linux/poky.git/meta/recipes-bsp/grub, branch gatesgarth

grub: Further reproducibility fix

2021-01-12T14:25:13+00:00

Fix the ordering in the generated unidata.c file to aid reproducibility. [YOCTO #14167] (From OE-Core rev: c0f96eadf9a85c911ba551d619c32794bb620dde) Signed-off-by: Richard Purdie (cherry picked from commit 6d9c9f7604fd32ef926726a46ae053bbab6ccb4f) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

grub: fix "CVE:" line in one of the patches

2021-01-12T14:25:13+00:00

The "CVE:" line in the patch for CVEs 2020-14309, CVE-2020-14310, and CVE-2020-14311 had commas between the CVE numbers, which resulted in CVE-2020-14310 not being picked up as patched by cve-check.bbclass's parsing. Remove the commas to match cve-check.bbclass's expectations. (From OE-Core rev: f8aa7314f98748ecb7a9abc6702e795ae50b97a6) Signed-off-by: Scott Murray Signed-off-by: Richard Purdie (cherry picked from commit 396d5c0f9cffa4b54ae94738b1ef2b6fb545f082) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

grub: Add second fix for determinism issue

2021-01-04T11:45:46+00:00

There is a second list sorting problem in a generator script within grub, add a sort() of a list to resolve this. (From OE-Core rev: 5d758a1568e5bd03fc55885d1a26de34aee7ebbd) Signed-off-by: Richard Purdie (cherry picked from commit cb5e96e05930eaff4d679166416d6c84d6e3236b) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

grub: Fix build reproducibility issue

2021-01-04T11:45:46+00:00

We're seeing reproducibility issue on the autobuilder due to changing module dependency ordering. Add some sorting to an awk script to fix this. (From OE-Core rev: c494d69efbc9035d6d9ff8dae8a606aeaf378adc) Signed-off-by: Richard Purdie (cherry picked from commit 925ddd5edccbfec52ff45c1b54ab2ae1bfe0d57c) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

grub: clean up CVE patches

2020-11-12T13:06:28+00:00

Clean up several patches introduced in commit 6732918498 ("grub:fix several CVEs in grub 2.04"). 1) Add CVE tags to individual patches. 2) Rename upstream patches and prefix them with CVE tags. 3) Add description of reference to upstream patch. (From OE-Core rev: a1db1e71129c3e67ddd9dbef21e1c5eb31552e00) Signed-off-by: Yongxin Liu Signed-off-by: Richard Purdie (cherry picked from commit bcb8b6719beaf6625e6b703e91958fe8afba5819) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

grub: fix several CVEs in grub 2.04

2020-10-30T13:04:39+00:00

Backport patches from https://git.savannah.gnu.org/git/grub.git to fix some CVEs. Here is the list. CVE-2020-14308: 0001-calloc-Make-sure-we-always-have-an-overflow-checking.patch 0002-lvm-Add-LVM-cache-logical-volume-handling.patch 0003-calloc-Use-calloc-at-most-places.patch CVE-2020-14309, CVE-2020-14310, CVE-2020-14311: 0004-safemath-Add-some-arithmetic-primitives-that-check-f.patch 0005-malloc-Use-overflow-checking-primitives-where-we-do-.patch CVE-2020-15706: 0006-script-Remove-unused-fields-from-grub_script_functio.patch 0007-script-Avoid-a-use-after-free-when-redefining-a-func.patch CVE-2020-15707: 0008-linux-Fix-integer-overflows-in-initrd-size-handling.patch (From OE-Core rev: 67329184985a03534f11f95e9df5f9fb2305a261) Signed-off-by: Yongxin Liu Signed-off-by: Richard Purdie

grub2: fix CVE-2020-10713

2020-10-20T10:11:46+00:00

(From OE-Core rev: ec6a2258ca27d5709df4fe18d94841332395bcb2) Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie

grub: set CVE_PRODUCT to grub2

2020-08-08T08:17:48+00:00

grub and grub-efi recipes' CVE_PRODUCT should be grub2. (From OE-Core rev: 8682f6bc7e3e8d5fcf682647526f1a8430d08768) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie

grub: Remove native version of grub-efi

2020-06-23T11:31:03+00:00

The native version of grub-efi only installs the tools /usr/bin/grub-editenv /usr/bin/grub-mkimage to sysroots-components/, but equivalent tools are already provided by grub-native, the difference on x86_64 being 4 hardwired paths in grub-mkimage (values taken from grub-native): LOCALEDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share/locale GRUB_DATADIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share GRUB_LIBDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/lib GRUB_SYSCONFDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/etc If grub-native and grub-efi-native are built with the following patch --- grub-2.04.orig/configure.ac +++ grub-2.04/configure.ac @@ -1980,10 +1980,10 @@ grub_libdir="$(eval echo "$libdir")" grub_localedir="$(eval echo "$localedir")" grub_datadir="$(eval echo "$datadir")" grub_sysconfdir="$(eval echo "$sysconfdir")" -AC_DEFINE_UNQUOTED(LOCALEDIR, "$grub_localedir", [Locale dir]) -AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "$grub_libdir", [Library dir]) -AC_DEFINE_UNQUOTED(GRUB_DATADIR, "$grub_datadir", [Data dir]) -AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "$grub_sysconfdir", [Configuration dir]) +AC_DEFINE_UNQUOTED(LOCALEDIR, "/non-existent", [Locale dir]) +AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "/non-existent", [Library dir]) +AC_DEFINE_UNQUOTED(GRUB_DATADIR, "/non-existent", [Data dir]) +AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "/non-existent", [Configuration dir]) the produced grub-editenv/grub-mkimage binaries become binary equivalent, assuming reproducible builds is active. Since the unpatched values of LOCALEDIR/GRUB_DATADIR/GRUB_LIBDIR/GRUB_SYSCONFDIR point to directories that are not expected to exist at runtime, they can be ignored. Therefore: * remove grub-efi-native and instead rely on the same tools from grub-native * replace references to grub-efi-native with grub-native * remove unused grub-efi-native security flags overrides (From OE-Core rev: 7044181df7487f047d175242f7ebbc3c35bf5402) Signed-off-by: Jacob Kroon Signed-off-by: Richard Purdie

grub: don't autoreconf twice

2019-11-25T17:57:23+00:00

do_configure() essentially calls autogen.sh to generate some sources and then autoreconf, but autogen.sh also calls autoreconf. Pass a magic variable so that autogen.sh doesn't autoreconf for us. (From OE-Core rev: 19e18446c09fef14c3dd54b0de12a8d21b280c93) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie