summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* python: Whitelist CVE-2017-17522 CVE-2017-18207 CVE-2015-5652Adrian Bunk2020-01-281-0/+10
| | | | | | | | | | One Windows-only CVE that cannot be fixed, and two CVEs where upstream agreement is that they are not vulnerabilities. (From OE-Core rev: 1b69d141b73e46cc377f8566868da44dd5b1ea42) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: set CVE vendor to ApacheRoss Burton2020-01-161-0/+2
| | | | | | | | | | | | There's a Jenkins plugin for Subversion. (From OE-Core rev: 9b5437f9afb4dd1366d5e21ea861f683d8cd2a09) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: set CVE vendor to git-scmRoss Burton2020-01-161-0/+2
| | | | | | | | | | | | There's a Jenkins plugin for Git. (From OE-Core rev: 44d4dda6db56107d7ce900730b370a2ec81d9c30) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* flex: set CVE_PRODUCT to include vendorRoss Burton2020-01-161-0/+3
| | | | | | | | | | | | | There are many projects called Flex and they have CVEs, so also set the vendor to remove these false positives. (From OE-Core rev: e128bd76ae9f4b30948e6b8fc68f4374e03c7bec) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: update to 2.7.17Alexander Kanavin2020-01-1614-903/+49
| | | | | | | | | | | | | | | | | | | | | | | Drop backports, rebase a couple of patches. This is the second last release of py 2.x; upstream support ends on 1 January 2020, there will be one final 2.x afterwards. Note that the only thing that still needs python 2.x in oe-core is u-boot; when the next u-boot update arrives, we should find out where the py3 migration is for that component before merging the update. (From OE-Core rev: 184b60eb905bb75ecc7a0c29a175e624d8555fac) (From OE-Core rev: 7009d823a0799ce7132bd77329b273a476718c8c) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> [Minor fixup for warrior context] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: fix CVE-2018-20852Anuj Mittal2020-01-162-0/+124
| | | | | | | | | (From OE-Core rev: 98cc3bfc6656b8648da591dcb64de8472e6c97e0) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: fix CVE-2019-16935Chen Qi2020-01-162-0/+102
| | | | | | | | | | | | | (From OE-Core rev: 1a7593bcdaf8a8cf15259aee8a0e2686247f2987) (From OE-Core rev: 27fea8ea1da28bb3163b5d503e6d16948c50f2ae) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: fix CVE-2019-18218Ross Burton2019-11-182-1/+57
| | | | | | | | | (From OE-Core rev: 0a1b1e88b936177344392e185fbd077622d88b3e) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patch: the CVE-2019-13638 fix also handles CVE-2018-20969Ross Burton2019-11-181-2/+2
| | | | | | | | | (From OE-Core rev: fec797a6ae981efa81896fd915933621699bca4e) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Add statx support to fix fedora30 issuesRichard Purdie2019-11-182-0/+107
| | | | | | | | | | | | | Modern distros (e.g. fedora30) are starting to use the new statx() syscall through the newly exposed glibc wrapper function in software like coreutils (e.g. the ls command). Add support to intercept this to pseudo. (From OE-Core rev: 1c09e45f966d553f1fea3795ef9122dd9957be67) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Fixup for warrior context] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Drop static linking to sqlite3Richard Purdie2019-11-181-15/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Back in 2010[1] we made pseudo statically link against sqlite3. Since then the world has changed, pseudo now has separate processes for the database in the server and the client and they have separate linking commands. Also, whilst there were concerns about needing specific versions of sqlite3, in the OE environment, this is always the case. [1] http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=ad0ac0ecd38fc77daf42485489fccc10a5e1e3e7 The static sqlite3-native is causing us problems, in particular: tmp/work/x86_64-linux/pseudo-native/1.9.0+gitAUTOINC+060058bb29-r0/recipe-sysroot-native/usr/lib/libsqlite3.a(sqlite3.o):(.data.rel+0xb0): undefined reference to `fcntl64' which occurs if sqlite3-native was built on a machine with glibc 2.28 or later and pseudo-native is being built on glibc before that. With dyanmical linking, libc is backwards compatible and works but with static linking it does not. There appears to be no easy way to avoid this other than adding a copy of sqlite3 into the pseudo recipe. Given the static linking doesn't seem to be required any longer due to the separate processes, drop that to fix those issues. (From OE-Core rev: c8c13ceafa3b12d2676b86182cb422681d465004) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Fix openat() with a symlink pointing to a directoryJason Wessel2019-11-182-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While working with ostree disk generation in conjunction with wic, I found a problem with pseudo where it tried to resolve a symlink when it shouldn't, based on openat() flags. A C program has been constructed to test pseudo to show that it is working properly with the correct behavior around openat(). #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/stat.h> #include <dirent.h> #include <unistd.h> #include <fcntl.h> int main() { /* * Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ; * ./app ; echo "pseudo"; pseudo ./app */ system("rm -rf tdir tlink"); system("mkdir tdir"); system("ln -s tdir tlink"); DIR *dir = opendir("."); int dfd = dirfd(dir); int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW); if (target_dfd == -1) { printf("Test 1 good\n"); } else { printf("Test 1 failed\n"); close(target_dfd); } target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC); if (target_dfd == -1) { printf("Test 2 failed\n"); } else { printf("Test 2 good\n"); close(target_dfd); } /* Test 3 make sure the owner of the link is root */ struct stat sbuf; if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0) { printf("Test 3 good\n"); } else { printf("Test 3 failed\n"); } /* Test 4 tests open with the "rb" flag, owner should not change */ int ofd = openat(dfd,"./tlink", O_RDONLY|O_CLOEXEC); if (ofd >= 0) { if (fstat(ofd, &sbuf) != 0) printf("ERROR in fstat test 4\n"); else if (sbuf.st_uid == 0) printf("Test 4 good\n"); close(ofd); } else { printf("Test 4 failed with openat()\n"); } /* Test pseudo db to see the fstat() above did not delete the DB entry */ if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0) printf("Test 5 good\n"); else printf("Test 5 failed... tlink is owned by %i and not 0\n", sbuf.st_uid); return 0; } int main() { /* Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ; ./app ; echo "pseudo"; pseudo ./app */ system("rm -rf tdir tlink"); system("mkdir tdir"); system("ln -s tdir tlink"); DIR *dir = opendir("."); int dfd = dirfd(dir); int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW); if (target_dfd == -1) { printf("This is right\n"); } else { printf("This is broken\n"); } return 0; } Many thanks to Peter Seebach for fixing the problem in the pseudo code to use the same logic which was already there for the AT_SYMLINK_NOFOLLOW. Also updated is the license MD5 checksum since the master branch of pseudo has had the SPDX data updated. (From OE-Core rev: d1788e865d9bcd70b36d0f239647aeffb0ea8b85) Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Upgrade 3.7.4 -> 3.7.5Adrian Bunk2019-11-184-137/+4
| | | | | | | | | | | | | | Backported patch removed. 3.7.5 also includes the fix for CVE-2019-16935. (From OE-Core rev: deabbb60b98418bd4fcf97adc3293b65d3ff306e) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: CVE-2019-16056Chen Qi2019-11-182-0/+133
| | | | | | | | | (From OE-Core rev: 8818a7e878644d1c695385eb256f53a34179fbbb) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix the test_locale output formatMingli Yu2019-11-182-0/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this patch: # python3 -m test -v test_locale [snip] test_getsetlocale_issue1813 (test.test_locale.TestMiscellaneous) ... testing with ('tr_TR', 'ISO8859-9') ok [snip] After this patch: # python3 -m test -v test_locale [snip] test_getsetlocale_issue1813 (test.test_locale.TestMiscellaneous) ... testing with ('tr_TR', 'ISO8859-9')... ok [snip] Make the test ended with "... ok" is common in python unittest world, we should make it keep consistent with other test cases in case it may be ignored to record in the report if we use the common filter "... ok". [YOCTO #13298] (From OE-Core rev: 5b8022db53d9ef50ea35b034a6e27477038a508b) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix .pyc file reproduciblilityJoshua Watt2019-11-182-0/+36
| | | | | | | | | | | | Applies a patch to python that makes the pre-compiled .pyc files generated during the build reproducible. (From OE-Core rev: c2c6f30554f96e551b71b3d66fb599a5d28a10bb) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Reformat sysconfigJoshua Watt2019-11-182-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | Reformats the sysconfig file when packaging. This file is output by using the python pprint function. This function will wrap long lines at 80 characters by default, and will even split strings at whitespace boundaries to do so, e.g.: 'A': 'B is really' ' long' This causes a problem for reproducibility however because there might be lines of differing lengths depending on the build path. These non-reproducible paths are removed, but their effect on string wrapping from pprint remains. To correct this, reformat the entire sysconfig file by re-printing using pprint with an (effectively) unlimited line length. (From OE-Core rev: 01e4409e81c3d037fcba82fbcb3273dd1118490b) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: python3: Fix build error x86->x86Ricardo Ribalda Delgado2019-11-182-0/+27
| | | | | | | | | | | | | | | | | | | | | When building x86->x86 the system will try to execute .so and related items from the default PYTHONPATH. This will fail if the target CPU contains instructions that the host CPU does not have, add CROSSPYTHONPATH into PYTHONPATH so we can prepend the list to find correct libs. Fixes: Illegal instruction (core dumped) Makefile:625: recipe for target 'sharedmods' failed make: *** [sharedmods] Error 132 make: *** Waiting for unfinished jobs.... (From OE-Core rev: 2f8086ce87bbb62ef971be4da80c2c2b9d8c9c66) Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix build on softfloat mipsMatthias Schoepfer via Openembedded-core2019-11-182-0/+202
| | | | | | | | | | | | | | | | This patch originally only meant to correct the python3 build for mips with softfloat, as the original test only checked for mips hardfloat. Replaced custom C Program for triplet detection with autotools triplet detection. (From OE-Core rev: f3326309c7c22a6034917f6eee21908c61f44a2f) Signed-off-by: Matthias Schoepfer <matthias.schoepfer@ithinx.io> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix do_install fail for parallel buiildChangqing Li2019-11-182-0/+35
| | | | | | | | | | | | | | | When using make -j with the 'install' target, it's possible for altbininstall (which normally creates BINDIR) and libainstall (which doesn't, though it installs python-config there) to race, resulting in a failure due to attempting to install python-config into a nonexistent BINDIR. Ensure it also exists in the libainstall target. (From OE-Core rev: dc84f40fd485863fb6c77e641d76135b21867d39) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nativesdk-meson: Remove some unused variablesPeter Kjellerstedt2019-11-181-5/+0
| | | | | | | | | (From OE-Core rev: ec563bf0009e1124adb966130f610b9df291fa19) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meson: Backport patch to handle strings in cross file argsPeter Kjellerstedt2019-11-182-0/+88
| | | | | | | | | | | | This allows <language>_args and <language>_link_args properties, e.g., c_link_args, in meson.cross to be specified as either a string or a list. (From OE-Core rev: 1913e688ad95d465e9b9d16ad57f2bdef2b50d93) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-1.12: update to 1.12.9 minor releaseKhem Raj2019-11-181-3/+3
| | | | | | | (From OE-Core rev: 03b303dbc92521606ff4051bd253f8acc01fd9e5) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Upgrade 1.12.5 -> 1.12.6Adrian Bunk2019-11-181-3/+3
| | | | | | | (From OE-Core rev: 8dfe441fd3ad46732c2775b817de1a0d816a87e4) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update 1.12.1->1.12.5Alexander Kanavin2019-11-181-3/+3
| | | | | | | (From OE-Core rev: 4e642e6f7b6e51c64e990b74aff3d84b78cd894e) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: update to 3.1.1.1Armin Kuster2019-10-3014-798/+2
| | | | | | | | | | | | | bug fix only update. Drop patches included in update. For full set of changes, see: https://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/tags/v3.1.1.1 (From OE-Core rev: 14f04e6b6c1fa40a1c39cd186627b4b8442f2d5e) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2019-16276Chen Qi2019-10-302-0/+164
| | | | | | | | | | | | (From OE-Core rev: 5fc9b154754e67553296a00a39ed16ab6a1d59de) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e31f87e289dfd3bbca961e927447a9c7ba816d3f) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit e02e8fa2e82cceaaa6a433466f52f97b0984762a) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: Fix CVE-2019-10160Changqing Li2019-10-302-0/+82
| | | | | | | | | | | | (From OE-Core rev: 23d48f2bea2d358bd8d7d4efd07792bc1f3666bd) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit b4240b585d7fcac2fdbf33a8e72d48cb732eb696) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 10d87a3085665a959a5fda64ae3895cb27ddf343) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: CVE-2019-16056Chen Qi2019-10-302-0/+91
| | | | | | | | | | | (From OE-Core rev: 49ff6c7ef1d366007c49083f4e5faaf5a9eb086f) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 27be9cf71a6fe906a23e81b56f1cc18a6fc9ef97) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: add tk-lib as runtime dependency for python-tkinterYi Zhao2019-10-302-2/+2
| | | | | | | | | | | | | | | | Fixes: ERROR: python-2.7.16-r0 do_package_qa: QA Issue: /usr/lib/python2.7/lib-dynload/_tkinter.so contained in package python-tkinter requires libtk8.6.so, but no providers found in RDEPENDS_python-tkinter? [file-rdeps] (From OE-Core rev: f83ecbabb911c46de77708ede759a0b768928ea2) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit f78248a2380bbbbf271b5bb02c762f5bc7a3a92e) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: include CVE patches for python-native as wellAnuj Mittal2019-10-302-5/+5
| | | | | | | | | | | | Also avoids maintaining a different set of patches for both. (From OE-Core rev: e73d5bb4a21497ed645e2a0a4b88c2eeaf65080a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b3b1c00cc46b33ddbf7e008267032220e1e298af) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meson: Fix native patch to python3Ricardo Ribalda Delgado2019-10-081-1/+1
| | | | | | | | | | | | | | | | | Fixes: File "/workdir/build/tmp/work/dbfp4-poky-linux/qv4l2/1.17.0+gitAUTOINC+95f39aae48-r0/recipe-sysroot-native/usr/lib/python3.7/site-packages/mesonbuild/dependencies/base.py", line 574, in _call_pkgbin cache[(self.pkgbin, targs, fenv)] = self._call_pkgbin_real(args, env, use_native) File "/workdir/build/tmp/work/dbfp4-poky-linux/qv4l2/1.17.0+gitAUTOINC+95f39aae48-r0/recipe-sysroot-native/usr/lib/python3.7/site-packages/mesonbuild/dependencies/base.py", line 556, in _call_pkgbin_real cmd = self.pkgbin.get_command() + "-native" + args TypeError: can only concatenate list (not "str") to list (From OE-Core rev: 9051c10e46960a357f0339e347618f5d83923fe4) Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix build issue on new hosts with glibc 2.30Armin Kuster2019-10-083-0/+146
| | | | | | | | | | | | | | | | | | | | | | This fixes the following error: TOPDIR/tmp/work/x86_64-linux/qemu-native/3.1.0-r0/qemu-3.1.0/linux-user/syscall.c:254:16: error: static declaration of ‘gettid’ follows non-static declaration 254 | _syscall0(int, gettid) | ^~~~~~ TOPDIR/tmp/work/x86_64-linux/qemu-native/3.1.0-r0/qemu-3.1.0/linux-user/syscall.c:185:13: note: in definition of macro ‘_syscall0’ 185 | static type name (void) \ | ^~~~ In file included from /usr/include/unistd.h:1170, from TOPDIR/tmp/work/x86_64-linux/qemu-native/3.1.0-r0/qemu-3.1.0/include/qemu/osdep.h:90, from TOPDIR/tmp/work/x86_64-linux/qemu-native/3.1.0-r0/qemu-3.1.0/linux-user/syscall.c:20: /usr/include/bits/unistd_ext.h:34:16: note: previous declaration of ‘gettid’ was here 34 | extern __pid_t gettid (void) __THROW; | ^~~~~~ (From OE-Core rev: fbedc2d73ff472c89ba273a890408f93015e8f17) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2019-8934Dan Tran2019-10-082-0/+216
| | | | | | | | | (From OE-Core rev: 7f13e4e9ef51bf62729a9a955967aa4752d0d2e8) Signed-off-by: Dan Tran <dantran@microsoft.com> [Fix up against lastest warrior] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* json-c: Don't --enable-rdrandAdrian Bunk2019-10-081-2/+0
| | | | | | | | | | | | | | | | | | | | | In recent years AMD CPUs have had various problems with RDRAND giving either non-random data or no result at all, which is problematic if either build or target machine has a CPU with this problem. The fallback is /dev/urandom, and I'd trust the kernel here. --enable-rdrand was added in an upgrade to a new upstream version without mentioning any reason. [YOCTO #13534] (From OE-Core rev: 07b19cd9ef127ec87f727e154eda62272a828275) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.7.3 -> 3.7.4Anuj Mittal2019-10-082-154/+2
| | | | | | | | | | | | | | | | Also fixes CVE-2019-9740, CVE-2019-9948. For details, see: https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final (From OE-Core rev: 6b7604c536a7a2da99490a7550f997a8e35ca043) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ Backported patch removed. ] Signed-off-by: Adrian Bunk <bunk@stusta.de> [Bug fix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: update to 3.7.3Alexander Kanavin2019-10-085-285/+5
| | | | | | | | | | | | | | License-update: copyright years (From OE-Core rev: 845b9a4ed2b83d716688a7b0d8bf13f37e79a025) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ Backported patches removed. ] Signed-off-by: Adrian Bunk <bunk@stusta.de> [Bug fix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: backport rewrite from masterRoss Burton2019-09-306-565/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As detailed at [1] the XML feeds provided by NIST are being discontinued on October 9th 2019. As cve-check-tool uses these feeds, cve-check.bbclass will be inoperable after this date. To ensure that cve-check continues working, backport the following commits from master to move away from the unmaintained cve-check-tool to our own Python code that fetches the JSON: 546d14135c5 cve-update-db: New recipe to update CVE database bc144b028f6 cve-check: Remove dependency to cve-check-tool-native 7f62a20b32a cve-check: Manage CVE_PRODUCT with more than one name 3bf63bc6084 cve-check: Consider CVE that affects versions with less than operator c0eabd30d7b cve-update-db: Use std library instead of urllib3 27eb839ee65 cve-check: be idiomatic 09be21f4d17 cve-update-db: Manage proxy if needed. 975793e3825 cve-update-db: do_populate_cve_db depends on do_fetch 0325dd72714 cve-update-db: Catch request.urlopen errors. 4078da92b49 cve-check: Depends on cve-update-db-native f7676e9a38d cve-update-db: Use NVD CPE data to populate PRODUCTS table bc0195be1b1 cve-check: Update unpatched CVE matching c807c2a6409 cve-update-db-native: Skip recipe when cve-check class is not loaded. 07bb8b25e17 cve-check: remove redundant readline CVE whitelisting 5388ed6d137 cve-check-tool: remove 270ac00cb43 cve-check.bbclass: initialize to_append e6bf9000987 cve-check: allow comparison of Vendor as well as Product 91770338f76 cve-update-db-native: use SQL placeholders instead of format strings 7069302a4cc cve-check: Replace CVE_CHECK_CVE_WHITELIST by CVE_CHECK_WHITELIST 78de2cb39d7 cve-update-db-native: Remove hash column from database. 4b301030cf9 cve-update-db-native: use os.path.join instead of + f0d822fad2a cve-update-db: actually inherit native b309840b6aa cve-update-db-native: use executemany() to optimise CPE insertion bb4e53af33d cve-update-db-native: improve metadata parsing 94227459792 cve-update-db-native: clean up JSON fetching 95438d52b73 cve-update-db-native: fix https proxy issues 1f9a963b9ff glibc: exclude child recipes from CVE scanning [1] https://nvd.nist.gov/General/News/XML-Vulnerability-Feed-Retirement (From OE-Core rev: 8c87e78547c598cada1bce92e7b25d85b994e2eb) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: Security fix for CVE-2019-15847Armin Kuster2019-09-304-0/+646
| | | | | | | | | | | Affects <= 9.2.0 Dropped Changelog changes (From OE-Core rev: a579b111349fd9ad91b2d40a51f194fd25af723a) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc-8.3: Security fix for CVE-2019-14250Armin Kuster2019-09-302-0/+45
| | | | | | | | | | Affects < 9.2 (From OE-Core rev: 125c77be468adf8b3be8d00f99d80bd77f7d2e1e) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: Fix mips patch which changes default emulationNathan Rossi2019-09-301-6/+3
| | | | | | | | | | | | | | The patch incorrectly removes 'mips_elf32_ntrad_le_vec' from the 'targ_selvecs' replacing it with duplicate entries for 'mips_elf32_ntrad_be_vec'. Correct this so that the default binutils can still handle 'mips_elf32_ntrad_le_vec' binaries. (From OE-Core rev: 21c59450d1c891dadfe1484337bd0a6007a4aa01) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: CVE-2018-12886Zhixiong Chi2019-09-302-0/+814
| | | | | | | | | | | | | Backprot CVE patch from the upstream: https://github.com/gcc-mirror/gcc.git [commit f98495d] https://nvd.nist.gov/vuln/detail/CVE-2018-12886 (From OE-Core rev: a3b083f8b2566bdb4e6b7db15d2a1e000bda57dd) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: reduce the variables in symtabZhixiong Chi2019-09-302-0/+95
| | | | | | | | | | | | | | | | Backport the patch from upstream: https://github.com/gcc-mirror/gcc.git [commit beb921e] https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=269925 Add the premark_used_variables function, meanwhile do not mark not premarked external variables in prune_unused_types_walk. (From OE-Core rev: 7edf5725631e69c22627e41ecf5de3222f1d624b) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: fix CVE-2019-14250 CVE-2019-14444Anuj Mittal2019-09-303-0/+63
| | | | | | | | (From OE-Core rev: 41579d569738a23b80d4599fd6ec082488c6cfee) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meson: backport fix for builds with -Werror=return-typeMartin Jansa2019-09-302-0/+85
| | | | | | | | (From OE-Core rev: 0ccf907992a0e3560897ac300ee6b1352d969c42) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dpkg: Use less as pagerRicardo Ribalda Delgado2019-09-302-0/+22
| | | | | | | | | | | | | | | | | | | Debian traditionaly uses /usr/bin/pager as the system pager, which is a link to the user preferred pager. This is a Debianism. Without this patch: root@qt5122:~# dpkg -l sh: pager: command not found dpkg-query: error: showing package list on pager subprocess returned error exit status 127 (From OE-Core rev: 51fb10275cd9013e3c5fcb94f88e3529e2b8f069) Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Richard Leitner <richard.leitner@skidata.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patch: backport fixesAnuj Mittal2019-09-303-0/+175
| | | | | | | | | | | | | | The original fix for CVE-2018-1000156 was incomplete. Backport more fixes done later for a complete fix. Also see: https://savannah.gnu.org/bugs/index.php?53820 (From OE-Core rev: 1a3527231d3c0fa42d16c5b1980c07d68105fea2) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patch: fix CVE-2019-13638Trevor Gamblin2019-09-302-0/+45
| | | | | | | | | | | (From OE-Core rev: b59b1222b3f73f982286222a583de09c661dc781) (From OE-Core rev: 87106ff3f2d24b58a90767e288f783aa92c25748) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: fix CVEs for included zlibAnuj Mittal2019-09-305-0/+393
| | | | | | | | | | | | | | | | | | | | rsync includes its own copy of zlib and doesn't recommend linking with the system version [1]. Import CVE fixes that impact zlib version 1.2.8 [2] that is currently used by rsync. [1] https://git.samba.org/rsync.git/?p=rsync.git;a=blob;f=zlib/README.rsync [2] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3agnu%3azlib%3a1.2.8 (From OE-Core rev: a55fbb4cb489853dfb0b4553f6e187c3f3633f48) (From OE-Core rev: 93ce13106abc05f4a68a6265590e3770f0bf49a2) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2018-20815Armin Kuster2019-09-302-0/+39
| | | | | | | | (From OE-Core rev: 0b73e48c64cb8e651c81b19ddabdd108e4024697) Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-14 21:38:17 +0000