linux/poky.git/meta/recipes-support, branch sumo

gnupg: patch gnupg-native to allow path relocation

2018-11-24T21:49:51+00:00

GnuPG hard-codes $bindir etc and uses them to find the helper binaries, such as gpg-agent. This breaks if gnupg-native is reused from sstate for a different build directory and GPG signing of packages is required. Patch in getenv() checks for gnupg-native when returning the hardcoded paths, and create a wrapper script which overrides GNUPG_BINDIR. There are more paths that can be overridden, but this one is sufficient to make GnuPG work. (From OE-Core rev: dfd69ff889ed78bf137116583d8ae351859ee203) (From OE-Core rev: ddaf41f210f80556eca1d0acaee1e3f9cbf80122) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

curl: actually apply latest CVE patches

2018-11-24T21:45:58+00:00

(From OE-Core rev: f0394e80a37f1da47042a1aa0487594f390603f9) (From OE-Core rev: b2ccfeeffc5762648ee6b1f1d05c3cc6f347ed28) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

apr-util: Trim license info extracted from apu_version.h

2018-11-24T21:45:58+00:00

Two unrelated lines were extracted from apu_version.h for the license information. License-Update: Only extract the relevant part from apu_version.h (From OE-Core rev: 2edb0f24a13f27b2fae94fb447221ad2ddb924a0) (From OE-Core rev: 6aebc3a4452d1422cf2ba59dd9b381f89e2fefcc) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

apr: Trim license info extracted from apr_lib.h

2018-11-24T21:45:58+00:00

Two unrelated lines were extracted from apr_lib.h for the license information. License-Update: Only extract the relevant part from apr_lib.h (From OE-Core rev: 90ab83ecc509c2fdc1f6083d771031decdcaad63) (From OE-Core rev: f7883a0fae697eefffccd56a45e013f24e20ba5c) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842

2018-11-24T21:45:58+00:00

(From OE-Core rev: 0f0db9fc8512a0ecd0cdba3304a195cd925a5029) (From OE-Core rev: b3e92c0c1864cac8c8f6c693ede713a2fc7f2ef5) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: Include the complete license information

2018-11-16T16:33:09+00:00

For some reason, the copyright part was left out of the license information included in LIC_FILES_CHKSUM, preventing it from being used in, e.g., documentation to satisfy the requirements of the license. License-Update: Include the complete license information (From OE-Core rev: 390becd2dcf4fe791ec3715a74e34a46bd457e7a) (From OE-Core rev: 015f65b5c391c75fe96f927a007a8be04db70a63) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: CVE-2018-14618

2018-11-16T16:33:09+00:00

Backport the CVE patch from the upstream https://github.com/curl/curl/commit/57d299a499155d4b327e341c6024e293b0418243.patch https://curl.haxx.se/docs/CVE-2018-14618.html https://nvd.nist.gov/vuln/detail/CVE-2018-14618 (From OE-Core rev: b76903b4b7bfec71be0a8a14e2cab4e2ec852222) (From OE-Core rev: 4c51e82e43cbcc74d9bcabe24b778aae3cf123ca) Signed-off-by: Zhixiong Chi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

curl: extend CVE_PRODUCT

2018-11-16T16:33:08+00:00

There are both "curl" and "libcurl" CPEs in NVD. All "curl" CVEs are now missed in the reports. Hence, switch "CVE_PRODUCT" to a space separated list of the items. (From OE-Core rev: 69ff709c2450c42139fd9705e3a74464221ad754) (From OE-Core rev: 5df0d75fe63a0e1ada396f5ecfa953ac63f65354) Signed-off-by: Grygorii Tertychnyi Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

recipes: Update git.gnome.org addresses after upstream changes

2018-10-18T10:08:53+00:00

git.gnome.org is no more. It has ceased to be. It's an ex-git. Please see here: https://about.gitlab.com/2018/05/31/welcome-gnome-to-gitlab/ Note that gitlab does not support git://, only https:// (and ssh). [Commit message from Alexander Kanavin] (From OE-Core rev: 8382cdc0888ca645a44aacaac1155afb8dcde979) (From OE-Core rev: a6b6af83e344501057b0eb28dce1077992e5a7f3) Signed-off-by: Richard Purdie [Fixup for sumo context] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libcroco: CVE-2017-7961

2018-10-10T12:26:25+00:00

* CVE-2017-7961 The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. CVE: CVE-2017-7961 Ref: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7961 (From OE-Core rev: 9b321cf141c3fa18d5b85f17ffe1710f4555ca49) Signed-off-by: Sinan Kaya Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie