summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* meta-openembedded/all: adapt to UNPACKDIR changesAlexander Kanavin8 days9-9/+2
| | | | | | | | | | | | | Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* reproducibility: move known non-repro list to layer.confYoann Congal13 days2-7/+8
| | | | | | | | | | | | | | | | | | | | | | The current include file that stores the known non-reproducible packages is layer dependent and that forces the user of the layers to maintain the list of the files (for example, see AB config[0]). By moving the exclude list to each layer.conf and extending the common OEQA_REPRODUCIBLE_EXCLUDED_PACKAGES variable, the known non-reproducible packages will be automatically excluded for each layer used in the reproducibility test without any special knowledge in the test environment. NB: the empty list for meta-initramfs was just removed not moved. [0]: https://git.yoctoproject.org/yocto-autobuilder-helper/tree/config.json?id=7d8933e75bdf7fb821a25617cb2dcabf1f3f8700#n322 Suggested-by: Quentin Schulz <quentin.schulz@cherry.de> Co-Developed-by: Guillaume Swaenepoel <guillaume.swaenepoel@smile.fr> Signed-off-by: Guillaume Swaenepoel <guillaume.swaenepoel@smile.fr> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Enable network during do_compile only when go support is enabledKhem Raj2025-05-141-1/+1
| | | | | | | Makes the hammer a bit smaller, since we do not enable go by default in packageconfig's it helps with yocto check layer with default config. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Fix a build race generating fail-html.cKhem Raj2025-05-092-0/+35
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Upgrade to 337Khem Raj2025-05-091-19/+22
| | | | | | | | Get rid of remoeved configure options ERROR: QA Issue: cockpit: configure was passed unrecognised options: --disable-pcp --enable-old-bridge --with-cockpit-ws-instance-user --disable-ssh --disable-polkit --with-cockpit-ws-instance-group --with-cockpit-group --with-cockpit-user [unknown-configure-option] Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: use -std=gnu17 for compilationYoann Congal2025-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | hiawatha does not build under -std=gnu23 which is the default of gcc15. Forcing -std=gnu17 fixes these build errors: | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:814:25: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types] | 814 | signal(SIGHUP, HUP_handler); | | ^~~~~~~~~~~ | | | | | void (*)(void) | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:88:57: note: expected '__sighandler_t' {aka 'void (*)(int)'} but argument is of type 'void (*)(void)' | 88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler) | | ~~~~~~~~~~~~~~~^~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:294:6: note: 'HUP_handler' declared here | 294 | void HUP_handler() { | | ^~~~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:72:16: note: '__sighandler_t' declared here | 72 | typedef void (*__sighandler_t) (int); | | ^~~~~~~~~~~~~~ Note: Upstream project has no published way to upstream patches. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: update HOMEPAGEYoann Congal2025-05-081-1/+1
| | | | | | | | | As noted in 11.7 changelog: https://hiawatha.leisink.net/changelog > All references to http://www.hiawatha-webserver.org/ changed to > https://hiawatha.leisink.net/. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-webserver/README: add example git send-email lineYoann Congal2025-05-081-0/+5
| | | | | | | | | As the other layers of meta-openembedded, this line makes it easy to send a patch by copy-pasting and reduce slightly the probability of error. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Scrub -ffile-prefix-map in build.nice fileKhem Raj2025-04-221-1/+1
| | | | | | | Fixes QA Issue: File /usr/libexec/apache2/build/config.nice in package apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Update project websiteJason Schonberg2025-04-161-1/+1
| | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layers: Add whinlatter (5.3) to compatible layer seriesKhem Raj2025-04-111-1/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Drop styhead from LAYERSERIES_COMPATKhem Raj2025-03-311-1/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.1 -> 11.2Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.2.1. Small improvements. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.0 -> 11.1Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.1.0. Small bugfixes. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: Upgrade to 3.4.2 releaseKhem Raj2025-03-141-2/+2
| | | | | | | License-Update: Update license to match the PHP 3.01 license [1] [1] https://github.com/xdebug/xdebug/commit/5fc2d818067d05503226ee8c6442985cb2fe069d Signed-off-by: Khem Raj <raj.khem@gmail.com>
* sthttpd: Fix service unit fileAlexis Cellier2025-02-271-2/+2
| | | | | | | | | | | Update PID file path from /var/run to /run to avoid systemd warning: PIDFile= references a path below legacy directory /var/run/, updating /var/run/thttpd.pid → /run/thttpd.pid; please update the unit file accordingly. Cc: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: remove deprecated packagesPaul Le Guen de Kerneizon2025-02-251-10/+0
| | | | | | | | | | | | | | | This commit removes from the recipe the following deprecated packages: - `cockpit-docker`: cockpit project no longer supports Docker since version 228 [1] - `cockpit-machines`: cockpit-machines is now provided in a dedicated repository [2], and code base has been removed since version 242 [3] [1]: https://cockpit-project.org/blog/cockpit-228.html [2]: https://github.com/cockpit-project/cockpit-machines [3]: https://cockpit-project.org/blog/cockpit-242.html Signed-off-by: Paul Le Guen de Kerneizon <paul.leguendekerneizon@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.27.3 to 1.27.4Changqing Li2025-02-161-2/+2
| | | | | | | | | | | | | License-Update: copyright year refreshed Resolves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.26.2 to 1.26.3Changqing Li2025-02-161-1/+1
| | | | | | | | | | | Solves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES-1.26 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.62 -> 2.4.63Wang Mingyu2025-02-101-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* phpmyadmin: upgrade 5.2.1 -> 5.2.2Changqing Li2025-02-091-2/+2
| | | | | | | | | | | | | | License-Update: License year updated This upgrade include security fix for: CVE-2025-24529 CVE-2025-24530 Release note: https://www.phpmyadmin.net/news/2025/1/21/phpMyAdmin-522-is-released/ Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mod-dnssd: update SRC_URIGyorgy Sarvari2025-02-031-1/+1
| | | | | | | | | Upstream repository url changed. Fixes unsuccessful fetch warning. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 10.12 -> 11.0Jason Schonberg2025-01-241-3/+2
| | | | | | | | | | | | | | The https://www.hiawatha-webserver.org/ site is defunct. So move SRC_URI to use https://hiawatha.leisink.net/ instead. Update to 11.0 while we are here. Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.0.0. Dropped support for TLSv1.0 and TLSv1.1. Configuration option MinTLSversion removed. Dropped support for HTTP Public Key Pinning (HPKP). Configuration option PublicKeyPins removed. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: set pam module path to ${base_libdir}/securityYi Zhao2025-01-061-2/+3
| | | | | | | | Set pam module path to ${base_libdir}/security as this is the default path in libpam. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-1237Peter Marko2024-12-241-0/+1
| | | | | | | | | | | | | | | This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: mark CVE-2016-1000229 as fixedPeter Marko2024-12-191-0/+2
| | | | | | | | as per https://github.com/swagger-api/swagger-ui/issues/1865 NVD tracks this CVE as version-less. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore disputed CVE CVE-2007-0086Peter Marko2024-12-191-0/+1
| | | | | | | | | | | | | | | | This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: ignore CVE-2013-1771Peter Marko2024-12-191-0/+1
| | | | | | | | This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: remove old version references from CVEsPeter Marko2024-12-191-7/+7
| | | | | | | | These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-0678 and CVE-1999-1412Peter Marko2024-12-191-0/+2
| | | | | | | These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline release version 1.27.1 -> 1.27.3Derek Straka2024-12-101-2/+2
| | | | | | | License-Update: License file negative and empty space changes Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta: Add SECURITY.md file to all layersKhem Raj2024-11-231-0/+20
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.17.14 -> 5.18.2Wang Mingyu2024-11-191-1/+1
| | | | | | | | | | | Changelog: ============= - update Scarf.js to v1.4.0 to avoid breaking Vitest - docker: return explicit Node.js installation - analytics: use Scarf.js to provide anonymized installation analytics Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: WebUI choice between all (default), v0, v1 or v2Jan Vermaete2024-11-051-0/+20
| | | | | | | | | | | | | Added a PACKAGECONFIG to select the version of the WebUI to be installed. When not set, all versions (v0, v1 and v2) will be installed. What is the default of Netdata. Enabling only the v1 version makes the package 25% smaller. More info: https://github.com/netdata/netdata/issues/15640#issuecomment-1946041083 Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Upgrade from 1.47.3 to 1.47.5 releaseJan Vermaete2024-11-023-71/+13
| | | | | | | | | | | | * 0001-Add-check-for-64bit-builtin-atomics.patch applied upstream * removed not longer used systemd service file The service of the netdata is used in previous commit(s) * oelint_adv issues solved Changlog: https://github.com/netdata/netdata/blob/master/CHANGELOG.md#v1475-2024-10-24 Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: OpenAPI (aka swagger) website (v5.17.14)Jan Vermaete2024-10-301-0/+22
| | | | | | | | | | | | | | | | | | | | New recipe with the static version of the Swagger UI. This is *not* a NPM version of the website (swagger-ui, swagger-ui-dist, swagger-ui-react). But the static release. Plain old HTML/CSS/JS (Standalone) The folder /dist includes all the HTML, CSS and JS files needed to run SwaggerUI on a static website or CMS, without requiring NPM. Download the latest release. Copy the contents of the /dist folder to your server. Open swagger-initializer.js in your text editor and replace "https://petstore.swagger.io/v2/swagger.json" with the URL for your OpenAPI 3.0 spec. -- https://github.com/swagger-api/swagger-ui/blob/HEAD/docs/usage/installation.md#plain-old-htmlcssjs-standalone Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add RDEPENDS to the docker PACKAGECONFIGTanguy Raufflet2024-10-241-1/+1
| | | | | | | | Add the runtime dependency Virtual/docker need when the package config Docker is enabled. This avoids do_rootfs installs issues. Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add setuid to the xenstat plugin fileTanguy Raufflet2024-10-241-0/+6
| | | | | | | | | | | | As mentioned in the Netdata documentation [1], The xenstat plugin requires elevated privileges to be executed. The xenstat.plugin permissions are modified to only allow users belonging to the netdata group to execute the plugin with root privileges. [1] https://learn.netdata.cloud/docs/collecting-metrics/containers-and-vms/xen-xcp-ng Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: modify apps.plugin permissionsTanguy Raufflet2024-10-241-1/+2
| | | | | | | | | | | Modification of the group for the apps.plugin file (from root to netdata) and removal of execution authorization for the “others”. This modification improves security by limiting the netdata group to execute the plugin as root. Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: do not depend on zlib header and libs from hostValeria Petrov2024-10-091-1/+1
| | | | | | | | | | | | | | | | | This commit modifies the PACKAGECONFIG entry for zlib to ensure that the mod_deflate module is enabled with the appropriate zlib configuration. By adding the --with-zlib=${STAGING_LIBDIR}/../ option, we direct the configure script to use the zlib library from the staging directory instead of relying on the host system's zlib installation. Without that configure will search the host for zlib headers and lib. This change resolves build failures related to zlib dependency when mod_deflate is enabled and ensures a consistent build environment across different host configurations. Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Upgrade to 1.47.3 releaseKhem Raj2024-10-043-24/+22
| | | | | | Update the atomics patch to v2 of upstream submission Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add go plugin PACKAGECONFIGEnguerrand de Ribaucourt2024-10-022-2/+27
| | | | | | | | Many netdata plugins are written in go, add a PACKAGECONFIG to enable them. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: refresh netdata.confEnguerrand de Ribaucourt2024-10-022-5034/+645
| | | | | | | | | | | | | Our provided netdata.conf contained a lot of keys which are no longer supported by netdata. Netdata allows to regenerate the configuration file and present all possible keys with their default values. This refreshed file will be more easy to configure by our users. To generate this file, I basically ran the documented command and replaced the file paths with our variables when applicable. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: use builtin packaging service filesEnguerrand de Ribaucourt2024-10-022-9/+49
| | | | | | | | | | | | Netdata now provides its own systemd service files. They provide better hardening than the one we were defining in the recipe. Unfortunately, the CMakeLists.txt file wants to install them into /lib rather than /usr/lib. I added mv commands to put them in the expected location depending on usrmerge. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add docker PACKAGECONFIGEnguerrand de Ribaucourt2024-10-021-1/+3
| | | | | | | | Some netdata plugins like cgroups or docker require permissions to access the docker socket in order to label data properly. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layer.conf: Update to walnascar (5.2) layer/release seriesKhem Raj2024-10-011-1/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cherokee: Remove obsolete recipeNiko Mauno2024-09-308-268/+0
| | | | | | | | | | | | | | | | | | | | This recipe depends on meta-python2, master branch of which has not been updated sine February 2022, see https://git.openembedded.org/meta-python2/log/?h=master Also, https://cherokee-project.com/doc/basics_requirements.html states The main Python releases targeted by our developers are 2.4, 2.5 and 2.6. Anything other than that is not guaranteed to work at the moment. Also, master branch of cherokee has not been updated since January 2023, see https://github.com/cherokee/webserver/commits/master/ Thus, remove the obsolete recipe and the associated packagegroup reference. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline 1.25.3 -> 1.27.1Peter Marko2024-09-172-10/+10
| | | | | | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-24989 * CVE-2024-24990 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 License-Update: copyright year refreshed Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade stable 1.26.0 -> 1.26.2Peter Marko2024-09-171-1/+1
| | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Add checks for 64-bit atomic builtinsKhem Raj2024-09-172-0/+52
| | | | | | This helps in passing correct flags to h2o module compilation Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-03 07:36:40 +0000