* [OE-core][wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:05 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720110548.2458865-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies upstream fixes [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence
numbers could lead to unstable ordering or undefined behavior.
Rebase CVE-2026-42009_p1.patch on top of the Wrynose
CVE-2026-33846 backport stack, which already includes the recv_buf
helper from upstream commit 9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0.
[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../gnutls/gnutls/CVE-2026-42009_p1.patch | 62 +++++++++++++++++++
.../gnutls/gnutls/CVE-2026-42009_p2.patch | 48 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 112 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
new file mode 100644
index 0000000000..f1ee618b48
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
@@ -0,0 +1,62 @@
+From d1191b910e63149a10647a089995d3cd85e16400 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Tue, 21 Apr 2026 16:52:48 +0200
+Subject: [PATCH] lib/buffers: ensure packets have differing sequence
+ numbers
+
+There should normally be no packets with same sequence number and
+differing handshake type, unless an adversary crafts them.
+Discarding them allows to get rid of packets
+with duplicate sequence ID in the buffer,
+relieving us from the question of how to sort them later.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d]
+
+Backport Changes:
+- Rebased on top of the Wrynose CVE-2026-33846 backport stack, which
+ already includes the recv_buf helper and sequence-number matching
+ prerequisite patches.
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit f01e21441e29052a6f0963840794c41d3b3ee66d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index 62f140ed3..e7f08b5625 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -971,8 +971,20 @@ static int merge_handshake_packet(gnutls_session_t session,
+ session->internals.handshake_recv_buffer;
+
+ for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) {
+- if (recv_buf[i].htype == hsk->htype &&
+- recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].htype != hsk->htype) {
++ _gnutls_audit_log(
++ session,
++ "Discarded unexpected handshake packet "
++ "with duplicate sequence %d, but "
++ "mismatched type %s (previously %s)\n",
++ hsk->sequence,
++ _gnutls_handshake2str(hsk->htype),
++ _gnutls_handshake2str(
++ recv_buf[i].htype));
++ _gnutls_handshake_buffer_clear(hsk);
++ return 0;
++ }
+ exists = 1;
+ pos = i;
+ break;
+--
+2.51.0
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
new file mode 100644
index 0000000000..6524cb47b4
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
@@ -0,0 +1,48 @@
+From 5374a6d584b8598511f7880b4e64ee52ee1f0cc5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <joshua@joshua.hu>
+Date: Tue, 21 Apr 2026 18:11:39 +0200
+Subject: [PATCH] buffers: fix handshake_compare when sequence numbers
+ match
+
+The comparator function used for ordering DTLS packets
+by sequence numbers did not follow qsort comparator contracts
+in case of packets with duplicate sequence numbers,
+which could lead to unstable ordering or undefined behaviour.
+Returning 0 in such cases makes the sorting stable.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f]
+
+Signed-off-by: Joshua Rogers <joshua@joshua.hu>
+(cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index e7f08b5625..1ac27e4e96 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2)
+ {
+ const handshake_buffer_st *e1 = _e1;
+ const handshake_buffer_st *e2 = _e2;
+-
+- if (e1->sequence <= e2->sequence)
+- return 1;
+- else
+- return -1;
++ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence);
+ }
+
+ #define SSL2_HEADERS 1
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index 03eee5c50e..3085a62310 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -34,6 +34,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
file://CVE-2026-3832_p1.patch \
file://CVE-2026-3832_p2.patch \
+ file://CVE-2026-42009_p1.patch \
+ file://CVE-2026-42009_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:05 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix [1] and test coverage [2], as
referenced in [3], to address multi-record OCSP response handling where
GnuTLS could check revocation status from the wrong OCSP entry.
[1] https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2
[2] https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e
[3] https://security-tracker.debian.org/tracker/CVE-2026-3832
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3832
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../gnutls/gnutls/CVE-2026-3832_p1.patch | 52 ++++++++
.../gnutls/gnutls/CVE-2026-3832_p2.patch | 114 ++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 168 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
new file mode 100644
index 0000000000..3786c578b9
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
@@ -0,0 +1,52 @@
+From 141c9b6015fc56cd05db3a853f08d03fcbd9b0f4 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 09:48:57 +0100
+Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
+
+In check_ocsp_response(), the code first searched
+for the SingleResponse that matches the certificate being validated.
+But later, the status was retrieved from entry 0 unconditionally,
+rather than from the matched resp_indx.
+As a result, if entry 0 corresponded to a different certificate and was good,
+while the matched entry for the peer certificate is revoked,
+the revocation check could've mistakenly accept the certificate.
+
+Reported-by: Oleh Konko (1seal) <security@1seal.org>
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1801
+Fixes: #1812
+Fixes: CVE-2026-3832
+Fixes: GNUTLS-SA-2026-04-29-12
+CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
+Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit 731861b9de8dccaf7d3b0c1446833051e48670c2)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/cert-session.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/cert-session.c b/lib/cert-session.c
+index 963f797ee..f48c7a1fb 100644
+--- a/lib/cert-session.c
++++ b/lib/cert-session.c
+@@ -343,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
+ goto cleanup;
+ }
+
+- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
+- &cert_status, &vtime, &ntime, &rtime,
+- NULL);
++ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
++ NULL, &cert_status, &vtime, &ntime,
++ &rtime, NULL);
+ if (ret < 0) {
+ _gnutls_audit_log(
+ session,
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
new file mode 100644
index 0000000000..54ea38fe69
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
@@ -0,0 +1,114 @@
+From ac357f76abeaf59429bc15b8764ad01920df0ef1 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 15:25:24 +0100
+Subject: [PATCH] tests/ocsp-tests/ocsp-must-staple-connection: test
+ CVE-2026-3832
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ .../ocsp-tests/ocsp-must-staple-connection.sh | 70 +++++++++++++++++++
+ 1 file changed, 70 insertions(+)
+
+diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+index 94d41ce24..5e100b9d9 100755
+--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
++++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+@@ -85,6 +85,7 @@ OCSP_RESPONSE_FILE="$testdir/ms-resp.tmp"
+ OCSP_REQ_FILE="$testdir/ms-req.tmp"
+ INDEXFILE="$testdir/ocsp_index.txt"
+ ATTRFILE="${INDEXFILE}.attr"
++SERVER_CERT_BAD_FILE="$testdir/ms-cert-bad.pem.tmp"
+
+ stop_servers ()
+ {
+@@ -118,6 +119,20 @@ ${CERTTOOL} \
+ --load-privkey "${srcdir}/ocsp-tests/certs/server_good.key" \
+ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_FILE}" 2>/dev/null
+
++echo "=== Generating bad server certificate ==="
++
++rm -f "$TEMPLATE_FILE"
++cp "${srcdir}/ocsp-tests/certs/server_bad.template" "$TEMPLATE_FILE"
++chmod u+w "$TEMPLATE_FILE"
++echo "ocsp_uri=http://localhost:${OCSP_PORT}/ocsp/" >>"$TEMPLATE_FILE"
++
++${CERTTOOL} \
++ --attime "${CERTDATE}" \
++ --generate-certificate --load-ca-privkey "${srcdir}/ocsp-tests/certs/ca.key" \
++ --load-ca-certificate "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --load-privkey "${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_BAD_FILE}" 2>/dev/null
++
+ echo "=== Bringing OCSP server up ==="
+
+ cp "${srcdir}/ocsp-tests/certs/ocsp_index.txt" ${INDEXFILE}
+@@ -486,6 +501,61 @@ kill "${TLS_SERVER_PID}"
+ wait "${TLS_SERVER_PID}"
+ unset TLS_SERVER_PID
+
++echo "=== Test 10: Server with revoked certificate - CVE-2026-3832 ==="
++
++# The revocation status was always mistakenly checked for the first cert.
++# Check a pair of responses: (irrelevant good unrevoked, relevant bad revoked).
++
++rm -f "${OCSP_RESPONSE_FILE}"
++
++"$FAKETIME" "${TESTDATE}" \
++ ${OPENSSL} ocsp -index "${INDEXFILE}" \
++ -issuer "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -CA "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -rsigner "${srcdir}/ocsp-tests/certs/ocsp-server.pem" \
++ -rkey "${srcdir}/ocsp-tests/certs/ocsp-server.key" \
++ -cert "${SERVER_CERT_FILE}" \
++ -cert "${SERVER_CERT_BAD_FILE}" \
++ -respout "${OCSP_RESPONSE_FILE}"
++
++eval "${GETPORT}"
++# Port for gnutls-serv
++TLS_SERVER_PORT=$PORT
++PORT=${TLS_SERVER_PORT}
++launch_bare_server \
++ "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
++ --x509keyfile="${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --x509certfile="${SERVER_CERT_BAD_FILE}" \
++ --port="${TLS_SERVER_PORT}" \
++ --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
++TLS_SERVER_PID="${!}"
++wait_server $TLS_SERVER_PID
++
++wait_for_port "${TLS_SERVER_PORT}"
++
++out=$(
++ echo "test 123456" | \
++ "${CLI}" -d1 --attime "${TESTDATE}" --ocsp \
++ --x509cafile "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --port "${TLS_SERVER_PORT}" localhost \
++ 2>&1
++ rc=$?
++)
++printf '%s\n' "$out"
++
++if test "${rc}" = "0"; then
++ echo 'ERROR: client accepted a revoked leaf (CVE-2026-3832)'
++ exit 1
++fi
++if ! echo "${out}" | grep "The certificate was revoked via OCSP" >/dev/null
++then
++ echo '"The certificate was revoked via OCSP" not found in output'
++ exit 1
++fi
++
++kill "${TLS_SERVER_PID}"
++wait "${TLS_SERVER_PID}"
++unset TLS_SERVER_PID
+
+ kill ${OCSP_PID}
+ wait ${OCSP_PID}
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index b92470768c..03eee5c50e 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -32,6 +32,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0006-buffers-match-DTLS-datagrams-by-sequence-number.patch \
file://0007-tests-mini-dtls-fragments-1839-mismatching-message_s.patch \
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
+ file://CVE-2026-3832_p1.patch \
+ file://CVE-2026-3832_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
--
2.35.6
^ permalink raw reply related
* Re: [OE-core] [wrynose] [PATCH 5/6] curl: fix CVE-2026-6429
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:01 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org
In-Reply-To: <DK2N7XBD8QIZ.33JH3NJ89PGYI@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 1946 bytes --]
Hi Yoann,
Anil is currently on medical leave, so I have taken over this activity and submitted the updated fresh patch series incorporating all the requested changes.
Please find the corresponding upstream mailing list submissions below:
1.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 1/5] curl: ignore CVE-2026-4873<https://lists.openembedded.org/g/openembedded-core/topic/120356772>
2.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 2/5] curl: fix CVE-2026-5545<https://lists.openembedded.org/g/openembedded-core/topic/120356773>
3.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 3/5] curl: fix CVE-2026-6253<https://lists.openembedded.org/g/openembedded-core/topic/120356774>
4.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 4/5] curl: fix CVE-2026-6429<https://lists.openembedded.org/g/openembedded-core/topic/120356780>
5.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 5/5] curl: fix CVE-2026-7168<https://lists.openembedded.org/g/openembedded-core/topic/120356782>
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Sunday, July 19, 2026 8:42 PMhi
To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <sudumbha@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [wrynose] [PATCH 5/6] curl: fix CVE-2026-6429
On Thu Jul 9, 2026 at 8:08 AM CEST, Sudhir Dumbhare via lists.openembedded.org wrote:
> Hi Yoann,
> Thank you for the review.
>
> I am working on same and will submit an updated patch series.
>
> Thanks & Regards,
> Sudhir
Gentle ping for a v2 of this series. It holds a patch on scarthgap.
Regards,
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 5785 bytes --]
^ permalink raw reply
* [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-7168
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 10:56 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for proxy Digest state reuse across proxy
switches described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
[2] https://curl.se/docs/CVE-2026-7168.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-7168
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../curl/curl/CVE-2026-7168.patch | 373 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 374 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
new file mode 100644
index 0000000000..b848fbaf84
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
@@ -0,0 +1,373 @@
+From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 27 Apr 2026 09:14:51 +0200
+Subject: [PATCH] setopt: clear proxy auth properties when switching
+
+Verify with test 1588
+
+Closes #21453
+
+CVE: CVE-2026-7168
+Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
+
+Backport Changes:
+- Adapted setproxy() insertion and test-list placement to the curl 8.19.0 wrynose layout.
+
+(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/setopt.c | 14 +++-
+ lib/vauth/vauth.h | 1 +
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1588 | 106 ++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 272 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1588
+ create mode 100644 tests/libtest/lib1588.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 84f3e02..d12ffb6 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -49,6 +49,7 @@
+ #include "curlx/strdup.h"
+ #include "escape.h"
+ #include "bufref.h"
++#include "vauth/vauth.h"
+
+ static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs)
+ {
+@@ -1664,6 +1665,17 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr)
+ #endif
+
+ #ifndef CURL_DISABLE_PROXY
++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
++{
++ if((data->set.str[STRING_PROXY] && proxy) &&
++ !strcmp(data->set.str[STRING_PROXY], proxy))
++ return CURLE_OK;
++
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
++}
++
+ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ const char *ptr)
+ {
+@@ -1759,7 +1771,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ * Setting it to NULL, means no proxy but allows the environment variables
+ * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
+ */
+- return Curl_setstropt(&s->str[STRING_PROXY], ptr);
++ return setproxy(data, ptr);
+ case CURLOPT_PRE_PROXY:
+ /*
+ * Set proxy server:port to use as SOCKS proxy.
+diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
+index 3e66c89..20ee51e 100644
+--- a/lib/vauth/vauth.h
++++ b/lib/vauth/vauth.h
+@@ -117,6 +117,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
+ /* This is used to clean up the digest specific data */
+ void Curl_auth_digest_cleanup(struct digestdata *digest);
+ #else
++#define Curl_auth_digest_cleanup(x)
+ #define Curl_auth_is_digest_supported() FALSE
+ #endif /* !CURL_DISABLE_DIGEST_AUTH */
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 1b76b01..1e84b26 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -208,7 +208,7 @@ test1548 test1549 test1550 test1551 test1552 test1553 test1554 test1555 \
+ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
+ test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \
+ test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \
+-test1580 test1581 test1582 test1583 test1584 test1585 \
++test1580 test1581 test1582 test1583 test1584 test1585 test1588 \
+ \
+ test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
+ test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \
+diff --git a/tests/data/test1588 b/tests/data/test1588
+new file mode 100644
+index 0000000..753e98c
+--- /dev/null
++++ b/tests/data/test1588
+@@ -0,0 +1,106 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<datacheck crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest
++</features>
++<name>
++HTTP proxy auth Digest, then change proxy and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2f77c16..96b82bc 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -97,7 +97,7 @@ TESTS_C = \
+ lib1559.c lib1560.c lib1564.c lib1565.c \
+ lib1567.c lib1568.c lib1569.c lib1571.c \
+ lib1576.c \
+- lib1582.c \
++ lib1582.c lib1588.c \
+ lib1591.c lib1592.c lib1593.c lib1594.c lib1597.c \
+ lib1598.c lib1599.c \
+ lib1662.c \
+diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
+new file mode 100644
+index 0000000..9b12f36
+--- /dev/null
++++ b/tests/libtest/lib1588.c
+@@ -0,0 +1,150 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = URL
++ * argv2 = proxy host
++ * argv3 = proxy port
++ * argv4 = proxyuser:password
++ */
++
++#include "first.h"
++
++static CURLcode init1588(CURL *curl, const char *url,
++ const char *userpwd, const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(result)
++ goto init_failed;
++#if 0
++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
++ if(result)
++ goto init_failed;
++#endif
++
++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
++ if(result)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return result; /* failure */
++}
++
++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
++ const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ result = init1588(curl, url, userpwd, proxy);
++ if(result)
++ return result;
++
++ return curl_easy_perform(curl);
++}
++
++static CURLcode test_lib1588(const char *URL)
++{
++ CURLcode result = CURLE_OK;
++ CURL *curl = NULL;
++ const char *proxyuserpws = libtest_arg4;
++ struct curl_slist *host = NULL;
++ struct curl_slist *host2 = NULL;
++ char proxy1_resolve[128];
++ char proxy2_resolve[128];
++ char proxy1_connect[128];
++ char proxy2_connect[128];
++
++ if(test_argc < 3)
++ return TEST_ERR_MAJOR_BAD;
++
++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
++
++ /* we connect to the fake host name but the right port number */
++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
++ "firstproxy:%s", libtest_arg3);
++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
++ "secondproxy:%s", libtest_arg3);
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(result)
++ return result;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ host = curl_slist_append(NULL, proxy1_resolve);
++ if(!host)
++ goto test_cleanup;
++ host2 = curl_slist_append(host, proxy2_resolve);
++ if(!host2)
++ goto test_cleanup;
++ host = host2;
++
++ start_test_timing();
++
++ easy_setopt(curl, CURLOPT_RESOLVE, host);
++
++ result = run1588(curl, URL, proxyuserpws, proxy1_connect);
++ if(result)
++ goto test_cleanup;
++
++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
++
++ result = run1588(curl, URL, proxyuserpws, proxy2_connect);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ curl_slist_free_all(host);
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 683163bfa6..7996aa7d00 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -21,6 +21,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-6429-dependent.patch \
file://CVE-2026-6429.patch \
+ file://CVE-2026-7168.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-6429
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 10:56 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] and the required dependent change [2] to
address the netrc credential leak across redirects, as mentioned in [3] and
tracked by [4].
[1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
[2] https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134
[3] https://curl.se/docs/CVE-2026-6429.html
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../curl/curl/CVE-2026-6429-dependent.patch | 81 +++++
.../curl/curl/CVE-2026-6429.patch | 325 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 2 +
3 files changed, 408 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
new file mode 100644
index 0000000000..a3f68ae539
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
@@ -0,0 +1,81 @@
+From 6b1769c54659f1e6d6323891cb45c682c22182b7 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 15 Apr 2026 10:43:12 +0200
+Subject: [PATCH] urlapi: same origin tests
+
+Add new internal `curl_url_same_origin()` to check if a href has the
+same origin as a base URL. Add test cases in test1675 and use this in
+http2 push handling.
+
+Closes #21328
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134]
+
+Backport Changes:
+- curl 8.19.0 does not provide Curl_url_same_origin(), but the CVE-2026-6429
+ fix from https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
+ uses it in lib/http.c.
+- kept only the helper declaration and implementation of
+ lib/urlapi-int.h and lib/urlapi.c.
+- Excluded unrelated upstream test and HTTP/2 changes from that commit.
+
+(cherry picked from commit 32a513e180ce83d5e9b708211306045407074134)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/urlapi-int.h | 2 ++
+ lib/urlapi.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/lib/urlapi-int.h b/lib/urlapi-int.h
+index 29d4fe5f39..591062035b 100644
+--- a/lib/urlapi-int.h
++++ b/lib/urlapi-int.h
+@@ -40,4 +40,6 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
+ #define U_CURLU_URLDECODE (unsigned int)CURLU_URLDECODE
+ #define U_CURLU_PATH_AS_IS (unsigned int)CURLU_PATH_AS_IS
+
++bool Curl_url_same_origin(CURLU *base, CURLU *href);
++
+ #endif /* HEADER_CURL_URLAPI_INT_H */
+diff --git a/lib/urlapi.c b/lib/urlapi.c
+index a4b82f31bd..20c6585b55 100644
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -1996,3 +1996,36 @@ nomem:
+ }
+ return CURLUE_OK;
+ }
++
++bool Curl_url_same_origin(CURLU *base, CURLU *href)
++{
++ const struct Curl_scheme *s = NULL;
++
++ /* base must be an absolute URL */
++ if(!base->scheme || !base->host)
++ return FALSE;
++ if(href->scheme && !curl_strequal(base->scheme, href->scheme))
++ return FALSE;
++ if(href->host) {
++ if(!curl_strequal(base->host, href->host))
++ return FALSE;
++ if(!curl_strequal(base->port, href->port)) {
++ /* This may still match if only one has an explicit port
++ * and it is the default for the scheme. */
++ if(base->port && href->port)
++ return FALSE;
++
++ s = Curl_get_scheme(base->scheme);
++ if(!s) /* Cannot match default port for unknown scheme */
++ return FALSE;
++
++ /* The port which is set must be the default one */
++ if((base->port && (base->portnum != s->defport)) ||
++ (href->port && (href->portnum != s->defport)))
++ return FALSE;
++ }
++ }
++ else if(href->port) /* no host in href, then there must be no port */
++ return FALSE;
++ return TRUE;
++}
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
new file mode 100644
index 0000000000..76711aafc0
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
@@ -0,0 +1,325 @@
+From 1d36681ca0e453faf199f44c483077d929899906 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 16 Apr 2026 14:26:20 +0200
+Subject: [PATCH] http: clear credentials better on redirect
+
+Verify with test 2506: netrc with redirect using proxy
+
+Updated test 998 which was wrong.
+
+Reported-by: Muhamad Arga Reksapati
+
+Closes #21345
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
+
+Backport Changes:
+- Aligned with curl 8.19.0 by using the existing
+ Curl_safefree() instead of the curlx_safefree() macro.
+- The curlx_safefree() macro was introduced in curl 8.20.0 by:
+ https://github.com/curl/curl/commit/0df6c01db398f5e25d00a062aae56f2a89d8ff55
+
+(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 84 ++++++++++++--------------------------
+ tests/data/Makefile.am | 2 +-
+ tests/data/test2506 | 64 +++++++++++++++++++++++++++++
+ tests/data/test998 | 1 -
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib2506.c | 71 ++++++++++++++++++++++++++++++++
+ 6 files changed, 162 insertions(+), 62 deletions(-)
+ create mode 100644 tests/data/test2506
+ create mode 100644 tests/libtest/lib2506.c
+
+diff --git a/lib/http.c b/lib/http.c
+index b960d790a4..2596b4b3a2 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1201,75 +1201,41 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ return CURLE_OUT_OF_MEMORY;
+ }
+ else {
+- uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
+- if(uc)
++ bool same_origin;
++ CURLcode result;
++ CURLU *u = curl_url();
++ if(!u)
++ return CURLE_OUT_OF_MEMORY;
++ uc = curl_url_set(u, CURLUPART_URL,
++ Curl_bufref_ptr(&data->state.url),
++ CURLU_URLENCODE | CURLU_ALLOW_SPACE);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
++ if(uc) {
++ curl_url_cleanup(u);
+ return Curl_uc_to_curlcode(uc);
++ }
+
+- /* Clear auth if this redirects to a different port number or protocol,
+- unless permitted */
+- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
+- int port;
+- bool clear = FALSE;
+-
+- if(data->set.use_port && data->state.allow_port)
+- /* a custom port is used */
+- port = (int)data->set.use_port;
+- else {
+- curl_off_t value;
+- char *portnum;
+- const char *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+- CURLU_DEFAULT_PORT);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
+- p = portnum;
+- curlx_str_number(&p, &value, 0xffff);
+- port = (int)value;
+- curlx_free(portnum);
+- }
+- if(port != data->info.conn_remote_port) {
+- infof(data, "Clear auth, redirects to port from %u to %u",
+- data->info.conn_remote_port, port);
+- clear = TRUE;
+- }
+- else {
+- char *scheme;
+- const struct Curl_scheme *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
++ same_origin = Curl_url_same_origin(u, data->state.uh);
++ curl_url_cleanup(u);
+
+- p = Curl_get_scheme(scheme);
+- if(p && (p->protocol != data->info.conn_protocol)) {
+- infof(data, "Clear auth, redirects scheme from %s to %s",
+- data->info.conn_scheme, scheme);
+- clear = TRUE;
+- }
+- curlx_free(scheme);
+- }
+- if(clear) {
+- CURLcode result = Curl_reset_userpwd(data);
+- if(result) {
+- curlx_free(follow_url);
+- return result;
+- }
+- Curl_safefree(data->state.aptr.user);
+- Curl_safefree(data->state.aptr.passwd);
++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
++ !data->set.str[STRING_USERNAME]) {
++ result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
+ }
++ Curl_safefree(data->state.aptr.user);
++ Curl_safefree(data->state.aptr.passwd);
+ }
+- }
+- DEBUGASSERT(follow_url);
+- {
+- CURLcode result = Curl_reset_proxypwd(data);
++ result = Curl_reset_proxypwd(data);
+ if(result) {
+ curlx_free(follow_url);
+ return result;
+ }
+ }
++ DEBUGASSERT(follow_url);
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 00a5221d1f..1b76b01a8c 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -265,7 +265,7 @@ test2309 \
+ \
+ test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \
+ \
+-test2500 test2501 test2502 test2503 test2504 \
++test2500 test2501 test2502 test2503 test2504 test2506 \
+ \
+ test2600 test2601 test2602 test2603 test2604 test2605 \
+ \
+diff --git a/tests/data/test2506 b/tests/data/test2506
+new file mode 100644
+index 0000000000..9c65002496
+--- /dev/null
++++ b/tests/data/test2506
+@@ -0,0 +1,64 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 3
++Location: http://numbertwo.example/%TESTNUMBER0002
++
++ok
++</data>
++<data2 crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 4
++
++yes
++</data2>
++</reply>
++
++<client>
++<server>
++http
++</server>
++<features>
++proxy
++</features>
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++netrc with redirect using proxy
++</name>
++<file name="%LOGDIR/netrc2506">
++machine site.example login batman password robin
++</file>
++<command>
++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET http://site.example/ HTTP/1.1
++Host: site.example
++Authorization: Basic %b64[batman:robin]b64%
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://numbertwo.example/25060002 HTTP/1.1
++Host: numbertwo.example
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test998 b/tests/data/test998
+index 24d1d3dd4e..56dbc0c891 100644
+--- a/tests/data/test998
++++ b/tests/data/test998
+@@ -77,7 +77,6 @@ Proxy-Connection: Keep-Alive
+
+ GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
+ Host: somewhere.else.example
+-Authorization: Basic %b64[alberto:einstein]b64%
+ User-Agent: curl/%VERSION
+ Accept: */*
+ Proxy-Connection: Keep-Alive
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2319bafe72..2f77c16975 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -113,7 +113,7 @@ TESTS_C = \
+ lib2023.c lib2032.c lib2082.c \
+ lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \
+ lib2402.c lib2404.c lib2405.c \
+- lib2502.c lib2504.c \
++ lib2502.c lib2504.c lib2506.c \
+ lib2700.c \
+ lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \
+ lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \
+diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
+new file mode 100644
+index 0000000000..8b3b3429f9
+--- /dev/null
++++ b/tests/libtest/lib2506.c
+@@ -0,0 +1,71 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "first.h"
++
++#include "testtrace.h"
++
++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
++{
++ (void)ptr;
++ (void)ud;
++ return size * nmemb;
++}
++
++static CURLcode test_lib2506(const char *URL)
++{
++ CURL *curl;
++ CURLcode result = CURLE_OUT_OF_MEMORY;
++
++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++ curl_mfprintf(stderr, "curl_global_init() failed\n");
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
++ test_setopt(curl, CURLOPT_PROXY, URL);
++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
++
++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
++ credentials come from netrc */
++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
++
++ result = curl_easy_perform(curl);
++
++test_cleanup:
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index b1ee0f8b9b..683163bfa6 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -19,6 +19,8 @@ SRC_URI = " \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
+ file://CVE-2026-6429-dependent.patch \
+ file://CVE-2026-6429.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-6253
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 10:56 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the proxy credential leak on redirect
described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f
[2] https://curl.se/docs/CVE-2026-6253.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-6253
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../curl/curl/CVE-2026-6253.patch | 389 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 390 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6253.patch b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
new file mode 100644
index 0000000000..0e7dd72612
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
@@ -0,0 +1,389 @@
+From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 13 Apr 2026 17:17:23 +0200
+Subject: [PATCH] http: clear the proxy credentials as well on port or scheme
+ change
+
+Add tests 2009-2011 to verify switching between proxies with credentials
+when the switch is driven by a redirect
+
+Reported-by: Dwij Mehta
+
+Closes #21304
+
+CVE: CVE-2026-6253
+Upstream-Status: Backport [https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f]
+
+Backport Changes:
+- Adapted the redirect credential reset hunk to curl 8.19.0 Curl_http_follow() after the existing wrynose CVE-2026-6276 backport.
+- Adapted tests/data/Makefile.am placement for the wrynose test list.
+
+(cherry picked from commit 188c2f166a20fa97c2325b2da7d0e5cecc13725f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 12 +++++++
+ lib/transfer.c | 51 +++++++++++++++++++++---------
+ lib/transfer.h | 2 ++
+ tests/data/Makefile.am | 1 +
+ tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++
+ 7 files changed, 262 insertions(+), 15 deletions(-)
+ create mode 100644 tests/data/test2009
+ create mode 100644 tests/data/test2010
+ create mode 100644 tests/data/test2011
+
+diff --git a/lib/http.c b/lib/http.c
+index 7ebbdfa..b960d79 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1252,12 +1252,24 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ curlx_free(scheme);
+ }
+ if(clear) {
++ CURLcode result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
+ Curl_safefree(data->state.aptr.user);
+ Curl_safefree(data->state.aptr.passwd);
+ }
+ }
+ }
+ DEBUGASSERT(follow_url);
++ {
++ CURLcode result = Curl_reset_proxypwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
++ }
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/lib/transfer.c b/lib/transfer.c
+index 6dd2f52..af5bee2 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -439,6 +439,40 @@ void Curl_init_CONNECT(struct Curl_easy *data)
+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
+ }
+
++/*
++ * Restore the user credentials to those set in options.
++ */
++CURLcode Curl_reset_userpwd(struct Curl_easy *data)
++{
++ CURLcode result;
++ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD])
++ data->state.creds_from = CREDS_OPTION;
++ result = Curl_setstropt(&data->state.aptr.user,
++ data->set.str[STRING_USERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.passwd,
++ data->set.str[STRING_PASSWORD]);
++ return result;
++}
++
++/*
++ * Restore the proxy credentials to those set in options.
++ */
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data)
++{
++#ifndef CURL_DISABLE_PROXY
++ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser,
++ data->set.str[STRING_PROXYUSERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.proxypasswd,
++ data->set.str[STRING_PROXYPASSWORD]);
++ return result;
++#else
++ (void)data;
++ return CURLE_OK;
++#endif
++}
++
+ /*
+ * Curl_pretransfer() is called immediately before a transfer starts, and only
+ * once for one transfer no matter if it has redirects or do multi-pass
+@@ -584,23 +618,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+- if(data->set.str[STRING_USERNAME] ||
+- data->set.str[STRING_PASSWORD])
+- data->state.creds_from = CREDS_OPTION;
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.user,
+- data->set.str[STRING_USERNAME]);
++ result = Curl_reset_userpwd(data);
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.passwd,
+- data->set.str[STRING_PASSWORD]);
+-#ifndef CURL_DISABLE_PROXY
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxyuser,
+- data->set.str[STRING_PROXYUSERNAME]);
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxypasswd,
+- data->set.str[STRING_PROXYPASSWORD]);
+-#endif
++ result = Curl_reset_proxypwd(data);
+
+ data->req.headerbytecount = 0;
+ Curl_headers_cleanup(data);
+diff --git a/lib/transfer.h b/lib/transfer.h
+index 05a5f89..131e31a 100644
+--- a/lib/transfer.h
++++ b/lib/transfer.h
+@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data,
+
+ void Curl_init_CONNECT(struct Curl_easy *data);
+
++CURLcode Curl_reset_userpwd(struct Curl_easy *data);
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data);
+ CURLcode Curl_pretransfer(struct Curl_easy *data);
+
+ CURLcode Curl_sendrecv(struct Curl_easy *data);
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index da0f8f5..00a5221 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -244,6 +244,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
+ test1978 test1979 test1980 test1981 \
+ \
+ test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
++test2009 test2010 test2011 \
+ \
+ test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+diff --git a/tests/data/test2009 b/tests/data/test2009
+new file mode 100644
+index 0000000..d2fd79e
+--- /dev/null
++++ b/tests/data/test2009
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via env variables, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2010 b/tests/data/test2010
+new file mode 100644
+index 0000000..443ae9d
+--- /dev/null
++++ b/tests/data/test2010
+@@ -0,0 +1,71 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via options for two proxies, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2011 b/tests/data/test2011
+new file mode 100644
+index 0000000..dd4e534
+--- /dev/null
++++ b/tests/data/test2011
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy creds via env, cross-scheme redirect, --location-trusted
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --location-trusted --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 558a2d311e..b1ee0f8b9b 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -18,6 +18,7 @@ SRC_URI = " \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-5545
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 10:56 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the Negotiate-authenticated connection
reuse issue described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd
[2] https://curl.se/docs/CVE-2026-5545.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-5545
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../curl/curl/CVE-2026-5545.patch | 43 +++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
new file mode 100644
index 0000000000..bb3b1407d4
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
@@ -0,0 +1,43 @@
+From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 2 Apr 2026 11:33:39 +0200
+Subject: [PATCH] url: improve connection reuse on negotiate
+
+Check state of negotiate to allow proper connection reuse.
+
+Closes #21203
+
+CVE: CVE-2026-5545
+Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd]
+
+(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index b9e308a..7c24f1a 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1110,11 +1110,17 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+ if(m->want_ntlm_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
+-
+ /* we prefer a credential match, but this is at least a connection
+- that can be reused and "upgraded" to NTLM */
+- if(conn->http_ntlm_state == NTLMSTATE_NONE)
++ that can be reused and "upgraded" to NTLM if it does
++ not have any auth ongoing. */
++#ifdef USE_SPNEGO
++ if((conn->http_ntlm_state == NTLMSTATE_NONE)
++ && (conn->http_negotiate_state == GSS_AUTHNONE)) {
++#else
++ if(conn->http_ntlm_state == NTLMSTATE_NONE) {
++#endif
+ m->found = conn;
++ }
+ return FALSE;
+ }
+ }
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 1cda69401b..558a2d311e 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -17,6 +17,7 @@ SRC_URI = " \
file://CVE-2026-6276.patch \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
+ file://CVE-2026-5545.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 10:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
- CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
transfer.
- In wrynose, these protocols are optional PACKAGECONFIG entries and are not
enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
for the default recipe configuration.
Reference:
- https://curl.se/docs/CVE-2026-4873.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4873
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 3326f478b5..1cda69401b 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -28,6 +28,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33
# Curl has used many names over the years...
CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2026-4873] = "${@bb.utils.contains_any('PACKAGECONFIG', 'imap pop3 smtp', 'unpatched', 'not-applicable-config: clear-text imap/pop3/smtp support is not enabled in PACKAGECONFIG', d)}"
inherit autotools pkgconfig binconfig multilib_header ptest
--
2.35.6
^ permalink raw reply related
* Re: [OE-core] [scarthgap][PATCH] binutils: fix CVE-2025-69645
From: Yoann Congal @ 2026-07-20 9:51 UTC (permalink / raw)
To: Roland Kovács, openembedded-core@lists.openembedded.org
In-Reply-To: <f81d8c26b92fdb73043c336630ecc54233da05f5.camel@est.tech>
On Mon Jul 20, 2026 at 11:46 AM CEST, Roland Kovács wrote:
> On Sun, 2026-07-19 at 22:43 +0200, Yoann Congal wrote:
>> Hello,
>>
>> On Thu Jul 16, 2026 at 11:58 AM CEST, Roland Kovács via lists.openembedded.org wrote:
>> > Binutils objdump contains a denial-of-service vulnerability when processing
>> > a crafted binary with malformed DWARF debug information. A logic error in
>> > the handling of DWARF compilation units can result in an invalid offset_size
>> > value being used inside byte_get_little_endian, leading to an abort (SIGABRT).
>> > A local attacker can trigger the crash by supplying a malicious input file.
>> >
>> > Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
>> > ---
>> > .../binutils/binutils-2.42.inc | 1 +
>> > .../binutils/binutils/CVE-2025-69645.patch | 135 ++++++++++++++++++
>> > 2 files changed, 136 insertions(+)
>> > create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
>>
>> More than a description of the vulnerability, what we need in the commit
>> message is a justification for the patch: i.e. why this is the patch we
>> should take to fix this CVE? In this case, this is trivial, this is the
>> patch referenced from the NVD page, so I've added it.
> I'll keep this in mind, thanks.
>
>>
>> Also, the NVD entry looks wrong: only the 2.44 version is said impacted
>> but the patches to fix apply way more than that.
> NVD data marks any version affected, 2.44 is __mentioned__ in the description but no filter or bound
> is set in the CVE metadata.
The NVD CPE is:
"cpe:2.3:a:gnu:binutils:2.44:*:*:*:*:*:*:*"
If I read that correctly, that mean only 2.44 is affected.
>> Can you reach them and fix the NVD data?
> I can ask upstream who issued the CVE to set 2.46 as unaffected/fixed based on their bugtracker, but
> that's about it.
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core] [scarthgap][PATCH] binutils: fix CVE-2025-69645
From: Roland Kovács @ 2026-07-20 9:46 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org, yoann.congal@smile.fr
In-Reply-To: <DK2U92VVUXKE.2HBXKS4ZWACG@smile.fr>
On Sun, 2026-07-19 at 22:43 +0200, Yoann Congal wrote:
> Hello,
>
> On Thu Jul 16, 2026 at 11:58 AM CEST, Roland Kovács via lists.openembedded.org wrote:
> > Binutils objdump contains a denial-of-service vulnerability when processing
> > a crafted binary with malformed DWARF debug information. A logic error in
> > the handling of DWARF compilation units can result in an invalid offset_size
> > value being used inside byte_get_little_endian, leading to an abort (SIGABRT).
> > A local attacker can trigger the crash by supplying a malicious input file.
> >
> > Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
> > ---
> > .../binutils/binutils-2.42.inc | 1 +
> > .../binutils/binutils/CVE-2025-69645.patch | 135 ++++++++++++++++++
> > 2 files changed, 136 insertions(+)
> > create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
>
> More than a description of the vulnerability, what we need in the commit
> message is a justification for the patch: i.e. why this is the patch we
> should take to fix this CVE? In this case, this is trivial, this is the
> patch referenced from the NVD page, so I've added it.
I'll keep this in mind, thanks.
>
> Also, the NVD entry looks wrong: only the 2.44 version is said impacted
> but the patches to fix apply way more than that.
NVD data marks any version affected, 2.44 is __mentioned__ in the description but no filter or bound
is set in the CVE metadata.
> Can you reach them and fix the NVD data?
I can ask upstream who issued the CVE to set 2.46 as unaffected/fixed based on their bugtracker, but
that's about it.
>
> Thanks!
^ permalink raw reply
* [PATCH v3 0/3] kernel: make the kernel toolchain switchable to clang
From: mark.yang @ 2026-07-20 9:31 UTC (permalink / raw)
To: openembedded-core; +Cc: mark.yang
From: "mark.yang" <mark.yang@lge.com>
Since v1, clang kernel toolchain support has been merged to master
with 928d81916f ("kernel-arch: Add clang toolchain support") and
e88ee794a3 ("kernel-yocto: Set CLANG_FLAGS for kernel config checks
when using clang"), superseding two of the three v1 patches. As
discussed on the v1 thread, this rework contains what remains on top
of current master.
On current master a clang kernel only builds when ld-is-lld happens to
be in DISTRO_FEATURES, since nothing else stages a bare ld.lld:
scripts/Kconfig.include:41: linker 'ld.lld ' not found
Full log: https://errors.yoctoproject.org/Errors/Build/242422/
Patch 1 falls back to GNU ld in that case.
kbuild wants the same toolchain for every make invocation against a
build tree (Documentation/kbuild/llvm.rst: "The same value used for
LLVM= should be set for each invocation of make"), and the out-of-tree
module and make-mod-scripts builds run make against that same tree.
Setting TOOLCHAIN on the kernel recipe alone leaves them on the gcc
defaults: kbuild spots the CC_VERSION_TEXT mismatch and silently
regenerates .config. On current master, building cryptodev-module
after a clang kernel succeeds without a warning, produces a gcc .ko
and flips the shared .config back to CONFIG_CC_IS_GCC.
The toolchain has to be known at parse time to set up the cross
toolchain dependencies, so this needs to be a configuration variable.
Patch 2 moves modules and make-mod-scripts onto explicit cross
toolchain dependencies and patch 3 adds a KERNEL_TOOLCHAIN switch
covering the kernel, modules and make-mod-scripts.
Tested on qemux86-64 (master aa33c4317d, clang 22.1.8, gcc 16.1.0):
with KERNEL_TOOLCHAIN unset, core-image-minimal and cryptodev-module
build with gcc as before. With KERNEL_TOOLCHAIN = "clang" the kernel,
make-mod-scripts and cryptodev-module all build with clang, the shared
.config keeps CONFIG_CC_IS_CLANG after the module build, and linking
uses GNU ld, or LLD with ld-is-lld in DISTRO_FEATURES. u-boot keeps
building with gcc.
mark.yang (3):
kernel-arch: fall back to GNU ld unless ld-is-lld is in
DISTRO_FEATURES
module.bbclass/make-mod-scripts: inhibit default dependencies
kernel: add KERNEL_TOOLCHAIN to switch the whole kernel toolchain
meta/classes-recipe/kernel-arch.bbclass | 3 ++-
meta/classes-recipe/kernel.bbclass | 1 +
meta/classes-recipe/module-base.bbclass | 1 +
meta/classes-recipe/module.bbclass | 3 +++
meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb | 4 ++++
5 files changed, 11 insertions(+), 1 deletion(-)
^ permalink raw reply
* [PATCH v3 2/3] module.bbclass/make-mod-scripts: inhibit default dependencies
From: mark.yang @ 2026-07-20 9:31 UTC (permalink / raw)
To: openembedded-core; +Cc: mark.yang
In-Reply-To: <20260720093119.3245892-1-mark.yang@lge.com>
From: "mark.yang" <mark.yang@lge.com>
Modules and make-mod-scripts build against the shared kernel build
tree with the kernel toolchain, so the default virtual/libc and
virtual/compilerlibs dependencies are unused. Inhibit them and add
the cross toolchain explicitly, as kernel.bbclass does, which also
keeps compiler-rt and libcxx out of module builds with clang.
Signed-off-by: mark.yang <mark.yang@lge.com>
---
v3: no changes
v2: split out of the KERNEL_TOOLCHAIN patch
meta/classes-recipe/module.bbclass | 3 +++
meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb | 3 +++
2 files changed, 6 insertions(+)
diff --git a/meta/classes-recipe/module.bbclass b/meta/classes-recipe/module.bbclass
index 6b2c09f441..ce5898125b 100644
--- a/meta/classes-recipe/module.bbclass
+++ b/meta/classes-recipe/module.bbclass
@@ -6,6 +6,9 @@
inherit module-base kernel-module-split pkgconfig
+INHIBIT_DEFAULT_DEPS = "1"
+DEPENDS += "virtual/cross-cc virtual/cross-binutils"
+
EXTRA_OEMAKE += "KERNEL_SRC=${STAGING_KERNEL_DIR}"
MODULES_INSTALL_TARGET ?= "modules_install"
diff --git a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
index 4b0630313f..338a50de91 100644
--- a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
+++ b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
@@ -18,6 +18,9 @@ DEV_PKG_DEPENDENCY = ""
DEPENDS += "bc-native bison-native"
DEPENDS += "gmp-native"
+INHIBIT_DEFAULT_DEPS = "1"
+DEPENDS += "virtual/cross-cc virtual/cross-binutils"
+
EXTRA_OEMAKE = " HOSTCC="${BUILD_CC}" HOSTCFLAGS="${BUILD_CFLAGS}" HOSTLDFLAGS="${BUILD_LDFLAGS}" HOSTCPP="${BUILD_CPP}""
EXTRA_OEMAKE += " HOSTCXX="${BUILD_CXX} ${BUILD_CXXFLAGS} ${BUILD_LDFLAGS}" CROSS_COMPILE=${TARGET_PREFIX}"
^ permalink raw reply related
* [PATCH v3] kernel: add KERNEL_TOOLCHAIN to switch the whole kernel toolchain
From: mark.yang @ 2026-07-20 9:31 UTC (permalink / raw)
To: openembedded-core; +Cc: mark.yang
In-Reply-To: <20260720093119.3245892-1-mark.yang@lge.com>
From: "mark.yang" <mark.yang@lge.com>
Setting TOOLCHAIN on the kernel recipe alone leaves modules and
make-mod-scripts running make against the shared build tree with gcc;
kbuild spots the CC_VERSION_TEXT mismatch and silently regenerates
the shared .config. Add a KERNEL_TOOLCHAIN switch so the kernel,
modules and make-mod-scripts change toolchain together, gcc by default.
Set TOOLCHAIN from it in the kbuild consumers rather than in
kernel-arch: kernel-arch is also inherited by u-boot and barebox for
the ARCH mapping, and the u-boot kbuild hardcodes ${CROSS_COMPILE}gcc,
so switching them too would drop the gcc cross dependency they need:
/bin/sh: 1: x86_64-oe-linux-gcc: not found
Full log: https://errors.yoctoproject.org/Errors/Build/242654/
Signed-off-by: mark.yang <mark.yang@lge.com>
---
v3: set TOOLCHAIN from the kbuild consumers instead of kernel-arch,
which is also inherited by u-boot and barebox
v2: rebased on the merged clang toolchain support which supersedes
the other v1 patches; dependency changes split out into patch 2
meta/classes-recipe/kernel-arch.bbclass | 1 +
meta/classes-recipe/kernel.bbclass | 1 +
meta/classes-recipe/module-base.bbclass | 1 +
meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb | 1 +
4 files changed, 4 insertions(+)
diff --git a/meta/classes-recipe/kernel-arch.bbclass b/meta/classes-recipe/kernel-arch.bbclass
index 321c9ed577..b15e0aca80 100644
--- a/meta/classes-recipe/kernel-arch.bbclass
+++ b/meta/classes-recipe/kernel-arch.bbclass
@@ -92,4 +92,5 @@ KERNEL_LD:toolchain-clang = "${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld'
KERNEL_AR:toolchain-clang = "llvm-ar ${HOST_AR_KERNEL_ARCH}"
KERNEL_OBJCOPY:toolchain-clang = "llvm-objcopy ${HOST_OBJCOPY_KERNEL_ARCH}"
KERNEL_STRIP:toolchain-clang = "llvm-strip"
+KERNEL_TOOLCHAIN ?= "gcc"
TOOLCHAIN = "gcc"
diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index 48e394b650..a90122354a 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -214,6 +214,7 @@ python do_symlink_kernsrc () {
addtask symlink_kernsrc before do_patch do_configure after do_unpack
inherit kernel-arch deploy
+TOOLCHAIN = "${KERNEL_TOOLCHAIN}"
PACKAGES_DYNAMIC += "^${KERNEL_PACKAGE_NAME}-module-.*"
PACKAGES_DYNAMIC += "^${KERNEL_PACKAGE_NAME}-image-.*"
diff --git a/meta/classes-recipe/module-base.bbclass b/meta/classes-recipe/module-base.bbclass
index 2a225881ba..cae71a9b15 100644
--- a/meta/classes-recipe/module-base.bbclass
+++ b/meta/classes-recipe/module-base.bbclass
@@ -5,6 +5,7 @@
#
inherit kernel-arch
+TOOLCHAIN = "${KERNEL_TOOLCHAIN}"
# We do the dependency this way because the output is not preserved
# in sstate, so we must force do_compile to run (once).
diff --git a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
index 338a50de91..d11afa86a1 100644
--- a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
+++ b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb
@@ -4,6 +4,7 @@ LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
inherit kernel-arch linux-kernel-base
+TOOLCHAIN = "${KERNEL_TOOLCHAIN}"
inherit pkgconfig
PACKAGE_ARCH = "${MACHINE_ARCH}"
^ permalink raw reply related
* [PATCH v3 1/3] kernel-arch: fall back to GNU ld unless ld-is-lld is in DISTRO_FEATURES
From: mark.yang @ 2026-07-20 9:31 UTC (permalink / raw)
To: openembedded-core; +Cc: mark.yang
In-Reply-To: <20260720093119.3245892-1-mark.yang@lge.com>
From: "mark.yang" <mark.yang@lge.com>
Nothing stages a bare ld.lld unless ld-is-lld is in DISTRO_FEATURES,
so a clang kernel fails its first linker check on any other setup.
Use GNU ld.bfd from binutils-cross instead.
Signed-off-by: mark.yang <mark.yang@lge.com>
---
v3: no changes
v2: new patch; the merged clang support uses a bare ld.lld which
nothing stages without ld-is-lld
meta/classes-recipe/kernel-arch.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes-recipe/kernel-arch.bbclass b/meta/classes-recipe/kernel-arch.bbclass
index 6ebc0f13ea..321c9ed577 100644
--- a/meta/classes-recipe/kernel-arch.bbclass
+++ b/meta/classes-recipe/kernel-arch.bbclass
@@ -88,7 +88,7 @@ KERNEL_CC:toolchain-clang = "${CCACHE}clang ${HOST_CC_KERNEL_ARCH} \
-ffile-prefix-map=${STAGING_KERNEL_DIR}=${KERNEL_SRC_PATH} \
-ffile-prefix-map=${STAGING_KERNEL_BUILDDIR}=${KERNEL_SRC_PATH} \
"
-KERNEL_LD:toolchain-clang = "ld.lld ${HOST_LD_KERNEL_ARCH}"
+KERNEL_LD:toolchain-clang = "${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld', 'ld.lld', '${HOST_PREFIX}ld.bfd', d)} ${HOST_LD_KERNEL_ARCH}"
KERNEL_AR:toolchain-clang = "llvm-ar ${HOST_AR_KERNEL_ARCH}"
KERNEL_OBJCOPY:toolchain-clang = "llvm-objcopy ${HOST_OBJCOPY_KERNEL_ARCH}"
KERNEL_STRIP:toolchain-clang = "llvm-strip"
^ permalink raw reply related
* Re: [OE-core] [PATCH 03/12] libpsl: use libidn2 instead of ICU
From: Ross Burton @ 2026-07-20 9:11 UTC (permalink / raw)
To: Khem Raj; +Cc: openembedded-core@lists.openembedded.org
In-Reply-To: <CAMKF1sqTS3TAN7Xmsb=enK45PZeazgrCd8zPr95_GSUzs4LqeA@mail.gmail.com>
On 18 Jul 2026, at 17:08, Khem Raj <raj.khem@gmail.com> wrote:
> libidn2 default was switched to build non-GPL3 images conveniently by
> switching to use ICU, where ICU is used by embedded systems more commonly
> than libidn2.
Luckily the library is dual-licensed which should help this. Only the -bin package is v3-only.
> Switch back to libidn2 to respect upstream's opinion, and because ICU is
> a monolithic dependency: this switch causes a minimal image containg
> libpsl to shrink by ~30MB.
>
> Which production image are you building ?
Production images are obviously hard to compare, so I was comparing minimal. Basically ICU is large, libidn2 is likely already present (gnutls and curl use it by default), so if you’re not otherwise using ICU that’s a big saving.
Ross
^ permalink raw reply
* [PATCH 5/5] mesa: Ugrade 26.1.4 -> 26.1.5
From: Richard Purdie @ 2026-07-20 8:32 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720083258.770582-1-richard.purdie@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
...-freedreno-don-t-encode-build-path-into-binaries.patch | 4 ++--
.../0001-gallivm-Fix-armhf-build-against-LLVM-22.patch | 4 ++--
...001-meson-misdetects-64bit-atomics-on-mips-clang.patch | 2 +-
...intel-compiler-jay-fix-GCC-10-case-label-declara.patch | 5 +----
...intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch | 5 +----
...util-u_math.c-do-not-use-arm-fpu-instructions-if.patch | 8 ++++----
meta/recipes-graphics/mesa/mesa.inc | 4 ++--
7 files changed, 13 insertions(+), 19 deletions(-)
diff --git a/meta/recipes-graphics/mesa/files/0001-freedreno-don-t-encode-build-path-into-binaries.patch b/meta/recipes-graphics/mesa/files/0001-freedreno-don-t-encode-build-path-into-binaries.patch
index e976b3399f4..3e00556b71e 100644
--- a/meta/recipes-graphics/mesa/files/0001-freedreno-don-t-encode-build-path-into-binaries.patch
+++ b/meta/recipes-graphics/mesa/files/0001-freedreno-don-t-encode-build-path-into-binaries.patch
@@ -1,4 +1,4 @@
-From 4ef7487109f9acfa2baf1a2224da31a0ae0c74c6 Mon Sep 17 00:00:00 2001
+From ddb43c52638b96c17392d08508609525b7db9a06 Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Date: Wed, 10 Dec 2025 02:27:16 +0200
Subject: [PATCH] freedreno: don't encode build path into binaries
@@ -25,7 +25,7 @@ Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/freedreno/meson.build b/src/freedreno/meson.build
-index a4bfd33..330b646 100644
+index e8f01b8..8144a75 100644
--- a/src/freedreno/meson.build
+++ b/src/freedreno/meson.build
@@ -4,9 +4,10 @@
diff --git a/meta/recipes-graphics/mesa/files/0001-gallivm-Fix-armhf-build-against-LLVM-22.patch b/meta/recipes-graphics/mesa/files/0001-gallivm-Fix-armhf-build-against-LLVM-22.patch
index 065dd373a7b..7e5a8276615 100644
--- a/meta/recipes-graphics/mesa/files/0001-gallivm-Fix-armhf-build-against-LLVM-22.patch
+++ b/meta/recipes-graphics/mesa/files/0001-gallivm-Fix-armhf-build-against-LLVM-22.patch
@@ -1,4 +1,4 @@
-From 2a40c481affef4df729d794daf378ed2e0184895 Mon Sep 17 00:00:00 2001
+From 41306cf1df603613e98baf2cbab2fc27dad95ea7 Mon Sep 17 00:00:00 2001
From: Alessandro Astone <ales.astone@gmail.com>
Date: Sun, 1 Mar 2026 18:14:09 +0100
Subject: [PATCH] gallivm: Fix armhf build against LLVM 22
@@ -13,7 +13,7 @@ Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp b/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp
-index d3ad342..c95d86e 100644
+index ce8ca02..86779f0 100644
--- a/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp
+++ b/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp
@@ -331,7 +331,7 @@ lp_build_fill_mattrs(std::vector<std::string> &MAttrs)
diff --git a/meta/recipes-graphics/mesa/files/0001-meson-misdetects-64bit-atomics-on-mips-clang.patch b/meta/recipes-graphics/mesa/files/0001-meson-misdetects-64bit-atomics-on-mips-clang.patch
index b039ac213ea..82293dbf6e3 100644
--- a/meta/recipes-graphics/mesa/files/0001-meson-misdetects-64bit-atomics-on-mips-clang.patch
+++ b/meta/recipes-graphics/mesa/files/0001-meson-misdetects-64bit-atomics-on-mips-clang.patch
@@ -1,4 +1,4 @@
-From 8943b38a0c14b220e3e173c038c87ce9a697c173 Mon Sep 17 00:00:00 2001
+From c21d65f05381c7a836d93494acdb7e5ffb28aefe Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Mon, 13 Jan 2020 15:23:47 -0800
Subject: [PATCH] meson misdetects 64bit atomics on mips/clang
diff --git a/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-fix-GCC-10-case-label-declara.patch b/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-fix-GCC-10-case-label-declara.patch
index b8b87189798..3340b7e103d 100644
--- a/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-fix-GCC-10-case-label-declara.patch
+++ b/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-fix-GCC-10-case-label-declara.patch
@@ -1,4 +1,4 @@
-From 0b4b577b7fc926d374234c80267a4bf9dcccb7ef Mon Sep 17 00:00:00 2001
+From 03df406963de6ebc40809dc22415c1715a08a905 Mon Sep 17 00:00:00 2001
From: Wang Mingyu <wangmy@fujitsu.com>
Date: Tue, 16 Jun 2026 09:12:34 +0000
Subject: [PATCH] src/intel/compiler/jay: fix GCC 10 case label declaration
@@ -37,6 +37,3 @@ index 62b9576..a0a9498 100644
case JAY_OPCODE_DESWIZZLE_EVEN:
brw_set_default_exec_size(p, BRW_EXECUTE_16);
---
-2.43.0
-
diff --git a/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch b/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch
index 904b20d4400..bc8b3e99e97 100644
--- a/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch
+++ b/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch
@@ -1,4 +1,4 @@
-From 3adae0d97f655c2991d5b428a3bc95a972e6228b Mon Sep 17 00:00:00 2001
+From 7735c1b9b97809ab97c38cd6bed26f3af1c28d5b Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex@linutronix.de>
Date: Sun, 14 Jun 2026 17:42:19 +0200
Subject: [PATCH] src/intel/compiler/jay/jay_ir.h: do not used typed enum
@@ -34,6 +34,3 @@ index 8307044..abf175a 100644
enum jay_conditional_mod conditional_mod;
jay_def cond_flag; /**< conditional flag */
---
-2.47.3
-
diff --git a/meta/recipes-graphics/mesa/files/0001-src-util-u_math.c-do-not-use-arm-fpu-instructions-if.patch b/meta/recipes-graphics/mesa/files/0001-src-util-u_math.c-do-not-use-arm-fpu-instructions-if.patch
index be79e29e420..2c381828fdb 100644
--- a/meta/recipes-graphics/mesa/files/0001-src-util-u_math.c-do-not-use-arm-fpu-instructions-if.patch
+++ b/meta/recipes-graphics/mesa/files/0001-src-util-u_math.c-do-not-use-arm-fpu-instructions-if.patch
@@ -1,4 +1,4 @@
-From 013717829278f02b0815d80a423e05e4bd567ae3 Mon Sep 17 00:00:00 2001
+From 589921de37e1658b0ca4984ec68d45ecb8c57659 Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex@linutronix.de>
Date: Wed, 1 Jul 2026 22:48:15 +0200
Subject: [PATCH] src/util/u_math.c: do not use arm fpu instructions if fpu is
@@ -11,10 +11,10 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/util/u_math.c b/src/util/u_math.c
-index 337baa9..9ad03bf 100644
+index 722eac7..8bcfefa 100644
--- a/src/util/u_math.c
+++ b/src/util/u_math.c
-@@ -86,7 +86,7 @@ util_fpstate_get(void)
+@@ -90,7 +90,7 @@ util_fpstate_get(void)
if (util_get_cpu_caps()->has_neon) {
#ifdef HAVE___BUILTIN_ARM_GET_FPSCR
fpstate = __builtin_arm_get_fpscr();
@@ -23,7 +23,7 @@ index 337baa9..9ad03bf 100644
__asm__ volatile("vmrs %0, fpscr" : "=r"(fpstate));
#endif
}
-@@ -151,7 +151,7 @@ util_fpstate_set(unsigned fpstate)
+@@ -157,7 +157,7 @@ util_fpstate_set(unsigned fpstate)
if (util_get_cpu_caps()->has_neon) {
#ifdef HAVE___BUILTIN_ARM_SET_FPSCR
__builtin_arm_set_fpscr(fpstate);
diff --git a/meta/recipes-graphics/mesa/mesa.inc b/meta/recipes-graphics/mesa/mesa.inc
index bb071e24119..15d56c804dc 100644
--- a/meta/recipes-graphics/mesa/mesa.inc
+++ b/meta/recipes-graphics/mesa/mesa.inc
@@ -23,8 +23,8 @@ SRC_URI = "https://archive.mesa3d.org/mesa-${PV}.tar.xz \
file://0001-src-util-u_math.c-do-not-use-arm-fpu-instructions-if.patch \
"
-SRC_URI[sha256sum] = "072705caa9adf4740f1489194b13e278ad959166863b5271fe423a86353c9ab6"
-PV = "26.1.4"
+SRC_URI[sha256sum] = "79e421c7ce18cd9e790b8375920325779f10798630bf30e0b22f1a21c8617122"
+PV = "26.1.5"
UPSTREAM_CHECK_GITTAGREGEX = "mesa-(?P<pver>\d+(\.\d+)+)"
^ permalink raw reply related
* [PATCH 2/5] python3-websockets: upgrade 16.1 -> 16.1.1
From: Richard Purdie @ 2026-07-20 8:32 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720083258.770582-1-richard.purdie@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
...{python3-websockets_16.1.bb => python3-websockets_16.1.1.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3-websockets_16.1.bb => python3-websockets_16.1.1.bb} (79%)
diff --git a/meta/recipes-devtools/python/python3-websockets_16.1.bb b/meta/recipes-devtools/python/python3-websockets_16.1.1.bb
similarity index 79%
rename from meta/recipes-devtools/python/python3-websockets_16.1.bb
rename to meta/recipes-devtools/python/python3-websockets_16.1.1.bb
index 0f819aecfd6..2e2eb0c3ed1 100644
--- a/meta/recipes-devtools/python/python3-websockets_16.1.bb
+++ b/meta/recipes-devtools/python/python3-websockets_16.1.1.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=51924a6af4495b8cfaee1b1da869b6f4"
inherit pypi python_setuptools_build_meta
-SRC_URI[sha256sum] = "299468cbe42e2b9981134c7c51d99387d8a7bf562b00183b3eec53f882846dad"
+SRC_URI[sha256sum] = "db234eda965dcce15df96bb9709f587cd87d4d52aaf0e80e2f34ec04c7670c57"
BBCLASSEXTEND = "native nativesdk"
^ permalink raw reply related
* [PATCH 1/5] diffoscope: upgrade 324 -> 325
From: Richard Purdie @ 2026-07-20 8:32 UTC (permalink / raw)
To: openembedded-core
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../diffoscope/{diffoscope_324.bb => diffoscope_325.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/diffoscope/{diffoscope_324.bb => diffoscope_325.bb} (93%)
diff --git a/meta/recipes-support/diffoscope/diffoscope_324.bb b/meta/recipes-support/diffoscope/diffoscope_325.bb
similarity index 93%
rename from meta/recipes-support/diffoscope/diffoscope_324.bb
rename to meta/recipes-support/diffoscope/diffoscope_325.bb
index 822446e9857..521b2b5b04d 100644
--- a/meta/recipes-support/diffoscope/diffoscope_324.bb
+++ b/meta/recipes-support/diffoscope/diffoscope_325.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
inherit pypi setuptools3
-SRC_URI[sha256sum] = "daf539d33140ecd4c5dcf18c894bbc09aeab5307b44de28b12ca34434d47c5ba"
+SRC_URI[sha256sum] = "d74a2edb0555a9ee306d5362b921f80c144bb941c0a6d61794473d1540d729ad"
RDEPENDS:${PN} += "\
binutils \
^ permalink raw reply related
* [PATCH 4/5] python3-uv-build: upgrade 0.11.28 -> 0.11.29
From: Richard Purdie @ 2026-07-20 8:32 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720083258.770582-1-richard.purdie@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../python/python3-uv-build-crates.inc | 88 ++++++-------------
...0.11.28.bb => python3-uv-build_0.11.29.bb} | 2 +-
2 files changed, 27 insertions(+), 63 deletions(-)
rename meta/recipes-devtools/python/{python3-uv-build_0.11.28.bb => python3-uv-build_0.11.29.bb} (92%)
diff --git a/meta/recipes-devtools/python/python3-uv-build-crates.inc b/meta/recipes-devtools/python/python3-uv-build-crates.inc
index 97225725c2f..f1de38878c2 100644
--- a/meta/recipes-devtools/python/python3-uv-build-crates.inc
+++ b/meta/recipes-devtools/python/python3-uv-build-crates.inc
@@ -12,9 +12,9 @@ SRC_URI += " \
crate://crates.io/anstyle-wincon/3.0.11 \
crate://crates.io/anyhow/1.0.103 \
crate://crates.io/arcstr/1.2.0 \
- crate://crates.io/arrayvec/0.7.7 \
+ crate://crates.io/arrayvec/0.7.8 \
crate://crates.io/astral-tokio-tar/0.6.3 \
- crate://crates.io/astral-version-ranges/0.2.0 \
+ crate://crates.io/astral-version-ranges/0.2.1 \
crate://crates.io/astral_async_zip/0.0.20 \
crate://crates.io/async-compression/0.4.19 \
crate://crates.io/autocfg/1.5.0 \
@@ -39,7 +39,7 @@ SRC_URI += " \
crate://crates.io/clap_derive/4.6.1 \
crate://crates.io/clap_lex/1.1.0 \
crate://crates.io/colorchoice/1.0.5 \
- crate://crates.io/console/0.16.3 \
+ crate://crates.io/console/0.16.4 \
crate://crates.io/cpufeatures/0.2.17 \
crate://crates.io/crc32fast/1.5.0 \
crate://crates.io/crypto-common/0.1.7 \
@@ -69,7 +69,7 @@ SRC_URI += " \
crate://crates.io/foldhash/0.1.5 \
crate://crates.io/foldhash/0.2.0 \
crate://crates.io/form_urlencoded/1.2.2 \
- crate://crates.io/fs-err/3.3.0 \
+ crate://crates.io/fs-err/3.3.1 \
crate://crates.io/futures/0.3.32 \
crate://crates.io/futures-channel/0.3.32 \
crate://crates.io/futures-core/0.3.32 \
@@ -81,8 +81,7 @@ SRC_URI += " \
crate://crates.io/futures-task/0.3.32 \
crate://crates.io/futures-util/0.3.32 \
crate://crates.io/generic-array/0.14.7 \
- crate://crates.io/getrandom/0.3.3 \
- crate://crates.io/getrandom/0.4.1 \
+ crate://crates.io/getrandom/0.4.3 \
crate://crates.io/globset/0.4.18 \
crate://crates.io/gloo-timers/0.3.0 \
crate://crates.io/hashbrown/0.15.5 \
@@ -96,7 +95,6 @@ SRC_URI += " \
crate://crates.io/icu_properties/2.1.2 \
crate://crates.io/icu_properties_data/2.1.2 \
crate://crates.io/icu_provider/2.1.1 \
- crate://crates.io/id-arena/2.3.0 \
crate://crates.io/idna/1.1.0 \
crate://crates.io/idna_adapter/1.2.1 \
crate://crates.io/indexmap/2.14.0 \
@@ -105,15 +103,14 @@ SRC_URI += " \
crate://crates.io/is_terminal_polyfill/1.70.2 \
crate://crates.io/itertools/0.14.0 \
crate://crates.io/itoa/1.0.17 \
- crate://crates.io/jiff/0.2.29 \
- crate://crates.io/jiff-static/0.2.29 \
+ crate://crates.io/jiff/0.2.31 \
+ crate://crates.io/jiff-static/0.2.31 \
crate://crates.io/jiff-tzdb/0.1.6 \
crate://crates.io/jiff-tzdb-platform/0.1.3 \
- crate://crates.io/jobserver/0.1.34 \
+ crate://crates.io/jobserver/0.1.35 \
crate://crates.io/js-sys/0.3.91 \
crate://crates.io/junction/2.0.0 \
crate://crates.io/lazy_static/1.5.0 \
- crate://crates.io/leb128fmt/0.1.0 \
crate://crates.io/libc/0.2.186 \
crate://crates.io/linux-raw-sys/0.4.15 \
crate://crates.io/linux-raw-sys/0.12.1 \
@@ -149,7 +146,6 @@ SRC_URI += " \
crate://crates.io/portable-atomic/1.13.1 \
crate://crates.io/portable-atomic-util/0.2.6 \
crate://crates.io/potential_utf/0.1.4 \
- crate://crates.io/prettyplease/0.2.37 \
crate://crates.io/proc-macro-error-attr2/2.0.0 \
crate://crates.io/proc-macro-error2/2.0.1 \
crate://crates.io/proc-macro2/1.0.106 \
@@ -157,7 +153,7 @@ SRC_URI += " \
crate://crates.io/ptr_meta_derive/0.3.1 \
crate://crates.io/quote/1.0.46 \
crate://crates.io/quoted_printable/0.5.1 \
- crate://crates.io/r-efi/5.3.0 \
+ crate://crates.io/r-efi/6.0.0 \
crate://crates.io/rancor/0.1.1 \
crate://crates.io/redox_syscall/0.5.15 \
crate://crates.io/ref-cast/1.0.25 \
@@ -167,9 +163,9 @@ SRC_URI += " \
crate://crates.io/regex-automata/0.4.14 \
crate://crates.io/regex-syntax/0.8.11 \
crate://crates.io/rend/0.5.3 \
- crate://crates.io/rkyv/0.8.16 \
- crate://crates.io/rkyv_derive/0.8.16 \
- crate://crates.io/rustc-hash/2.1.2 \
+ crate://crates.io/rkyv/0.8.17 \
+ crate://crates.io/rkyv_derive/0.8.17 \
+ crate://crates.io/rustc-hash/2.1.3 \
crate://crates.io/rustix/0.38.44 \
crate://crates.io/rustix/1.1.4 \
crate://crates.io/rustversion/1.0.22 \
@@ -180,7 +176,6 @@ SRC_URI += " \
crate://crates.io/scopeguard/1.2.0 \
crate://crates.io/seahash/4.1.0 \
crate://crates.io/self-replace/1.5.0 \
- crate://crates.io/semver/1.0.27 \
crate://crates.io/serde/1.0.228 \
crate://crates.io/serde-untagged/0.1.9 \
crate://crates.io/serde_core/1.0.228 \
@@ -231,12 +226,11 @@ SRC_URI += " \
crate://crates.io/tracing-test/0.2.6 \
crate://crates.io/tracing-test-macro/0.2.6 \
crate://crates.io/typeid/1.0.3 \
- crate://crates.io/typenum/1.19.0 \
+ crate://crates.io/typenum/1.20.1 \
crate://crates.io/ucd-trie/0.1.7 \
crate://crates.io/unicode-ident/1.0.24 \
crate://crates.io/unicode-linebreak/0.1.5 \
crate://crates.io/unicode-width/0.2.2 \
- crate://crates.io/unicode-xid/0.2.6 \
crate://crates.io/unscanny/0.1.0 \
crate://crates.io/url/2.5.8 \
crate://crates.io/utf8_iter/1.0.4 \
@@ -247,16 +241,10 @@ SRC_URI += " \
crate://crates.io/vte/0.14.1 \
crate://crates.io/walkdir/2.5.0 \
crate://crates.io/wasi/0.11.1+wasi-snapshot-preview1 \
- crate://crates.io/wasi/0.14.7+wasi-0.2.4 \
- crate://crates.io/wasip2/1.0.2+wasi-0.2.9 \
- crate://crates.io/wasip3/0.4.0+wasi-0.3.0-rc-2026-01-06 \
crate://crates.io/wasm-bindgen/0.2.114 \
crate://crates.io/wasm-bindgen-macro/0.2.114 \
crate://crates.io/wasm-bindgen-macro-support/0.2.114 \
crate://crates.io/wasm-bindgen-shared/0.2.114 \
- crate://crates.io/wasm-encoder/0.244.0 \
- crate://crates.io/wasm-metadata/0.244.0 \
- crate://crates.io/wasmparser/0.244.0 \
crate://crates.io/winapi-util/0.1.11 \
crate://crates.io/windows/0.61.3 \
crate://crates.io/windows-collections/0.2.0 \
@@ -282,12 +270,6 @@ SRC_URI += " \
crate://crates.io/windows_x86_64_gnullvm/0.52.6 \
crate://crates.io/windows_x86_64_msvc/0.52.6 \
crate://crates.io/winnow/1.0.3 \
- crate://crates.io/wit-bindgen/0.51.0 \
- crate://crates.io/wit-bindgen-core/0.51.0 \
- crate://crates.io/wit-bindgen-rust/0.51.0 \
- crate://crates.io/wit-bindgen-rust-macro/0.51.0 \
- crate://crates.io/wit-component/0.244.0 \
- crate://crates.io/wit-parser/0.244.0 \
crate://crates.io/writeable/0.6.2 \
crate://crates.io/xattr/1.6.1 \
crate://crates.io/xz2/0.1.7 \
@@ -315,9 +297,9 @@ SRC_URI[anstyle-query-1.1.5.sha256sum] = "40c48f72fd53cd289104fc64099abca73db416
SRC_URI[anstyle-wincon-3.0.11.sha256sum] = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
SRC_URI[anyhow-1.0.103.sha256sum] = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
SRC_URI[arcstr-1.2.0.sha256sum] = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
-SRC_URI[arrayvec-0.7.7.sha256sum] = "f02882884d3e1bc524fb12c79f107f6ad0e1cfd498c536ffb494301740995dfe"
+SRC_URI[arrayvec-0.7.8.sha256sum] = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
SRC_URI[astral-tokio-tar-0.6.3.sha256sum] = "08648fef353ab39a9d26f909ad53fc4f071be4c91853b78523f5cc3d9e5ebffd"
-SRC_URI[astral-version-ranges-0.2.0.sha256sum] = "086f936efdefab117f5a72367fb3d68c4fded8ba5a7008e3c63365eecf723822"
+SRC_URI[astral-version-ranges-0.2.1.sha256sum] = "14445f6708e9a60d5098b6d6f99dbe7b5b347178b2736e1fad7a87b04e289791"
SRC_URI[astral_async_zip-0.0.20.sha256sum] = "bd939d79959c3f49a648a1d7857d63cc62548725a6b060b8dbf0ea5c92470b63"
SRC_URI[async-compression-0.4.19.sha256sum] = "06575e6a9673580f52661c92107baabffbf41e2141373441cbcdc47cb733003c"
SRC_URI[autocfg-1.5.0.sha256sum] = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
@@ -342,7 +324,7 @@ SRC_URI[clap_builder-4.6.0.sha256sum] = "714a53001bf66416adb0e2ef5ac857140e7dc3a
SRC_URI[clap_derive-4.6.1.sha256sum] = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
SRC_URI[clap_lex-1.1.0.sha256sum] = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
SRC_URI[colorchoice-1.0.5.sha256sum] = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-SRC_URI[console-0.16.3.sha256sum] = "d64e8af5551369d19cf50138de61f1c42074ab970f74e99be916646777f8fc87"
+SRC_URI[console-0.16.4.sha256sum] = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c"
SRC_URI[cpufeatures-0.2.17.sha256sum] = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
SRC_URI[crc32fast-1.5.0.sha256sum] = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
SRC_URI[crypto-common-0.1.7.sha256sum] = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
@@ -372,7 +354,7 @@ SRC_URI[flate2-1.1.9.sha256sum] = "843fba2746e448b37e26a819579957415c8cef339bf08
SRC_URI[foldhash-0.1.5.sha256sum] = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
SRC_URI[foldhash-0.2.0.sha256sum] = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
SRC_URI[form_urlencoded-1.2.2.sha256sum] = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-SRC_URI[fs-err-3.3.0.sha256sum] = "73fde052dbfc920003cfd2c8e2c6e6d4cc7c1091538c3a24226cec0665ab08c0"
+SRC_URI[fs-err-3.3.1.sha256sum] = "b91aa448ca50d7e79433bdf3ee8d99215430d2ec02ade5aefab2a073a1822e8a"
SRC_URI[futures-0.3.32.sha256sum] = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
SRC_URI[futures-channel-0.3.32.sha256sum] = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
SRC_URI[futures-core-0.3.32.sha256sum] = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
@@ -384,8 +366,7 @@ SRC_URI[futures-sink-0.3.32.sha256sum] = "c39754e157331b013978ec91992bde1ac08984
SRC_URI[futures-task-0.3.32.sha256sum] = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
SRC_URI[futures-util-0.3.32.sha256sum] = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
SRC_URI[generic-array-0.14.7.sha256sum] = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-SRC_URI[getrandom-0.3.3.sha256sum] = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-SRC_URI[getrandom-0.4.1.sha256sum] = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+SRC_URI[getrandom-0.4.3.sha256sum] = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
SRC_URI[globset-0.4.18.sha256sum] = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
SRC_URI[gloo-timers-0.3.0.sha256sum] = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
SRC_URI[hashbrown-0.15.5.sha256sum] = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
@@ -399,7 +380,6 @@ SRC_URI[icu_normalizer_data-2.1.1.sha256sum] = "7aedcccd01fc5fe81e6b489c15b247b8
SRC_URI[icu_properties-2.1.2.sha256sum] = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
SRC_URI[icu_properties_data-2.1.2.sha256sum] = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
SRC_URI[icu_provider-2.1.1.sha256sum] = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
-SRC_URI[id-arena-2.3.0.sha256sum] = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
SRC_URI[idna-1.1.0.sha256sum] = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
SRC_URI[idna_adapter-1.2.1.sha256sum] = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
SRC_URI[indexmap-2.14.0.sha256sum] = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
@@ -408,15 +388,14 @@ SRC_URI[insta-1.48.0.sha256sum] = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f
SRC_URI[is_terminal_polyfill-1.70.2.sha256sum] = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
SRC_URI[itertools-0.14.0.sha256sum] = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
SRC_URI[itoa-1.0.17.sha256sum] = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
-SRC_URI[jiff-0.2.29.sha256sum] = "34f877a98676d2fb664698d74cc6a51ce6c484ce8c770f05d0108ec9090aeb46"
-SRC_URI[jiff-static-0.2.29.sha256sum] = "0666b5ab5ecaca213fc2a85b8c0083d9004e84ee2d5f9a7e0017aaf50986f25f"
+SRC_URI[jiff-0.2.31.sha256sum] = "ccfe6121cbe750cf81efa362d85c0bde7ea298ec43092d3a193baca59cdbd634"
+SRC_URI[jiff-static-0.2.31.sha256sum] = "e165e897f662d428f3cd3828a919dbe067c2d42bb1031eede74ef9d27ecdedd2"
SRC_URI[jiff-tzdb-0.1.6.sha256sum] = "c900ef84826f1338a557697dc8fc601df9ca9af4ac137c7fb61d4c6f2dfd3076"
SRC_URI[jiff-tzdb-platform-0.1.3.sha256sum] = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
-SRC_URI[jobserver-0.1.34.sha256sum] = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+SRC_URI[jobserver-0.1.35.sha256sum] = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
SRC_URI[js-sys-0.3.91.sha256sum] = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
SRC_URI[junction-2.0.0.sha256sum] = "160f2eade097f30263b548aae5deb12ad349c909baa710fa24b92c9090b2e006"
SRC_URI[lazy_static-1.5.0.sha256sum] = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-SRC_URI[leb128fmt-0.1.0.sha256sum] = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
SRC_URI[libc-0.2.186.sha256sum] = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
SRC_URI[linux-raw-sys-0.4.15.sha256sum] = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
SRC_URI[linux-raw-sys-0.12.1.sha256sum] = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
@@ -452,7 +431,6 @@ SRC_URI[pkg-config-0.3.32.sha256sum] = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e
SRC_URI[portable-atomic-1.13.1.sha256sum] = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
SRC_URI[portable-atomic-util-0.2.6.sha256sum] = "091397be61a01d4be58e7841595bd4bfedb15f1cd54977d79b8271e94ed799a3"
SRC_URI[potential_utf-0.1.4.sha256sum] = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
-SRC_URI[prettyplease-0.2.37.sha256sum] = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
SRC_URI[proc-macro-error-attr2-2.0.0.sha256sum] = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
SRC_URI[proc-macro-error2-2.0.1.sha256sum] = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
SRC_URI[proc-macro2-1.0.106.sha256sum] = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
@@ -460,7 +438,7 @@ SRC_URI[ptr_meta-0.3.1.sha256sum] = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a43
SRC_URI[ptr_meta_derive-0.3.1.sha256sum] = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
SRC_URI[quote-1.0.46.sha256sum] = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
SRC_URI[quoted_printable-0.5.1.sha256sum] = "640c9bd8497b02465aeef5375144c26062e0dcd5939dfcbb0f5db76cb8c17c73"
-SRC_URI[r-efi-5.3.0.sha256sum] = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+SRC_URI[r-efi-6.0.0.sha256sum] = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
SRC_URI[rancor-0.1.1.sha256sum] = "a063ea72381527c2a0561da9c80000ef822bdd7c3241b1cc1b12100e3df081ee"
SRC_URI[redox_syscall-0.5.15.sha256sum] = "7e8af0dde094006011e6a740d4879319439489813bd0bcdc7d821beaeeff48ec"
SRC_URI[ref-cast-1.0.25.sha256sum] = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
@@ -470,9 +448,9 @@ SRC_URI[regex-1.12.4.sha256sum] = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a
SRC_URI[regex-automata-0.4.14.sha256sum] = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
SRC_URI[regex-syntax-0.8.11.sha256sum] = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
SRC_URI[rend-0.5.3.sha256sum] = "cadadef317c2f20755a64d7fdc48f9e7178ee6b0e1f7fce33fa60f1d68a276e6"
-SRC_URI[rkyv-0.8.16.sha256sum] = "73389e0c99e664f919275ab5b5b0471391fe9a8de61e1dff9b1eaf56a90f16e3"
-SRC_URI[rkyv_derive-0.8.16.sha256sum] = "5d2ed0b54125315fb36bd021e82d314d1c126548f871634b483f46b31d13cac6"
-SRC_URI[rustc-hash-2.1.2.sha256sum] = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+SRC_URI[rkyv-0.8.17.sha256sum] = "815cc8a37159a463064825246cadb07961e25cd9885908606f6d08a98d8f8874"
+SRC_URI[rkyv_derive-0.8.17.sha256sum] = "c0ed1a78a1b19d184b0daa629dd9a024573173ec7d485b287cb369fb3607cc1c"
+SRC_URI[rustc-hash-2.1.3.sha256sum] = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
SRC_URI[rustix-0.38.44.sha256sum] = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
SRC_URI[rustix-1.1.4.sha256sum] = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
SRC_URI[rustversion-1.0.22.sha256sum] = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
@@ -483,7 +461,6 @@ SRC_URI[schemars_derive-1.2.1.sha256sum] = "7d115b50f4aaeea07e79c1912f645c7513d8
SRC_URI[scopeguard-1.2.0.sha256sum] = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
SRC_URI[seahash-4.1.0.sha256sum] = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
SRC_URI[self-replace-1.5.0.sha256sum] = "03ec815b5eab420ab893f63393878d89c90fdd94c0bcc44c07abb8ad95552fb7"
-SRC_URI[semver-1.0.27.sha256sum] = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
SRC_URI[serde-1.0.228.sha256sum] = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
SRC_URI[serde-untagged-0.1.9.sha256sum] = "f9faf48a4a2d2693be24c6289dbe26552776eb7737074e6722891fadbe6c5058"
SRC_URI[serde_core-1.0.228.sha256sum] = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
@@ -534,12 +511,11 @@ SRC_URI[tracing-subscriber-0.3.23.sha256sum] = "cb7f578e5945fb242538965c2d0b0441
SRC_URI[tracing-test-0.2.6.sha256sum] = "19a4c448db514d4f24c5ddb9f73f2ee71bfb24c526cf0c570ba142d1119e0051"
SRC_URI[tracing-test-macro-0.2.6.sha256sum] = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
SRC_URI[typeid-1.0.3.sha256sum] = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
-SRC_URI[typenum-1.19.0.sha256sum] = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+SRC_URI[typenum-1.20.1.sha256sum] = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
SRC_URI[ucd-trie-0.1.7.sha256sum] = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
SRC_URI[unicode-ident-1.0.24.sha256sum] = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
SRC_URI[unicode-linebreak-0.1.5.sha256sum] = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
SRC_URI[unicode-width-0.2.2.sha256sum] = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-SRC_URI[unicode-xid-0.2.6.sha256sum] = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
SRC_URI[unscanny-0.1.0.sha256sum] = "e9df2af067a7953e9c3831320f35c1cc0600c30d44d9f7a12b01db1cd88d6b47"
SRC_URI[url-2.5.8.sha256sum] = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
SRC_URI[utf8_iter-1.0.4.sha256sum] = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
@@ -550,16 +526,10 @@ SRC_URI[version_check-0.9.5.sha256sum] = "0b928f33d975fc6ad9f86c8f283853ad26bdd5
SRC_URI[vte-0.14.1.sha256sum] = "231fdcd7ef3037e8330d8e17e61011a2c244126acc0a982f4040ac3f9f0bc077"
SRC_URI[walkdir-2.5.0.sha256sum] = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
SRC_URI[wasi-0.11.1+wasi-snapshot-preview1.sha256sum] = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-SRC_URI[wasi-0.14.7+wasi-0.2.4.sha256sum] = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
-SRC_URI[wasip2-1.0.2+wasi-0.2.9.sha256sum] = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
-SRC_URI[wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06.sha256sum] = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
SRC_URI[wasm-bindgen-0.2.114.sha256sum] = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
SRC_URI[wasm-bindgen-macro-0.2.114.sha256sum] = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
SRC_URI[wasm-bindgen-macro-support-0.2.114.sha256sum] = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
SRC_URI[wasm-bindgen-shared-0.2.114.sha256sum] = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
-SRC_URI[wasm-encoder-0.244.0.sha256sum] = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-SRC_URI[wasm-metadata-0.244.0.sha256sum] = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-SRC_URI[wasmparser-0.244.0.sha256sum] = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
SRC_URI[winapi-util-0.1.11.sha256sum] = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
SRC_URI[windows-0.61.3.sha256sum] = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
SRC_URI[windows-collections-0.2.0.sha256sum] = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
@@ -585,12 +555,6 @@ SRC_URI[windows_x86_64_gnu-0.52.6.sha256sum] = "147a5c80aabfbf0c7d901cb5895d1de3
SRC_URI[windows_x86_64_gnullvm-0.52.6.sha256sum] = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
SRC_URI[windows_x86_64_msvc-0.52.6.sha256sum] = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
SRC_URI[winnow-1.0.3.sha256sum] = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
-SRC_URI[wit-bindgen-0.51.0.sha256sum] = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-SRC_URI[wit-bindgen-core-0.51.0.sha256sum] = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-SRC_URI[wit-bindgen-rust-0.51.0.sha256sum] = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-SRC_URI[wit-bindgen-rust-macro-0.51.0.sha256sum] = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-SRC_URI[wit-component-0.244.0.sha256sum] = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-SRC_URI[wit-parser-0.244.0.sha256sum] = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
SRC_URI[writeable-0.6.2.sha256sum] = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
SRC_URI[xattr-1.6.1.sha256sum] = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
SRC_URI[xz2-0.1.7.sha256sum] = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
diff --git a/meta/recipes-devtools/python/python3-uv-build_0.11.28.bb b/meta/recipes-devtools/python/python3-uv-build_0.11.29.bb
similarity index 92%
rename from meta/recipes-devtools/python/python3-uv-build_0.11.28.bb
rename to meta/recipes-devtools/python/python3-uv-build_0.11.29.bb
index 9523f573ed8..202e7f18343 100644
--- a/meta/recipes-devtools/python/python3-uv-build_0.11.28.bb
+++ b/meta/recipes-devtools/python/python3-uv-build_0.11.29.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE-APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \
file://crates/uv-pep508/License-Apache;md5=e23fadd6ceef8c618fc1c65191d846fa \
file://crates/uv-pep508/License-BSD;md5=ef7a6027dc4c2389b9afad7e690274c7"
-SRC_URI[sha256sum] = "daba66fd25a9a82caa23949686e967cbb69fd056177e991650643186057adaef"
+SRC_URI[sha256sum] = "7dd16d50366f410ae494a27be20b45206feeac37d99dc53abfa1a04410069b78"
require ${BPN}-crates.inc
^ permalink raw reply related
* [PATCH 3/5] wayland: upgrade 1.25.0 -> 1.26.0
From: Richard Purdie @ 2026-07-20 8:32 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720083258.770582-1-richard.purdie@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../wayland/0001-build-Fix-strndup-detection-on-MinGW.patch | 4 ++--
.../wayland/0001-tests-Remove-event_loop_timer-test.patch | 2 +-
.../wayland/{wayland_1.25.0.bb => wayland_1.26.0.bb} | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
rename meta/recipes-graphics/wayland/{wayland_1.25.0.bb => wayland_1.26.0.bb} (96%)
diff --git a/meta/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch b/meta/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch
index d402fbf8b44..c60d01708c4 100644
--- a/meta/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch
+++ b/meta/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch
@@ -1,4 +1,4 @@
-From b4a3b9f913e06f9b71966cd695df1ab14a031ed0 Mon Sep 17 00:00:00 2001
+From a3239f480eecc8d45bd15b8c0f6774424249a295 Mon Sep 17 00:00:00 2001
From: Joshua Watt <JPEWhacker@gmail.com>
Date: Thu, 20 Feb 2020 15:20:45 -0600
Subject: [PATCH] build: Fix strndup detection on MinGW
@@ -20,7 +20,7 @@ Signed-off-by: Denys Dmytriyenko <denis@denix.org>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meson.build b/meson.build
-index 33653e7..e05eaef 100644
+index 2c010be..3b6f8d7 100644
--- a/meson.build
+++ b/meson.build
@@ -49,12 +49,12 @@ have_funcs = [
diff --git a/meta/recipes-graphics/wayland/wayland/0001-tests-Remove-event_loop_timer-test.patch b/meta/recipes-graphics/wayland/wayland/0001-tests-Remove-event_loop_timer-test.patch
index b225bec96d7..3de30473147 100644
--- a/meta/recipes-graphics/wayland/wayland/0001-tests-Remove-event_loop_timer-test.patch
+++ b/meta/recipes-graphics/wayland/wayland/0001-tests-Remove-event_loop_timer-test.patch
@@ -1,4 +1,4 @@
-From 46da8d01e695f415aeb4a8442dbc13ae0898912c Mon Sep 17 00:00:00 2001
+From 022ef36fa8a9fe57a117a6cbc55d8b81bf0fa023 Mon Sep 17 00:00:00 2001
From: Joshua Watt <JPEWhacker@gmail.com>
Date: Thu, 6 Nov 2025 08:35:26 -0700
Subject: [PATCH] tests: Remove event_loop_timer test
diff --git a/meta/recipes-graphics/wayland/wayland_1.25.0.bb b/meta/recipes-graphics/wayland/wayland_1.26.0.bb
similarity index 96%
rename from meta/recipes-graphics/wayland/wayland_1.25.0.bb
rename to meta/recipes-graphics/wayland/wayland_1.26.0.bb
index a0bc13df565..c4e3c8b0f68 100644
--- a/meta/recipes-graphics/wayland/wayland_1.25.0.bb
+++ b/meta/recipes-graphics/wayland/wayland_1.26.0.bb
@@ -17,7 +17,7 @@ SRC_URI = "https://gitlab.freedesktop.org/wayland/wayland/-/releases/${PV}/downl
file://0001-build-Fix-strndup-detection-on-MinGW.patch \
file://0001-tests-Remove-event_loop_timer-test.patch \
"
-SRC_URI[sha256sum] = "c065f040afdff3177680600f249727e41a1afc22fccf27222f15f5306faa1f03"
+SRC_URI[sha256sum] = "64176eaa46e4969903e286f8e5ef8331affc17fdf03ac9b58381d2b23162b7a3"
UPSTREAM_CHECK_URI = "https://gitlab.freedesktop.org/wayland/wayland/-/tags"
UPSTREAM_CHECK_REGEX = "releases/(?P<pver>\d+\.\d+\.(?!9\d+)\d+)"
^ permalink raw reply related
* Re: [OE-core] [scarthgap][PATCH] glibc-testsuite: inherit nospdx to fix do_create_spdx failure
From: Jaipaul Cheernam @ 2026-07-20 8:09 UTC (permalink / raw)
To: Yoann Congal, openembedded-core@lists.openembedded.org
In-Reply-To: <DK2Q2D3DOPR0.1PPO4DOF1JPZL@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 2891 bytes --]
Hi Yoann,
Please proceed with cherry-pick from your side.
Thanks ..
Regards,
Jaipaul Cheernam
From: Yoann Congal <yoann.congal@smile.fr>
Date: Sunday, 19 July 2026 at 19:26
To: Jaipaul Cheernam <jaipaul.cheernam@est.tech>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCH] glibc-testsuite: inherit nospdx to fix do_create_spdx failure
On Wed Jul 8, 2026 at 1:50 PM CEST, Jaipaul Cheernam via lists.openembedded.org wrote:
> The glibc-testsuite recipe fails during do_create_spdx with:
>
> ERROR: glibc-testsuite-2.39+git-r1 do_create_spdx: Recipe glibc-testsuite
> is trying to create package sln which was already written by recipe glibc.
> This will cause corruption, please resolve this and only provide the
> package from one recipe or the other or only build one of the recipes.
>
> This happens because glibc-testsuite includes glibc_2.39.bb via 'require'
> to reuse its source and build configuration for running 'make check'. As a
> result, it inherits all of glibc's PACKAGES definitions (including sln).
> While the recipe already inherits 'nopackages' to suppress packaging, the
> nopackages class does not disable SPDX tasks. The do_create_spdx task then
> attempts to generate SPDX data for packages like 'sln', conflicting with
> the real glibc recipe that owns that package.
>
> This issue was exposed by the SPDX 3.0 backport (commit 9c9b954504,
> Nov 2025) which introduced stricter package-level SPDX generation.
>
> Fix this by adding 'inherit nospdx'. glibc-testsuite does not run on
> target or factor into the build supply chain, since its purpose is to
> run tests in QEMU at build time.
>
> (cherry picked from commit 32801348ca231978498612f3ebee121ca27459c1)
Hello,
That is not a straight forward cherry-pick. Commit message and author
where rewritten.
If you need to add backport info to the cherry-pick, add them after the
"(cherry picked from ..." line but keep the rest (author, title, body)
the same.
You can either send me a v2 with proper cherry-pick procedure (only
append, no rewrite) or just request a cherry-pick for me to handle
(looks easy enough).
Regards,
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---
> meta/recipes-core/glibc/glibc-testsuite_2.39.bb | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-core/glibc/glibc-testsuite_2.39.bb b/meta/recipes-core/glibc/glibc-testsuite_2.39.bb
> index 2e076f4b0f..e0e3e8ba84 100644
> --- a/meta/recipes-core/glibc/glibc-testsuite_2.39.bb
> +++ b/meta/recipes-core/glibc/glibc-testsuite_2.39.bb
> @@ -31,6 +31,7 @@ do_check:append () {
> }
>
> inherit nopackages
> +inherit nospdx
> deltask do_stash_locale
> deltask do_install
> deltask do_populate_sysroot
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 5348 bytes --]
^ permalink raw reply
* Re: [OE-core][scarthgap][PATCH] libxpm: upgrade 3.5.17 -> 3.5.19
From: Yoann Congal @ 2026-07-20 8:08 UTC (permalink / raw)
To: enoch.ng, openembedded-core
In-Reply-To: <20260716142529.2686271-1-enoch.ng@windriver.com>
Hello,
On Thu Jul 16, 2026 at 4:25 PM CEST, Enoch Ng via lists.openembedded.org wrote:
> From: Wang Mingyu <wangmy@fujitsu.com>
>
> Squashed backport of two upgrades:
> 1fc25a668e libxpm: upgrade 3.5.18 -> 3.5.19
> 767f686226 libxpm: upgrade 3.5.17 -> 3.5.18
Wang did not author this squashed commit. You can reference their
commits but if you majorly modify them (like here), you should be
author.
>
> A vulnerability in the `xpmNextWord()` function could cause an
> internal pointer to read beyond the file's end due to improper
> validation of file boundaries. This issue was fixed in libXpm 3.5.19.
>
> The changes between 3.5.17 and 3.5.19 contain the fix to
> CVE-2026-4367 along with other changes that should be safe to
> backport as shown here:
>
> $ git log --oneline libXpm-3.5.17..libXpm-3.5.19
> 9a05472 (HEAD -> master, tag: libXpm-3.5.19, origin/master,
> origin/HEAD) libXpm 3.5.19
> 5448e1b Fix CVE-2026-4367: Out-of-bounds read in xpmNextWord()
> 5b7e903 (tag: libXpm-3.5.18) libXpm 3.5.18
> a5549ac gitlab CI: drop the ci-fairy check-mr job
> 10070a4 Strip trailing whitespace from source files
> 5679dd6 tests: poll for stable compressed output
> 7ce3959 man pages: adjust line breaks in source files
> 60ee362 man pages: remove .PP after .SH or .SS lines
> 3ba5d81 man pages: ensure .BR macro has multiple arguments
> 3aa8a1e man pages: make indentation arguments to .IP be numeric
> 854c23a XpmCreateBuffer.3: editorial changes for this man page
> [Debian bug #1102886]
> b7309b4 Fix build with current Windows headers
> 2803929 Use _stricmp() instead of strcasecmp() on Windows
> bdb6c75 Remove xpmstrdup fallback for strdup
> 73b69d7 Remove xpmstrcasecmp fallback for strcasecmp
> b30fd09 Remove ancient port to 16-bit Windows without X11 libraries
> 0224b43 Remove ancient Amiga support
> b72af4e unifdef VAX11C
> 02702c2 unifdef sequent
> b4e2177 Remove outdated ifdef checks for including stdint.h
I disagree: 3.5.18 is a maintenance/cleanup release with major code
removal (even if obsolete) and I think this is not compatible with our
stable policy.
To fix CVE-2026-4367, you should backport the fix to scarthgap instead.
>
> Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> Signed-off-by: Ross Burton <ross.burton@arm.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
> ---
> .../xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} (88%)
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [PATCH v4 2/2] systemd: add native hwdb generator via merged systemd-tools-native
From: Richard Purdie @ 2026-07-20 8:03 UTC (permalink / raw)
To: Daniel Turull, Ross.Burton@arm.com
Cc: openembedded-core@lists.openembedded.org
In-Reply-To: <0b406994f714c1d3659dd054ceea97e95b7f8090.camel@ericsson.com>
On Mon, 2026-07-20 at 07:26 +0000, Daniel Turull wrote:
> On Fri, 2026-07-17 at 17:59 +0000, Ross Burton wrote:
> > Hi Daniel,
> >
> > > On 3 Jul 2026, at 08:29, daniel.turull@ericsson.com wrote:
> > >
> > > Build systemd-hwdb natively so image construction no longer
> > > depends
> > > on
> > > QEMU-emulated udevadm on such hosts, with:
> > > - A patch restoring /proc/self/fdinfo mount-ID fallback for
> > > kernels
> > > lacking STATX_MNT_ID (applied only to the native tools recipe)
> > > - A patch forcing compat mode in hwdb generation to avoid
> > > embedding
> > > build-host paths in hwdb.bin (reproducibility)
> > >
> > > Update the update_udev_hwdb intercept to prefer the native
> > > systemd-hwdb over QEMU emulation, with a test -s check to catch
> > > silent failures from either path.
> >
> > Staring at these patches made me have thoughts and ideas, I’ve just
> > sent some patches that do some cleanups to the systemctl code (and
> > conflict with your series) that also then renames systemd-
> > systemctl-
> > native to -tools-, so that the upgrade work is tidier as it doesn’t
> > also need to rename lots of things. This makes patches easier to
> > review/revert/backport/etc.
> >
> > Then some research revealed that we don’t need to run update-hwdb
> > in
> > a qemu at all, we were likely doing that originally because we
> > didn’t
> > have a native recipe and the generated file has explicit
> > bytesize/word order: the files generated by ppc32 vs aarch64 in
> > qemu
> > are identical, so we can just delete the qemu codepaths entirely.
> >
> > This did involve discovering that there’s a bug in pseudo and
> > writing
> > an upstreamable patch for systemd-hwdb to strip build paths, but I
> > think we’re getting there. The last bit of the series needs a bit
> > more love, but I’ll be sending that on Monday.
> >
> > Then we can rebase the 261 upgrade, which should be a lot smaller!
> >
>
> Thanks Ross, then I'll rebase the upgrade on top of you new patches.
> I
> will also take the latest systemd version
>
> what about the debian 11 compatibility, has been settle to use
> buildtools within debian 11 since it is old and reaching EOL or
> should I put effort to make it build natively?
We switched debian11 to use buildtools so we're ok there.
I have some of Ross' patches ready for merging in master-next. I'd also
written this patch myself:
https://git.openembedded.org/openembedded-core/commit/?h=master-next&id=87c788c4f1f99425c6716d0337ec153719bcca4a
which applied on top of yours, basically dropping the systemd intercept
as I don't think it is needed any more if we're not using qemu.
Cheers,
Richard
^ permalink raw reply
* [scarthgap][PATCH v2 0/3] python3: fix CVE-2026-11940, CVE-2026-11972 and CVE-2026-9669
From: Benjamin Robin (Schneider Electric) @ 2026-07-20 8:01 UTC (permalink / raw)
To: openembedded-core
Cc: olivier.benjamin, mathieu.dubois-briand, pascal.eberhard,
wahid.essid, Benjamin Robin (Schneider Electric)
This series fix the following CVEs:
- CVE-2026-11940
- CVE-2026-11972
- CVE-2026-9669
On master and wrynose the CVE-2026-9669 patch is not necessary since it is
already included in 3.14.6
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Changes in v2:
- Add back Co-authored-by in CVE-2026-11972 patch
It had been deleted by mistake due to a lack of knowledge regarding how
to handle it.
- Fix commit author of CVE-2026-9669 patch to use the original author and
not the bot named Miss Islington.
- Link to v1: https://patch.msgid.link/20260706-fix-cves-python-scarthgap-v1-0-8d51db14f7ac@bootlin.com
---
Benjamin Robin (Schneider Electric) (3):
python3: fix CVE-2026-11940
python3: fix CVE-2026-11972
python3: fix CVE-2026-9669
.../python/python3/CVE-2026-11940.patch | 66 +++++++++++++++
.../python/python3/CVE-2026-11972.patch | 60 ++++++++++++++
.../python/python3/CVE-2026-9669.patch | 96 ++++++++++++++++++++++
meta/recipes-devtools/python/python3_3.12.13.bb | 3 +
4 files changed, 225 insertions(+)
---
base-commit: 2814f0962f56c8d1afa4de76d2895ba9b5cb767d
change-id: 20260706-fix-cves-python-scarthgap-76eb4e1f3d78
Best regards,
--
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
^ permalink raw reply
* [scarthgap][PATCH v2 1/3] python3: fix CVE-2026-11940
From: Benjamin Robin (Schneider Electric) @ 2026-07-20 8:01 UTC (permalink / raw)
To: openembedded-core
Cc: olivier.benjamin, mathieu.dubois-briand, pascal.eberhard,
wahid.essid, Benjamin Robin (Schneider Electric)
In-Reply-To: <20260720-fix-cves-python-scarthgap-v2-0-fe434ff03f49@bootlin.com>
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed
by a crafted archive where a hardlink references a symlink stored at a
deeper name than the hardlink itself.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
.../python/python3/CVE-2026-11940.patch | 66 ++++++++++++++++++++++
meta/recipes-devtools/python/python3_3.12.13.bb | 1 +
2 files changed, 67 insertions(+)
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11940.patch b/meta/recipes-devtools/python/python3/CVE-2026-11940.patch
new file mode 100644
index 000000000000..0851138ae892
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-11940.patch
@@ -0,0 +1,66 @@
+From 91a9bd79cdbab8f8518c4a5e669b3f19680a2f31 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Tue, 23 Jun 2026 14:31:38 +0100
+Subject: [PATCH] gh-151558: Fix symlink escape via `tarfile`
+ hardlink-extraction fallback (GH-151559)
+
+CVE: CVE-2026-11940
+Upstream-Status: Backport [https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f]
+
+Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
+---
+ Lib/tarfile.py | 3 +++
+ Lib/test/test_tarfile.py | 24 ++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 59d3f6e5cce1..83226e907e4b 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -2650,6 +2650,9 @@ def makelink_with_filter(self, tarinfo, targetpath,
+ "makelink_with_filter: if filter_function is not None, "
+ + "extraction_root must also not be None")
+ try:
++ filter_function(
++ unfiltered.replace(name=tarinfo.name, deep=False),
++ extraction_root)
+ filtered = filter_function(unfiltered, extraction_root)
+ except _FILTER_ERRORS as cause:
+ raise LinkFallbackError(tarinfo, unfiltered.name) from cause
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 759fa03ead70..29719d95b6c1 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4080,6 +4080,30 @@ def test_sneaky_hardlink_fallback(self):
+ self.expect_file("boom", symlink_to='../../link_here')
+ self.expect_file("c", symlink_to='b')
+
++ @symlink_test
++ def test_sneaky_hardlink_fallback_deep(self):
++ # (CVE-2026-11940)
++ with ArchiveMaker() as arc:
++ arc.add("a/b/s", symlink_to=os.path.join("..", "escape"))
++ arc.add("s", hardlink_to=os.path.join("a", "b", "s"))
++
++ with self.check_context(arc.open(), 'data'):
++ e = self.expect_exception(
++ tarfile.LinkFallbackError,
++ "link 's' would be extracted as a copy of "
++ + "'a/b/s', which was rejected")
++ self.assertIsInstance(e.__cause__,
++ tarfile.LinkOutsideDestinationError)
++
++ for filter in 'tar', 'fully_trusted':
++ with self.subTest(filter), self.check_context(arc.open(), filter):
++ if not os_helper.can_symlink():
++ self.expect_file("a/")
++ self.expect_file("a/b/")
++ else:
++ self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
++ self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
++
+ @symlink_test
+ def test_exfiltration_via_symlink(self):
+ # (CVE-2025-4138)
+--
+2.54.0
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index 06dbc8e892d9..f41588055f32 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -44,6 +44,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2026-6019_p2.patch \
file://CVE-2025-13462.patch \
file://CVE-2026-4224.patch \
+ file://CVE-2026-11940.patch \
"
SRC_URI:append:class-native = " \
--
2.55.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox