summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* gstreamer1.0-vaapi: downgrade vaapisink to marginal rankAnuj Mittal2018-12-042-1/+48
| | | | | | | | | | | | | | | | | | Using vaapisink (which doesn't supports DRI3 [1] and uses DRI2) with default poky configuration currently results in an unresponsive display because DRI2 rendering doesn't work (as of xserver 1.20.3) in non-composited environments [2]. Downgrade vaapisink to marginal for now so playbin (and in turn gst-play and gtk-play examples) uses next best sink element and works out of box. [1] https://github.com/intel/libva/issues/122 [2] https://gitlab.freedesktop.org/xorg/xserver/issues/13 (From OE-Core rev: 0ac1b496823a57ac6a234a14c60318bf1ffa19b0) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sanity: Add check for WSLRichard Purdie2018-11-241-0/+11
| | | | | | | | | Users are starting to expect OE to work under WSL which it doesn't. Add a warning to tell them about this up front and manage expectations. (From OE-Core rev: 4f22710f9a310412f1de0b4e6905c058ec416f25) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/utils/httpserver: Rework to avoid hangs and improve loggingRichard Purdie2018-11-244-11/+32
| | | | | | | | | | | | | | | | | | testimage.bbclass installs a SIGTERM handler which conflicts with the use of multiprocessing here. This is paritcularly problematic if the http service is terminated before its started and hence before its had a chance to reset the default signal handler (as the code was written). Instead, temporarily remove testimage's handler whilst forking the http process which means the correct handler is installed and won't deadlock. Also take the opportunity to add in some log messages about the server start and shutdown so that future debugging is easier and its clearer what the code is doing. (From OE-Core rev: cc0471439aa0085ca87deccf061c5b676ef12388) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl-1.1.1: remove build path from version infoMartin Hundebøll2018-11-242-0/+71
| | | | | | | | | | | | | | | | | | The openssl build system generates buildinf.h containing the full compiler command line used to compile objects. This breaks reproducibility, as the compile command is baked into libcrypto, where it is used when running `openssl version -f`. Add stripped build variables for the compiler and cflags lines, and use those when generating buildinfo.h. This is based on a similar patch for older openssl versions: https://patchwork.openembedded.org/patch/147229/ (From OE-Core rev: 8f5b6a3789a7fcbac0a384b84b4c7ef5994023b6) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: make busybox.links.{suid, nosuid} reproducibleMartin Hundebøll2018-11-241-1/+2
| | | | | | | | | | | | | | The busybox.link.* files are generated from autoconf.h and applets.h, which are both auto-generated by the build system. The contents of the two files might be in different order, and so the link files are not reproducble as is. Fix this by sorting the lists using `sort`. (From OE-Core rev: bade7cc344c2f0e9316f973c34e9c9dfcbdbe32d) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: improve reproducibility by hard-coding shell pathMartin Hundebøll2018-11-241-0/+2
| | | | | | | | | | | | | | | | | The shadow configure script tries really hard to detect the running shell to make sure it doesn't do unsupported calls. On my system the shell is detected as /bin/sh, while a build in an ubuntu docker it resolves to /bin/bash. And since the shell path is baked into the target binaries through config.h, the build becomes inreproducible. Fix reproducibility by hard-coding the shell to be /bin/sh (From OE-Core rev: 5f4fe91cb6c21cd3ecd0b68d1c6b46a9530c7570) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: actually apply latest CVE patchesRoss Burton2018-11-091-0/+3
| | | | | | | (From OE-Core rev: f0394e80a37f1da47042a1aa0487594f390603f9) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unzip: actually apply CVE-2018-18384Ross Burton2018-11-091-0/+1
| | | | | | | (From OE-Core rev: d8e1b7afc536f989e7e6efdab0998d54f26ad1f6) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest/recipetool: Fix problems from changing upstream sourceMohamad Noor Alim Hussin2018-11-091-2/+2
| | | | | | | | | | | | The upstream source tarball checksums changed. Use the copy from our source mirror to avoid failures. [YOCTO #12979] (From OE-Core rev: e97a31e6bbaec5cb56d4750bf5171dbba510ee33) Signed-off-by: Mohamad Noor Alim Hussin <mohamad.noor.alim.hussin@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* image-buildinfo,oeqa/selftest/containerimage: Ensure image-buildinfo doesn't ↵Richard Purdie2018-11-092-0/+3
| | | | | | | | | | | | | | | | | | | break tests Having image-buildinfo enabled causes containerimage.ContainerImageTests.test_expected_files to fail due to the presence of an unexpected file: ['./', './etc/', - './etc/build', './etc/default/', './etc/default/postinst', Tweak the class to allow it to be disabled and disable it from the test just in case it was enabled. (From OE-Core rev: af67bf422a4df5b7e07894512ff73a5f493682ab) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* valgrind: drop mips n32 supportRandy MacLeod2018-11-092-0/+2
| | | | | | | | | | | | | | | | | valgrind for qemumips64 multilib builds fails to configure for libn32 with the error: configure:6190: checking for 32 bit build support ... fatal error: bits/long-double-32.h: No such file or directory It seems that the toolchain is producing: tmp-glibc/sysroots-components/mips64-n32/libn32-glibc/usr/include/bits/long-double-n32.h Until the toolchain problem is resolved, skip valgrind for libn32. (From OE-Core rev: 17d5574f05384edeb5c80ada2724fff4a1c3c94b) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest: Standardize json logging output directoryYeoh Ee Peng2018-11-091-1/+1
| | | | | | | | | | | | Currently sdk & sdkext will output json file to LOG_DIR, while selftest will output json file to TOPDIR/log. Standardize selftest json output file to LOG_DIR. (From OE-Core rev: 2012d6b076fc833864a0254d56d78536314a6799) Signed-off-by: Yeoh Ee Peng <ee.peng.yeoh@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: make ld-2.28.so reproducible on armMartin Hundebøll2018-11-091-0/+13
| | | | | | | | | | | Play the whack-a-mole game and add the .file directive to another assembly file that otherwise shows itself in ld-2.28.so debug file, which in turns alters the build-id of ld-2.28.so on target. (From OE-Core rev: 4cbf901b3a127ed039371e614946002d26d56997) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base.bbclass: avoid 'find -ignore_readdir_race -delete'Matthias Schiffer2018-11-091-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Due to a bug in find [1], -ignore_readdir_race does not work correctly with -delete. This can lead to spurious build failures when files disappear while such a command is running; specifically this was seen in the case of do_configure and do_populate_lic running concurrently for packages with ${B} == ${WORKDIR}: find: '.../sstate-build-populate_lic': No such file or directory While the issue is fixed in the findutils git master, the find command of the host system is called here, so we can't ensure that the used version contains the fix. Many common distros have not updated to a recent enough findutils version yet (Ubuntu 18.10 contains the fix, while 18.04 is still affected). Work around the issue by passing the output of find to 'rm -f' instead of using -delete. [1] https://savannah.gnu.org/bugs/?52981 (From OE-Core rev: 8079e2d62e23f7c274f46185e6dad64fa95394c1) Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: fix four CVE issuesZhixiong Chi2018-11-095-0/+506
| | | | | | | | | Backport the CVE patches from the binutils upstream. (From OE-Core rev: 84bb9c0514ecbd7c31935c22062b18b4aaefbef1) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perf: Disable libunwind for ARC & RISCV64Alexey Brodkin2018-11-071-0/+4
| | | | | | | | | | | | | | | | libunwind is not yet ported for ARC & RISCV64 and on attempt to build it for those arches we just get an error message. If we explicitly disable libunwind it is gracefully handled by perf build system and it just gets configured to not use it so perf is still usable even on those arches. (From OE-Core rev: bb06900a1f29fdd4066f6d7e7a961d230c2e9438) Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com> Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apt: update SRC_URIChangqing Li2018-11-071-1/+1
| | | | | | | | | | update SRC_URI since previous link is not valid now (From OE-Core rev: 0b5972c8189dade0e77df175651b8d8707647bb1) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* archiver: Drop unwanted directoriesFabien Lahoudere2018-11-071-1/+9
| | | | | | | | | | | | | In sources directory we can find patches/ and temp/. The first one is filled with symbolic link unusable on another machines. The second contains yocto logs to create this archives and are typically copied when 'S = "${WORKDIR}"' (From OE-Core rev: 3904f98851c6a63dd9377e38f1432be6b1c0a94d) Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: Use double colon for chown OWNER:GROUPKosta Zertsekel2018-11-073-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | Rationale - excerp from `info chown` ==================================== OWNER‘:’GROUP If the OWNER is followed by a colon and a GROUP (a group name or numeric group ID), with no spaces between them, the group ownership of the files is changed as well (to GROUP). Some older scripts may still use ‘.’ in place of the ‘:’ separator. POSIX 1003.1-2001 (*note Standards conformance::) does not require support for that, but for backward compatibility GNU ‘chown’ supports ‘.’ so long as no ambiguity results. New scripts should avoid the use of ‘.’ because it is not portable, and because it has undesirable results if the entire OWNER‘.’GROUP happens to identify a user whose name contains ‘.’. (From OE-Core rev: 185918234a07cb506d7d7464a49ac33972c7d963) Signed-off-by: Kosta Zertsekel <zertsekel@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest: Add test for Yocto source mirror functionality/completenessRichard Purdie2018-11-071-0/+23
| | | | | | | | | | | | | | We've had a number of occasions where the Yocto Project source mirrors have not been complete or functioning correctly. This adds a test so that if this happens we find out out it sooner. It also only works over http meaning we should be able to test that anyone behind an http only proxy (no git protocol) also has functional fetches for OE-Core and layers built by the core of the project. (From OE-Core rev: 9a25b2eb9cc13dd77a774dad83067ea5f9bf9716) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgpg-error: Support build for native on ppc64/ppc64le hostsSerhey Popovych2018-11-071-0/+2
| | | | | | | | | | | | | | | | | | | Both RHEL and SLES uses ppc64/ppc64le for powerpc 64 bit big/little endian targets instead of powerpc64/powerpc64le in libgpg-error. Also libgpg-error provides common target system names in form like <arch>-unknown-linux-gnu. Add mapping for ppc64/ppc64le targets to their libgpg-error equivalents to fix native builds. Cross build for arm64 tested on IBM Power 8 machine with RHEL7 for ppc64le variant only, but should work for ppc64 as well. (From OE-Core rev: f1af780769477f06eb925fd87c844baba04ada2d) Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* v86d: Make cross compilation working on more architecturesSerhey Popovych2018-11-073-20/+36
| | | | | | | | | | | | | | | | | | Since commit 709c603dec19 ("v86d: Accept aarch64 as build host") we support cross compilation on aarch64 host in addition to x86 host. However building on hosts different than two above will fail. Make cross compilation support more generic by checking for TARGET_ARCH in v86d configure script with fallback to `uname -m` when not present in environment and pass TARGET_ARCH explicitly in do_configure(). Cross build for x86 tested on IBM Power 8 machine with RHEL7. Should work on aarch64 and rest too. (From OE-Core rev: 69f7579eb36c00b557225377e1a3cc61b103be23) Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe-init-buildenv/base: Relax python version checks in favour of HOSTTOOLS ↵Richard Purdie2018-11-072-1/+8
| | | | | | | | | | | | | | manipulation Several distros are now shipping "python" as python v3 contra to the original python guidelines. This causes users confusion/pain in trying to use our tools. We can just force "python" to "python2" within HOSTTOOLS to avoid this issue and hide the complexity from the user. (From OE-Core rev: b06a6cde5c5503f456f260c773cf126085e18c8d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/runtime/ptest: Inject results+logs into stored json results fileRichard Purdie2018-11-072-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows the ptest results from ptest-runner, run in an image to be transferred over to the resulting json results output. Each test is given a pass/skip/fail so individual results can be monitored and the raw log output from the ptest-runner is also dumped into the results json file as this means after the fact debugging becomes much easier. Currently the log output is not split up per test but that would make a good future enhancement. I attempted to implement this as python subTests however it failed as the output was too confusing, subTests don't support any kind of log output handling, subTest successes aren't logged and it was making things far more complex than they needed to be. We mark ptest-runner as "EXPECTEDFAILURE" since its unlikely every ptest will pass currently and we don't want that to fail the whole image test run. Its assumed there would be later analysis of the json output to determine regressions. We do have to change the test runner code so that 'unexpectedsuccess' is not a failure. Also, the test names are manipuated to remove spaces and brackets with "_" used as a replacement and any duplicate occurrences truncated. (From OE-Core rev: a13e088942e2a3c3521e98954a394e61a15234e8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* crosssdk: Remove usage of host flags for cross-compilationRichard Purdie2018-11-071-4/+4
| | | | | | | | | | | | | | | | | | | Similarlly to OE-Core rev 4b936cde58ca0a6f34092ce82640a02859110411 for cross.sdk, BUILD_* flags can't be used as TARGET_* flags gcc-crosssdk buils leaks config.log's through "gcc-stashed-builddir" and TARGET_* flags to libgcc cross-build through "gcc/libgcc.mvars" file on "gcc-stashed-builddir". This means that if BUILD_CFLAGS contains host-specific flags like "-isystem/usr/include" libgcc build will fail "do_qa_configure" and "do_package_qa" checks. Remove host-related flags from TARGET_* flags for gcc-crosssdk builds. [YOCTO #11874] (From OE-Core rev: 6e162e619b6f5173c073cd9bedbcadf205017e30) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Change from TARGET_ARCH to TUNE_PKGARCHRichard Purdie2018-11-074-5/+5
| | | | | | | | | | | | | | | | | Right now go-cross is changing signatures when you change TUNE for a given architecture. In particular this breaks layer tests like: yocto-check-layer ../meta-yocto-bsp/ --machines qemuarm beaglebone-yocto This changes the PN addtion to something containing the tune rather than the arch which avoids these kinds of errors. If go-cross can be tune independent that would be nice but currently that isn't the case. [YOCTO #12586] (From OE-Core rev: e3c7e1703499e6a5332d9ab8a941671ec8235c4f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-dep: disable PTEST_ENABLED for mips and mips64Chen Qi2018-11-071-0/+5
| | | | | | | | | | | | | The current go-dep does not compile ptest successfully on mips and mips64. So as a workaround, disable PTEST_ENABLED explicitly to avoid error like below. | vet config not found (From OE-Core rev: 786322ec408e2ef5cd6fb809456e0453e5f5e162) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: add python3-venv to the python3-modules RDEPENDSRoss Burton2018-11-071-0/+1
| | | | | | | (From OE-Core rev: ed5e7541677f6a046f85389cd0c879be3db422cd) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix python3-pyvenv run-time dependencyHugues Kamba2018-11-072-2/+18
| | | | | | | | | | | | | | | | | | | | | | | Pyvenv is just a small script that uses venv to create virtual environments. https://www.python.org/dev/peps/pep-0405/#creating-virtual-environments This patch adds the python3-venv module as a self-contained package which python3-pyvenv must depend on at run-time. The patch also provides the package python3-pyvenv from the pyhton3-venv package.This is good for future-proofing since python3-pyvenv has been deprecated and only python3-venv is now available in Python 3.6. https://docs.python.org/3/library/venv.html. Without this patch python3-pyvenv is broken because it is missing the venv module at run-time. This patch specifies the newly created python3-venv as a run-time dependency of python3-pyvenv. (From OE-Core rev: effa141bfce55aab25142ee578c95383c755ad73) Signed-off-by: Hugues Kamba <hugues.kamba@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gdbm: fix ptest failureChen Qi2018-11-071-1/+1
| | | | | | | | | | Some of gdbm's ptest cases require gdbmtool, which is packaged into ${PN}-bin. So extend the RDEPENDS_${PN}-ptest to include the package. (From OE-Core rev: e188a75aa882efc98b8390f43f18279c3707314a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pixman: Trim license info extracted from pixman-matrix.cPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Four unrelated lines were extracted from pixman-matrix.c for the license information. License-Update: Only extract the relevant part from pixman-matrix.c (From OE-Core rev: d0a209e8cf29d982567e3978e1dcbb3871505a39) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgpg-error: Trim license info extracted from init.c & gpg-error.h.inPeter Kjellerstedt2018-11-071-2/+2
| | | | | | | | License-Update: Only extract relevant parts from init.c & gpg-error.h.in (From OE-Core rev: a5c1ff6deb6393666745889eee8297112848ba28) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr-util: Trim license info extracted from apu_version.hPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Two unrelated lines were extracted from apu_version.h for the license information. License-Update: Only extract the relevant part from apu_version.h (From OE-Core rev: 2edb0f24a13f27b2fae94fb447221ad2ddb924a0) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Trim license info extracted from apr_lib.hPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Two unrelated lines were extracted from apr_lib.h for the license information. License-Update: Only extract the relevant part from apr_lib.h (From OE-Core rev: 90ab83ecc509c2fdc1f6083d771031decdcaad63) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* common-licenses: Correct the FreeType license textPeter Kjellerstedt2018-11-071-2/+2
| | | | | | | | | | It now matches: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT (From OE-Core rev: 9dcb393551b65c8b674f625e90171b512f5e5a60) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* reproducible_build: update do_deploy_source_date_epoch commmentDouglas Royds2018-11-071-1/+4
| | | | | | | | | | | | Once the value of SOURCE_DATE_EPOCH is determined, it is stored in the recipe's SDE_FILE. If none of the existing mechanisms are suitable, replace the do_deploy_source_date_epoch task with recipe-specific functionality to write the appropriate SOURCE_DATE_EPOCH into the SDE_FILE. (From OE-Core rev: e7b891b76954c784f5a93bd0a1c91315673ce40d) Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842Changqing Li2018-11-073-0/+113
| | | | | | | (From OE-Core rev: 0f0db9fc8512a0ecd0cdba3304a195cd925a5029) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2018-0735 for 1.1.1Kai Kang2018-11-072-0/+51
| | | | | | | | | Backport patch to fix CVE-2018-0735 for openssl 1.1.1. (From OE-Core rev: 78e751e33d3ec4394d96391e737cc39cad960ebe) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2018-0734 for both 1.0.2p and 1.1.1Kai Kang2018-11-074-0/+143
| | | | | | | | | | Backport patches to fix CVE-2018-0734 for both openssl 1.0.2p and 1.1.1 versions. (From OE-Core rev: 9d5c6a87eb72a8b8b8d417126a831565982ca9a6) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-18284Hongxu Jia2018-11-072-0/+246
| | | | | | | | | | | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. (From OE-Core rev: 98ab5c5770d20b39bf3c58083f31f31838f2e940) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-18073Hongxu Jia2018-11-073-0/+241
| | | | | | | | | | | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. (From OE-Core rev: 6098c19e1f179896af7013c4b5db3081549c97bc) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-17961Hongxu Jia2018-11-076-0/+806
| | | | | | | | | | | | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. (From OE-Core rev: 6c32ea184941d292cd8f0eb898e6cc90120ada40) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* elfutils: fix CVE-2018-18520 & CVE-2018-18521 & CVE-2018-18310Hongxu Jia2018-11-074-0/+139
| | | | | | | | | | These CVE fixes come from upstream master branch and no new version released, so backport rather than upgrade. (From OE-Core rev: bd8d2c25f595e30a3fdcad8a2409913bb8af7c5c) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* elfutils: 0.173 -> 0.174Hongxu Jia2018-11-075-1015/+22
| | | | | | | | | | | | | | - Drop backport fixes CVE-2018-16062.patch 0001-libdw-Check-end-of-attributes-list-consistently.patch 0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch - Rebase 0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch (From OE-Core rev: 777c1f8b6e20643964c304400e2d746dc2926524) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nasm: fix CVE-2018-1000667Hongxu Jia2018-11-072-0/+38
| | | | | | | | | | Since the latest nasm is 2.14rc16 (not formal release), so backport a patch to 2.13 to fix CVE-2018-1000667. (From OE-Core rev: 024b395425c95a08c881d922c310be78ffad483a) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unzip: fix for CVE-2018-18384Changqing Li2018-11-071-0/+39
| | | | | | | (From OE-Core rev: 2ddb3b25ed063b47d3fe2b3e9e17b7f9d0e2a7e5) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix for CVE-2018-10839Changqing Li2018-11-071-0/+52
| | | | | | | (From OE-Core rev: 5c2b164e1022c46f6bf541894429773c3dde7af2) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15688Chen Qi2018-11-072-0/+40
| | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15688 (From OE-Core rev: 13591d7224393dc0ae529a03cdf74aceb3540ce9) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15687Chen Qi2018-11-072-0/+220
| | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15687 (From OE-Core rev: eeb621aa19f690971caf862290a172a115578ba1) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15686Chen Qi2018-11-072-0/+251
| | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15686 (From OE-Core rev: 0ef70603bc983315eb0e8a97958d995a31198c35) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-28 02:17:41 +0000