linux/poky.git/meta/recipes-devtools, branch walnascar

python3-setuptools: restore build_scripts.executable support

2025-09-25T19:25:51+00:00

We encountered an issue when running python scripts provided by python3-fail2ban. The shebang '#!/usr/bin/env python3' was replaced by '#!python', which caused these scripts to fail to run. For example: $ head -n 1 /usr/bin/fail2ban-testcases #!python $ /usr/bin/fail2ban-testcases -sh: /usr/bin/fail2ban-testcases: cannot execute: required file not found This issue was introduced by commit[1] in python3-setuptools 75.3.2. See the upstream issue report[2] for more information. Backport patches from [3] to fix this issue. [1] https://github.com/pypa/setuptools/commit/c71266345c64fd662b5f95bbbc6e4536172f496d [2] https://github.com/pypa/setuptools/issues/4934 [3] https://github.com/pypa/distutils/pull/358 (From OE-Core rev: d728ec95291f05cbfb436eabe8717ebe9a0dc11d) Signed-off-by: Yi Zhao Signed-off-by: Steve Sakoman

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-22T19:21:23+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 3d161e94ad532f660d4a0259a32e26a32ea0c75d) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman

rpm: keep leading `/' from sed operation

2025-09-22T19:21:23+00:00

For /usr/lib/rpm/macros, Yocto explicitly set OECMAKE_FIND_ROOT_PATH_MODE_PROGRAM = "ONLY" [1][2] to search tools from CMAKE_FIND_ROOT_PATH [5] which locates in native recipe sysroot or HOSTTOOLS_DIR. If found in native recipe sysroot or HOSTTOOLS_DIR, the sed operation removed leading `/' root@qemux86-64:~# vi /usr/lib/rpm/macros ... %__xz usr/bin/xz %__make usr/bin/make %__zstd usr/bin/zstd %__quilt usr/bin/quilt %__patch usr/bin/patch ... root@qemux86-64:~# rpm --eval "%{__xz} %{__make} %{__zstd} %{__quilt} %{__patch}" usr/bin/xz usr/bin/make usr/bin/zstd usr/bin/quilt usr/bin/patch This commit keeps leading `/' from sed operation, and similar reason for /usr/lib/cmake/rpm/rpm-targets.cmake After applying this commit: root@qemux86-64:~# rpm --eval "%{__xz} %{__make} %{__zstd} %{__quilt} %{__patch}" /usr/bin/xz /usr/bin/make /usr/bin/zstd /usr/bin/quilt /usr/bin/patch [1] https://git.openembedded.org/openembedded-core/commit/?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3 [2] https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_ROOT_PATH_MODE_PROGRAM.html (From OE-Core rev: 32486bb4c5401b0a59470a37505f60f71da6c2c7) Signed-off-by: Hongxu Jia Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (master rev: 0d0773879ab9520c475c4a8c930b2e663de0e032) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

rpm: correct tool path in macros for no usrmerge

2025-09-22T19:21:23+00:00

While no usrmerge in sysvinit, some tools defined in rpm macro have wrong path $ echo 'INIT_MANAGER="sysvinit"' >> conf/local.conf $ echo 'IMAGE_INSTALL:append = " rpm busybox"' >> conf/local.conf $ bitbake core-image-minimal $ runqemu tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.qemuboot.conf root@qemux86-64:~# which sed tar rm mkdir cp cat chown chmod gzip grep mv /bin/sed /bin/tar /bin/rm /bin/mkdir /bin/cp /bin/cat /bin/chown /bin/chmod /bin/gzip /bin/grep /bin/mv root@qemux86-64:~# rpm --eval "%{__sed} %{__tar} %{__rm} %{__mkdir} %{__cp} %{__cat} %{__chown} %{__chmod} %{__gzip} %{__grep} %{__mv}" /usr/bin/sed /usr/bin/tar /usr/bin/rm /usr/bin/mkdir /usr/bin/cp /usr/bin/cat /usr/bin/chown /usr/bin/chmod /usr/bin/gzip /usr/bin/grep /usr/bin/mv Here to explain how __rm was set in rpm during build. The build system of rpm is cmake. Take rpm rpm-4.19.x for example: The '__RM rm' is defected by findutil [1], and function findutil calls find_program to search for tool, if not found on host, then hardcode with "/usr/bin" prefix [2] Yocto explicitly set OECMAKE_FIND_ROOT_PATH_MODE_PROGRAM = "ONLY" [3][4] to search tools from CMAKE_FIND_ROOT_PATH [5] which locates in recipe sysroot, if not found in recipe sysroot, hardcode with "/usr/bin" prefix If "${base_bindir}" != "${bindir}, explicitly correct tools in rpm macros, use ${base_bindir} to instead original ${bindir}. Only do the operation for target, it is not necessary for native and nativesdk, because most host distribution supports usrmerge After applying this commit, on target: root@qemux86-64:~# rpm --eval "%{__sed} %{__tar} %{__rm} %{__mkdir} %{__cp} %{__cat} %{__chown} %{__chmod} %{__gzip} %{__grep} %{__mv}" /bin/sed /bin/tar /bin/rm /bin/mkdir /bin/cp /bin/cat /bin/chown /bin/chmod /bin/gzip /bin/grep /bin/mv root@qemux86-64:~# ls /bin/sed /bin/tar /bin/rm /bin/mkdir /bin/cp /bin/cat /bin/chown /bin/chmod /bin/gzip /bin/grep /bin/mv /bin/cat /bin/chmod /bin/chown /bin/cp /bin/grep /bin/gzip /bin/mkdir /bin/mv /bin/rm /bin/sed /bin/tar In order to save size, this commit does not add these tools to runtime depends, user should explicitly add them if necessary (such as use rpm to build packages) [1] https://github.com/rpm-software-management/rpm/blob/rpm-4.19.x/CMakeLists.txt#L121 [2] https://github.com/rpm-software-management/rpm/blob/rpm-4.19.x/CMakeLists.txt#L59 [3] https://git.openembedded.org/openembedded-core/commit/?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3 [4] https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_ROOT_PATH_MODE_PROGRAM.html [5] https://git.openembedded.org/openembedded-core/tree/meta/classes-recipe/cmake.bbclass?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3#n123 (From OE-Core rev: 3958989d976fb429c84b12427bab3db0bc0d5d16) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie (master rev: c89c7177be2df5d2be44478a6ac43b35ad46db9e) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

binutils: patch CVE-2025-8225

2025-09-09T16:30:07+00:00

Pick commit [1] mentioned in [2]. [1] https://gitlab.com/gnutools/binutils-gdb/-/commit/e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-8225 Testsuite did not show any changes in results: === binutils Summary === # of expected passes 310 # of unexpected failures 1 # of untested testcases 1 # of unsupported tests 9 (From OE-Core rev: 3d79514f90a6f731a5333417641500b8e52e410a) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

binutils: set status for CVE-2025-8224

2025-08-29T17:02:59+00:00

Commit mentioned in CVE report is already included in current hash. Can be verified by trying to cherry-pick. (From OE-Core rev: c7297f46efa410a9204d3d386d307deada967bb6) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

pkgconfig: fix build with gcc-15

2025-08-26T13:33:14+00:00

* on hosts with gcc-15 or whenever glib PACKAGECONFIG isn't enabled and pkgconfig uses own old bundled glib * fixes: http://errors.yoctoproject.org/Errors/Details/853015/ ../../../git/glib/glib/goption.c:169:14: error: two or more data types in declaration specifiers 169 | gboolean bool; | ^~~~ ../../../git/glib/glib/goption.c:169:18: warning: declaration does not declare anything 169 | gboolean bool; | ^ (From OE-Core rev: 092ee1703d81b8aaed452189dd329320483087d3) Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

binutils: Fix gprofng broken symbolic link with gp-*

2025-08-26T13:33:14+00:00

In binutils 2.44, application names were changed from the gp- prefix (e.g., gp-display-text, gp-archive) to the gprofng- prefix (e.g., gprofng-display-text, gprofng-archive). Temporary gp-* symlinks were added to maintain compatibility with the older gprofng-gui. However, these compatibility symlinks did not support cross-platform toolchain prefixes, which resulted in broken gp-* symbolic links. Support for cross-platform prefixes are added upstream in binutils 2.45, so this change backports that fix to resolve broken symlinks issue. Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90803ffdcc4d8c3d17566bf8dccadbad312f07a9] (From OE-Core rev: 55684a63904365d8a6ab2a8ce9e091f29b0b7df5) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman

go: upgrade 1.24.5 -> 1.24.6

2025-08-26T13:33:14+00:00

Upgrade to latest 1.24.x release [1]: $ git --no-pager log --oneline go1.24.5..go1.24.6 7f36edc26d [release-branch.go1.24] go1.24.6 83b4a5db24 [release-branch.go1.24] database/sql: avoid closing Rows while scan is in progress 0f5133b742 [release-branch.go1.24] os/exec: fix incorrect expansion of "", "." and ".." in LookPath 6e1c4529e4 [release-branch.go1.24] cmd/compile: for arm64 epilog, do SP increment with a single instruction 731de13dc3 [release-branch.go1.24] os/user: user random name for the test user account 390ffce7d6 [release-branch.go1.24] runtime: prevent unnecessary zeroing of large objects with pointers b454859a8a [release-branch.go1.24] runtime: stash allpSnapshot on the M Fixes CVE-2025-47906 and CVE-2025-47907 [2]. [1] https://github.com/golang/go/compare/go1.24.5...go1.24.6 [2] https://groups.google.com/g/golang-announce/c/x5MKroML2yM (From OE-Core rev: a348c04d449c0ba36b2ef278bea08919f0e6d19f) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit f3072c210ac0a1e4d8046d920c3ebc29f9916b72) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

elfutils: Fix CVE-2025-1377

2025-08-26T13:33:14+00:00

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1377 https://ubuntu.com/security/CVE-2025-1377 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=fbf1df9ca286de3323ae541973b08449f8d03aba (From OE-Core rev: 36436f0996d3a84fe6a59434dec1a92704110602) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman