linux/poky.git/meta/recipes-extended/tar, branch dunfell-23.0.20

tar: filter CVEs using vendor name

2021-10-23T22:14:16+00:00

Recently a number of CVEs have been logged against a nodejs project called "node-tar". These appear as false positives against the GNU tar being built by Yocto. Some of these have been manually excluded using CVE_CHECK_WHITELIST. To avoid this problem, use the vendor name (in addition to package name) for filtering CVEs. The syntax for this is: CVE_PRODUCT = "vendor:package" When not specified, the vendor defaults to "%" which matches anything. (From OE-Core rev: 4d0ad4962bd3c69800f70770dc9123a694e16c26) Signed-off-by: Ralph Siemsen Signed-off-by: Alexandre Belloni (cherry picked from commit 45d1a0bea0c628f84a00d641a4d323491988106f) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tar: ignore node-tar CVEs

2021-09-29T23:02:22+00:00

These three CVEs are specific to the Node package node-tar. exclude: CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 (From OE-Core rev: 8653ed5bc02c794944372be5c4ba785a7739f6d0) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie (cherry picked from commit 9f9317a02d73c1e5aea026683a037e52c996c7bb) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tar: ignore node-tar CVEs

2021-08-26T07:32:18+00:00

These two CVEs are specific to the Node package node-tar. (From OE-Core rev: d1b09f81ad80e5099ae670c965dcf7d39ad09ac1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit bc7216e8148d0dee7b56e6851da6615e93647a0a) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tar: Fix CVE-2021-20193

2021-05-13T21:10:05+00:00

(From OE-Core rev: c8f48471bea67cbf0f12a35639b764f90acae854) Signed-off-by: Anatol Belski Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tar: Fix build determinism, disable rsh

2020-02-06T12:16:34+00:00

rsh is insecure and obsolete but tar will enable support if the binary is on the host system. Some systems point it at ssh. Lets explictly disable it for now unless someone actually needs/uses this at which point it could become a packageconfig. (From OE-Core rev: d14a4b0db92a9a7d1ff72a2e0faca7f1a23a0b68) Signed-off-by: Richard Purdie

m4/tar: Remove remove-gets.patch

2019-05-27T16:06:34+00:00

When the original problem was fixed in gnulib the patches were rebased on top of the upstream fix... (From OE-Core rev: d93ad85d94ea99e3fad7e4c2f6be999088e2f9f9) Signed-off-by: Adrian Bunk Signed-off-by: Richard Purdie

cpio/tar/native.bbclass: move rmt to sbindir and add a prefix to avoid native clashing

2019-05-08T11:15:17+00:00

The rmt in cpio-native and tar-native is clashing, since tar-native has set var-NATIVE_PACKAGE_PATH_SUFFIX, we move rmt to sbindir, and add suffix NATIVE_PACKAGE_PATH_SUFFIX to sbindir could avoid the clashing. And in Ubuntu, rmt is in sbindir $ which rmt /usr/sbin/rmt (From OE-Core rev: e9ac5ac2f4d135734f549d17cce3ebc52132b7d0) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

tar: update to 1.32

2019-04-12T13:05:37+00:00

(From OE-Core rev: 472258c7bf25672d6b8922061e8ea382d7be478a) Signed-off-by: Oleksandr Kravchuk Signed-off-by: Richard Purdie

tar: upgrade to 1.31

2019-02-20T11:30:35+00:00

Remove the musl specific do_install, as it's not suitable for this version. (From OE-Core rev: 348a96a5b4016a7615f8d22c03ec1ced60367c3b) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie

tar: control acl PACKAGECONFIG based on acl distro feature

2018-05-04T12:28:05+00:00

(From OE-Core rev: fa8f3bda2680d9890ff6d2bc0ce9737a4d40b4f7) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie