linux/poky.git/meta/recipes-support, branch rocko

recipes: Update git.gnome.org addresses after upstream changes

2018-10-18T10:09:39+00:00

git.gnome.org is no more. It has ceased to be. It's an ex-git. Please see here: https://about.gitlab.com/2018/05/31/welcome-gnome-to-gitlab/ Note that gitlab does not support git://, only https:// (and ssh). [Commit message from Alexander Kanavin] (From OE-Core rev: 8382cdc0888ca645a44aacaac1155afb8dcde979) (From OE-Core rev: d40c87b003b290a1739039156b27f194f68f12c2) Signed-off-by: Richard Purdie [Fixup for sumo context] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

popt: update SRC_URI

2018-07-19T09:54:55+00:00

It appears the rpm5.org has been down for some time, switch to fossies WARNING: popt-native-1.16-r3 do_fetch: Failed to fetch URL http://rpm5.org/files/popt/popt-1.16.tar.gz, attempting MIRRORS if available (From OE-Core rev: 347ee336dcc94e6fa4e4788117013615b90abd70) (From OE-Core rev: 9e3bf0ce4ebb885ca0ede0e636d80e032c29e744) (From OE-Core rev: 3eb66e250e9dd38db0b1d557a0fda3c33e43ef04) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 50804c06633f8402fb9ac905882353f746afd1cb) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libnl: fix CVE-2017-0553

2018-05-23T16:43:00+00:00

An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0553 Backport fix from upstream libnl 3.3.0 release: https://github.com/thom311/libnl/commit/3e18948f17148e6a3c4255bdeaaf01ef6081ceeb http://lists.infradead.org/pipermail/libnl/2017-May/002313.html (From OE-Core rev: f452fbc5d2ffb9c1417079574bed0dfcdc44787a) Signed-off-by: Andre McCurdy Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

mpfr: Update SRC_URI to use gnu

2018-05-03T08:53:49+00:00

ERROR: mpfr-native-3.1.5-r0 do_checkuri: Fetcher failure for URL: 'http://www.mpfr.org/mpfr-3.1.5/mpfr-3.1.5.tar.xz'. URL http://www.mpfr.org/mpfr-3.1.5/mpfr-3.1.5.tar.xz doesn't work ERROR: mpfr-native-3.1.5-r0 do_checkuri: Function failed: do_checkuri Found gnu has the same copy (From OE-Core rev: ee3de1e4963ae56515be3a56b473f25ace286511) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libpcre-ptest: skip locale test

2018-05-03T08:53:48+00:00

If a fr_FR locale is found, it is automatically tested. The test will fail if the locale is UTF-8, as the test blindly assumes (and expects) a non-UTF fr_FR locale. The remedy is to skip the test. [YOCTO #12215] (From OE-Core rev: 4cedddb83623c79980b354642dfeaf78218ca4b7) (From OE-Core rev: ebb6c4f6a2bb6a6be4b3c4f8b7095bad529c62ea) Signed-off-by: Juro Bystricky Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ca-certificates: change SRC_URI from Debian anonscm to salsa

2018-05-03T08:53:47+00:00

Debian anonscm service in Alioth is shutdown and thus fetching ca-certificates sources fails. https://wiki.debian.org/Alioth "Alioth is broken, and there is nobody around to fix it. Don't ask the remaining people who give it life support to implement fixes and changes. It is being replaced by a cocktail of ?GitLab (see Salsa), read-only repos and keep-alive mechanisms. See below for more information." (From OE-Core rev: fc20ff2003cee7ee3b78ba3bc236a60a8caabc35) (From OE-Core rev: 127d1d68346bece34ccd8f6203976e2399c31a92) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: DEPENDS on libidn2 (not libidn)

2018-05-03T08:53:47+00:00

Since v7.51.0, libidn2 is the only available option, libidn support was dropped. The configure option was renamed as of v7.53.0 Therefore, curl unconditionally tries to build against libidn2, which in particular is a problem for curl-native, as that might or might not build against the build-machine's libidn2 now, which furthermore causes problems when trying to share sstate between multiple build machines. We therefore see the following in the config log: ... checking whether to build with libidn2... (assumed) yes ... checking for libidn2 options with pkg-config... no configure: IDN_LIBS: "-lidn2" configure: IDN_LDFLAGS: "" configure: IDN_CPPFLAGS: "" configure: IDN_DIR: "" checking if idn2_lookup_ul can be linked... yes checking idn2.h usability... yes checking idn2.h presence... yes checking for idn2.h... yes ... IDN support: enabled (libidn2) ... even though this recipe tries to disable that. While libidn2 isn't available in OE, this change at least: * prevents curl-native to silently build against libidn2 if that is installed on build machine, even if not requested * alerts people who use the PACKAGECONFIG option that it's not actually doing what they intend to do (From OE-Core rev: 705eaea991622bdbb2ee83eefa8df8e665e3efe4) (From OE-Core rev: 6ec8cb59b2f58784a9f74afa6018791694f8a030) Signed-off-by: André Draszik Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: upgrade to 7.58.0

2018-05-03T08:53:47+00:00

(From OE-Core rev: 9763c9d649a22f9024d832eb625bee35b583e717) This update include these CVES: CVE-2018-1000122 CWE-126: Buffer Over-read CVE-2018-1000121 CWE-476: NULL Pointer Dereference CVE-2018-1000120 CWE-122: Heap-based Buffer Overflow Mostly bugfixes. (From OE-Core rev: f99e2ce01ed01cf036a8282b2d155d941ed7ec9b) Signed-off-by: Oleksandr Kravchuk Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: 7.54.1 -> 7.57.0

2018-05-03T08:53:47+00:00

1.Upgrade curl from 7.54.1 to 7.57.0. 2.Delete CVE-2017-1000099.patch, CVE-2017-1000100.patch, CVE-2017-1000101.patch, CVE-2017-1000254.patch, reproducible-mkhelp.patch, since it is integrated upstream. 3.Remove "do_install_append()" from curl_7.57.0.bb, since curl/curlbuild.h has been removed. this update include CVE fixes for: CVE-2018-1000007 CWE-522: Insufficiently Protected Credentials CVE-2018-1000005 CWE-126: Buffer Over-read CVE-2017-8818 CWE-125: Out-of-bounds Read CVE-2017-8817 CWE-126: Buffer Over-read CVE-2017-8816 CWE-131: Incorrect Calculation of Buffer Size CVE-2017-1000257 CWE-126: Buffer Over-read Most of the changes are bug fixes. https://curl.haxx.se/changes.html (From OE-Core rev: 215d5677004537fc190b5381157ac8b94db6d7e8) (From OE-Core rev: 7f1029aff8abaadb25730fef50c495dcd6fc1e30) Signed-off-by: Huang Qiyu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie [Safer to upgrade than to backport CVE-2017-8818. Lots of depends patches] Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ca-certificates: run postinst script only for -target package

2018-03-26T14:07:11+00:00

Nativesdk package has a special arrangement where the same thing is done in do_install(). It was assumed (in the comment) that postinsts don't run when installing nativesdk packages, but this was incorrect: they are run, but any failures were previously silently ignored. Now this missing failure reporting has been fixed, and so we get to see the failures. (From OE-Core rev: 8ebb695c1429f8d57d655072a362a4f176258699) (From OE-Core rev: 31f69f8fd8a08fadee0ea288214aa33c33ad6912) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie