linux/poky.git/meta/recipes-extended/cpio, branch yocto-2.7.2

cpio/tar/native.bbclass: move rmt to sbindir and add a prefix to avoid native clashing

2019-05-20T13:38:16+00:00

The rmt in cpio-native and tar-native is clashing, since tar-native has set var-NATIVE_PACKAGE_PATH_SUFFIX, we move rmt to sbindir, and add suffix NATIVE_PACKAGE_PATH_SUFFIX to sbindir could avoid the clashing. And in Ubuntu, rmt is in sbindir $ which rmt /usr/sbin/rmt (From OE-Core rev: 9f47cea3c58a53db8599f1be4ff4401406c00928) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

cpio: avoid conflict with tar-doc and rmt.8

2019-02-27T18:04:14+00:00

This fixes: Error: Transaction check error: file /usr/share/man/man8/rmt.8 conflicts between attempted installs of cpio-doc-2.12-r0.core2_64 and tar-doc-1.31-r0.core2_64 Prior to commit 348a96a5b401 [tar: upgrade to 1.31] the copies of rmt.8 found in the tar(-doc) and cpio(-doc) packages were the same and thus no conflict was seen. After the upgrade there were small changes in the manpage header which results in the conflict quoted above. The applications themselves make use of the 'update-alternatives' mechanism to allow a user to select which version of 'rmt' to use but since the man pages are essentially the same we disambiguate the source of the man pages and make them both available should both cpio-doc and tar-doc are both installed. And as such we avoid the conflict. (From OE-Core rev: 692d5b1025450bf1c33fb6aa041603f082e2ba4d) Signed-off-by: Mark Asselstine Signed-off-by: Richard Purdie

cpio: update patch to merged version

2018-12-05T12:37:02+00:00

The segfault on append was fixed upstream with a different patch, so apply that instead. (From OE-Core rev: 24000d1fdba2684202e15371f80bb385722c9d91) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: fix crash when appending to archives

2018-12-01T11:38:36+00:00

The upstream fix for CVE-2016-2037 introduced a read from uninitialized memory bug when appending to an existing archive, which is an operation we perform when building an image. (From OE-Core rev: 046e3e1fca925febf47b3fdd5d4e9ee2e1fad868) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: fix CVE-2016-2037

2018-06-15T16:56:24+00:00

"The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file." https://nvd.nist.gov/vuln/detail/CVE-2016-2037 Note that there appear to be two versions of this fix. The original patch posted to the bug-cpio mailing list [1] is used by Debian [2], but apparently causes regression [3]. The patch accepted to the upstream git repo [4] seems to be the most complete fix. [1] https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html [2] https://security-tracker.debian.org/tracker/CVE-2016-2037 [3] https://www.mail-archive.com/bug-cpio@gnu.org/msg00584.html [4] http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=d36ec5f4e93130efb24fb9678aafd88e8070095b (From OE-Core rev: f170288ac706126e69a504a14d564b2e5c3513e4) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: rely on texinfo.bbclass for texinfo-native dependency

2018-06-15T16:56:24+00:00

(From OE-Core rev: 7dad119dd0ee82b14a82b2a0b5a89f790e3bc007) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: move contents of cpio_v2.inc into the cpio recipe

2018-06-15T16:56:24+00:00

Merge contents of cpio_v2.inc into the only recipe which uses it. (From OE-Core rev: 162ff3871779d646dadc7e7287f4667641d6e612) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

recipes: Move out stale GPLv2 versions to a seperate layer

2017-03-07T20:05:31+00:00

These are recipes where the upstream has moved to GPLv3 and these old versions are the last ones under the GPLv2 license. There are several reasons for making this move. There is a different quality of service with these recipes in that they don't get security fixes and upstream no longer care about them, in fact they're actively hostile against people using old versions. The recipes tend to need a different kind of maintenance to work with changes in the wider ecosystem and there needs to be isolation between changes made in the v3 versions and those in the v2 versions. There are probably better ways to handle a "non-GPLv3" system but right now having these in OE-Core makes them look like a first class citizen when I believe they have potential for a variety of undesireable issues. Moving them into a separate layer makes their different needs clearer, it also makes it clear how many of these there are. Some are probably not needed (e.g. mc), I also wonder whether some are useful (e.g. gmp) since most things that use them are GPLv3 only already. Someone could now more clearly see how to streamline the list of recipes here. I'm proposing we mmove to this separate layer for 2.3 with its future maintinership and testing to be determined in 2.4 and beyond. (From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b) Signed-off-by: Richard Purdie

meta: use require instead of include when file should exist

2017-01-09T13:39:11+00:00

If the file is expected to exist, then we should always be using require so that if it doesn't we get an error rather than some other more obscure failure later on. (From OE-Core rev: 603ae6eb487489e65da69c68e532cb767ccc1fc2) Signed-off-by: Paul Eggleton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: Add native variant

2016-05-30T14:58:11+00:00

(From OE-Core rev: fb3457a454b045abf1fa6b560b8f96257a4405c1) Signed-off-by: Mariano Lopez Signed-off-by: Ross Burton Signed-off-by: Richard Purdie