summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* pseudo: Update to latest version including statx fixRichard Purdie2021-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | This updates to the latest pseudo version which includes: Revert "client: Fix some compiler warnings" ports/linux: Always build statx support makewrappers: Handle parameters marked as nonnull client: Fix some compiler warnings wrappers: Avoid -Wcast-function-type warning In particular, this pseudo version always has statx enabled which means we can then remove the need to make pseudo-native host distro specific which fixes an eSDK issue. (From OE-Core rev: c78d82c60acd8cf1eabc728d614bf4631a96c2ad) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 58cc70940ff998be49a9b89e1ad0538242cb7998) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Add uninative configuration sanity checkRichard Purdie2021-07-201-0/+13
| | | | | | | | | | | | | | | When building pseudo-native to work with uninative, we need to ensure the configuration will work on all supported target systems. This means "new clone" semantics, xattr and statvfs support in particular. It is extremely unlikely we'd run on a system without any of these but add a check just to be sure when uninative is enabled. (From OE-Core rev: 262b70f94c34762f5879f637dc918e2d5928f2d0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ea5b208ee25752bea6037cd0f3b28da7d2c9905e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dwarfsrcfiles: Avoid races over debug-link filesRichard Purdie2021-07-151-3/+10
| | | | | | | | | | | | | | | | | | | | | | | We use dwarfsrcfiles in package.bbclass to list the source files used by a binary. This is done before they're stripped and linked to debug symbols in separate files. It is possible a binary may already have a link to separate debug symbols, e.g. some of the test binaries in lttng-tools ptest. In those cases, the linked binary may be changed by package.bbclass code whilst dwarfsrcfiles is reading it. That would result in a rare SIGBUS race causing the binary to fail. To avoid this, break the debug file search path so no other binaries are found. Also fix a segfault if no binary is specified while here. [YOCTO #14400] (From OE-Core rev: 317e334518c6394ecba4a3fdd4ba18b185822d22) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit efef732859e265533acf16f2f4da3b29d50e0df4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bootchart2: update 0.14.8 -> 0.14.9Alexander Kanavin2021-07-151-2/+1
| | | | | | | | | | (From OE-Core rev: ed7d3e43e9d90b4b7db006758311e0b8b2b5f677) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b4ed68ea38bbdb91729f822a8f1a5fe7e5d2d713) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.10 -> 3.8.11Tim Orling2021-07-151-0/+362
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: June 28, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.11, a security bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Get the latest release of 3.9.x here. Security content in this release contains three fixes. There's also two fixes for 3.8.10 regressions. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in security fixes only stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bugfixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. References: https://docs.python.org/release/3.8.11/whatsnew/changelog.html#python-3-8-11-final (From OE-Core rev: 1ba51ee2d52ee92bbdede9f2cd2f9ed9ff04ddb6) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rpm: fix CVE-2021-3421Minjae Kim2021-07-102-0/+198
| | | | | | | | | | | | unsigned signature header leads to string injection into an rpm database reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3421 https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21 (From OE-Core rev: eb1183cac91a9948ac47acc56454b8841764ba72) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: apply test skipping patch unconditionallyAlexander Kanavin2021-07-101-1/+1
| | | | | | | | | | | | | | | | Testing IMAGE_FEATURES from component recipes cannot possibly work; adjusting the test to soft-fail if needed items are not available is not trivial, so let's just skip unconditionally for now. (From OE-Core rev: 68b816cb90badddd0aafa2a5c6633e000cb21a21) (From OE-Core rev: 0bb221206c55564fd5cfe1d2452a6abe5e86d2c3) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 01b41f7deed48b33b35c84e32ef55de3e63b9bc1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: skip tests requiring tools-sdkTim Orling2021-07-102-0/+34
| | | | | | | | | | | | | | | | Conditionally skip test_ctypes.test_find unless IMAGE_FEATURES contains 'tools-sdk' as these test cases require full packagegroup-core-buildessential Fixes: AssertionError: Failed ptests: {'python3': ['test_find_library_with_gcc', 'test_find_library_with_ld']} (From OE-Core rev: 63bc36dbd93c46be8adf7db00e3fc22897eb1846) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-ptest: add newly discovered missing rdepsTim Orling2021-07-021-1/+2
| | | | | | | | | | | | | | | | | Making ptest images based on core-image-minimal uncovered quite a few missing depenendcies from various recipes, here they are. (From OE-Core rev: 2cda6242f2f0f6f9c6bdef72bbb271eab7e5e1f5) (From OE-Core rev: 9423ad8f0f42d249c2fcb1b86ec9abb75854f011) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Backport to Python 3.8.10 (only python3 portion of patch) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.9 -> 3.8.10Tim Orling2021-07-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: May 3, 2021 This is the tenth and final regular maintenance release of Python 3.8 Note: The release you're looking at is Python 3.8.10, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. FIXME: AssertionError: Failed ptests: {'python3': ['test_record_extensions', 'test_build_ext']} References: https://www.python.org/downloads/release/python-3810/ https://docs.python.org/release/3.8.10/whatsnew/changelog.html (From OE-Core rev: 471d19fa70c4c2b43a039909c9538e2223996335) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.8 -> 3.8.9Tim Orling2021-07-022-14/+16
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: April 2, 2021 Note: The release you're looking at is Python 3.8.9, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Refresh test_local.py patch for upstream changes * Add DEPENDS on autoconf-archive: - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. References: https://www.python.org/downloads/release/python-389/ https://docs.python.org/release/3.8.9/whatsnew/changelog.html#python-3-8-9 https://bugs.python.org/issue43617 (From OE-Core rev: fe037d895e045c5de7ea834c38d09a1c08d8b8a2) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.7 -> 3.8.8Tim Orling2021-07-022-195/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: Feb. 19, 2021 Note: The release you're looking at is Python 3.8.8, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.8 Earlier Python versions allowed using both ; and & as query parameter separators in urllib.parse.parse_qs() and urllib.parse.parse_qsl(). Due to security concerns, and to conform with newer W3C recommendations, this has been changed to allow only a single separator key, with & as the default. This change also affects cgi.parse() and cgi.parse_multipart() as they use the affected functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in bpo-42967.) License-Update: update copyright years Drop patches fixed in 3.8.8: - CVE-2021-3177 Fixes: CVE: CVE-2021-3426 CVE: CVE-2021-23336 References: https://www.python.org/downloads/release/python-388/ https://docs.python.org/release/3.8.8/whatsnew/changelog.html#changelog https://docs.python.org/3/whatsnew/3.8.html#notable-changes-in-python-3-8-8 https://nvd.nist.gov/vuln/detail/CVE-2021-3177 https://nvd.nist.gov/vuln/detail/CVE-2021-3426 (From OE-Core rev: fdfc3340b58e1af0c231eedaa07358f7d9c6483e) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.6 -> 3.8.7Tim Orling2021-07-022-73/+2
| | | | | | | | | | | | | | | | | | | | | Release Date: Dec. 21, 2020 Note: The release you're looking at is Python 3.8.7, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-27619 fixed in 3.8.7 References: https://nvd.nist.gov/vuln/detail/CVE-2020-27619 https://www.python.org/downloads/release/python-387/ https://docs.python.org/release/3.8.7/whatsnew/changelog.html (From OE-Core rev: a90dde9b1800acf364fa272177945e0a4cbf6560) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.5 -> 3.8.6Tim Orling2021-07-021-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: Sept. 24, 2020 Note: The release you're looking at is Python 3.8.6, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. References: https://www.python.org/downloads/release/python-386/ https://docs.python.org/release/3.8.6/whatsnew/changelog.html#changelog License-Update: PSFv2 -> PSF-2.0 and BSD-0-Clause Starting with Python 3.8.6, examples, recipes, and other code in the documentation are dual licensed under the PSF License Version 2 and the Zero-Clause BSD license. (From OE-Core rev: 2fd24949d3eda9e89239f63d1c5034b96eb2756f) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.4 -> 3.8.5Tim Orling2021-07-023-152/+2
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: July 20, 2020 Note: The release you're looking at is Python 3.8.5, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Drop patches fixed in 3.8.5: - CVE-2019-20907 - CVE-2019-26116 References: https://nvd.nist.gov/vuln/detail/CVE-2019-20907 https://nvd.nist.gov/vuln/detail/CVE-2020-26116 https://www.python.org/downloads/release/python-385/ https://docs.python.org/release/3.8.5/whatsnew/changelog.html#changelog (From OE-Core rev: c68cc11071cfa49d9d986bf7a9e6e1dfff514a39) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.3 -> 3.8.4Tim Orling2021-07-022-80/+2
| | | | | | | | | | | | | | | | | | | | | | Release Date: July 13, 2020 Note: The release you're looking at is Python 3.8.4, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-14422 fixed in 3.8.4 * Refresh CVE-2021-23336 patch References: https://nvd.nist.gov/vuln/detail/CVE-2020-14422 https://www.python.org/downloads/release/python-384/ https://docs.python.org/release/3.8.4/whatsnew/changelog.html#changelog (From OE-Core rev: c2c6df391a2634e83930219d1b574dbf64066d8a) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.2 -> 3.8.3Tim Orling2021-07-022-251/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: May 13, 2020 Note: The release you're looking at is Python 3.8.3, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.3: The constant values of future flags in the __future__ module are updated in order to prevent collision with compiler flags. Previously PyCF_ALLOW_TOP_LEVEL_AWAIT was clashing with CO_FUTURE_DIVISION. (Contributed by Batuhan Taskaya in bpo-39562) * Drop patch for CVE-2020-3492 fixed since 3.8.1 References: https://nvd.nist.gov/vuln/detail/CVE-2020-8492 https://www.python.org/downloads/release/python-383/ https://docs.python.org/release/3.8.3/whatsnew/changelog.html#changelog (From OE-Core rev: 2aec1b2b679d607f3b7760b87403aa39465cc1b7) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "python3: fix CVE-2021-23336"yocto-3.1.9dunfell-23.0.9Steve Sakoman2021-06-202-531/+0
| | | | | | | | Causes build failures on autobuilder This reverts commit 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* valgrind: fix a typoKai Kang2021-06-191-1/+1
| | | | | | | | | | (From OE-Core rev: 061cf0ccd5eb47c080eb833ba1dd25242c55945a) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0478d9b04d6a6d10e439116b23b641a1e2553e26) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2021-23336Lee Chee Yang2021-06-192-0/+531
| | | | | | | | | | | | | | | | | | | | | | | | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. References: https://nvd.nist.gov/vuln/detail/CVE-2021-23336 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336 (From OE-Core rev: 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ruby: 2.7.1 -> 2.7.3Lee Chee Yang2021-06-192-43/+2
| | | | | | | | | | | | | | | | | | | This release includes security fixes. CVE-2021-28965: XML round-trip vulnerability in REXML CVE-2021-28966: Path traversal in Tempfile on Windows CVE-2020-25613 fixed in 2.7.2, do drop the patch release notes for 2.7.2 and 2.7.3 https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/ https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-7-3-released/ (From OE-Core rev: 4de0d54827bc4645b69e5a0043b6f285b0193402) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pkgconfig: update SRC_URIChangqing Li2021-06-031-1/+1
| | | | | | | | | | | | | The git repo for pkg-config was changed, so update the SRC_URI accordingly with the new link. (From OE-Core rev: 9f67246e62aa9e8b0c4a790605c5417336fef70c) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9fd1b9b8282d68213b187ab42fae27e6a3c95b2e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unfs3: correct configure optionChangqing Li2021-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | On some new distro like ubuntu21.04, unfs3-native compile failed with error: undefined reference to `xdr_uint32', since new distro has new glibc. >From glibc 2.27 rpc support is dropped, so unfs3 need to link to libtirpc. Here is defination of ac_link: ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' Depended library should be added into LIBS, not LDFLAGS, otherwise, gcc may not load the lib since it is before conftest.$ac_ext during configure. Finally, it results in compile failed. (From OE-Core rev: 09b9027a9da8b5cf34e1f1c016d9d6bbbe904dcf) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 27867862c1fee6c0e649286500fa1ab015d57faf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dejagnu: needs expect at runtimeRomain Naour2021-05-201-0/+1
| | | | | | | | | | | | | runtest return an error due to missing expect on the target. Add expect as runtime dependency. (From OE-Core rev: 381a5f3e409504b2a31710d971eef58346339ae4) Signed-off-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d9a3a08edc1efcbe7b02e80be98370792d3c6cc2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* jquery: Exclude CVE-2007-2379 from cve-checkRichard Purdie2021-05-201-0/+5
| | | | | | | | | | | | | The CVE is non-specific and depends on the users of jquery, doesn't make sense to have this flagged against jquery as there is nothing we can do about it. (From OE-Core rev: d18ba3735ff3438ebd60b680e6bae5227c85bccb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1f82843584f6d2843c5bbd2fe5dcbc654a0fbcfb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2018-18438 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | | The issues were investigated and found not to be an issue therefore exclude from checks. (From OE-Core rev: 05f39301ab19a968916163b2d8f65beda7c09852) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee6ee9bd489c126b99d15c1011560df2f840a6e9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2007-0998 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | The CVE applies to the built-in VNC server but we don't enable this by default. (From OE-Core rev: f0e0787265d9d8bd01629f2b56a0eb57d950c037) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d62b9974a5f3a0f462434ce2763c28a4b4bbcfc6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2017-5957 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | The CVE applies to virglrender before 0.6.0 which we don't have. (From OE-Core rev: 559ed3e62e542b7a4456a9a4eef8742ce8521dfb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b5355375d028577de0b98e05992de6a088cb972) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: 2.11.2 -> 2.11.3Lee Chee Yang2021-05-201-1/+1
| | | | | | | | | | | | | updates include fix for CVE-2020-28493 changelog: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3 (From OE-Core rev: 9485d568b2b9e2143e1f46859a5c1de644c69b94) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-3392Lee Chee Yang2021-05-202-0/+93
| | | | | | | | (From OE-Core rev: fe872d2edc160f48e57d3bdc82e5fc72f6dcbb72) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix CVE-2020-17525Lee Chee Yang2021-05-202-0/+118
| | | | | | | | (From OE-Core rev: 3975fe2156d30cc64005e56666f4e88716d5ba27) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: fix CVE-2021-3487Lee Chee Yang2021-05-132-0/+84
| | | | | | | | | | drop changes to changelog file in the patch so it can be backport. (From OE-Core rev: c955d1fc332b8c0a931ffa4a068844981406ae8a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Binutils: Fix CVE-2021-20197Vinay Kumar2021-05-042-0/+573
| | | | | | | | | | | | | | | | | Source: git://sourceware.org/git/binutils-gdb.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Backported upstream commit d3edaa91d4cf7202ec14342410194841e2f67f12 to binutils-2.34 source, along with commit id dependencies (8e03235147a9e774d3ba084e93c2daaa94d1cec, 365f5fb6d0f0da83817431a275e99e6f6babbe04 and 8b69e61d4be276bb862698aaafddc3e779d23c8f). Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d3edaa91d4cf7202ec14342410194841e2f67f12] (From OE-Core rev: c98f3563937dc55605cc1f09c096f7cd716a78ce) Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtool: make sure autoheader run before automakeMingli Yu2021-04-302-0/+36
| | | | | | | | | | | | | | | | | When use automake to generate Makefile.in from Makefile.am, there comes below race: | configure.ac:45: error: required file 'config-h.in' not found It is because the file config-h.in in updating process by autoheader, so make automake run after autoheader to avoid the above race. (From OE-Core rev: 0d5dd68a07707f8b8428fe564414e2f5b7433ed5) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1fc0a4a98e65db7efba8bb5cb835101ea5dd865b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Upgrade to add trailing slashes ignore path fixRichard Purdie2021-04-301-1/+1
| | | | | | | | | | | | Pull in: client: strip trailing slashes when opening an ignored path (From OE-Core rev: fda1bc10604c41904df6b859105cab68dc70b556) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9fb92bc13b8a78ef98798f14e728058feb180ba6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go_1.14: don't set -buildmode=pie when building for windows targetsPeter Morrow2021-04-231-4/+4
| | | | | | | | | | | | | go 1.14 for windows targets does not support -buildmode=pie, disable it and use the default buildmode instead. Support for -buildmode=pie for windows targets is added with go 1.15 (https://golang.org/doc/go1.15) which is added to poky in gatesgarth. (From OE-Core rev: a1b0631c4723d2a98eb9e80ec85a00bc46276783) Signed-off-by: Peter Morrow <pemorrow@linux.microsoft.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtool: make sure autoheader run before autoconfMingli Yu2021-04-062-0/+36
| | | | | | | | | | | | | | | | | autoheader will update ../libtool-2.4.6/libltdl/config-h.in which autoconf needs, so there comes a race sometimes as below: | configure.ac:45: error: required file 'config-h.in' not found | touch '../libtool-2.4.6/libltdl/config-h.in' So make sure autoheader run before autoconf to avoid this race. (From OE-Core rev: ac63b30ac7dce558c9de5be985c153e4617157d5) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d8451cbef5906b67756582fdfc44eb01ed3512fc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* run-postinsts: do not remove postinsts directory.Anton D. Kachalov2021-04-061-6/+4
| | | | | | | | | | | | | | | | | | When running on the systems having read-only rootfs backed by overlayfs, removing the whole directory lead to create a special char device file on the upperdir to reflect directory's removal. Once it is required to upgrade the whole read-only image that might contain new postinsts scripts, it will be impossible to run such scripts with a "deletion mark" file on the overlayfs -- the whole directory will be marked as deleted regardless new files in it. (From OE-Core rev: d913d2fbd431ccc10a6197c4dc8858dfd9a91426) Signed-off-by: Anton D. Kachalov <gmouse@google.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1a27b62b225ffeecec47c249a0b86cc54d775add) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: fix CVE-2021-21300Minjae Kim2021-04-062-1/+308
| | | | | | | | | | | | checkout: fix bug that makes checkout follow symlinks in leading path Upstream-Status: Acepted [https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592] CVE: CVE-2021-21300 (From OE-Core rev: 8293d5d1529629bd13028bdde1fa99da30313bac) Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* valgrind: Increase timeout duration 30 -> 90 sYi Fan Yu2021-03-181-2/+7
| | | | | | | | | | | | | | | Attempt to fix intermittent failure of `drd/tests/std_list` Locally tested to take around 45 s on qemuarm64 [YOCTO #14228] (From OE-Core rev: ab87c49321a5511060fea6ebff2ffee847f014c0) Signed-off-by: Yi Fan Yu <yifan.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aac00b1c8042e41cd6bb1aea8e3033a1c6dd2b05) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* swig: Fix reproducibility issueRichard Purdie2021-03-182-0/+20
| | | | | | | | | | | | Remove hardcoding the build configuration into the help/version output from swig to make the binaries reproducible. (From OE-Core rev: 6187dd2b21a9f42877e782810ef96738dbc668c1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ed28ae9717ea9dad4e131012186d5f08e8f0bec) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* syslinux: Fix reproducibility issuesRichard Purdie2021-03-182-0/+27
| | | | | | | | | | | | Add sorting to wildcard expansion in the makefile to make builds reproducible. (From OE-Core rev: 7529d0a5fff17e35238c0f005163360f7f903898) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5541ba76ccc0c416f315bc0dc14a20a33059bd5f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda Bassey2021-03-183-0/+4
| | | | | | | | | | | | | | | Added missing HOMEPAGE and DESCRIPTION found using the test command `oe-selftest -r distrodata.Distrodata.test_missing_homepg` [YOCTO #13471] (From OE-Core rev: a6f1da03c9534c3ea1607d479e08d1037688a59f) Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7290b773486da3888f848abf0dba747f2d9f42e1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: set CVE_PRODUCTChen Qi2021-03-181-0/+2
| | | | | | | | | | | | Set CVE_PRODUCT for more accurate CVE scanning. (From OE-Core rev: af50558e2505f2e96bd213cd45bcdd5d33161b77) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aefcc7a7dd012530ed846292caaed70d20589a3a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-20203Minjae Kim2021-03-182-0/+75
| | | | | | | | | | | | net: vmxnet3: validate configuration values during activate Upstream-Status: Acepted [https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg07935.html] CVE: CVE-2021-20203 (From OE-Core rev: c65a671d7af64a19bebd45b1c4d02fdf124a1c5a) Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda2021-03-1052-8/+75
| | | | | | | | | | | | | | Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: bd3352880322598b0ba6dc439ff08c2e4c592e36) Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* librepo: fix CVE-2020-14352Minjae Kim2021-03-102-0/+56
| | | | | | | | | | | | librepo: missing path validation in repomd.xml may lead to directory traversal Upstream-Status: Acepted [https://github.com/rpm-software-management/librepo/commit/7daea2a2429a54dad68b1de9b37a5f65c5cf2600] CVE: CVE-2020-14352 (From OE-Core rev: f0df1ff1de6ca9a239d7eafd335b753d6a6e6471) Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2021-3177Anuj Mittal2021-03-102-0/+192
| | | | | | | | | (From OE-Core rev: 489ef4207141aa8527be95a5ba86aa30540357a4) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 25d1cae49e56797c4c9e91c01697c4de02dee046) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Backport patch to avoid assertion fails on icache line sizeAndrei Gherzan2021-03-042-0/+49
| | | | | | | | | | | | | | | | | | | Due to a bug in glibc 2.33, the value of the icache line size is now reported as unsupported option. This breaks qemu at runtime with: cacheinfo.c:182: init_cache_info: Assertion `(isize & (isize - 1)) == 0' failed. Aborted (core dumped) We haven't caught this one yet because we were already on qemu 5.2.0 when we started to play with glibc 2.33 so it was only reproducible on dunfell. (From OE-Core rev: fdb3ff363c6f8408058f362f3bfdeee4e18150fa) Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mtd-utils: Remove duplicate assignments to alternative link namesThomas Viehweger2021-03-041-2/+0
| | | | | | | | | | | | The two duplicate lines are not needed. The existence is confusing. (From OE-Core rev: 24afa7308cea30ed1b4f40ea8c1c95e485560237) Signed-off-by: Thomas Viehweger <patchesThomas.Vie@web.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 36bdb4faa90dc18bc020481eba82ee570b968c39) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-23 10:57:46 +0000