linux/poky.git/meta/recipes-support/ca-certificates, branch scarthgap

ca-certificates: upgrade 20250419 -> 20260223

2026-05-04T12:57:32+00:00

Changelog: * Update Mozilla certificate authority bundle to version 2.82 The following certificate authorities were added (+): + TrustAsia TLS ECC Root CA + TrustAsia TLS RSA Root CA + SwissSign RSA TLS Root CA 2022 - 1 + OISTE Server Root ECC G1 + OISTE Server Root RSA G1 The following certificate authorities were removed (-): - GlobalSign Root CA - Entrust.net Premium 2048 Secure Server CA - Baltimore CyberTrust Root (closes: #1121936) - Comodo AAA Services root - XRamp Global CA Root - Go Daddy Class 2 CA - Starfield Class 2 CA - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public Trust RSA Root-02 * Use dh_usrlocal to create /usr/local/share/ca-certificates (From OE-Core rev: 219ca927c9cd31a200b2ab4bed17937af4e5afc8) Signed-off-by: Andrej Kozemcak Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 738e08718e31de19c1c8db5e162a4a00e2b0c0e6) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

ca-certificates: fix on-target postinstall script

2025-11-14T14:45:29+00:00

When the package is installed directly on the machine (instead of installing it in the rootfs directly), the postinstall script fails with the following error: /usr/sbin/update-ca-certificates: line 75: shift: shift count out of range The reason is that the "update-ca-certificates" script is executed with the "--sysroot" argument, and as the sysroot $D is passed. However on the target system this variable doesn't exist, so the argument is passed without this mandatory value, and the execution fails. To avoid this error, check if the $D variable exists, and pass the --sysroot argument only when it does. Reported-by: WXbet (From OE-Core rev: 9a2bd3b6e2e53071a1463d2804d0d4fb17b1814f) Signed-off-by: Gyorgy Sarvari Signed-off-by: Richard Purdie (cherry picked from commit cf39461e97098a1b28693299677888ba7e8bfccf) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: upgrade 20241223 -> 20250419

2025-11-14T14:45:29+00:00

0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch 0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch refreshed for 20250419 0002-sbin-update-ca-certificates-add-a-sysroot-option.patch removed since it's included in 20250419 (From OE-Core rev: dd05818a422c8c5be1aef06405d200280b382b91) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit e39cc1fb7234bf2b37856296d3c0d10ddf8cae64) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: submit sysroot patch upstream, drop default-sysroot.patch

2025-11-14T14:45:29+00:00

ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch was using a non-standard environment variable, and was replaced with a patch that adds a command line option (and then this was submitted upstream). ca-certificates recipe was tweaked accordingly, and nothing else in core or meta-oe is using update-ca-certificates. Drop default-sysroot.patch as the use case is unclear: sysroot is explicitly specified in all known invocations of update-ca-certificate, and if there's a place where it isn't, then update-ca-certificates will error out trying to write to /etc, and should be fixed to explicitly specify the sysroot. (From OE-Core rev: a80185fd72a2be183783b0e464c07f1043d7dd37) Signed-off-by: Alexander Kanavin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 90d9f0ba674d4fe8e9291f0513c13dff3775c545) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: upgrade 20240203 -> 20241223

2025-11-14T14:45:29+00:00

(From OE-Core rev: 7e4ce7c927f6328e013db53690a2ef841b1bb9bf) Signed-off-by: Richard Purdie (cherry picked from commit 48a236c2f78fee5e6db19c6be23b4a18df025607) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: get sources from debian tarballs

2025-11-14T14:45:29+00:00

git repo no longer has tags for recent versions which means we had missed several of them, and wouldn't be able to get notifications about any future releases. (From OE-Core rev: 44c113497c7e3f9f06604e892df1eb717bb3410d) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 81f013fd1312551628701bf36ac62746a2606dbd) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: Add comment for provenance of SRCREV

2025-11-14T14:45:29+00:00

Provide references for how the SRCREV was arrived at for the 20240203 release. (From OE-Core rev: b1d86653f1485aa56fe8bf050931d5b8657ee499) Signed-off-by: Theodore A. Roth Signed-off-by: Theodore A. Roth Signed-off-by: Richard Purdie (cherry picked from commit 6916cdb0f05f6644edb1e432a9421595abb9f0ca) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

ca-certificates: update 20211016 -> 20240203

2025-11-14T14:45:29+00:00

The 20240203 version is the same as used in Ubuntu >= 24.04 and Debian Trixie (testing). (From OE-Core rev: 63620f034019b3b3585e263bd26b3fadd9a1692e) Signed-off-by: Theodore A. Roth Signed-off-by: Theodore A. Roth Signed-off-by: Richard Purdie (cherry picked from commit ce19168885a04b0d77e81c1fd1c4262b195a47d4) Signed-off-by: Ankur Tyagi Signed-off-by: Steve Sakoman

meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers

2022-02-20T16:45:25+00:00

An automated conversion using scripts/contrib/convert-spdx-licenses.py to convert to use the standard SPDX license identifiers. Two recipes in meta-selftest were not converted as they're that way specifically for testing. A change in linux-firmware was also skipped and may need a more manual tweak. (From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0) Signed-off-by: Richard Purdie

meta: Add explict branch to git SRC_URIs

2021-10-30T17:56:47+00:00

There is uncertainty about the default branch name in git going forward. To try and cover the different possible outcomes, add branch names to all git:// and gitsm:// SRC_URI entries. This update was made with the script added to contrib in this patch which aims to help others convert other layers. (From OE-Core rev: b51c405faf6f8c0365f7533bfaf470d79152a463) Signed-off-by: Richard Purdie