summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
* glibc: CVE-2020-1752Zhixiong Chi2020-06-022-0/+67
| | | | | | | | | | | | Backport the CVE patch from upstream: git://sourceware.org/git/glibc.git commit ddc650e9b3dc916eab417ce9f79e67337b05035c (From OE-Core rev: 50b04216e47b1bf0da8170c7fd62d18a07d10152) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionzeus-22.0.3yocto-3.0.3Richard Purdie2020-05-141-1/+1
| | | | | | (From OE-Core rev: 9bab7c1a29a58ba7f97e253e4e0ac167b77d0e65) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix CVE-2020-1712wenlin.kang@windriver.com2020-05-072-0/+521
| | | | | | | | | | Fix CVE-2020-1712 (From OE-Core rev: 0d0c87e6c6082e1ac9d60d6131f889c53c25a9cc) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean DB if temporary file existLee Chee Yang2020-05-071-1/+8
| | | | | | | | | | | | | | | | | | | | | when do_populate_cve_db forced stop at certain point, the DB execution are stoped however the temporary database file (DB-JOURNAL) are not removed. This db-journal file indicates that DB is incomplete and set DB in readonly mode. So when db-journal exist, remove both DB and the db-journal and build the DB again from scratch. [YOCTO #13682] (From OE-Core rev: 70713df25b8ae27a21e53b0b9234567d7053800a) (From OE-Core rev: 3f3bdb014cb6d87ee2e22db3c76b99ca6085787a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: CVE-2020-1751Zhixiong Chi2020-05-072-0/+71
| | | | | | | | | | | | Backport the CVE patch from upstream: git://sourceware.org/git/glibc.git commit d93769405996dfc11d216ddbe415946617b5a494 (From OE-Core rev: 807d416cb8b01de4dbb96236653bb47447018ad0) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: CPE version '-' as all versionLee Chee Yang2020-04-291-1/+1
| | | | | | | | | | | | | | | | | | | | | CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: 1e8e188514584f9f972c0eb733c10a61853ec3d0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: on upgrade save busybox if it is the last shellJeremy Puhlman2020-04-171-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | During a busybox upgrade on a ipk based system, it is possible that busybox is the only shell in the system. During the uninstall the alternative for /bin/sh is removed and everything after that goes down hill. * Add a check to verify if busybox is the shell, and save it to the busyboxrm directory created in tmp. Then add an alternative for /bin/sh that points to that busybox at the lowest priority. * Add PATH to the busyboxrm directory using shell(as during an upgrade busybox and its links are missing). * When install over remove extra busybox if present. deb and rpm are uneffected by the bug because they both drag in bash, however neither upgrade seemed to have issue with the changes. [YOCTO 13850] (From OE-Core rev: 443d1c8c7fb5a69c03c813f3e90758e0add7df4b) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a9d2af8f5b3da8239cf00a52883ca596a19ea23a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: fix CVE-2020-6750haiqing2020-04-172-0/+742
| | | | | | | | | | | | | | | GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. (From OE-Core rev: 29ed9fc7341cc3db716115aef1a6910fdb893145) Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: CVE-2020-10029Zhixiong Chi2020-03-162-0/+129
| | | | | | | | | | | | Backport the CVE patch from upstream: [https://sourceware.org/git/gitweb.cgi?p=glibc.git; a=patch;h=9333498794cde1d5cca518badf79533a24114b6f] (From OE-Core rev: 229bc59863265433121656b57320d90808f6569e) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dummy-sdk-package: Add DUMMYPROVIDES_PACKAGESRichard Purdie2020-03-164-3/+11
| | | | | | | | | | | | We're about to need to use this variable in the main include file so restructure the users of it to all set it appropriately. (From OE-Core rev: a01bf79a35c908d6b072b984608114860b5c1e8f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a247e7c961286cbed73b6dc0f4074ecf856402a) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2019-20388Lee Chee Yang2020-03-072-0/+38
| | | | | | | | | | | | | | | see: https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68 (From OE-Core rev: 12a5eb0ea6f530ad7be2e58d4091b4edadbf461b) (From OE-Core rev: 49131908e3510dc69e0f278889803a461c2d96c0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: fix CVE-2020-7595Anuj Mittal2020-03-072-0/+37
| | | | | | | | | | | | (From OE-Core rev: f2f7aa9a495774fe5a2e3947584cb3503bd1eaf1) (From OE-Core rev: 72a747f77f9fd051e054e679deacf537b4b7116f) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ncurses: add CVE_VERSIONAnuj Mittal2020-03-071-0/+2
| | | | | | | | | | | | | | | Include the version number in a format that is comparable to what we get from NVD. (From OE-Core rev: fdb2a95d5e0265de1172940b6dc71fc7d602e8d1) (From OE-Core rev: 53b94d0bc839eda408d90e15937746871b7546e3) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc-testsuite: Exclude this recipe from world buildsNathan Rossi2020-03-071-0/+2
| | | | | | | | | | | | | | This recipe is intended to be run manually or via oeqa. [YOCTO #13737] (From OE-Core rev: 2b3235f10bb1759d651d28b41825ad53192c841a) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit eadbe01bb8232de79e0827e6c6b3411f69ea7303) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc-testsuite: Remove the do_install taskNathan Rossi2020-03-071-0/+1
| | | | | | | | | | | | | | | | This task is not intended to be run as this recipe does not produce any packages or install any sysroot content. Additionally running this task behaves differently from a normal glibc build, and can result in issues. [YOCTO #13737] (From OE-Core rev: a02934484605e5f81e67798d4d8eeb24e70591e6) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2b51252cb8bd9badfa28794f9ef9431b48752e3d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionRichard Purdie2020-02-111-1/+1
| | | | | | (From OE-Core rev: 799b3cd1016bd765f4452a5e81ea5613c9089bce) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ncurses: Fix reproducibility issueRichard Purdie2020-02-111-0/+1
| | | | | | | | | | | | | | | | | | The build was deciding whether to rename manpages based upon the presence of /etc/debian_version. Be explicit about the configuration instead and ensure determinism. [YOCTO #13781] (From OE-Core rev: 09c8a28893e7ca94a44232d802e1cb02a8f34b87) (From OE-Core rev: 3d114c08c32578426646f5d97769d2c66fea06cb) (From OE-Core rev: 7bc68f7b946b1aaaafb161a57aa889b200abc2eb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sysvinit: Fix Reproducibility issueRichard Purdie2020-02-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | With a sequence like: bitbake sysvinit bitbake sysvinit -c clean bitbake sysvinit -c package_write_ipk -f then the resulting package has two files with group "root/70" rather than "root/shutdown". The issue is that of do_package is a setscene task, base-passwd isn't present. This patch fixes that dependency but there may be other cases of this problem around. [YOCTO #13776] (From OE-Core rev: 0227e929021263c51d2e7db36224000fecb01f1c) (From OE-Core rev: cbcba43c18d67aea0ba41f019b357fbec6570ee1) (From OE-Core rev: bde90e407c8ae0b851534ae84d9d54980e908046) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patch: Extend to native/nativesdk and depend uponRichard Purdie2020-02-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a bug in patch 2.7.3 and earlier where index lines in patches can change file modes when they shouldn't: http://git.savannah.gnu.org/cgit/patch.git/patch/?id=82b800c9552a088a241457948219d25ce0a407a4 This leaks into debug sources in particular (e.g. tcp-wrappers where source files are read-only). Add the dependency to target recipes to avoid this problem until we can rely on 2.7.4 or later. We could try and remove all index lines from patch files but it will be a losing battle. We could try and identify all the recipes which change modes on files in patches but again, its a losing battle. Instead, compromise and have patch-native as a dependency for target recipes. We use patch-replacement-native since patch-native is in ASSUME_PROVIDED. Also add nativesdk-patch to buildtools-tarball. [YOCTO #13777] (From OE-Core rev: 5ed0840c93804488cd1c1aba6cb382b2434714a5) (From OE-Core rev: fd3bd61a6fe5190c575dc968f3a0be9c1cbf21ed) (From OE-Core rev: 148f1f8caf5d9a262c1f55e437326ce6139a743e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionRichard Purdie2020-02-061-1/+1
| | | | | | (From OE-Core rev: 832588c287d47604d8f717adfed6cc2ecd8c755e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kbd: avoid vlock conflict with busyboxHongxu Jia2020-02-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | busybox as well as vlock utility from meta-oe provides vlock utility which can conflict when with kbd if pam is a enabled distro_feature Fixes image build errors update-alternatives: Error: not linking <rootfs>/usr/bin/vlock to /bin/busybox.suid since <rootfs>/usr/bin/vlock exists and is not a link ERROR: yoe-qt5-wayland-image-1.0-r0 do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget_${PN} (). Deferring to first boot via 'exit 1' is no longer supported. (From OE-Core rev: d00349526f5727fdff9b40c6139d95bd75af213d) Signed-off-by: Khem Raj <raj.khem@gmail.com> The vlock doesn't exist if PAM isn't enabled. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: De Huo <de.huo@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kbd: configure.ac: Fix logic of vlock configure switchDe Huo2020-02-042-0/+32
| | | | | | | | | | | | | Downstream bug report: https://bugs.gentoo.org/661650 Upstream-Status: Backport [f7f357ef079b6d185f340e716d7c72a98d82bad0] (From OE-Core rev: bb544a4d9b0b889d6acacdd73e3a790546fe13ba) Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> Signed-off-by: De Huo <De.Huo@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2019-19956Lee Chee Yang2020-02-042-0/+41
| | | | | | | | | | | see: https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549 (From OE-Core rev: 9fd363d21df59fff4488763d62548c936b4d14fb) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Upgrade 243 -> 243.2Adrian Bunk2020-01-114-3/+1
| | | | | | | | | | | Bugfix-only changes on the 243 stable branch. (From OE-Core rev: fd1aa49d8a25767953e8b1beb91001d5e115f781) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd-systemctl: Fix handling of aliased targetsSlavic Brutalik2019-12-311-1/+1
| | | | | | | | | | | | | | | | | The script scans for services, parses them and makes sure those targets are still there. The exists file check fails if the target is an alias, such as default.target so add an additional test. [YOCTO #13685] (From OE-Core rev: 10bdbf033e51c97f6408c9114d480372135a2c2e) (From OE-Core rev: 64d305024e0514b832da05867672f61d1b5b3225) Signed-off-by: Werner Grift <sky.captin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Switch to NVD CVE JSON feed version 1.1Niko Mauno2019-12-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to recently released version 1.1 of NVD CVE JSON feed, as in https://nvd.nist.gov/General/News/JSON-1-1-Vulnerability-Feed-Release it is mentioned that Due to changes required to support CVSS v3.1 scoring, the JSON vulnerability feeds must be modified. This will require the consumers of this data to update their internal processes. We will be providing the JSON 1.1 schema on the data feeds page and the information below to prepare for this transition. ... The JSON 1.1 data feeds will be available on September 9th, 2019. At that time the current JSON 1.0 data feeds will no longer available. This change was tested briefly by issuing 'bitbake core-image-minimal' with 'cve-check.bbclass' inherited via local.conf, and then comparing the content between the resulting two 'DEPLOY_DIR_IMAGE/core-image-minimal-qemux86.cve' files, which did not seem to contain any other change, except total of 167 entries like CVSS v3 BASE SCORE: 0.0 were replaced with similar 'CVSS v3 BASE SCORE:' entries which had scores that were greater than '0.0' (up to '9.8'). (From OE-Core rev: cc20e4d8ff2f3aa52a2658404af9a0ff358cc323) (From OE-Core rev: c92b8804d6e59b2707332859957f0e6a46db0a73) Signed-off-by: Niko Mauno <niko.mauno@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: change SRC_URI to use httpsStefan Müller-Klieser2019-12-165-7/+7
| | | | | | | | | | | | | Change all recipes to https where we get an http 301 permanent redirect. (From OE-Core rev: e514acda9e12bccde6d3974e0fd1a37b3837191a) (From OE-Core rev: e62c39670241136df7f17e5784b3de7b64d8f5d0) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib: Whitelist CVE-2019-12450Adrian Bunk2019-12-161-0/+3
| | | | | | | | | | Fixed in 2.60.4, but CPE data is outdated. (From OE-Core rev: 060e46a73fb08b21c2acc5dddce30168574cd4f1) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: fix CVE-2019-19126Anuj Mittal2019-12-062-0/+33
| | | | | | | | | | | | | | Backport from 2.30 stable branch and drop NEWS section. (From OE-Core rev: b4d4f70380c100d8ab06557237d8d5649a885e30) (From OE-Core rev: 3d790738abd884121372f1e00170f9b42b13b5f1) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionzeus-22.0.1yocto-3.0.1Richard Purdie2019-11-271-1/+1
| | | | | | (From OE-Core rev: 75a4cabf55e13e6714c0fdb229cd51b5184ddbef) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionRichard Purdie2019-11-261-1/+1
| | | | | | (From OE-Core rev: 5a0ccf24fe00728823ee687823f34d843539df68) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance: Use zeus as the branchRichard Purdie2019-11-261-1/+1
| | | | | | (From OE-Core rev: 4a14eb567b51fbdf1f0630b7c63a289bc66f3b80) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to zeus head revisionRichard Purdie2019-11-261-1/+1
| | | | | | (From OE-Core rev: 378b6de44909a383ac002b00ba6da54de77aa61c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean up proxy handlingRoss Burton2019-11-251-26/+5
| | | | | | | | | | | | | | urllib handles adding proxy handlers if the proxies are set in the environment, so call bb.utils.export_proxies() to do that and remove the manual setup. (From OE-Core rev: 6b73004668b3b71c9c38814b79fbb58c893ed434) (From OE-Core rev: 15f6b4b59805db40df4eff6d5a2809f6f05b66c1) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add an index on the CVE ID columnRoss Burton2019-11-251-0/+3
| | | | | | | | | | | | | | Create an index on the PRODUCTS table which contains a row for each CPE, drastically increasing the performance of lookups for a specific CVE. (From OE-Core rev: b4048b05b3a00d85c40d09961f846eadcebd812e) (From OE-Core rev: 1b4a524da1532d15eb34a96c5bda5ff2af25a953) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: don't hardcode the database nameRoss Burton2019-11-251-2/+2
| | | | | | | | | | | | | | Don't hardcode the database filename, there's a variable for this in cve-check.bbclass. (From OE-Core rev: 0d188a9dc4ae64c64cd661e9d9c3841e86f226ab) (From OE-Core rev: 1c10a3189aad5109f04d1fc208d579225bdd1431) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: don't refresh more than once an hourRoss Burton2019-11-251-1/+9
| | | | | | | | | | | | | | | We already fetch the yearly CVE metadata and check that for updates before downloading the full data, but we can speed up CVE checking further by only checking the CVE metadata once an hour. (From OE-Core rev: 50d898fd360c58fe85460517d965f62b7654771a) (From OE-Core rev: f9e9107dbe23293eb96e049d7f821d2e33c23f06) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* initscripts/sysfs.sh: Mount /sys/firmware/efi/efivars when possibleHaris Okanovic2019-11-131-0/+4
| | | | | | | | | | | | | | | Without this change, efibootmgr is unable to recover BootOrder if lost during a previous write operation, e.g. exceeded storage capacity. This is problematic using EFI to manage boot flow from Linux (E.g. via RAUC). https://www.kernel.org/doc/Documentation/filesystems/efivarfs.txt (From OE-Core rev: adc0a31169f59d0183c327347b9ab3bcebb1aef2) Signed-off-by: Haris Okanovic <haris.okanovic@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* util-linux: fix PKNAME name is NULL when use lsblk [LIN1019-2963]Liwei Song2019-10-292-0/+37
| | | | | | | | | | | | | PKNAME is NULL when run "lsblk -o+PKNAME /dev/sda1" backport an upstream patch to fix it. (From OE-Core rev: dba4cc01463c2edad29f6f8c854b298255cc7562) Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5a987ff5e5e333e28be44a12e729907272ea3cb) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: update dbus-1.init to reflect new PID fileTom Benn2019-10-291-2/+2
| | | | | | | | | | | | The PID file referenced in dbus-1.init script was out of date and no longer existed. This meant that dbus could not be restarted via init.d without force removing the old PID file. (From OE-Core rev: a9d3cae5668fbcae7145b8cdba786caa30b5b3d3) Signed-off-by: fridgecow <fridgecow@fb.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 2ed6f06f30cb54b9c70f1a92d93c920ec4d01ffe) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ncurses: fix CVE-2019-17594, CVE-2019-17595Trevor Gamblin2019-10-292-0/+170
| | | | | | | | | | | Backport changes to tinfo/comp_hash.c, tinfo/parse_entry.c, and progs/dump_entry.c from upstream to fix CVEs. (From OE-Core rev: 7ec70aeb0c6f6080523efa0f983fa36b92cb5558) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to master head revisionzeus-22.0.0yocto-3.0Richard Purdie2019-10-091-1/+1
| | | | | | (From OE-Core rev: 59938780e7e776d87146002ea939b185f8704408) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* readline-native: Fix builds on tumbleweedRichard Purdie2019-10-092-0/+17
| | | | | | | | | | | OpenSuse's libreadline has extra symbol information which upsets our uninative loader as our libreadline is missing symbols with the appropriate versions. The simplest solution is to add the version information as they're harmless. (From OE-Core rev: 4dc83cd3110e2cc103b29769629e91c38187a6f6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to master head revisionRichard Purdie2019-10-091-1/+1
| | | | | | (From OE-Core rev: b6abf7c201f7c9668bdf3c6e87c7dbc70c6427f9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: don't install systemd-hwdb-update.serviceRoss Burton2019-10-081-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | This service file is designed to do first-boot initialisation of the udev hwdb database, but the condition logic to fire it is suboptimal: it can fire if not needed, and can also not fire if needed. Specifically it will always fire on first boot, even though as part of rootfs generation we build the hwdb database. On slow machines this can take a significant amount of time, the pathological case being qemumips where the service can time out after 90 seconds of processing. Other distributions have also noticed this problem (specifically, at least Debian and Clear) and solve it by using traditional postinst scripts to generate the hwdb (which we already do) and deleting the service file (which we don't). Finish the fix and improve boot times across all boards by deleting the service file. [ YOCTO #13504 ] (From OE-Core rev: b1fffd407029d5936e01ba6988b9e82279d98285) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: don't install udev.pc manuallyRoss Burton2019-10-081-2/+0
| | | | | | | | | | This is already installed by the install target to $datadir/pkgconfig, so there's no need to install it again to $libdir/pkgconfig. (From OE-Core rev: 9f0f688cecbd2bad28c46f8dc467eb88486a3f6e) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* musl: Update to latestKhem Raj2019-10-084-125/+50
| | | | | | | | | | | | | | Drop upstream'ed patch Fix libgcc build with musl Detailed ChangeLog [1] [1] https://git.musl-libc.org/cgit/musl/log/?qt=range&q=1f0e9f9cc2e3fa354f94e18b3b362de5f1ec7272..2c2477da9a553c0b9b2fa18073a5dcdbe6d395af (From OE-Core rev: 88ab64956762cd51d953128262fd9bc0338a4488) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Expose resolv-conf alternative only when resolved is builtAlexandre Bard2019-10-021-1/+1
| | | | | | | | | | | | When systemd is built without internal resolver, it does not make sense to expose it as a resolv-conf alternative and can even break images where this alternative would be chosen, because of an invalid symlink. (From OE-Core rev: 91efc50723229672b6e8187b69b183cba525f199) Signed-off-by: Alexandre Bard <alexandre.bard@netmodule.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* musl: Fix __riscv_mc* containers to match glibcKhem Raj2019-10-022-0/+68
| | | | | | | | | | Fixes packages like gdb compile (From OE-Core rev: 6792307a41c71786841f8fa6224af81be201688e) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* initramfs-framework: support PARTLABEL optionDiego Rondini2019-10-021-0/+5
| | | | | | | | | | | | | Since commit (kernel >= 4.20): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f027c34d844013d9d6c902af8fa01a82d6e5073d specifying rootfs by PARTLABEL is supported. This commit adds support to specify root by GPT partition label. (From OE-Core rev: ebc974be12c3e83e961c99c24fde267d6c8e8bfc) Signed-off-by: Diego Rondini <diego.rondini@kynetics.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-10 02:14:05 +0000