summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--documentation/migration-guides/migration-5.3.rst47
-rw-r--r--documentation/migration-guides/release-notes-5.3.rst335
-rw-r--r--meta/classes-recipe/barebox.bbclass2
-rw-r--r--meta/classes-recipe/kernel-fit-image.bbclass14
-rw-r--r--meta/classes-recipe/rust-target-config.bbclass2
-rw-r--r--meta/classes-recipe/uboot-config.bbclass2
-rw-r--r--meta/classes/toolchain/clang.bbclass1
-rw-r--r--meta/conf/distro/include/maintainers.inc1
-rw-r--r--meta/lib/oeqa/selftest/cases/fitimage.py80
-rw-r--r--meta/lib/oeqa/selftest/cases/rust.py3
-rw-r--r--meta/lib/oeqa/selftest/cases/wic.py36
-rw-r--r--meta/recipes-bsp/barebox/barebox-common.inc4
-rw-r--r--meta/recipes-connectivity/avahi/avahi_0.8.bb2
-rw-r--r--meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch228
-rw-r--r--meta/recipes-connectivity/avahi/files/CVE-2024-52616.patch104
-rw-r--r--meta/recipes-connectivity/bind/bind_9.20.15.bb (renamed from meta/recipes-connectivity/bind/bind_9.20.13.bb)2
-rw-r--r--meta/recipes-connectivity/openssh/openssh_10.1p1.bb (renamed from meta/recipes-connectivity/openssh/openssh_10.0p1.bb)2
-rw-r--r--meta/recipes-devtools/binutils/binutils-cross-canadian.inc3
-rw-r--r--meta/recipes-devtools/fmt/fmt/run-ptest2
-rw-r--r--meta/recipes-devtools/fmt/fmt_11.2.0.bb2
-rw-r--r--meta/recipes-devtools/python/python3-hypothesis_6.142.2.bb (renamed from meta/recipes-devtools/python/python3-hypothesis_6.139.2.bb)2
-rw-r--r--meta/recipes-devtools/python/python3-referencing_0.37.0.bb (renamed from meta/recipes-devtools/python/python3-referencing_0.36.2.bb)2
-rw-r--r--meta/recipes-devtools/python/python3-urllib3_2.5.0.bb19
-rw-r--r--meta/recipes-devtools/qemu/qemu-native_10.0.6.bb (renamed from meta/recipes-devtools/qemu/qemu-native_10.0.2.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc4
-rw-r--r--meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch85
-rw-r--r--meta/recipes-devtools/qemu/qemu_10.0.6.bb (renamed from meta/recipes-devtools/qemu/qemu_10.0.2.bb)0
-rw-r--r--meta/recipes-extended/tar/tar_1.35.bb4
-rw-r--r--meta/recipes-graphics/images/core-image-weston.bb4
-rw-r--r--meta/recipes-graphics/x11-common/x11-volatiles.bb20
-rw-r--r--meta/recipes-graphics/x11-common/x11-volatiles/02_x116
-rw-r--r--meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.18.bb2
-rw-r--r--meta/recipes-graphics/xwayland/xwayland_24.1.8.bb2
-rw-r--r--meta/recipes-kernel/linux-firmware/linux-firmware_20251021.bb8
-rw-r--r--meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.17.bb (renamed from meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.16.bb)2
-rw-r--r--meta/recipes-kernel/linux/kernel-devsrc.bb2
-rw-r--r--meta/recipes-support/lz4/lz4/CVE-2025-62813.patch69
-rw-r--r--meta/recipes-support/lz4/lz4_1.10.0.bb4
-rw-r--r--scripts/lib/wic/ksparser.py21
-rw-r--r--scripts/lib/wic/plugins/imager/direct.py14
41 files changed, 963 insertions, 179 deletions
diff --git a/documentation/migration-guides/migration-5.3.rst b/documentation/migration-guides/migration-5.3.rst
index 985712cb22..e59bc8c638 100644
--- a/documentation/migration-guides/migration-5.3.rst
+++ b/documentation/migration-guides/migration-5.3.rst
@@ -134,10 +134,20 @@ To set back the "mac" policy in systemd (version 257.8 at the time of writing
134this note), you should set the ``NamePolicy`` and ``AlternativeNamesPolicy`` as 134this note), you should set the ``NamePolicy`` and ``AlternativeNamesPolicy`` as
135detailed in :manpage:`systemd.link(5)`. 135detailed in :manpage:`systemd.link(5)`.
136 136
137Removal of unlicensed Linux kernel firmware
138~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
139
140By default, the ``linux-firmware`` recipe now excludes firmware that do not
141provide any license information. The recipe holds an internal list of firmware
142to exclude via a variable named ``REMOVE_UNLICENSED``, this variable may be
143overridden if unlicensed firmware is needed. See :oe_git:`the recipe
144</openembedded-core/tree/meta/recipes-kernel/linux-firmware>` for a complete
145overview of the removed firmware.
146
137Supported kernel versions 147Supported kernel versions
138~~~~~~~~~~~~~~~~~~~~~~~~~ 148~~~~~~~~~~~~~~~~~~~~~~~~~
139 149
140The :term:`OLDEST_KERNEL` setting is XXX in this release, meaning that 150The :term:`OLDEST_KERNEL` setting is 5.15 in this release, meaning that
141out the box, older kernels are not supported. See :ref:`4.3 migration notes 151out the box, older kernels are not supported. See :ref:`4.3 migration notes
142<migration-4.3-supported-kernel-versions>` for details. 152<migration-4.3-supported-kernel-versions>` for details.
143 153
@@ -147,7 +157,9 @@ Supported distributions
147Compared to the previous releases, running BitBake is supported on new 157Compared to the previous releases, running BitBake is supported on new
148GNU/Linux distributions: 158GNU/Linux distributions:
149 159
150- XXX 160- Debian 13 (Trixie)
161- Fedora 42
162- Ubuntu 25.04
151 163
152On the other hand, some earlier distributions are no longer supported: 164On the other hand, some earlier distributions are no longer supported:
153 165
@@ -174,6 +186,10 @@ The following variables have been removed:
174 :term:`BitBake` invocation and replace it with information about what was 186 :term:`BitBake` invocation and replace it with information about what was
175 built during the build. This was partly broken and hard to maintain. 187 built during the build. This was partly broken and hard to maintain.
176 188
189- ``GPE_MIRROR``: this variable used to contain the
190 "http://gpe.linuxtogo.org/download/source" URL, but was not used by any
191 recipe in OE-Core.
192
177Removed recipes 193Removed recipes
178~~~~~~~~~~~~~~~ 194~~~~~~~~~~~~~~~
179 195
@@ -195,6 +211,11 @@ The following recipes have been removed in this release:
195- ``xf86-input-vmmouse``: It has a runtime dependency on ``xf86-input-mouse``, 211- ``xf86-input-vmmouse``: It has a runtime dependency on ``xf86-input-mouse``,
196 which stopped supporting Linux. 212 which stopped supporting Linux.
197 213
214- ``babeltrace``: Removed in favour of ``babeltrace2``.
215
216- ``cwautomacros``: A long-obsolete set of custom :ref:`ref-classes-autotools`
217 macros, not used by any other recipe.
218
198Removed :term:`PACKAGECONFIG` entries 219Removed :term:`PACKAGECONFIG` entries
199~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 220~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
200 221
@@ -206,6 +227,8 @@ Removed :term:`PACKAGECONFIG` entries
206 227
207- ``mesa``: ``kmsro``, ``osmesa``, ``xa`` 228- ``mesa``: ``kmsro``, ``osmesa``, ``xa``
208 229
230- ``systemd``: ``dbus``
231
209Removed classes 232Removed classes
210~~~~~~~~~~~~~~~ 233~~~~~~~~~~~~~~~
211 234
@@ -269,4 +292,22 @@ Miscellaneous changes
269- ``xserver-xorg``: remove sub-package ``${PN}-xwayland``, as ``xwayland`` is 292- ``xserver-xorg``: remove sub-package ``${PN}-xwayland``, as ``xwayland`` is
270 now its own recipe. 293 now its own recipe.
271 294
272- The Wic-specific option ``--extra-space`` has been renamed to ``--extra-filesystem-space``. \ No newline at end of file 295- ``gdk-pixbuf``: drop the ``GDK_PIXBUF_LOADERS`` variable, which was part of
296 the recipe's :term:`PACKAGECONFIG`. Instead the :term:`PACKAGECONFIG` can be
297 modified directly to achieve the same result.
298
299- Remove the ``meta/conf/distro/include/distro_alias.inc`` include file,
300 which associated a recipe name to one or more Distribution package name.
301 This file is not used and maintained anymore.
302
303- Remove the ``nghttp2-proxy`` package from the ``nghttp2`` recipe as the
304 ``nghttp2-proxy`` package became empty after an upgrade that makes it a
305 library recipe only (due to
306 :term:`EXTRA_OEMAKE` containing ``-DENABLE_APP=OFF`` by default in the
307 recipe).
308
309- Remove the ``util-linux-fcntl-lock`` package (in the ``util-linux`` recipe) as
310 ``util-linux`` now supports the ``--fcntl`` flag for the ``flock`` command.
311
312 Recipes currently using the ``fcntl-lock`` command should replace these by
313 ``flock --fcntl``.
diff --git a/documentation/migration-guides/release-notes-5.3.rst b/documentation/migration-guides/release-notes-5.3.rst
index 66c88fcb48..5cd875e9b5 100644
--- a/documentation/migration-guides/release-notes-5.3.rst
+++ b/documentation/migration-guides/release-notes-5.3.rst
@@ -11,10 +11,21 @@ Release notes for |yocto-ver| (|yocto-codename|)
11New Features / Enhancements in |yocto-ver| 11New Features / Enhancements in |yocto-ver|
12~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 12~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13 13
14- Linux kernel XXX, gcc 15, glibc XXX, LLVM XXX, and over XXX other 14- Linux kernel 6.16, gcc 15, glibc 2.42, LLVM 21.1.1, and over 300 other
15 recipe upgrades. 15 recipe upgrades.
16 16
17- Minimum Python version required on the host: XXX. 17- Minimum Python version required on the host: 3.9.
18
19- Host requirements changes:
20
21 - The minimum disk space requirement is now 140Gbytes (previously 90Gbytes).
22
23 - The minimum RAM requirement is now 32Gbytes (previously 8Gbytes).
24
25 - These changes are mainly due to recent additions of the LLVM and other
26 resource heavy recipes. For guidance on how to limit the resources used by
27 the :term:`OpenEmbedded Build System`, see the
28 :doc:`/dev-manual/limiting-resources` guide.
18 29
19- BitBake changes: 30- BitBake changes:
20 31
@@ -36,10 +47,18 @@ New Features / Enhancements in |yocto-ver|
36 - ``az``: Add sanity check to check that :term:`AZ_SAS` starts with ``?`` 47 - ``az``: Add sanity check to check that :term:`AZ_SAS` starts with ``?``
37 to mark the start of the query parameters. 48 to mark the start of the query parameters.
38 49
39 - ``git``: Add the tag to shallow clone tarball name. 50 - ``git``:
51
52 - Add the tag to shallow clone tarball name.
53 - Verify if local clones contains a tag, when the ``tag=`` parameter
54 is used in :term:`SRC_URI`.
55
56 - ``knotty``:
57
58 - Pass failed task logs through the log infrastructure (use
59 ``bb.plain()`` instead of ``print()``).
40 60
41 - ``knotty``: pass failed task logs through the log infrastructure (use 61 - Improve refresh rate of the footer progress bar.
42 ``bb.plain()`` instead of ``print()``)
43 62
44 - Add support for automatically promoting class inherits to deferred 63 - Add support for automatically promoting class inherits to deferred
45 inherits by listing them in the :term:`BB_DEFER_BBCLASSES` variable. 64 inherits by listing them in the :term:`BB_DEFER_BBCLASSES` variable.
@@ -92,6 +111,17 @@ New Features / Enhancements in |yocto-ver|
92 :term:`BitBake` to specify what to profile. Can be "main", "idle" or 111 :term:`BitBake` to specify what to profile. Can be "main", "idle" or
93 "parsing". Split the reports in separate files. 112 "parsing". Split the reports in separate files.
94 113
114 - A "filtering" functionality was added and allows modifying the value of a
115 variable before its value is returned by :term:`BitBake`. The
116 ``setVarFilter`` API can be used for applying the filters, but it is
117 **not** recommended for general use. It was added for internal use in
118 the :term:`OpenEmbedded Build System` in the :ref:`ref-classes-native`
119 class. The list of filters that are allowed are derived from a select
120 list of functions that must be added using a ``filter_proc`` decorator.
121
122 - ``tests/parse``: Add tests for ``include``, ``require`` and
123 ``include_all``.
124
95- Toolchain changes: 125- Toolchain changes:
96 126
97 - The Clang/LLVM toolchain can now be used as part of the build. 127 - The Clang/LLVM toolchain can now be used as part of the build.
@@ -106,6 +136,12 @@ New Features / Enhancements in |yocto-ver|
106 The toolchain is also customizable on a per-recipe basis, using the 136 The toolchain is also customizable on a per-recipe basis, using the
107 :term:`TOOLCHAIN` and :term:`TOOLCHAIN_NATIVE` variables. 137 :term:`TOOLCHAIN` and :term:`TOOLCHAIN_NATIVE` variables.
108 138
139 .. warning::
140
141 The :term:`TOOLCHAIN` should **not** be set globally. For overriding
142 the toolchain globally, use :term:`PREFERRED_TOOLCHAIN_TARGET`,
143 :term:`PREFERRED_TOOLCHAIN_NATIVE` and :term:`PREFERRED_TOOLCHAIN_SDK`.
144
109 - Multiple recipes were pinned to use the GCC/Binutils toolchain as they do 145 - Multiple recipes were pinned to use the GCC/Binutils toolchain as they do
110 not support being built with Clang/LLVM yet. In these recipes the 146 not support being built with Clang/LLVM yet. In these recipes the
111 :term:`TOOLCHAIN` variable is set to "gcc". 147 :term:`TOOLCHAIN` variable is set to "gcc".
@@ -119,14 +155,42 @@ New Features / Enhancements in |yocto-ver|
119 - ``bitbake.conf``: Drop ``lz4`` from :term:`HOSTTOOLS`, as it is not 155 - ``bitbake.conf``: Drop ``lz4`` from :term:`HOSTTOOLS`, as it is not
120 required anymore, and the ``lz4-native`` package is used instead. 156 required anymore, and the ``lz4-native`` package is used instead.
121 157
122 - ``conf/fragments``: add a fragment for the CDN :ref:`sstate-cache 158 - :term:`Configuration Fragments <Configuration Fragment>`:
123 <overview-manual/concepts:shared state cache>` mirror. 159
160 - Add a fragment for the `CDN` :ref:`sstate-cache
161 <overview-manual/concepts:shared state cache>` mirror.
162
163 - Add a ``show-fragments`` sub-command to the
164 :oe_git:`bitbake-config-build </bitbake/tree/bin/bitbake-config-build>`
165 utility, to show the content of fragments from command-line.
124 166
125 - ``default-distrovars``: set an empty default for :term:`LICENSE_PATH`. 167 - ``default-distrovars``: set an empty default for :term:`LICENSE_PATH`.
126 168
127 - The default definition of :term:`UNPACKDIR` is no longer 169 - The default definition of :term:`UNPACKDIR` is no longer
128 ``sources-unpack`` but ``sources``. 170 ``sources-unpack`` but ``sources``.
129 171
172 - The default value for :term:`IMAGE_FSTYPES` (defined in
173 :oe_git:`bitbake.conf </openembedded-core/tree/meta/conf/bitbake.conf>`)
174 is now ``tar.zst`` (previously ``tar.gz``).
175
176 - Remove the ``meta/conf/distro/include/distro_alias.inc`` include file,
177 which associated a recipe name to one or more Distribution package name.
178 This file is not used and maintained anymore.
179
180 - A new configuration file :ref:`structure-build-conf-toolcfg.conf` is now
181 used by :oe_git:`bitbake-config-build </bitbake/tree/bin/bitbake-config-build>`
182 to manage :term:`Configuration Fragments <Configuration Fragment>`.
183
184 - ``bitbake.conf``: add :term:`TMPDIR` to the ``GIT_CEILING_DIRECTORIES``
185 Git variable. This avoids Git trying to find a repository higher than
186 :term:`TMPDIR` in recipes that use the :ref:`structure-build-work-shared`
187 directory for storing their sources. This fixes reproducibility issues.
188
189 - Changes to the ``genericarm64`` machine configuration:
190
191 - Increase the :term:`Initramfs` maximum size.
192 - Install extra Linux firmware packages to fix Linux kernel warnings.
193
130- New variables: 194- New variables:
131 195
132 - The ``VIRTUAL-RUNTIME_dbus`` variable, to allow changing the runtime 196 - The ``VIRTUAL-RUNTIME_dbus`` variable, to allow changing the runtime
@@ -159,6 +223,11 @@ New Features / Enhancements in |yocto-ver|
159 deployed filenames. Users can now override :term:`UBOOT_VERSION` to 223 deployed filenames. Users can now override :term:`UBOOT_VERSION` to
160 changes the output filenames. 224 changes the output filenames.
161 225
226 - The :term:`UBOOT_MAKE_OPTS` variable specifies extra options passed to
227 ``make`` when building U-boot. Extra options can also be passed as the
228 fourth argument of the :term:`UBOOT_CONFIG` variable. See the
229 documentation of :ref:`ref-classes-uboot-config` class for more details.
230
162- Kernel-related changes: 231- Kernel-related changes:
163 232
164 - ``linux/generate-cve-exclusions``: use data from CVEProject instead of 233 - ``linux/generate-cve-exclusions``: use data from CVEProject instead of
@@ -186,6 +255,8 @@ New Features / Enhancements in |yocto-ver|
186 - ``linux-yocto``: when built for RISC-V, enable features in 255 - ``linux-yocto``: when built for RISC-V, enable features in
187 :term:`KERNEL_FEATURES` based on features listed in :term:`TUNE_FEATURES`. 256 :term:`KERNEL_FEATURES` based on features listed in :term:`TUNE_FEATURES`.
188 257
258 - ``perf``: Enable ``coresight`` if enabled in :term:`MACHINE_FEATURES`.
259
189- New core recipes: 260- New core recipes:
190 261
191 - ``python3-pdm``, ``python3-pdm-backend`` and ``python3-pdm-build-locked``, 262 - ``python3-pdm``, ``python3-pdm-backend`` and ``python3-pdm-build-locked``,
@@ -210,6 +281,13 @@ New Features / Enhancements in |yocto-ver|
210 to code blocks in Sphinx. It is part of ``buildtools-docs-tarball`` for later 281 to code blocks in Sphinx. It is part of ``buildtools-docs-tarball`` for later
211 use in the Yocto Project documentation. 282 use in the Yocto Project documentation.
212 283
284 - ``python3-coherent-licensed``: License management tooling for `Coherent
285 System` and skeleton projects. It became a new dependency of
286 ``python3-zipp``.
287
288 - ``gn``: a commonly used build tool to generate `ninja
289 <https://ninja-build.org/>`__ files.
290
213 - LLVM/Clang related recipes: 291 - LLVM/Clang related recipes:
214 292
215 - ``clang``: LLVM based C/C++ compiler. 293 - ``clang``: LLVM based C/C++ compiler.
@@ -225,11 +303,15 @@ New Features / Enhancements in |yocto-ver|
225 - ``llvm-tblgen-native``: LLVM TableGen binaries for the build host, 303 - ``llvm-tblgen-native``: LLVM TableGen binaries for the build host,
226 often used to build LLVM projects. 304 often used to build LLVM projects.
227 305
306 - ``lld``: the LLVM Linker.
307
228 - ``lldb``: LLDB debugger for LLVM projects. 308 - ``lldb``: LLDB debugger for LLVM projects.
229 309
230 - ``llvm-project-source``: canonical git mirror of the LLVM subversion 310 - ``llvm-project-source``: canonical git mirror of the LLVM subversion
231 repository. 311 repository.
232 312
313 - ``llvm``: The LLVM Compiler Infrastructure.
314
233 - ``openmp``: LLVM OpenMP compiler Runtime. 315 - ``openmp``: LLVM OpenMP compiler Runtime.
234 316
235 - ``kernel-signing-keys-native``: this recipe is used in the 317 - ``kernel-signing-keys-native``: this recipe is used in the
@@ -242,6 +324,9 @@ New Features / Enhancements in |yocto-ver|
242 - ``glvnd``, which enables OpenGL Vendor Neutral Dispatch Library 324 - ``glvnd``, which enables OpenGL Vendor Neutral Dispatch Library
243 support when using recipes such as ``mesa``. 325 support when using recipes such as ``mesa``.
244 326
327 - ``opencl``: support for the :wikipedia:`OpenCL (Open Computing Language)
328 <OpenCL>` framework.
329
245- New core classes: 330- New core classes:
246 331
247 - The new :ref:`ref-classes-kernel-fit-image` class replaces the previous 332 - The new :ref:`ref-classes-kernel-fit-image` class replaces the previous
@@ -255,6 +340,10 @@ New Features / Enhancements in |yocto-ver|
255 maintain Go recipes that use a ``BPN-go-mods.inc`` and 340 maintain Go recipes that use a ``BPN-go-mods.inc`` and
256 ``BPN-licenses.inc`` and update these files automatically. 341 ``BPN-licenses.inc`` and update these files automatically.
257 342
343 - The new :ref:`ref-classes-python_pdm` class supports building Python
344 recipes with the `PDM <https://pdm-project.org/>`__ package and dependency
345 manager.
346
258- Architecture-specific changes: 347- Architecture-specific changes:
259 348
260 - Rework the RISC-V :term:`TUNE_FEATURES` to make them based of the RISC-V 349 - Rework the RISC-V :term:`TUNE_FEATURES` to make them based of the RISC-V
@@ -299,6 +388,16 @@ New Features / Enhancements in |yocto-ver|
299 </openembedded-core/tree/meta/conf/machine/include/riscv/README>` for more 388 </openembedded-core/tree/meta/conf/machine/include/riscv/README>` for more
300 information. 389 information.
301 390
391 - Add support for new Arm64 instruction sets, which are represented as files
392 to be included in :term:`MACHINE` configuration in :term:`OpenEmbedded-Core
393 (OE-Core)`. The new configuration files are:
394
395 - :oe_git:`conf/machine/include/arm/arch-armv8-7a.inc </openembedded-core/tree/meta/conf/machine/include/arm/arch-armv8-7a.inc>`
396 - :oe_git:`conf/machine/include/arm/arch-armv8-8a.inc </openembedded-core/tree/meta/conf/machine/include/arm/arch-armv8-8a.inc>`
397 - :oe_git:`conf/machine/include/arm/arch-armv9-1a.inc </openembedded-core/tree/meta/conf/machine/include/arm/arch-armv9-1a.inc>`
398 - :oe_git:`conf/machine/include/arm/arch-armv9-2a.inc </openembedded-core/tree/meta/conf/machine/include/arm/arch-armv9-2a.inc>`
399 - :oe_git:`conf/machine/include/arm/arch-armv9-3a.inc </openembedded-core/tree/meta/conf/machine/include/arm/arch-armv9-3a.inc>`
400
302 - ``arch-mips.inc``: Use ``-EB``/``-EL`` for denoting Endianness. 401 - ``arch-mips.inc``: Use ``-EB``/``-EL`` for denoting Endianness.
303 402
304 - Enable ``riscv32`` as supported arch for ``musl`` systems. 403 - Enable ``riscv32`` as supported arch for ``musl`` systems.
@@ -306,6 +405,15 @@ New Features / Enhancements in |yocto-ver|
306 - Powerpc: Use ``-maltivec`` in compiler flags if ``altivec`` is in 405 - Powerpc: Use ``-maltivec`` in compiler flags if ``altivec`` is in
307 :term:`TUNE_FEATURES`. 406 :term:`TUNE_FEATURES`.
308 407
408 - ``arm``: add a ``nocrypto`` feature to :term:`TUNE_FEATURES` to complement
409 the ``crypto`` feature to explicitly disable cryptographic extensions via
410 `GCC` flags.
411
412 This lead to the creation of two new tunes:
413
414 - ``tune-cortexa72-nocrypto``
415 - ``tune-cortexa53-nocrypto``
416
309- QEMU / ``runqemu`` changes: 417- QEMU / ``runqemu`` changes:
310 418
311 - Refactor :ref:`ref-classes-qemu` functions into library functions (in 419 - Refactor :ref:`ref-classes-qemu` functions into library functions (in
@@ -330,19 +438,40 @@ New Features / Enhancements in |yocto-ver|
330 machine's CPU must also be recent enough to support these instructions 438 machine's CPU must also be recent enough to support these instructions
331 natively. 439 natively.
332 440
333 - ``runqemu`` can now run compressed images with snapshot mode. For example, 441 - ``runqemu``:
334 with ``IMAGE_FSTYPES = "... ext4.zst ..."``, you can run:: 442
443 - The script can now run compressed images with snapshot mode. For
444 example, with :term:`IMAGE_FSTYPES` containing ``ext4.zst``, you can run::
445
446 runqemu snapshot ext4.zst <image-recipe>
335 447
336 runqemu snapshot ext4.zst <image-recipe> 448 - Add support for the ``erofs`` filesystem.
449
450 - The :term:`BitBake` environment is now a requirement, and the script
451 cannot run without a successful call to ``bitbake -e``.
452
453 The script will also raise an error with the ``bitbake`` command is not
454 found.
337 455
338- Documentation changes: 456- Documentation changes:
339 457
458 - Add documentation on :term:`Configuration Fragments <Configuration
459 Fragment>`:
460
461 - :doc:`/ref-manual/fragments`
462 - :doc:`/dev-manual/creating-fragments`
463
340 - Part of :term:`BitBake` internals are now documented at 464 - Part of :term:`BitBake` internals are now documented at
341 :yocto_docs:`/bitbake/bitbake-user-manual/bitbake-user-manual-library-functions.html`. 465 :yocto_docs:`/bitbake/bitbake-user-manual/bitbake-user-manual-library-functions.html`.
342 466
343 - A new :doc:`/dev-manual/limiting-resources` guide was created to help 467 - A new :doc:`/dev-manual/limiting-resources` guide was created to help
344 users limit the host resources used by the :term:`OpenEmbedded Build 468 users limit the resources used by the :term:`OpenEmbedded Build System`.
345 System`. 469
470 - A new :doc:`/dev-manual/hashequivserver` guide was created to help users
471 setting up a :ref:`overview-manual/concepts:Hash Equivalence` server.
472
473 - The QA checks defined in the :term:`OpenEmbedded Build System` were
474 gathered in :doc:`/ref-manual/qa-checks`.
346 475
347- Core library changes: 476- Core library changes:
348 477
@@ -352,6 +481,9 @@ New Features / Enhancements in |yocto-ver|
352 481
353- Go changes: 482- Go changes:
354 483
484 - :ref:`ref-classes-go-mod-update-modules`: Update license finding to use
485 the new ``find_licenses_up`` library function.
486
355- Rust changes: 487- Rust changes:
356 488
357 - ``rust-llvm``: 489 - ``rust-llvm``:
@@ -362,6 +494,9 @@ New Features / Enhancements in |yocto-ver|
362 - Disable the following feature through configuration 494 - Disable the following feature through configuration
363 (:ref:`ref-tasks-configure`): libedit, benchmarks. 495 (:ref:`ref-tasks-configure`): libedit, benchmarks.
364 496
497 - Add the ``has-thread-local`` option to the
498 :ref:`ref-classes-rust-target-config` class.
499
365- Wic Image Creator changes: 500- Wic Image Creator changes:
366 501
367 - After a Python upgrade, WIC plugins containing dashes (``-``) for their 502 - After a Python upgrade, WIC plugins containing dashes (``-``) for their
@@ -387,17 +522,36 @@ New Features / Enhancements in |yocto-ver|
387 :term:`BitBake` variables. This directory is usually found in 522 :term:`BitBake` variables. This directory is usually found in
388 :term:`STAGING_DIR`. 523 :term:`STAGING_DIR`.
389 524
390 - Add the Wic-specific option ``--extra-partiton-space`` to add extra empty 525 - Add the Wic-specific option ``--extra-partition-space`` to add extra empty
391 space after the space filled by the filesystem in the partition. 526 space after the space filled by the filesystem in the partition.
527
528 - The Wic-specific option ``--extra-space`` has a new alias
529 ``--extra-filesystem-space``.
530
531 - ``bootimg_pcbios``: move Syslinux install into separate functions, to make
532 it easier to add new bootloaders.
533
534 The Grub bootloader can now be installed with this Wic plugin.
392 535
393 - Add the Wic plugin ``extra_partition`` to install files from the 536 - Add the Wic plugin ``extra_partition`` to install files from the
394 :term:`DEPLOY_DIR_IMAGE` directory into an extra non-rootfs partition. 537 :term:`DEPLOY_DIR_IMAGE` directory into an extra non-rootfs partition. See the
538 :term:`IMAGE_EXTRA_PARTITION_FILES` variable for more information.
395 539
396- SDK-related changes: 540- SDK-related changes:
397 541
398 - Include additional information about Meson setting in the SDK environment 542 - Include additional information about Meson setting in the SDK environment
399 setup script (host system, CPU family, etc.). 543 setup script (host system, CPU family, etc.).
400 544
545 - Add Go to :term:`SDK_TOOLCHAIN_LANGS`, except for the following
546 architecture on which this is not supported:
547
548 - RISC-V 32 bits (``rv32``)
549 - PowerPC
550
551 - Image-based SDKs can now include `Zsh` completions by adding the
552 ``zsh-completion-pkgs`` feature to the :term:`IMAGE_FEATURES` variable in
553 the image recipe.
554
401- Testing-related changes: 555- Testing-related changes:
402 556
403 - ``bitbake/tests/fetch``: Add tests for ``gitsm`` with git-lfs. 557 - ``bitbake/tests/fetch``: Add tests for ``gitsm`` with git-lfs.
@@ -405,6 +559,9 @@ New Features / Enhancements in |yocto-ver|
405 - ``bitbake/lib/bb/tests/fetch``: add a test case to ensure Git shallow 559 - ``bitbake/lib/bb/tests/fetch``: add a test case to ensure Git shallow
406 fetch works for tag containing slashes. 560 fetch works for tag containing slashes.
407 561
562 - :ref:`ref-classes-testexport`: capture all tests and data from all layers
563 (instead of the :term:`OpenEmbedded-Core (OE-Core)` layer only).
564
408 - OEQA: 565 - OEQA:
409 566
410 - SDK: 567 - SDK:
@@ -455,8 +612,16 @@ New Features / Enhancements in |yocto-ver|
455 612
456 - ``runqemu``: add new test for booting compressed images. 613 - ``runqemu``: add new test for booting compressed images.
457 614
458 - :ref:`ref-classes-testexport`: capture all tests and data from all layers 615 - General improvements of the parallelization of tests, namely fixing
459 (instead of the :term:`OpenEmbedded-Core (OE-Core)` layer only). 616 some tests that could spawn an unlimited number of threads leading to
617 OOM kills.
618
619 - A new SDK test is now running for Go after ``go`` was added to
620 :term:`SDK_TOOLCHAIN_LANGS`.
621
622 - Commands sent over SSH (using the ``OESSHTarget`` class) will now error
623 when an SSH failure occurs. It is possible to ignore these errors by
624 passing ``ignore_ssh_fails`` when executing a command.
460 625
461- Utility script changes: 626- Utility script changes:
462 627
@@ -468,6 +633,8 @@ New Features / Enhancements in |yocto-ver|
468 patch files *must* include an ``Upstream-Status`` to pass with this 633 patch files *must* include an ``Upstream-Status`` to pass with this
469 script. 634 script.
470 635
636 - Show the :term:`DISTRO` used when running the script.
637
471 - :ref:`ref-classes-yocto-check-layer` class: 638 - :ref:`ref-classes-yocto-check-layer` class:
472 639
473 - Refactor to be extended easily. 640 - Refactor to be extended easily.
@@ -490,7 +657,11 @@ New Features / Enhancements in |yocto-ver|
490 657
491 - ``buildstats-diff``: find last two Buildstats files if none are specified. 658 - ``buildstats-diff``: find last two Buildstats files if none are specified.
492 659
493 - ``pybootchartgui``: visualize ``/proc/net/dev`` network stats in graphs. 660 - ``pybootchartgui``:
661
662 - visualize ``/proc/net/dev`` network stats in graphs.
663
664 - account for network statistics when calculating extents.
494 665
495- Packaging changes: 666- Packaging changes:
496 667
@@ -499,6 +670,19 @@ New Features / Enhancements in |yocto-ver|
499 detailed information on the files used during the compilation and improve 670 detailed information on the files used during the compilation and improve
500 SPDX accuracy. 671 SPDX accuracy.
501 672
673 - When using the ``ipk`` and ``rpm`` package managers, give out more possible
674 reasons about unmatched packages.
675
676 For example::
677
678 E: Package 'catch2' has no installation candidate
679 catch2 is a recipe. Its generated packages are: ['catch2-src', 'catch2-dbg', 'catch2-staticdev', 'catch2-dev', 'catch2-doc']
680 Either specify a generated package or set ALLOW_EMPTY:${PN} = "1" in catch2 recipe
681
682 - ``package.py``: replace all files unconditionally when copying debug
683 sources (passing ``-u`` to the ``cpio`` command in
684 ``copydebugsources()``). This improves reproducibility.
685
502- LLVM related changes: 686- LLVM related changes:
503 687
504 - Like ``gcc-source``, the LLVM project sources are part of ``work-shared`` 688 - Like ``gcc-source``, the LLVM project sources are part of ``work-shared``
@@ -535,14 +719,26 @@ New Features / Enhancements in |yocto-ver|
535 719
536 - Handle workspaces for multiconfig. 720 - Handle workspaces for multiconfig.
537 721
722 - Fix upgrade for recipes with Git submodules.
723
538- Patchtest-related changes: 724- Patchtest-related changes:
539 725
726 - Multiple improvements to the tool's :oe_git:`README
727 </openembedded-core/tree/scripts/patchtest.README>`.
728
729 - Don't match :term:`BitBake` Python expansions as GitHub usernames
730 (``${@...}`` syntax).
731
540- Security changes: 732- Security changes:
541 733
542 - ``openssl``: add FIPS support. This can be enabled through the ``fips`` 734 - ``openssl``: add FIPS support. This can be enabled through the ``fips``
543 :term:`PACKAGECONFIG`. 735 :term:`PACKAGECONFIG`.
544 736
545- :ref:`ref-classes-cve-check` changes: 737- :ref:`ref-classes-cve-check` class changes:
738
739
740 - ``cve-update-db-native``: FKIE: use Secondary metric if there is no
741 Primary metric.
546 742
547- New :term:`PACKAGECONFIG` options for individual recipes: 743- New :term:`PACKAGECONFIG` options for individual recipes:
548 744
@@ -554,13 +750,34 @@ New Features / Enhancements in |yocto-ver|
554 - ``openssl``: ``fips`` 750 - ``openssl``: ``fips``
555 - ``qemu``: ``sdl-image``, ``pixman`` 751 - ``qemu``: ``sdl-image``, ``pixman``
556 - ``wget``: ``pcre2`` 752 - ``wget``: ``pcre2``
557 - ``mesa``: ``asahi``, ``amd``, ``svga``, ``teflon``, ``nouveau`` 753 - ``mesa``: ``asahi``, ``amd``, ``svga``, ``teflon``, ``nouveau``,
754 ``xmlconfig``
755 - ``dbus``: ``traditional-activation``, ``message-bus``
756 - ``cmake``: ``debugger``
757 - ``libcxx``: ``unwind-cross``
758 - ``tiff``: ``lerc``
759 - ``freetype``: ``brotli``
760 - ``gawk``: ``pma-if-64bit``
761 - ``x264``: ``ffmpeg``, ``opencl``
558 762
559- Systemd related changes: 763- Systemd related changes:
560 764
561 - Enable getty generator by default by adding ``serial-getty-generator`` to 765 - Enable getty generator by default by adding ``serial-getty-generator`` to
562 :term:`PACKAGECONFIG`. 766 :term:`PACKAGECONFIG`.
563 767
768 - Now uses the :term:`USE_NLS` variable to enable or disable building
769 translations.
770
771 - Fix deduplicated templates and instance lines in preset files when listing
772 both template and instances in :term:`SYSTEMD_SERVICE`.
773
774 - Stop enabling non-standard MAC policy when using the 'pni-names' feature
775 (part of :term:`DISTRO_FEATURES`). Instead, follow what is provided by
776 upstream systemd.
777
778 - Install ``systemd-sysv-install`` when using the
779 ``systemd-systemctl-native`` recipe.
780
564- :ref:`ref-classes-sanity` class changes: 781- :ref:`ref-classes-sanity` class changes:
565 782
566 - :ref:`ref-classes-insane`: Move test for invalid :term:`PACKAGECONFIG` to 783 - :ref:`ref-classes-insane`: Move test for invalid :term:`PACKAGECONFIG` to
@@ -576,6 +793,9 @@ New Features / Enhancements in |yocto-ver|
576 install ``libstdc++-14-dev`` instead of ``libgcc-14-dev`` to avoid build 793 install ``libstdc++-14-dev`` instead of ``libgcc-14-dev`` to avoid build
577 issues when building :ref:`ref-classes-native` with Clang. 794 issues when building :ref:`ref-classes-native` with Clang.
578 795
796 - Drop the ``var-undefined`` QA check as it was not relevant for the
797 variables it was checking, as those are mandatory by default.
798
579- U-boot related changes: 799- U-boot related changes:
580 800
581 - :ref:`ref-classes-uboot-sign`: Add support for setting firmware property 801 - :ref:`ref-classes-uboot-sign`: Add support for setting firmware property
@@ -589,6 +809,11 @@ New Features / Enhancements in |yocto-ver|
589 variable to automatically set U-boot configuration options (for example 809 variable to automatically set U-boot configuration options (for example
590 ``CONFIG_RISCV_ISA_F``). 810 ``CONFIG_RISCV_ISA_F``).
591 811
812 - Improve the way build directories are split when having multiple
813 configurations listed in :term:`UBOOT_CONFIG`. This fixes an issue where
814 two or more of these configurations were using the same directory for
815 building (because these were using the same defconfig file).
816
592- Miscellaneous changes: 817- Miscellaneous changes:
593 818
594 - ``dropbear``: The ``dropbearkey.service`` can now take extra arguments for 819 - ``dropbear``: The ``dropbearkey.service`` can now take extra arguments for
@@ -648,12 +873,78 @@ New Features / Enhancements in |yocto-ver|
648 - :ref:`ref-classes-externalsrc`: Always ask Git for location of ``.git`` 873 - :ref:`ref-classes-externalsrc`: Always ask Git for location of ``.git``
649 directory (may be different from the default ``${S}/.git``). 874 directory (may be different from the default ``${S}/.git``).
650 875
651 - :ref:`ref-classes-features_check`: Add support for required 876 - :ref:`ref-classes-features_check`: Add support for :term:`REQUIRED_TUNE_FEATURES`.
652 :term:`TUNE_FEATURES`.
653 877
654 - ``openssh``: limit read access to ``sshd_config`` file (set its filemode 878 - ``openssh``: limit read access to ``sshd_config`` file (set its filemode
655 to ``0600``). 879 to ``0600``).
656 880
881 - ``barebox-tools`` now installs the ``rk-usb-loader`` utility.
882
883 - The :ref:`ref-classes-setuptools3_legacy` class now supports the
884 :ref:`qa-check-pep517-backend` QA check.
885
886 - The :ref:`ref-classes-ccache` class now supports using `Ccache` for native
887 recipes when the local build configuration contains::
888
889 ASSUME_PROVIDED += "ccache-native"
890 HOSTTOOLS += "ccache"
891
892 - :ref:`ref-classes-python_pep517`: use ``pyproject-build`` instead of
893 calling the module with ``nativepython3``.
894
895 - ``dbus-glib``: include the binding tools separately into the
896 ``${PN}-tools`` package.
897
898 - ``dbus``: use the :ref:`ref-classes-systemd` class to handle the unit
899 files of D-Bus.
900
901 - ``dpkg``: add :ref:`ptest <test-manual/ptest:testing packages with ptest>`
902 support.
903
904 - ``shared-mime-info``: Now uses the :term:`USE_NLS` variable to enable
905 building translations.
906
907 - ``p11-kit``: Now uses the :term:`USE_NLS` variable to enable building
908 translations.
909
910 - ``babeltrace2``: Enable Python plugins
911
912 - ``initramfs-framework``: mount a temporary filesystem on ``/run`` and move
913 it to the root filesystem directory before calling ``switch_root``.
914
915 - ``python3``: Pass ``PLATFORM_TRIPLET`` explicitly when cross compiling to
916 make the build deterministic instead of letting Python detect the platform
917 triplet (``${HOST_ARCH}-${HOST_OS}``).
918
919 - ``pulseaudio``: Add the ``audio`` group explicitly if
920 ``pulseaudio-server`` is used.
921
922 - ``oe/license_finder``: Add ``find_licenses_up`` function to find licenses
923 upwards until reaching a predefined top directory (as an argument).
924
925 - ``mesa``:
926
927 - Build Mesa's Asahi tools when ``asahi`` is part of the recipe's
928 :term:`PACKAGECONFIG` variable.
929
930 - The ``mesa`` recipe now declares two new :term:`PROVIDES` for Vulkan
931 and OpenCL ICD. These virtual provider are respectively named
932 ``virtual-opencl-icd`` and ``virtual-vulkan-icd``.
933
934 - ``mesa-demos``: split info tools to a separate package ``mesa-demos-info``.
935
936 - ``vte``: skip :ref:`ref-classes-gobject-introspection` with Clang on Arm,
937 as it caused build failures.
938
939 - ``shadow``: Increase the maximum group name length from 24 to 32 (default
940 value provided by upstream recipe, was previously hardcoded to 24).
941
942 - ``udev-extraconf``: Speed up the ``mount.sh`` script by passing the block
943 device of interest to ``blkid`` when getting partition label names.
944
945 - ``piglit``: enable OpenCL support if ``opencl`` is part of the
946 :term:`DISTRO` features.
947
657Known Issues in |yocto-ver| 948Known Issues in |yocto-ver|
658~~~~~~~~~~~~~~~~~~~~~~~~~~~ 949~~~~~~~~~~~~~~~~~~~~~~~~~~~
659 950
diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
index ece8fb6485..73615999aa 100644
--- a/meta/classes-recipe/barebox.bbclass
+++ b/meta/classes-recipe/barebox.bbclass
@@ -16,6 +16,8 @@ DEPENDS += "bison-native flex-native lz4-native"
16 16
17S = "${UNPACKDIR}/barebox-${PV}" 17S = "${UNPACKDIR}/barebox-${PV}"
18B = "${WORKDIR}/build" 18B = "${WORKDIR}/build"
19KBUILD_OUTPUT = "${B}"
20OE_TERMINAL_EXPORTS += "KBUILD_OUTPUT"
19 21
20require conf/image-uefi.conf 22require conf/image-uefi.conf
21 23
diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
index 16b6ab7b2f..fd0d21ceee 100644
--- a/meta/classes-recipe/kernel-fit-image.bbclass
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -63,14 +63,12 @@ python do_compile() {
63 ) 63 )
64 64
65 # Prepare a kernel image section. 65 # Prepare a kernel image section.
66 linux_bin = d.getVar('FIT_LINUX_BIN') 66 shutil.copyfile(os.path.join(kernel_deploydir, "linux.bin"), "linux.bin")
67 if linux_bin: 67 with open(os.path.join(kernel_deploydir, "linux_comp")) as linux_comp_f:
68 shutil.copyfile(os.path.join(kernel_deploydir, "linux.bin"), "linux.bin") 68 linux_comp = linux_comp_f.read()
69 with open(os.path.join(kernel_deploydir, "linux_comp")) as linux_comp_f: 69 root_node.fitimage_emit_section_kernel("kernel-1", "linux.bin", linux_comp,
70 linux_comp = linux_comp_f.read() 70 d.getVar('UBOOT_LOADADDRESS'), d.getVar('UBOOT_ENTRYPOINT'),
71 root_node.fitimage_emit_section_kernel("kernel-1", "linux.bin", linux_comp, 71 d.getVar('UBOOT_MKIMAGE_KERNEL_TYPE'), d.getVar("UBOOT_ENTRYSYMBOL"))
72 d.getVar('UBOOT_LOADADDRESS'), d.getVar('UBOOT_ENTRYPOINT'),
73 d.getVar('UBOOT_MKIMAGE_KERNEL_TYPE'), d.getVar("UBOOT_ENTRYSYMBOL"))
74 72
75 # Prepare a DTB image section 73 # Prepare a DTB image section
76 kernel_devicetree = d.getVar('KERNEL_DEVICETREE') 74 kernel_devicetree = d.getVar('KERNEL_DEVICETREE')
diff --git a/meta/classes-recipe/rust-target-config.bbclass b/meta/classes-recipe/rust-target-config.bbclass
index 0c7e3c0090..9ce57843cf 100644
--- a/meta/classes-recipe/rust-target-config.bbclass
+++ b/meta/classes-recipe/rust-target-config.bbclass
@@ -405,7 +405,7 @@ def rust_gen_target(d, thing, wd, arch):
405 tspec['llvm-abiname'] = "lp64d" 405 tspec['llvm-abiname'] = "lp64d"
406 if "powerpc64le" in tspec['llvm-target']: 406 if "powerpc64le" in tspec['llvm-target']:
407 tspec['llvm-abiname'] = "elfv2" 407 tspec['llvm-abiname'] = "elfv2"
408 if "powerpc64" in tspec['llvm-target']: 408 elif "powerpc64" in tspec['llvm-target']:
409 tspec['llvm-abiname'] = "elfv1" 409 tspec['llvm-abiname'] = "elfv1"
410 tspec['vendor'] = "unknown" 410 tspec['vendor'] = "unknown"
411 tspec['target-family'] = "unix" 411 tspec['target-family'] = "unix"
diff --git a/meta/classes-recipe/uboot-config.bbclass b/meta/classes-recipe/uboot-config.bbclass
index eb82dd3583..fd6c045142 100644
--- a/meta/classes-recipe/uboot-config.bbclass
+++ b/meta/classes-recipe/uboot-config.bbclass
@@ -85,7 +85,7 @@ SPL_MKIMAGE_DTCOPTS ??= ""
85UBOOT_MKIMAGE ?= "uboot-mkimage" 85UBOOT_MKIMAGE ?= "uboot-mkimage"
86UBOOT_MKIMAGE_SIGN ?= "${UBOOT_MKIMAGE}" 86UBOOT_MKIMAGE_SIGN ?= "${UBOOT_MKIMAGE}"
87 87
88# Signature activation - this requires KERNEL_IMAGETYPE = "fitImage" 88# Signature activation
89UBOOT_SIGN_ENABLE ?= "0" 89UBOOT_SIGN_ENABLE ?= "0"
90 90
91# Arguments passed to mkimage for signing 91# Arguments passed to mkimage for signing
diff --git a/meta/classes/toolchain/clang.bbclass b/meta/classes/toolchain/clang.bbclass
index b4a1c180f6..9a3cd0e584 100644
--- a/meta/classes/toolchain/clang.bbclass
+++ b/meta/classes/toolchain/clang.bbclass
@@ -32,6 +32,7 @@ TUNE_CCARGS += "${@bb.utils.contains("DISTRO_FEATURES", "usrmerge", " --dyld-pre
32 32
33LDFLAGS:append:class-nativesdk:x86-64 = " -Wl,-dynamic-linker,${base_libdir}/ld-linux-x86-64.so.2" 33LDFLAGS:append:class-nativesdk:x86-64 = " -Wl,-dynamic-linker,${base_libdir}/ld-linux-x86-64.so.2"
34LDFLAGS:append:class-nativesdk:aarch64 = " -Wl,-dynamic-linker,${base_libdir}/ld-linux-aarch64.so.1" 34LDFLAGS:append:class-nativesdk:aarch64 = " -Wl,-dynamic-linker,${base_libdir}/ld-linux-aarch64.so.1"
35LDFLAGS:append:class-cross-canadian = " -Wl,-dynamic-linker,${base_libdir}/placeholder/to/be/rewritten/by/sdk/installer"
35 36
36# do_populate_sysroot needs STRIP, do_package_qa needs OBJDUMP 37# do_populate_sysroot needs STRIP, do_package_qa needs OBJDUMP
37POPULATESYSROOTDEPS:append:class-target = " llvm-native:do_populate_sysroot" 38POPULATESYSROOTDEPS:append:class-target = " llvm-native:do_populate_sysroot"
diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc
index c4142e2b72..6902bc0c44 100644
--- a/meta/conf/distro/include/maintainers.inc
+++ b/meta/conf/distro/include/maintainers.inc
@@ -886,6 +886,7 @@ RECIPE_MAINTAINER:pn-wic-tools = "Unassigned <unassigned@yoctoproject.org>"
886RECIPE_MAINTAINER:pn-wireless-regdb = "Unassigned <unassigned@yoctoproject.org>" 886RECIPE_MAINTAINER:pn-wireless-regdb = "Unassigned <unassigned@yoctoproject.org>"
887RECIPE_MAINTAINER:pn-wpa-supplicant = "Unassigned <unassigned@yoctoproject.org>" 887RECIPE_MAINTAINER:pn-wpa-supplicant = "Unassigned <unassigned@yoctoproject.org>"
888RECIPE_MAINTAINER:pn-wpebackend-fdo = "Unassigned <unassigned@yoctoproject.org>" 888RECIPE_MAINTAINER:pn-wpebackend-fdo = "Unassigned <unassigned@yoctoproject.org>"
889RECIPE_MAINTAINER:pn-x11-volatiles = "Unassigned <unassigned@yoctoproject.org>"
889RECIPE_MAINTAINER:pn-x11perf = "Unassigned <unassigned@yoctoproject.org>" 890RECIPE_MAINTAINER:pn-x11perf = "Unassigned <unassigned@yoctoproject.org>"
890RECIPE_MAINTAINER:pn-x264 = "Unassigned <unassigned@yoctoproject.org>" 891RECIPE_MAINTAINER:pn-x264 = "Unassigned <unassigned@yoctoproject.org>"
891RECIPE_MAINTAINER:pn-xauth = "Unassigned <unassigned@yoctoproject.org>" 892RECIPE_MAINTAINER:pn-xauth = "Unassigned <unassigned@yoctoproject.org>"
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index 9c2e10dd2b..8df5e92a34 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -9,7 +9,6 @@ import re
9import shlex 9import shlex
10import logging 10import logging
11import pprint 11import pprint
12import tempfile
13 12
14import oe.fitimage 13import oe.fitimage
15 14
@@ -47,10 +46,11 @@ class FitImageTestCase(OESelftestTestCase):
47 # Check if the its file contains the expected paths and attributes. 46 # Check if the its file contains the expected paths and attributes.
48 # The _get_req_* functions are implemented by more specific chield classes. 47 # The _get_req_* functions are implemented by more specific chield classes.
49 self._check_its_file() 48 self._check_its_file()
50 req_its_paths = self._get_req_its_paths() 49 req_its_paths, not_req_its_paths = self._get_req_its_paths()
51 req_sigvalues_config = self._get_req_sigvalues_config() 50 req_sigvalues_config = self._get_req_sigvalues_config()
52 req_sigvalues_image = self._get_req_sigvalues_image() 51 req_sigvalues_image = self._get_req_sigvalues_image()
53 # Compare the its file against req_its_paths, req_sigvalues_config, req_sigvalues_image 52 # Compare the its file against req_its_paths, not_req_its_paths,
53 # req_sigvalues_config, req_sigvalues_image
54 54
55 # Call the dumpimage utiliy and check that it prints all the expected paths and attributes 55 # Call the dumpimage utiliy and check that it prints all the expected paths and attributes
56 # The _get_req_* functions are implemented by more specific chield classes. 56 # The _get_req_* functions are implemented by more specific chield classes.
@@ -198,7 +198,7 @@ class FitImageTestCase(OESelftestTestCase):
198 # Support only the test recipe which provides 1 devicetree and 1 devicetree overlay 198 # Support only the test recipe which provides 1 devicetree and 1 devicetree overlay
199 pref_prov_dtb = bb_vars.get('PREFERRED_PROVIDER_virtual/dtb') 199 pref_prov_dtb = bb_vars.get('PREFERRED_PROVIDER_virtual/dtb')
200 if pref_prov_dtb == "bbb-dtbs-as-ext": 200 if pref_prov_dtb == "bbb-dtbs-as-ext":
201 all_dtbs += ["am335x-bonegreen-ext.dtb", "BBORG_RELAY-00A2.dtbo"] 201 all_dtbs += ["BBORG_RELAY-00A2.dtbo", "am335x-bonegreen-ext.dtb"]
202 dtb_symlinks.append("am335x-bonegreen-ext-alias.dtb") 202 dtb_symlinks.append("am335x-bonegreen-ext-alias.dtb")
203 return (all_dtbs, dtb_symlinks) 203 return (all_dtbs, dtb_symlinks)
204 204
@@ -234,8 +234,9 @@ class FitImageTestCase(OESelftestTestCase):
234 self.logger.debug("its file: %s" % its_file.read()) 234 self.logger.debug("its file: %s" % its_file.read())
235 235
236 # Generate a list of expected paths in the its file 236 # Generate a list of expected paths in the its file
237 req_its_paths = self._get_req_its_paths(bb_vars) 237 req_its_paths, not_req_its_paths = self._get_req_its_paths(bb_vars)
238 self.logger.debug("req_its_paths:\n%s\n" % pprint.pformat(req_its_paths, indent=4)) 238 self.logger.debug("req_its_paths:\n%s\n" % pprint.pformat(req_its_paths, indent=4))
239 self.logger.debug("not_req_its_paths:\n%s\n" % pprint.pformat(not_req_its_paths, indent=4))
239 240
240 # Generate a dict of expected configuration signature nodes 241 # Generate a dict of expected configuration signature nodes
241 req_sigvalues_config = self._get_req_sigvalues_config(bb_vars) 242 req_sigvalues_config = self._get_req_sigvalues_config(bb_vars)
@@ -275,6 +276,11 @@ class FitImageTestCase(OESelftestTestCase):
275 if not req_path in its_paths: 276 if not req_path in its_paths:
276 self.fail('Missing path in its file: %s (%s)' % (req_path, its_file_path)) 277 self.fail('Missing path in its file: %s (%s)' % (req_path, its_file_path))
277 278
279 # check if all not expected paths are absent in the its file
280 for not_req_path in not_req_its_paths:
281 if not_req_path in its_paths:
282 self.fail('Unexpected path found in its file: %s (%s)' % (not_req_path, its_file_path))
283
278 # Check if all the expected singnature nodes (images and configurations) are found 284 # Check if all the expected singnature nodes (images and configurations) are found
279 self.logger.debug("sigs:\n%s\n" % pprint.pformat(sigs, indent=4)) 285 self.logger.debug("sigs:\n%s\n" % pprint.pformat(sigs, indent=4))
280 if req_sigvalues_config or req_sigvalues_image: 286 if req_sigvalues_config or req_sigvalues_image:
@@ -353,7 +359,7 @@ class FitImageTestCase(OESelftestTestCase):
353 359
354 def _get_req_its_paths(self, bb_vars): 360 def _get_req_its_paths(self, bb_vars):
355 self.logger.error("This function needs to be implemented") 361 self.logger.error("This function needs to be implemented")
356 return [] 362 return ([], [])
357 363
358 def _get_req_its_fields(self, bb_vars): 364 def _get_req_its_fields(self, bb_vars):
359 self.logger.error("This function needs to be implemented") 365 self.logger.error("This function needs to be implemented")
@@ -499,7 +505,7 @@ class KernelFitImageBase(FitImageTestCase):
499 return (fitimage_its_path, fitimage_path) 505 return (fitimage_its_path, fitimage_path)
500 506
501 def _get_req_its_paths(self, bb_vars): 507 def _get_req_its_paths(self, bb_vars):
502 """Generate a list of expected paths in the its file 508 """Generate a list of expected and a list of not expected paths in the its file
503 509
504 Example: 510 Example:
505 [ 511 [
@@ -515,15 +521,26 @@ class KernelFitImageBase(FitImageTestCase):
515 uboot_sign_enable = bb_vars.get('UBOOT_SIGN_ENABLE') 521 uboot_sign_enable = bb_vars.get('UBOOT_SIGN_ENABLE')
516 522
517 # image nodes 523 # image nodes
518 images = [ 'kernel-1' ] 524 images = ['kernel-1']
525 not_images = []
526
519 if dtb_files: 527 if dtb_files:
520 images += [ 'fdt-' + dtb for dtb in dtb_files ] 528 images += [ 'fdt-' + dtb for dtb in dtb_files ]
529
521 if fit_uboot_env: 530 if fit_uboot_env:
522 images.append('bootscr-' + fit_uboot_env) 531 images.append('bootscr-' + fit_uboot_env)
532 else:
533 not_images.append('bootscr-boot.cmd')
534
523 if bb_vars['MACHINE'] == "qemux86-64": # Not really the right if 535 if bb_vars['MACHINE'] == "qemux86-64": # Not really the right if
524 images.append('setup-1') 536 images.append('setup-1')
537 else:
538 not_images.append('setup-1')
539
525 if initramfs_image and initramfs_image_bundle != "1": 540 if initramfs_image and initramfs_image_bundle != "1":
526 images.append('ramdisk-1') 541 images.append('ramdisk-1')
542 else:
543 not_images.append('ramdisk-1')
527 544
528 # configuration nodes (one per DTB and also one per symlink) 545 # configuration nodes (one per DTB and also one per symlink)
529 if dtb_files: 546 if dtb_files:
@@ -541,7 +558,12 @@ class KernelFitImageBase(FitImageTestCase):
541 req_its_paths.append(['/', 'configurations', configuration, 'hash-1']) 558 req_its_paths.append(['/', 'configurations', configuration, 'hash-1'])
542 if uboot_sign_enable == "1": 559 if uboot_sign_enable == "1":
543 req_its_paths.append(['/', 'configurations', configuration, 'signature-1']) 560 req_its_paths.append(['/', 'configurations', configuration, 'signature-1'])
544 return req_its_paths 561
562 not_req_its_paths = []
563 for image in not_images:
564 not_req_its_paths.append(['/', 'images', image])
565
566 return (req_its_paths, not_req_its_paths)
545 567
546 def _get_req_its_fields(self, bb_vars): 568 def _get_req_its_fields(self, bb_vars):
547 initramfs_image = bb_vars['INITRAMFS_IMAGE'] 569 initramfs_image = bb_vars['INITRAMFS_IMAGE']
@@ -572,10 +594,23 @@ class KernelFitImageBase(FitImageTestCase):
572 fit_conf_prefix = bb_vars.get('FIT_CONF_PREFIX', "conf-") 594 fit_conf_prefix = bb_vars.get('FIT_CONF_PREFIX', "conf-")
573 its_field_check.append('default = "' + fit_conf_prefix + fit_conf_default_dtb + '";') 595 its_field_check.append('default = "' + fit_conf_prefix + fit_conf_default_dtb + '";')
574 596
575 its_field_check.append('kernel = "kernel-1";') 597 # configuration nodes (one per DTB and also one per symlink)
598 dtb_files, dtb_symlinks = FitImageTestCase._get_dtb_files(bb_vars)
599 if dtb_files:
600 for dtb in dtb_files:
601 its_field_check.append('kernel = "kernel-1";')
602 its_field_check.append('fdt = "fdt-%s";' % dtb)
603 for dtb in dtb_symlinks:
604 its_field_check.append('kernel = "kernel-1";')
605 # Works only for tests were the symlink is with -alias suffix
606 its_field_check.append('fdt = "fdt-%s";' % dtb.replace('-alias', ''))
576 607
577 if initramfs_image and initramfs_image_bundle != "1": 608 if initramfs_image and initramfs_image_bundle != "1":
578 its_field_check.append('ramdisk = "ramdisk-1";') 609 its_field_check.append('ramdisk = "ramdisk-1";')
610 else:
611 its_field_check.append('kernel = "kernel-1";')
612 if initramfs_image and initramfs_image_bundle != "1":
613 its_field_check.append('ramdisk = "ramdisk-1";')
579 614
580 return its_field_check 615 return its_field_check
581 616
@@ -1032,20 +1067,21 @@ class FitImagePyTests(KernelFitImageBase):
1032 # Provide variables without calling bitbake 1067 # Provide variables without calling bitbake
1033 bb_vars = { 1068 bb_vars = {
1034 # image-fitimage.conf 1069 # image-fitimage.conf
1070 'FIT_ADDRESS_CELLS': "1",
1071 'FIT_CONF_DEFAULT_DTB': "",
1072 'FIT_CONF_PREFIX': "conf-",
1035 'FIT_DESC': "Kernel fitImage for a dummy distro", 1073 'FIT_DESC': "Kernel fitImage for a dummy distro",
1036 'FIT_HASH_ALG': "sha256",
1037 'FIT_SIGN_ALG': "rsa2048",
1038 'FIT_PAD_ALG': "pkcs-1.5",
1039 'FIT_GENERATE_KEYS': "0", 1074 'FIT_GENERATE_KEYS': "0",
1040 'FIT_SIGN_NUMBITS': "2048", 1075 'FIT_HASH_ALG': "sha256",
1041 'FIT_KEY_GENRSA_ARGS': "-F4", 1076 'FIT_KEY_GENRSA_ARGS': "-F4",
1042 'FIT_KEY_REQ_ARGS': "-batch -new", 1077 'FIT_KEY_REQ_ARGS': "-batch -new",
1043 'FIT_KEY_SIGN_PKCS': "-x509", 1078 'FIT_KEY_SIGN_PKCS': "-x509",
1079 'FIT_LINUX_BIN': "linux.bin",
1080 'FIT_PAD_ALG': "pkcs-1.5",
1081 'FIT_SIGN_ALG': "rsa2048",
1044 'FIT_SIGN_INDIVIDUAL': "0", 1082 'FIT_SIGN_INDIVIDUAL': "0",
1045 'FIT_CONF_PREFIX': "conf-", 1083 'FIT_SIGN_NUMBITS': "2048",
1046 'FIT_SUPPORTED_INITRAMFS_FSTYPES': "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio", 1084 'FIT_SUPPORTED_INITRAMFS_FSTYPES': "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio",
1047 'FIT_CONF_DEFAULT_DTB': "",
1048 'FIT_ADDRESS_CELLS': "1",
1049 'FIT_UBOOT_ENV': "", 1085 'FIT_UBOOT_ENV': "",
1050 # kernel.bbclass 1086 # kernel.bbclass
1051 'UBOOT_ENTRYPOINT': "0x20008000", 1087 'UBOOT_ENTRYPOINT': "0x20008000",
@@ -1072,6 +1108,9 @@ class FitImagePyTests(KernelFitImageBase):
1072 } 1108 }
1073 if bb_vars_overrides: 1109 if bb_vars_overrides:
1074 bb_vars.update(bb_vars_overrides) 1110 bb_vars.update(bb_vars_overrides)
1111 if logging.DEBUG >= self.logger.level:
1112 debug_output = "\n".join([f"{key} = {value}" for key, value in bb_vars_overrides.items()])
1113 self.logger.debug("bb_vars overrides:\n%s" % debug_output)
1075 1114
1076 root_node = oe.fitimage.ItsNodeRootKernel( 1115 root_node = oe.fitimage.ItsNodeRootKernel(
1077 bb_vars["FIT_DESC"], bb_vars["FIT_ADDRESS_CELLS"], 1116 bb_vars["FIT_DESC"], bb_vars["FIT_ADDRESS_CELLS"],
@@ -1204,7 +1243,7 @@ class UBootFitImageTests(FitImageTestCase):
1204 req_its_paths.append(['/', 'images', image, 'signature']) 1243 req_its_paths.append(['/', 'images', image, 'signature'])
1205 for configuration in configurations: 1244 for configuration in configurations:
1206 req_its_paths.append(['/', 'configurations', configuration]) 1245 req_its_paths.append(['/', 'configurations', configuration])
1207 return req_its_paths 1246 return (req_its_paths, [])
1208 1247
1209 def _get_req_its_fields(self, bb_vars): 1248 def _get_req_its_fields(self, bb_vars):
1210 loadables = ["uboot"] 1249 loadables = ["uboot"]
@@ -1730,4 +1769,3 @@ UBOOT_FIT_GENERATE_KEYS = "1"
1730 self.write_config(config) 1769 self.write_config(config)
1731 bb_vars = self._fit_get_bb_vars() 1770 bb_vars = self._fit_get_bb_vars()
1732 self._test_fitimage(bb_vars) 1771 self._test_fitimage(bb_vars)
1733
diff --git a/meta/lib/oeqa/selftest/cases/rust.py b/meta/lib/oeqa/selftest/cases/rust.py
index 06acf53e9a..31222e2456 100644
--- a/meta/lib/oeqa/selftest/cases/rust.py
+++ b/meta/lib/oeqa/selftest/cases/rust.py
@@ -122,6 +122,9 @@ class RustSelfTestSystemEmulated(OESelftestTestCase, OEPTestResultTestCase):
122 cmd = "export TARGET_VENDOR=\"-poky\";" 122 cmd = "export TARGET_VENDOR=\"-poky\";"
123 cmd = cmd + " export PATH=%s/recipe-sysroot-native/usr/bin/python3-native:%s/recipe-sysroot-native/usr/bin:%s/recipe-sysroot-native/usr/bin/%s:%s/hosttools:$PATH;" % (rustlibpath, rustlibpath, rustlibpath, tcpath, tmpdir) 123 cmd = cmd + " export PATH=%s/recipe-sysroot-native/usr/bin/python3-native:%s/recipe-sysroot-native/usr/bin:%s/recipe-sysroot-native/usr/bin/%s:%s/hosttools:$PATH;" % (rustlibpath, rustlibpath, rustlibpath, tcpath, tmpdir)
124 cmd = cmd + " export RUST_TARGET_PATH=%s/rust-targets;" % rustlibpath 124 cmd = cmd + " export RUST_TARGET_PATH=%s/rust-targets;" % rustlibpath
125 # Strip debug symbols from test binaries to reduce size (300+ MB -> ~140 MB)
126 # PowerPC mac99 QEMU has 768MB RAM limit, so we need to minimize test binary sizes
127 cmd = cmd + " export RUSTFLAGS='-C strip=debuginfo';"
125 # Trigger testing. 128 # Trigger testing.
126 cmd = cmd + " export TEST_DEVICE_ADDR=\"%s:12345\";" % qemu.ip 129 cmd = cmd + " export TEST_DEVICE_ADDR=\"%s:12345\";" % qemu.ip
127 cmd = cmd + " cd %s; python3 src/bootstrap/bootstrap.py test %s --target %s" % (builddir, testargs, targetsys) 130 cmd = cmd + " cd %s; python3 src/bootstrap/bootstrap.py test %s --target %s" % (builddir, testargs, targetsys)
diff --git a/meta/lib/oeqa/selftest/cases/wic.py b/meta/lib/oeqa/selftest/cases/wic.py
index bb4ac23ebf..d7a9b14658 100644
--- a/meta/lib/oeqa/selftest/cases/wic.py
+++ b/meta/lib/oeqa/selftest/cases/wic.py
@@ -1905,6 +1905,42 @@ INITRAMFS_IMAGE = "core-image-initramfs-boot"
1905 self.assertIn("Source parameter 'fill' only works with the '--fixed-size' option, exiting.", result.output) 1905 self.assertIn("Source parameter 'fill' only works with the '--fixed-size' option, exiting.", result.output)
1906 self.assertNotEqual(0, result.status) 1906 self.assertNotEqual(0, result.status)
1907 1907
1908 def test_diskid_on_msdos_partition(self):
1909 """Test diksid on msdos partions"""
1910 img = 'core-image-minimal'
1911 diskid = "0xdeadbbef"
1912 with NamedTemporaryFile("w", suffix=".wks") as wks:
1913 wks.writelines(['bootloader --ptable msdos --diskid %s\n' % diskid,
1914 'part /boot --size=100M --active --fstype=ext4 --label boot\n'
1915 'part / --source rootfs --fstype=ext4 --label root\n'])
1916 wks.flush()
1917 cmd = "wic create %s -e %s -o %s" % (wks.name, img, self.resultdir)
1918 runCmd(cmd)
1919 wksname = os.path.splitext(os.path.basename(wks.name))[0]
1920 out = glob(os.path.join(self.resultdir, "%s-*direct" % wksname))
1921 self.assertEqual(1, len(out))
1922 sysroot = get_bb_var('RECIPE_SYSROOT_NATIVE', 'wic-tools')
1923 result = runCmd("%s/usr/sbin/sfdisk -l %s | grep 'Disk identifier:'" % (sysroot, out[0]))
1924 self.assertEqual("Disk identifier: %s" % diskid.lower(), result.output)
1925
1926 def test_diskid_on_gpt_partition(self):
1927 """Test diksid on gpt partions"""
1928 img = 'core-image-minimal'
1929 diskid = "deadbeef-cafe-babe-f00d-cec2ea4eface"
1930 with NamedTemporaryFile("w", suffix=".wks") as wks:
1931 wks.writelines(['bootloader --ptable gpt --diskid %s\n' % diskid,
1932 'part /boot --size=100M --active --fstype=ext4 --label boot\n'
1933 'part / --source rootfs --fstype=ext4 --label root\n'])
1934 wks.flush()
1935 cmd = "wic create %s -e %s -o %s" % (wks.name, img, self.resultdir)
1936 runCmd(cmd)
1937 wksname = os.path.splitext(os.path.basename(wks.name))[0]
1938 out = glob(os.path.join(self.resultdir, "%s-*direct" % wksname))
1939 self.assertEqual(1, len(out))
1940 sysroot = get_bb_var('RECIPE_SYSROOT_NATIVE', 'wic-tools')
1941 result = runCmd("%s/usr/sbin/sfdisk -l %s | grep 'Disk identifier:'" % (sysroot, out[0]))
1942 self.assertEqual("Disk identifier: %s" % diskid.upper(), result.output)
1943
1908class ModifyTests(WicTestCase): 1944class ModifyTests(WicTestCase):
1909 def test_wic_ls(self): 1945 def test_wic_ls(self):
1910 """Test listing image content using 'wic ls'""" 1946 """Test listing image content using 'wic ls'"""
diff --git a/meta/recipes-bsp/barebox/barebox-common.inc b/meta/recipes-bsp/barebox/barebox-common.inc
index 864c6010c9..e41d0858fd 100644
--- a/meta/recipes-bsp/barebox/barebox-common.inc
+++ b/meta/recipes-bsp/barebox/barebox-common.inc
@@ -3,6 +3,6 @@ SECTION = "bootloaders"
3 3
4LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192" 4LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192"
5 5
6PV = "2025.08.0" 6PV = "2025.09.0"
7SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2" 7SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2"
8SRC_URI[sha256sum] = "b32f141ee708e87cb0cc01d626adafc07bd6eb52d62ca969287d7d27462eab32" 8SRC_URI[sha256sum] = "7df1aa47bb7bf1763a729137ac773e69a4052812af094475d739fc63a9295f0d"
diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb
index 220160a7e1..4fe8ba4d28 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -35,6 +35,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/avahi-${PV}.tar.gz \
35 file://CVE-2023-38471-2.patch \ 35 file://CVE-2023-38471-2.patch \
36 file://CVE-2023-38472.patch \ 36 file://CVE-2023-38472.patch \
37 file://CVE-2023-38473.patch \ 37 file://CVE-2023-38473.patch \
38 file://CVE-2024-52616.patch \
39 file://CVE-2024-52615.patch \
38 " 40 "
39 41
40GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/" 42GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
diff --git a/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
new file mode 100644
index 0000000000..9737f52837
--- /dev/null
+++ b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
@@ -0,0 +1,228 @@
1From 4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942 Mon Sep 17 00:00:00 2001
2From: Michal Sekletar <msekleta@redhat.com>
3Date: Wed, 27 Nov 2024 18:07:32 +0100
4Subject: [PATCH] core/wide-area: fix for CVE-2024-52615
5
6CVE: CVE-2024-52615
7Upstream-Status: Backport [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
8
9Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
10---
11 avahi-core/wide-area.c | 128 ++++++++++++++++++++++-------------------
12 1 file changed, 69 insertions(+), 59 deletions(-)
13
14diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
15index 00a15056e..06df7afc6 100644
16--- a/avahi-core/wide-area.c
17+++ b/avahi-core/wide-area.c
18@@ -81,6 +81,10 @@ struct AvahiWideAreaLookup {
19
20 AvahiAddress dns_server_used;
21
22+ int fd;
23+ AvahiWatch *watch;
24+ AvahiProtocol proto;
25+
26 AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, lookups);
27 AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, by_key);
28 };
29@@ -88,9 +92,6 @@ struct AvahiWideAreaLookup {
30 struct AvahiWideAreaLookupEngine {
31 AvahiServer *server;
32
33- int fd_ipv4, fd_ipv6;
34- AvahiWatch *watch_ipv4, *watch_ipv6;
35-
36 /* Cache */
37 AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
38 AvahiHashmap *cache_by_key;
39@@ -125,35 +126,67 @@ static AvahiWideAreaLookup* find_lookup(AvahiWideAreaLookupEngine *e, uint16_t i
40 return l;
41 }
42
43+static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata);
44+
45 static int send_to_dns_server(AvahiWideAreaLookup *l, AvahiDnsPacket *p) {
46+ AvahiWideAreaLookupEngine *e;
47 AvahiAddress *a;
48+ AvahiServer *s;
49+ AvahiWatch *w;
50+ int r;
51
52 assert(l);
53 assert(p);
54
55- if (l->engine->n_dns_servers <= 0)
56+ e = l->engine;
57+ assert(e);
58+
59+ s = e->server;
60+ assert(s);
61+
62+ if (e->n_dns_servers <= 0)
63 return -1;
64
65- assert(l->engine->current_dns_server < l->engine->n_dns_servers);
66+ assert(e->current_dns_server < e->n_dns_servers);
67
68- a = &l->engine->dns_servers[l->engine->current_dns_server];
69+ a = &e->dns_servers[e->current_dns_server];
70 l->dns_server_used = *a;
71
72- if (a->proto == AVAHI_PROTO_INET) {
73+ if (l->fd >= 0) {
74+ /* We are reusing lookup object and sending packet to another server so let's cleanup before we establish connection to new server. */
75+ s->poll_api->watch_free(l->watch);
76+ l->watch = NULL;
77
78- if (l->engine->fd_ipv4 < 0)
79- return -1;
80+ close(l->fd);
81+ l->fd = -EBADF;
82+ }
83
84- return avahi_send_dns_packet_ipv4(l->engine->fd_ipv4, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT);
85+ assert(a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6);
86
87- } else {
88- assert(a->proto == AVAHI_PROTO_INET6);
89+ if (a->proto == AVAHI_PROTO_INET)
90+ r = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
91+ else
92+ r = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
93
94- if (l->engine->fd_ipv6 < 0)
95- return -1;
96+ if (r < 0) {
97+ avahi_log_error(__FILE__ ": Failed to create socket for wide area lookup");
98+ return -1;
99+ }
100
101- return avahi_send_dns_packet_ipv6(l->engine->fd_ipv6, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
102+ w = s->poll_api->watch_new(s->poll_api, r, AVAHI_WATCH_IN, socket_event, l);
103+ if (!w) {
104+ close(r);
105+ avahi_log_error(__FILE__ ": Failed to create socket watch for wide area lookup");
106+ return -1;
107 }
108+
109+ l->fd = r;
110+ l->watch = w;
111+ l->proto = a->proto;
112+
113+ return a->proto == AVAHI_PROTO_INET ?
114+ avahi_send_dns_packet_ipv4(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT):
115+ avahi_send_dns_packet_ipv6(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
116 }
117
118 static void next_dns_server(AvahiWideAreaLookupEngine *e) {
119@@ -246,6 +279,9 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
120 l->dead = 0;
121 l->key = avahi_key_ref(key);
122 l->cname_key = avahi_key_new_cname(l->key);
123+ l->fd = -EBADF;
124+ l->watch = NULL;
125+ l->proto = AVAHI_PROTO_UNSPEC;
126 l->callback = callback;
127 l->userdata = userdata;
128
129@@ -314,6 +350,12 @@ static void lookup_destroy(AvahiWideAreaLookup *l) {
130 if (l->cname_key)
131 avahi_key_unref(l->cname_key);
132
133+ if (l->watch)
134+ l->engine->server->poll_api->watch_free(l->watch);
135+
136+ if (l->fd >= 0)
137+ close(l->fd);
138+
139 avahi_free(l);
140 }
141
142@@ -572,14 +614,20 @@ static void handle_packet(AvahiWideAreaLookupEngine *e, AvahiDnsPacket *p) {
143 }
144
145 static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata) {
146- AvahiWideAreaLookupEngine *e = userdata;
147+ AvahiWideAreaLookup *l = userdata;
148+ AvahiWideAreaLookupEngine *e = l->engine;
149 AvahiDnsPacket *p = NULL;
150
151- if (fd == e->fd_ipv4)
152- p = avahi_recv_dns_packet_ipv4(e->fd_ipv4, NULL, NULL, NULL, NULL, NULL);
153+ assert(l);
154+ assert(e);
155+ assert(l->fd == fd);
156+
157+ if (l->proto == AVAHI_PROTO_INET)
158+ p = avahi_recv_dns_packet_ipv4(l->fd, NULL, NULL, NULL, NULL, NULL);
159 else {
160- assert(fd == e->fd_ipv6);
161- p = avahi_recv_dns_packet_ipv6(e->fd_ipv6, NULL, NULL, NULL, NULL, NULL);
162+ assert(l->proto == AVAHI_PROTO_INET6);
163+
164+ p = avahi_recv_dns_packet_ipv6(l->fd, NULL, NULL, NULL, NULL, NULL);
165 }
166
167 if (p) {
168@@ -598,32 +646,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
169 e->server = s;
170 e->cleanup_dead = 0;
171
172- /* Create sockets */
173- e->fd_ipv4 = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
174- e->fd_ipv6 = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
175-
176- if (e->fd_ipv4 < 0 && e->fd_ipv6 < 0) {
177- avahi_log_error(__FILE__": Failed to create wide area sockets: %s", strerror(errno));
178-
179- if (e->fd_ipv6 >= 0)
180- close(e->fd_ipv6);
181-
182- if (e->fd_ipv4 >= 0)
183- close(e->fd_ipv4);
184-
185- avahi_free(e);
186- return NULL;
187- }
188-
189- /* Create watches */
190-
191- e->watch_ipv4 = e->watch_ipv6 = NULL;
192-
193- if (e->fd_ipv4 >= 0)
194- e->watch_ipv4 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv4, AVAHI_WATCH_IN, socket_event, e);
195- if (e->fd_ipv6 >= 0)
196- e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
197-
198 e->n_dns_servers = e->current_dns_server = 0;
199
200 /* Initialize cache */
201@@ -651,18 +673,6 @@ void avahi_wide_area_engine_free(AvahiWideAreaLookupEngine *e) {
202 avahi_hashmap_free(e->lookups_by_id);
203 avahi_hashmap_free(e->lookups_by_key);
204
205- if (e->watch_ipv4)
206- e->server->poll_api->watch_free(e->watch_ipv4);
207-
208- if (e->watch_ipv6)
209- e->server->poll_api->watch_free(e->watch_ipv6);
210-
211- if (e->fd_ipv6 >= 0)
212- close(e->fd_ipv6);
213-
214- if (e->fd_ipv4 >= 0)
215- close(e->fd_ipv4);
216-
217 avahi_free(e);
218 }
219
220@@ -680,7 +690,7 @@ void avahi_wide_area_set_servers(AvahiWideAreaLookupEngine *e, const AvahiAddres
221
222 if (a) {
223 for (e->n_dns_servers = 0; n > 0 && e->n_dns_servers < AVAHI_WIDE_AREA_SERVERS_MAX; a++, n--)
224- if ((a->proto == AVAHI_PROTO_INET && e->fd_ipv4 >= 0) || (a->proto == AVAHI_PROTO_INET6 && e->fd_ipv6 >= 0))
225+ if (a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6)
226 e->dns_servers[e->n_dns_servers++] = *a;
227 } else {
228 assert(n == 0);
diff --git a/meta/recipes-connectivity/avahi/files/CVE-2024-52616.patch b/meta/recipes-connectivity/avahi/files/CVE-2024-52616.patch
new file mode 100644
index 0000000000..a156f98728
--- /dev/null
+++ b/meta/recipes-connectivity/avahi/files/CVE-2024-52616.patch
@@ -0,0 +1,104 @@
1From f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
3Date: Mon, 11 Nov 2024 00:56:09 +0100
4Subject: [PATCH] Properly randomize query id of DNS packets
5
6CVE: CVE-2024-52616
7Upstream-Status: Backport [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7]
8
9Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
10---
11 avahi-core/wide-area.c | 36 ++++++++++++++++++++++++++++--------
12 configure.ac | 3 ++-
13 2 files changed, 30 insertions(+), 9 deletions(-)
14
15diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
16index 971f5e714..00a15056e 100644
17--- a/avahi-core/wide-area.c
18+++ b/avahi-core/wide-area.c
19@@ -40,6 +40,13 @@
20 #include "addr-util.h"
21 #include "rr-util.h"
22
23+#ifdef HAVE_SYS_RANDOM_H
24+#include <sys/random.h>
25+#endif
26+#ifndef HAVE_GETRANDOM
27+# define getrandom(d, len, flags) (-1)
28+#endif
29+
30 #define CACHE_ENTRIES_MAX 500
31
32 typedef struct AvahiWideAreaCacheEntry AvahiWideAreaCacheEntry;
33@@ -84,8 +91,6 @@ struct AvahiWideAreaLookupEngine {
34 int fd_ipv4, fd_ipv6;
35 AvahiWatch *watch_ipv4, *watch_ipv6;
36
37- uint16_t next_id;
38-
39 /* Cache */
40 AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
41 AvahiHashmap *cache_by_key;
42@@ -201,6 +206,26 @@ static void sender_timeout_callback(AvahiTimeEvent *e, void *userdata) {
43 avahi_time_event_update(e, avahi_elapse_time(&tv, 1000, 0));
44 }
45
46+static uint16_t get_random_uint16(void) {
47+ uint16_t next_id;
48+
49+ if (getrandom(&next_id, sizeof(next_id), 0) == -1)
50+ next_id = (uint16_t) rand();
51+ return next_id;
52+}
53+
54+static uint16_t avahi_wide_area_next_id(AvahiWideAreaLookupEngine *e) {
55+ uint16_t next_id;
56+
57+ next_id = get_random_uint16();
58+ while (find_lookup(e, next_id)) {
59+ /* This ID is already used, get new. */
60+ next_id = get_random_uint16();
61+ }
62+ return next_id;
63+}
64+
65+
66 AvahiWideAreaLookup *avahi_wide_area_lookup_new(
67 AvahiWideAreaLookupEngine *e,
68 AvahiKey *key,
69@@ -227,11 +252,7 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
70 /* If more than 65K wide area quries are issued simultaneously,
71 * this will break. This should be limited by some higher level */
72
73- for (;; e->next_id++)
74- if (!find_lookup(e, e->next_id))
75- break; /* This ID is not yet used. */
76-
77- l->id = e->next_id++;
78+ l->id = avahi_wide_area_next_id(e);
79
80 /* We keep the packet around in case we need to repeat our query */
81 l->packet = avahi_dns_packet_new(0);
82@@ -604,7 +625,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
83 e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
84
85 e->n_dns_servers = e->current_dns_server = 0;
86- e->next_id = (uint16_t) rand();
87
88 /* Initialize cache */
89 AVAHI_LLIST_HEAD_INIT(AvahiWideAreaCacheEntry, e->cache);
90diff --git a/configure.ac b/configure.ac
91index a3211b80e..31bce3d76 100644
92--- a/configure.ac
93+++ b/configure.ac
94@@ -367,7 +367,8 @@ AC_FUNC_SELECT_ARGTYPES
95 # whether libc's malloc does too. (Same for realloc.)
96 #AC_FUNC_MALLOC
97 #AC_FUNC_REALLOC
98-AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname])
99+AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname getrandom])
100+AC_CHECK_HEADERS([sys/random.h])
101
102 AC_FUNC_CHOWN
103 AC_FUNC_STAT
104
diff --git a/meta/recipes-connectivity/bind/bind_9.20.13.bb b/meta/recipes-connectivity/bind/bind_9.20.15.bb
index de39924c3d..1195b5bdc3 100644
--- a/meta/recipes-connectivity/bind/bind_9.20.13.bb
+++ b/meta/recipes-connectivity/bind/bind_9.20.15.bb
@@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
20 file://0001-avoid-start-failure-with-bind-user.patch \ 20 file://0001-avoid-start-failure-with-bind-user.patch \
21 " 21 "
22 22
23SRC_URI[sha256sum] = "151f9376ead317e646a5d0c9f01c060386d891118d7437a7f829bb9727c7b34c" 23SRC_URI[sha256sum] = "d62b38fae48ba83fca6181112d0c71018d8b0f2ce285dc79dc6a0367722ccabb"
24 24
25UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" 25UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
26# follow the ESV versions divisible by 2 26# follow the ESV versions divisible by 2
diff --git a/meta/recipes-connectivity/openssh/openssh_10.0p1.bb b/meta/recipes-connectivity/openssh/openssh_10.1p1.bb
index 2f446b5540..83b6183858 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.0p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.1p1.bb
@@ -26,7 +26,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
26 file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ 26 file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
27 file://0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch \ 27 file://0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch \
28 " 28 "
29SRC_URI[sha256sum] = "021a2e709a0edf4250b1256bd5a9e500411a90dddabea830ed59cef90eb9d85c" 29SRC_URI[sha256sum] = "b9fc7a2b82579467a6f2f43e4a81c8e1dfda614ddb4f9b255aafd7020bbf0758"
30 30
31CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here." 31CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here."
32 32
diff --git a/meta/recipes-devtools/binutils/binutils-cross-canadian.inc b/meta/recipes-devtools/binutils/binutils-cross-canadian.inc
index 7d7ffe92ce..d28dcaf402 100644
--- a/meta/recipes-devtools/binutils/binutils-cross-canadian.inc
+++ b/meta/recipes-devtools/binutils/binutils-cross-canadian.inc
@@ -21,9 +21,10 @@ LDFLAGS:append:toolchain-clang = " -fuse-ld=bfd"
21do_install () { 21do_install () {
22 autotools_do_install 22 autotools_do_install
23 23
24 # We're not interested in the libs or headers, these would come from the 24 # We're not interested in the plugins, libs, or headers, these would come from the
25 # nativesdk or target version of the binutils recipe 25 # nativesdk or target version of the binutils recipe
26 rm -rf ${D}${prefix}/${TARGET_SYS} 26 rm -rf ${D}${prefix}/${TARGET_SYS}
27 rm -rf ${D}${libdir}/bfd-plugins
27 rm -f ${D}${libdir}/libbfd* 28 rm -f ${D}${libdir}/libbfd*
28 rm -f ${D}${libdir}/libiberty* 29 rm -f ${D}${libdir}/libiberty*
29 rm -f ${D}${libdir}/libopcodes* 30 rm -f ${D}${libdir}/libopcodes*
diff --git a/meta/recipes-devtools/fmt/fmt/run-ptest b/meta/recipes-devtools/fmt/fmt/run-ptest
index a069e4543c..ba1e9fc51f 100644
--- a/meta/recipes-devtools/fmt/fmt/run-ptest
+++ b/meta/recipes-devtools/fmt/fmt/run-ptest
@@ -1,5 +1,5 @@
1#!/bin/sh 1#!/bin/sh
2 2
3for t in `ls ./*-test`; do 3for t in *-test; do
4 ./$t && echo PASS: $t || echo FAIL: $t 4 ./$t && echo PASS: $t || echo FAIL: $t
5done 5done
diff --git a/meta/recipes-devtools/fmt/fmt_11.2.0.bb b/meta/recipes-devtools/fmt/fmt_11.2.0.bb
index 06ba523ada..133e1ae77d 100644
--- a/meta/recipes-devtools/fmt/fmt_11.2.0.bb
+++ b/meta/recipes-devtools/fmt/fmt_11.2.0.bb
@@ -17,7 +17,7 @@ EXTRA_OECMAKE += "-DBUILD_SHARED_LIBS=ON"
17EXTRA_OECMAKE += "${@bb.utils.contains('PTEST_ENABLED', '1', '-DFMT_TEST=ON', '', d)}" 17EXTRA_OECMAKE += "${@bb.utils.contains('PTEST_ENABLED', '1', '-DFMT_TEST=ON', '', d)}"
18 18
19do_install_ptest(){ 19do_install_ptest(){
20 for t in `ls ${B}/bin/*-test`; do 20 for t in ${B}/bin/*-test; do
21 install $t ${D}${PTEST_PATH}/ 21 install $t ${D}${PTEST_PATH}/
22 done 22 done
23} 23}
diff --git a/meta/recipes-devtools/python/python3-hypothesis_6.139.2.bb b/meta/recipes-devtools/python/python3-hypothesis_6.142.2.bb
index b03cc22fac..5ba7c66577 100644
--- a/meta/recipes-devtools/python/python3-hypothesis_6.139.2.bb
+++ b/meta/recipes-devtools/python/python3-hypothesis_6.142.2.bb
@@ -13,7 +13,7 @@ SRC_URI += " \
13 file://test_rle.py \ 13 file://test_rle.py \
14 " 14 "
15 15
16SRC_URI[sha256sum] = "2dc2ff36ea977a9cb7fb68f24a5dbf5d673b88a2e502212676eafe09b699f511" 16SRC_URI[sha256sum] = "c4204a2ce327e45fbaf83a2b58142a285135698dc1d08e368ae9901f06b49e64"
17 17
18RDEPENDS:${PN} += " \ 18RDEPENDS:${PN} += " \
19 python3-attrs \ 19 python3-attrs \
diff --git a/meta/recipes-devtools/python/python3-referencing_0.36.2.bb b/meta/recipes-devtools/python/python3-referencing_0.37.0.bb
index 388c1887fb..a75f5f80d4 100644
--- a/meta/recipes-devtools/python/python3-referencing_0.36.2.bb
+++ b/meta/recipes-devtools/python/python3-referencing_0.37.0.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/python-jsonschema/referencing"
3LICENSE = "MIT" 3LICENSE = "MIT"
4LIC_FILES_CHKSUM = "file://COPYING;md5=93eb9740964b59e9ba30281255b044e2" 4LIC_FILES_CHKSUM = "file://COPYING;md5=93eb9740964b59e9ba30281255b044e2"
5 5
6SRC_URI[sha256sum] = "df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa" 6SRC_URI[sha256sum] = "44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8"
7 7
8inherit pypi python_hatchling 8inherit pypi python_hatchling
9 9
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb b/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb
index a4f3995730..62fdf8e345 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb
@@ -7,18 +7,23 @@ SRC_URI[sha256sum] = "3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbf
7 7
8inherit pypi python_hatchling 8inherit pypi python_hatchling
9 9
10DEPENDS += " \ 10DEPENDS += "python3-hatch-vcs-native"
11 python3-hatch-vcs-native \ 11
12" 12PACKAGECONFIG ??= ""
13# This is not recommended for use upstream, and has large dependencies
14PACKAGECONFIG[openssl] = ",,,python3-cryptography python3-pyopenssl"
15
16do_install:append() {
17 if ! ${@bb.utils.contains("PACKAGECONFIG", "openssl", "true", "false", d)}; then
18 rm -f ${D}${PYTHON_SITEPACKAGES_DIR}/urllib3/contrib/pyopenssl.py
19 fi
20}
13 21
14RDEPENDS:${PN} += "\ 22RDEPENDS:${PN} += "\
15 python3-certifi \
16 python3-cryptography \
17 python3-email \
18 python3-idna \ 23 python3-idna \
24 python3-email \
19 python3-json \ 25 python3-json \
20 python3-netclient \ 26 python3-netclient \
21 python3-pyopenssl \
22 python3-threading \ 27 python3-threading \
23 python3-logging \ 28 python3-logging \
24" 29"
diff --git a/meta/recipes-devtools/qemu/qemu-native_10.0.2.bb b/meta/recipes-devtools/qemu/qemu-native_10.0.6.bb
index 26fa84c180..26fa84c180 100644
--- a/meta/recipes-devtools/qemu/qemu-native_10.0.2.bb
+++ b/meta/recipes-devtools/qemu/qemu-native_10.0.6.bb
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb b/meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb
index 22462e2499..22462e2499 100644
--- a/meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb
+++ b/meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 2ee76e9a7c..3ed5dcc671 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -31,7 +31,6 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
31 file://0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ 31 file://0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \
32 file://0010-configure-lookup-meson-exutable-from-PATH.patch \ 32 file://0010-configure-lookup-meson-exutable-from-PATH.patch \
33 file://0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch \ 33 file://0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch \
34 file://0012-Remove-deprecated-get_event_loop-calls.patch \
35 file://qemu-guest-agent.init \ 34 file://qemu-guest-agent.init \
36 file://qemu-guest-agent.udev \ 35 file://qemu-guest-agent.udev \
37 " 36 "
@@ -39,7 +38,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
39UPSTREAM_CHECK_URI = "https://www.qemu.org" 38UPSTREAM_CHECK_URI = "https://www.qemu.org"
40UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 39UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
41 40
42SRC_URI[sha256sum] = "ef786f2398cb5184600f69aef4d5d691efd44576a3cff4126d38d4c6fec87759" 41SRC_URI[sha256sum] = "c7c40c4b166871e775804e97fce4da65665d1cc93a5c6c9e2ede9d9ee992e7a0"
43 42
44CVE_STATUS[CVE-2007-0998] = "not-applicable-config: The VNC server can expose host files uder some circumstances. We don't enable it by default." 43CVE_STATUS[CVE-2007-0998] = "not-applicable-config: The VNC server can expose host files uder some circumstances. We don't enable it by default."
45 44
@@ -51,6 +50,7 @@ CVE_STATUS[CVE-2023-2680] = "not-applicable-platform: RHEL specific issue."
51 50
52# NVD DB has this CVE as version-less (with "-") 51# NVD DB has this CVE as version-less (with "-")
53CVE_STATUS[CVE-2024-6505] = "fixed-version: this CVE is fixed since 9.1.0" 52CVE_STATUS[CVE-2024-6505] = "fixed-version: this CVE is fixed since 9.1.0"
53CVE_STATUS[CVE-2024-8354] = "fixed-version: this CVE is fixed since 10.0.5"
54 54
55CVE_STATUS[CVE-2023-1386] = "disputed: not an issue as per https://bugzilla.redhat.com/show_bug.cgi?id=2223985" 55CVE_STATUS[CVE-2023-1386] = "disputed: not an issue as per https://bugzilla.redhat.com/show_bug.cgi?id=2223985"
56 56
diff --git a/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch b/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch
deleted file mode 100644
index 64816fe7d9..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch
+++ /dev/null
@@ -1,85 +0,0 @@
1From 5240406747fd43886618ae8194153e6fc957a82a Mon Sep 17 00:00:00 2001
2From: John Snow <jsnow@redhat.com>
3Date: Tue, 13 Aug 2024 09:35:30 -0400
4Subject: [PATCH] Remove deprecated get_event_loop calls
5
6This method was deprecated in 3.12 because it ordinarily should not be
7used from coroutines; if there is not a currently running event loop,
8this automatically creates a new event loop - which is usually not what
9you want from code that would ever run in the bottom half.
10
11In our case, we do want this behavior in two places:
12
13(1) The synchronous shim, for convenience: this allows fully sync
14programs to use QEMUMonitorProtocol() without needing to set up an event
15loop beforehand. This is intentional to fully box in the async
16complexities into the legacy sync shim.
17
18(2) The qmp_tui shell; instead of relying on asyncio.run to create and
19run an asyncio program, we need to be able to pass the current asyncio
20loop to urwid setup functions. For convenience, again, we create one if
21one is not present to simplify the creation of the TUI appliance.
22
23The remaining user of get_event_loop() was in fact one of the erroneous
24users that should not have been using this function: if there's no
25running event loop inside of a coroutine, you're in big trouble :)
26
27Upstream-Status: Backport [https://gitlab.com/qemu-project/python-qemu-qmp/-/merge_requests/33]
28Signed-off-by: John Snow <jsnow@redhat.com>
29---
30 python/qemu/qmp/legacy.py | 9 ++++++++-
31 python/qemu/qmp/qmp_tui.py | 7 ++++++-
32 python/tests/protocol.py | 2 +-
33 3 files changed, 15 insertions(+), 3 deletions(-)
34
35diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py
36index 22a2b56..ea9b803 100644
37--- a/python/qemu/qmp/legacy.py
38+++ b/python/qemu/qmp/legacy.py
39@@ -86,7 +86,14 @@ def __init__(self,
40 "server argument should be False when passing a socket")
41
42 self._qmp = QMPClient(nickname)
43- self._aloop = asyncio.get_event_loop()
44+
45+ try:
46+ self._aloop = asyncio.get_running_loop()
47+ except RuntimeError:
48+ # No running loop; since this is a sync shim likely to be
49+ # used in fully sync programs, create one if neccessary.
50+ self._aloop = asyncio.get_event_loop_policy().get_event_loop()
51+
52 self._address = address
53 self._timeout: Optional[float] = None
54
55diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
56index 2d9ebbd..d11b9fc 100644
57--- a/python/qemu/qmp/qmp_tui.py
58+++ b/python/qemu/qmp/qmp_tui.py
59@@ -377,7 +377,12 @@ def run(self, debug: bool = False) -> None:
60 screen = urwid.raw_display.Screen()
61 screen.set_terminal_properties(256)
62
63- self.aloop = asyncio.get_event_loop()
64+ try:
65+ self.aloop = asyncio.get_running_loop()
66+ except RuntimeError:
67+ # No running asyncio event loop. Create one if necessary.
68+ self.aloop = asyncio.get_event_loop_policy().get_event_loop()
69+
70 self.aloop.set_debug(debug)
71
72 # Gracefully handle SIGTERM and SIGINT signals
73diff --git a/python/tests/protocol.py b/python/tests/protocol.py
74index 56c4d44..8dcef57 100644
75--- a/python/tests/protocol.py
76+++ b/python/tests/protocol.py
77@@ -228,7 +228,7 @@ def async_test(async_test_method):
78 Decorator; adds SetUp and TearDown to async tests.
79 """
80 async def _wrapper(self, *args, **kwargs):
81- loop = asyncio.get_event_loop()
82+ loop = asyncio.get_running_loop()
83 loop.set_debug(True)
84
85 await self._asyncSetUp()
diff --git a/meta/recipes-devtools/qemu/qemu_10.0.2.bb b/meta/recipes-devtools/qemu/qemu_10.0.6.bb
index 5d544d8d13..5d544d8d13 100644
--- a/meta/recipes-devtools/qemu/qemu_10.0.2.bb
+++ b/meta/recipes-devtools/qemu/qemu_10.0.6.bb
diff --git a/meta/recipes-extended/tar/tar_1.35.bb b/meta/recipes-extended/tar/tar_1.35.bb
index ea0993a909..d463eff97d 100644
--- a/meta/recipes-extended/tar/tar_1.35.bb
+++ b/meta/recipes-extended/tar/tar_1.35.bb
@@ -94,3 +94,7 @@ BBCLASSEXTEND = "native nativesdk"
94# Avoid false positives from CVEs in node-tar package 94# Avoid false positives from CVEs in node-tar package
95# For example CVE-2021-{32803,32804,37701,37712,37713} 95# For example CVE-2021-{32803,32804,37701,37712,37713}
96CVE_PRODUCT = "gnu:tar" 96CVE_PRODUCT = "gnu:tar"
97
98# A test uses cmp to compare two 8GB files. Busybox's cmp does the job usually, but it is much slower than
99# diffutils' cmp, and the test times out when there is a high load on the host machine.
100RDEPENDS:${PN}-ptest += "diffutils"
diff --git a/meta/recipes-graphics/images/core-image-weston.bb b/meta/recipes-graphics/images/core-image-weston.bb
index 62305cc1ce..96d9c34bfa 100644
--- a/meta/recipes-graphics/images/core-image-weston.bb
+++ b/meta/recipes-graphics/images/core-image-weston.bb
@@ -4,9 +4,11 @@ IMAGE_FEATURES += "splash package-management ssh-server-dropbear hwcodecs weston
4 4
5LICENSE = "MIT" 5LICENSE = "MIT"
6 6
7inherit core-image 7inherit core-image features_check
8 8
9CORE_IMAGE_BASE_INSTALL += "gtk+3-demo" 9CORE_IMAGE_BASE_INSTALL += "gtk+3-demo"
10CORE_IMAGE_BASE_INSTALL += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'weston-xwayland matchbox-terminal', '', d)}" 10CORE_IMAGE_BASE_INSTALL += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'weston-xwayland matchbox-terminal', '', d)}"
11 11
12QB_MEM = "-m 512" 12QB_MEM = "-m 512"
13
14REQUIRED_DISTRO_FEATURES = "wayland"
diff --git a/meta/recipes-graphics/x11-common/x11-volatiles.bb b/meta/recipes-graphics/x11-common/x11-volatiles.bb
new file mode 100644
index 0000000000..23bd6e1661
--- /dev/null
+++ b/meta/recipes-graphics/x11-common/x11-volatiles.bb
@@ -0,0 +1,20 @@
1SUMMARY = "Xserver Volatile Directories"
2LICENSE = "GPL-2.0-only"
3LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
4SECTION = "x11"
5
6SRC_URI = "file://02_x11"
7
8S = "${UNPACKDIR}"
9
10inherit bin_package features_check
11
12REQUIRED_DISTRO_FEATURES = "x11"
13CONFLICT_DISTRO_FEATURES = "systemd"
14
15do_install() {
16 install -d ${D}${sysconfdir}/default/volatiles
17 install -m 0644 ${UNPACKDIR}/02_x11 ${D}${sysconfdir}/default/volatiles
18}
19
20FILES:${PN} += "${sysconfdir}/default/volatiles"
diff --git a/meta/recipes-graphics/x11-common/x11-volatiles/02_x11 b/meta/recipes-graphics/x11-common/x11-volatiles/02_x11
new file mode 100644
index 0000000000..35c3698479
--- /dev/null
+++ b/meta/recipes-graphics/x11-common/x11-volatiles/02_x11
@@ -0,0 +1,6 @@
1# Volatile entries to match systemd
2# https://github.com/systemd/systemd/blob/main/tmpfiles.d/x11.conf
3d root root 1777 /tmp/.X11-unix none
4d root root 1777 /tmp/.ICE-unix none
5d root root 1777 /tmp/.XIM-unix none
6d root root 1777 /tmp/.font-unix none
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.18.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.18.bb
index 14c45be432..3c8cb0173f 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.18.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.18.bb
@@ -26,3 +26,5 @@ RCONFLICTS:${PN} = "${PN}-extension-dri \
26 ${PN}-extension-extmod \ 26 ${PN}-extension-extmod \
27 ${PN}-extension-dbe \ 27 ${PN}-extension-dbe \
28 " 28 "
29
30RDEPENDS:${PN} += "${@bb.utils.contains("DISTRO_FEATURES", "systemd", "", "x11-volatiles", d)}"
diff --git a/meta/recipes-graphics/xwayland/xwayland_24.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_24.1.8.bb
index 900da524b3..a621af1a7f 100644
--- a/meta/recipes-graphics/xwayland/xwayland_24.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_24.1.8.bb
@@ -47,4 +47,4 @@ do_install:append() {
47 47
48FILES:${PN} += "${libdir}/xorg/protocol.txt" 48FILES:${PN} += "${libdir}/xorg/protocol.txt"
49 49
50RDEPENDS:${PN} += "xkbcomp" 50RDEPENDS:${PN} += "xkbcomp ${@bb.utils.contains("DISTRO_FEATURES", "systemd", "", "x11-volatiles", d)}"
diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20251021.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20251021.bb
index 70fd983b0c..66d3be90e7 100644
--- a/meta/recipes-kernel/linux-firmware/linux-firmware_20251021.bb
+++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20251021.bb
@@ -643,7 +643,6 @@ PACKAGES =+ "${PN}-amphion-vpu-license ${PN}-amphion-vpu \
643 ${PN}-qca-wcn6750 \ 643 ${PN}-qca-wcn6750 \
644 ${PN}-qca-qca2066 \ 644 ${PN}-qca-qca2066 \
645 ${PN}-qca-wcn7850 \ 645 ${PN}-qca-wcn7850 \
646 ${PN}-qca-misc \
647 \ 646 \
648 ${PN}-imx-sdma-license ${PN}-imx-sdma-imx6q ${PN}-imx-sdma-imx7d \ 647 ${PN}-imx-sdma-license ${PN}-imx-sdma-imx6q ${PN}-imx-sdma-imx7d \
649 \ 648 \
@@ -934,7 +933,6 @@ LICENSE:${PN}-qca-wcn399x = "Firmware-qualcommAthos_ath10k"
934LICENSE:${PN}-qca-wcn6750 = "Firmware-qualcommAthos_ath10k" 933LICENSE:${PN}-qca-wcn6750 = "Firmware-qualcommAthos_ath10k"
935LICENSE:${PN}-qca-qca2066 = "Firmware-qualcommAthos_ath10k" 934LICENSE:${PN}-qca-qca2066 = "Firmware-qualcommAthos_ath10k"
936LICENSE:${PN}-qca-wcn7850 = "Firmware-qcom" 935LICENSE:${PN}-qca-wcn7850 = "Firmware-qcom"
937LICENSE:${PN}-qca-misc = "Firmware-qualcommAthos_ath10k & Firmware-qcom"
938 936
939FILES:${PN}-ar3k-license = "${nonarch_base_libdir}/firmware/LICENSE.QualcommAtheros_ar3k" 937FILES:${PN}-ar3k-license = "${nonarch_base_libdir}/firmware/LICENSE.QualcommAtheros_ar3k"
940FILES:${PN}-ar3k = " \ 938FILES:${PN}-ar3k = " \
@@ -1061,12 +1059,7 @@ FILES:${PN}-qca-wcn7850 = " \
1061 ${nonarch_base_libdir}/firmware/qca/hmtnv20.b112* \ 1059 ${nonarch_base_libdir}/firmware/qca/hmtnv20.b112* \
1062 ${nonarch_base_libdir}/firmware/qca/hmtnv20.bin* \ 1060 ${nonarch_base_libdir}/firmware/qca/hmtnv20.bin* \
1063" 1061"
1064FILES:${PN}-qca-misc = "${nonarch_base_libdir}/firmware/qca/*"
1065# -qca is a virtual package that depends upon all qca packages.
1066ALLOW_EMPTY:${PN}-qca = "1" 1062ALLOW_EMPTY:${PN}-qca = "1"
1067# -qca-misc is a catch all package that includes all the qca
1068# firmwares that are not already included in other -qca- packages.
1069ALLOW_EMPTY:${PN}-qca-misc = "1"
1070 1063
1071RDEPENDS:${PN}-ar3k += "${PN}-ar3k-license ${PN}-atheros-license" 1064RDEPENDS:${PN}-ar3k += "${PN}-ar3k-license ${PN}-atheros-license"
1072RDEPENDS:${PN}-ath10k += "${PN}-ath10k-license" 1065RDEPENDS:${PN}-ath10k += "${PN}-ath10k-license"
@@ -1103,7 +1096,6 @@ RDEPENDS:${PN}-qca-wcn399x += "${PN}-ath10k-license"
1103RDEPENDS:${PN}-qca-wcn6750 += "${PN}-ath10k-license" 1096RDEPENDS:${PN}-qca-wcn6750 += "${PN}-ath10k-license"
1104RDEPENDS:${PN}-qca-qca2066 += "${PN}-ath10k-license" 1097RDEPENDS:${PN}-qca-qca2066 += "${PN}-ath10k-license"
1105RDEPENDS:${PN}-qca-wcn7850 += "${PN}-qcom-license" 1098RDEPENDS:${PN}-qca-wcn7850 += "${PN}-qcom-license"
1106RDEPENDS:${PN}-qca-misc += "${PN}-ath10k-license ${PN}-qcom-license"
1107# For ralink 1099# For ralink
1108LICENSE:${PN}-ralink = "Firmware-ralink-firmware" 1100LICENSE:${PN}-ralink = "Firmware-ralink-firmware"
1109LICENSE:${PN}-ralink-license = "Firmware-ralink-firmware" 1101LICENSE:${PN}-ralink-license = "Firmware-ralink-firmware"
diff --git a/meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.16.bb b/meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.17.bb
index c3c77f8719..b4bf1126ab 100644
--- a/meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.16.bb
+++ b/meta/recipes-kernel/linux-libc-headers/linux-libc-headers_6.17.bb
@@ -8,5 +8,5 @@ SRC_URI:append:libc-musl = "\
8 8
9LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" 9LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
10 10
11SRC_URI[sha256sum] = "1a4be2fe6b5246aa4ac8987a8a4af34c42a8dd7d08b46ab48516bcc1befbcd83" 11SRC_URI[sha256sum] = "9b607166a1c999d8326098121222feb080a20a3253975fcdfa2de96ba7f757a7"
12 12
diff --git a/meta/recipes-kernel/linux/kernel-devsrc.bb b/meta/recipes-kernel/linux/kernel-devsrc.bb
index 04dd683dde..411c99ba30 100644
--- a/meta/recipes-kernel/linux/kernel-devsrc.bb
+++ b/meta/recipes-kernel/linux/kernel-devsrc.bb
@@ -400,7 +400,7 @@ do_install() {
400 for ss in $(find $kerneldir/build/scripts -type f -name '*'); do 400 for ss in $(find $kerneldir/build/scripts -type f -name '*'); do
401 sed -i 's,/usr/bin/python2,/usr/bin/env python3,' "$ss" 401 sed -i 's,/usr/bin/python2,/usr/bin/env python3,' "$ss"
402 sed -i 's,/usr/bin/env python2,/usr/bin/env python3,' "$ss" 402 sed -i 's,/usr/bin/env python2,/usr/bin/env python3,' "$ss"
403 sed -i 's,/usr/bin/python,/usr/bin/env python3,' "$ss" 403 sed -i 's,/usr/bin/python$,/usr/bin/env python3,' "$ss"
404 done 404 done
405 405
406 chown -R root:root ${D} 406 chown -R root:root ${D}
diff --git a/meta/recipes-support/lz4/lz4/CVE-2025-62813.patch b/meta/recipes-support/lz4/lz4/CVE-2025-62813.patch
new file mode 100644
index 0000000000..4fa0373ff7
--- /dev/null
+++ b/meta/recipes-support/lz4/lz4/CVE-2025-62813.patch
@@ -0,0 +1,69 @@
1From f64efec011c058bd70348576438abac222fe6c82 Mon Sep 17 00:00:00 2001
2From: louislafosse <louis.lafosse@epitech.eu>
3Date: Mon, 31 Mar 2025 20:48:52 +0200
4Subject: [PATCH] fix(null) : improve error handlings when passing a null
5 pointer to some functions from lz4frame
6
7CVE: CVE-2025-62813
8Upstream-Status: Backport [https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82]
9Signed-off-by: Peter Marko <peter.marko@siemens.com>
10---
11 lib/lz4frame.c | 15 +++++++++++++--
12 tests/frametest.c | 9 ++++++---
13 2 files changed, 19 insertions(+), 5 deletions(-)
14
15diff --git a/lib/lz4frame.c b/lib/lz4frame.c
16index 85daca7b..c9e4a3cf 100644
17--- a/lib/lz4frame.c
18+++ b/lib/lz4frame.c
19@@ -539,9 +539,16 @@ LZ4F_CDict*
20 LZ4F_createCDict_advanced(LZ4F_CustomMem cmem, const void* dictBuffer, size_t dictSize)
21 {
22 const char* dictStart = (const char*)dictBuffer;
23- LZ4F_CDict* const cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
24+ LZ4F_CDict* cdict = NULL;
25+
26 DEBUGLOG(4, "LZ4F_createCDict_advanced");
27- if (!cdict) return NULL;
28+
29+ if (!dictStart)
30+ return NULL;
31+ cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
32+ if (!cdict)
33+ return NULL;
34+
35 cdict->cmem = cmem;
36 if (dictSize > 64 KB) {
37 dictStart += dictSize - 64 KB;
38@@ -1486,6 +1493,10 @@ LZ4F_errorCode_t LZ4F_getFrameInfo(LZ4F_dctx* dctx,
39 LZ4F_frameInfo_t* frameInfoPtr,
40 const void* srcBuffer, size_t* srcSizePtr)
41 {
42+ assert(dctx != NULL);
43+ RETURN_ERROR_IF(frameInfoPtr == NULL, parameter_null);
44+ RETURN_ERROR_IF(srcSizePtr == NULL, parameter_null);
45+
46 LZ4F_STATIC_ASSERT(dstage_getFrameHeader < dstage_storeFrameHeader);
47 if (dctx->dStage > dstage_storeFrameHeader) {
48 /* frameInfo already decoded */
49diff --git a/tests/frametest.c b/tests/frametest.c
50index de0fe643..90247547 100644
51--- a/tests/frametest.c
52+++ b/tests/frametest.c
53@@ -714,10 +714,13 @@ static int unitTests(U32 seed, double compressibility)
54 size_t const srcSize = 65 KB; /* must be > 64 KB to avoid short-size optimizations */
55 size_t const dstCapacity = LZ4F_compressFrameBound(srcSize, NULL);
56 size_t cSizeNoDict, cSizeWithDict;
57- LZ4F_CDict* const cdict = LZ4F_createCDict(CNBuffer, dictSize);
58- if (cdict == NULL) goto _output_error;
59- CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
60+ LZ4F_CDict* cdict = NULL;
61
62+ CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
63+ cdict = LZ4F_createCDict(CNBuffer, dictSize);
64+ if (cdict == NULL)
65+ goto _output_error;
66+
67 DISPLAYLEVEL(3, "Testing LZ4F_createCDict_advanced : ");
68 { LZ4F_CDict* const cda = LZ4F_createCDict_advanced(lz4f_cmem_test, CNBuffer, dictSize);
69 if (cda == NULL) goto _output_error;
diff --git a/meta/recipes-support/lz4/lz4_1.10.0.bb b/meta/recipes-support/lz4/lz4_1.10.0.bb
index 9bd3cfc27b..f2a86036b5 100644
--- a/meta/recipes-support/lz4/lz4_1.10.0.bb
+++ b/meta/recipes-support/lz4/lz4_1.10.0.bb
@@ -14,7 +14,9 @@ SRCREV = "ebb370ca83af193212df4dcbadcc5d87bc0de2f0"
14 14
15SRC_URI = "git://github.com/lz4/lz4.git;branch=release;protocol=https \ 15SRC_URI = "git://github.com/lz4/lz4.git;branch=release;protocol=https \
16 file://reproducibility.patch \ 16 file://reproducibility.patch \
17 file://run-ptest" 17 file://run-ptest \
18 file://CVE-2025-62813.patch \
19"
18UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.*)" 20UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.*)"
19 21
20inherit ptest 22inherit ptest
diff --git a/scripts/lib/wic/ksparser.py b/scripts/lib/wic/ksparser.py
index 48b5b09ddd..4ccd70dc55 100644
--- a/scripts/lib/wic/ksparser.py
+++ b/scripts/lib/wic/ksparser.py
@@ -16,6 +16,7 @@ import os
16import shlex 16import shlex
17import logging 17import logging
18import re 18import re
19import uuid
19 20
20from argparse import ArgumentParser, ArgumentError, ArgumentTypeError 21from argparse import ArgumentParser, ArgumentError, ArgumentTypeError
21 22
@@ -196,7 +197,7 @@ class KickStart():
196 bootloader.add_argument('--configfile') 197 bootloader.add_argument('--configfile')
197 bootloader.add_argument('--ptable', choices=('msdos', 'gpt', 'gpt-hybrid'), 198 bootloader.add_argument('--ptable', choices=('msdos', 'gpt', 'gpt-hybrid'),
198 default='msdos') 199 default='msdos')
199 bootloader.add_argument('--diskid', type=lambda x: int(x, 0)) 200 bootloader.add_argument('--diskid')
200 bootloader.add_argument('--timeout', type=int) 201 bootloader.add_argument('--timeout', type=int)
201 bootloader.add_argument('--source') 202 bootloader.add_argument('--source')
202 203
@@ -297,6 +298,24 @@ class KickStart():
297 if append_var: 298 if append_var:
298 self.bootloader.append = ' '.join(filter(None, \ 299 self.bootloader.append = ' '.join(filter(None, \
299 (self.bootloader.append, append_var))) 300 (self.bootloader.append, append_var)))
301 if parsed.diskid:
302 if parsed.ptable == "msdos":
303 try:
304 self.bootloader.diskid = int(parsed.diskid, 0)
305 except ValueError:
306 err = "with --ptbale msdos only 32bit integers " \
307 "are allowed for --diskid. %s could not " \
308 "be parsed" % self.ptable
309 raise KickStartError(err)
310 else:
311 try:
312 self.bootloader.diskid = uuid.UUID(parsed.diskid)
313 except ValueError:
314 err = "with --ptable %s only valid uuids are " \
315 "allowed for --diskid. %s could not be " \
316 "parsed" % (parsed.ptable, parsed.diskid)
317 raise KickStartError(err)
318
300 else: 319 else:
301 err = "%s:%d: more than one bootloader specified" \ 320 err = "%s:%d: more than one bootloader specified" \
302 % (confpath, lineno) 321 % (confpath, lineno)
diff --git a/scripts/lib/wic/plugins/imager/direct.py b/scripts/lib/wic/plugins/imager/direct.py
index f40f033a3d..ad922cfbf1 100644
--- a/scripts/lib/wic/plugins/imager/direct.py
+++ b/scripts/lib/wic/plugins/imager/direct.py
@@ -315,7 +315,14 @@ class PartitionedImage():
315 # all partitions (in bytes) 315 # all partitions (in bytes)
316 self.ptable_format = ptable_format # Partition table format 316 self.ptable_format = ptable_format # Partition table format
317 # Disk system identifier 317 # Disk system identifier
318 if disk_id: 318 if disk_id and ptable_format in ('gpt', 'gpt-hybrid'):
319 self.disk_guid = disk_id
320 elif os.getenv('SOURCE_DATE_EPOCH'):
321 self.disk_guid = uuid.UUID(int=int(os.getenv('SOURCE_DATE_EPOCH')))
322 else:
323 self.disk_guid = uuid.uuid4()
324
325 if disk_id and ptable_format == 'msdos':
319 self.identifier = disk_id 326 self.identifier = disk_id
320 elif os.getenv('SOURCE_DATE_EPOCH'): 327 elif os.getenv('SOURCE_DATE_EPOCH'):
321 self.identifier = random.Random(int(os.getenv('SOURCE_DATE_EPOCH'))).randint(1, 0xffffffff) 328 self.identifier = random.Random(int(os.getenv('SOURCE_DATE_EPOCH'))).randint(1, 0xffffffff)
@@ -545,11 +552,6 @@ class PartitionedImage():
545 552
546 def _write_disk_guid(self): 553 def _write_disk_guid(self):
547 if self.ptable_format in ('gpt', 'gpt-hybrid'): 554 if self.ptable_format in ('gpt', 'gpt-hybrid'):
548 if os.getenv('SOURCE_DATE_EPOCH'):
549 self.disk_guid = uuid.UUID(int=int(os.getenv('SOURCE_DATE_EPOCH')))
550 else:
551 self.disk_guid = uuid.uuid4()
552
553 logger.debug("Set disk guid %s", self.disk_guid) 555 logger.debug("Set disk guid %s", self.disk_guid)
554 sfdisk_cmd = "sfdisk --sector-size %s --disk-id %s %s" % \ 556 sfdisk_cmd = "sfdisk --sector-size %s --disk-id %s %s" % \
555 (self.sector_size, self.path, self.disk_guid) 557 (self.sector_size, self.path, self.disk_guid)
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-02 10:27:59 +0000