summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/meta
Commit message (Collapse)AuthorAgeFilesLines
* buildtools-tarball: Fix conflicts with oe-selftest and other toolingRichard Purdie2020-09-231-0/+3
| | | | | | | | | | | | OECORE_NATIVE_SYSROOT is used by tools like oe-run-native and hence we were seeing selftest failures when newer buildtools-tarballs that use this were run on the autobuilder. Unset the variable after use to avoid these issues. (From OE-Core rev: ea5128fde10eb9be7fefbbb87ae6181edd2bcdff) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: Add python3-jinja2Richard Purdie2020-09-211-0/+1
| | | | | | | | | | | | This is used by various pieces of the result handling code, particularly the performance testing and we're seeing autobuilder failures that are easiest resolved using this. Acked-by: Tim Orling <ticotimo@gmail.com> (From OE-Core rev: e86a07e7105fd1cc4fd3e5aa22ff07aca6e960d7) Signed-off-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: remove unused variableChris Laplante2020-09-151-1/+0
| | | | | | | (From OE-Core rev: 790f8a5bfbd1851226fa5fc5b09e79f6396e747d) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: move -journal checking into do_fetchChris Laplante2020-09-151-6/+8
| | | | | | | | | | | It was always questionable to do this in an anonymous function, but now with multiconfig it is a critical mistake and leads to more strange "Exception: sqlite3.OperationalError: disk I/O error" errors. (From OE-Core rev: fcbc9d0e8421a3a559db05005ba042337cd5d864) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: be less magical about checking whether the cve-check ↵Chris Laplante2020-09-151-2/+1
| | | | | | | | | class is enabled (From OE-Core rev: cbc717350b21fb417fa6f83621022ac633a26124) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use fetch taskRoss Burton2020-09-121-4/+5
| | | | | | | | | | Instead of inventing a new task to fetch the CVE data, use the existing fetch task. (From OE-Core rev: f5f97d33a1703d75b9fd9760f2c7767081538e00) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add more logging when fetchingRoss Burton2020-09-121-1/+5
| | | | | | | | | Add some debug logging when fetching the CVE data. (From OE-Core rev: 9b230584664873af2ab453b8153b1ad276d3b0af) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: remove unused importRoss Burton2020-09-121-1/+1
| | | | | | | | | This import isn't used anymore, so remove it. (From OE-Core rev: d4f0e43bdf1de972e95869f033dd45f8d420c400) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use context manager for cve_fChris Laplante2020-09-101-4/+1
| | | | | | (From OE-Core rev: ff422652e1b5db62205fafc75ce56bb5951d478d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check/cve-update-db-native: use lockfile to fix usage under multiconfigChris Laplante2020-09-101-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously CVE_CHECK_DB_FILE / CVE_CHECK_DB_DIR was the same across multiconfigs which led to a race condition wherein multiple cve-update-db-native:do_populate_cve_db tasks could attempt to write to the same sqlite database. This led to the following task failure: Error executing a python function in exec_python_func() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_python_func() autogenerated', lineno: 2, function: <module> 0001: *** 0002:do_populate_cve_db(d) 0003: File: '/mnt/data/agent/work/74f119cccb44f133/yocto/sources/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 103, function: do_populate_cve_db 0099: if year == date.today().year: 0100: cve_f.write('CVE database update : %s\n\n' % date.today()) 0101: 0102: cve_f.close() *** 0103: conn.commit() 0104: conn.close() 0105:} 0106: 0107:def initialize_db(c): Exception: sqlite3.OperationalError: disk I/O error Use a lockfile to ensure multiple tasks don't step over each other. (From OE-Core rev: 24e9380643a2ae3fcae193519cb64aedaf682153) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add progress handlerChris Laplante2020-09-101-43/+47
| | | | | | | (From OE-Core rev: 79ae2e82b8ec11578177f428060b568d6c7d44ca) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nativesdk-sdk-provides-dummy: Add /bin/shRichard Purdie2020-08-224-2/+4
| | | | | | | | | | | | | | By doing this we can revert b18c32ab6bc9c4f1953e9f79aa39bc92d1c4e30d which was a pretty ugly hack anyway and now means the different providers are all being handled consistently. Anyone with SDK recipes will need to ensure nativesdk-sdk-provides-dummy is included in those builds (or an equivalent). This is a good thing to do anyway. (From OE-Core rev: dd2c603befdd65c92c6196d5b103568249766b3e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools: Handle generic environment setup injectionRichard Purdie2020-08-081-8/+11
| | | | | | | | | | | | | | | Currently buildtools has its own hacked environment setup. We added capability for generic script fragements but this code was never updated to use it even if several components it contains needs it. Remove a hardcoded variable in favour of the generic scripts to avoid bugs in this area in future. The others should probably be migrated to environment files in future too but there isn't such a file for those at present. (From OE-Core rev: eb210cee4bd71614dd108027e6d5aa8f8d451b27) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update: handle baseMetricV2 as optionalKonrad Weihmann2020-07-271-4/+9
| | | | | | | | | | | Currently in NVD DB an item popped up, which hasn't set baseMetricV2. Let the parser handle it as an optional item. In case use baseMetricV2 before baseMetricV3 (From OE-Core rev: fdcbf3f28289188c5a97664d1421d4a5c4991eda) Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* deploy.bbclass: Clean DEPLOYDIR before do_deployDaniel Klauer2020-06-301-2/+0
| | | | | | | | | | | | | | | | | | | | | | do_deploy should clean up ${DEPLOYDIR} before running, just like do_install cleans up ${D} before running. This reduces the risk of DEPLOYDIR being accidentally contaminated by files from previous runs, possibly even with different config, in case of incremental builds. It is convenient to have this in deploy.bbclass, so it doesn't have to be duplicated in every recipe, considering for example meta-freescale, which has 23 affected recipes. All recipes using deploy.bbclass (grep -r 'inherit .*deploy') in poky, meta-openembedded and meta-freescale look like they either benefit from this or are at least not affected negatively by it. The only exception I've noticed was uboot-sign.bbclass, which was however fixed by the previous patch. (From OE-Core rev: 7083a7d56f4d90c81d2e6652ee291d20fd908bbe) Signed-off-by: Daniel Klauer <daniel.klauer@gin.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: Remove native version of grub-efiJacob Kroon2020-06-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The native version of grub-efi only installs the tools /usr/bin/grub-editenv /usr/bin/grub-mkimage to sysroots-components/, but equivalent tools are already provided by grub-native, the difference on x86_64 being 4 hardwired paths in grub-mkimage (values taken from grub-native): LOCALEDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share/locale GRUB_DATADIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share GRUB_LIBDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/lib GRUB_SYSCONFDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/etc If grub-native and grub-efi-native are built with the following patch --- grub-2.04.orig/configure.ac +++ grub-2.04/configure.ac @@ -1980,10 +1980,10 @@ grub_libdir="$(eval echo "$libdir")" grub_localedir="$(eval echo "$localedir")" grub_datadir="$(eval echo "$datadir")" grub_sysconfdir="$(eval echo "$sysconfdir")" -AC_DEFINE_UNQUOTED(LOCALEDIR, "$grub_localedir", [Locale dir]) -AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "$grub_libdir", [Library dir]) -AC_DEFINE_UNQUOTED(GRUB_DATADIR, "$grub_datadir", [Data dir]) -AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "$grub_sysconfdir", [Configuration dir]) +AC_DEFINE_UNQUOTED(LOCALEDIR, "/non-existent", [Locale dir]) +AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "/non-existent", [Library dir]) +AC_DEFINE_UNQUOTED(GRUB_DATADIR, "/non-existent", [Data dir]) +AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "/non-existent", [Configuration dir]) the produced grub-editenv/grub-mkimage binaries become binary equivalent, assuming reproducible builds is active. Since the unpatched values of LOCALEDIR/GRUB_DATADIR/GRUB_LIBDIR/GRUB_SYSCONFDIR point to directories that are not expected to exist at runtime, they can be ignored. Therefore: * remove grub-efi-native and instead rely on the same tools from grub-native * replace references to grub-efi-native with grub-native * remove unused grub-efi-native security flags overrides (From OE-Core rev: 7044181df7487f047d175242f7ebbc3c35bf5402) Signed-off-by: Jacob Kroon <jacob.kroon@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: export OPENSSL_CONF in environment setupSteve Sakoman2020-06-151-0/+1
| | | | | | | | | | | The autobuilder has been experiencing SSL: CERTIFICATE_VERIFY_FAILED errors during error report uploads when using buildtools due to looking for certs in /opt/poky (From OE-Core rev: 197f1d5d14b8e57295f5a81c03c86abba5328614) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-sysroots: add sysroot paths with native binaries to PATHAlexander Kanavin2020-06-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | staging_populate_sysroot_dir() collects postinsts from the sysroot and executes them. These postinsts, in turn, may call binaries that are only available from the sysroot. This works fine with recipe-specific sysroots, as all necessary paths are already in PATH, but breaks down in this recipe which imitates the old global sysroot way but doesn't adjust the PATH to include the binary paths from global sysroot. To reproduce the failure: $ bitbake docbook-xml-dtd4-native $ bitbake -c build_native_sysroot build-sysroots ... Exception: subprocess.CalledProcessError: Command '/home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog' returned non-zero exit status 127. Subprocess output: /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: 5: /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: xmlcatalog: not found /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: 8: /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: xmlcatalog: not found (From OE-Core rev: 6b5f7bda4204d45cd29670cefcd53dc5da031095) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* populate_sdk_base: Add ld.so.conf for nativesdk-binutilsOvidiu Panait2020-04-291-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Extend the functionality provided by commit [1] to the SDK as well. This way we can make sure that nativesdk-binutils finds SDK libraries first rather than host ones. This is useful for example when trying to build the linux kernel using nativesdk-gcc. This scenario currently fails because it tries to link to host libraries rather than SDK host ones: make x86_64_defconfig make bzImage ... error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel Makefile:1101: recipe for target 'prepare-objtool' failed make: *** [prepare-objtool] Error 1 .... /../../../../x86_64-wrlinuxsdk-linux/bin/ld: /lib/x86_64-linux-gnu/libpthread.so.0: undefined reference to `__libc_vfork@GLIBC_PRIVATE' ... [1] 15049c610b [buildtools-tarball: Add an ld.so.conf for nativesdk-binutils] (From OE-Core rev: 7ec84a463ad4c45aee9cd2cbc75b43e5aab5cd18) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-extended-tarball: add libgomp-devAlexander Kanavin2020-04-291-0/+1
| | | | | | | | | | This is needed in particular for newer versions of rpm which would otherwise fail to build due to absence of omp.h header. (From OE-Core rev: 319ae973740bc291cb3e02e3cb2b4df2109df53e) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic: root: Add an opt. destination on include-pathRicardo Ribalda Delgado2020-04-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Allow specifying an optional destination to include-path and make the option aware of permissions and owners. It is very useful for making a partition that contains the rootfs for a host and a target Eg: / -> Roofs for the host /export/ -> Rootfs for the target (which will netboot) Although today we support making a partition for "/export" this might not be compatible with some upgrade systems, or we might be limited by the number of partitions. With this patch we can use something like: part / --source rootfs --fstype=ext4 --include-path core-image-minimal-mtdutils export/ --include-path hello on the .wks file. Cc: Paul Barker <pbarker@konsulko.com> (From OE-Core rev: e8c21c6ebaebde88151697381bdb2452f1171090) Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: add nativesdk-mtools for `wic ls'hongxu2020-04-241-0/+1
| | | | | | | | | | | | | | | | | | | On ubuntu 18.04.1, it does not provides `mdir' by default which caused `wic ls **.wic' failed on fat partition ... $ wic ls build/tmp-glibc/deploy/images/xilinx-zynqmp/wrlinux-image-std-xilinx-zynqmp.wic ERROR: Can't find executable 'mdir' ... Add nativesdk-mtools to buildtools-tarball and use buildtools to provide mdir (From OE-Core rev: f35a6586d62a98589ef6454f36b8fbeb30029c1b) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-extended-tarball: Add libstc++.aJeremy Puhlman2020-04-241-0/+1
| | | | | | | | | | | | Builds like native-openjdk, really wants a to link some tools against the static version. Since when using the extended tarball, its the only place to get it, add the library. (From OE-Core rev: 59c4a3fdbbfd5a6aaba7e0a1675dcd5866a7f3a4) Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: fix DB file version for '-'Lee Chee Yang2020-04-051-0/+3
| | | | | | | | | | | fix logic for CVE DB update so that when the CPE version is '-', it keeps the version as '-' in the DB file too and leave other operation as blank. (From OE-Core rev: 0ec35b00d65c70485eb1efe602d9fca53e926811) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: CPE version '-' as all versionLee Chee Yang2020-04-011-1/+1
| | | | | | | | | | | | | | | | | | CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean DB if temporary file existLee Chee Yang2020-03-291-1/+8
| | | | | | | | | | | | | | | | when do_populate_cve_db forced stop at certain point, the DB execution are stoped however the temporary database file (DB-JOURNAL) are not removed. This db-journal file indicates that DB is incomplete and set DB in readonly mode. So when db-journal exist, remove both DB and the db-journal and build the DB again from scratch. [YOCTO #13682] (From OE-Core rev: 70713df25b8ae27a21e53b0b9234567d7053800a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: prevent fatal error cause by networkLee Chee Yang2020-03-291-1/+7
| | | | | | | | | | | prevent cve-check from fatal error cause by network issue. [YOCTO #13680] (From OE-Core rev: da358e415726f836e6b3e69ad7fbeffb50bd402d) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-extended-tarball: Add locale commandRichard Purdie2020-03-111-0/+1
| | | | | | | | | The eSDK installation code checks installed locales with the locale command which is from glibc-utils. Add this so that we find the correct locales from the buildtools. (From OE-Core rev: 7d35e4bc6ff94a2d03c48827d7d60a6855c9029d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-extended-tarball: add nativesdk-libxcrypt-devJeremy Puhlman2020-03-061-0/+1
| | | | | | | | | | | | | virtual/crypt-native is assume provided in bitbake.conf, so buildtools-extended-tarball shoud provide crypt since it doesn't use the host's headers/libraries. [YOCTO #13714] (From OE-Core rev: da948b25d5ef452fb35275d108e18d2a2829f4fb) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* image.bbclass, package-index.bb: Delete do_populate_lic taskKhem Raj2020-02-151-0/+1
| | | | | | | | | These are meta packages (From OE-Core rev: e6ea95ae85763670aef35f7cb025eea693138d07) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patch: Extend to native/nativesdk and depend uponRichard Purdie2020-02-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | There is a bug in patch 2.7.3 and earlier where index lines in patches can change file modes when they shouldn't: http://git.savannah.gnu.org/cgit/patch.git/patch/?id=82b800c9552a088a241457948219d25ce0a407a4 This leaks into debug sources in particular (e.g. tcp-wrappers where source files are read-only). Add the dependency to target recipes to avoid this problem until we can rely on 2.7.4 or later. We could try and remove all index lines from patch files but it will be a losing battle. We could try and identify all the recipes which change modes on files in patches but again, its a losing battle. Instead, compromise and have patch-native as a dependency for target recipes. We use patch-replacement-native since patch-native is in ASSUME_PROVIDED. Also add nativesdk-patch to buildtools-tarball. [YOCTO #13777] (From OE-Core rev: 5ed0840c93804488cd1c1aba6cb382b2434714a5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: Add an ld.so.conf for nativesdk-binutilsRichard Purdie2020-01-221-0/+4
| | | | | | | | | | | We need to search our own libdirs, then fall back to the system ones as our customised dynamic loader will. Have ld.so.conf reflect that. This ensures that binutils finds libraries here when linking too. (From OE-Core rev: 15049c610bcfd0a3e161379651b5ea117ea02715) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta-extsdk-toolchain: Mark as nostampRichard Purdie2020-01-111-0/+3
| | | | | | | | | | | | This recipe needs to generate the latest hashes. With unihash we may not rebuild as previous dependencies may be marked as equivalent. eSDK which uses this is nostamp already, mark this task as nostamp also for the same reason. (From OE-Core rev: e8cfc8525c5d903ee876eafd56521f4a7325a6f5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dummy-sdk-package.inc: do multilib expanesion for RREPLACES as wellAlexander Kanavin2020-01-101-2/+3
| | | | | | | | | | | | | | Otherwise, multilib packages such as lib64-perl aren't properly replaced: Error: Problem: package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with lib64-perl provided by lib64-perl-5.30.1-r0.x86_64 - package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with lib64-perl-module-strict provided by lib64-perl-5.30.1-r0.x86_64 - package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with lib64-perl-module-warnings provided by lib64-perl-5.30.1-r0.x86_64 - package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with lib64-perl-module-vars provided by lib64-perl-5.30.1-r0.x86_64 (From OE-Core rev: 1f807b2c51df8a7e66d7aad6e531afef42942e6e) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-extended-tarball: add recipe with build-essentialsTim Orling2020-01-011-0/+32
| | | | | | | | | | | | | | | | | * For some aging distros, such as CentOS 7, the native version of gcc is simply too ancient and is a constant source of headaches for moving forward. * Add an extended version of buildtools-tarball which adds all of build-essential, so that the host is now modernized and capable of compiling the latest versions of components. Fixes [YOCTO #13714] (From OE-Core rev: f0377af2325613b63716b0bb4db1ab253d79f388) Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nativesdk-buildtools-perl-dummy: add dependencies for autoconf and automakeTim Orling2019-12-301-0/+3
| | | | | | | | | | * For buildtools-extended-tarball, where we are adding all of build-essentials to the nativesdk, we need additional perl modules for autoconf and automake. (From OE-Core rev: f0f766160663407ea7683d31bbf5f011accc9ba2) Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Switch to NVD CVE JSON feed version 1.1Niko Mauno2019-12-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to recently released version 1.1 of NVD CVE JSON feed, as in https://nvd.nist.gov/General/News/JSON-1-1-Vulnerability-Feed-Release it is mentioned that Due to changes required to support CVSS v3.1 scoring, the JSON vulnerability feeds must be modified. This will require the consumers of this data to update their internal processes. We will be providing the JSON 1.1 schema on the data feeds page and the information below to prepare for this transition. ... The JSON 1.1 data feeds will be available on September 9th, 2019. At that time the current JSON 1.0 data feeds will no longer available. This change was tested briefly by issuing 'bitbake core-image-minimal' with 'cve-check.bbclass' inherited via local.conf, and then comparing the content between the resulting two 'DEPLOY_DIR_IMAGE/core-image-minimal-qemux86.cve' files, which did not seem to contain any other change, except total of 167 entries like CVSS v3 BASE SCORE: 0.0 were replaced with similar 'CVSS v3 BASE SCORE:' entries which had scores that were greater than '0.0' (up to '9.8'). (From OE-Core rev: cc20e4d8ff2f3aa52a2658404af9a0ff358cc323) Signed-off-by: Niko Mauno <niko.mauno@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dummy-sdk-package.inc: do not include files into RREPLACESAlexander Kanavin2019-11-281-1/+2
| | | | | | | | | rpm 4.15 no longer allows it, which makes sense. (From OE-Core rev: 017d0f34619cf56dd223ba8c075af5f7e128e61b) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dummy-sdk-package: Add DUMMYPROVIDES_PACKAGESRichard Purdie2019-11-284-3/+11
| | | | | | | | | We're about to need to use this variable in the main include file so restructure the users of it to all set it appropriately. (From OE-Core rev: 4a247e7c961286cbed73b6dc0f4074ecf856402a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean up proxy handlingRoss Burton2019-11-211-26/+5
| | | | | | | | | | urllib handles adding proxy handlers if the proxies are set in the environment, so call bb.utils.export_proxies() to do that and remove the manual setup. (From OE-Core rev: 6b73004668b3b71c9c38814b79fbb58c893ed434) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add an index on the CVE ID columnRoss Burton2019-11-211-0/+3
| | | | | | | | | | Create an index on the PRODUCTS table which contains a row for each CPE, drastically increasing the performance of lookups for a specific CVE. (From OE-Core rev: b4048b05b3a00d85c40d09961f846eadcebd812e) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: don't hardcode the database nameRoss Burton2019-11-211-2/+2
| | | | | | | | | | Don't hardcode the database filename, there's a variable for this in cve-check.bbclass. (From OE-Core rev: 0d188a9dc4ae64c64cd661e9d9c3841e86f226ab) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: don't refresh more than once an hourRoss Burton2019-11-141-1/+9
| | | | | | | | | | | We already fetch the yearly CVE metadata and check that for updates before downloading the full data, but we can speed up CVE checking further by only checking the CVE metadata once an hour. (From OE-Core rev: 50d898fd360c58fe85460517d965f62b7654771a) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: export OPENSSL_CONF for opensslLiwei Song2019-11-141-0/+1
| | | | | | | | | export OPENSSL_CONF to aviod SDK openssl can not find openssl.cnf. (From OE-Core rev: 0aaf3dd17dcde959e9c0d62543cb91c9b33551b4) Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "meta-extsdk: Either an sstate task is a proper task or it isn't"Richard Purdie2019-09-271-5/+0
| | | | | | | | This reverts commit db5f08c16eff01f3af0b99119c09f68628e2331d. (From OE-Core rev: 4ed7861875c3f28090e014265f1f576ae0608eb7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta-extsdk: Either an sstate task is a proper task or it isn'tRichard Purdie2019-09-191-0/+5
| | | | | | | | | Ensure the task is properly regsistered as an sstate task as this "half way" state confuses new code in bitbake and it isn't supported. (From OE-Core rev: 53d6cd98216e3b73c0c90e42223efd1a2b649358) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* target-sdk-provides-dummy: extend packages for multilib caseChen Qi2019-08-211-4/+8
| | | | | | | | | | | | | | | | | | | | | | If we have installed some lib32 package which depends on perl/bash, then populating sdk for that image would fail with the following error. Error: Problem: package lib32-libxml-namespacesupport-perl-1.12-r0.corei7_32 requires lib32-perl, but none of the providers can be installed package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with /usr/bin/perl provided by lib32-perl-5.30.0-r0.corei7_32 package target-sdk-provides-dummy-1.0-r0.sdk_provides_dummy_target conflicts with libperl.so.5 provided by lib32-perl-5.30.0-r0.corei7_32 This could be produced by the following steps: 1. IMAGE_INSTALL_append = " lib32-valgrind" 2. bitbake core-image-minimal -c populate_sdk We need to extend all packages in DUMMYPROVIDES to avoid such problems. (From OE-Core rev: 6a38c6aafc2956bb6f7824eff4ac0f630f02da75) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: fix https proxy issuesChin Huat Ang2019-07-261-11/+30
| | | | | | | | | | | | | | When https_proxy is set, use proxy opener to open CVE metadata and database URLs, otherwise fallback to the urllib.request.urlopen. Also fix a minor issue where the json database which has been gzip decompressed as byte object should be decoded as utf-8 string as expected by update_db. (From OE-Core rev: 95438d52b732bec217301fbfc2fb019bbc3707c8) Signed-off-by: Chin Huat Ang <chin.huat.ang@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean up JSON fetchingRoss Burton2019-07-221-17/+12
| | | | | | | | | | | | | Currently the code fetches the compressed JSON, writes it to a temporary file, uncompresses that with gzip and passes the fake file object to update_db(). Instead, uncompress the gzip'd data in memory and pass the JSON directly to update_db(). (From OE-Core rev: 9422745979256c442f533770203f62ec071c18fb) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: improve metadata parsingRoss Burton2019-07-221-8/+10
| | | | | | | | | | | | | | | | The metadata parser is fragile: first it coerces a bytes() to a str() (so the string is b'LastModifiedDate:2019...'), assumes the first line is the date, and then uses a regex to parse (which then includes the trailing quote as part of the date). Clean this up by parsing the bytes as UTF-8 (ASCII is probably fine, but this is safer), iterate through the lines and split on colons to find the right key/value pair. (From OE-Core rev: bb4e53af33d6ca1e9346464adbdc1b39c47530f3) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-18 01:51:07 +0000