summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* go: Security Advisory - go - CVE-2020-24553Li Zhou2020-09-103-0/+459
| | | | | | | | | | | Backport the patch from <https://github.com/golang/go/commit/ eb07103a083237414145a45f029c873d57037e06> to solve CVE-2020-24553. (From OE-Core rev: 794dfa173adbce781c9fe609d58d3ed9b8cbd501) Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: CVE-2020-14364Li Wang2020-09-102-0/+94
| | | | | | | | | | | Backport patch from: https://git.qemu.org/?p=qemu.git;a=patch;h=b946434f2659a182afc17e155be6791ebfb302eb (From OE-Core rev: 8b4163c4e60f5e96790522e129f84102831feb8e) Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu : fix CVE-2020-15863Li Wang2020-09-102-0/+65
| | | | | | | | | | (From OE-Core rev: 30b0784e2eef9c4d45296857b0792a4374020fab) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Li Wang <Li.Wang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: CVE-2020-10756Stefan Ghinea2020-09-102-0/+41
| | | | | | | | | | | | | | | | | | | | | | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1. References: https://nvd.nist.gov/vuln/detail/CVE-2020-10756 https://bugzilla.redhat.com/show_bug.cgi?id=1835986 Upstream patches: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/c7ede54cbd2e2b25385325600958ba0124e31cc0 (From OE-Core rev: b6d73f9f8c055928051dc57943baf5833568d04f) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: CVE-2020-16845Zhixiong Chi2020-09-102-0/+111
| | | | | | | | | | | | Backport CVE patch from the upstream: https://github.com/golang/go.git commit 027d7241ce050d197e7fabea3d541ffbe3487258 (From OE-Core rev: 4fa2a6c171e62855ad9a2bd7a2d8507067f62988) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: CVE-2020-16092Li Wang2020-09-102-0/+50
| | | | | | | | | | | Backport CVE patch from the upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=035e69b063835a5fd23cacabd63690a3d84532a8 (From OE-Core rev: ffb65dd34fce4c75b9aa00dc0197bf83198a9980) Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-testtools: Avoid traceback2 module requirementRichard Purdie2020-09-102-0/+25
| | | | | | | | | | | | | | | | traceback2 adds traceback for python2. Rather than depend on traceback2, we're python3 only so just use traceback. This caused breakage in oe-selftest -j which uses testtools on the autobuilder using buildtools-tarball. [YOCTO #13652] (From OE-Core rev: ee80a06c107375e3cf0d246ea17c09dda4536dab) (From OE-Core rev: 9f51e83ab407c3dff6624b6ae1b03ca6c326d382) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: Install non-alternatives links for nativesdkRichard Purdie2020-09-101-0/+3
| | | | | | | | | | | In the SDK we need the plain symlinks and don't use alternative providers. When these are missing the toolchain can work incorrectly so fix this. (From OE-Core rev: 0c06cfaa016d06cc56d80dc1c244a938f3d38a3c) (From OE-Core rev: 0d299c5dc04407d2d54574157f4014f50f2d0468) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: Fix relocation of ld.so.conf in nativesdk buildsRichard Purdie2020-09-102-0/+82
| | | | | | | | | | | | | | | | | | | We need binutils to look at our ld.so.conf file within the SDK to ensure we search the SDK's libdirs as well as those from the host system. There add a patch which passes in the directory to the code using a define, then add it to a section we relocate in a similar way to the way we relocate the gcc internal paths. This ensures that ld works correctly in our buildtools tarball. Standard sysroot relocation doesn't work since we're not in a sysroot, we want to use both the host system and SDK libs. (From OE-Core rev: f6c1089642934ad93056ef19a0888965486ee030) (From OE-Core rev: 09a2b16ac2bd1e3e415131e46315c851373aa7e0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Security Advisory - go - CVE-2020-15586Li Zhou2020-08-122-0/+132
| | | | | | | | | | | Backport patch from <https://github.com/golang/go/commit/ fa98f46741f818913a8c11b877520a548715131f> to solve CVE-2020-15586. (From OE-Core rev: 0e8526ce8694ebd6988c3804e4d2ccf39cda90c7) Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-numpy: Stop shipping manual config filesAdrian Bunk2020-08-0429-2022/+0
| | | | | | | | | | | | | Automatic generation seems to work fine, and does not become outdated. (From OE-Core rev: 49a9b38bb8355aa6b3413335851b7b609356e33b) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8993270f8bc65e152418d84fde03f8ead83c054b) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-14422Lee Chee Yang2020-08-042-0/+80
| | | | | | | | | (From OE-Core rev: f12ea255a24d60c625d4e6ab4de0633df49679a5) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> [Rebased for v3.7.8] Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: fix CVE-2020-10543 & CVE-2020-10878Lee Chee Yang2020-08-044-0/+227
| | | | | | | | | | | | | (From OE-Core rev: d9c5d9c52eb1f03ff9c907a76dda31042fb26edb) (From OE-Core rev: de3fe84fcfe3f1c3c2ad963b1fe459ccca9472a0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: Fix host specific modules problemsRichard Purdie2020-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | We were seeing a ton of empty perl modules being created such as "perl-module-x86-64-linux-encoding" where the name would include ${TARGET_ARCH}-linux. These files were already being filtered in an earlier do_split_packages() expression so exclude them from the latter one to remove the pointless empty modules in PACKAGES. This doesn't explain why some were not deterministic but will recude the do_package execution time and clean up the build directories at the very least. (From OE-Core rev: 5aaf9d3a748cbad17a4a3e5d9715ac2f289b007d) (From OE-Core rev: 6103cc314520280e55366d00657723e90f609d70) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9f1a959d9831f43dda656e3b0c4d059db3363877) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mtd-utils: Fix return value of ubiformatOtavio Salvador2020-08-042-0/+63
| | | | | | | | | | | | | | | | | | | | | | | | | This changeset fixes a feature regression in ubiformat. Older versions of ubiformat, when invoked with a flash-image, would return 0 in the case no error was encountered. Upon upgrading to latest, it was discovered that ubiformat returned 255 even without encountering an error condition. This changeset corrects the above issue and causes ubiformat, when given an image file, to return 0 when no errors are detected. Backport fix from 2.1.2 (From OE-Core rev: 3ee98b6c9ddd1dd0825245ca672236b7befb9859) (From OE-Core rev: e10f007c165ed974a0cd4d46934cd4708661aaf5) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> (cherry picked from commit 7ebacd9cbaec98fbc406e8ae99c9805a24fdadc6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* patchelf: Add patch to address corrupt shared library issueRichard Purdie2020-08-042-0/+38
| | | | | | | | | | | | | | | | | patchelf can corrupt shared libraries if the program headers don't immediately follow the elf header. Add a patch submitted upstream to address this. (From OE-Core rev: faaf5f34332290708f3720a5488b3d1549d9e95a) (From OE-Core rev: 1969b67592bf1cfb0088f89ecde516abf614238f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e7811c787bbe2f5d49b3506309499acc27189988) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: add bzip2-replacement-native to DEPENDS to fix sstate issueJan-Simon Moeller2020-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | file-native when built on a Debian 10 host will embed a dependency to 'libbz2.so.1.0' (instead of 'libbz2.so.1'). This can cause issues when sharing the sstate between hosts e.g.: recipe-sysroot-native/usr/lib/rpm/rpmdeps: error while loading shared libraries: libbz2.so.1.0: \ cannot open shared object file: No such file or directory To avoid this situation, let's add the bzip2-replacement-native to the file recipe's DEPENDS_class-native . Details in https://bugzilla.yoctoproject.org/show_bug.cgi?id=13915 . (From OE-Core rev: 5a2bc3bfa9e1a4f37b6e26a5c40a4a9c025d03f1) (From OE-Core rev: 693caddd3b62d0bcb76ec6d3d6faa6561b763598) Signed-off-by: Jan-Simon Moeller <dl9pf@gmx.de> (cherry picked from commit 4a996574464028bd5d57b90920d0887d1a81e9e9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Upgrade 3.7.7 -> 3.7.8Adrian Bunk2020-08-042-251/+2
| | | | | | | | | | Backported patch removed. (From OE-Core rev: 2c33c482ba6691ae82252f192b3c03e8c8fb7d55) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2020-10702 & CVE-2020-13765Lee Chee Yang2020-07-083-0/+102
| | | | | | | | (From OE-Core rev: 684307688eb0c1a98be8885164ecc8f578a36cf8) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: un-break disabling the readline PACKAGECONFIGAlexander Kanavin2020-07-081-0/+1
| | | | | | | | | | | | | Previously the readline module would have been built regardless of readline's presence in the sysroot, and the recipe would fail at package_qa. (From OE-Core rev: 4a4413aa521f35414d94f883a74aec3beb628a9a) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: make gdbm optionalAlexander Kanavin2020-07-083-5/+46
| | | | | | | | | | | | The use case is building a gpl3-free image, without having to rely on outdated recipes from meta-gplv2 layer. (From OE-Core rev: 033a63507d1ccd423b8023575729ff089614303b) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* strace: fix failing ptestsAlexander Kanavin2020-06-022-3/+6
| | | | | | | | | | | | | | | | 1. They need to be run under regular user. 2. Some tests genuinely need more time than 30 seconds 3. The Makefile patch erroneously introduced a test-breaking change. (From OE-Core rev: 3d6bf58c7080c1cacf3ed1f270ff5acf4858c790) (From OE-Core rev: 7bc11ef93b02ff3b223fc0b3b730ce7b06181156) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5e90281ac211e912ec6bfd6873e56152ec8bd4e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2020-11869Lee Chee Yang2020-06-022-0/+98
| | | | | | | | (From OE-Core rev: 5ada35d14598505448c16a52e8fe129e72f1ed0b) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-8492Trevor Gamblin2020-06-022-0/+249
| | | | | | | | | | | | | | | | CVE: CVE-2020-8492 (From OE-Core rev: c9ee462bb606b34ab31cfb90f84a5302d15135cf) (From OE-Core rev: 5c8662e6ff870da917ed5efa02179d6da4addba9) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5811ed9140fab64da59d0d2ad6e6b0fec8341a20) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu/slirp: fix CVE-2020-7211Chee Yang Lee2020-05-072-0/+47
| | | | | | | | | | | | | | | | | fix CVE-2020-7211 for qemu slirp submodule see : https://www.openwall.com/lists/oss-security/2020/01/17/2 https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4 (From OE-Core rev: 31362d739834377ac4ab880029c3e3dda0cd7698) (From OE-Core rev: c68323151b9bafb5f52dda6a4bd11712feff2e83) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2020-7039Changqing Li2020-05-074-0/+170
| | | | | | | | | | | | (From OE-Core rev: 5ea3d9d83ed695827634e3216664c13fcff6d48a) (From OE-Core rev: b7b96bd938cf4167b4abeebb68d35ba74ce0d3c6) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: Upgrade 2.7.17 -> 2.17.18Adrian Bunk2020-05-073-3/+3
| | | | | | | | | | LICENSE checksum changed due to 2019 -> 2020 update. (From OE-Core rev: b15db3ce3af3460b7f9ae1e186e453a79a056511) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Add PACKAGECONFIG for glusterfshaiqing2020-05-071-0/+1
| | | | | | | | (From OE-Core rev: b249fddf46b1e1ebeedf3c599acdadd93e6d046a) Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: Security Advisory - git - CVE-2020-11008Li Zhou2020-05-0713-0/+1667
| | | | | | | | | | | | | | | | | Backport the 1st -- 9th patches listed by <https://github.com/git/git/compare/v2.17.4...v2.17.5> to solve CVE-2020-11008. Also backport the 2nd -- 4th patches listed by <https://github.com/git/git/compare/v2.17.3...v2.17.4> for CVE-2020-5260 (not necessary, and only the 1st patch is necessary for this CVE), because some of the above 9 patches are based on them. (From OE-Core rev: 63c7f76912f097cdfb95296778c42887b7336925) Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: Security Advisory - git - CVE-2020-5260Li Zhou2020-05-072-1/+68
| | | | | | | | | | | Backport patch from <https://github.com/git/git/commit/ 9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b> to solve CVE-2020-5260. (From OE-Core rev: e4c3adbaae41147f921dde638b25911d1f5422e1) Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apt-native: don't let dpkg overwrite files by defaultJan Luebbe2020-05-071-1/+1
| | | | | | | | | | | | | | | | | | | With --force-overwrite (implied by --force-all), dpkg will not abort when a package overwrites files from different packages. As this can also lead to "The following package disappeared from your system as all files have been overwritten by other packages: <package>" and subsequently broken dependencies, this makes the simple case of conflicting files hard to debug. Instead of finding all possibly required force options, only disable overwrite for now. (From OE-Core rev: b57b311cfaabbcd08ce51760abcd64cf23e1435b) Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Replace stime() API with clock_settimeKhem Raj2020-05-072-0/+62
| | | | | | | | | (From OE-Core rev: e69b89575e5ccec243658e09936908dd9e5d45ef) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-native: Should not search the system for headers/libraries.Jeremy Puhlman2020-05-072-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | The specific issue here is rpc/rpc.h, but its likely more general. /usr/include is searched for rpc/rpc.h and if it exists on the system, it changes behavior. If you are using the extended buildtools tarball on a machine that has /usr/include/rpc/rpc.h, it will decide that is good enough and not continue to search. nis fails to build because /usr/include and /usr/lib are not part of the include/link paths for the buildtools tarball compiler(nor should they be). This makes it so python3-native will not build if you are using the extended buildtools tarball, but from a larger issue perspective it is building in likely different ways depending on what machine it is building on. libtirpc is already a depend so we shouldn't need the hosts rpc/rcp.h. (From OE-Core rev: f37dfc7907ae7bac08d40468ddde2e5b8bba030c) (From OE-Core rev: db8bef336849570dd99900b173c44cc47b208058) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 400743867de587579dee85388c30190f353f80c8) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Ensure we use our own libsqliteRichard Purdie2020-04-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | pseudo-native is special in that bitbake ends up executing it from the sysroot-components directory before we have any workdirs for the bitbake fakeroot worker. Since we switched to dynamically linking sqlite, it means sqlite from the host system may be found, we really want the version in sysroot-components. Trying to run tasks to create some special environment for pseudo is hard and error prone. The simplest fix is to add an RPATH to the binary so that it can correctly find the sqlite we want. Unfortunately passing $ORIGIN into make doesn't work so well with shell quoting so we have to fix that during do_install. [YOCTO #13814] (From OE-Core rev: 2cbb3a663a3d3b2dcf8c12c26843d6087789ded0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3937ca9e2dfabb1ce9bce1d536b60b1e2a43739b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* e2fsprogs: backport upstream patchAnuj Mittal2020-03-302-0/+77
| | | | | | | | | | | | | | | | | | | Fixes a bug wherein a use after free could potentially be used to run malicious code if a user can be tricked into running e2fsck on a maliciously crafted file system. Also see: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948517 (From OE-Core rev: 23c1b157362609bd8d85c7d35e6c7f0f60c32c88) (From OE-Core rev: bc3c82e82e6d2dce025e84b8f398379f4fc6f249) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* e2fsprogs: fix CVE-2019-5188Anuj Mittal2020-03-303-0/+108
| | | | | | | | | | | | | | | Also see: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948508 (From OE-Core rev: 09bdcef183d885025da6aa87a7c2bf7e8268774e) (From OE-Core rev: b3fcf13e332d8830e759ef4161161f0e54591700) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Upgrade 3.7.6 -> 3.7.7Adrian Bunk2020-03-191-3/+3
| | | | | | | | | | | THE LICENSE checksum changed in this update due to copyright notice added for 2020. (From OE-Core rev: 3c40cfe7433999272e1698e2c914d6d190f76b63) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2019-20382Lee Chee Yang2020-03-192-0/+1019
| | | | | | | | (From OE-Core rev: dac4545cdf0ab848086da96eac123d0c640cd8b2) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ruby: fix CVE-2019-16254Rahul Chauhan2020-03-162-0/+107
| | | | | | | | (From OE-Core rev: b8e6eb473f3697ab76f30ca8a0abe584d3d10fa6) Signed-off-by: Rahul Chauhan <rahulchauhankitps@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc-target.inc: Prevent sysroot from leaking into configargs.hNathan Rossi2020-03-161-0/+8
| | | | | | | | | | | | | | | | | | | Prevent the full recipe-sysroot path from leaking into configargs.h. The configargs.h header is intended to be static and unchanged as the content is used as a means of determining that a gcc plugin is built for the same gcc. This also effects the output of 'gcc -v'. Due to per recipe sysroots and staging, the sysroot path would be replaced with the sysroot local to the recipe thus changing the content of configargs.h. This change also improves gcc binary reproducibility. The sysroot path is replaced with the base target root "/". (From OE-Core rev: 0f418fccab3f67a2afaa28195263d6f24831dd56) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b8d6e2ab68ee5e341fe970b191bfd334e6d2c40b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc-cross.inc: Prevent native sysroot from leaking into configargs.hNathan Rossi2020-03-162-4/+7
| | | | | | | | | | | | | | | | | | | | | Prevent the native(sdk) sysroot path from leaking into configargs.h. The configargs.h header is intended to be static and unchanged as the content is used as a means of determining that a gcc plugin is built for the same gcc. This also effects the output of 'gcc --version'. Due to per recipe sysroots and staging, the sysroot path would be replaced with the sysroot local to the recipe thus changing the content of configargs.h. The sysroot path is replaced with a generic "/host" prefix which represents the host sysroot (e.g. native or nativesdk). (From OE-Core rev: 9bb270b3f12ff94b1541649078741e683020ffe9) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 84a78f46d59447eeec3d69532a7506148f64c979) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc-cross-canadian: A missing space in an append caused an invalid optionMark Hatle2020-03-161-2/+2
| | | | | | | | | | | | | | | | | When configuring the cross-candian toolchain for a non-linux target system, the resulting gcc configuration included: --enable-initfini-array--without-headers these should have been two separate options. (From OE-Core rev: fdd3d65b690c9d460a5758cf1b83e7b2edfc9559) Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7b52893632dae7bc9ac75dddc7ad625e19f41050) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2020-1711Lee Chee Yang2020-03-072-1/+66
| | | | | | | | | | see https://git.qemu.org/?p=qemu.git;a=commit;h=693fd2acdf14dd86c0bf852610f1c2cca80a74dc (From OE-Core rev: 3e65ad67995874c363863280e40457acc3f479e9) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* liberror-perl: upgrade 0.17028 -> 0.17029Tim Orling2020-03-071-2/+2
| | | | | | | | | | | | | | | | | | | | Upstream release notes: " 0.17029 2020-01-28 - Rebuild for order of 'NAME' and 'VERSION' sections in the generated POD documentation (see 0.001004 in https://metacpan.org/changes/distribution/Pod-Weaver-PluginBundle-SHLOMIF ). - VERSION used to appear before NAME. " (From OE-Core rev: 8856aa960ff4c9c833e958082466d19259915d5f) Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4a520cc827187d83f2997614d893bba7d74a152) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: Fix makefile race causing configuration differencesRichard Purdie2020-03-072-0/+25
| | | | | | | | | | | | | | Add a missing makefile dependency which can cause differences in configuration (submitted upstream). [YOCTO #13800] (From OE-Core rev: 1589115ff42e8c211bc0784bd8aca7d3a5b8f566) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fe97845a45434902c5a994e253a127a462d7d3b4) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: Fix encode module reproducibility issuesRichard Purdie2020-03-072-0/+23
| | | | | | | | | | | | | The code is encoding host compiler parameters into target builds. Avoid this for our target builds. This should resolve builds which aren't reproducible between hosts with different compilers. (From OE-Core rev: 4b41afeea632f33a490d75621e2c0d6bb2bb6aca) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 71cdbf426e46e3ca1b5038f40e9f7ba958abc537) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: fix failing ptestsAlexander Kanavin2020-03-073-2/+30
| | | | | | | | | | | (From OE-Core rev: b84f3056591c16fa3e2bba2e4fa936390a76ee9a) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f1da6355f13e707b3ffa5025067e509e0120784d) [Fixup for zeus context] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: improve reproducibilityRoss Burton2020-03-071-0/+8
| | | | | | | | | | | | | | | | | | | | | | | Occasionally the reproducibility selftest fails because perl-pod differs, specifically that the perltoc.pod file was sometimes missing modules. Debugging revealed that there are missing dependencies so there is a build race: building perltoc.pod from an clean build tree results in no modules being listed at all. A bug has been filed at https://github.com/arsv/perl-cross/issues/86 to solve this properly, but for now we can just delete perltoc.pod after make has finished and re-generate it. [ YOCTO #13726 ] (From OE-Core rev: 4ee9c60797e95674ae138245b3a4de063b2e95db) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7e0f6c9ea4f824f29dc30c6631fd8039ebe83a0b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libmodule-build-perl: fix ptestsAlexander Kanavin2020-03-072-2/+3
| | | | | | | | | | | | | | Particularly remove a broken detection of skipped tests (which was marking tests that actually passed), and install additional artefacts needed for testing. (From OE-Core rev: 559fd361440898479937c887a0e4f8cfb8c46891) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dbbce0918617c21d0e43e9727d38372c22dff3dc) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: install typemap and other extutils metadata as part of perl-coreAlexander Kanavin2020-03-071-3/+3
| | | | | | | | | | | | | | Modules actually make use of these files, so they belong in perl-core other than perl-doc (the immediate failure was ptests for libmodule-build-perl failing). (From OE-Core rev: c95832dbfe4f375dadbffc8ee678052dbf7b3913) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 829e8c49833e4cb8de5db869769eb492c827e8c9) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-19 10:25:32 +0000