linux/meta-openembedded.git, branch styhead-next

sip: Upgrade 6.8.3 -> 6.8.6

2025-02-25T13:45:21+00:00

After the migration from Mercurial to GitHub the homepage has changed and SIP has been licensed under the BSD-2-Clause license since Feb 9, 2024. Upgrade to version 6.8.6: - Handle single number macOS deployment targets - Support for architectures where `char` is unsigned - Support for building from git archives - Run the tests using the current Python version The project has a proper pyproject.toml which declares the setuptools.build.meta PEP-517 backend. Fixes: WARNING: sip-6.8.6-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with setuptools.build_meta, use the correct class [pep517-backend] Please note SIP version 6.8.6 is present for branch Scarthgap and it is required for PyQt6 6.8 from layer meta-qt6 (branch 6.8). The work was sponsored by GOVCERT.LU. License-Update: SIP is licensed under the BSD-2-Clause license. Signed-off-by: Leon Anavi Signed-off-by: Armin Kuster

licenses/MINPACK: Remove

2025-02-25T13:45:21+00:00

The libeigen recipe, which was the only user of this license file, now uses the Minpack license from OE-Core instead. Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

libeigen: Remove LGPL code

2025-02-25T13:45:21+00:00

Since libeigen is a header-only library, LGPL effectively has the same properties as GPL when it comes to affecting the licensing of the code that uses libeigen. To avoid the problem, backport a patch to remove all LGPL-2.1 code from the library. Switch to using "Minpack" rather than "MINPACK" as license since the former is the official SPDX name. Also correct the licenses for ${PN}, ${PN}-dbg and ${PN}-dev to reflect that they do not contain any GPL code (the GPL code is only used for benchmark tests and does not affect what is installed). License-Update: Correct the license information Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

lvm2: Remove a lingering reference to ${PN}-udevrules

2025-02-25T13:45:21+00:00

The lvm2-udevrules package has not actually been created since commit 5d54a52fbeb69dba7b8ae11db98af4813951fa61. Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

tbb: Re-enable hwloc support

2025-02-25T13:45:21+00:00

The problem with using pkg-config to find hwloc when cross-compiling was solved by upstream in 2021.13.0. However, the upgrade in commit d8c5a72788ab0f2e36aee16e6d9e7555537366a5 missed that upstream defaults to disabling searching for hwloc when cross-compiling. Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

ebtables: Remove the dependecy on bash

2025-02-25T13:45:21+00:00

Rewrite ebtables-legacy-save to avoid using bashisms. Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

lapack: fix buildpaths in ptest also when CBLAS is enabled

2025-02-04T22:29:37+00:00

ERROR: lapack-3.12.0-r0 do_package_qa: QA Issue: File /usr/lib/lapack/ptest/bin/xccblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat3 in package lapack-ptest contains reference to TMPDIR [buildpaths] Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

lapack: add PACKAGECONFIG for cblas

2025-02-04T22:29:37+00:00

Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

audiofile: mark CVE-2020-18781 as patched

2025-02-04T22:29:37+00:00

Per [1] this CVE is already patched by commit [2]. This can be also verified with yocto build. Running without this patch: root@qemux86-64:~# sfconvert poc.wav output format wave malloc(): corrupted top size Aborted Running with it: root@qemux86-64:~# sfconvert poc.wav output format wave Audio File Library: Bad number of coefficients [error 62] Could not open file 'poc.wav' for reading. [1] https://github.com/mpruett/audiofile/issues/56 [2] https://github.com/antlarr/audiofile/commit/c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 68f55c158e15a5d35702ae5c730586001e487f86) Signed-off-by: Armin Kuster

vorbis-tools: patch CVE-2023-43361

2025-02-04T22:29:37+00:00

This is inactive project, so no official CVE fix will be available anymore. That however does not mean that there is no fix available. Following tries to prove that patch provided here is valid. NVD CVE report [1] links issue [2] where this is reported. Based on the report, fix was proposed in [3]. There was some review however the patch autor was not active. [4] was later created trying to adddress the comments, but the project was not active anymore. In this PR the patch was shrunk to a one-liner in discussion. I have tested the poc and it is real. The patch fixes it, while not breaking the execution if good file path is provided as argument. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-43361 [2] https://github.com/xiph/vorbis-tools/issues/41 [3] https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/7 [4] https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/8 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 67d94fecb0dbd4f979b09a439c614ee4f01fc0c2) Signed-off-by: Armin Kuster