summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tpm2-pkcs11: upgrade 1.9.1 -> 1.9.2HEADmaster-nextmasterPeter Marko2026-05-251-1/+1
| | | | | | | | | This contains fix for building native recipe with security flags enabled: * https://github.com/tpm2-software/tpm2-pkcs11/commit/be97b21ae641303ce83a8fbb54002701c1aede31 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* samhain: upgrade 4.5.2 -> 4.5.3Bin Cao2026-05-171-2/+2
| | | | | | | | | Update samhain-client, samhain-server, and samhain-standalone to 4.5.3. Release notes: https://www.la-samhna.de/samhain/archive.html Signed-off-by: Bin Cao <bin.cao.cn@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* aide: fix pkg_postinst_ontarget shell scriptjason.lau2026-05-171-2/+2
| | | | | | | | | | | | - Fix conditional checks for AIDE_SCAN_POSTINIT and AIDE_RESCAN_POSTINIT: '[ 0 ]' always evaluates to true since it's a non-empty string. Use string comparison '= "1"' instead. - Fix invalid use of '&&' inside '[ ]' test brackets. Use separate test expressions joined by shell '&&'. Signed-off-by: Haitao Liu <haitao.liu@windriver.com> (reworked for 0.19.3, fixed indentation) Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* aide-base.bbclass: correct STAGING_AIDE_DIRLi Zhou2026-05-171-1/+1
| | | | | | | Fix the typo "aida" to "aide" in STAGING_AIDE_DIR. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* arpwatch: fix typosYi Zhao2026-05-171-4/+4
| | | | | | | | | APRWATCH_FROM -> ARPWATCH_FROM ARPWATH_REPLY -> ARPWATCH_REPLY CONFFILE_FILES -> CONFFILES:${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* tpm2-tools: make efivar optionalPeter Marko2026-05-171-1/+4
| | | | | | | | | Previous commit made this a hard dependency because it's autodetected. Instead of that, make it configurable so it can be disabled (roughtly equivalent to behavior before that commit). Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* parsec-service: update TS group nameRoss Burton2026-05-171-1/+1
| | | | | | | | | | meta-arm recently changed the group name that is used by TS[1], so update the group name to match. [1] meta-arm 595cb0f1a0 ("arm/trusted-services: fix udev management in libts") Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* parsec-service: do group membership modifications in useraddRoss Burton2026-05-171-3/+16
| | | | | | | | | | | | | | | | | | | | | Instead of calling groupmems after creating the user, we can tell useradd to do the group membership when creating the user. There are several reasons for this: 1) Consolidation of the calls into a single call means creation is atomic, it either worked or it did not. 2) The existing logic doesn't work if both TPM and TS were enabled. 3) GROUPMEMS_PARAM is broken in oe-core master[1] and this will not be fixed as groupmems has been removed from shadow[2]. Instead, construct a list of groups that parsec needs to be a member of, and pass them to useradd. [1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16277 [2] shadow 388ce70 "*/: groupmems(8): Remove program" Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* parsec-service: assign PACKAGECONFIG in one lineRoss Burton2026-05-171-2/+1
| | | | | | | | By :appending the TPM option we make it impossible for distros to simply assign to PACKAGECONFIG. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* meta-parsec: Do not run Parsec CI jobs on 32bit platforms.Anton Antonov2026-05-173-24/+0
| | | | | Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* parsec-service: Update Parsec service version.Anton Antonov2026-05-173-431/+499
| | | | | | | This update adds compatibility with clang 22.1 in oe-core. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* google-authenticator-libpam: update 1.0.9 -> 1.11jason.lau2026-05-171-2/+2
| | | | | | | | | | | | | | | | | | | | Changes from 1.09 to 1.10: - Shorten syslog name to work with rsyslog (#172) - Update config file with grace period in all cases (#193) - Remove printing QR code using Google Charts URL (service shut down) Changes from 1.10 to 1.11: - Change secret key bits from 128 to 160 bits (#266, #271) - Add support for black & white terminals (#268, #270) - Fix grace_period for IPv6 link-local addresses (#265) Also fix the .bb recipe: - Fix typo: RDEPNEDS -> RDEPENDS - Use new override syntax: RDEPENDS:pam-google-authenticator (replaces old underscore style RDEPENDS_pam-google-authenticator) Signed-off-by: Haitao Liu <haitao.liu@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* layer.conf: correct WARN_QALi Zhou2026-05-171-1/+1
| | | | | | | | | Fix the typo "tmp-layer" in "WARN_QA:append". The right name for this layer in OVERRIDES is layer-tpm-layer by checking "bitbake -e <recipe_name> | grep ^OVERRIDES=". Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* firejail: fix COMPATIBLE_MACHINE settingLi Zhou2026-05-131-2/+3
| | | | | | | | | | | | | | | | | | Because "x86_64" and "arm64" aren't valid in bitbake OVERRIDES, they should be corrected to "x86-64" and "aarch64". On the other side, "x86_64" and "arch64" aren't valid MACHINE name. So correct the way to "only allow x86-64 and arm64 to build": COMPATIBLE_MACHINE = "(-)" => disallow all machine first COMPATIBLE_MACHINE:aarch64 = "(.*)" => when arch "aarch64" in OVERRIDES, allow all machines. COMPATIBLE_MACHINE:x86-64 = "(.*)" => when arch "x84-64" in OVERRIDES, allow all machines. Fix 1dd076d3a76f ("firejail: only allow x86-64 and arm64 to build") Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* README: update CI linksMarta Rybczynska2026-04-271-4/+2
| | | | | | | Update CI links for meta-security Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* packagegroup-core-security: remove python3-privacyideaScott Murray2026-04-271-1/+0
| | | | | | | | To work around an install conflict between python3-cryptography and python3-pyrad and unblock CI runs, remove python3-privacyidea from the packagegroup dynamic bbappend temporarily. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* packagegroup-core-security: Add missing packagesScott Murray2026-04-271-0/+4
| | | | | | | Add aircrack-ng, crowdsec, ncrack, and opendnssec where appropriate now that they have been updated to build again. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* ncrack: UpdateScott Murray2026-04-271-3/+5
| | | | | | | | | | Bump to HEAD of ncrack's master branch to pick up build fixes for newer gcc's. PV has been updated to indicate that we are now building something newer than the 0.7 tagged commit. License-Update: copyright years refreshed Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* libmhash: RemoveScott Murray2026-04-276-106/+0
| | | | | | Remove libmhash, as it is no longer required to build aide. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* aide: Upgrade to 0.19.3Scott Murray2026-04-273-48/+44
| | | | | | | | | | Release notes: https://github.com/aide/aide/releases/tag/v0.19 https://github.com/aide/aide/releases/tag/v0.19.1 https://github.com/aide/aide/releases/tag/v0.19.2 https://github.com/aide/aide/releases/tag/v0.19.3 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* clamav: Upgrade to 1.4.4Scott Murray2026-04-272-36/+148
| | | | | | | Release notes: https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.4 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* libmspack: RemoveScott Murray2026-04-273-18/+1
| | | | | | | | Remove libmspack recipe, and remove it from clamav's DEPENDS. clamav now vendors its own substantially modified copy, so there's no reason to carry a recipe for it. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* opendnssec: Upgrade to 2.1.14Scott Murray2026-04-274-7/+131
| | | | | | | Upgrade to 2.1.14 and add some patches from the github PR queue to fix compilation. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* aircrack-ng: Upgrade to 1.7Scott Murray2026-04-273-36/+133
| | | | | | | | | | | Upgrade to the latest release, 1.7, and rework recipe so that it actually builds again. Note that the extra scripts are no longer installed by default as they seem somewhat stale and likely further work is required to have any of them work. A PACKAGECONFIG option, "ext-scripts" has been added to enable installing them if they are required for some reason. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* crowdsec: Upgrade to v1.7.7Scott Murray2026-04-274-40/+791
| | | | | | | | The crowdsec recipes has seemingly been broken since soon after its addition, rewrite it to build the latest version with the go-mod bbclass. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: update 7.0.13 -> 8.0.4Clayton Casciato2026-04-274-691/+2681
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 8.0.0 [1]: Increased Rust use (including libhtp, suricatactl, and suricatasc) More protocols Lua sandboxed and available by default 8.0.4 [2]: security, performance, accuracy, and stability fixes Resolve startup warning [3]: W: af-packet: eth0: AF_PACKET tpacket-v3 is recommended for non-inline operation Add "ja4" option for fingerprinting TLS and QUIC clients [4] CFLAGS modification for (see [5]): do_package_qa: QA Issue: File /usr/bin/.debug/suricata in package suricata-dbg contains reference to TMPDIR [buildpaths] SURICATA_LUA_SYS_HEADER_DST [6] [1] https://suricata.io/2025/07/08/suricata-8-0-0-released/ [2] https://suricata.io/2026/03/17/suricata-8-0-4-and-7-0-15-released/ [3] https://docs.suricata.io/en/suricata-8.0.4/upgrade.html#id1 [4] https://github.com/OISF/suricata/pull/10836 [5] https://git.openembedded.org/openembedded-core/commit/?id=3239961e35434592c06ec2cae2885ab464d35744 [6] https://github.com/OISF/suricata/commit/3a7eef812198118fa0b96059e70074bec5a8cdbe Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> (added musl libunwind fix) Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* krill: fix missing dollar sign in FILESWenlin Kang2026-04-251-1/+1
| | | | | | | {sysconfdir} -> ${sysconfdir} Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* isic: fix RDEPNEDS typoHaiqing Bai2026-04-151-1/+1
| | | | | | | | Fix typo: RDEPNEDS -> RDEPENDS Signed-off-by: Haiqing Bai <haiqing.bai@windriver.com> (fixed RDEPENDS:${PN}) Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* meta-security: fix incorrect HOMEPAGE variable namesZhang Peng2026-04-156-6/+6
| | | | | | | | | | | | | | | | | Several recipes used non-standard variable names for the homepage URL (HOME_PAGE, HOME_URL, HOMEDIR) which are not recognized by bitbake. Rename them all to the correct HOMEPAGE variable. Affected recipes: - glome: HOME_PAGE -> HOMEPAGE - google-authenticator-libpam: HOME_PAGE -> HOMEPAGE - arpwatch: HOME_PAGE -> HOMEPAGE - openscap: HOME_URL -> HOMEPAGE - scap-security-guide: HOME_URL -> HOMEPAGE - lynis: HOMEDIR -> HOMEPAGE Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* tpm2-pkcs11: fix build failurePeter Marko2026-04-152-0/+29
| | | | | | | | | | | Use patch submitted upstream to fix build error: | src/lib/tpm.c: In function ‘tpm_unseal’: | src/lib/tpm.c:1040:16: error: incompatible types when returning type ‘_Bool’ but ‘twist’ {aka ‘const char *’} was expected | 1040 | return false; | | ^~~~~ Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* wic: wic need to be moved to files/wic within the layer to be found/usedKhem Raj2026-04-153-0/+0
| | | | | Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* openscap: upgrade 1.4.2 -> 1.4.3Yi Zhao2026-04-151-1/+1
| | | | | | | | ChangeLog: https://github.com/OpenSCAP/openscap/releases/tag/1.4.3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* scap-security-guide: upgrade 0.1.78 -> 0.1.80Yi Zhao2026-04-151-1/+1
| | | | | | | | ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.80 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* libtpms: fix build with glibc 2.43Peter Marko2026-04-142-1/+37
| | | | | | | Backport patch stable-0.10 branch (not tagged yet). Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* layer.conf: Update to wrynose (6.0) releaseMarta Rybczynska2026-03-225-5/+5
| | | | | | | | Update LAYERSERIES_COMPAT in all layer.conf files with the exception of meta-parsec to wrynose. For meta-parsec, added wrynose to the list of supported versions. Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
* A couple of small CI fixesScott Murray2026-03-072-2/+2
| | | | | | | | | Change the "poky" layer configuration name to "meta-yocto" in the KAS configuration so the cloned repo name is less confusing in logs, and fix a spot where "poky" -> "openembedded-core" had been missed in the gitlab configuration. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* nikto: fix branchScott Murray2026-03-071-1/+1
| | | | | | | Upstream has renamed their master branch to main, adjust SRC_URI to match. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* fscryptctl: Correct the spelling of DESCRIPTIONPeter Kjellerstedt2026-03-041-1/+1
| | | | | Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* fscryptctl: Use ${prefix} rather than /usrPeter Kjellerstedt2026-03-041-1/+1
| | | | | Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* fscrypt: Correct the spelling of DESCRIPTIONPeter Kjellerstedt2026-03-041-1/+1
| | | | | Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* python3-tpm2-pytss: BBCLASSEXTEND native and nativesdkPeter Marko2026-03-041-0/+2
| | | | | | | | | | | | | Commit cd729862f68152bc76db02cd4a93ca12a9424f88 added native/nativesdk possibility to tpm2-pkcs11. After 784ca4b6584101e971b2d5d76ec7b716ad1301b5 which added rdepends on python3-tpm2-pytss, there are errors like: Missing or unbuildable dependency chain was: ['<image>', 'swtpm-native', 'tpm2-pkcs11-tools-native', 'python3-tpm2-pytss-native'] Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: improve PACKAGECONFIG[unittests] controlClayton Casciato2026-03-041-1/+1
| | | | | | | | | | Allow downstream users to explicitly select desired PACKAGECONFIG options (e.g. via "="). Users are currently forced to use ":remove" (with "ptest"). Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* dm-verity-img.bbclass: filter units from value partStephan Wurm2026-01-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | This is necessary for cryptsetup starting from v2.8.0 which introduced "[units]" in its output breaking the parsing of veritysetup output. VERITY header information for image-poky-20250701085433.squashfs-zst.verity. UUID: 5dc16c55-79b8-4988-9d79-900f8e143f98 Hash type: 1 Data blocks: 40091 Data block size: 4096 [bytes] Hash blocks: 318 Hash block size: 4096 [bytes] Hash algorithm: sha256 Salt: f670bf67a32f4f5a22e052d7bf84830f8d35ea24e2d52f585f6275207899153b Root hash: a7eab55b7933e347650671611e4b2a10571f2a28a1fb0fc8eae409f7a0d86693 This extends the value filter to remove the "[units]" from the .env file, while retaining compatibility to older cryptsetup releases. Signed-off-by: Stephan Wurm <stephan.wurm@a-eberle.de> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: add PACKAGECONFIG[seccomp] - MemoryDenyWriteExecuteClayton Casciato2026-01-162-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add option to prevent memory mappings that are both writable and executable. https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#MemoryDenyWriteExecute= Core Suricata developer: https://github.com/jasonish/suricata-rpms/blob/a606a810325dd0a4f3ee45b2756b96bda28e590b/7.0/suricata-4.1.1-service.patch#L23 Fedora: https://src.fedoraproject.org/rpms/suricata/c/cfb3b996f54d28018cd01f9c6b9ecb77e59f344d Resolve SELinux AVC denial: type=PROCTITLE proctitle=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 type=SYSCALL arch=aarch64 syscall=mprotect success=no exit=EACCES(Permission denied) a0=0x7fffa7d04000 a1=0x4000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=0x21 items=0 ppid=1 pid=283 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=Suricata-Main exe=/usr/bin/suricata subj=system_u:system_r:initrc_t:s0 key=(null) type=AVC avc: denied { execmem } for pid=283 comm=Suricata-Main scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* lynis: upgrade to 3.1.6Scott Murray2026-01-161-1/+1
| | | | | | | Release notes: https://github.com/CISOfy/lynis/releases/tag/3.1.6 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Update kas configurationScott Murray2026-01-074-12/+12
| | | | | | | | | Changes to catch up with current kas and future-proof a bit: * Update the kas configuration file versions to 19 to match kas 4.8.x. * Change refspec to branch to remove deprecation warnings. * Add quoting around URLs to match upstream examples. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* meta-parsec: Remove meta-clang dependencyScott Murray2026-01-073-9/+3
| | | | | | | | Since clang is in openembedded-core now, meta-parsec no longer needs meta-clang. Also updated maintainers in meta-parsec README.md since it had previously been missed. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: update PACKAGECONFIG[jansson] option to requiredClayton Casciato2025-12-311-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | jansson is required as of Suricata 5.0: https://github.com/OISF/suricata/commit/e49c40428e1b9f7e5dcdb5857c3978d5cb859fd9 This is still required in the latest release: https://github.com/OISF/suricata/blob/suricata-8.0.2/configure.ac#L828 On exclusion attempt: [...] | checking for jansson.h... no | checking for json_dump_callback in -ljansson... no | | ERROR: Jansson is now required. | | Go get it from your distribution or from: | http://www.digip.org/jansson/ | | Ubuntu/Debian: apt install libjansson-dev | CentOS: yum install jansson-devel | Fedora: dnf install jansson-devel | | NOTE: The following config.log files may provide further information. | NOTE: [...]/poky-whinlatter/build/tmp/work/cortexa57-poky-linux/suricata/7.0.13/sources/suricata-7.0.13/config.log | ERROR: configure failed | WARNING: exit code 1 from a shell command. ERROR: Task ([...]/poky-whinlatter/layers/meta-security/recipes-ids/suricata/suricata_7.0.13.bb:do_configure) failed with exit code '1' Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: drop trailing whitespaceClayton Casciato2025-12-311-6/+6
| | | | | Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: drop deprecated nss, nspr PACKAGECONFIGsClayton Casciato2025-12-221-3/+1
| | | | | | | | | | | | | Default add in 3f95047ae1e1d ("suricata: package update to 2.0.8") https://docs.suricata.io/en/suricata-8.0.1/upgrade.html#id7 As of 7.0, "NSS is no longer required. File hashing and JA3 can now be used without the NSS compile time dependency." Removed in 8.0: https://github.com/OISF/suricata/blob/suricata-8.0.1/ChangeLog#L647 Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-14 06:21:52 +0000