linux/poky.git, branch dunfell-23.0.11

build-appliance-image: Update to dunfell head revision

2021-09-15T17:34:21+00:00

(From OE-Core rev: c7d2281eb6cda9c1637c20b3540b142073bca235) Signed-off-by: Richard Purdie

poky: Use SDKPATHINSTALL instead of SDKPATH

2021-09-15T17:34:13+00:00

SDKPATHINSTALL is the default installation path used for the SDK but is not the path encoded into every SDK binary as the default path. This change allows it to contain things like dates without requiring every nativesdk recipe to rebuild. Partially fixes [YOCTO #14100] (From meta-yocto rev: 7eac76587428202db781f269439ad9d719017289) Signed-off-by: Richard Purdie (cherry picked from commit a62175ee581bd05661717f0fb89dad2a297b4034) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

build-appliance-image: Update to dunfell head revision

2021-09-15T09:42:30+00:00

(From OE-Core rev: 49ca1f62cc17c951b7737a4ee3c236f732bc8ebe) Signed-off-by: Richard Purdie

go: Several Security fixes

2021-09-14T16:27:42+00:00

Source: golang.org MR: 111958, 112390, 112393 Type: Security Fix Disposition: Backport from https://github.com/golang/go.git ChangeID: 662d021814f025b3d768a04864498486f94819a7 Description: Affects < 1.16.5 Fixes: CVE-2021-33196 CVE-2021-33197 CVE-2021-34558 (From OE-Core rev: 1eaac89b0384cc39ea489a3b7ea58eab6b23240b) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

xserver-xorg: Security fix for CVE-2020-14360/-25712

2021-09-14T16:27:42+00:00

Source: https://gitlab.freedesktop.org/xorg/xserver MR: 108223, Type: Security Fix Disposition: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b and https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9 ChangeID: 496c2a2d80e4f8fff9b0d3148fca70c090cec31e Description: affects < 1.20.10 Fixes CVE-2020-14360 and CVE-2020-25712 (From OE-Core rev: ee4a4f9053909f820de48a48750bda92170aaf86) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: Exclude CVE-2021-29923 from report list

2021-09-14T16:27:42+00:00

Upstream don't believe it is a signifiant real world issue and will only fix in 1.17 onwards. Therefore exclude it from our reports. https://github.com/golang/go/issues/30999#issuecomment-910470358 (From OE-Core rev: 9dfc6abbb83f8792fbfa1acb9c0fe4ab23872d8f) Signed-off-by: Richard Purdie (cherry picked from commit 5bd5faf0c34b47b2443975d66b71482d2380a01a) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

flex: Add CVE-2019-6293 to exclusions for checks

2021-09-14T16:27:42+00:00

CVE is effectively disputed - yes there is stack exhaustion but no bug and it is building the parser, not running it, effectively similar to a compiler ICE. Upstream no plans to address and there is no security issue. https://github.com/westes/flex/issues/414 (From OE-Core rev: b939b005b06be58a276d565f755ee2d8f3e5dfc1) Signed-off-by: Richard Purdie (cherry picked from commit 0cae5d7a24bedf6784781b62cbb3795a44bab4d1) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dbus: upgrade 1.12.18 -> 1.12.20

2021-09-14T16:27:42+00:00

Source: https://git.openembedded.org/openembedded-core MR: 108825 Type: Security Fix Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-core/dbus?id=bfaef91e77cd54e4f642e966903aac3f3291c325 ChangeID: bfaef91e77cd54e4f642e966903aac3f3291c325 Description: Bugz only update Includes fix for CVE-2020-35512 ab88811768 (HEAD, tag: dbus-1.12.20) v1.12.20 5757fd5480 Update NEWS f3b2574f0c userdb: Reference-count DBusUserInfo, DBusGroupInfo <- cve fix 37b36d49a6 userdb: Make lookups return a const pointer 732284d530 Solaris and derivatives do not adjust cmsg_len on MSG_CTRUNC 1f8c42c7cd Start 1.12.20 development (From OE-Core rev: bfaef91e77cd54e4f642e966903aac3f3291c325) (From OE-Core rev: 4cebabf1007762872510c5065a2a718a89687734) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit bfaef91e77cd54e4f642e966903aac3f3291c325) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dbus,dbus-test: Move common parts to dbus.inc

2021-09-14T16:27:42+00:00

dbus and dbus-test share the same source code and base configuration options, so factor out the common parts into dbus.inc. This way we can eliminate the need to keep the two recipes in sync. When they are not properly in sync (e.g. when dbus recipe has extra patches/config options that are not duplicated in dbus-test) ptest testsuite will actually test a slightly different codebase. This is due to the fact that dbus-test does not run the testsuite against the system libdbus library, but instead it generates a local libdbus.so that needs to configured/compiled as close as possible to the system one. (From OE-Core rev: 1cde2935526d2eec7d6b17a6c622647b0c132439) (From OE-Core rev: 6c90e4dd59eb06058d14deeb9aa87717fd88ab09) Signed-off-by: Ovidiu Panait Signed-off-by: Richard Purdie (cherry picked from commit 44ae5d8d6f26fda4ab1a3fef9fc49d74e4ac89f0) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dbus-test: Remove EXTRA_OECONF_X configs

2021-09-14T16:27:42+00:00

X specific configs are already handled through PACKAGECONFIG: PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd x11', d)}" ... PACKAGECONFIG[x11] = "--with-x --enable-x11-autolaunch,--without-x --disable-x11-autolaunch, virtual/libx11 libsm" Remove duplicated EXTRA_OECONF_X args. (From OE-Core rev: 7dc107b05a29f8a3e8903d73f84ef8069f68af6f) (From OE-Core rev: d747c666ed563488af0b894d4e3236335aa2a8bf) Signed-off-by: Ovidiu Panait Signed-off-by: Richard Purdie (cherry picked from commit 036e3436e51a44de3fc9b4b8e5b1ff149e3aaa9d) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie