[OE-core][wrynose 00/17] Patch review

[OE-core][wrynose 00/17] Patch review

[Fabien Thomas]

Please review this set of changes for wrynose and have comments back by
end of day Monday, August 17.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4467
* meta-qcom has a known issue: https://github.com/qualcomm-linux/meta-qcom/issues/2457

The following changes since commit f09a0f28aeb54ddd90415dd458338e1565bb5a49:

  build-appliance-image: Update to wrynose head revisions (2026-07-30 13:29:32 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut

for you to fetch changes up to d75e9cc17035bcd403b101298be1503697a6f929:

  oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED (2026-08-13 12:14:52 +0200)

----------------------------------------------------------------

Adarsh Jagadish Kamini (1):
  glibc: CVE-2026-5358 add CVE_STATUS

Adrian Freihofer (1):
  oe-selftest: fitimage: Do not expect kernel property in DTBO config
    subnodes

Daniel Turull (1):
  libarchive: fix CVE-2026-14164

Himanshu Jadon (1):
  python3-pip: set CVE_PRODUCT

Jaipaul Cheernam (1):
  bind: upgrade 9.20.23 -> 9.20.26

Marek Vasut (2):
  kernel-fit-image.bbclass: Do not include kernel property in DTBO
    config subnodes
  kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = "1"

Peter Marko (1):
  gstreamer1.0: set status for CVE-2026-5056

Ryan Eatmon (2):
  kernel-fit-image: Add KERNEL_DTBVENDORED support for
    FIT_CONF_DEFAULT_DTB
  oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED

Wes Malone (1):
  cpan_build: disable .packlist and html doc

Yoann Congal (1):
  selftest: uboot: remove duplicated KVM presence test

mark.yang (5):
  python3-pyopenssl: set CVE_PRODUCT
  python3-pyyaml: set CVE_PRODUCT
  python3-xmltodict: set CVE_PRODUCT
  python3-certifi: set CVE_PRODUCT
  python3-idna: set CVE_PRODUCT

 meta/classes-recipe/cpan_build.bbclass        |  7 +++
 meta/classes-recipe/kernel-fit-image.bbclass  | 22 ++++++-
 meta/lib/oe/fitimage.py                       |  7 ++-
 meta/lib/oeqa/selftest/cases/fitimage.py      | 59 ++++++++++++++++++-
 meta/lib/oeqa/selftest/cases/uboot.py         |  6 +-
 ...1-avoid-start-failure-with-bind-user.patch |  2 +-
 ...kport-ax_prog_cc_for_build.m4-macros.patch |  2 +-
 ...d-V-and-start-log-hide-build-options.patch |  4 +-
 ...ching-for-json-headers-searches-sysr.patch |  6 +-
 .../recipes-connectivity/bind/bind/conf.patch |  2 +-
 ...t.d-add-support-for-read-only-rootfs.patch |  2 +-
 .../bind/make-etc-initd-bind-stop-work.patch  |  2 +-
 .../bind/{bind_9.20.23.bb => bind_9.20.26.bb} |  2 +-
 meta/recipes-core/glibc/glibc_2.43.bb         |  2 +-
 .../perl/libmodule-build-perl_0.4234.bb       |  2 -
 .../python/python3-certifi_2026.2.25.bb       |  2 +
 .../python/python3-idna_3.11.bb               |  2 +
 .../python/python3-pip_26.0.1.bb              |  2 +
 .../python/python3-pyopenssl_26.0.0.bb        |  2 +
 .../python/python3-pyyaml_6.0.3.bb            |  2 +
 .../python/python3-xmltodict_1.0.4.bb         |  2 +
 .../libarchive/CVE-2026-14164.patch           | 53 +++++++++++++++++
 .../libarchive/libarchive_3.8.7.bb            |  1 +
 .../gstreamer/gstreamer1.0_1.28.2.bb          |  2 +
 24 files changed, 171 insertions(+), 24 deletions(-)
 rename meta/recipes-connectivity/bind/{bind_9.20.23.bb => bind_9.20.26.bb} (97%)
 create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch

[OE-core][wrynose 01/17] selftest: uboot: remove duplicated KVM presence test

[Fabien Thomas]

From: Yoann Congal <yoann.congal@smile.fr>

test_boot_uboot_kvm_to_full_target test, needs a working KVM.
It checked it with the kvm-ok tool but that tool is not documented as a
requirement. Also, the check is also done by runqemu called later in the
test.

Remove it from the test and let runqemu have the responsibility of
checking for KVM.

Note that the KVM check now happens *after* the image build instead of
before it.

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6a91494f29a1f9da28280bc93771714c4545da46)
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/lib/oeqa/selftest/cases/uboot.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/meta/lib/oeqa/selftest/cases/uboot.py b/meta/lib/oeqa/selftest/cases/uboot.py
index 2e4530fddd..847fa205a1 100644
--- a/meta/lib/oeqa/selftest/cases/uboot.py
+++ b/meta/lib/oeqa/selftest/cases/uboot.py
@@ -9,7 +9,7 @@ import os
 import textwrap
 
 from oeqa.selftest.case import OESelftestTestCase
-from oeqa.utils.commands import bitbake, runqemu, get_bb_var, get_bb_vars, runCmd
+from oeqa.utils.commands import bitbake, runqemu, get_bb_var, get_bb_vars
 from oeqa.core.decorator.data import skipIfNotArch, skipIfNotBuildArch
 from oeqa.core.decorator import OETestTag
 
@@ -51,11 +51,9 @@ QEMU_USE_KVM = "False"
     def test_boot_uboot_kvm_to_full_target(self):
         """
         Tests building u-boot and booting it with QEMU and KVM.
-        Requires working KVM on build host. See "kvm-ok" output.
+        Requires working KVM on build host.
         """
 
-        runCmd("kvm-ok")
-
         image = "core-image-minimal"
         vars = get_bb_vars(['HOST_ARCH', 'BUILD_ARCH'], image)
         host_arch = vars['HOST_ARCH']

[OE-core][wrynose 02/17] bind: upgrade 9.20.23 -> 9.20.26

[Fabien Thomas]

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>

Changelog: https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html

This upgrade fixes the following CVEs:

- [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name
  too long.

  Previously, if the expansion of a wildcard CNAME RPZ policy resulted
  in a name that exceeded the length limit, a self referential CNAME and
  the original address record were returned, allowing the policy to be
  bypassed.

- [CVE-2026-11721] Invalid signed wildcard records were being accepted.

  Signed wildcard responses in which the Labels field in the RRSIG
  record was less than the number of labels in the Signer Name field
  were being incorrectly accepted.

- [CVE-2026-13321] Fix DNSSEC validation bypass via out-of-zone NSEC
  Next Field.

  A malicious zone with out-of-zone NSEC next owner names can cause a
  DNSSEC validating resolver to cache such record and generate negative
  answers for any zone that is covered by the range.

- [CVE-2026-10723] Correct verification of NSEC3 signer name.

  BIND 9 accepted child-zone NSEC3 records where the first label equals
  the hash of the parent zone as valid parent-zone closest encloser
  proofs.

- [CVE-2026-12617] Do not assert for some specific CNAME and DNAME
  queries.

  A bug in the resolver's handling of certain cached DNAME and CNAME
  responses could cause named to trigger an assertion failure and exit.

- [CVE-2026-10822] Malformed DNSKEY records could trigger an assertion.

  Previously, dns_name_fromwire() did not honor the record boundary
  when reading names from the wire, allowing malformed records to be
  accepted when they should not have been.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 .../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +-
 .../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch   | 2 +-
 ...01-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++--
 ...nd-ensure-searching-for-json-headers-searches-sysr.patch | 6 +++---
 meta/recipes-connectivity/bind/bind/conf.patch              | 2 +-
 .../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +-
 .../bind/bind/make-etc-initd-bind-stop-work.patch           | 2 +-
 .../bind/{bind_9.20.23.bb => bind_9.20.26.bb}               | 2 +-
 8 files changed, 11 insertions(+), 11 deletions(-)
 rename meta/recipes-connectivity/bind/{bind_9.20.23.bb => bind_9.20.26.bb} (97%)

diff --git a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
index 4fa377a594..7ed4c5fd2f 100644
--- a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
@@ -1,4 +1,4 @@
-From 2a3ff2a026c55dc67655baf28e0f4175232ee0ff Mon Sep 17 00:00:00 2001
+From a67ac281cd86d8d9ca27e64a5944deb5578e5087 Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 15 Oct 2018 16:55:09 +0800
 Subject: [PATCH] avoid start failure with bind user
diff --git a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
index 7279a73e87..da4cdef696 100644
--- a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
@@ -1,4 +1,4 @@
-From 77f8fafab0cc91c3ad8fbf1382b1d0f2d2cd99a6 Mon Sep 17 00:00:00 2001
+From 16608520c9d946223404165732eacd79b59de471 Mon Sep 17 00:00:00 2001
 From: Khem Raj <khem.raj@oss.qualcomm.com>
 Date: Fri, 10 Apr 2026 23:33:49 +0000
 Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros
diff --git a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
index 369185ad86..07acce9cba 100644
--- a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
@@ -1,4 +1,4 @@
-From 49ca7b5432dd6c24541bbde21bca5043cd0c000b Mon Sep 17 00:00:00 2001
+From d925183807ae182cf332124ff5a617d257e184f9 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Mon, 27 Aug 2018 21:24:20 +0800
 Subject: [PATCH] `named/lwresd -V' and start log hide build options
@@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster <akuster@mvista.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index c3852ec..3b7a446 100644
+index af020f0..f461229 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par
diff --git a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
index 4a066294f0..4e90e97271 100644
--- a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
+++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
@@ -1,4 +1,4 @@
-From fa165cb4a9dfeb72f0db787decd527e3d587cd4e Mon Sep 17 00:00:00 2001
+From af229781e60d6779c76d5a61d26a4597b2a42f6c Mon Sep 17 00:00:00 2001
 From: Paul Gortmaker <paul.gortmaker@windriver.com>
 Date: Tue, 9 Jun 2015 11:22:00 -0400
 Subject: [PATCH] bind: ensure searching for json headers searches sysroot
@@ -32,10 +32,10 @@ Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index c6a10f6..c3852ec 100644
+index f47ce7b..af020f0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -865,7 +865,7 @@ AS_CASE([$with_lmdb],
+@@ -872,7 +872,7 @@ AS_CASE([$with_lmdb],
  	[no],[],
  	[auto|yes], [PKG_CHECK_MODULES([LMDB], [lmdb],
  				       [ac_lib_lmdb_found=yes],
diff --git a/meta/recipes-connectivity/bind/bind/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch
index ec22fe84c4..3425742d1b 100644
--- a/meta/recipes-connectivity/bind/bind/conf.patch
+++ b/meta/recipes-connectivity/bind/bind/conf.patch
@@ -1,4 +1,4 @@
-From 4b9f6f6735340d558d9c9fba9c84d7f99d3cbde2 Mon Sep 17 00:00:00 2001
+From bde3a4cb010f459a9ef92817c7e6e6e2d871794a Mon Sep 17 00:00:00 2001
 From: Qing He <qing.he@intel.com>
 Date: Tue, 30 Nov 2010 13:35:42 +0800
 Subject: [PATCH] bind: add new recipe
diff --git a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
index fd96d46448..9b55afb5d3 100644
--- a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
+++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
@@ -1,4 +1,4 @@
-From 19933be78902d90014f177b5633dd15984bc1bc9 Mon Sep 17 00:00:00 2001
+From 8876e722beda701a0de021360ff381347120c6ff Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Thu, 27 Mar 2014 02:34:41 +0000
 Subject: [PATCH] init.d: add support for read-only rootfs
diff --git a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
index 155cc5a110..33d5d34f15 100644
--- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
+++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
@@ -1,4 +1,4 @@
-From e429899c34ea8a4f85de428e22ee49c453281e82 Mon Sep 17 00:00:00 2001
+From 26c988eee9d2eae7c7dec8c529176352017b2ce1 Mon Sep 17 00:00:00 2001
 From: Roy Li <rongqing.li@windriver.com>
 Date: Thu, 15 Nov 2012 02:27:54 +0000
 Subject: [PATCH] bind: make "/etc/init.d/bind stop" work
diff --git a/meta/recipes-connectivity/bind/bind_9.20.23.bb b/meta/recipes-connectivity/bind/bind_9.20.26.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.20.23.bb
rename to meta/recipes-connectivity/bind/bind_9.20.26.bb
index ebc4422b67..fe2ae3f002 100644
--- a/meta/recipes-connectivity/bind/bind_9.20.23.bb
+++ b/meta/recipes-connectivity/bind/bind_9.20.26.bb
@@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
 		   file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \
            "
 
-SRC_URI[sha256sum] = "5d4475aed3f9e500ef554b2b14d972bdb83d33de214a9b3be92918ea46908371"
+SRC_URI[sha256sum] = "55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350"
 
 UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
 # follow the ESV versions divisible by 2

[OE-core][wrynose 03/17] libarchive: fix CVE-2026-14164

[Fabien Thomas]

From: Daniel Turull <daniel.turull@ericsson.com>

Backport patch to fix CVE-2026-14164.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-14164

Upstream fix:
  https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8

Tested with ptest:
Before: PASSED: 5, FAILED: 0, SKIPPED: 0
After: PASSED: 5, FAILED: 0, SKIPPED: 0

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 .../libarchive/CVE-2026-14164.patch           | 53 +++++++++++++++++++
 .../libarchive/libarchive_3.8.7.bb            |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch

diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
new file mode 100644
index 0000000000..b734fc448f
--- /dev/null
+++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
@@ -0,0 +1,53 @@
+From edbac77e8e544286fe7581bc398781c949ee5a22 Mon Sep 17 00:00:00 2001
+From: "Dustin L. Howett" <dustin@howett.net>
+Date: Sun, 24 May 2026 12:43:00 -0500
+Subject: [PATCH] Merge pull request #3071 from stoeckmann/rar5_doublefree
+
+rar5: Avoid dangling pointers in init_unpack
+(cherry picked from commit 42453cf16255800726b4efedab25138639ceef20)
+
+Conflicts Resolved:
+
+libarchive/archive_read_support_format_rar5.c (1 conflict):
+- The stable branch's init_unpack() already unconditionally NULLs
+  rar->cstate.window_buf and rar->cstate.filtered_buf right after free()
+  (the core CVE fix), but still retained the redundant else-branch that
+  re-NULLed them when window_size <= 0. Removed that dead else-branch to
+  match the upstream fix, and omitted upstream's added
+  `if(...== NULL) return ARCHIVE_FATAL;` calloc failure checks, since
+  init_unpack() is void-returning in this stable version and predates
+  that hardening.
+
+Assisted-by: kiro:claude-sonnet-5
+
+Changes from upstream commit f774f03b40cb:
+  - libarchive/archive_read_support_format_rar5.c: adapted from upstream
+
+CVE: CVE-2026-14164
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8]
+
+Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
+---
+ libarchive/archive_read_support_format_rar5.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c
+index 63dd97b3..271aa0cb 100644
+--- a/libarchive/archive_read_support_format_rar5.c
++++ b/libarchive/archive_read_support_format_rar5.c
+@@ -2568,12 +2568,12 @@ static void init_unpack(struct rar5* rar) {
+ 	free(rar->cstate.window_buf);
+ 	free(rar->cstate.filtered_buf);
+ 
++	rar->cstate.window_buf = NULL;
++	rar->cstate.filtered_buf = NULL;
++
+ 	if(rar->cstate.window_size > 0) {
+ 		rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
+ 		rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
+-	} else {
+-		rar->cstate.window_buf = NULL;
+-		rar->cstate.filtered_buf = NULL;
+ 	}
+ 
+ 	clear_data_ready_stack(rar);
diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index e8c3a3bfe3..ecb13a6772 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
 
 SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \
            file://run-ptest \
+           file://CVE-2026-14164.patch \
           "
 UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
 

[OE-core][wrynose 04/17] python3-pyopenssl: set CVE_PRODUCT

[Fabien Thomas]

From: "mark.yang" <mark.yang@lge.com>

The pypi class default python:pyopenssl matches nothing in the CVE
databases, which have used four vendor spellings for pyOpenSSL over
the years:

* CVE-2013-4314 (jean-paul_calderone:pyopenssl)
* CVE-2018-1000807 (pyopenssl:pyopenssl)
* CVE-2018-1000808 (pyopenssl_project:pyopenssl)
* CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records,
pyopenssl:pyopenssl in the NVD CPEs)

Set all four vendor:product pairs. All five CVEs are fixed before
26.3.0 (the two 2026 ones in 26.0.0), so they resolve as not
affected.

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-pyopenssl_26.0.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-pyopenssl_26.0.0.bb b/meta/recipes-devtools/python/python3-pyopenssl_26.0.0.bb
index ca2ee93d29..43977d75b9 100644
--- a/meta/recipes-devtools/python/python3-pyopenssl_26.0.0.bb
+++ b/meta/recipes-devtools/python/python3-pyopenssl_26.0.0.bb
@@ -18,4 +18,6 @@ RDEPENDS:${PN}:class-target = " \
 "
 RDEPENDS:${PN}-tests = "${PN}"
 
+CVE_PRODUCT = "jean-paul_calderone:pyopenssl pyca:pyopenssl pyopenssl:pyopenssl pyopenssl_project:pyopenssl"
+
 BBCLASSEXTEND = "native nativesdk"

[OE-core][wrynose 05/17] python3-pyyaml: set CVE_PRODUCT

[Fabien Thomas]

From: "mark.yang" <mark.yang@lge.com>

The pypi class default python:pyyaml vendor prefix matches nothing,
so PyYAML CVEs are not evaluated at all. The databases use two
vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a
space, not expressible as a vendor:product pair) in CVE-2020-1747's
CNA record. Use the bare product name to cover both.

All four existing CVEs (CVE-2017-18342, CVE-2019-20477,
CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as
not affected at 6.0.3.

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89a0ba3c2da2a7755bafb28afbf75dc7112e2549)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-pyyaml_6.0.3.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-pyyaml_6.0.3.bb b/meta/recipes-devtools/python/python3-pyyaml_6.0.3.bb
index 7e2b088ca5..849e2c9cc8 100644
--- a/meta/recipes-devtools/python/python3-pyyaml_6.0.3.bb
+++ b/meta/recipes-devtools/python/python3-pyyaml_6.0.3.bb
@@ -21,4 +21,6 @@ RDEPENDS:${PN} += "\
     python3-netclient \
 "
 
+CVE_PRODUCT = "pyyaml"
+
 BBCLASSEXTEND = "native nativesdk"

[OE-core][wrynose 06/17] python3-xmltodict: set CVE_PRODUCT

[Fabien Thomas]

From: "mark.yang" <mark.yang@lge.com>

The CVE databases track xmltodict as xmltodict:xmltodict, so the
default python:xmltodict vendor prefix never matches and its CVEs
are not evaluated at all. Use the exact vendor:product pair.

The only existing CVE (CVE-2025-9375, disputed by upstream) affects
0.14.2 before 0.15.1, so it resolves as not affected at 1.0.4.

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-xmltodict_1.0.4.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-xmltodict_1.0.4.bb b/meta/recipes-devtools/python/python3-xmltodict_1.0.4.bb
index e622c00dae..04632de099 100644
--- a/meta/recipes-devtools/python/python3-xmltodict_1.0.4.bb
+++ b/meta/recipes-devtools/python/python3-xmltodict_1.0.4.bb
@@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "6d94c9f834dd9e44514162799d344d815a3a4faec913717a9ecbfa5be1
 
 PYPI_PACKAGE = "xmltodict"
 
+CVE_PRODUCT = "xmltodict:xmltodict"
+
 BBCLASSEXTEND = "native nativesdk"
 
 inherit pypi python_setuptools_build_meta ptest-python-pytest

[OE-core][wrynose 07/17] python3-certifi: set CVE_PRODUCT

[Fabien Thomas]

From: "mark.yang" <mark.yang@lge.com>

NVD tracks certifi as certifi:certifi, so the default python:certifi
vendor prefix never matches and its CVEs are not evaluated at all.
Use the exact vendor:product pair.

All three existing CVEs (CVE-2022-23491, CVE-2023-37920,
CVE-2024-39689) are fixed before 2024.7.4. The wrynose recipe version
is 2026.2.25, so it is outside the affected ranges and these CVEs
resolve as not affected.

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 26c49743ec431a3cc39803664eec8851be75756e)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-certifi_2026.2.25.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-certifi_2026.2.25.bb b/meta/recipes-devtools/python/python3-certifi_2026.2.25.bb
index 7034f7a6f1..0425f3544f 100644
--- a/meta/recipes-devtools/python/python3-certifi_2026.2.25.bb
+++ b/meta/recipes-devtools/python/python3-certifi_2026.2.25.bb
@@ -11,6 +11,8 @@ SRC_URI[sha256sum] = "e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e8
 
 inherit pypi python_setuptools_build_meta
 
+CVE_PRODUCT = "certifi:certifi"
+
 BBCLASSEXTEND = "native nativesdk"
 
 RDEPENDS:${PN} += "python3-io"

[OE-core][wrynose 08/17] python3-idna: set CVE_PRODUCT

[Fabien Thomas]

From: "mark.yang" <mark.yang@lge.com>

The pypi class default python:idna matches nothing in the CVE
databases, which track the Python idna CVEs as:

* CVE-2024-3651 (kjd:internationalized_domain_names_in_applications) [1]
* CVE-2026-45409 (kjd:idna in the CNA record, same NVD CPE as above)

Set both vendor:product pairs.

For wrynose, python3-idna is 3.11. CVE-2024-3651 is fixed before
3.7, so it does not apply here. CVE-2026-45409 affects idna versions
before 3.15, so this metadata change will expose that CVE as
applicable/unpatched for wrynose.

The bare product name is not an option here: it would also match
"servo:idna", the Rust idna crate (e.g. CVE-2024-12224).

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3651

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48428c0fe22d8ecbfa53efffb28173d4d37539e6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-idna_3.11.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-idna_3.11.bb b/meta/recipes-devtools/python/python3-idna_3.11.bb
index de4595c1d4..eb87572934 100644
--- a/meta/recipes-devtools/python/python3-idna_3.11.bb
+++ b/meta/recipes-devtools/python/python3-idna_3.11.bb
@@ -10,4 +10,6 @@ inherit pypi python_flit_core ptest-python-pytest
 RDEPENDS:${PN} += "python3-codecs"
 RDEPENDS:${PN}-ptest += "python3-unittest-automake-output"
 
+CVE_PRODUCT = "kjd:idna kjd:internationalized_domain_names_in_applications"
+
 BBCLASSEXTEND = "native nativesdk"

[OE-core][wrynose 09/17] cpan_build: disable .packlist and html doc

[Fabien Thomas]

From: Wes Malone <wes@mitsi.com>

Currently, Makefile.PL-built Perl recipes (cpan.bbclass) exclude
.packlist files with NO_PACKLIST=1, but Build.PL recipes
(cpan_build.bbclass) do not. This now results in a QA error due to the
TMPDIR paths included in the .packlist file.

  ERROR: x do_package_qa: QA Issue: File [...]/.packlist in package x
         contains reference to TMPDIR [buildpaths]

A similar error is produced by generated html doc.

Here we add the corresponding Build.PL arg to disable packlists and html
doc.

Signed-off-by: Wes Malone <wes@mitsi.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/classes-recipe/cpan_build.bbclass                    | 7 +++++++
 meta/recipes-devtools/perl/libmodule-build-perl_0.4234.bb | 2 --
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/cpan_build.bbclass b/meta/classes-recipe/cpan_build.bbclass
index 026859b6c7..03289dc21c 100644
--- a/meta/classes-recipe/cpan_build.bbclass
+++ b/meta/classes-recipe/cpan_build.bbclass
@@ -25,6 +25,13 @@ cpan_build_do_configure () {
 	fi
 
 	perl Build.PL --installdirs vendor --destdir ${D} \
+                        --create_packlist=0 \
+                        --config installhtml1dir= \
+                        --config installhtml3dir= \
+                        --config installsitehtml1dir= \
+                        --config installsitehtml3dir= \
+                        --config installvendorhtml1dir= \
+                        --config installvendorhtml3dir= \
 			${EXTRA_CPAN_BUILD_FLAGS}
 
 	# Build.PLs can exit with success without generating a
diff --git a/meta/recipes-devtools/perl/libmodule-build-perl_0.4234.bb b/meta/recipes-devtools/perl/libmodule-build-perl_0.4234.bb
index b27a8c15e6..0f992dea6d 100644
--- a/meta/recipes-devtools/perl/libmodule-build-perl_0.4234.bb
+++ b/meta/recipes-devtools/perl/libmodule-build-perl_0.4234.bb
@@ -32,8 +32,6 @@ do_patch_module_build () {
 
 do_patch[postfuncs] += "do_patch_module_build"
 
-EXTRA_CPAN_BUILD_FLAGS = "--create_packlist=0"
-
 do_install:prepend () {
 	# We do not have a recipe for libpod-parser-perl which is for
 	# documentation (and is deprecated in favor of Pod::Simple)

[OE-core][wrynose 10/17] glibc: CVE-2026-5358 add CVE_STATUS

[Fabien Thomas]

From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

CVE-2026-5358 has been marked rejected.
https://sourceware.org/bugzilla/show_bug.cgi?id=34067#c6

https://inbox.sourceware.org/libc-alpha/20260421164416.4031726-1-carlos@redhat.com/T/#mf76c27025e603294611196b90e428769c9fc5a4e

Add CVE-2026-5358 to CVE_STATUS_RECIPE group as the CVE is disputed
by upstream glibc maintainers.

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-core/glibc/glibc_2.43.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-core/glibc/glibc_2.43.bb
index b84c55ca17..a856554782 100644
--- a/meta/recipes-core/glibc/glibc_2.43.bb
+++ b/meta/recipes-core/glibc/glibc_2.43.bb
@@ -5,7 +5,7 @@ require glibc-version.inc
 # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010023
 # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010024
 CVE_STATUS_GROUPS = "CVE_STATUS_RECIPE"
-CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024"
+CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024 CVE-2026-5358"
 CVE_STATUS_RECIPE[status] = "disputed: \
 Upstream glibc maintainers dispute there is any issue and have no plans to address it further. \
 this is being treated as a non-security bug and no real threat."

[OE-core][wrynose 11/17] gstreamer1.0: set status for CVE-2026-5056

[Fabien Thomas]

From: Peter Marko <peter.marko@siemens.com>

Per [1] this is fixed in 1.28.2.
cvelistV5 has just hash in version so creates false positive.

[1] https://security-tracker.debian.org/tracker/CVE-2026-5056

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb
index b727783746..4e51418c98 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb
@@ -71,4 +71,6 @@ RDEPENDS:${PN}-ptest:append:libc-glibc = " glibc-gconv-iso8859-5"
 
 CVE_PRODUCT = "gstreamer"
 
+CVE_STATUS[CVE-2026-5056] = "cpe-stable-backport: Fixed since 1.28.2"
+
 PTEST_BUILD_HOST_FILES = ""

[OE-core][wrynose 12/17] python3-pip: set CVE_PRODUCT

[Fabien Thomas]

From: Himanshu Jadon <hjadon@cisco.com>

CVE_PRODUCT is not set for python3-pip, so cve-check can miss or
misreport pip CVEs. CVE-2026-8643 is reported in NVD with pypa:pip.

Add CVE_PRODUCT to match the NVD product name and report this CVE
correctly.

Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a486abd4889ad03e1a8ddd5311595f3ece7d61b6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/recipes-devtools/python/python3-pip_26.0.1.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-pip_26.0.1.bb b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
index 28af8f7ec7..9640bc926a 100644
--- a/meta/recipes-devtools/python/python3-pip_26.0.1.bb
+++ b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
@@ -28,6 +28,8 @@ SRC_URI += "file://no_shebang_mangling.patch"
 
 SRC_URI[sha256sum] = "c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8"
 
+CVE_PRODUCT = "pypa:pip"
+
 do_install:append(){
 	# pip vendors distlib which ships Windows launcher templates (*.exe).
 	# Keep them only when building for a Windows (mingw) host.

[OE-core][wrynose 13/17] oe-selftest: fitimage: Do not expect kernel property in DTBO config subnodes

[Fabien Thomas]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

A DTBO overlay together with only a kernel cannot form a bootable result,
so DTBO configuration subnodes should not include the kernel property.
Update _get_req_its_fields() accordingly: skip appending
'kernel = "kernel-1"' for .dtbo files, aligning it with
_get_req_sections() which already handles this correctly.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 85e0408a81bdca0411a8625061e5e343c05f92d9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/lib/oeqa/selftest/cases/fitimage.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index 3541c07520..e8435fb43c 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -659,7 +659,9 @@ class KernelFitImageBase(FitImageTestCase):
         dtb_files, dtb_symlinks = FitImageTestCase._get_dtb_files(bb_vars)
         if dtb_files:
             for dtb in dtb_files:
-                its_field_check.append('kernel = "kernel-1";')
+                # DTBO overlay configs do not include a kernel property
+                if not dtb.endswith('.dtbo'):
+                    its_field_check.append('kernel = "kernel-1";')
                 its_field_check.append('fdt = "fdt-%s";' % dtb)
             for dtb in dtb_symlinks:
                 its_field_check.append('kernel = "kernel-1";')

[OE-core][wrynose 14/17] kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes

[Fabien Thomas]

From: Marek Vasut <marek.vasut@mailbox.org>

The OE 5.0 implementation of fitImage generation did not include the
kernel property in DTBO configuration node subnodes, while the current
OE 6.0 implementation does. The previous implementation was correct,
because kernel together with only a DTBO overlay can not form bootable
result. The kernel property should only be part of the configuration
subnode which includes both kernel and DTB. Fix this.

Fixes: 05d0c7342d76 ("kernel-fit-image.bbclass: add a new FIT image implementation")
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 06ed34005957a6afb88270603df5e545941546b0)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/lib/oe/fitimage.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
index 881d0eae0a..d7e21171ab 100644
--- a/meta/lib/oe/fitimage.py
+++ b/meta/lib/oe/fitimage.py
@@ -425,8 +425,13 @@ class ItsNodeRootKernel(ItsNode):
         opt_props = {}
         conf_desc = []
         sign_entries = []
+        include_kernel = 1
 
-        if self._kernel:
+        # DTBO configuration sections do not include kernel property
+        if dtb and os.path.splitext(dtb.name)[1] == ".dtbo":
+            include_kernel = 0
+
+        if self._kernel and include_kernel:
             conf_desc.append("Linux kernel")
             opt_props["kernel"] = self._kernel.name
             if self._sign_enable:

[OE-core][wrynose 15/17] kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = "1"

[Fabien Thomas]

From: Marek Vasut <marek.vasut@mailbox.org>

In the case KERNEL_DTBVENDORED = "1" , the fitImage configuration
subnode names used to contain the vendor prefix in OE 5.0 , e.g.:
"
$ mkimage  -l fitImage
...
 Configuration 0 (conf-freescale_imx8mn-board.dtb)
                       ^^^^^^^^^^
...
"

With OE 6.0 this is no longer the case and KERNEL_DTBVENDORED = "1"
and KERNEL_DTBVENDORED = "0" behave exactly the same way:
"
$ mkimage  -l fitImage
...
 Configuration 0 (conf-imx8mn-board.dtb)
...
"

Users depend on the correct configuration subnode names as those
are used in the U-Boot "bootm" command when booting fitImages.

Fix this by converting each entry in the KERNEL_DEVICETREE list
into the configuration subnode name by replacing all of its path
separators with underscores.

Fixes: 05d0c7342d76 ("kernel-fit-image.bbclass: add a new FIT image implementation")
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4297b94c3728cd2e320d75b68c508e12ab127719)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/classes-recipe/kernel-fit-image.bbclass | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
index ae8f3c6688..448a88ccb1 100644
--- a/meta/classes-recipe/kernel-fit-image.bbclass
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -94,6 +94,13 @@ python do_compile() {
         for dtb in kernel_devicetree.split():
             # In deploy_dir the DTBs are without sub-directories also with KERNEL_DTBVENDORED = "1"
             dtb_name = os.path.basename(dtb)
+            # With vendored DTs, use the DT name as listed in KERNEL_DEVICETREE
+            # and replace any path separators with underscores, this behaves the
+            # same way as KERNEL_DTBVENDORED = "1" did in OE 5.0 and older.
+            if d.getVar('KERNEL_DTBVENDORED') != "1":
+                conf_name = dtb_name
+            else:
+                conf_name = dtb.replace('/', '_')
 
             # Skip DTB if it's also provided in EXTERNAL_KERNEL_DEVICETREE directory
             if external_kernel_devicetree:
@@ -103,7 +110,7 @@ python do_compile() {
 
             # Copy the dtb or dtbo file into the FIT image assembly directory
             shutil.copyfile(os.path.join(kernel_deploydir, dtb_name), dtb_name)
-            root_node.fitimage_emit_section_dtb(dtb_name, dtb_name,
+            root_node.fitimage_emit_section_dtb(conf_name, dtb_name,
                 d.getVar("UBOOT_DTB_LOADADDRESS"), d.getVar("UBOOT_DTBO_LOADADDRESS"))
 
     if external_kernel_devicetree:

[OE-core][wrynose 16/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB

[Fabien Thomas]

From: Ryan Eatmon <reatmon@ti.com>

When specifying a FIT_CONF_DEFAULT_DTB for a machine, you have to
exactly align the name with what will be in the fitImage file or you
will get a build error.  If you also turn on KERNEL_DTBVENDORED then you
must also specify the vendor directory as part of the dtb name that you
want for the default, but you must manually do the same mapping that the
kernel-fit-image class is doing when it generates the fit-image.its file.

This patch just adds the same logic to figure out the value for the
requested default dtb and eliminate the need to understand the internal
mapping of the class.  It should make specifying the value more
intuitive.  The same value that you put in the KERNEL_DEVICETREE can be
used in the FIT_CONF_DEFAULT_DTB and the new code will correctly honor
the KERNEL_DTBVENDORED setting.

Before:

  KERNEL_DEVICETREE = "
    ti/k3-am62p5-sk.dtb \
    ... \
  "
  FIT_CONF_DEFAULT_DTB = "ti_k3-am62p5-sk.dtb"

After:

  KERNEL_DEVICETREE = "
    ti/k3-am62p5-sk.dtb \
    ... \
  "
  FIT_CONF_DEFAULT_DTB = "ti/k3-am62p5-sk.dtb"

Signed-off-by: Ryan Eatmon <reatmon@ti.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3bceb2dabeee13c0a80ddd74ea7ae991606d6772)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/classes-recipe/kernel-fit-image.bbclass | 21 +++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
index 448a88ccb1..cfe43a5a30 100644
--- a/meta/classes-recipe/kernel-fit-image.bbclass
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -55,6 +55,13 @@ FIT_KERNEL_SIGN_ENABLE ?= "${UBOOT_SIGN_ENABLE}"
 FIT_KERNEL_SIGN_KEYNAME ?= "${UBOOT_SIGN_KEYNAME}"
 FIT_KERNEL_SIGN_KEYDIR ?= "${UBOOT_SIGN_KEYDIR}"
 
+def apply_dtbvendored(d,dtb):
+    if d.getVar('KERNEL_DTBVENDORED') != "1":
+        mapped_name = os.path.basename(dtb)
+    else:
+        mapped_name = dtb.replace('/', '_')
+    return mapped_name
+
 python do_compile() {
     import shutil
     import oe.fitimage
@@ -97,10 +104,7 @@ python do_compile() {
             # With vendored DTs, use the DT name as listed in KERNEL_DEVICETREE
             # and replace any path separators with underscores, this behaves the
             # same way as KERNEL_DTBVENDORED = "1" did in OE 5.0 and older.
-            if d.getVar('KERNEL_DTBVENDORED') != "1":
-                conf_name = dtb_name
-            else:
-                conf_name = dtb.replace('/', '_')
+            conf_name = apply_dtbvendored(d, dtb)
 
             # Skip DTB if it's also provided in EXTERNAL_KERNEL_DEVICETREE directory
             if external_kernel_devicetree:
@@ -195,8 +199,15 @@ python do_compile() {
                                                  loadable_loadaddress,
                                                  loadable_entrypoint)
 
+    # Figure out if we have a default dtb and if we need to honor the
+    # KERNEL_DTBVENDORED variable to tweak the name to match what will be
+    # in the fitImage.
+    default_dtb = d.getVar("FIT_CONF_DEFAULT_DTB")
+    if default_dtb:
+        default_dtb = apply_dtbvendored(d, default_dtb)
+
     # Generate the configuration section
-    root_node.fitimage_emit_section_config(d.getVar("FIT_CONF_DEFAULT_DTB"), d.getVar("FIT_CONF_MAPPINGS"))
+    root_node.fitimage_emit_section_config(default_dtb, d.getVar("FIT_CONF_MAPPINGS"))
 
     # Write the its file
     root_node.write_its_file(itsfile)

[OE-core][wrynose 17/17] oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED

[Fabien Thomas]

From: Ryan Eatmon <reatmon@ti.com>

The recent changes to fixing KERNEL_DTBVENDORED support and then adding
the same mapping for FIT_CONF_DEFAULT_DTB exposed that we were missing
tests for these two cases.

Signed-off-by: Ryan Eatmon <reatmon@ti.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit de2e11e63624f86583875163e66f63ea7457c121)
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 meta/lib/oeqa/selftest/cases/fitimage.py | 55 +++++++++++++++++++++++-
 1 file changed, 53 insertions(+), 2 deletions(-)

diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index e8435fb43c..b35dda6674 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -183,6 +183,16 @@ class FitImageTestCase(OESelftestTestCase):
                 pass
         return a_comment
 
+    @staticmethod
+    def _apply_dtbvendored(bb_vars,dtb):
+        """ This is (and should remain) the same logic that is in kernel-fit-image.bbclass
+        """
+        if bb_vars.get('KERNEL_DTBVENDORED') != "1":
+            mapped_name = os.path.basename(dtb)
+        else:
+            mapped_name = dtb.replace('/', '_')
+        return mapped_name
+
     @staticmethod
     def _get_dtb_files(bb_vars):
         """Return a list of devicetree names
@@ -195,7 +205,7 @@ class FitImageTestCase(OESelftestTestCase):
         all_dtbs = []
         dtb_symlinks = []
         if kernel_devicetree:
-            all_dtbs += [os.path.basename(dtb) for dtb in kernel_devicetree.split()]
+            all_dtbs += [FitImageTestCase._apply_dtbvendored(bb_vars, dtb) for dtb in kernel_devicetree.split()]
         # Support only the test recipe which provides 1 devicetree and 1 devicetree overlay
         pref_prov_dtb = bb_vars.get('PREFERRED_PROVIDER_virtual/dtb')
         if pref_prov_dtb == "bbb-dtbs-as-ext":
@@ -437,6 +447,7 @@ class KernelFitImageBase(FitImageTestCase):
             'INITRAMFS_IMAGE',
             'KERNEL_DEPLOYSUBDIR',
             'KERNEL_DEVICETREE',
+            'KERNEL_DTBVENDORED',
             'KERNEL_FIT_LINK_NAME',
             'MACHINE',
             'PREFERRED_PROVIDER_virtual/dtb',
@@ -653,7 +664,7 @@ class KernelFitImageBase(FitImageTestCase):
         fit_conf_default_dtb = bb_vars.get('FIT_CONF_DEFAULT_DTB')
         if fit_conf_default_dtb:
             fit_conf_prefix = bb_vars.get('FIT_CONF_PREFIX', "conf-")
-            its_field_check.append('default = "' + fit_conf_prefix + fit_conf_default_dtb + '";')
+            its_field_check.append('default = "' + fit_conf_prefix + self._apply_dtbvendored(bb_vars, fit_conf_default_dtb) + '";')
 
         # configuration nodes (one per DTB and also one per symlink)
         dtb_files, dtb_symlinks = FitImageTestCase._get_dtb_files(bb_vars)
@@ -1142,6 +1153,46 @@ FIT_HASH_ALG = "sha256"
         self._gen_signing_key(bb_vars)
         self._test_fitimage(bb_vars)
 
+    def test_vendored_dtb_without_kernel_dtbvendored(self):
+        """
+        Summary:     Check if FIT image and Image Tree Source (its) are created correctly with KERNEL_DTBVENDORED turned off.
+        Expected:    1) its and FIT image are built successfully
+                     2) Dumping the FIT image indicates the devicetree overlay
+        """
+
+        config = """
+MACHINE:forcevariable = "beaglebone-yocto"
+UBOOT_MACHINE = "am335x_evm_defconfig"
+UBOOT_ARCH = "arm"
+UBOOT_DTB_BINARY = "u-boot.dtb"
+KERNEL_DTBVENDORED = "0"
+"""
+        config = self._config_add_kernel_classes(config)
+        config = self._config_add_uboot_env(config)
+        self.write_config(config)
+        bb_vars = self._fit_get_bb_vars()
+        self._test_fitimage(bb_vars)
+
+    def test_vendored_dtb_with_kernel_dtbvendored(self):
+        """
+        Summary:     Check if FIT image and Image Tree Source (its) are created correctly with KERNEL_DTBVENDORED turned on.
+        Expected:    1) its and FIT image are built successfully
+                     2) Dumping the FIT image indicates the devicetree overlay
+        """
+
+        config = """
+MACHINE:forcevariable = "beaglebone-yocto"
+UBOOT_MACHINE = "am335x_evm_defconfig"
+UBOOT_ARCH = "arm"
+UBOOT_DTB_BINARY = "u-boot.dtb"
+KERNEL_DTBVENDORED = "1"
+"""
+        config = self._config_add_kernel_classes(config)
+        config = self._config_add_uboot_env(config)
+        self.write_config(config)
+        bb_vars = self._fit_get_bb_vars()
+        self._test_fitimage(bb_vars)
+
 class FitImagePyTests(KernelFitImageBase):
     """Test cases for the fitimage.py module without calling bitbake"""
 

[OE-core][wrynose 00/17] Patch review

[Yoann Congal]

Please review this set of changes for wrynose and have comments back by
end of day Tuesday, July 21.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4229
* qemux86-world and qemux86-64-ptest got impacted by 16316 – AB-INT: tar failure: got *at() syscall for unknown directory, fd 4
  retried as 
    https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4062
    https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/4182
* qemuarmv5 got impacted by 16217 – AB-INT: boot hang in qemu (amba chip errors?)
  retried as https://autobuilder.yoctoproject.org/valkyrie/#/builders/80/builds/3992

The following changes since commit 6f5681afb324aed2cba4e5b819ffc878f74a2bac:

  gnutls: fix CVE-2026-33846 (2026-07-16 20:54:12 +0200)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut

for you to fetch changes up to 551eade6c83483616ea6172336a4cf6c994ce90d:

  openssh: set status for CVE-2026-3497 (2026-07-18 01:31:03 +0200)

----------------------------------------------------------------

Adrian Freihofer (1):
  oe-selftest: fitimage: Do not expect kernel property in DTBO config
    subnodes

Alexander Kanavin (1):
  wic: upgrade 0.3.0 -> 0.3.1

Deepak Rathore (1):
  util-linux: fix CVE-2026-13595

Gustavo Henrique Nihei (1):
  u-boot: re-enable RISC-V compressed (c) ISA extension

Jaipaul Cheernam (2):
  gzip: fix CVE-2026-41992
  bzip2: Fix CVE-2026-42250

Marek Vasut (2):
  kernel-fit-image.bbclass: Do not include kernel property in DTBO
    config subnodes
  kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = "1"

Peter Marko (5):
  go: upgrade 1.26.4 -> 1.26.5
  vex: remove obsolete semicolon
  rootfs: move tasks using image_list_installed_packages to
    postuninstall
  flac: fix buildpaths with doxygen enabled
  flac: make documentation build deterministic

Ryan Eatmon (1):
  kernel-fit-image: Add KERNEL_DTBVENDORED support for
    FIT_CONF_DEFAULT_DTB

Sudhir Dumbhare (1):
  openssh: set status for CVE-2026-3497

Vijay Anusuri (1):
  tzdata/tzcode-native: upgrade 2026b -> 2026c

Yoann Congal (1):
  scripts/install-buildtools: Update to 6.0.2

 meta/classes-recipe/kernel-fit-image.bbclass  |  22 ++-
 meta/classes-recipe/license_image.bbclass     |   2 +-
 meta/classes/vex.bbclass                      |   2 +-
 meta/lib/oe/fitimage.py                       |   7 +-
 meta/lib/oeqa/selftest/cases/fitimage.py      |   4 +-
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |   1 +
 .../openssh/openssh_10.3p1.bb                 |   1 +
 meta/recipes-core/util-linux/util-linux.inc   |   1 +
 .../util-linux/CVE-2026-13595.patch           | 148 ++++++++++++++++++
 .../go/{go-1.26.4.inc => go-1.26.5.inc}       |   2 +-
 ...e_1.26.4.bb => go-binary-native_1.26.5.bb} |   6 +-
 ..._1.26.4.bb => go-cross-canadian_1.26.5.bb} |   0
 ...{go-cross_1.26.4.bb => go-cross_1.26.5.bb} |   0
 ...osssdk_1.26.4.bb => go-crosssdk_1.26.5.bb} |   0
 ...runtime_1.26.4.bb => go-runtime_1.26.5.bb} |   0
 .../go/{go_1.26.4.bb => go_1.26.5.bb}         |   0
 .../bzip2/bzip2/CVE-2026-42250.patch          |  35 +++++
 meta/recipes-extended/bzip2/bzip2_1.0.8.bb    |   1 +
 .../gzip/gzip-1.14/CVE-2026-41992.patch       |  64 ++++++++
 meta/recipes-extended/gzip/gzip_1.14.bb       |   1 +
 meta/recipes-extended/timezone/timezone.inc   |   6 +-
 meta/recipes-multimedia/flac/flac_1.5.0.bb    |   5 +-
 .../wic/{wic_0.3.0.bb => wic_0.3.1.bb}        |   2 +-
 scripts/install-buildtools                    |   4 +-
 24 files changed, 296 insertions(+), 18 deletions(-)
 create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
 rename meta/recipes-devtools/go/{go-1.26.4.inc => go-1.26.5.inc} (90%)
 rename meta/recipes-devtools/go/{go-binary-native_1.26.4.bb => go-binary-native_1.26.5.bb} (80%)
 rename meta/recipes-devtools/go/{go-cross-canadian_1.26.4.bb => go-cross-canadian_1.26.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-cross_1.26.4.bb => go-cross_1.26.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-crosssdk_1.26.4.bb => go-crosssdk_1.26.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-runtime_1.26.4.bb => go-runtime_1.26.5.bb} (100%)
 rename meta/recipes-devtools/go/{go_1.26.4.bb => go_1.26.5.bb} (100%)
 create mode 100644 meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch
 create mode 100644 meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch
 rename meta/recipes-support/wic/{wic_0.3.0.bb => wic_0.3.1.bb} (90%)