summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* llvm: update 14.0.6 -> 15.0.1Alexander Kanavin2022-10-292-3/+4
| | | | | | | | | | 'Release' type follows standard practice elsewhere in core, particularly rust-llvm as well. (From OE-Core rev: 20adf74207b8c3eac7871e27da2df1aa26fca3b6) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnu-config: update to latest revisionAlexander Kanavin2022-10-291-2/+2
| | | | | | | | (From OE-Core rev: b4d105d0d2bc54cf3987cbb9665588ec7aa037bd) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unfs3: correct upstream version checkAlexander Kanavin2022-10-291-1/+1
| | | | | | | | (From OE-Core rev: 70897a57b2f3f0eaaa937fe84383d6e26cd62c72) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cmake-native: Fix host tool contaminationBernhard Rosenkränzer2022-10-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [v2 hopefully fixes the From: mangling by the ML, no functional changes] Trying to build cmake-native on a host system where curl was built with cmake (resulting in CURLConfig.cmake and friends, which do not use the same naming schemes expected by cmake-native's build process, being installed to a system wide cmake directory like /usr/lib64/cmake/CURL) results in undefined references to all libcurl symbols. The problem is that cmake-native sees and uses the system wide /usr/lib64/cmake/CURL/CURLConfig.cmake, which defines CURL::libcurl and CURL::curl as opposed to setting ${CURL_LIBRARIES} as expected by cmake-native. find_package(CURL) (cmake-native's CMakeLists.txt, line 478) succeeds, but incorrectly uses the system wide CURLConfig.cmake, resulting CMAKE_CURL_LIBRARIES to be set to an empty string (cmake-native's CMakeLists.txt, line 484), causing the cmake-native build to miss -lcurl. The simplest fix is to let cmake know the right value for CURL_LIBRARIES. Making it -lcurl should always work with libcurl-native in recipe-sysroot-native. [YOCTO #14951] (From OE-Core rev: 2659c735a464c956b4fca0894a5aed27a0fe7e37) Signed-off-by: Bernhard Rosenkränzer <bero@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: fetch2/git: don't set core.fsyncobjectfiles=0Ross Burton2022-10-291-1/+1
| | | | | | | | | | | | | | | | | This git configuration variable is deprecated in 2.36.0 onwards, so git warns in the logs for every git call. Luckily the default value has always been false[1], so we can just remove this. [ YOCTO #14939 ] [1] https://github.com/git/git/commit/aafe9fbaf4f1d1f27a6f6e3eb3e246fff81240ef (Bitbake rev: 8ad310633e0c5d5593631c1196cbdde30147efce) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: use references to the "Build Directory" termMichael Opdenacker2022-10-2827-376/+294
| | | | | | | | | | | | | | Replace instances of "Build Directory" and "build directory" (when applicable) by :term:`Build Directory` as already done in most places. Doing this, fix the indentation of the paragraphs with this term. (From yocto-docs rev: dce50679242d39f133e0cde5c8483b5e69f3eb54) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: add missing references to SDKMACHINE and SDK_ARCHMichael Opdenacker2022-10-283-16/+14
| | | | | | | | | Doing this, fix the odd identation of the corresponding paragraphs (From yocto-docs rev: e319b3bf4eb6420949372e699d60c7383945e513) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: stop referring to the meta-openembedded repo from GitHubMichael Opdenacker2022-10-284-12/+8
| | | | | | | (From yocto-docs rev: de6e7c05fbcff99a6f1fe2a2bf889b559b9b576b) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* manuals: replace "_" by "__" in external linksMichael Opdenacker2022-10-286-13/+12
| | | | | | | (From yocto-docs rev: 25142cd8121fdd6a8e0524fc8417fc666c498981) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Documentation/README: formalize guidelines for external link syntaxMichael Opdenacker2022-10-281-0/+13
| | | | | | | (From yocto-docs rev: f5d10ceed943270d7bcfa31b5936f37a60669c7f) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: common-tasks.rst: refactor and improve "Checking for ↵Mikko Rapeli2022-10-281-46/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Vulnerabilities" section Add sub section to how Poky and OE-Core handle CVE security issues. This is a generic intro chapter. Also add note that this is a process which needs quite a bit of review and iteration to keep products and SW stack secure, a process not a product. Then change "Vulnerabilites in images" chapter to "Vulnerability check at build time" since the process applies to anything compiled with bitbake, not just images. Explain details of how to work with cve-check.bbclass, especially the states Patched, Unpatched and Ignored in the generated reports. Rename recipe chapter to "Fixing CVE product name and version mappings" since CVE check has some default which works for all recipes but generated reports may be completely broken. Fixes are then done with CVE_PRODUCT and CVE_VERSION. Give some hints how to analyze "Unpatched" CVEs by checking what happens in other Linux distros etc. (From yocto-docs rev: 77a9c1a9fe651bf11f1d5a723b0741dd1764b2c8) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: common-tasks.rst: add regular updates and CVE scans to security ↵Mikko Rapeli2022-10-281-0/+7
| | | | | | | | | | | | | best practices Regular security scans and updates to fix issues and updates from upstream maintainers are best practices. (From yocto-docs rev: 24d3337b6cbb38297877f6ce6ec78896ce93e8b2) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: classes.rst: improve documentation for cve-check.bbclassMikko Rapeli2022-10-281-2/+50
| | | | | | | | | | | It is a quite important tool for maintaining yocto based products so documentation should include the best practices. (From yocto-docs rev: 3f7d09fc3c96f29ab80a2cb893c9b4b19a75a769) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: variables.rst: add documentation for CVE_VERSIONMikko Rapeli2022-10-281-0/+12
| | | | | | | | | | Related to cve-check.bbclass. (From yocto-docs rev: 1218775a9b32ac16556645c5d186007c19a5baf4) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: add info on buildtools-make-tarballPaul Eggleton2022-10-281-1/+25
| | | | | | | | | | | | | PENDING ON THIS OE-CORE PATCH: install-buildtools: support buildtools-make-tarball and update to 4.1 https://lists.openembedded.org/g/openembedded-core/message/171522 Cover the use case and the new provided tarball. (From yocto-docs rev: 3a06c35d059d7d43f7eb33a4f490f5d76afe6cb6) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: add wic command bootloader ptable optionAdrian Freihofer2022-10-281-6/+11
| | | | | | | | | | Reordering the bootloader command options alphabetically (From yocto-docs rev: 9d43fcf8ba023be1350ed2b26482d2d5e44cf0cb) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: fix a typo for CVE-2022-2953.patchQiu, Zheng2022-10-281-1/+1
| | | | | | | | | | The CVE number in the patch is a typo. CVE-2022-2053 is not related to libtiff. So fix it. (From OE-Core rev: c9f76ef859b0b4edb83ac098816b625f52c78173) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mirrors.bbclass: use shallow tarball for binutils-nativeEtienne Cordonnier2022-10-281-0/+1
| | | | | | | | | | | | This is useful e.g. when using meta-clang, which introduces a dependency to binutils-native, and then a full tarball of binutils is fetched additionally to a shallow tarball. The original BB_GIT_SHALLOW lines were added because of https://www.mail-archive.com/yocto@lists.yoctoproject.org/msg08752.html (From OE-Core rev: bd83b8b502ae935c75b59aaf71bbb531c9771dcc) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: add support to build on ppc64leAndrew Geissler2022-10-281-0/+1
| | | | | | | | | | Verified by building on a ppc64le based system (From OE-Core rev: 6f9bb7094b34d9cbafa8618ada46a94a06332545) Signed-off-by: Andrew Geissler <geissonator@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: skip FDT section creation for applicable symlinksAhmad Fatoum2022-10-281-1/+32
| | | | | | | | | | | | | | | | | | When building a FIT image with device trees, each device tree lands in a FIT section and is referenced by a FIT configuration node. FIT images however also allow referencing the same device tree from multiple configurations. This can be useful to reduce FIT image size while staying compatible with existing bootloaders. Allow kernel-fitimage.bbclass users to take advantage of this by mapping each symlink to a regular device tree included in the FIT to a configuration that references a common device tree section. (From OE-Core rev: 21e240da63239826f3ef50ceef40c9519e9030d8) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: mangle slashes to underscores as late as possibleAhmad Fatoum2022-10-281-4/+4
| | | | | | | | | | | | | This introduces no functional change, but will come in handy in a later commit where a file lookup will have us using the device tree name. If we keep it like it's now, we will lose the information whether an underscore is an original underscore or a mangled slash. (From OE-Core rev: 8bea426ca59d17715a3b32f7e3caf3e4b6db5ce9) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lighttpd: upgrade 1.4.66 -> 1.4.67wangmy2022-10-282-33/+1
| | | | | | | | | | | | | | | | | | | | Changelog: ============= * Update comment about TCP_INFO on OpenBSD * [mod_ajp13] fix crash with bad response headers (fixes #3170) * [core] handle RDHUP when collecting chunked body * [core] tweak streaming request body to backends * [core] handle ENOSPC with pwritev() (#3171) * [core] manually calculate off_t max (fixes #3171) * [autoconf] force large file support (#3171) * [multiple] quiet coverity warnings using casts * [meson] add license keyword to project declaration (From OE-Core rev: 7a399862bb2e1503fbffa18e7ec0767643f76132) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rust: install rustfmt for riscv32 as wellAlexander Kanavin2022-10-281-1/+0
| | | | | | | | | | With the above rust arch fixes it builds just fine. (From OE-Core rev: f417ae30c79fac99e2549324ed351f6f63cc4a25) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rust-target-config: match riscv target names with what rust expectsAlexander Kanavin2022-10-282-14/+28
| | | | | | | | | | | | | | | | | | | | Official rust risc-v targets are prefixed with riscv32gc- and riscv64gc-: https://doc.rust-lang.org/nightly/rustc/platform-support.html Particularly crossbeam-utils make important build time decisions for atomics based on those names, and so we need to match ours with official targets. On the other hand, the actual definitions for those targets do not use the 'gc' suffix in 'arch' and 'llvm-target' fields, and so we need to follow that too, to avoid cryptic mismatch errors from rust-llvm: https://github.com/rust-lang/rust/blob/master/compiler/rustc_target/src/spec/riscv32gc_unknown_linux_gnu.rs (From OE-Core rev: 1cfb9c8a59d98ccc9b0510cd28fb933f72fb6b6c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: backport the fix for CVE-2022-3165Ross Burton2022-10-282-0/+60
| | | | | | | | (From OE-Core rev: d820389728b0f5e085954b4f995da2b2014acedf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: fix a number of CVEsRoss Burton2022-10-285-1/+1018
| | | | | | | | | | | | | | | | Backport fixes from upstream for the following CVEs: - CVE-2022-3599 - CVE-2022-3597 - CVE-2022-3626 - CVE-2022-3627 - CVE-2022-3570 - CVE-2022-3598 (From OE-Core rev: 722bbb88777cc3c7d1c8273f1279fc18ba33e87c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mesa: update 22.2.0 -> 22.2.2Markus Volk2022-10-283-1/+3
| | | | | | | | | | - add a PACKAGECONFIG for perfetto support (From OE-Core rev: cbcaff0b4cc349706b9847f4262746b43adba209) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake-user-manual: details about variable flags starting with ↵Michael Opdenacker2022-10-271-0/+6
| | | | | | | | | | | underscore Fixes [YOCTO #14140] (Bitbake rev: 0f3e9d87168813ce49995ff04bccdce11c5f7b47) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: tests/fetch: Allow handling of a file:// url within a submoduleRichard Purdie2022-10-261-2/+2
| | | | | | | | | CVE-2022-39253 in git meant file:// urls within submodules were disabled. Add a parameter to the commands in the tests to allow this to continue to work. (Bitbake rev: 209f7ba352b60722830157054e3fc56cb9c693eb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Fix SSL_CERT_FILE to match ca-certs locationRichard Purdie2022-10-261-1/+1
| | | | | | | | | | | | In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: tests: bb.tests.fetch.URLHandle: add 2 new testsMark Asselstine2022-10-261-0/+2
| | | | | | | | | | | | | | | | | Add a test for special characters in user and password to qualify decodeurl() inspired by a bug report describing that '=' signs in a password was problematic. Add a second test to qualify decodeurl() as related to the change in commit 628c4bf6c89b [fetch2/__init__: handle @ in package names]. Relates to [YOCTO #14476] (Bitbake rev: ee04cf09c7022168c035affa654773652a49793e) Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: doc: bitbake-user-manual: expand description of BB_PRESSURE_MAX ↵Michael Opdenacker2022-10-261-17/+43
| | | | | | | | | | | variables (Bitbake rev: 72e9847dd578c3cbed52a9c16fea23ebbeef5046) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils/ply: Update md5 to better report errors with hashlibMark Hatle2022-10-262-1/+13
| | | | | | | | | | | | | | | | | | | | | | In the case where hashlib is not available, the try would fail and fall through resulting in a backtrace on the usage of the 'sig'. The backtrace itself was confusing and made it difficult to determine what went wrong. Update the import to be in it's own try block with an appropriate message to indicate what went wrong. Note, the current version of ply all of this code has been restructured so this is not applicable upstream. Additionally, some versions of hashlib don't appear to implement the second FIPS related argument. Detect this and support both versions. (Bitbake rev: 484ab42f440070c0369b81f5c69da860fa47a798) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake: user-manual: inform about spaces in :removeJohan Korsnes2022-10-261-1/+2
| | | | | | | | | | | | | | | | | | | | Inform the reader that there should be no need for spaces in the value when using removal override `:remove`. Considering why spaces are used in the other override operators, it might seem obvious that they aren't needed for the removal operator. But, it seems like I'm not the first to be confused about this. Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com> Cc: Ross Burton <ross.burton@arm.com> Cc: Nicolas Dechesne <nicolas.dechesne@linaro.org> (Bitbake rev: 0a493a772f83436cbe909de93c157f4ab2d2d136) Signed-off-by: Johan Korsnes <johan.korsnes@remarkable.no> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Rework signing to remove interdependenciesSean Anderson2022-10-265-296/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The U-Boot signing code is a bit of a mess. The problem is that mkimage determines the public keys to embed into a device tree based on an image that it is signing. This results in all sorts of contortions: U-Boot has to be available to the kernel recipe so that it can have the correct public keys embedded. Then, the signed U-Boot has to be made available to U-Boot's do_deploy. This same dance is then repeated for SPL. To complicate matters, signing for U-Boot and U-Boot SPL is optional, so the whole process must be seamlessly integrated with a non-signed build. The complexity and interdependency of this process makes it difficult to extend. For example, it is not possible to install a signed U-Boot binary into the root filesystem. This is first because u-boot:do_install must run before linux:do_assemble_fitimage, which must run before u-boot:do_deploy. But aside from infrastructure issues, installing a signed U-Boot also can't happen, because the kernel image might have an embedded initramfs (containing the signed U-Boot). However, all of this complexity is accidental. It is not necessary to embed the public keys into U-Boot and sign the kernel in one fell swoop. Instead, we can sign the kernel, stage it, and sign the staged kernel again to embed the public keys into U-Boot [1]. This twice-signed kernel serves only to provide the correct parameters to mkimage, and does not have to be installed or deployed. By cutting the dependency of linux:do_assemble_fitimage on u-boot:do_install, we can drastically simplify the build process, making it much more extensible. The process of doing this conversion is a bit involved, since the U-Boot and Linux recipes are so intertwined at the moment. The most major change is that uboot-sign is no longer inherited by kernel-fitimage. Similarly, all U-Boot-related tasks have been removed from kernel-fitimage. We add a new step to the install task to stage the kernel in /sysroot-only. The logic to disable assemble_fitimage has been removed. We always assemble it, even if the final fitImage will use a bundled initramfs, because U-Boot will need it. On the U-Boot side, much of the churn stems from multiple config support. Previously, we took a fairly ad-hoc approach to UBOOT_CONFIG and UBOOT_MACHINE, introducing for loops wherever we needed to deal with them. However, I have chosen to use a much more structured approach. Each task which needs to use the build directory uses the following pseudocode: do_mytask() { if ${UBOOT_CONFIG}; then for config, type in zip(${UBOOT_CONFIG}, ${UBOOT_MACHINE}); do cd ${config} mytask_helper ${type} done else cd ${B} mytask_helper "" fi } By explicitly placing the work in mytask_helper, we make it easier to ensure that everything is covered, and we also allow bbappends files to more easily extend the task (as otherwise they would need to reimplement the loop themselves). [1] It doesn't particularly matter what we sign. Any FIT will do, but I chose the kernel's because we already went to the trouble of setting it up with the correct hashes and signatures. In the future, we could create a "dummy" image and sign that instead, but it would probably have to happen in the kernel recipe anyway (so we have access to the appropriate variables). (From OE-Core rev: 5e12dc911d0c541f43aa6d0c046fb87e8b7c1f7e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Split off kernel-fitimage variablesSean Anderson2022-10-263-15/+32
| | | | | | | | | | In preparation for the next commit, split off several (From OE-Core rev: 60c1a170f1f8c11bc8f42026debf121433b39115) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Use bitbake variables directlySean Anderson2022-10-261-20/+10
| | | | | | | | | | | | | | | uboot_fitimage_assemble is called from one place with the same arguments. Instead of using shell variables as intermediaries, simplify the function by using the bitbake variables directly. Removing a layer of indirection makes it easier to determine what values are being substituted in. Some variables can't be fully converted, but they will be addressed in the a few commits. (From OE-Core rev: 27f42c9b9a91742d3ee358aa8dc29627379b2539) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: Use KERNEL_OUTPUT_DIR where appropriateSean Anderson2022-10-261-8/+8
| | | | | | | | | | | We have a specific variable for the path to the boot directory. Use it instead of open-coding this path. (From OE-Core rev: 725b75e83bc2b2111f2ab5103b7e7f60d6d3f34e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel: Clear SYSROOT_DIRS instead of replacing sysroot_stage_allSean Anderson2022-10-261-3/+1
| | | | | | | | | | | | Replacing sysroot_stage_all by a no-op recipe makes it difficult for bbappends to stage files intentionally. Instead, just clear SYSROOT_DIRS, allowing other bbappends to easily add new directories. (From OE-Core rev: 849791e7086463a4c7c53c2c1ed9603a6c3a080d) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Fix using wrong KEY_REQ_ARGSSean Anderson2022-10-261-1/+1
| | | | | | | | | | | | | When generating our SPL-verifying certificate, we use FIT_KEY_REQ_ARGS, which is intended for the U-Boot-verifying certificate. Instead, use UBOOT_FIT_KEY_REQ_ARGS. Fixes: 0e6b0fefa0 ("u-boot: Use a different Key for SPL signing") (From OE-Core rev: a2d939ccb182a1ad29280d236b9f9e1d09527af1) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: upgrade 2.37.3 -> 2.38.1Tim Orling2022-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2022-39260 Git v2.38.1 Release Notes ========================= This release merges the security fix that appears in v2.30.6; see the release notes for that version for details. Excerpt from 2.30.6 release notes: * CVE-2022-39260: An overly-long command string given to `git shell` can result in overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution when `git shell` is exposed and the directory `$HOME/git-shell-commands` exists. `git shell` is taught to refuse interactive commands that are longer than 4MiB in size. `split_cmdline()` is hardened to reject inputs larger than 2GiB. Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub. The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau. For 2.38.0 changes, see: https://github.com/git/git/blob/master/Documentation/RelNotes/2.38.0.txt (From OE-Core rev: b304768711374066db320fe87960be81f54a8424) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551Ross Burton2022-10-263-0/+103
| | | | | | | | (From OE-Core rev: e32401d8bf44afcca88af7e4c5948d2c28e1813f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: ignore CVE-2022-3553 as it is XQuartz-specificRoss Burton2022-10-261-0/+2
| | | | | | | | (From OE-Core rev: 769576f36aac9652525beec5c7e8a4d26632b844) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libx11: apply the fix for CVE-2022-3554Ross Burton2022-10-262-0/+58
| | | | | | | | (From OE-Core rev: 5d30f124274d2822d72b56f84eb8c8ae64e31e0d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-yocto: improve fatal error messages of symbol_why.pyJose Quaresma2022-10-261-5/+5
| | | | | | | | | | | | Improve the fatal error message of the yocto-kernel-tools symbol_why.py and shows the command that generate the error as it can help understand the root cause of the error. (From OE-Core rev: 54ae08779071f2e97bff0ff6514ede3124312c3b) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: add HOMEPAGE and link to documentationMikko Rapeli2022-10-261-0/+2
| | | | | | | | | | | | It's important to use standard variable names in the /etc/os-release file. Otherwise reporting version etc details requires custom modifications in various tools. (From OE-Core rev: af528f4b46e5df0a176d91d46cc6f89c7296c602) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: replace DISTRO_CODENAME with VERSION_CODENAMEMikko Rapeli2022-10-261-1/+2
| | | | | | | | | | | | | Latter is the /etc/os-release standard to report distro codenames like "langdale". https://www.freedesktop.org/software/systemd/man/os-release.html#VERSION_CODENAME= (From OE-Core rev: 2565b435176a16aca5b747044cc3643d845f6486) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gstreamer1.0-libav: fix errors with ffmpeg 5.xClaus Stovgaard2022-10-262-1/+89
| | | | | | | | | | | | | Backport of patch already present upstream to fix issues with invalid characters for GLIB when combining gstreamer1.0-libav with ffmpeg 5.x. Remove when gstreamer1.0-libav is upgraded to 1.21.1 or above (From OE-Core rev: 703ff945557ad307bbe4ba0b0b7f1a2e5b4b847e) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: Remove a trailing slash from ${B}Peter Kjellerstedt2022-10-261-1/+1
| | | | | | | | | | | | | The trailing slash in ${B} caused -fdebug-prefix-map=${B}=... to not match as intended, resulting in ${TMPDIR} ending up in files in ${PN}-dbg when externalsrc was in use, which in turn triggered buildpath QA warnings. (From OE-Core rev: 9b5031ed5a0d102905fa75acc418246c23df6eef) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: Do not perturb script environmentJoshua Watt2022-10-261-12/+14
| | | | | | | | | | | | | | | | | | | | | Instead of changing the script environment to affect the child processes, make a copy of the environment with modifications and pass that to subprocess. Specifically, when dri rendering is enabled, LD_PRELOAD was being passed to all processes created by the script which resulted in other commands (e.g. stty) exiting with a failure like: /bin/sh: symbol lookup error: sysroots-uninative/x86_64-linux/lib/librt.so.1: undefined symbol: __libc_unwind_link_get, version GLIBC_PRIVATE Making a copy of the environment fixes this because the LD_PRELOAD is now only passed to qemu itself. (From OE-Core rev: 2232599d330bd5f2a9e206b490196569ad855de8) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-14 11:38:28 +0000