linux/poky.git/meta, branch yocto-5.0.9

build-appliance-image: Update to scarthgap head revision

2025-04-19T21:45:35+00:00

(From OE-Core rev: 04038ecd1edd6592b826665a2b787387bb7074fa) Signed-off-by: Steve Sakoman

openssl: rewrite ptest installation

2025-04-19T21:42:10+00:00

Rewrite (again) the openssl test suite installation. Depend on and reuse already installed libraries and modules instead of installing them twice. Be more selective when installing from the build tree so we don't install intermediate .c .d .o files. This further reduces the size of openssl-dbg from ~120MB to ~18MB. (From OE-Core rev: 8baa0ce7eae65026cb3a784adaf3a4fc724ce9c9) Upstream-Status: Backport[https://git.yoctoproject.org/poky/commit/?id=76212866402edb947f745f837e3c3b98b3056e58] (From OE-Core rev: b3cd05f123625c4c301fee925cdbb9641bc73412) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 76212866402edb947f745f837e3c3b98b3056e58) Signed-off-by: Vishwas Udupa Change-Id: Ifc0e3a019c2abe5142d0f1e359ae5aa33dae1608 Signed-off-by: Steve Sakoman

libarchive: upgrade 3.7.4 -> 3.7.9

2025-04-19T21:42:10+00:00

These is update with only bug and security releases. On top of previous CVE patches, also CVE-2024-48615 is handled. Also many security fixes without CVE assigment are included. Note that upgrade to 3.7.5 on master required fix of test in python3-libarchive-c, however that recipe does not yet have ptest in scarthgap and the fix was in test only, not in productive code, so it is not necessary in scarthgap. Also remove CVE_STATUS which was obsolete already before this upgrade. (From OE-Core rev: f20516a3ed8a39d7e4deddf11dd2acd871894048) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

binutils: patch CVE-2025-1181

2025-04-19T21:42:10+00:00

Import patches from ubuntu: Upstream-Status: Backport [ https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 && https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 Upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 ] (From OE-Core rev: abb575f6ac1f5badae2825f1cb6152379a6658ee) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

binutils: patch CVE-2025-1178 & CVE-2024-57360

2025-04-19T21:42:10+00:00

Backport Fixes for: *CVE-2025-1178 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] *CVE-2024-57360 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=5f8987d3999edb26e757115fe87be55787d510b9] (From OE-Core rev: 15a7f68ce14f635acf9b988fc1958ee625de4e11) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-1176

2025-04-19T21:42:10+00:00

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1176.patch?h=applied/ubuntu/jammy-security Upstream commit https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814] (From OE-Core rev: 8d02a680b415f3145f4a4ef71842f336d8e3513b) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

patch.py: set commituser and commitemail for addNote

2025-04-16T13:41:24+00:00

When PATCHTOOL is set to 'git', and user don't setup user.name and user.email for git, do_patch fail with the following error, fix by passing -c options. CmdError("git notes --ref refs/notes/devtool append -m 'original patch: 0001-PATCH-increase-to-cpp17-version.patch' HEAD", 0, 'stdout: stderr: Author identity unknown *** Please tell me who you are. Run git config --global user.email "you@example.com" git config --global user.name "Your Name" (From OE-Core rev: 9de38ac99c2b19f549c00ea5277faf621c6f4e65) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

ghostscript: upgrade 10.04.0 -> 10.05.0

2025-04-16T13:41:24+00:00

This upgrade addresses CVEs: CVE-2025-27835 CVE-2025-27832 CVE-2025-27831 CVE-2025-27836 CVE-2025-27830 CVE-2025-27833 CVE-2025-27833 CVE-2025-27834 Changelog: https://ghostscript.readthedocs.io/en/gs10.05.0/News.html (From OE-Core rev: 2c851f74fa72c30d447d59d450eb9bc036404f55) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

go: fix CVE-2025-22871

2025-04-16T13:41:24+00:00

Upstream-Status: Backport from https://github.com/golang/go/commit/15e01a2e43ecb8c7e15ff7e9d62fe3f10dcac931 (From OE-Core rev: b343da566856ad17b5dc03d42d9241bcb44cad1b) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

xz: patch CVE-2025-31115

2025-04-16T13:41:24+00:00

Cherry-pick commits from [1] linked from [2] from branch v5.4 [1] https://tukaani.org/xz/xz-cve-2025-31115.patch [2] https://tukaani.org/xz/threaded-decoder-early-free.html (From OE-Core rev: 952ea12f08a4e42f787a21fb98adaf4b17d0aee1) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman