linux/meta-openembedded.git/meta-oe/recipes-crypto, branch scarthgap

libsodium: patch CVE-2025-69277

2026-01-12T02:42:23+00:00

Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-69277 Signed-off-by: Peter Marko Signed-off-by: Anuj Mittal

botan: patch CVE-2024-50382 and CVE-2024-50383

2025-11-19T03:16:56+00:00

Same patch fixes both vulnerabilities. Details: https://nvd.nist.gov/vuln/detail/CVE-2024-50382 https://nvd.nist.gov/vuln/detail/CVE-2024-50383 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

botan: patch CVE-2024-34703

2025-11-17T04:45:53+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2024-34703 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

cryptsetup: upgrade 2.7.4 -> 2.7.5

2025-11-17T04:45:53+00:00

Release Notes: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.5-ReleaseNotes Signed-off-by: Yi Zhao Signed-off-by: Khem Raj (cherry picked from commit cf174f190d75736aaa6c3ffe7e82d86d19930420) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

cryptsetup: upgrade 2.7.3 -> 2.7.4

2025-11-17T04:45:53+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit a403ed1c3e852fddc29bf102e92f934677420648) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

cryptsetup: upgrade 2.7.2 -> 2.7.3

2025-11-17T04:45:53+00:00

Changelog: ============ * Do not allow formatting LUKS2 with Opal SED (hardware encryption) * Fixes to wiping LUKS2 headers after Opal locking area erase. * Mention the need for possible PSID revert before Opal format for some drives (man page). * Fix Bitlocker-compatible code to ignore newly seen metadata entries. * Fix interactive query retry if LUKS2 unbound keyslot is present. * Detect unsupported zoned devices for LUKS header devices. * Allow "capi" cipher format for benchmark command and fix parsing of plain IV in "capi" format. * Add support for HCTR2 encryption mode. * Source code now uses SPDX license identifiers instead of full license preambles. * Fix missing includes for cryptographic backend that could cause compilation errors for some systems. * Fix tests to work correctly in FIPS mode with recent OpenSSL 3.2. * Fix various (mostly false positive) issues detected by Coverity. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 7916a5c55a2dee58f062197c45d7e50a8960e471) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

fsverity-utils: fix SRC_URI

2025-11-12T06:02:41+00:00

This URL does not exist any more, and do_fetch works only because a mirrored file is available at http://downloads.yoctoproject.org/mirror/sources/git2_git.kernel.org.pub.scm.linux.kernel.git.ebiggers.fsverity-utils.git.tar.gz Signed-off-by: Etienne Cordonnier Signed-off-by: Khem Raj (cherry picked from commit d54e2671e62b87532e2dd8f80b73d545fc54aeb4) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

botan: Make it reproducible

2025-04-17T00:30:23+00:00

Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

cryptsetup: upgrade 2.7.1 -> 2.7.2

2024-04-21T17:52:42+00:00

Changelog: ========== * Fix activation of OPAL-only encrypted LUKS device with tokens. * Fix formatting of OPAL devices with 4096-byte sector size. * Fix incorrect OPAL locking range alignment calculation if used over an unaligned device partition. * Add --hw-opal-factory-reset option description to the manual page. * Do not check the passphrase quality for OPAL Admin PIN, as this passphrase already exists. * Update license for FAQ document to CC BY-SA 4.0. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

cryptsetup: upgrade 2.7.0 -> 2.7.1

2024-03-11T04:54:07+00:00

Cryptsetup 2.7.1 Release Notes ============================== Stable bug-fix release with minor extensions. Changes since version 2.7.0 * Fix interrupted LUKS1 decryption resume. With the replacement of the cryptsetup-reencrypt tool by the cryptsetup reencrypt command, resuming the interrupted LUKS1 decryption operation could fail. LUKS2 was not affected. * Allow --link-vk-to-keyring with --test-passphrase option. This option allows uploading the volume key in a user-specified kernel keyring without activating the device. * Fix crash when --active-name was used in decryption initialization. * Updates and changes to man pages, including indentation, sorting options alphabetically, fixing mistakes in crypt_set_keyring_to_link, and fixing some typos. * Fix compilation with libargon2 when --disable-internal-argon2 was used. * Do not require installed argon2.h header and never compile internal libargon2 code if the crypto library directly supports Argon2. * Fixes to regression tests to support older Linux distributions. Signed-off-by: Yi Zhao Signed-off-by: Khem Raj