linux/poky.git/meta/recipes-devtools/git, branch yocto-5.0.14

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-22T20:17:52+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman

git: fix build with gcc-15 on host

2025-09-01T15:30:56+00:00

(From OE-Core rev: a534cf958f9c7d05af795def43ee5ba09fb34ca2) Signed-off-by: Martin Jansa Signed-off-by: Steve Sakoman

git: Upgrade 2.44.3 -> 2.44.4

2025-07-21T16:07:22+00:00

Addresses the security issues - CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. Release Notes: https://github.com/git/git/blob/v2.44.4/Documentation/RelNotes/2.44.4.txt (From OE-Core rev: 3a9fdcb2ea0dd2744f59a62f2722bfa276302324) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

buildtools-tarball: Make buildtools respects host CA certificates

2025-05-02T15:20:12+00:00

To adapt user network enviroment, buildtools should first try to use the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these envs is not set, then use the auto-detected ca file and ca path, and finally use the CA certificates in buildtools. nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work nativesdk-curl don't set default ca file, need SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO also works nativesdk-python3-requests will use cacert.pem under python module certifi by default, need to set REQUESTS_CA_BUNDLE (From OE-Core rev: 0653b96bac6d0800dc5154557706a323418808be) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: add envvars into BB_ENV_PASSTHROUGH_ADDITIONS

2025-05-02T15:20:12+00:00

Here is one testcase: For recipe tensorflow-lite-host-tools_2.18.0.bb, refer [1], do_configure[network] = "1" and it will git clone some repos in CMakeLists.txt When buildtools is used and nativesdk-git is installed into sdk, do_configure failed with error: [1/9] Performing download step (git clone) for 'protobuf-populate' Cloning into 'protobuf'... fatal: unable to access 'https://github.com/protocolbuffers/protobuf/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-wrlinuxsdk-linux/etc/ssl/certs/ca-certificates.crt Fix by adding GIT_SSL_CAINFO in BB_ENV_PASSTHROUGH_ADDITIONS, so that user can export GIT_SSL_CAINFO=${GIT_SSL_CAINFO} in their do_configure:prepend() to fix above do_configure failure CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE is similar envvars, so all add into BB_ENV_PASSTHROUGH_ADDITIONS [1] https://github.com/nxp-imx/meta-imx/blob/styhead-6.12.3-1.0.0/meta-imx-ml/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2.18.0.bb (From OE-Core rev: 27f018d8e8ace97d0b1cdfb8782a2a7a0a319816) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: move setting of envvars to respective envfile

2025-05-02T15:20:12+00:00

* make git,curl,python3-requests align with openssl, move the setting of envvars into respective envfile * for environment.d-openssl.sh, also check if ca-certificates.crt exist before export envvars (From OE-Core rev: 5f4fd544d3df7365224599c9efdce4e545f51d5e) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

git: Upgrade 2.44.1 -> 2.44.3

2025-05-02T15:20:11+00:00

Addresses the security issues - CVE-2024-50349 and CVE-2024-52006 Release Notes: https://github.com/git/git/blob/v2.44.3/Documentation/RelNotes/2.44.3.txt (From OE-Core rev: f4f7a3af706bd6923362633a56423526a5264c6c) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

git: upgrade 2.44.0 -> 2.44.1

2024-06-14T12:19:22+00:00

Addresses the security issues - CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,CVE-2024-32021 and CVE-2024-32465 Changelog: ========== https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.44.1.txt (From OE-Core rev: 3a7ef46ebaf8d4b470ef5b6803dc3b76c22a97c2) Signed-off-by: Soumya Sambu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 767f9515013790c9a6b945fae9de03c9e5b89b80) Signed-off-by: Steve Sakoman

git: set --with-gitconfig=/etc/gitconfig for -native builds

2024-06-05T12:57:12+00:00

Commit 6c2ae2346db0 (kern-tools: depend on git-replacement-native) broke our kernel builds. For saving space and time, we have a DL_DIR shared between multiple users/buildbots, not all of which run with the same uid (and with appropriate sticky bits set so that files downloaded by one user become owned by a common group and are readable by others). This works fine also for git sources because the docker images we use all have a /etc/gitconfig with [safe] directory = * But with the mentioned commit, the host's git is no longer used for do_unpack (nor for do_fetch if re-building and sysroot has already been populated by a previous build), causing spurious "fatal: detected dubious ownership..." failures. Currently, the path where the git-native binary searches for system gitconfig is the sysroot from it was built, which obviously doesn't contain a /etc/gitconfig. As for the nativesdk variant, respect the host's /etc/gitconfig if present. (From OE-Core rev: a3f5ac9f9fee2c8e10fec7c3f758e49513fef724) Signed-off-by: Rasmus Villemoes Signed-off-by: Richard Purdie (cherry picked from commit 572f511f7ff02fb559ac42d2d5dbd09fec478d97) Signed-off-by: Steve Sakoman

git: git-replacement-native: depend on ca-certificate

2024-03-18T12:21:45+00:00

git is delegating webacces for URLs using TLS to libcurl. However our native libcurl build does not find a ca-certificate.crt unless its curl-native work dir still exists and thus git will fail. If a recipe uses AUTOREV with a git repo using https as its protocol parsing of that recipe will fail fetching the latest HEAD. Fix that by depending on ca-certificate and give its location to libcurl via git's envrironment variable GIT_SSL_CAINFO. (From OE-Core rev: 2e99ffda70fd95b5eab3de47048032349cd66f4b) Signed-off-by: Max Krummenacher Signed-off-by: Richard Purdie