linux/poky.git/meta/recipes-support/curl, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

curl: Update to 8.16.0

2025-09-22T21:09:48+00:00

Release notes: https://curl.se/changes.html#8_16_0 CVE: CVE-2025-9086 CVE: CVE-2025-10148 (From OE-Core rev: 15e206a61bca24c2948c93b562621ca8668289d1) Signed-off-by: Peter Kjellerstedt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-15T16:57:23+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

curl: upgrade 8.14.1 -> 8.15.0

2025-08-11T17:04:25+00:00

Upgrade curl to the latest release. Release notes: https://curl.se/changes.html#8_15_0 This version includes bug fixes and security updates. (From OE-Core rev: ead10dcf9876a745224e3ff683ee5f687b13da03) Signed-off-by: Osama Abdelkader Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

curl: upgrade 8.12.1 -> 8.14.1

2025-06-09T16:43:41+00:00

Handle CVE-2025-4947 and CVE-2025-5025. CVE-2025-5399 fixed in 8.14.1 was introduced only in 8.13.0, so Yocto never had version vulnerable to it. Rebase patches. Add openssl-native dependency fo ptest to fix following error: Missing or broken 'openssl' tool. openssl 1.0.2+ is required. Without it, this script cannot generate the necessary certificates the curl test suite needs for all its TLS related tests. at ../../../curl-8.14.0/tests/certs/genserv.pl line 33. Install curlinfo for tests required since 8.14.0 https://github.com/curl/curl/commit/7a1211d474afd4e36bfb39f2b870a418bce42138 (From OE-Core rev: d990ee6c49e3fcf969e54688397d47f0d0892ba1) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

buildtools-tarball: Make buildtools respects host CA certificates

2025-04-24T10:27:06+00:00

To adapt user network enviroment, buildtools should first try to use the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these envs is not set, then use the auto-detected ca file and ca path, and finally use the CA certificates in buildtools. nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work nativesdk-curl don't set default ca file, need SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO also works nativesdk-python3-requests will use cacert.pem under python module certifi by default, need to set REQUESTS_CA_BUNDLE (From OE-Core rev: 8a7ec52e9b35654bee48cd948c6c34c63db3e265) Signed-off-by: Changqing Li Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

buildtools-tarball: add envvars into BB_ENV_PASSTHROUGH_ADDITIONS

2025-04-11T10:49:59+00:00

Here is one testcase: For recipe tensorflow-lite-host-tools_2.18.0.bb, refer [1], do_configure[network] = "1" and it will git clone some repos in CMakeLists.txt When buildtools is used and nativesdk-git is installed into sdk, do_configure failed with error: [1/9] Performing download step (git clone) for 'protobuf-populate' Cloning into 'protobuf'... fatal: unable to access 'https://github.com/protocolbuffers/protobuf/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-wrlinuxsdk-linux/etc/ssl/certs/ca-certificates.crt Fix by adding GIT_SSL_CAINFO in BB_ENV_PASSTHROUGH_ADDITIONS, so that user can export GIT_SSL_CAINFO=${GIT_SSL_CAINFO} in their do_configure:prepend() to fix above do_configure failure CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE is similar envvars, so all add into BB_ENV_PASSTHROUGH_ADDITIONS [1] https://github.com/nxp-imx/meta-imx/blob/styhead-6.12.3-1.0.0/meta-imx-ml/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2.18.0.bb (From OE-Core rev: 183e043de423fd3f7833366ca524a6f7d17e6d14) Signed-off-by: Changqing Li Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

buildtools-tarball: move setting of envvars to respective envfile

2025-04-11T10:49:59+00:00

* make git,curl,python3-requests align with openssl, move the setting of envvars into respective envfile * for environment.d-openssl.sh, also check if ca-certificates.crt exist before export envvars (From OE-Core rev: 9d8ebfcd55ad274e79cb81f162397c8f39f4287b) Signed-off-by: Changqing Li Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

curl: only set CA bundle in target build

2025-03-24T17:29:16+00:00

In native/nativesdk builds, sysconfdir refers to a recipe sysroot directory, which will disappear once the workdir is cleaned up, breaking libcurl's HTTPS connections. By simply not setting --with-ca-bundle at all in non-target builds, curl defaults to the host system's CA certificates, which is desirable anyways to allow builds in environments that require local CA certificates. (From OE-Core rev: 4909a46e93ba774c960c3d3c277e2a669af3fea6) Signed-off-by: Matthias Schiffer Signed-off-by: Richard Purdie

curl: upgrade 8.12.0 -> 8.12.1

2025-02-18T11:56:03+00:00

Rebase patch which needs it. (From OE-Core rev: 375167de2f46338d77ca9b79325819ea4068751c) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie