linux/poky.git/meta/recipes-core/zlib, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

recipes: cleanup CVE_STATUS which are resolved now

2025-08-28T09:47:08+00:00

The don't show up in CVE metrics anymore since they were either fixed upstream or recipe version was upgraded meanwhile. * bind CVE-2019-6470: cpe got corrected in nvd db * libxml2 CVE-2023-45322: version is now higher than NVD cpe * zlib CVE-2023-45853: version is now higher than NVD cpe * gcc CVE-2021-37322: version is now higher than NVD cpe * python3 * CVE-2007-4559: version is now higher than NVD cpe * CVE-2019-18348: version is now higher than NVD cpe * CVE-2020-15523: version is now higher than NVD cpe * CVE-2022-26488: version is now higher than NVD cpe * CVE-2015-20107: version is now higher than NVD cpe * CVE-2023-36632: version is now higher than NVD cpe * rust * CVE-2024-24576: NVD has no cpe, but we have newer version as fix * CVE-2024-43402: version is now higher than NVD cpe * cups CVE-2021-25317: version is now higher than NVD cpe * ghostscript CVE-2023-38559: version is now higher than NVD cpe * libtirpc CVE-2021-46828: version is now higher than NVD cpe * unzip CVE-2008-0888: version is now higher than NVD cpe * ffmpeg CVE-2023-39018: cpe got corrected in nvd db * libxslt CVE-2022-29824: version is now higher than NVD cpe * libyaml * CVE-2024-35325: CVE is now rejected in NVD DB * CVE-2024-35326: CVE is now rejected in NVD DB * CVE-2024-35328: CVE is now rejected in NVD DB Also add comment for iputils regarding reports for FKIE/NVD2. Also remove some trailing spaces in python recipe. (From OE-Core rev: 73ee9789183aa95072af2b51ac9e08203f4e33f9) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

zlib: Always use GNU ld for linking

2025-08-14T09:31:10+00:00

Linking does not yet work with LLD Fixes aarch64-yoesdk-linux-ld.lld: error: undefined symbol: gzopen >>> referenced by minigzip.c >>> minigzip.o:(main) (From OE-Core rev: be5856616aee1d2134e6aedefc5fe664ad5e2a7d) Signed-off-by: Khem Raj Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

zlib: Enable PIE for native builds

2024-08-29T20:58:19+00:00

The zlib crate in rust uses libz.a which comes from the zlib-native build. Some distros like alma9, fedora etc. do not have PIE enabled by default for system compiler. This leads to target-rust-ccld linking error for cargo-native as (line no 22936): error: linking with `/home/pokybuild/yocto-worker/qemuarm64/build/build/tmp/work/x86_64-linux/cargo-native/1.79.0/wrapper/target-rust-ccld` failed: exit status: 1 https://autobuilder.yoctoproject.org/typhoon/#/builders/42/builds/9385/steps/13/logs/stdio Hence, enable PIE option to CFLAGS for native builds. (From OE-Core rev: 7146d260f655fa924461333c8c2944ebb93b2b3c) Signed-off-by: Yash Shinde Signed-off-by: Richard Purdie

zlib: Add CVE_PRODUCT to exclude false positives

2024-08-09T21:33:38+00:00

To avoid false positives (such as CVE-2023-6992, cloudflare:zlib), add a CVE_PRODUCT to identify the vendors that have been used. Removing the present existing CVE_STATUS for CVE-2023-6992. (From OE-Core rev: 119b775b36dfd51286493763cffb6e965893b8fd) Signed-off-by: Het Patel Signed-off-by: Richard Purdie

siteconfig: Drop siteconfig class/code/support

2024-05-31T15:58:36+00:00

The siteconfig code was only used for 5 cache values. The complexity added to sstate to support this code was considerable and the runtime much more significant than any benefit the cache files would have added. Drop the support for this which was only used minimally for ncurses and zlib. (From OE-Core rev: f3766dc038f7ba9780ddaf5eb8d27385ea31d7d0) Signed-off-by: Richard Purdie

zlib: upgrade 1.3 -> 1.3.1

2024-02-16T15:14:26+00:00

Refresh local patch. Changelog: https://github.com/madler/zlib/releases/tag/v1.3.1 (From OE-Core rev: 186475e244d9622817b5a50e83cbfe1e4ed78e34) Signed-off-by: Denys Dmytriyenko Signed-off-by: Richard Purdie

zlib: ignore CVE-2023-6992

2024-01-23T11:53:41+00:00

This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: 9f953a1cd832f03f0b3666168addf45fd4fc8d14) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

zlib: ignore CVE-2023-45853

2023-10-26T14:29:34+00:00

This CVE relates to a bug in the minizip tool, but we don't build that. (From OE-Core rev: a32f285501b459cfe18e3135a3c531b63f58034c) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

zlib: upgrade 1.2.13 -> 1.3

2023-09-02T17:23:06+00:00

Changelog: ============ - Remove K&R function definitions and zlib2ansi - Fix bug in deflateBound() for level 0 and memLevel 9 - Fix bug when gzungetc() is used immediately after gzopen() - Fix bug when using gzflush() with a very small buffer - Fix crash when gzsetparams() attempted for transparent write - Fix test/example.c to work with FORCE_STORED - Rewrite of zran in examples (see zran.c version history) - Fix minizip to allow it to open an empty zip file - Fix reading disk number start on zip64 files in minizip - Fix logic error in minizip argument processing - Add minizip testing to Makefile - Read multiple bytes instead of byte-by-byte in minizip unzip.c - Add memory sanitizer to configure (--memory) - Various portability improvements - Various documentation improvements - Various spelling and typo corrections (From OE-Core rev: 369780c635cb99a3d93c38dc4e3944eba5a2c2cd) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie