linux/meta-security.git, branch wrynose

tpm2-pkcs11: upgrade 1.9.1 -> 1.9.2

2026-05-25T14:14:15+00:00

This contains fix for building native recipe with security flags enabled: * https://github.com/tpm2-software/tpm2-pkcs11/commit/be97b21ae641303ce83a8fbb54002701c1aede31 Signed-off-by: Peter Marko Signed-off-by: Scott Murray

samhain: upgrade 4.5.2 -> 4.5.3

2026-05-18T16:21:05+00:00

Update samhain-client, samhain-server, and samhain-standalone to 4.5.3. Release notes: https://www.la-samhna.de/samhain/archive.html Signed-off-by: Bin Cao Signed-off-by: Scott Murray

aide: fix pkg_postinst_ontarget shell script

2026-05-18T16:21:05+00:00

- Fix conditional checks for AIDE_SCAN_POSTINIT and AIDE_RESCAN_POSTINIT: '[ 0 ]' always evaluates to true since it's a non-empty string. Use string comparison '= "1"' instead. - Fix invalid use of '&&' inside '[ ]' test brackets. Use separate test expressions joined by shell '&&'. Signed-off-by: Haitao Liu (reworked for 0.19.3, fixed indentation) Signed-off-by: Scott Murray

aide-base.bbclass: correct STAGING_AIDE_DIR

2026-05-18T16:21:05+00:00

Fix the typo "aida" to "aide" in STAGING_AIDE_DIR. Signed-off-by: Li Zhou Signed-off-by: Scott Murray

arpwatch: fix typos

2026-05-18T16:21:05+00:00

APRWATCH_FROM -> ARPWATCH_FROM ARPWATH_REPLY -> ARPWATCH_REPLY CONFFILE_FILES -> CONFFILES:${PN} Signed-off-by: Yi Zhao Signed-off-by: Scott Murray

tpm2-tools: make efivar optional

2026-05-18T16:21:05+00:00

Previous commit made this a hard dependency because it's autodetected. Instead of that, make it configurable so it can be disabled (roughtly equivalent to behavior before that commit). Signed-off-by: Peter Marko Signed-off-by: Scott Murray

parsec-service: update TS group name

2026-05-18T16:21:05+00:00

meta-arm recently changed the group name that is used by TS[1], so update the group name to match. [1] meta-arm 595cb0f1a0 ("arm/trusted-services: fix udev management in libts") Signed-off-by: Ross Burton Signed-off-by: Scott Murray

parsec-service: do group membership modifications in useradd

2026-05-18T16:21:05+00:00

Instead of calling groupmems after creating the user, we can tell useradd to do the group membership when creating the user. There are several reasons for this: 1) Consolidation of the calls into a single call means creation is atomic, it either worked or it did not. 2) The existing logic doesn't work if both TPM and TS were enabled. 3) GROUPMEMS_PARAM is broken in oe-core master[1] and this will not be fixed as groupmems has been removed from shadow[2]. Instead, construct a list of groups that parsec needs to be a member of, and pass them to useradd. [1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16277 [2] shadow 388ce70 "*/: groupmems(8): Remove program" Signed-off-by: Ross Burton Signed-off-by: Scott Murray

parsec-service: assign PACKAGECONFIG in one line

2026-05-18T16:21:05+00:00

By :appending the TPM option we make it impossible for distros to simply assign to PACKAGECONFIG. Signed-off-by: Ross Burton Signed-off-by: Scott Murray

meta-parsec: Do not run Parsec CI jobs on 32bit platforms.

2026-05-18T16:21:05+00:00

Signed-off-by: Anton Antonov Signed-off-by: Scott Murray