linux/poky.git/meta/recipes-extended, branch scarthgap

tzdata/tzcode-native: upgrade 2026a -> 2026b

2026-06-10T13:35:21+00:00

The 2026b release contains the following changes: Briefly: British Columbia moved to permanent -07 on 2026-03-09. Some more overflow bugs have been fixed in zic. Changes to future timestamps British Columbia’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.) Although the change to permanent -07 legally took place on 2026-03-09, temporarily model the change to occur on 2026-11-01 at 02:00 instead. This works around a limitation in CLDR v48.2 (2026-03-17). This temporary hack is planned to be removed after CLDR is fixed. Changes to code zic no longer mishandles a last transition to a new time type. zic no longer overflows a buffer when generating a TZ string like "PST-167:59:58PDT-167:59:59,M11.5.6/-167:59:59,M12.5.6/-167:59:59", which can occur with adversarial input. (Thanks to Naveed Khan.) zic no longer generates a longer TZif file than necessary when an earlier time zone abbreviation is a suffix of a later one. As a nice side effect, zic no longer overflows a buffer when given a long series of abbreviations, each a suffix of the next. (Buffer overflow reported by Arthur Chan.) zic no longer overflows an int when processing input like ‘Zone Ouch 2147483648:00:00 - LMT’. The int overflow can lead to buffer overflow in adversarial cases. (Thanks to Naveed Khan.) zic now checks for signals more often. (From OE-Core rev: 37dab321242e06d2940c4221e4a13e68265d696f) Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit dda7d55396e0c5258cba58af7e990ab3813bf108) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: Fix CVE-2026-4424

2026-06-10T13:35:20+00:00

Pick patches from [1] and [2] as mentioned in Debian report in [3]. [1] https://github.com/libarchive/libarchive/commit/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375 [2] https://github.com/libarchive/libarchive/commit/e1907c5832b6489c7b4198b0825f857c93a03c10 [3] https://security-tracker.debian.org/tracker/CVE-2026-4424 (From OE-Core rev: 7fa280872275e194152cc2d355ad39c81a477d50) Signed-off-by: Hugo SIMELIERE (Schneider Electric) Reviewed-by: Bruno VERNAY Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

sudo: fix for CVE-2026-35535

2026-05-12T20:31:34+00:00

Pick patch from [1] also mentioned at Debian report in [2] [1] https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69 [2] https://security-tracker.debian.org/tracker/CVE-2026-35535 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-35535 (From OE-Core rev: ddf8325a5b791dfcb0fdf129274deea8ad7eb90a) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: fix for CVE-2026-4426

2026-05-12T20:31:34+00:00

Pick patch from [1] also mentioned at Debian report in [2] [1] https://github.com/libarchive/libarchive/commit/c3cb1c568ebf9e8f7f478cfc0356ae54e99712b0 [2] https://security-tracker.debian.org/tracker/CVE-2026-4426 More details: https://nvd.nist.gov/vuln/detail/CVE-2026-4426 (From OE-Core rev: e4e78640b75acb474f82ca9e24be9a1d5b06740b) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

ghostscript: fix build with gcc-15 on host

2026-05-12T20:31:34+00:00

(From OE-Core rev: 0769c461e545073772aecc34e81fa309ade68dcb) Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie (From OE-Core rev: 02e282f6417274a93c6f01978bf33e2d171297b0) Signed-off-by: Mikko Rapeli Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

ghostscript: Pin to C17 std

2026-05-12T20:31:34+00:00

The code defines a custom 'bool' type (as an 'int'), which is incompatible with C23 in which bool is a keyword, and trying to use fails because 'int' and 'bool' are used interchangeably in the code. Add the flag to CC variable, since CFLAGS is used by both c and c++ compilers and clang++ is less forgiving when C compiler only option is used on its cmdline so it complains about -std=gnu17 and bails out. (From OE-Core rev: 0647201fb4729be3b10b3da2b19645c59147b40a) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie (From OE-Core rev: 49657089ef215824f8f79a81deb7baf4f27d0030) Signed-off-by: Mikko Rapeli Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

sudo: upgrade 1.9.17p1 -> 1.9.17p2

2026-05-04T12:57:33+00:00

Changelog for sudo: 1.9.17p1 -> 1.9.17p2 ============================================================ Merge sudo 1.9.17p2 from branch 'main' into sudo-1.9 [d1b48c651] * configure, configure.ac: Fix check for which man page type to use with nroff Fixes a bug where configure would use *.man instead of *.mdoc on systems without mandoc. Bug #1077. [aa2498e46] * plugins/sudoers/log_client.c: client_msg_cb: make warning match the function that failed [f73162df3] 2025-07-23 Todd C. Miller * NEWS, configure, configure.ac: Sudo 1.9.17p2 [f0e1a5ca3] * plugins/sudoers/match_command.c, plugins/sudoers/match_digest.c: digest_matches: plug fd leak on snprinf() failure [26a1a7529] 2025-07-21 Todd C. Miller * etc/sudo-logsrvd.pp, etc/sudo-python.pp, etc/sudo.pp, scripts/mkpkg: Add a way to override pp_rpm_arch when building rpms This will be used to build x86_64_v2 packages for Alma Linux. [55d3c99c4] * configure, configure.ac: Fix check for which man page type to use with nroff Fixes a bug where configure would use *.man instead of *.mdoc on systems without mandoc. [2dc10cfbd] * plugins/sudoers/timestamp.c: ts_write: call lseek after fruncate on short write We need to make sure the file position is reset to the old EOF on error. [8e7e0e23f] 2025-07-20 Todd C. Miller * src/exec_ptrace.c: ptrace_readv_string: quiet sign-compare warning [fac2a49e7] * src/exec_ptrace.c: ptrace_readv_string: properly handle reads of more than one page When the intercept and intercept_verify options are enabled and either argv[] or envp[] contains a string larger than the page size (usually 4096), ptrace_readv_string() would fill the buffer with mutiple copies of the same string. Fixes GitHub issue #453. [2e93eabed] 2025-07-14 Todd C. Miller * src/exec_pty.c: revoke_pty: use killpg() not kill() to send HUP to the process group Also make sure we never call killpg(-1, SIGHUP), which would send SIGHUP to process 1 (init). It is possible for cmnd_pid to be -1 in certain error conditions where sudo killed the command itself. This may explain GitHub issue #458. [fb208d383] 2025-07-08 Todd C. Miller * etc/sudo-logsrvd.pp, etc/sudo-python.pp, etc/sudo.pp, scripts/pp: Don't assume RHEL major version is only a single digit Fixes handling of RHEL 10 and higher. [e5d953f33] * plugins/sudoers/visudo.c: visudo: create temporary file as mod 0600 not 0700 This was due to a typo in the mode field when the temporary file was created. Noticed by Bjorn Baron of the sudo-rs project. [1c254b330] 2025-06-30 Todd C. Miller * Makefile.in: We now build sudo releases from git, not mercurial [cb4e26734] 2025-06-28 Todd C. Miller * NEWS, configure, configure.ac: (From OE-Core rev: 76b98657e3dc9da01a746deb7b9d08cb84ba44b6) Signed-off-by: Daniel Turull (cherry picked from commit 12e9ba655153a9cb7c2b79cf52a2300e19634dcf) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

texinfo: Backport patches for hosts with newer GCC

2026-05-04T12:57:33+00:00

On Ubuntu 26.04 (Gcc 15.2), texinfo-native fails to build. Note: it is usually ASSUME_PROVIDED via bitbake.conf. Backport patches (all included in texinfo-7.3, OE-Core's version) to fix these errors: | ../../texinfo-7.0.3/system.h:69:14: error: conflicting types for ‘strerror’; have ‘char *(void)’ | 69 | extern char *strerror (); | | ^~~~~~~~ | In file included from ../gnulib/lib/string.h:41, | from ../../texinfo-7.0.3/system.h:34: | /usr/include/string.h:451:14: note: previous declaration of ‘strerror’ with type ‘char *(int)’ | 451 | extern char *strerror (int __errnum) __THROW; | | ^~~~~~~~ ======================================================== | ../../../../../../../workspace/sources/texinfo-native/info/echo-area.c:176:12: error: too many arguments to function ‘cmd’; expected 0, have 2 | 176 | (*cmd) (the_echo_area, count); | | ~^~~~~ ~~~~~~~~~~~~~ ======================================================== | ../../../../../../../workspace/sources/texinfo-native/info/m-x.c:140:8: error: too many arguments to function ‘command->func’; expected 0, have 3 | 140 | (*command->func) (active_window, count, 0); | | ~^~~~~~~~~~~~~~~ ~~~~~~~~~~~~~ ======================================================== (From OE-Core rev: d80f41a4d02b81fdfcb21956f81c9918caab2dad) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

ltp: fix epoll_ctl04 failed

2026-05-04T12:57:32+00:00

backport from ltp upstream commit: https://github.com/linux-test-project/ltp/commit/e84f0689cf7a8a77478a0e70aa62560f66c3bceb the related kernel patch was already merged into yocto linux: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2e467a48287c868818085aa35389a224d226732 (From OE-Core rev: 02ee34a255573789d1baf7ec080bf30e6e34b2ba) Signed-off-by: Li Wang Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: Fix CVE-2026-4111

2026-05-04T12:57:30+00:00

Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-4111 [2] https://github.com/libarchive/libarchive/pull/2877 [3] https://access.redhat.com/errata/RHSA-2026:5063 (From OE-Core rev: c938ecea4304a57edb824f121e0ca8f79b45bb7e) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker