linux/poky.git, branch yocto-5.0.10

build-appliance-image: Update to scarthgap head revision

2025-06-02T14:22:19+00:00

(From OE-Core rev: d5342ffc570d47a723b18297d75bd2f63c2088db) Signed-off-by: Steve Sakoman

poky.conf: bump version for 5.0.10

2025-06-02T14:19:04+00:00

(From meta-yocto rev: 70e3095506c9d8f37dc8963158d4c7d146852dea) Signed-off-by: Steve Sakoman

u-boot: ensure keys are generated before assembling U-Boot FIT image

2025-06-02T14:12:34+00:00

Add the task dependency: do_uboot_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys to ensure the kernel FIT image signing keys are available when creating the U-Boot DTB. This is done only if the signing of the kernel FIT image is enabled (UBOOT_SIGN_ENABLE="1"). The lack of the dependency causes build errors when executing a build with no kernel FIT keys initially present in the keys directory. In such cases one would see an output like this in the Bitbake logs: Log data follows: | DEBUG: Executing shell function do_uboot_assemble_fitimage | Couldn't open RSA private key: '/workdir/build/keys/fit/dev.key': No such file or directory | Failed to sign 'signature' signature node in 'conf-1' conf node | FIT description: Kernel Image image with one or more FDT blobs | ... This issue was introduced by commit 259bfa86f384 where the dependency between U-Boot and the kernel was removed (for good reasons). Before that commit the dependency was set via DEPENDS so that, in terms of tasks, one had: u-boot:do_configure -> virtual/kernel:do_populate_sysroot and the chain leading to the key generation was: virtual/kernel:do_populate_sysroot -> virtual/kernel:do_install virtual/kernel:do_install -> virtual/kernel:do_assemble_fitimage virtual/kernel:do_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys With the removal of the first dependency, no more guarantees exist that the keys would be present when assembling the U-Boot FIT image. That's the situation we are solving with the present commit. (From OE-Core rev: 036f20156b3c7d0a8b912e90aa29a9b986106d5a) Fixes: d7bd9c627661 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled") (From OE-Core rev: 56431a98ac661eaa42803e83a9ede6eae0b72b67) Signed-off-by: Rogerio Guerra Borin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

util-linux: Add fix to isolate test fstab entries using CUSTOM_FSTAB

2025-06-02T14:12:34+00:00

During ptest execution, util-linux adds mount entries in /etc/fstab and runs `mount -a`, which mounts all available entries from /etc/fstab. This can cause unintended mounts that are unrelated to the test, leading to incorrect test behavior. To avoid this, upstream util-linux introduced a mechanism using CUSTOM_FSTAB,which isolates test-specific fstab entries. Only entries listed in CUSTOM_FSTAB are mounted during test execution, ensuring tests do not interfere with or depend on the system's /etc/fstab. This commit backports below upstream changes to use CUSTOM_FSTAB. https://github.com/util-linux/util-linux/commit/ed3d33faff17fb702a3acfca2f9f24e69f4920de https://github.com/util-linux/util-linux/commit/b1580bd760519a2cf052f023057846e54de47484 https://github.com/util-linux/util-linux/commit/6aa8d17b6b53b86a46c5da68c02a893113130496 (From OE-Core rev: e7420db0d77611140149ccfefefc8becfad4f34b) Signed-off-by: Virendra Thakur Signed-off-by: Steve Sakoman

ffmpeg: upgrade 6.1.1 -> 6.1.2

2025-06-02T14:12:34+00:00

ffmpeg_6.1.2 is the newest available stable release for 6.1. It introduces quite a few bug and CVE fixes, which should help all. CVEs that are fixed in the upgrade: CVE-2024-32230 CVE-2024-35366 CVE-2024-36613 CVE-2024-36616 CVE-2024-36617 CVE-2024-36619 CVE-2024-7055 During upgrade it was noticed that the CVE scan doesn't pick up the CVEs as unpatched (CVE-2025-0518, CVE-2025-22919, CVE-2025-22921, CVE-2025-25473, CVE-2024-36618, CVE-2024-35369, CVE-2024-35368, CVE-2024-35367, CVE-2024-35365, CVE-2024-28661, CVE-2023-50007, CVE-2023-49528, CVE-2023-49501), due to improper versioning in NVD, they are affecting 6.1.2 and hence we are leaving the patches in. check the changelog mention below for information about fixes. changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n6.1.2 This upgrade fixes CVE's hence remove those patches. Refresh vulkan_av1_stable_API.patch as per new codebase. (From OE-Core rev: 57e25585abf34677451c68d581374245e5b4b418) Signed-off-by: Divyanshu Rathore Signed-off-by: Steve Sakoman

binutils: set CVE_STATUS for CVE-2025-1180

2025-06-02T14:12:34+00:00

CVE-2025-1180 is fixed with patch from CVE-2025-1176. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2025-1179 (From OE-Core rev: 9c63f1c73426532a94f01fbbe26c9f52a3c4fdf7) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman

libsoup: patch CVE-2025-4476

2025-06-02T14:12:34+00:00

Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c] (From OE-Core rev: 91231813d04680f93a08cb29540073bb4749e22f) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

ruby: fix CVE-2025-27221

2025-06-02T14:12:34+00:00

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27221 Upstream-patches: https://github.com/ruby/uri/commit/3675494839112b64d5f082a9068237b277ed1495 https://github.com/ruby/uri/commit/2789182478f42ccbb62197f952eb730e4f02bfc5 (From OE-Core rev: 421d7011269f4750f5942b815d68f77fa4559d69) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-1179

2025-06-02T14:12:34+00:00

CVE-2025-1179-pre.patch is dependency patch for CVE-2025-1179.patch Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141322.html && https://sourceware.org/pipermail/binutils/2025-May/141321.html] CVE: CVE-2025-1179 cherry picked from upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=67e30b15212adc1502b898a1ca224fdf65dc110d https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1d68a49ac5d71b648304f69af978fce0f4413800 (From OE-Core rev: 8f54548f784ef60eaf7fb6b3f539d48b0f7192a3) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman

libsoup-2.4: Fix CVE-2025-32914

2025-06-02T14:12:34+00:00

import patch from debian to fix CVE-2025-32914 Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads Upstream commit https://gitlab.gnome.org/GNOME/libsoup/-/commit/5bfcf8157597f2d327050114fb37ff600004dbcf] Reference: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450 https://security-tracker.debian.org/tracker/CVE-2025-32914 (From OE-Core rev: 8eba970123aca651cbce13e52d43ddaddd76a7cc) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman