linux/poky.git/meta/recipes-devtools/git, branch walnascar

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-22T19:21:23+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 3d161e94ad532f660d4a0259a32e26a32ea0c75d) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman

git: upgrade 2.49.0 -> 2.49.1

2025-08-04T16:12:24+00:00

Git v2.49.1 Release Notes ========================= This release merges up the fixes that appear in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, and v2.48.2 to address the following CVEs: CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release notes for v2.43.7 for details. It also contains some updates to various CI bits to work around and/or to adjust to the deprecation of use of Ubuntu 20.04 GitHub Actions CI, updates to to Fedora base image. (From OE-Core rev: e46903948f991eeec49567b585c7c31f3ece742a) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

buildtools-tarball: Make buildtools respects host CA certificates

2025-05-14T15:33:40+00:00

To adapt user network enviroment, buildtools should first try to use the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these envs is not set, then use the auto-detected ca file and ca path, and finally use the CA certificates in buildtools. nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work nativesdk-curl don't set default ca file, need SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO also works nativesdk-python3-requests will use cacert.pem under python module certifi by default, need to set REQUESTS_CA_BUNDLE (From OE-Core rev: 0d5f241eee19c0dff9f9f59949485414935edaa2) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: add envvars into BB_ENV_PASSTHROUGH_ADDITIONS

2025-05-14T15:33:40+00:00

Here is one testcase: For recipe tensorflow-lite-host-tools_2.18.0.bb, refer [1], do_configure[network] = "1" and it will git clone some repos in CMakeLists.txt When buildtools is used and nativesdk-git is installed into sdk, do_configure failed with error: [1/9] Performing download step (git clone) for 'protobuf-populate' Cloning into 'protobuf'... fatal: unable to access 'https://github.com/protocolbuffers/protobuf/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-wrlinuxsdk-linux/etc/ssl/certs/ca-certificates.crt Fix by adding GIT_SSL_CAINFO in BB_ENV_PASSTHROUGH_ADDITIONS, so that user can export GIT_SSL_CAINFO=${GIT_SSL_CAINFO} in their do_configure:prepend() to fix above do_configure failure CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE is similar envvars, so all add into BB_ENV_PASSTHROUGH_ADDITIONS [1] https://github.com/nxp-imx/meta-imx/blob/styhead-6.12.3-1.0.0/meta-imx-ml/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2.18.0.bb (From OE-Core rev: 5fa8cb40395977722d0d5a2271c8044598fb1f01) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: move setting of envvars to respective envfile

2025-05-14T15:33:40+00:00

* make git,curl,python3-requests align with openssl, move the setting of envvars into respective envfile * for environment.d-openssl.sh, also check if ca-certificates.crt exist before export envvars (From OE-Core rev: 5c915fcada5868bdbb8aa3e28c18a26cfc41914f) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

Revert "git: git-replacement-native: depend on ca-certificate"

2025-03-24T17:29:16+00:00

This reverts commit 2e99ffda70fd95b5eab3de47048032349cd66f4b. git-replacement-native is used only to provide a newer version than may be installed on the system; apart from that, it should work more or less the same. In particular, it is using the host system's /etc/gitconfig; it should also use the system CA certificates, otherwise it will break HTTPS connections in environments that need local certificates, for example for a corporate HTTP proxy. The override had been added to deal with curl-native relying on the existence of its workdir to access CA certificates, which has been fixed in the curl recipe now. (From OE-Core rev: d18f4d9d2ac75f58669754f1e4b7a1313eb9db32) Signed-off-by: Matthias Schiffer Signed-off-by: Richard Purdie

git: upgrade 2.48.1 -> 2.49.0

2025-03-17T22:38:32+00:00

(From OE-Core rev: cff5f7c2fabdefc5bc1e9b61bf26a35e2d28ddac) Signed-off-by: Richard Purdie

git: upgrade 2.47.1 -> 2.48.1

2025-02-05T12:49:55+00:00

(From OE-Core rev: 0d6d7d63a5e04eaff3db4d6aa552b2bfb3138c9c) Signed-off-by: Richard Purdie

git: upgrade 2.47.0 -> 2.47.1

2024-12-12T12:52:39+00:00

(From OE-Core rev: 36f98d40ffd27497be43f687ce5ca23353996257) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

git: upgrade 2.46.1 -> 2.47.0

2024-10-11T11:17:02+00:00

0001-config.mak.uname-do-not-force-RHEL-7-specific-build-.patch refreshed for 2.47.0 Changelog: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.47.0.txt (From OE-Core rev: af3f824ec3290fd7a1a135d303438aa568877fab) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie