d51d63b2c4c9fd Mon Sep 17 00:00:00 2001
+From 743774cd53ed1c45bb660eddacf6dadb5ee3e145 Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex@linutronix.de>
Date: Mon, 18 Oct 2021 12:05:49 +0200
Subject: [PATCH] Revert "mozilla/certdata2pem.py: print a warning for expired
@@ -16,10 +16,10 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
3 files changed, 1 insertion(+), 13 deletions(-)
diff --git a/debian/changelog b/debian/changelog
-index 52d41ca..bdb2c8a 100644
+index dbe3e9c..496e05d 100644
--- a/debian/changelog
+++ b/debian/changelog
-@@ -138,7 +138,6 @@ ca-certificates (20211004) unstable; urgency=low
+@@ -156,7 +156,6 @@ ca-certificates (20211004) unstable; urgency=low
- "Trustis FPS Root CA"
- "Staat der Nederlanden Root CA - G3"
* Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
index cad30929f5..1a29da756f 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
+++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
@@ -1,4 +1,4 @@
-From 348163df412e53b1b7ec3e81ae5f22caa0227c37 Mon Sep 17 00:00:00 2001
+From 63086d41f76b1c3357e23c6509df72d3f75af20c Mon Sep 17 00:00:00 2001
From: Ross Burton <ross.burton@intel.com>
Date: Mon, 6 Jul 2015 15:19:41 +0100
Subject: [PATCH] ca-certificates: remove Debianism in run-parts invocation
@@ -22,10 +22,10 @@ Signed-off-by: Maciej Borzecki <maciej.borzecki@rndity.com>
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index 36cdd9a..2d3e1fe 100755
+index 91d8024..1e737b9 100755
--- a/sbin/update-ca-certificates
+++ b/sbin/update-ca-certificates
-@@ -202,9 +202,7 @@ if [ -d "$HOOKSDIR" ]
+@@ -210,9 +210,7 @@ if [ -d "$HOOKSDIR" ]
then
echo "Running hooks in $HOOKSDIR..."
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch b/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
deleted file mode 100644
index ba5bb69657..0000000000
--- a/meta/recipes-support/ca-certificates/ca-certificates/0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From d6bb773745c2e95fd1a414e916fbed64e0d8df66 Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex@linutronix.de>
-Date: Mon, 31 Mar 2025 17:42:25 +0200
-Subject: [PATCH] sbin/update-ca-certificates: add a --sysroot option
-
-This allows using the script in cross-compilation environments
-where the script needs to prefix the sysroot to every other
-directory it operates on. There are individual options
-to set those directories, but using a common prefix option
-instead is a lot less clutter and more robust.
-
-Upstream-Status: Submitted [https://salsa.debian.org/debian/ca-certificates/-/merge_requests/13]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- sbin/update-ca-certificates | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
-index 4bb77a0..1e737b9 100755
---- a/sbin/update-ca-certificates
-+++ b/sbin/update-ca-certificates
-@@ -59,6 +59,14 @@ do
- --hooksdir)
- shift
- HOOKSDIR="$1";;
-+ --sysroot)
-+ shift
-+ SYSROOT="$1"
-+ CERTSCONF="$1/${CERTSCONF}"
-+ CERTSDIR="$1/${CERTSDIR}"
-+ LOCALCERTSDIR="$1/${LOCALCERTSDIR}"
-+ ETCCERTSDIR="$1/${ETCCERTSDIR}"
-+ HOOKSDIR="$1/${HOOKSDIR}";;
- --help|-h|*)
- echo "$0: [--verbose] [--fresh]"
- exit;;
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb b/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
similarity index 94%
rename from meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
rename to meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
index 676e9e0c78..f06a30bd6d 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
@@ -14,10 +14,9 @@ DEPENDS:class-nativesdk = "openssl-native"
# Need rehash from openssl and run-parts from debianutils
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
-SRC_URI[sha256sum] = "dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03"
+SRC_URI[sha256sum] = "33b44ef78653ecd3f0f2f13e5bba6be466be2e7da72182f737912b81798ba5d2"
SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
- file://0002-sbin-update-ca-certificates-add-a-sysroot-option.patch \
file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \
file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \
"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 17/19] ca-certificates: fix on-target postinstall script
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (15 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 16/19] ca-certificates: upgrade 20241223 -> 20250419 Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 18/19] oeqa/selftest/devtool: Update after upstream repo changes Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 19/19] xf86-video-intel: correct SRC_URI as freedesktop anongit is down Steve Sakoman
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Gyorgy Sarvari <skandigraun@gmail.com>
When the package is installed directly on the machine (instead of
installing it in the rootfs directly), the postinstall script fails with
the following error:
/usr/sbin/update-ca-certificates: line 75: shift: shift count out of range
The reason is that the "update-ca-certificates" script is executed with
the "--sysroot" argument, and as the sysroot $D is passed. However on the
target system this variable doesn't exist, so the argument is passed without
this mandatory value, and the execution fails.
To avoid this error, check if the $D variable exists, and pass the --sysroot
argument only when it does.
Reported-by: WXbet <Wxbet@proton.me>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cf39461e97098a1b28693299677888ba7e8bfccf)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ca-certificates/ca-certificates_20250419.bb | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb b/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
index f06a30bd6d..01f594095e 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20250419.bb
@@ -60,7 +60,8 @@ do_install:append:class-target () {
}
pkg_postinst:${PN}:class-target () {
- $D${sbindir}/update-ca-certificates --sysroot $D
+ [ -n "$D" ] && sysroot_args="--sysroot $D"
+ $D${sbindir}/update-ca-certificates $sysroot_args
}
CONFFILES:${PN} += "${sysconfdir}/ca-certificates.conf"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 18/19] oeqa/selftest/devtool: Update after upstream repo changes
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (16 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 17/19] ca-certificates: fix on-target postinstall script Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
2025-11-11 14:58 ` [OE-core][scarthgap 19/19] xf86-video-intel: correct SRC_URI as freedesktop anongit is down Steve Sakoman
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
The upstream changed the branch name, moving to archive/ so we need to
update too. Take the opportunity to match the new location too to avoid
the redirect.
We could use a different branch but upstream would probably eventually
rename that too so this may last longer.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 478a645bad150f04dee1b0085c4542c2eefe7007)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/selftest/cases/devtool.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/meta/lib/oeqa/selftest/cases/devtool.py b/meta/lib/oeqa/selftest/cases/devtool.py
index ee75687f01..55048830bf 100644
--- a/meta/lib/oeqa/selftest/cases/devtool.py
+++ b/meta/lib/oeqa/selftest/cases/devtool.py
@@ -476,8 +476,8 @@ class DevtoolAddTests(DevtoolBase):
version = 'v3.1.0'
pn = 'mbedtls'
# this will trigger reformat_git_uri with branch parameter in url
- git_url = "'git://git@github.com/ARMmbed/mbedtls.git;branch=mbedtls-2.28;protocol=https'"
- resulting_src_uri = "git://git@github.com/ARMmbed/mbedtls.git;branch=mbedtls-2.28;protocol=https"
+ git_url = "'git://git@github.com/Mbed-TLS/mbedtls.git;branch=archive/mbedtls-2.28;protocol=https'"
+ resulting_src_uri = "git://git@github.com/Mbed-TLS/mbedtls.git;branch=archive/mbedtls-2.28;protocol=https"
self._test_devtool_add_git_url(git_url, version, pn, resulting_src_uri)
def test_devtool_add_git_style2(self):
@@ -485,8 +485,8 @@ class DevtoolAddTests(DevtoolBase):
srcrev = 'v3.1.0'
pn = 'mbedtls'
# this will trigger reformat_git_uri with branch parameter in url
- git_url = "'git://git@github.com/ARMmbed/mbedtls.git;protocol=https'"
- resulting_src_uri = "git://git@github.com/ARMmbed/mbedtls.git;protocol=https;branch=master"
+ git_url = "'git://git@github.com/Mbed-TLS/mbedtls.git;protocol=https'"
+ resulting_src_uri = "git://git@github.com/Mbed-TLS/mbedtls.git;protocol=https;branch=master"
self._test_devtool_add_git_url(git_url, version, pn, resulting_src_uri, srcrev)
def test_devtool_add_library(self):
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][scarthgap 19/19] xf86-video-intel: correct SRC_URI as freedesktop anongit is down
2025-11-11 14:58 [OE-core][scarthgap 00/19] Patch review Steve Sakoman
` (17 preceding siblings ...)
2025-11-11 14:58 ` [OE-core][scarthgap 18/19] oeqa/selftest/devtool: Update after upstream repo changes Steve Sakoman
@ 2025-11-11 14:58 ` Steve Sakoman
18 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-11-11 14:58 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
(From OE-Core rev: 04037a14e1431c4a51f5d51885974732a6108368)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9649bec517996558e01d668d2b59e68306a3a647)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb b/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
index 2e526bd799..0a42bd9975 100644
--- a/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
+++ b/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
@@ -13,7 +13,7 @@ SRCREV = "31486f40f8e8f8923ca0799aea84b58799754564"
PV = "2.99.917+git"
S = "${WORKDIR}/git"
-SRC_URI = "git://anongit.freedesktop.org/git/xorg/driver/xf86-video-intel;protocol=https;branch=master"
+SRC_URI = "git://gitlab.freedesktop.org/xorg/driver/xf86-video-intel.git;protocol=https;branch=master"
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread