linux/poky.git/meta/recipes-devtools/rust, branch 5.1_M2

libstd-rs,rust-cross-canadian: set CVE_PRODUCT to rust

2024-07-16T10:56:53+00:00

These recipes come from rust sources and CVEs are reported for them under rust-lang:rust vendor:product touple. Especially libstd-rs needs correct CVE_PRODUCT as is it installed on target devices (being statically linked to rust compiled binaries). before: cargo: CVE_PRODUCT="cargo" cargo-c-native: CVE_PRODUCT="cargo-c" libstd-rs: CVE_PRODUCT="libstd-rs" rust: CVE_PRODUCT="rust" rust-cross-canadian: CVE_PRODUCT="rust-cross-canadian-" rust-llvm: CVE_PRODUCT="rust-llvm" after: cargo: CVE_PRODUCT="cargo" cargo-c-native: CVE_PRODUCT="cargo-c" libstd-rs: CVE_PRODUCT="rust" rust: CVE_PRODUCT="rust" rust-cross-canadian-x86-64: CVE_PRODUCT="rust" rust-llvm: CVE_PRODUCT="rust-llvm" Product for rust-llvm is uncertain and, should be handled in another commit if it is desired to align it, too. sqlite> select vendor, product, count(product) from products where vendor="rust-lang" group by product; rust-lang|async-h1|2 rust-lang|cargo|5 rust-lang|future-utils|2 rust-lang|futures-task|2 rust-lang|mdbook|1 rust-lang|regex|2 rust-lang|rsa|2 rust-lang|rust|45 rust-lang|socket2|1 (From OE-Core rev: e8cf1df16a6ec2785cacaf608bec5cd8496103af) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

native/nativesdk: Stop overriding unprefixed *FLAGS variables

2024-07-01T12:58:08+00:00

We're currently encouraging an "arms race" with the FLAGS variables since a recipe might want to set a specific flag for all variants but to do so, += won't work due to the assignment in the native/nativesdk class files. This means recipes are using append. Since the default variables are constructed out of TARGET_XXX variables and we redefine these, there is no need to re-define the un-prefixed variables. If we drop that, the += appends and similar work and recipes don't have to resort to append. Change the classes and cleanup a number of recipes to adapt to the change. This change will result in some flags appearing to some native/nativesdk variants but that is probably what was originally expected anyway. (From OE-Core rev: a157b2f9d93428ca21265cc860a3b58b3698b3aa) Signed-off-by: Richard Purdie

rust: build the default set of tools

2024-05-28T14:09:01+00:00

Setting it explicitly replaces rust's default choice which is rustdoc (needed for example in selftests and otherwise expected to be present in typical rust installations): https://github.com/rust-lang/rust/blob/master/config.example.toml#L320 This addresses some of the rust selftest failures but not all. Help is appreciate to restore the selftest. Unfortunately, this also breaks rust reproducibility (or rather exposes that it was never properly fixed, as explained here: https://lists.openembedded.org/g/openembedded-core/message/199288 ) (From OE-Core rev: 58eaf2ee6c0809bf0a0d3c1d177e62bda7241651) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

rust: use rust-snapshot binaries only in rust-native

2024-05-28T14:09:01+00:00

Otherwise, use rust-native and cargo-native binaries as that allows our native tweaks in them to be used for target/nativesdk rust - same as for everything else written in rust. In particular, this allows building target rust with cargo-native that includes important reproducibility tweaks. Unfortunately, this also breaks rust selftest, and that is partially addressed by the following commit. [YOCTO #15185] (From OE-Core rev: 8f2230cb51fe22ef4711a56fecfab4858c04e35b) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

rust: add reproducibility patch to eliminate host leakage

2024-05-28T14:09:01+00:00

[YOCTO #15185] (From OE-Core rev: 924df18b47e9a69fa295bafe37bdb39d8eaea2bb) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

rust: correctly link rust-snapshot into build/stage0

2024-05-22T09:21:26+00:00

This does not seem to be used in regular builds, but is beneficial in rust selftest, where it allows dropping a custom patch that is unsuitable for upstream (and was rejected by them). Also remove an obsolete comment that seems related to the code but describes something that was resolved long time ago. I have confirmed that the rust selftest continues to pass with just this one commit on top of master (as the following changes do break the selftest). (From OE-Core rev: bf5732e2b235ce06fa1f24fe8f0dbcbc068500e3) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

recipes: Switch away from S = WORKDIR

2024-05-21T11:08:04+00:00

Where recipes use S = ${WORKDIR}, change them to set UNPACKDIR to a subdir of WORKDIR and make S point at this instead. I've chosen not to force S into any standard UNPACKDIR we may pick in future just so the S = UNPACKDIR case is clearly visible by the directory naming under WORKDIR as that should aid usability. (From OE-Core rev: d9328e3b0b062f0621de3d114584b44f384a1c02) Signed-off-by: Richard Purdie

recipes: Start WORKDIR -> UNPACKDIR transition

2024-05-21T11:08:04+00:00

Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. (From OE-Core rev: 1f18b9a512800860d5153d89eb82b56388efad6f) Signed-off-by: Richard Purdie

recipes: Update S = WORKDIR recipes to use ${S} correctly

2024-05-02T14:15:51+00:00

Where recipes use S = ${WORKDIR}, ensure they are referencing ${S} correctly to access files as soon we want to stop doing this in WORKDIR at which point they would break unless corrected. (From OE-Core rev: f25dd633fffe6560f191526d1869e657e129bad9) Signed-off-by: Richard Purdie

rust: set CVE_STATUS for CVE-2024-24576

2024-04-10T17:35:09+00:00

CVE-2024-24576 only applies when invoking batch files (with the `bat` and `cmd` extensions) on Windows & No other platform or use is affected. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2024-24576 (From OE-Core rev: 28eddfa53494c7560861feff84be3f3a5a46aecb) Signed-off-by: Harish Sadineni Signed-off-by: Richard Purdie