linux/poky.git, branch yocto-5.0.17

build-appliance-image: Update to scarthgap head revision

2026-04-02T12:49:05+00:00

(From OE-Core rev: 52380df998b3a8fe6a091f8547434a3231320a8e) Signed-off-by: Paul Barker

poky.conf: Bump version for 5.0.17 release

2026-04-02T12:45:40+00:00

(From meta-yocto rev: c7c38663a1cafb1fa8593c0b246811e51d3bbe20) Signed-off-by: Paul Barker

gnutls: Fix CVE-2025-14831

2026-04-02T12:41:55+00:00

Picked commits which mentions this CVE per [1]. [1] https://ubuntu.com/security/CVE-2025-14831 [2] https://security-tracker.debian.org/tracker/CVE-2025-14831 [3] https://gitlab.com/gnutls/gnutls/-/issues/1773 (From OE-Core rev: d0e844108702e553950cab60d51f1cc4cfeed993) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-pyopenssl: Fix CVE-2026-27459

2026-04-02T12:41:55+00:00

Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27459 [2] https://ubuntu.com/security/CVE-2026-27459 (From OE-Core rev: 94c6f16933b9ff4c4a2ea46be1e3fc5f2979a49d) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-pyopenssl: Fix CVE-2026-27448

2026-04-02T12:41:54+00:00

Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27448 [2] https://ubuntu.com/security/CVE-2026-27448 (From OE-Core rev: 6349510d2ae9d8f4ad1c52d7356d2359b7bf4826) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

spdx: add option to include only compiled sources

2026-04-02T12:41:54+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for SPDX3.0 Tested with: - bitbake world on oe-core - oe-selftest --run-tests spdx.SPDX30Check Regarding SPDX2.2, the respective backport was already performed in OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b (From OE-Core rev: 1c7dfab26d69a87bb026e05b3bbf6a266858c0d1) Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-cryptography: Fix CVE-2026-26007

2026-04-02T12:41:54+00:00

CVE-2026-26007 is fixed upstream in version 46.0.5. Our current version (42.0.5, scarthgap) is still reported as vulnerable by NVD. Backport the upstream fix to address this CVE. Upstream commit: https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c CVE report: https://nvd.nist.gov/vuln/detail/CVE-2026-26007 (From OE-Core rev: a363958725430237160b0a83a6a6acbe8380fba3) Signed-off-by: Nguyen Dat Tho Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

tzdata,tzcode-native: Upgrade 2025b -> 2025c

2026-04-02T12:41:54+00:00

This release mostly changes code and commentary. The only changed data are leap second table expiration and pre-1976 time in Baja California. Full release notes: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/ (From OE-Core rev: 7255b0ff315367abb5f0c6f00974bf30f7861d1b) Signed-off-by: Paul Barker Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 452334219309793ad74abd6ff390dcb06cab929b) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

ref-manual/system-requirements.rst: add CentOS Stream 9 to supported distros

2026-03-31T08:08:51+00:00

Add CentOS Stream 9 to the list of supported distros, after it was added to poky.conf with [1]. [1]: https://lore.kernel.org/r/f87e76ef6bd6745038616876af07c6a74b49f8c9.1773966064.git.yoann.congal@smile.fr (From yocto-docs rev: aa7226705451e6c1ef964d49963bbed29b267c27) Signed-off-by: Antonin Godard Signed-off-by: Paul Barker

Revert "scripts/install-buildtools: Update to 5.0.16"

2026-03-26T09:53:17+00:00

This reverts commit 917c382c412766b40779788ee2411ac23358f0ae. I mechanically did the update but should not have: this was already raised here: Re: [OE-core] Wrong version of buildtools files uploaded for 5.0.16. https://lore.kernel.org/all/DH2QPDTPQT3Q.1TJYOVQ7PIU7B@smile.fr/ Trying to fetch the 5.0.16 buildtools installer results in an error: $ ./scripts/install-buildtools INFO: Fetching buildtools installer ERROR: Could not download file from https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.16/buildtools/x86_64-buildtools-extended-nativesdk-standalone-5.0.16.sh See https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.16/RELEASENOTES: > --------------- > Known Issues > --------------- > The poky DISTRO_VERSION was incorrectly left at 5.0.15. This is a minor issue, if a workaround is needed please cherry-pick: > - poky commit 06210079b2e10d6d3fb943afe87864267e329821, or > - meta-yocto commit 03f93c769ec99e5086e492d8145eb308a718e8d3. (From OE-Core rev: 41597b5260fb5ca811d0fb4ae7e65246d61734eb) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker