113 files changed, 1287 insertions, 450 deletions

diff --git a/bitbake/bin/bitbake b/bitbake/bin/bitbake
index 09cbb54e8c..c2d0ca7613 100755
--- a/bitbake/bin/bitbake
+++ b/bitbake/bin/bitbake
@@ -27,7 +27,7 @@ from bb.main import bitbake_main, BitBakeConfigParameters, BBMainException
 
 bb.utils.check_system_locale()
 
-__version__ = "2.12.0"
+__version__ = "2.15.0"
 
 if __name__ == "__main__":
     if __version__ != bb.__version__:
diff --git a/bitbake/bin/bitbake-getvar b/bitbake/bin/bitbake-getvar
index 1719824d95..378fb13572 100755
--- a/bitbake/bin/bitbake-getvar
+++ b/bitbake/bin/bitbake-getvar
@@ -10,6 +10,7 @@ import io
 import os
 import sys
 import warnings
+import logging
 warnings.simplefilter("default")
 
 bindir = os.path.dirname(__file__)
@@ -38,6 +39,10 @@ if __name__ == "__main__":
             sys.exit("--flag only makes sense with --value")
 
     quiet = args.quiet or args.value
+    if quiet:
+        logger = logging.getLogger("BitBake")
+        logger.setLevel(logging.WARNING)
+
     with bb.tinfoil.Tinfoil(tracking=True, setup_logging=not quiet) as tinfoil:
         if args.recipe:
             tinfoil.prepare(quiet=3 if quiet else 2)
diff --git a/bitbake/lib/bb/__init__.py b/bitbake/lib/bb/__init__.py
index c95c91a4cb..62ceaaef6e 100644
--- a/bitbake/lib/bb/__init__.py
+++ b/bitbake/lib/bb/__init__.py
@@ -9,7 +9,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 
-__version__ = "2.12.0"
+__version__ = "2.15.0"
 
 import sys
 if sys.version_info < (3, 9, 0):
diff --git a/bitbake/lib/bb/event.py b/bitbake/lib/bb/event.py
index a12adbc937..b29f0a5568 100644
--- a/bitbake/lib/bb/event.py
+++ b/bitbake/lib/bb/event.py
@@ -431,6 +431,16 @@ class RecipeEvent(Event):
         self.fn = fn
         Event.__init__(self)
 
+class RecipePreDeferredInherits(RecipeEvent):
+    """
+    Called before deferred inherits are processed so code can snoop on class extensions for example
+    Limitations: It won't see inherits of inherited classes and the data is unexpanded
+    """
+    def __init__(self, fn, inherits):
+        self.fn = fn
+        self.inherits = inherits
+        Event.__init__(self)
+
 class RecipePreFinalise(RecipeEvent):
     """ Recipe Parsing Complete but not yet finalised"""
 
diff --git a/bitbake/lib/bb/parse/ast.py b/bitbake/lib/bb/parse/ast.py
index 290ed45048..ea1096f2de 100644
--- a/bitbake/lib/bb/parse/ast.py
+++ b/bitbake/lib/bb/parse/ast.py
@@ -340,9 +340,7 @@ class InheritDeferredNode(AstNode):
         self.inherit = (classes, filename, lineno)
 
     def eval(self, data):
-        inherits = data.getVar('__BBDEFINHERITS', False) or []
-        inherits.append(self.inherit)
-        data.setVar('__BBDEFINHERITS', inherits)
+        bb.parse.BBHandler.inherit_defer(*self.inherit, data)
 
 class AddFragmentsNode(AstNode):
     def __init__(self, filename, lineno, fragments_path_prefix, fragments_variable, flagged_variables_list_variable):
@@ -471,6 +469,17 @@ def finalize(fn, d, variant = None):
         if d.getVar("_FAILPARSINGERRORHANDLED", False) == True:
             raise bb.BBHandledException()
 
+        inherits = [x[0] for x in (d.getVar('__BBDEFINHERITS', False) or [('',)])]
+        bb.event.fire(bb.event.RecipePreDeferredInherits(fn, inherits), d)
+
+        while True:
+            inherits = d.getVar('__BBDEFINHERITS', False) or []
+            if not inherits:
+                break
+            inherit, filename, lineno = inherits.pop(0)
+            d.setVar('__BBDEFINHERITS', inherits)
+            bb.parse.BBHandler.inherit(inherit, filename, lineno, d, deferred=True)
+
         for var in d.getVar('__BBHANDLERS', False) or []:
             # try to add the handler
             handlerfn = d.getVarFlag(var, "filename", False)
@@ -525,14 +534,6 @@ def multi_finalize(fn, d):
         logger.debug("Appending .bbappend file %s to %s", append, fn)
         bb.parse.BBHandler.handle(append, d, True)
 
-    while True:
-        inherits = d.getVar('__BBDEFINHERITS', False) or []
-        if not inherits:
-            break
-        inherit, filename, lineno = inherits.pop(0)
-        d.setVar('__BBDEFINHERITS', inherits)
-        bb.parse.BBHandler.inherit(inherit, filename, lineno, d, deferred=True)
-
     onlyfinalise = d.getVar("__ONLYFINALISE", False)
 
     safe_d = d
@@ -568,7 +569,7 @@ def multi_finalize(fn, d):
                 d.setVar("BBEXTENDVARIANT", variantmap[name])
             else:
                 d.setVar("PN", "%s-%s" % (pn, name))
-            bb.parse.BBHandler.inherit(extendedmap[name], fn, 0, d)
+            bb.parse.BBHandler.inherit_defer(extendedmap[name], fn, 0, d)
 
         safe_d.setVar("BBCLASSEXTEND", extended)
         _create_variants(datastores, extendedmap.keys(), extendfunc, onlyfinalise)
diff --git a/bitbake/lib/bb/parse/parse_py/BBHandler.py b/bitbake/lib/bb/parse/parse_py/BBHandler.py
index 4bdb11994f..008fec2308 100644
--- a/bitbake/lib/bb/parse/parse_py/BBHandler.py
+++ b/bitbake/lib/bb/parse/parse_py/BBHandler.py
@@ -42,12 +42,22 @@ def supports(fn, d):
     """Return True if fn has a supported extension"""
     return os.path.splitext(fn)[-1] in [".bb", ".bbclass", ".inc"]
 
+def inherit_defer(expression, fn, lineno, d):
+    inherit = (expression, fn, lineno)
+    inherits = d.getVar('__BBDEFINHERITS', False) or []
+    inherits.append(inherit)
+    d.setVar('__BBDEFINHERITS', inherits)
+
 def inherit(files, fn, lineno, d, deferred=False):
     __inherit_cache = d.getVar('__inherit_cache', False) or []
     #if "${" in files and not deferred:
     #    bb.warn("%s:%s has non deferred conditional inherit" % (fn, lineno))
     files = d.expand(files).split()
     for file in files:
+        defer = (d.getVar("BB_DEFER_BBCLASSES") or "").split()
+        if not deferred and file in defer:
+            inherit_defer(file, fn, lineno, d)
+            continue
         classtype = d.getVar("__bbclasstype", False)
         origfile = file
         for t in ["classes-" + classtype, "classes"]:
diff --git a/documentation/ref-manual/index.rst b/documentation/ref-manual/index.rst
index a746dde492..53fa98cc99 100644
--- a/documentation/ref-manual/index.rst
+++ b/documentation/ref-manual/index.rst
@@ -11,6 +11,7 @@ Yocto Project Reference Manual
    :numbered:
 
    system-requirements
+   yocto-project-supported-features
    terms
    release-process
    structure
diff --git a/documentation/ref-manual/yocto-project-supported-features.rst b/documentation/ref-manual/yocto-project-supported-features.rst
new file mode 100644
index 0000000000..bc1a813938
--- /dev/null
+++ b/documentation/ref-manual/yocto-project-supported-features.rst
@@ -0,0 +1,263 @@
+.. SPDX-License-Identifier: CC-BY-SA-2.0-UK
+
+**************************************************
+Yocto Project Supported Architectures And Features
+**************************************************
+
+The Yocto Project is putting continuous efforts into testing the changes made to
+the :term:`OpenEmbedded-Core (OE-Core)` metadata and core tools. The details on
+how this test environment functions is described in the
+:doc:`/test-manual/index`.
+
+These tests are also run for stable and :term:`LTS` versions of the Yocto
+Project. See the :doc:`/ref-manual/release-process` section of the Yocto Project
+Reference Manual for more information on these types of releases.
+
+The infrastructure behind the test environment is the
+:ref:`Yocto Project Autobuilder <test-manual/intro:Yocto Project Autobuilder
+Overview>`. The Autobuilder contains a set of Builders that are associated to an
+architecture or a feature to test. For example, the ``qemuarm64`` builder
+corresponds to testing the ARM 64-bit architecture.
+
+Below is a comprehensive list of target architectures and features that are
+supported, as well as their level of support. For each architecture or feature,
+their corresponding builders are also listed.
+
+Primary Supported
+=================
+
+The term "primary" means that dedicated builds for these architectures or
+features are being run on a daily basis on the Yocto Project Autobuilder and
+also tested with incoming changes before they merge. These changes are usually
+on the "-next" Git branches of the :term:`OpenEmbedded-Core (OE-Core)`
+repositories.
+
+Below is a list of primary tested features, their maintainer(s) and builder(s):
+
+.. list-table::
+   :widths: 20 20 20 40
+   :header-rows: 1
+
+   * - Feature
+     - Description
+     - Maintainer(s)
+     - Builder(s)
+   * - :wikipedia:`ARM <ARM_architecture_family>`
+     - ARM architecture testing
+     - Collective effort
+     - genericarm64,
+       genericarm64-alt,
+       musl-qemuarm64,
+       qemuarm,
+       qemuarm-alt,
+       qemuarm-oecore,
+       qemuarm-tc,
+       qemuarm64,
+       qemuarm64-alt,
+       qemuarm64-armhost,
+       qemuarm64-ltp,
+       qemuarm64-ptest,
+       qemuarm64-tc,
+       qemuarmv5
+   * - :yocto_git:`Beaglebone </poky/tree/meta-yocto-bsp/conf/machine/beaglebone-yocto.conf>`
+     - Beaglebone image and SDK build testing
+     - Collective effort
+     - beaglebone,
+       beaglebone-alt
+   * - :doc:`Reproducible </test-manual/reproducible-builds>`
+     - reproducibility testing
+     - Collective effort
+     - reproducible
+   * - :term:`Buildtools`
+     - Buildtools generation
+     - Collective effort
+     - buildtools
+   * - `meta-agl-core <https://gerrit.automotivelinux.org/gerrit/AGL/meta-agl>`__
+     - meta-agl-core layer testing
+     - TBD
+     - meta-agl-core
+   * - `meta-arm <https://git.yoctoproject.org/meta-arm>`__
+     - meta-arm layer testing
+     - TBD
+     - meta-arm
+   * - `meta-aws <https://github.com/aws4embeddedlinux/meta-aws>`__
+     - meta-aws layer testing
+     - TBD
+     - meta-aws
+   * - `meta-intel <https://git.yoctoproject.org/meta-intel>`__
+     - meta-intel layer testing
+     - TBD
+     - meta-intel
+   * - `meta-virtualization <https://git.yoctoproject.org/meta-virtualization/>`__
+     - meta-virtualization layer testing
+     - TBD
+     - meta-virt
+   * - :ref:`Multilib <dev-manual/libraries:Combining Multiple Versions of Library Files into One Image>`
+     - Multilib feature testing
+     - Collective effort
+     - multilib
+   * - :term:`OpenEmbedded-Core selftest<OpenEmbedded-Core (OE-Core)>`
+     - OpenEmbedded-Core layers selftests
+     - Collective effort
+     - oe-selftest-fedora,
+       oe-selftest-debian,
+       oe-selftest-armhost
+   * - Package managers
+     - Package managers (RPM, DEB and IPK formats) testing in the
+       :term:`OpenEmbedded Build System` (different from the
+       ``package-management`` :term:`image feature <IMAGE_FEATURES>`)
+     - Collective effort
+     - pkgman-non-rpm (other builders use RPM by default)
+   * - :ref:`Patchtest <contributor-guide/submit-changes:Validating Patches with Patchtest>`
+     - Patchtest tool selftests
+     - TBD
+     - patchtest-selftest
+   * - :wikipedia:`RISC-V (64-bit) <RISC-V>`
+     - RISC-V architecture testing (64-bit)
+     - Collective effort
+     - qemuriscv64,
+       qemuriscv64-ptest,
+       qemuriscv64-tc
+   * - :wikipedia:`systemd <Systemd>`
+     - Systemd init manager testing
+     - Collective effort
+     - no-x11, qa-extras2
+   * - :term:`Toaster`
+     - Toaster web interface testing
+     - Collective effort
+     - toaster
+   * - :ref:`Wic <dev-manual/wic:creating partitioned images using wic>`
+     - WIC image creation testing
+     - Collective effort
+     - wic
+   * - :wikipedia:`X86 <X86>`
+     - X86 architecture testing
+     - Collective effort
+     - genericx86,
+       genericx86-64,
+       genericx86-64-alt,
+       genericx86-alt,
+       musl-qemux86,
+       musl-qemux86-64,
+       qemux86,
+       qemux86-64,
+       qemux86-64-alt,
+       qemux86-64-ltp,
+       qemux86-64-ptest,
+       qemux86-64-tc,
+       qemux86-64-x32,
+       qemux86-alt,
+       qemux86-tc,
+       qemux86-world,
+       qemux86-world-alt
+
+Secondary Supported
+===================
+
+The term "secondary" means that in some cases there is code/feature/support
+which is desired by people using the project and is in the project's interests
+to support, however there isn't wide enough interest and support to justify
+testing all incoming changes on it. There are however project member
+organisations and maintainers willing to run tests and review fixes.
+
+This category may be applicable as support/usage in an area develops and grows,
+or as support/usage fades but we continue to have tests. It can also apply where
+resourcing isn't available for full primary support but there is
+member/maintainer support for running tests.
+
+We therefore have the following criteria and policies for such items:
+
+-  It can be clearly isolated and defined by specific configuration.
+
+-  There is a clear documented group of maintainers agreeing to maintain it.
+
+-  Those maintainers are active and responsive.
+
+-  It is being actively and publicly tested (potentially using
+   the :ref:`Autobuilder <test-manual/intro:Yocto Project Autobuilder Overview>`
+   by agreement, or otherwise).
+
+-  Testing would not be part of standard incoming change testing and regressions
+   would not block incoming patches.
+
+-  The :yocto_wiki:`SWAT </Yocto_Build_Failure_Swat_Team>` team would not handle
+   any test builds on the Autobuilder.
+
+-  Test results can be submitted as part of the release process if desired.
+
+The Yocto Project :oe_wiki:`Technical Steering Committee (TSC) </TSC>` makes
+decisions on features in this status and Autobuilder testing. Such support would
+be dropped if the maintainers/testing were inactive.
+
+If you are interested in providing resources for improving testing please
+contact the :oe_wiki:`Technical Steering Committee (TSC) </TSC>`.
+
+Below is a list of secondary tested features, their maintainer(s) and
+builder(s):
+
+.. list-table::
+   :widths: 20 20 20 40
+   :header-rows: 1
+
+   * - Feature
+     - Description
+     - Maintainer(s)
+     - Builder(s)
+   * - :wikipedia:`PowerPC (32-bit) <PowerPC>`
+     - PowerPC architecture testing (32-bit)
+     - TBD
+     - qemuppc,
+       qemuppc-alt,
+       qemuppc-tc
+   * - :oe_git:`meta-openembedded </meta-openembedded>`
+     - meta-openembedded layer testing
+     - TBD
+     - meta-oe
+   * - `meta-mingw <https://git.yoctoproject.org/meta-mingw>`__
+     - mingw based SDKs testing
+     - TBD
+     - meta-mingw
+   * - `meta-webosose <https://github.com/webosose/meta-webosose>`__
+     - meta-webosose layer testing
+     - TBD
+     - meta-webosose
+   * - :wikipedia:`RISC-V (32-bit) <RISC-V>`
+     - RISC-V architecture testing (32-bit)
+     - Collective effort
+     - qemuriscv32,
+       qemuriscv32,
+       qemuriscv32-tc
+
+Untested
+========
+
+"Untested" means that whilst the configurations are present in the project, we
+don't currently run the tests on any regular basis and new changes are not
+tested against them. We may take patches in these areas if they make sense but
+it is on a best effort only basis.
+
+.. list-table::
+   :widths: 20 20 20 40
+   :header-rows: 1
+
+   * - Feature
+     - Description
+     - Maintainer(s)
+     - Builder(s)
+   * - `meta-exein <https://github.com/exein-io/meta-exein>`__
+     - meta-exein layer testing
+     - TBD
+     - meta-exein
+   * - :wikipedia:`MIPS <MIPS_architecture>`
+     - MIPS architecture testing
+     - No maintainers
+     - qemumips,
+       qemumips64,
+       qemumips-alt,
+       qemumips-tc,
+       qemumips64-tc
+   * - :wikipedia:`PowerPC (64-bit) <PowerPC>`
+     - PowerPC architecture testing (64-bit)
+     - No maintainers
+     - qemuppc64,
+       qemuppc64-tc
diff --git a/meta-selftest/recipes-test/images/wic-image-minimal.wks b/meta-selftest/recipes-test/images/wic-image-minimal.wks
index ae69cb6e3c..4186b16517 100644
--- a/meta-selftest/recipes-test/images/wic-image-minimal.wks
+++ b/meta-selftest/recipes-test/images/wic-image-minimal.wks
@@ -2,7 +2,7 @@
 # long-description: This image contains boot partition and 3 rootfs partitions
 # created from core-image-minimal and wic-image-minimal image recipes.
 
-part /boot --source bootimg-pcbios --ondisk sda --label boot --active --align 1024
+part /boot --source bootimg_pcbios --ondisk sda --label boot --active --align 1024
 part / --source rootfs --ondisk sda --fstype=ext4 --label platform --align 1024 --use-uuid
 part /media --source rootfs --rootfs-dir=wic-image-minimal --ondisk sda --fstype=ext4 --label uuid-test --align 1024 --use-uuid --fsuuid 2c71ef06-a81d-4735-9d3a-379b69c6bdba
 part /mnt --source rootfs --rootfs-dir=wic-image-minimal --ondisk sda --fstype=ext4 --label core --align 1024
diff --git a/meta-selftest/wic/overlayfs_etc.wks.in b/meta-selftest/wic/overlayfs_etc.wks.in
index 066cd35b15..8375d73a9c 100644
--- a/meta-selftest/wic/overlayfs_etc.wks.in
+++ b/meta-selftest/wic/overlayfs_etc.wks.in
@@ -1,4 +1,4 @@
-part /boot --active --source bootimg-biosplusefi --ondisk sda --sourceparams="loader=grub-efi" --align 1024
+part /boot --active --source bootimg_biosplusefi --ondisk sda --sourceparams="loader=grub-efi" --align 1024
 part / --source rootfs --ondisk sda --fstype=${OVERLAYFS_ROOTFS_TYPE} --use-uuid --align 1024
 part --ondisk sda --fstype=ext4 --size=5 --align 1024
 bootloader --ptable gpt --timeout=1 --append="rootfstype=${OVERLAYFS_ROOTFS_TYPE} console=ttyS0,115200 console=tty0 ${OVERLAYFS_INIT_OPTION}"
diff --git a/meta-selftest/wic/test_biosplusefi_plugin.wks b/meta-selftest/wic/test_biosplusefi_plugin.wks
index 5a56c84518..4be6643a6f 100644
--- a/meta-selftest/wic/test_biosplusefi_plugin.wks
+++ b/meta-selftest/wic/test_biosplusefi_plugin.wks
@@ -1,6 +1,6 @@
 # short-description: This file is used in oe-selftest wic module to test biosplusefi plugin
 
-part /boot --source bootimg-biosplusefi --sourceparams="loader=grub-efi" --active --align 1024 --use-uuid
+part /boot --source bootimg_biosplusefi --sourceparams="loader=grub-efi" --active --align 1024 --use-uuid
 part / --source rootfs --fstype=ext4 --align 1024 --use-uuid
 
 bootloader  --timeout=0 --append="console=ttyS0,115200n8"
diff --git a/meta-selftest/wic/test_efi_plugin.wks b/meta-selftest/wic/test_efi_plugin.wks
index e876a4be0e..f75e0f0e0b 100644
--- a/meta-selftest/wic/test_efi_plugin.wks
+++ b/meta-selftest/wic/test_efi_plugin.wks
@@ -1,5 +1,5 @@
 # short-description: This file is used in oe-selftest wic module to test efi plugin
-part /boot --source bootimg-efi --sourceparams="loader=systemd-boot" --active --align 1024 --use-uuid
+part /boot --source bootimg_efi --sourceparams="loader=systemd-boot" --active --align 1024 --use-uuid
 part / --source rootfs --fstype=ext4 --align 1024 --use-uuid --label root
 
 bootloader  --timeout=0 --append="console=ttyS0,115200n8"
diff --git a/meta-selftest/wic/test_efi_plugin_plain_systemd-boot.wks b/meta-selftest/wic/test_efi_plugin_plain_systemd-boot.wks
index 83f136ac15..3a58c8137c 100644
--- a/meta-selftest/wic/test_efi_plugin_plain_systemd-boot.wks
+++ b/meta-selftest/wic/test_efi_plugin_plain_systemd-boot.wks
@@ -1,5 +1,5 @@
 # short-description: This file is used in oe-selftest wic module to test efi plugin
-part /boot --source bootimg-efi --sourceparams="loader=systemd-boot,initrd=${INITRAMFS_IMAGE}-${MACHINE}.${INITRAMFS_FSTYPES}" --active --align 1024 --use-uuid
+part /boot --source bootimg_efi --sourceparams="loader=systemd-boot,initrd=${INITRAMFS_IMAGE}-${MACHINE}.${INITRAMFS_FSTYPES}" --active --align 1024 --use-uuid
 part / --source rootfs --fstype=ext4 --align 1024 --use-uuid
 
 bootloader  --timeout=0
diff --git a/meta-selftest/wic/test_rawcopy_plugin.wks.in b/meta-selftest/wic/test_rawcopy_plugin.wks.in
index a865dd1d32..ba324d9980 100644
--- a/meta-selftest/wic/test_rawcopy_plugin.wks.in
+++ b/meta-selftest/wic/test_rawcopy_plugin.wks.in
@@ -1,6 +1,6 @@
 # short-description: This file is used in oe-selftest wic module to test rawcopy plugin
 
-part /boot --active --source bootimg-pcbios
+part /boot --active --source bootimg_pcbios
 part / --source rawcopy --sourceparams="file=${IMAGE_LINK_NAME_CORE_IMAGE_MINIMAL}.ext4" --use-uuid
 
 bootloader  --timeout=0 --append="console=ttyS0,115200n8"
diff --git a/meta-selftest/wic/test_uefikernel.wks b/meta-selftest/wic/test_uefikernel.wks
index bede2288f6..9bc4813dfa 100644
--- a/meta-selftest/wic/test_uefikernel.wks
+++ b/meta-selftest/wic/test_uefikernel.wks
@@ -1,5 +1,5 @@
 # short-description: This file is used in oe-selftest wic module to test uefi-kernel loader
 
-part /boot --source bootimg-efi --sourceparams="loader=uefi-kernel"
+part /boot --source bootimg_efi --sourceparams="loader=uefi-kernel"
 part / --source rootfs --fstype=ext4 --align 1024 --use-uuid
 
diff --git a/meta-yocto-bsp/wic/beaglebone-yocto.wks b/meta-yocto-bsp/wic/beaglebone-yocto.wks
index 7a28fb23dc..335e2b9bd5 100644
--- a/meta-yocto-bsp/wic/beaglebone-yocto.wks
+++ b/meta-yocto-bsp/wic/beaglebone-yocto.wks
@@ -2,6 +2,6 @@
 # long-description: Creates a partitioned SD card image for Beaglebone.
 # Boot files are located in the first vfat partition.
 
-part /boot --source bootimg-partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4 --fixed-size 32 --sourceparams="loader=u-boot" --use-uuid
+part /boot --source bootimg_partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4 --fixed-size 32 --sourceparams="loader=u-boot" --use-uuid
 part / --source rootfs --ondisk mmcblk0 --fstype=ext4 --label root --align 4 --use-uuid
 bootloader --append="console=ttyS0,115200"
diff --git a/meta-yocto-bsp/wic/genericarm64.wks.in b/meta-yocto-bsp/wic/genericarm64.wks.in
index ee7da87ded..52ee8147fa 100644
--- a/meta-yocto-bsp/wic/genericarm64.wks.in
+++ b/meta-yocto-bsp/wic/genericarm64.wks.in
@@ -2,7 +2,7 @@
 # long-description: Creates a partitioned EFI disk image that the user
 # can directly dd to boot media.
 
-part /boot --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${INITRAMFS_IMAGE}-${MACHINE}.${INITRAMFS_FSTYPES}" --label boot --active --align 1024 --use-uuid
+part /boot --source bootimg_efi --sourceparams="loader=${EFI_PROVIDER},initrd=${INITRAMFS_IMAGE}-${MACHINE}.${INITRAMFS_FSTYPES}" --label boot --active --align 1024 --use-uuid
 
 part swap --size 44 --label swap --fstype=swap --use-uuid
 
diff --git a/meta-yocto-bsp/wic/genericx86.wks.in b/meta-yocto-bsp/wic/genericx86.wks.in
index 7c09ad00a1..f75ae9adac 100644
--- a/meta-yocto-bsp/wic/genericx86.wks.in
+++ b/meta-yocto-bsp/wic/genericx86.wks.in
@@ -1,6 +1,6 @@
 # short-description: Create an EFI disk image for genericx86*
 # long-description: Creates a partitioned EFI disk image for genericx86* machines
-part /boot --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}" --ondisk sda --label msdos --active --align 1024
+part /boot --source bootimg_efi --sourceparams="loader=${EFI_PROVIDER}" --ondisk sda --label msdos --active --align 1024
 part / --source rootfs --ondisk sda --fstype=ext4 --label platform --align 1024 --use-uuid
 part swap --ondisk sda --size 44 --label swap1 --fstype=swap
 
diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
index 8215969c7b..e55a538e36 100644
--- a/meta/classes-global/base.bbclass
+++ b/meta/classes-global/base.bbclass
@@ -19,6 +19,21 @@ PACKAGECONFIG_CONFARGS ??= ""
 
 inherit metadata_scm
 
+PREFERRED_TOOLCHAIN_TARGET ??= "gcc"
+PREFERRED_TOOLCHAIN_NATIVE ??= "gcc"
+PREFERRED_TOOLCHAIN_SDK ??= "gcc"
+
+PREFERRED_TOOLCHAIN = "${PREFERRED_TOOLCHAIN_TARGET}"
+PREFERRED_TOOLCHAIN:class-native = "${PREFERRED_TOOLCHAIN_NATIVE}"
+PREFERRED_TOOLCHAIN:class-cross = "${PREFERRED_TOOLCHAIN_NATIVE}"
+PREFERRED_TOOLCHAIN:class-crosssdk = "${PREFERRED_TOOLCHAIN_SDK}"
+PREFERRED_TOOLCHAIN:class-nativesdk = "${PREFERRED_TOOLCHAIN_SDK}"
+
+TOOLCHAIN ??= "${PREFERRED_TOOLCHAIN}"
+
+inherit toolchain/gcc-native
+inherit_defer toolchain/${TOOLCHAIN}
+
 def lsb_distro_identifier(d):
     adjust = d.getVar('LSB_DISTRO_ADJUST')
     adjust_func = None
@@ -267,10 +282,19 @@ def buildcfg_neededvars(d):
         bb.fatal('The following variable(s) were not set: %s\nPlease set them directly, or choose a MACHINE or DISTRO that sets them.' % ', '.join(pesteruser))
 
 addhandler base_eventhandler
-base_eventhandler[eventmask] = "bb.event.ConfigParsed bb.event.MultiConfigParsed bb.event.BuildStarted bb.event.RecipePreFinalise bb.event.RecipeParsed"
+base_eventhandler[eventmask] = "bb.event.ConfigParsed bb.event.MultiConfigParsed bb.event.BuildStarted bb.event.RecipePreFinalise bb.event.RecipeParsed bb.event.RecipePreDeferredInherits"
 python base_eventhandler() {
     import bb.runqueue
 
+    if isinstance(e, bb.event.RecipePreDeferredInherits):
+        # Use this to snoop on class extensions and set these up before the deferred inherits
+        # are processed which allows overrides on conditional variables.
+        for c in ['native', 'nativesdk', 'crosssdk', 'cross']:
+            if c in e.inherits:
+                d.setVar('CLASSOVERRIDE', 'class-' + c)
+                break
+        return
+
     if isinstance(e, bb.event.ConfigParsed):
         if not d.getVar("NATIVELSBSTRING", False):
             d.setVar("NATIVELSBSTRING", lsb_distro_identifier(d))
diff --git a/meta/classes-global/insane.bbclass b/meta/classes-global/insane.bbclass
index eb8591f624..c45650291f 100644
--- a/meta/classes-global/insane.bbclass
+++ b/meta/classes-global/insane.bbclass
@@ -832,7 +832,7 @@ def package_qa_check_rdepends(pkg, pkgdest, skip, taskdeps, packages, d):
                 return False
 
             for rdepend in rdepends:
-                if "-dbg" in rdepend and "debug-deps" not in skip:
+                if rdepend.endswith("-dbg") and "debug-deps" not in skip:
                     error_msg = "%s rdepends on %s" % (pkg,rdepend)
                     oe.qa.handle_error("debug-deps", error_msg, d)
                 if (not "-dev" in pkg and not "-staticdev" in pkg) and rdepend.endswith("-dev") and "dev-deps" not in skip:
diff --git a/meta/classes-recipe/crosssdk.bbclass b/meta/classes-recipe/crosssdk.bbclass
index 824b1bcff4..3541c2c393 100644
--- a/meta/classes-recipe/crosssdk.bbclass
+++ b/meta/classes-recipe/crosssdk.bbclass
@@ -4,6 +4,7 @@
 # SPDX-License-Identifier: MIT
 #
 
+BB_DEFER_BBCLASSES:remove = "cross"
 inherit cross
 
 CLASSOVERRIDE = "class-crosssdk"
diff --git a/meta/classes/toaster.bbclass b/meta/classes/toaster.bbclass
index 03c4f3a930..af7c457808 100644
--- a/meta/classes/toaster.bbclass
+++ b/meta/classes/toaster.bbclass
@@ -84,7 +84,7 @@ python toaster_layerinfo_dumpdata() {
 
     llayerinfo = {}
 
-    for layer in { l for l in bblayers.strip().split(" ") if len(l) }:
+    for layer in { l for l in bblayers.strip().split() if len(l) }:
         llayerinfo[layer] = _get_layer_dict(layer)
 
 
diff --git a/meta/conf/toolchain/clang.inc b/meta/classes/toolchain/clang.bbclass
index 8a0a2c315a..d7b8a3657c 100644
--- a/meta/conf/toolchain/clang.inc
+++ b/meta/classes/toolchain/clang.bbclass
@@ -14,15 +14,18 @@ STRINGS = "${HOST_PREFIX}llvm-strings"
 NM = "${HOST_PREFIX}llvm-nm"
 READELF = "${HOST_PREFIX}llvm-readelf"
 
-PREFERRED_PROVIDER_virtual/cross-cc = "${MLPREFIX}clang-cross-${TARGET_ARCH}"
-PREFERRED_PROVIDER_virtual/cross-c++ = "${MLPREFIX}clang-cross-${TARGET_ARCH}"
-PREFERRED_PROVIDER_virtual/compilerlibs = "gcc-runtime"
-PREFERRED_PROVIDER_virtual/cross-cc:class-nativesdk = "clang-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/cross-c++:class-nativesdk = "clang-crosssdk-${SDK_SYS}"
-
-PREFERRED_PROVIDER_virtual/nativesdk-cross-cc = "clang-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/nativesdk-cross-c++ = "clang-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/nativesdk-compilerlibs = "nativesdk-gcc-runtime"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-cc = "${MLPREFIX}clang-cross-${TARGET_ARCH}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-c++ = "${MLPREFIX}clang-cross-${TARGET_ARCH}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}compilerlibs = "${MLPREFIX}gcc-runtime"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-cc:class-nativesdk = "clang-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-c++:class-nativesdk = "clang-crosssdk-${SDK_SYS}"
+
+PREFERRED_PROVIDER_virtual/nativesdk-cross-cc:class-crosssdk = "clang-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-cross-c++:class-crosssdk = "clang-crosssdk-${SDK_SYS}"
+
+PREFERRED_PROVIDER_virtual/nativesdk-cross-cc:class-cross-canadian = "clang-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-cross-c++:class-cross-canadian = "clang-crosssdk-${SDK_SYS}"
+
 
 BASE_DEFAULT_DEPS:append:class-target = " compiler-rt"
 
diff --git a/meta/conf/toolchain/build-gcc.inc b/meta/classes/toolchain/gcc-native.bbclass
index a708bd0389..a708bd0389 100644
--- a/meta/conf/toolchain/build-gcc.inc
+++ b/meta/classes/toolchain/gcc-native.bbclass
diff --git a/meta/classes/toolchain/gcc.bbclass b/meta/classes/toolchain/gcc.bbclass
new file mode 100644
index 0000000000..a5adb5ca37
--- /dev/null
+++ b/meta/classes/toolchain/gcc.bbclass
@@ -0,0 +1,33 @@
+CC = "${CCACHE}${HOST_PREFIX}gcc ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
+CXX = "${CCACHE}${HOST_PREFIX}g++ ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
+FC = "${HOST_PREFIX}gfortran ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
+CPP = "${HOST_PREFIX}gcc -E${TOOLCHAIN_OPTIONS} ${HOST_CC_ARCH}"
+LD = "${HOST_PREFIX}ld${TOOLCHAIN_OPTIONS} ${HOST_LD_ARCH}"
+CCLD = "${CC}"
+AR = "${HOST_PREFIX}gcc-ar"
+AS = "${HOST_PREFIX}as ${HOST_AS_ARCH}"
+RANLIB = "${HOST_PREFIX}gcc-ranlib"
+STRIP = "${HOST_PREFIX}strip"
+OBJCOPY = "${HOST_PREFIX}objcopy"
+OBJDUMP = "${HOST_PREFIX}objdump"
+STRINGS = "${HOST_PREFIX}strings"
+NM = "${HOST_PREFIX}gcc-nm"
+READELF = "${HOST_PREFIX}readelf"
+
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-cc = "${MLPREFIX}gcc-cross-${TARGET_ARCH}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-c++ = "${MLPREFIX}gcc-cross-${TARGET_ARCH}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}compilerlibs = "${MLPREFIX}gcc-runtime"
+
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-cc:class-nativesdk = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}cross-c++:class-nativesdk = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/${MLPREFIX}compilerlibs:class-nativesdk = "nativesdk-gcc-runtime"
+
+PREFERRED_PROVIDER_virtual/nativesdk-cross-cc:class-crosssdk = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-cross-c++:class-crosssdk = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-compilerlibs:class-crosssdk = "nativesdk-gcc-runtime"
+
+PREFERRED_PROVIDER_virtual/nativesdk-cross-cc:class-cross-canadian = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-cross-c++:class-cross-canadian = "gcc-crosssdk-${SDK_SYS}"
+PREFERRED_PROVIDER_virtual/nativesdk-compilerlibs:class-cross-canadian = "nativesdk-gcc-runtime"
+
+TCOVERRIDE = "toolchain-gcc"
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index e600d9d774..54d6bebc39 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -834,9 +834,6 @@ include conf/licenses.conf
 require conf/sanity.conf
 include conf/bblock.conf
 
-require toolchain/gcc.inc
-require toolchain/build-gcc.inc
-
 ##################################################################
 # Weak variables (usually to retain backwards compatibility)
 ##################################################################
@@ -950,6 +947,8 @@ BB_DEFAULT_UMASK ??= "022"
 BB_CONSOLELOG ?= "${LOG_DIR}/cooker/${MACHINE}/${DATETIME}.log"
 BB_DEFAULT_EVENTLOG ?= "${LOG_DIR}/eventlog/${DATETIME}.json"
 
+BB_DEFER_BBCLASSES = "native nativesdk cross crosssdk"
+
 # Setup our default hash policy
 BB_SIGNATURE_HANDLER ?= "OEBasicHash"
 BB_HASHEXCLUDE_COMMON ?= "TMPDIR FILE PATH PWD BB_TASKHASH BBPATH BBSERVER DL_DIR \
@@ -987,11 +986,3 @@ MULTILIB_VARIANTS ??= ""
 # support unihashes.
 BB_UNIHASH ?= "${BB_TASKHASH}"
 
-oe.sstatesig.find_sstate_manifest[vardepsexclude] = "BBEXTENDCURR BBEXTENDVARIANT OVERRIDES PACKAGE_EXTRA_ARCHS"
-oe.utils.get_multilib_datastore[vardepsexclude] = "DEFAULTTUNE_MULTILIB_ORIGINAL OVERRIDES"
-oe.path.format_display[vardepsexclude] = "TOPDIR"
-oe.utils.get_bb_number_threads[vardepsexclude] = "BB_NUMBER_THREADS"
-oe.package.save_debugsources_info[vardepsexclude] = "BB_NUMBER_THREADS"
-oe.package.read_debugsources_info[vardepsexclude] = "BB_NUMBER_THREADS"
-oe.packagedata.emit_pkgdata[vardepsexclude] = "BB_NUMBER_THREADS"
-oe.packagedata.read_subpkgdata_extended[vardepsexclude] = "BB_NUMBER_THREADS"
diff --git a/meta/conf/distro/include/default-distrovars.inc b/meta/conf/distro/include/default-distrovars.inc
index 85835c4c61..9ea3b5414c 100644
--- a/meta/conf/distro/include/default-distrovars.inc
+++ b/meta/conf/distro/include/default-distrovars.inc
@@ -36,6 +36,7 @@ COMMERCIAL_VIDEO_PLUGINS ?= ""
 # COMMERCIAL_VIDEO_PLUGINS ?= "gst-plugins-ugly-mpeg2dec gst-plugins-ugly-mpegstream gst-plugins-bad-mpegvideoparse"
 # Set of common licenses used for license.bbclass
 COMMON_LICENSE_DIR ??= "${COREBASE}/meta/files/common-licenses"
+LICENSE_PATH ??= ""
 
 BB_GENERATE_MIRROR_TARBALLS ??= "0"
 
diff --git a/meta/conf/sanity.conf b/meta/conf/sanity.conf
index 6d3911ff94..3692007e96 100644
--- a/meta/conf/sanity.conf
+++ b/meta/conf/sanity.conf
@@ -3,7 +3,7 @@
 # See sanity.bbclass
 #
 # Expert users can confirm their sanity with "touch conf/sanity.conf"
-BB_MIN_VERSION = "2.12.0"
+BB_MIN_VERSION = "2.15.0"
 
 SANITY_ABIFILE = "${TMPDIR}/abi_version"
 
diff --git a/meta/conf/toolchain/gcc.inc b/meta/conf/toolchain/gcc.inc
deleted file mode 100644
index 75f9abe999..0000000000
--- a/meta/conf/toolchain/gcc.inc
+++ /dev/null
@@ -1,27 +0,0 @@
-CC = "${CCACHE}${HOST_PREFIX}gcc ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
-CXX = "${CCACHE}${HOST_PREFIX}g++ ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
-FC = "${HOST_PREFIX}gfortran ${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
-CPP = "${HOST_PREFIX}gcc -E${TOOLCHAIN_OPTIONS} ${HOST_CC_ARCH}"
-LD = "${HOST_PREFIX}ld${TOOLCHAIN_OPTIONS} ${HOST_LD_ARCH}"
-CCLD = "${CC}"
-AR = "${HOST_PREFIX}gcc-ar"
-AS = "${HOST_PREFIX}as ${HOST_AS_ARCH}"
-RANLIB = "${HOST_PREFIX}gcc-ranlib"
-STRIP = "${HOST_PREFIX}strip"
-OBJCOPY = "${HOST_PREFIX}objcopy"
-OBJDUMP = "${HOST_PREFIX}objdump"
-STRINGS = "${HOST_PREFIX}strings"
-NM = "${HOST_PREFIX}gcc-nm"
-READELF = "${HOST_PREFIX}readelf"
-
-PREFERRED_PROVIDER_virtual/cross-cc = "${MLPREFIX}gcc-cross-${TARGET_ARCH}"
-PREFERRED_PROVIDER_virtual/cross-c++ = "${MLPREFIX}gcc-cross-${TARGET_ARCH}"
-PREFERRED_PROVIDER_virtual/compilerlibs = "gcc-runtime"
-PREFERRED_PROVIDER_virtual/cross-cc:class-nativesdk = "gcc-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/cross-c++:class-nativesdk = "gcc-crosssdk-${SDK_SYS}"
-
-PREFERRED_PROVIDER_virtual/nativesdk-cross-cc = "gcc-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/nativesdk-cross-c++ = "gcc-crosssdk-${SDK_SYS}"
-PREFERRED_PROVIDER_virtual/nativesdk-compilerlibs = "nativesdk-gcc-runtime"
-
-TCOVERRIDE = "toolchain-gcc"
diff --git a/meta/files/license-hashes.csv b/meta/files/license-hashes.csv
new file mode 100644
index 0000000000..906660b85d
--- /dev/null
+++ b/meta/files/license-hashes.csv
@@ -0,0 +1,78 @@
+008c22318c8ea65928bf730ddd0273e3,BSD-3-Clause
+02d4002e9171d41a8fad93aa7faf3956,BSD-3-Clause
+0636e73ff0215e8d672dc4c32c317bb3,GPL-2.0-only
+063b5c3ebb5f3aa4c85a2ed18a31fbe7,GPL-2.0-only
+0a97f8e4cbaf889d6fa51f84b89a79f6,ISC
+0ceb9ff3b27d3a8cf451ca3785d73c71,BSD-3-Clause & MIT
+0dd48ae8103725bd7b401261520cdfbb,BSD-3-Clause
+0e46634a01bfef056892949acaea85b1,BSD-3-Clause
+1034431802e57486b393d00c5d262b8a,Apache-2.0
+12f884d2ae1ff87c09e5b7ccc2c4ca7e,GPL-2.0-only
+18810669f13b87348459e611d31ab760,GPL-2.0-only
+19cbd64715b51267a47bf3750cc6a8a5,Apache-2.0
+201414b6610203caed355323b1ab3116,BSD-3-Clause
+252890d9eee26aab7b432e8b8a616475,LGPL-2.0-only
+2b8c039b2b9a25f0feb4410c4542d346,BSD-2-Clause
+2d5025d4aa3495befef8f17206a5b0a1,LGPL-2.1-only
+3214f080875748938ba060314b4f727d,LGPL-2.0-only
+385c55653886acac3821999a3ccd17b3,Artistic-1.0 | GPL-2.0-only
+393a5ca445f6965873eca0259a17f833,GPL-2.0-only
+3b83ef96387f14655fc854ddc3c6bd57,Apache-2.0
+3bf50002aefd002f49e7bb854063f7e7,LGPL-2.0-only
+3debde09238a8c8e1f6a847e1ec9055b,LGPL-2.1-only
+4325afd396febcb659c36b49533135d4,GPL-2.0-only
+4c641f2d995c47f5cb08bdb4b5b6ea05,BSD-2-Clause
+4ee4feb2b545c2231749e5c54ace343e,BSD-3-Clause
+4fbd65380cdd255951079008b364516c,LGPL-2.1-only
+50fab24ce589d69af8964fdbfe414c60,BSD-2-Clause
+54c7042be62e169199200bc6477f04d1,BSD-3-Clause
+55ca817ccb7d5b5b66355690e9abc605,LGPL-2.0-only
+59530bdf33659b29e73d4adb9f9f6552,GPL-2.0-only
+5d4950ecb7b26d2c5e4e7b4e0dd74707,BSD-3-Clause
+5f30f0716dfdd0d91eb439ebec522ec2,LGPL-2.0-only
+6a6a8e020838b23406c81b19c1d46df6,LGPL-3.0-only
+721f23a96ff4161ca3a5f071bbe18108,MIT
+7364d1e4653d3584181e9d22d81f275f,CC0-1.0
+751419260aa954499f7abaabaa882bbe,GPL-2.0-only
+75512892d6f59dddb6d1c7e191957e9c,Zlib
+75605e6bdd564791ab698fca65c94a4f,Unlicense
+7998cb338f82d15c0eff93b7004d272a,BSD-3-Clause
+7f5202f4d44ed15dcd4915f5210417d8,LGPL-2.1-only
+7fbc338309ac38fefcd64b04bb903e34,LGPL-2.1-only
+80fa7b56a28e8c902e6af194003220a5,BSD-2-Clause
+85d8a977ee9d7c5ab4ac03c9b95431c4,MIT-0
+88a4355858a1433fea99fae34a44da88,GPL-2.0-only
+8bd23871802951c9ad63855151204c2c,BSD-2-Clause
+8ca43cbc842c2336e835926c2166c28b,GPL-2.0-only
+939cce1ec101726fa754e698ac871622,BSD-3-Clause
+94d55d512a9ba36caa9b7df079bae19f,GPL-2.0-only
+9ac2e7cff1ddaf48b6eab6028f23ef88,GPL-2.0-only
+9f604d8a4f8e74f4f5140845a21b6674,LGPL-2.0-only
+a39327c997c20da0937955192d86232d,BSD-3-Clause
+a54a1a6a39e7f9dbb4a23a42f5c7fd1c,Apache-2.0
+a651bb3d8b1c412632e28823bb432b40,BSD-3-Clause
+a6f89e2100d9b6cdffcea4f398e37343,LGPL-2.1-only
+ad4e9d34a2e966dfe9837f18de03266d,GFDL-1.1-only
+b234ee4d69f5fce4486a80fdaf4a4263,GPL-2.0-only
+b27575459e02221ccef97ec0bfd457ae,Apache-2.0
+b376d29a53c9573006b9970709231431,MIT
+b5f72aef53d3b2b432702c30b0215666,BSD-3-Clause
+b66384e7137e41a9b1904ef4d39703b6,Apache-2.0
+bbb461211a33b134d42ed5ee802b37ff,LGPL-2.1-only
+bfe1f75d606912a4111c90743d6c7325,MPL-1.1-only
+c93c0550bd3173f4504b2cbd8991e50b,GPL-2.0-only
+d014fb11a34eb67dc717fdcfc97e60ed,GFDL-1.2-only
+d0b68be4a2dc957aaf09144970bc6696,MIT
+d32239bcb673463ab874e80d47fae504,GPL-3.0-only
+d7810fab7487fb0aad327b76f1be7cd7,GPL-2.0-only
+d8045f3b8f929c1cb29a1e3fd737b499,LGPL-2.1-only
+db979804f025cf55aabec7129cb671ed,LGPL-2.0-only
+e020ca655b06c112def28e597ab844f1,GFDL-1.3-only
+e659f77bfd9002659e112d0d3d59b2c1,BSD-2-Clause
+eb723b61539feef013de476e68b5c50a,GPL-2.0-only
+ebb5c50ab7cab4baeffba14977030c07,GPL-2.0-only
+efe2cb9a35826992b9df68224e3c2628,EPL-1.0
+f27defe1e96c2e1ecd4e0c9be8967949,GPL-3.0-only
+f90c613c51aa35da4d79dd55fc724ceb,LGPL-3.0-only
+fad9b3332be894bab9bc501572864b29,LGPL-2.1-only
+fbc093901857fcd118f065f900982c24,LGPL-2.1-only
diff --git a/meta/lib/oe/bootfiles.py b/meta/lib/oe/bootfiles.py
index 155fe742db..7ee148c4e2 100644
--- a/meta/lib/oe/bootfiles.py
+++ b/meta/lib/oe/bootfiles.py
@@ -10,7 +10,7 @@
 # Returns a list of tuples with (original filepath relative to
 # deploy_dir, desired filepath renaming)
 #
-# Heavily inspired of bootimg-partition.py
+# Heavily inspired of bootimg_partition.py
 #
 def get_boot_files(deploy_dir, boot_files):
     import re
diff --git a/meta/lib/oe/license_finder.py b/meta/lib/oe/license_finder.py
new file mode 100644
index 0000000000..16f5d7c94c
--- /dev/null
+++ b/meta/lib/oe/license_finder.py
@@ -0,0 +1,179 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+
+import fnmatch
+import hashlib
+import logging
+import os
+import re
+
+import bb
+import bb.utils
+
+logger = logging.getLogger("BitBake.OE.LicenseFinder")
+
+def _load_hash_csv(d):
+    """
+    Load a mapping of (checksum: license name) from all files/license-hashes.csv
+    files that can be found in the available layers.
+    """
+    import csv
+    md5sums = {}
+
+    # Read license md5sums from csv file
+    for path in d.getVar('BBPATH').split(':'):
+        csv_path = os.path.join(path, 'files', 'license-hashes.csv')
+        if os.path.isfile(csv_path):
+            with open(csv_path, newline='') as csv_file:
+                reader = csv.DictReader(csv_file, delimiter=',', fieldnames=['md5sum', 'license'])
+                for row in reader:
+                    md5sums[row['md5sum']] = row['license']
+
+    return md5sums
+
+
+def _crunch_known_licenses(d):
+    """
+    Calculate the MD5 checksums for the original and "crunched" versions of all
+    known licenses.
+    """
+    md5sums = {}
+
+    lic_dirs = [d.getVar('COMMON_LICENSE_DIR')] + (d.getVar('LICENSE_PATH') or "").split()
+    for lic_dir in lic_dirs:
+        for fn in os.listdir(lic_dir):
+            path = os.path.join(lic_dir, fn)
+            # Hash the exact contents
+            md5value = bb.utils.md5_file(path)
+            md5sums[md5value] = fn
+            # Also hash a "crunched" version
+            md5value = _crunch_license(path)
+            md5sums[md5value] = fn
+
+    return md5sums
+
+
+def _crunch_license(licfile):
+    '''
+    Remove non-material text from a license file and then calculate its
+    md5sum. This works well for licenses that contain a copyright statement,
+    but is also a useful way to handle people's insistence upon reformatting
+    the license text slightly (with no material difference to the text of the
+    license).
+    '''
+
+    import oe.utils
+
+    # Note: these are carefully constructed!
+    license_title_re = re.compile(r'^#*\(? *(This is )?([Tt]he )?.{0,15} ?[Ll]icen[sc]e( \(.{1,10}\))?\)?[:\.]? ?#*$')
+    license_statement_re = re.compile(r'^((This (project|software)|.{1,10}) is( free software)? (released|licen[sc]ed)|(Released|Licen[cs]ed)) under the .{1,10} [Ll]icen[sc]e:?$')
+    copyright_re = re.compile(r'^ *[#\*]* *(Modified work |MIT LICENSED )?Copyright ?(\([cC]\))? .*$')
+    disclaimer_re = re.compile(r'^ *\*? ?All [Rr]ights [Rr]eserved\.$')
+    email_re = re.compile(r'^.*<[\w\.-]*@[\w\.\-]*>$')
+    header_re = re.compile(r'^(\/\**!?)? ?[\-=\*]* ?(\*\/)?$')
+    tag_re = re.compile(r'^ *@?\(?([Ll]icense|MIT)\)?$')
+    url_re = re.compile(r'^ *[#\*]* *https?:\/\/[\w\.\/\-]+$')
+
+    lictext = []
+    with open(licfile, 'r', errors='surrogateescape') as f:
+        for line in f:
+            # Drop opening statements
+            if copyright_re.match(line):
+                continue
+            elif disclaimer_re.match(line):
+                continue
+            elif email_re.match(line):
+                continue
+            elif header_re.match(line):
+                continue
+            elif tag_re.match(line):
+                continue
+            elif url_re.match(line):
+                continue
+            elif license_title_re.match(line):
+                continue
+            elif license_statement_re.match(line):
+                continue
+            # Strip comment symbols
+            line = line.replace('*', '') \
+                       .replace('#', '')
+            # Unify spelling
+            line = line.replace('sub-license', 'sublicense')
+            # Squash spaces
+            line = oe.utils.squashspaces(line.strip())
+            # Replace smart quotes, double quotes and backticks with single quotes
+            line = line.replace(u"\u2018", "'").replace(u"\u2019", "'").replace(u"\u201c","'").replace(u"\u201d", "'").replace('"', '\'').replace('`', '\'')
+            # Unify brackets
+            line = line.replace("{", "[").replace("}", "]")
+            if line:
+                lictext.append(line)
+
+    m = hashlib.md5()
+    try:
+        m.update(' '.join(lictext).encode('utf-8'))
+        md5val = m.hexdigest()
+    except UnicodeEncodeError:
+        md5val = None
+    return md5val
+
+
+def find_license_files(srctree, first_only=False):
+    """
+    Search srctree for files that look like they could be licenses.
+    If first_only is True, only return the first file found.
+    """
+    licspecs = ['*LICEN[CS]E*', 'COPYING*', '*[Ll]icense*', 'LEGAL*', '[Ll]egal*', '*GPL*', 'README.lic*', 'COPYRIGHT*', '[Cc]opyright*', 'e[dp]l-v10']
+    skip_extensions = (".html", ".js", ".json", ".svg", ".ts", ".go", ".sh")
+    licfiles = []
+    for root, dirs, files in os.walk(srctree):
+        # Sort files so that LICENSE is before LICENSE.subcomponent, which is
+        # meaningful if first_only is set.
+        for fn in sorted(files):
+            if fn.endswith(skip_extensions):
+                continue
+            for spec in licspecs:
+                if fnmatch.fnmatch(fn, spec):
+                    fullpath = os.path.join(root, fn)
+                    if not fullpath in licfiles:
+                        licfiles.append(fullpath)
+                        if first_only:
+                            return licfiles
+
+    return licfiles
+
+
+def match_licenses(licfiles, srctree, d, extra_hashes={}):
+    md5sums = {}
+    md5sums.update(_load_hash_csv(d))
+    md5sums.update(_crunch_known_licenses(d))
+    md5sums.update(extra_hashes)
+
+    licenses = []
+    for licfile in sorted(licfiles):
+        resolved_licfile = d.expand(licfile)
+        md5value = bb.utils.md5_file(resolved_licfile)
+        license = md5sums.get(md5value, None)
+        if not license:
+            crunched_md5 = _crunch_license(resolved_licfile)
+            license = md5sums.get(crunched_md5, None)
+            if not license:
+                license = 'Unknown'
+                logger.info("Please add the following line for '%s' to a 'license-hashes.csv' " \
+                    "and replace `Unknown` with the license:\n" \
+                    "%s,Unknown" % (os.path.relpath(licfile, srctree + "/.."), md5value))
+
+        licenses.append((license, os.path.relpath(licfile, srctree), md5value))
+
+    return licenses
+
+
+def find_licenses(srctree, d, first_only=False, extra_hashes={}):
+    licfiles = find_license_files(srctree, first_only)
+    licenses = match_licenses(licfiles, srctree, d, extra_hashes)
+
+    # FIXME should we grab at least one source file with a license header and add that too?
+
+    return licenses
diff --git a/meta/lib/oe/package.py b/meta/lib/oe/package.py
index 60392cbced..ce69151e5d 100644
--- a/meta/lib/oe/package.py
+++ b/meta/lib/oe/package.py
@@ -16,6 +16,7 @@ import mmap
 import subprocess
 import shutil
 
+import bb.parse
 import oe.cachedpath
 
 def runstrip(file, elftype, strip, extra_strip_sections=''):
@@ -1049,6 +1050,7 @@ def copydebugsources(debugsrcdir, sources, d):
             if os.path.exists(p) and not os.listdir(p):
                 os.rmdir(p)
 
+@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
 def save_debugsources_info(debugsrcdir, sources_raw, d):
     import json
     import bb.compress.zstd
@@ -1081,6 +1083,7 @@ def save_debugsources_info(debugsrcdir, sources_raw, d):
         with bb.compress.zstd.open(debugsources_file, "wt", encoding="utf-8", num_threads=num_threads) as f:
             json.dump(sources_dict, f, sort_keys=True)
 
+@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
 def read_debugsources_info(d):
     import json
     import bb.compress.zstd
diff --git a/meta/lib/oe/packagedata.py b/meta/lib/oe/packagedata.py
index 2d1d6ddeb7..b6a10a930a 100644
--- a/meta/lib/oe/packagedata.py
+++ b/meta/lib/oe/packagedata.py
@@ -7,6 +7,7 @@
 import codecs
 import os
 import json
+import bb.parse
 import bb.compress.zstd
 import oe.path
 
@@ -64,6 +65,7 @@ def read_subpkgdata_dict(pkg, d):
         ret[newvar] = subd[var]
     return ret
 
+@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
 def read_subpkgdata_extended(pkg, d):
     import json
     import bb.compress.zstd
@@ -182,6 +184,7 @@ def runtime_mapping_rename(varname, pkg, d):
 
     #bb.note("%s after: %s" % (varname, d.getVar(varname)))
 
+@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
 def emit_pkgdata(pkgfiles, d):
     def process_postinst_on_target(pkg, mlprefix):
         pkgval = d.getVar('PKG:%s' % pkg)
diff --git a/meta/lib/oe/path.py b/meta/lib/oe/path.py
index 5d21cdcbdf..a1efe97d88 100644
--- a/meta/lib/oe/path.py
+++ b/meta/lib/oe/path.py
@@ -10,6 +10,8 @@ import shutil
 import subprocess
 import os.path
 
+import bb.parse
+
 def join(*paths):
     """Like os.path.join but doesn't treat absolute RHS specially"""
     return os.path.normpath("/".join(paths))
@@ -77,6 +79,7 @@ def replace_absolute_symlinks(basedir, d):
             os.remove(path)
             os.symlink(base, path)
 
+@bb.parse.vardepsexclude("TOPDIR")
 def format_display(path, metadata):
     """ Prepare a path for display to the user. """
     rel = relative(metadata.getVar("TOPDIR"), path)
diff --git a/meta/lib/oe/sstatesig.py b/meta/lib/oe/sstatesig.py
index 826549948e..ef687f5d41 100644
--- a/meta/lib/oe/sstatesig.py
+++ b/meta/lib/oe/sstatesig.py
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-only
 #
+import bb.parse
 import bb.siggen
 import bb.runqueue
 import oe
@@ -493,6 +494,7 @@ def sstate_get_manifest_filename(task, d):
         d2.setVar("SSTATE_MANMACH", extrainf)
     return (d2.expand("${SSTATE_MANFILEPREFIX}.%s" % task), d2)
 
+@bb.parse.vardepsexclude("BBEXTENDCURR", "BBEXTENDVARIANT", "OVERRIDES", "PACKAGE_EXTRA_ARCHS")
 def find_sstate_manifest(taskdata, taskdata2, taskname, d, multilibcache):
     d2 = d
     variant = ''
diff --git a/meta/lib/oe/utils.py b/meta/lib/oe/utils.py
index d272dd2b8d..a11db5f3cd 100644
--- a/meta/lib/oe/utils.py
+++ b/meta/lib/oe/utils.py
@@ -9,6 +9,8 @@ import multiprocessing
 import traceback
 import errno
 
+import bb.parse
+
 def read_file(filename):
     try:
         f = open( filename, "r" )
@@ -265,6 +267,7 @@ def execute_pre_post_process(d, cmds):
         bb.note("Executing %s ..." % cmd)
         bb.build.exec_func(cmd, d)
 
+@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
 def get_bb_number_threads(d):
     return int(d.getVar("BB_NUMBER_THREADS") or os.cpu_count() or 1)
 
@@ -467,7 +470,7 @@ def host_gcc_version(d, taskcontextonly=False):
     version = match.group(1)
     return "-%s" % version if version in ("4.8", "4.9") else ""
 
-
+@bb.parse.vardepsexclude("DEFAULTTUNE_MULTILIB_ORIGINAL", "OVERRIDES")
 def get_multilib_datastore(variant, d):
     localdata = bb.data.createCopy(d)
     if variant:
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index be291e4b0f..ca4724d1ae 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -786,7 +786,7 @@ FIT_CONF_PREFIX = "foo-"
         EXPECTED_COMP = ["ti,am335x-bone-green", "ti,am335x-bone-black", "ti,am335x-bone", "ti,am33xx"]
 
         config = """
-DISTRO="poky"
+DISTRO = "poky"
 MACHINE = "beaglebone-yocto"
 """
         self.write_config(config)
@@ -918,7 +918,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
         bb_vars = self._fit_get_bb_vars()
 
         # Ensure new keys are generated and FIT_GENERATE_KEYS = "1" is tested
-        bitbake("kernel-signing-keys-native -c cleansstate")
+        bitbake("kernel-signing-keys-native -c compile -f")
 
         self._test_fitimage(bb_vars)
 
@@ -938,7 +938,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
         """
 
         config = """
-DISTRO="poky"
+DISTRO = "poky"
 MACHINE = "beaglebone-yocto"
 INITRAMFS_IMAGE = "core-image-minimal-initramfs"
 INITRAMFS_SCRIPTS = ""
@@ -992,7 +992,7 @@ FIT_HASH_ALG = "sha256"
         """
 
         config = """
-DISTRO="poky"
+DISTRO = "poky"
 MACHINE = "beaglebone-yocto"
 INITRAMFS_IMAGE_BUNDLE = "1"
 INITRAMFS_IMAGE = "core-image-minimal-initramfs"
diff --git a/meta/lib/oeqa/selftest/cases/wic.py b/meta/lib/oeqa/selftest/cases/wic.py
index 1a67b6df51..f45608172f 100644
--- a/meta/lib/oeqa/selftest/cases/wic.py
+++ b/meta/lib/oeqa/selftest/cases/wic.py
@@ -153,7 +153,7 @@ class Wic(WicTestCase):
         # create a temporary file for the WKS content
         with NamedTemporaryFile("w", suffix=".wks") as wks:
             wks.write(
-                'part --source bootimg-efi '
+                'part --source bootimg_efi '
                 '--sourceparams="loader=grub-efi,install-kernel-into-boot-dir=false" '
                 '--label boot --active\n'
             )
@@ -186,7 +186,7 @@ class Wic(WicTestCase):
         # create a temporary file for the WKS content
         with NamedTemporaryFile("w", suffix=".wks") as wks:
             wks.write(
-                'part --source bootimg-efi '
+                'part --source bootimg_efi '
                 '--sourceparams="loader=grub-efi,install-kernel-into-boot-dir=true" '
                 '--label boot --active\n'
             )
@@ -1358,7 +1358,7 @@ class Wic2(WicTestCase):
     def test_biosplusefi_plugin(self):
         """Test biosplusefi plugin"""
         # Wic generation below may fail depending on the order of the unittests
-        # This is because bootimg-pcbios (that bootimg-biosplusefi uses) generate its MBR inside STAGING_DATADIR directory
+        # This is because bootimg_pcbios (that bootimg_biosplusefi uses) generate its MBR inside STAGING_DATADIR directory
         #    which may or may not exists depending on what was built already
         # If an image hasn't been built yet, directory ${STAGING_DATADIR}/syslinux won't exists and _get_bootimg_dir()
         #   will raise with "Couldn't find correct bootimg_dir"
@@ -1370,7 +1370,7 @@ class Wic2(WicTestCase):
 
         img = 'core-image-minimal'
         with NamedTemporaryFile("w", suffix=".wks") as wks:
-            wks.writelines(['part /boot --active --source bootimg-biosplusefi --sourceparams="loader=grub-efi"\n',
+            wks.writelines(['part /boot --active --source bootimg_biosplusefi --sourceparams="loader=grub-efi"\n',
                             'part / --source rootfs --fstype=ext4 --align 1024 --use-uuid\n'\
                             'bootloader --timeout=0 --append="console=ttyS0,115200n8"\n'])
             wks.flush()
@@ -1390,7 +1390,7 @@ class Wic2(WicTestCase):
 
         img = 'core-image-minimal'
         with NamedTemporaryFile("w", suffix=".wks") as wks:
-            wks.writelines(['part /boot --source bootimg-efi --sourceparams="loader=uefi-kernel"\n'
+            wks.writelines(['part /boot --source bootimg_efi --sourceparams="loader=uefi-kernel"\n'
                             'part / --source rootfs --fstype=ext4 --align 1024 --use-uuid\n'\
                             'bootloader --timeout=0 --append="console=ttyS0,115200n8"\n'])
             wks.flush()
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch
new file mode 100644
index 0000000000..157486848b
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch
@@ -0,0 +1,59 @@
+From 33d7969baf541326a35e2fbe31943c46af8c71db Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 27 May 2025 12:53:17 +0200
+Subject: [PATCH] tree: Fix integer overflow in xmlBuildQName
+
+This issue affects memory safety and might receive a CVE ID later.
+
+Fixes #926.
+
+Signed-off-by: Nick Wellnhofer <wellnhofer@aevum.de>
+
+Add '#include <stdint.h>' to assure the definition of SIZE_MAX
+CVE: CVE-2025-6021
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ tree.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 7454b07..22ec11c 100644
+--- a/tree.c
++++ b/tree.c
+@@ -23,6 +23,7 @@
+ #include <limits.h>
+ #include <ctype.h>
+ #include <stdlib.h>
++#include <stdint.h>
+ 
+ #ifdef LIBXML_ZLIB_ENABLED
+ #include <zlib.h>
+@@ -168,10 +169,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
+ xmlChar *
+ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+              xmlChar *memory, int len) {
+-    int lenn, lenp;
++    size_t lenn, lenp;
+     xmlChar *ret;
+ 
+-    if (ncname == NULL) return(NULL);
++    if ((ncname == NULL) || (len < 0)) return(NULL);
+     if (prefix == NULL) return((xmlChar *) ncname);
+ 
+ #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+@@ -182,8 +183,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+ 
+     lenn = strlen((char *) ncname);
+     lenp = strlen((char *) prefix);
++    if (lenn >= SIZE_MAX - lenp - 1)
++        return(NULL);
+ 
+-    if ((memory == NULL) || (len < lenn + lenp + 2)) {
++    if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
+        ret = xmlMalloc(lenn + lenp + 2);
+        if (ret == NULL)
+            return(NULL);
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.14.3.bb b/meta/recipes-core/libxml/libxml2_2.14.3.bb
index da75cbe450..4baab59186 100644
--- a/meta/recipes-core/libxml/libxml2_2.14.3.bb
+++ b/meta/recipes-core/libxml/libxml2_2.14.3.bb
@@ -18,6 +18,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://run-ptest \
            file://install-tests.patch \
            file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch \
+           file://CVE-2025-6021.patch \
            "
 
 SRC_URI[archive.sha256sum] = "6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833"
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
new file mode 100644
index 0000000000..066dfa0ff0
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
@@ -0,0 +1,43 @@
+From 2c8fb3e5164effc8a370e800fe91db7341e69116 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Mon, 7 Apr 2025 11:23:41 -0700
+Subject: [PATCH 1/4] SecurityPkg: Update SecurityFixes.yaml for CVE-2024-38797
+
+This commit updates the SecurityFixes.yaml file to include
+information about the CVE-2024-38797 vulnerability.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/519366f542e9370bee982b1c3687ffedb5cabc21]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+index b4006b4..06b597a 100644
+--- a/SecurityPkg/SecurityFixes.yaml
++++ b/SecurityPkg/SecurityFixes.yaml
+@@ -40,3 +40,18 @@ CVE_2022_36764:
+     - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c

+   links:

+     - https://bugzilla.tianocore.org/show_bug.cgi?id=4118

++CVE_2024_38797:

++  commit-titles:

++    - "SecurityPkg: Out of bound read in HashPeImageByType()"

++    - "SecurityPkg: Improving HashPeImageByType () logic"

++    - "SecurityPkg: Improving SecureBootConfigImpl:HashPeImageByType () logic"

++  cve: CVE-2024-38797

++  date_reported: 2024-06-04 12:00 UTC

++  description: Out of bound read in HashPeImageByType()

++  note:

++  files_impacted:

++    - SecurityPkg\Library\DxeImageVerificationLib\DxeImageVerificationLib.c

++    - SecurityPkg\VariableAuthenticated\SecureBootConfigDxe\SecureBootConfigImpl.c

++  links:

++    - https://bugzilla.tianocore.org/show_bug.cgi?id=2214

++    - https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
new file mode 100644
index 0000000000..9bf6645681
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
@@ -0,0 +1,63 @@
+From 1a7be26382c4a34504875f094e15fe371d44192e Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Thu, 3 Oct 2024 09:37:18 -0700
+Subject: [PATCH 2/4] SecurityPkg: Out of bound read in HashPeImageByType()
+
+In HashPeImageByType(), the hash of PE/COFF image is calculated.
+This function may get untrusted input.
+
+Inside this function, the following code verifies the loaded image has
+the correct format, by reading the second byte of the buffer.
+
+```c
+  if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
+        ...
+  }
+```
+
+The input image is not trusted and that may not have the second byte to
+read. So this poses an out of bound read error.
+
+With below fix we are assuring that we don't do out of bound read. i.e,
+we make sure that AuthDataSize is greater than 1.
+
+```c
+  if (AuthDataSize > 1
+      && (*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE){
+    ...
+  }
+```
+
+AuthDataSize size is verified before reading the second byte.
+So if AuthDataSize is less than 2, the second byte will not be read, and
+the out of bound read situation won't occur.
+
+Tested the patch on real platform with and without TPM connected and
+verified image is booting fine.
+
+Authored-by: Raj AlwinX Selvaraj <Alw...@intel.com>
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/2dcdb41b564aa3cb846644b4b1722a0b3ae5e06b]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c   | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index b05da19..2afa2c9 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -642,7 +642,7 @@ HashPeImageByType (
+     //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+     //    Fixed offset (+32) is calculated based on two bytes of length encoding.

+     //

+-    if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {

++    if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+       //

+       // Only support two bytes of Long Form of Length Encoding.

+       //

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
new file mode 100644
index 0000000000..169c78daab
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
@@ -0,0 +1,99 @@
+From 4db363db013a92937431234252fc9d84e44fc120 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Thu, 3 Oct 2024 10:16:57 -0700
+Subject: [PATCH 3/4] SecurityPkg: Improving HashPeImageByType () logic
+
+Namely:
+
+(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
+    to TRUE for Index==0, then it will evaluate to TRUE for all other
+    Index values as well. As a result, the (Index == HASHALG_MAX)
+    condition will fire after the loop, and we'll return
+    EFI_UNSUPPORTED.
+
+    While this is correct, functionally speaking, it is wasteful to
+    keep re-checking TWO_BYTE_ENCODE in the loop body. The check
+    should be made at the top of the function, and EFI_UNSUPPORTED
+    should be returned at once, if appropriate.
+
+(2) If the hash algorithm selected by Index has such a large OID that
+    the OID comparison cannot even be performed (because AuthDataSize
+    is not large enough for containing the OID in question, starting
+    at offset 32), then the function returns EFI_UNSUPPORTED at once.
+
+    This is bogus; this case should simply be treated as an OID
+    mismatch, and the loop should advance to the next Index value /
+    hash algorithm candidate. A remaining hash algo may have a shorter
+    OID and yield an OID match.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/5df518ec510324f48ed1cf0376150960644b41f0]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../DxeImageVerificationLib.c                 | 37 ++++++++++---------
+ 1 file changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 2afa2c9..2eca39d 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -618,6 +618,7 @@ Done:
+   @param[in]  AuthDataSize        Size of the Authenticode Signature in bytes.

+ 

+   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.

++  @retval EFI_BAD_BUFFER_SIZE         AuthData provided is invalid size.

+   @retval EFI_SUCCESS                 Hash successfully.

+ 

+ **/

+@@ -629,28 +630,28 @@ HashPeImageByType (
+ {

+   UINT8  Index;

+ 

+-  for (Index = 0; Index < HASHALG_MAX; Index++) {

++  //

++  // Check the Hash algorithm in PE/COFF Authenticode.

++  //    According to PKCS#7 Definition:

++  //        SignedData ::= SEQUENCE {

++  //            version Version,

++  //            digestAlgorithms DigestAlgorithmIdentifiers,

++  //            contentInfo ContentInfo,

++  //            .... }

++  //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

++  //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

++  //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++  //

++  if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+     //

+-    // Check the Hash algorithm in PE/COFF Authenticode.

+-    //    According to PKCS#7 Definition:

+-    //        SignedData ::= SEQUENCE {

+-    //            version Version,

+-    //            digestAlgorithms DigestAlgorithmIdentifiers,

+-    //            contentInfo ContentInfo,

+-    //            .... }

+-    //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

+-    //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+-    //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++    // Only support two bytes of Long Form of Length Encoding.

+     //

+-    if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+-      //

+-      // Only support two bytes of Long Form of Length Encoding.

+-      //

+-      continue;

+-    }

++    return EFI_BAD_BUFFER_SIZE;

++  }

+ 

++  for (Index = 0; Index < HASHALG_MAX; Index++) {

+     if (AuthDataSize < 32 + mHash[Index].OidLength) {

+-      return EFI_UNSUPPORTED;

++      continue;

+     }

+ 

+     if (CompareMem (AuthData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
new file mode 100644
index 0000000000..86bc950e7d
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
@@ -0,0 +1,97 @@
+From cb3342702c5c1f8a4ddbb6d503a98ed720d14eb3 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Fri, 17 Jan 2025 11:30:17 -0800
+Subject: [PATCH 4/4] SecurityPkg: Improving
+ SecureBootConfigImpl:HashPeImageByType () logic
+
+Namely:
+
+(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
+    to TRUE for Index==0, then it will evaluate to TRUE for all other
+    Index values as well. As a result, the (Index == HASHALG_MAX)
+    condition will fire after the loop, and we'll return
+    EFI_UNSUPPORTED.
+
+    While this is correct, functionally speaking, it is wasteful to
+    keep re-checking TWO_BYTE_ENCODE in the loop body. The check
+    should be made at the top of the function, and EFI_UNSUPPORTED
+    should be returned at once, if appropriate.
+
+(2) If the hash algorithm selected by Index has such a large OID that
+    the OID comparison cannot even be performed (because AuthDataSize
+    is not large enough for containing the OID in question, starting
+    at offset 32), then the function returns EFI_UNSUPPORTED at once.
+
+    This is bogus; this case should simply be treated as an OID
+    mismatch, and the loop should advance to the next Index value /
+    hash algorithm candidate. A remaining hash algo may have a shorter
+    OID and yield an OID match.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/8676572908b950dd4d1f8985006011be99c0a5b6]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../SecureBootConfigImpl.c                    | 37 +++++++++++--------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+index 6d4560c..155e755 100644
+--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
++++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+@@ -2096,30 +2096,35 @@ HashPeImageByType (
+ {

+   UINT8                     Index;

+   WIN_CERTIFICATE_EFI_PKCS  *PkcsCertData;

++  UINT32                    PkcsCertSize;

+ 

+   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *)(mImageBase + mSecDataDir->Offset);

++  PkcsCertSize = mSecDataDir->SizeOfCert;

+ 

+-  for (Index = 0; Index < HASHALG_MAX; Index++) {

++  //

++  // Check the Hash algorithm in PE/COFF Authenticode.

++  //    According to PKCS#7 Definition:

++  //        SignedData ::= SEQUENCE {

++  //            version Version,

++  //            digestAlgorithms DigestAlgorithmIdentifiers,

++  //            contentInfo ContentInfo,

++  //            .... }

++  //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

++  //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

++  //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++  //

++  if ((PkcsCertSize > 1) && ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+     //

+-    // Check the Hash algorithm in PE/COFF Authenticode.

+-    //    According to PKCS#7 Definition:

+-    //        SignedData ::= SEQUENCE {

+-    //            version Version,

+-    //            digestAlgorithms DigestAlgorithmIdentifiers,

+-    //            contentInfo ContentInfo,

+-    //            .... }

+-    //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

+-    //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+-    //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++    // Only support two bytes of Long Form of Length Encoding.

+     //

+-    if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {

+-      //

+-      // Only support two bytes of Long Form of Length Encoding.

+-      //

++    return EFI_BAD_BUFFER_SIZE;

++  }

++

++  for (Index = 0; Index < HASHALG_MAX; Index++) {

++    if (PkcsCertSize < 32 + mHash[Index].OidLength) {

+       continue;

+     }

+ 

+-    //

+     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {

+       break;

+     }

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index aa7de3af2b..ab6c580722 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -27,6 +27,10 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
            file://0003-debug-prefix-map.patch \
            file://0004-reproducible.patch \
            file://CVE-2025-2295.patch \
+           file://CVE-2024-38797-1.patch \
+           file://CVE-2024-38797-2.patch \
+           file://CVE-2024-38797-3.patch \
+           file://CVE-2024-38797-4.patch \
            "
 
 PV = "edk2-stable202502"
diff --git a/meta/recipes-core/packagegroups/packagegroup-base.bb b/meta/recipes-core/packagegroups/packagegroup-base.bb
index cb9d1f07af..2e051dba33 100644
--- a/meta/recipes-core/packagegroups/packagegroup-base.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-base.bb
@@ -119,7 +119,7 @@ python __anonymous () {
 # packages added by distribution
 #
 SUMMARY:packagegroup-distro-base = "${DISTRO} extras"
-DEPENDS_packagegroup-distro-base = "${DISTRO_EXTRA_DEPENDS}"
+DEPENDS:packagegroup-distro-base = "${DISTRO_EXTRA_DEPENDS}"
 RDEPENDS:packagegroup-distro-base = "${DISTRO_EXTRA_RDEPENDS}"
 RRECOMMENDS:packagegroup-distro-base = "${DISTRO_EXTRA_RRECOMMENDS}"
 
diff --git a/meta/recipes-core/systemd/systemd-boot-native_257.5.bb b/meta/recipes-core/systemd/systemd-boot-native_257.6.bb
index 05ebe7b63e..05ebe7b63e 100644
--- a/meta/recipes-core/systemd/systemd-boot-native_257.5.bb
+++ b/meta/recipes-core/systemd/systemd-boot-native_257.6.bb
diff --git a/meta/recipes-core/systemd/systemd-boot_257.5.bb b/meta/recipes-core/systemd/systemd-boot_257.6.bb
index c6c443f929..c6c443f929 100644
--- a/meta/recipes-core/systemd/systemd-boot_257.5.bb
+++ b/meta/recipes-core/systemd/systemd-boot_257.6.bb
diff --git a/meta/recipes-core/systemd/systemd-systemctl-native_257.5.bb b/meta/recipes-core/systemd/systemd-systemctl-native_257.6.bb
index 041a040a26..041a040a26 100644
--- a/meta/recipes-core/systemd/systemd-systemctl-native_257.5.bb
+++ b/meta/recipes-core/systemd/systemd-systemctl-native_257.6.bb
diff --git a/meta/recipes-core/systemd/systemd.inc b/meta/recipes-core/systemd/systemd.inc
index 243053a8c7..5ed84757f3 100644
--- a/meta/recipes-core/systemd/systemd.inc
+++ b/meta/recipes-core/systemd/systemd.inc
@@ -15,7 +15,7 @@ LICENSE:libsystemd = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE.GPL2;md5=751419260aa954499f7abaabaa882bbe \
                     file://LICENSE.LGPL2.1;md5=4fbd65380cdd255951079008b364516c"
 
-SRCREV = "1c93ed4c72a4513d9cefcd1f89d11a9dc828d06c"
+SRCREV = "00a12c234e2506f5cab683460199575f13c454db"
 SRCBRANCH = "v257-stable"
 SRC_URI = "git://github.com/systemd/systemd.git;protocol=https;branch=${SRCBRANCH};tag=v${PV}"
 
diff --git a/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch b/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch
index f9a45bb40b..47b8583e7a 100644
--- a/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch
+++ b/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch
@@ -25,7 +25,7 @@ diff --git a/meson.build b/meson.build
 index bffda86845..4146f4beef 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -773,6 +773,7 @@ foreach header : ['crypt.h',
+@@ -770,6 +770,7 @@ foreach header : ['crypt.h',
                    'linux/ioprio.h',
                    'linux/memfd.h',
                    'linux/time_types.h',
diff --git a/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch b/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
index 00b4b777f4..0bbc6bbac7 100644
--- a/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
+++ b/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
@@ -71,7 +71,7 @@ diff --git a/src/basic/namespace-util.c b/src/basic/namespace-util.c
 index 332e8cdfd5..804498127d 100644
 --- a/src/basic/namespace-util.c
 +++ b/src/basic/namespace-util.c
-@@ -354,12 +354,12 @@ int userns_acquire(const char *uid_map, const char *gid_map) {
+@@ -359,12 +359,12 @@ int userns_acquire(const char *uid_map, const char *gid_map) {
                  freeze();
  
          xsprintf(path, "/proc/" PID_FMT "/uid_map", pid);
@@ -154,7 +154,7 @@ diff --git a/src/core/cgroup.c b/src/core/cgroup.c
 index 6933aae54d..ab6fccc0e4 100644
 --- a/src/core/cgroup.c
 +++ b/src/core/cgroup.c
-@@ -5167,7 +5167,7 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
+@@ -5175,7 +5175,7 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
          if (r < 0)
                  return r;
  
@@ -180,7 +180,7 @@ diff --git a/src/core/main.c b/src/core/main.c
 index 172742c769..e68ce2a6d8 100644
 --- a/src/core/main.c
 +++ b/src/core/main.c
-@@ -1812,7 +1812,7 @@ static void initialize_core_pattern(bool skip_setup) {
+@@ -1826,7 +1826,7 @@ static void initialize_core_pattern(bool skip_setup) {
          if (getpid_cached() != 1)
                  return;
  
@@ -231,7 +231,7 @@ diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-
 index 01fa90b1ff..83ab655bf4 100644
 --- a/src/libsystemd/sd-device/sd-device.c
 +++ b/src/libsystemd/sd-device/sd-device.c
-@@ -2563,7 +2563,7 @@ _public_ int sd_device_set_sysattr_value(sd_device *device, const char *sysattr,
+@@ -2564,7 +2564,7 @@ _public_ int sd_device_set_sysattr_value(sd_device *device, const char *sysattr,
          if (!value)
                  return -ENOMEM;
  
@@ -359,7 +359,7 @@ diff --git a/src/shared/coredump-util.c b/src/shared/coredump-util.c
 index 805503f366..3234a1d76e 100644
 --- a/src/shared/coredump-util.c
 +++ b/src/shared/coredump-util.c
-@@ -173,7 +173,7 @@ void disable_coredumps(void) {
+@@ -180,7 +180,7 @@ void disable_coredumps(void) {
          if (detect_container() > 0)
                  return;
  
@@ -372,7 +372,7 @@ diff --git a/src/shared/hibernate-util.c b/src/shared/hibernate-util.c
 index 1213fdc2c7..4c26e6a4ee 100644
 --- a/src/shared/hibernate-util.c
 +++ b/src/shared/hibernate-util.c
-@@ -495,7 +495,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
+@@ -498,7 +498,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
  
          /* We write the offset first since it's safer. Note that this file is only available in 4.17+, so
           * fail gracefully if it doesn't exist and we're only overwriting it with 0. */
@@ -381,7 +381,7 @@ index 1213fdc2c7..4c26e6a4ee 100644
          if (r == -ENOENT) {
                  if (offset != 0)
                          return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
-@@ -511,7 +511,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
+@@ -514,7 +514,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
                  log_debug("Wrote resume_offset=%s for device '%s' to /sys/power/resume_offset.",
                            offset_str, device);
  
diff --git a/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch b/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
index 08d4e384ff..0aabae6d82 100644
--- a/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
+++ b/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
@@ -140,7 +140,7 @@ diff --git a/src/shared/userdb.c b/src/shared/userdb.c
 index ff83d4bf90..54d36cc706 100644
 --- a/src/shared/userdb.c
 +++ b/src/shared/userdb.c
-@@ -1041,13 +1041,15 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
+@@ -1042,13 +1042,15 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
                  if (gr) {
                          _cleanup_free_ char *buffer = NULL;
                          bool incomplete = false;
@@ -157,7 +157,7 @@ index ff83d4bf90..54d36cc706 100644
                          if (!FLAGS_SET(iterator->flags, USERDB_SUPPRESS_SHADOW)) {
                                  r = nss_sgrp_for_group(gr, &sgrp, &buffer);
                                  if (r < 0) {
-@@ -1060,6 +1062,9 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
+@@ -1061,6 +1063,9 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
                          }
  
                          r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret);
diff --git a/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch b/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
index 791079a19f..56083cc7b3 100644
--- a/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
+++ b/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
@@ -11,8 +11,8 @@ Upstream-Status: Inappropriate [musl specific]
 
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
- src/basic/errno-util.h | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
+ src/basic/errno-util.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/src/basic/errno-util.h b/src/basic/errno-util.h
 index 48b76e4bf7..6e7653e2d9 100644
@@ -23,9 +23,8 @@ index 48b76e4bf7..6e7653e2d9 100644
   *
   * Note that we use the GNU variant of strerror_r() here. */
 -#define STRERROR(errnum) strerror_r(abs(errnum), (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
--
 +static inline const char * STRERROR(int errnum);
-+
+ 
 +static inline const char * STRERROR(int errnum) {
 +#ifdef __GLIBC__
 +        return strerror_r(abs(errnum), (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN);
diff --git a/meta/recipes-core/systemd/systemd_257.5.bb b/meta/recipes-core/systemd/systemd_257.6.bb
index 995b55580e..995b55580e 100644
--- a/meta/recipes-core/systemd/systemd_257.5.bb
+++ b/meta/recipes-core/systemd/systemd_257.6.bb
diff --git a/meta/recipes-devtools/binutils/binutils-cross.inc b/meta/recipes-devtools/binutils/binutils-cross.inc
index 9c371e7e13..c545ea2ad9 100644
--- a/meta/recipes-devtools/binutils/binutils-cross.inc
+++ b/meta/recipes-devtools/binutils/binutils-cross.inc
@@ -9,6 +9,8 @@ TARGET_ARCH[vardepvalue] = "${TARGET_ARCH}"
 INHIBIT_DEFAULT_DEPS = "1"
 INHIBIT_AUTOTOOLS_DEPS = "1"
 
+TOOLCHAIN = "gcc"
+
 SRC_URI += "file://0002-binutils-cross-Do-not-generate-linker-script-directo.patch"
 
 # Specify lib-path else we use a load of search dirs which we don't use
diff --git a/meta/recipes-devtools/clang/clang-cross_git.bb b/meta/recipes-devtools/clang/clang-cross_git.bb
index 9b9b120a3d..323cc0d880 100644
--- a/meta/recipes-devtools/clang/clang-cross_git.bb
+++ b/meta/recipes-devtools/clang/clang-cross_git.bb
@@ -11,6 +11,7 @@ PN = "clang-cross-${TARGET_ARCH}"
 require common-clang.inc
 require common-source.inc
 inherit cross
+TOOLCHAIN = "clang"
 DEPENDS += "clang-native virtual/cross-binutils"
 
 #INHIBIT_PACKAGE_STRIP = "1"
diff --git a/meta/recipes-devtools/clang/clang-crosssdk_git.bb b/meta/recipes-devtools/clang/clang-crosssdk_git.bb
index 47ac96f4f9..ef162ef153 100644
--- a/meta/recipes-devtools/clang/clang-crosssdk_git.bb
+++ b/meta/recipes-devtools/clang/clang-crosssdk_git.bb
@@ -11,6 +11,7 @@ PN = "clang-crosssdk-${SDK_SYS}"
 require common-clang.inc
 require common-source.inc
 inherit crosssdk
+TOOLCHAIN = "clang"
 DEPENDS += "clang-native nativesdk-clang-glue virtual/nativesdk-cross-binutils virtual/nativesdk-libc"
 
 do_install() {
diff --git a/meta/recipes-devtools/meson/meson_1.8.1.bb b/meta/recipes-devtools/meson/meson_1.8.2.bb
index af4bc9fecd..bfeaab0a79 100644
--- a/meta/recipes-devtools/meson/meson_1.8.1.bb
+++ b/meta/recipes-devtools/meson/meson_1.8.2.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/meson-${PV}.tar.gz \
            file://0001-Make-CPU-family-warnings-fatal.patch \
            file://0002-Support-building-allarch-recipes-again.patch \
            "
-SRC_URI[sha256sum] = "b4e3b80e8fa633555abf447a95a700aba1585419467b2710d5e5bf88df0a7011"
+SRC_URI[sha256sum] = "c105816d8158c76b72adcb9ff60297719096da7d07f6b1f000fd8c013cd387af"
 UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)$"
 
 inherit python_setuptools_build_meta github-releases
diff --git a/meta/recipes-devtools/python/python3-cython_3.1.1.bb b/meta/recipes-devtools/python/python3-cython_3.1.2.bb
index 1bc6eda4ac..77dbbe8b2c 100644
--- a/meta/recipes-devtools/python/python3-cython_3.1.1.bb
+++ b/meta/recipes-devtools/python/python3-cython_3.1.2.bb
@@ -7,7 +7,7 @@ SECTION = "devel/python"
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=61c3ee8961575861fa86c7e62bc9f69c"
 
-SRC_URI[sha256sum] = "505ccd413669d5132a53834d792c707974248088c4f60c497deb1b416e366397"
+SRC_URI[sha256sum] = "6bbf7a953fa6762dfecdec015e3b054ba51c0121a45ad851fa130f63f5331381"
 
 inherit pypi setuptools3 cython
 
diff --git a/meta/recipes-devtools/python/python3-dtschema_2025.2.bb b/meta/recipes-devtools/python/python3-dtschema_2025.6.1.bb
index 2071763741..872084841b 100644
--- a/meta/recipes-devtools/python/python3-dtschema_2025.2.bb
+++ b/meta/recipes-devtools/python/python3-dtschema_2025.6.1.bb
@@ -7,7 +7,7 @@ inherit pypi python_setuptools_build_meta
 
 PYPI_PACKAGE = "dtschema"
 
-SRC_URI[sha256sum] = "9adeaff2079a8b5fbc4bd1c8f02cbd232016a84a9684739cac20b4df3b19509e"
+SRC_URI[sha256sum] = "6348fb23961d0cd1c89ea0c29b790c622bc34fdd1be56090724c6c1f76cbf10d"
 
 DEPENDS += "python3-setuptools-scm-native"
 RDEPENDS:${PN} += "\
diff --git a/meta/recipes-devtools/python/python3-hypothesis_6.132.0.bb b/meta/recipes-devtools/python/python3-hypothesis_6.135.9.bb
index 52688b8765..efc5229fbc 100644
--- a/meta/recipes-devtools/python/python3-hypothesis_6.132.0.bb
+++ b/meta/recipes-devtools/python/python3-hypothesis_6.135.9.bb
@@ -13,7 +13,7 @@ SRC_URI += " \
     file://test_rle.py \
     "
 
-SRC_URI[sha256sum] = "55868060add41baa6176ed9c3456655678d140c74e3514bdf03381dae6391403"
+SRC_URI[sha256sum] = "a80a256268b8af3d34d62be30f6bf4a7d099b2b762621cc5f3f1de65e7b98543"
 
 RDEPENDS:${PN} += " \
     python3-attrs \
diff --git a/meta/recipes-devtools/python/python3-numpy_2.2.6.bb b/meta/recipes-devtools/python/python3-numpy_2.3.0.bb
index 10468d6850..e77a4ba5c3 100644
--- a/meta/recipes-devtools/python/python3-numpy_2.2.6.bb
+++ b/meta/recipes-devtools/python/python3-numpy_2.3.0.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://numpy.org/"
 DESCRIPTION = "NumPy is the fundamental package needed for scientific computing with Python."
 SECTION = "devel/python"
 LICENSE = "BSD-3-Clause & BSD-2-Clause & PSF-2.0 & Apache-2.0 & MIT"
-LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=1de863c37a83e71b1e97b64d036ea78b"
+LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=26080bf81b2662c7119d3ef28ae197fd"
 
 SRCNAME = "numpy"
 
@@ -12,7 +12,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${SRCNAME}-${PV}.tar.gz \
            file://fix_reproducibility.patch \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd"
+SRC_URI[sha256sum] = "581f87f9e9e9db2cba2141400e160e9dd644ee248788d6f90636eeb8fd9260a6"
 
 GITHUB_BASE_URI = "https://github.com/numpy/numpy/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
diff --git a/meta/recipes-devtools/python/python3-pdm_2.24.2.bb b/meta/recipes-devtools/python/python3-pdm_2.25.1.bb
index d24e03d650..d9331ba72c 100644
--- a/meta/recipes-devtools/python/python3-pdm_2.24.2.bb
+++ b/meta/recipes-devtools/python/python3-pdm_2.25.1.bb
@@ -4,7 +4,7 @@ LICENSE = "MIT"
 SECTION = "devel/python"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2eb31a2cc1a758c34b499f287dd04ef2"
 
-SRC_URI[sha256sum] = "ce0d5e9005fe26238b8ba5cf0e37ac00acab2fb90f904bf0219a5e8445849dfb"
+SRC_URI[sha256sum] = "3145251f37a3f94fa211ade992e7db7792da4c3e8e3eeeb1993d952adebe0b96"
 
 inherit pypi python_setuptools_build_meta
 
diff --git a/meta/recipes-devtools/python/python3-requests_2.32.3.bb b/meta/recipes-devtools/python/python3-requests_2.32.4.bb
index bc9b2289f6..49d44298f6 100644
--- a/meta/recipes-devtools/python/python3-requests_2.32.3.bb
+++ b/meta/recipes-devtools/python/python3-requests_2.32.4.bb
@@ -7,7 +7,7 @@ SRC_URI:append:class-nativesdk = " \
            file://environment.d-python3-requests.sh \
 "
 
-SRC_URI[sha256sum] = "55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760"
+SRC_URI[sha256sum] = "27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"
 
 inherit pypi python_setuptools_build_meta
 
diff --git a/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.12.bb b/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.14.bb
index 3b136b3b58..e7ac24abb8 100644
--- a/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.12.bb
+++ b/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.14.bb
@@ -9,7 +9,7 @@ UPSTREAM_CHECK_PYPI_PACKAGE = "${PYPI_PACKAGE}"
 
 inherit pypi python_setuptools_build_meta
 
-SRC_URI[sha256sum] = "5a38fd5ce39d223bebb9e3a6779e86b9427a03fb0bf9f270060f8b149cffe5e2"
+SRC_URI[sha256sum] = "7227b76aaec364df15936730efbf7d72b30c0b79b1d578bbb8e3dcb2d81f52b7"
 
 RDEPENDS:${PN} += "\
     python3-shell \
diff --git a/meta/recipes-devtools/python/python3-typing-extensions_4.13.2.bb b/meta/recipes-devtools/python/python3-typing-extensions_4.14.0.bb
index 9c83ae6c61..1c03aacc10 100644
--- a/meta/recipes-devtools/python/python3-typing-extensions_4.13.2.bb
+++ b/meta/recipes-devtools/python/python3-typing-extensions_4.14.0.bb
@@ -16,7 +16,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=fcf6b249c2641540219a727f35d8d2c2"
 PYPI_PACKAGE = "typing_extensions"
 UPSTREAM_CHECK_PYPI_PACKAGE = "${PYPI_PACKAGE}"
 
-SRC_URI[sha256sum] = "e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef"
+SRC_URI[sha256sum] = "8676b788e32f02ab42d9e7c61324048ae4c6d844a399eebace3d4979d75ceef4"
 
 inherit pypi python_flit_core
 
diff --git a/meta/recipes-devtools/repo/repo_2.55.bb b/meta/recipes-devtools/repo/repo_2.55.2.bb
index 5fea49abb3..9cff3c0b7c 100644
--- a/meta/recipes-devtools/repo/repo_2.55.bb
+++ b/meta/recipes-devtools/repo/repo_2.55.2.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 SRC_URI = "git://gerrit.googlesource.com/git-repo.git;protocol=https;branch=main;tag=v${PV} \
            "
-SRCREV = "08815ad3eb245872700201e03c47cb504d1dc3f9"
+SRCREV = "b262d0e4619c406a2708856ed312091d21c5bf39"
 
 MIRRORS += "git://gerrit.googlesource.com/git-repo.git git://github.com/GerritCodeReview/git-repo.git"
 
diff --git a/meta/recipes-extended/libsolv/libsolv_0.7.32.bb b/meta/recipes-extended/libsolv/libsolv_0.7.33.bb
index 71786e40dc..7584251420 100644
--- a/meta/recipes-extended/libsolv/libsolv_0.7.32.bb
+++ b/meta/recipes-extended/libsolv/libsolv_0.7.33.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://github.com/openSUSE/libsolv.git;branch=master;protocol=https \
            file://0001-utils-Conside-musl-when-wrapping-qsort_r.patch \
 "
 
-SRCREV = "95f64952e3270deb6be30ae4b786cae5c114c807"
+SRCREV = "9fb855d872139fb1ebebec4c892b338fccda69ba"
 
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)"
 
diff --git a/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-01.patch b/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-01.patch
new file mode 100644
index 0000000000..0d55512497
--- /dev/null
+++ b/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-01.patch
@@ -0,0 +1,91 @@
+From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
+From: Zephkeks <zephyrofficialdiscord@gmail.com>
+Date: Tue, 13 May 2025 11:04:17 +0200
+Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
+ get_name()
+
+Coordinated as GHSA-pfwf-h6m3-63wf
+
+CVE: CVE-2025-46836
+Upstream-Status: Backport [https://sourceforge.net/p/net-tools/code/ci/7a8f42fb20013a1493d8cae1c43436f85e656f2d/]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 39 insertions(+), 24 deletions(-)
+
+diff --git a/lib/interface.c b/lib/interface.c
+index 71d4163..a054f12 100644
+--- a/lib/interface.c
++++ b/lib/interface.c
+@@ -211,32 +211,47 @@ out:
+ }
+ 
+ static const char *get_name(char *name, const char *p)
++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
++   and the destination buffer is always NUL‑terminated.             */
+ {
+-    while (isspace(*p))
+-       p++;
+-    while (*p) {
+-       if (isspace(*p))
+-           break;
+-       if (*p == ':') {        /* could be an alias */
+-               const char *dot = p++;
+-               while (*p && isdigit(*p)) p++;
+-               if (*p == ':') {
+-                       /* Yes it is, backup and copy it. */
+-                       p = dot;
+-                       *name++ = *p++;
+-                       while (*p && isdigit(*p)) {
+-                               *name++ = *p++;
+-                       }
+-               } else {
+-                       /* No, it isn't */
+-                       p = dot;
+-           }
+-           p++;
+-           break;
+-       }
+-       *name++ = *p++;
++    char       *dst = name;                 /* current write ptr          */
++    const char *end = name + IFNAMSIZ - 1;  /* last byte we may write     */
++
++    /* Skip leading white‑space. */
++    while (isspace((unsigned char)*p))
++        ++p;
++
++    /* Copy until white‑space, end of string, or buffer full. */
++    while (*p && !isspace((unsigned char)*p) && dst < end) {
++        if (*p == ':') {                    /* possible alias veth0:123:  */
++            const char *dot = p;            /* remember the colon         */
++            ++p;
++            while (*p && isdigit((unsigned char)*p))
++                ++p;
++
++            if (*p == ':') {                /* confirmed alias            */
++                p = dot;                    /* rewind and copy it all     */
++
++                /* copy the colon */
++                if (dst < end)
++                    *dst++ = *p++;
++
++                /* copy the digits */
++                while (*p && isdigit((unsigned char)*p) && dst < end)
++                    *dst++ = *p++;
++
++                if (*p == ':')              /* consume trailing colon     */
++                    ++p;
++            } else {              /* if so treat as normal */
++                p = dot;
++            }
++            break;                          /* interface name ends here   */
++        }
++
++        *dst++ = *p++;                      /* ordinary character copy    */
+     }
+-    *name++ = '\0';
++
++    *dst = '\0';                            /* always NUL‑terminate       */
+     return p;
+ }
+ 
diff --git a/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-02.patch b/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-02.patch
new file mode 100644
index 0000000000..d2c3673a24
--- /dev/null
+++ b/meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-02.patch
@@ -0,0 +1,31 @@
+From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001
+From: Bernd Eckenfels <net-tools@lina.inka.de>
+Date: Sat, 17 May 2025 21:53:23 +0200
+Subject: [PATCH] Interface statistic regression after 7a8f42fb2
+
+CVE: CVE-2025-46836
+Upstream-Status: Backport [https://sourceforge.net/p/net-tools/code/ci/ddb0e375fb9ca95bb69335540b85bbdaa2714348/]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/interface.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/lib/interface.c b/lib/interface.c
+index a054f12..ca4adf1 100644
+--- a/lib/interface.c
++++ b/lib/interface.c
+@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p)
+                 /* copy the digits */
+                 while (*p && isdigit((unsigned char)*p) && dst < end)
+                     *dst++ = *p++;
+-
+-                if (*p == ':')              /* consume trailing colon     */
+-                    ++p;
+             } else {              /* if so treat as normal */
+                 p = dot;
+             }
++            if (*p == ':')                  /* consume trailing colon */
++                ++p;
+             break;                          /* interface name ends here   */
+         }
+ 
diff --git a/meta/recipes-extended/net-tools/net-tools_2.10.bb b/meta/recipes-extended/net-tools/net-tools_2.10.bb
index 7facc0cc8d..547079f4cf 100644
--- a/meta/recipes-extended/net-tools/net-tools_2.10.bb
+++ b/meta/recipes-extended/net-tools/net-tools_2.10.bb
@@ -11,6 +11,8 @@ SRC_URI = "git://git.code.sf.net/p/net-tools/code;protocol=https;branch=master \
     file://net-tools-config.h \
     file://net-tools-config.make \
     file://Add_missing_headers.patch \
+    file://CVE-2025-46836-01.patch \
+    file://CVE-2025-46836-02.patch \
 "
 
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-gnome/gtk+/gtk4_4.18.5.bb b/meta/recipes-gnome/gtk+/gtk4_4.18.6.bb
index 85773b1174..092f8d309f 100644
--- a/meta/recipes-gnome/gtk+/gtk4_4.18.5.bb
+++ b/meta/recipes-gnome/gtk+/gtk4_4.18.6.bb
@@ -38,7 +38,7 @@ MAJ_VER = "${@oe.utils.trim_version("${PV}", 2)}"
 UPSTREAM_CHECK_REGEX = "gtk-(?P<pver>\d+\.(\d*[02468])+(\.\d+)+)\.tar.xz"
 
 SRC_URI = "http://ftp.gnome.org/pub/gnome/sources/gtk/${MAJ_VER}/gtk-${PV}.tar.xz"
-SRC_URI[sha256sum] = "bb5267a062f5936947d34c9999390a674b0b2b0d8aa3472fe0d05e2064955abc"
+SRC_URI[sha256sum] = "e1817c650ddc3261f9a8345b3b22a26a5d80af154630dedc03cc7becefffd0fa"
 
 S = "${WORKDIR}/gtk-${PV}"
 
diff --git a/meta/recipes-graphics/drm/libdrm_2.4.124.bb b/meta/recipes-graphics/drm/libdrm_2.4.125.bb
index 78f31ccb95..a256f73145 100644
--- a/meta/recipes-graphics/drm/libdrm_2.4.124.bb
+++ b/meta/recipes-graphics/drm/libdrm_2.4.125.bb
@@ -13,7 +13,7 @@ DEPENDS = "libpthread-stubs"
 SRC_URI = "http://dri.freedesktop.org/libdrm/${BP}.tar.xz \
           "
 
-SRC_URI[sha256sum] = "ac36293f61ca4aafaf4b16a2a7afff312aa4f5c37c9fbd797de9e3c0863ca379"
+SRC_URI[sha256sum] = "d4bae92797a50f81a93524762e0410a49cd84cfa0f997795bc0172ac8fb1d96a"
 
 inherit meson pkgconfig manpages
 
diff --git a/meta/recipes-graphics/jpeg/libjpeg-turbo_3.1.0.bb b/meta/recipes-graphics/jpeg/libjpeg-turbo_3.1.1.bb
index a5f1932a90..2b39a4c1d9 100644
--- a/meta/recipes-graphics/jpeg/libjpeg-turbo_3.1.0.bb
+++ b/meta/recipes-graphics/jpeg/libjpeg-turbo_3.1.1.bb
@@ -9,7 +9,7 @@ DEPENDS:append:x86-64:class-target = " nasm-native"
 DEPENDS:append:x86:class-target = " nasm-native"
 
 SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.gz"
-SRC_URI[sha256sum] = "9564c72b1dfd1d6fe6274c5f95a8d989b59854575d4bbee44ade7bc17aa9bc93"
+SRC_URI[sha256sum] = "aadc97ea91f6ef078b0ae3a62bba69e008d9a7db19b34e4ac973b19b71b4217c"
 
 PE = "1"
 
diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.32.6.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.32.8.bb
index 75710b962a..57758de8b3 100644
--- a/meta/recipes-graphics/libsdl2/libsdl2_2.32.6.bb
+++ b/meta/recipes-graphics/libsdl2/libsdl2_2.32.8.bb
@@ -25,7 +25,7 @@ SRC_URI = "http://www.libsdl.org/release/SDL2-${PV}.tar.gz"
 
 S = "${WORKDIR}/SDL2-${PV}"
 
-SRC_URI[sha256sum] = "6a7a40d6c2e00016791815e1a9f4042809210bdf10cc78d2c75b45c4f52f93ad"
+SRC_URI[sha256sum] = "0ca83e9c9b31e18288c7ec811108e58bac1f1bb5ec6577ad386830eac51c787e"
 
 inherit cmake lib_package binconfig-disabled pkgconfig upstream-version-is-even
 UPSTREAM_CHECK_REGEX = "SDL2-(?P<pver>\d+\.(\d*[02468])+(\.\d+)+)\.tar"
diff --git a/meta/recipes-graphics/mesa/mesa.inc b/meta/recipes-graphics/mesa/mesa.inc
index b222e72fdd..56ac18ea53 100644
--- a/meta/recipes-graphics/mesa/mesa.inc
+++ b/meta/recipes-graphics/mesa/mesa.inc
@@ -93,10 +93,10 @@ PACKAGECONFIG = " \
 # skip all Rust dependencies if we are not building OpenCL"
 INHIBIT_DEFAULT_RUST_DEPS = "${@bb.utils.contains('PACKAGECONFIG', 'opencl', '', '1', d)}"
 
-PACKAGECONFIG:append:x86 = " libclc gallium-llvm intel amd svga"
-PACKAGECONFIG:append:x86-64 = " libclc gallium-llvm intel amd svga"
-PACKAGECONFIG:append:i686 = " libclc gallium-llvm intel amd svga"
-PACKAGECONFIG:append:class-native = " libclc gallium-llvm amd svga"
+PACKAGECONFIG:append:x86 = " libclc gallium-llvm intel amd nouveau svga"
+PACKAGECONFIG:append:x86-64 = " libclc gallium-llvm intel amd nouveau svga"
+PACKAGECONFIG:append:i686 = " libclc gallium-llvm intel amd nouveau svga"
+PACKAGECONFIG:append:class-native = " libclc gallium-llvm amd nouveau svga"
 
 # "gbm" requires "opengl"
 PACKAGECONFIG[gbm] = "-Dgbm=enabled,-Dgbm=disabled"
@@ -171,15 +171,18 @@ GALLIUMDRIVERS:append = "${@bb.utils.contains('PACKAGECONFIG', 'v3d', ',v3d', ''
 GALLIUMDRIVERS:append = "${@bb.utils.contains('PACKAGECONFIG', 'zink', ',zink', '', d)}"
 
 GALLIUMDRIVERS_ASAHI = "${@bb.utils.contains('PACKAGECONFIG', 'asahi libclc opencl', ',asahi', '', d)}"
+GALLIUMDRIVERS_AMD = "${@bb.utils.contains('PACKAGECONFIG', 'amd', ',r300', '', d)}"
 GALLIUMDRIVERS_IRIS = "${@bb.utils.contains('PACKAGECONFIG', 'intel libclc', ',iris', '', d)}"
+GALLIUMDRIVERS_NOUVEAU = "${@bb.utils.contains('PACKAGECONFIG', 'nouveau', ',nouveau', '', d)}"
 GALLIUMDRIVERS_RADEONSI = "${@bb.utils.contains('PACKAGECONFIG', 'amd', ',radeonsi', '', d)}"
 GALLIUMDRIVERS_LLVMPIPE = ",llvmpipe"
 # llvmpipe crashes on x32
 GALLIUMDRIVERS_LLVMPIPE:x86-x32 = ""
 GALLIUMDRIVERS_SVGA = "${@bb.utils.contains('PACKAGECONFIG', 'svga', ',svga', '', d)}"
-GALLIUMDRIVERS_LLVM = ",r300,nouveau${GALLIUMDRIVERS_LLVMPIPE}${GALLIUMDRIVERS_ASAHI}${GALLIUMDRIVERS_IRIS}${GALLIUMDRIVERS_RADEONSI}${GALLIUMDRIVERS_SVGA}"
+GALLIUMDRIVERS_LLVM = "${GALLIUMDRIVERS_LLVMPIPE}${GALLIUMDRIVERS_AMD}${GALLIUMDRIVERS_ASAHI}${GALLIUMDRIVERS_IRIS}${GALLIUMDRIVERS_NOUVEAU}${GALLIUMDRIVERS_RADEONSI}${GALLIUMDRIVERS_SVGA}"
 
 PACKAGECONFIG[amd] = ""
+PACKAGECONFIG[nouveau] = ""
 PACKAGECONFIG[svga] = ""
 PACKAGECONFIG[virgl] = ""
 
diff --git a/meta/recipes-graphics/wayland/wayland-protocols_1.44.bb b/meta/recipes-graphics/wayland/wayland-protocols_1.45.bb
index c86f09eb7c..d98ccf964f 100644
--- a/meta/recipes-graphics/wayland/wayland-protocols_1.44.bb
+++ b/meta/recipes-graphics/wayland/wayland-protocols_1.45.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=c7b12b6702da38ca028ace54aae3d484 \
                     file://stable/presentation-time/presentation-time.xml;endline=26;md5=4646cd7d9edc9fa55db941f2d3a7dc53"
 
 SRC_URI = "https://gitlab.freedesktop.org/wayland/wayland-protocols/-/releases/${PV}/downloads/wayland-protocols-${PV}.tar.xz"
-SRC_URI[sha256sum] = "3df1107ecf8bfd6ee878aeca5d3b7afd81248a48031e14caf6ae01f14eebb50e"
+SRC_URI[sha256sum] = "4d2b2a9e3e099d017dc8107bf1c334d27bb87d9e4aff19a0c8d856d17cd41ef0"
 
 UPSTREAM_CHECK_URI = "https://gitlab.freedesktop.org/wayland/wayland-protocols/-/tags"
 UPSTREAM_CHECK_REGEX = "releases/(?P<pver>.+)"
diff --git a/meta/recipes-graphics/wayland/weston_14.0.1.bb b/meta/recipes-graphics/wayland/weston_14.0.2.bb
index 2a0a403d99..03b49d730e 100644
--- a/meta/recipes-graphics/wayland/weston_14.0.1.bb
+++ b/meta/recipes-graphics/wayland/weston_14.0.2.bb
@@ -13,7 +13,7 @@ SRC_URI = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${PV}/downlo
            file://systemd-notify.weston-start \
            "
 
-SRC_URI[sha256sum] = "a8150505b126a59df781fe8c30c8e6f87da7013e179039eb844a5bbbcc7c79b3"
+SRC_URI[sha256sum] = "b47216b3530da76d02a3a1acbf1846a9cd41d24caa86448f9c46f78f20b6e0ac"
 
 UPSTREAM_CHECK_URI = "https://gitlab.freedesktop.org/wayland/weston/-/tags"
 UPSTREAM_CHECK_REGEX = "releases/(?P<pver>\d+\.\d+\.(?!9\d+)\d+)"
@@ -92,7 +92,7 @@ PACKAGECONFIG[image-jpeg] = "-Dimage-jpeg=true,-Dimage-jpeg=false, jpeg"
 # screencasting via PipeWire
 PACKAGECONFIG[pipewire] = "-Dbackend-pipewire=true,-Dbackend-pipewire=false,pipewire"
 # VNC remote screensharing
-PACKAGECONFIG[vnc] = "-Dbackend-vnc=true,-Dbackend-vnc=false,neatvnc"
+PACKAGECONFIG[vnc] = "-Dbackend-vnc=true,-Dbackend-vnc=false,neatvnc libpam"
 
 
 do_install:append() {
diff --git a/meta/recipes-graphics/xorg-lib/pixman_0.46.0.bb b/meta/recipes-graphics/xorg-lib/pixman_0.46.2.bb
index c1c71fd420..71c7f9a98d 100644
--- a/meta/recipes-graphics/xorg-lib/pixman_0.46.0.bb
+++ b/meta/recipes-graphics/xorg-lib/pixman_0.46.2.bb
@@ -8,7 +8,7 @@ SECTION = "x11/libs"
 DEPENDS = "zlib"
 
 SRC_URI = "https://www.cairographics.org/releases/${BP}.tar.gz"
-SRC_URI[sha256sum] = "02d9ff7b8458ef61731c3d355f854bbf461fd0a4d3563c51f1c1c7b00638050d"
+SRC_URI[sha256sum] = "3e0de5ba6e356916946a3d958192f15505dcab85134771bfeab4ce4e29bbd733"
 
 # see http://cairographics.org/releases/ - only even minor versions are stable
 UPSTREAM_CHECK_REGEX = "pixman-(?P<pver>\d+\.(\d*[02468])+(\.\d+)+)"
diff --git a/meta/recipes-kernel/lttng/lttng-modules_2.13.18.bb b/meta/recipes-kernel/lttng/lttng-modules_2.13.19.bb
index 1b2327f609..63ba488515 100644
--- a/meta/recipes-kernel/lttng/lttng-modules_2.13.18.bb
+++ b/meta/recipes-kernel/lttng/lttng-modules_2.13.19.bb
@@ -17,7 +17,7 @@ SRC_URI = "https://lttng.org/files/${BPN}/${BPN}-${PV}.tar.bz2 \
 SRC_URI:append = " file://0001-src-Kbuild-change-missing-CONFIG_TRACEPOINTS-to-warn.patch \
                 "
 
-SRC_URI[sha256sum] = "a2f38e289817dbd1d2f12cfc1f20390230e16d56323cb58cc1db9874ced400ed"
+SRC_URI[sha256sum] = "06d704633749039f8fa72a954bec6486058386e2a0c3557b22c484698f9b34d5"
 
 export INSTALL_MOD_DIR = "kernel/lttng-modules"
 
diff --git a/meta/recipes-multimedia/libtheora/libtheora_1.2.0.bb b/meta/recipes-multimedia/libtheora/libtheora_1.2.0.bb
index 361d2c6e4a..1a1b5fce06 100644
--- a/meta/recipes-multimedia/libtheora/libtheora_1.2.0.bb
+++ b/meta/recipes-multimedia/libtheora/libtheora_1.2.0.bb
@@ -19,6 +19,11 @@ inherit autotools pkgconfig
 
 EXTRA_OECONF = "--disable-examples --disable-doc"
 
+# theora 1.2.0 has broken 32-bit arm assembler, see:
+# https://gitlab.xiph.org/xiph/theora/-/issues/2339
+# https://gitlab.xiph.org/xiph/theora/-/issues/2340
+EXTRA_OECONF:append:arm = " --disable-asm"
+
 # these old architectures don't support all the instructions from the asm source files
 EXTRA_OECONF:append:armv4 = " --disable-asm "
 EXTRA_OECONF:append:armv5 = " --disable-asm "
diff --git a/meta/recipes-multimedia/mpg123/mpg123_1.32.10.bb b/meta/recipes-multimedia/mpg123/mpg123_1.33.0.bb
index d559bc6417..2905bf0abc 100644
--- a/meta/recipes-multimedia/mpg123/mpg123_1.32.10.bb
+++ b/meta/recipes-multimedia/mpg123/mpg123_1.33.0.bb
@@ -10,7 +10,7 @@ LICENSE = "LGPL-2.1-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=e7b9c15fcfb986abb4cc5e8400a24169"
 
 SRC_URI = "https://www.mpg123.de/download/${BP}.tar.bz2"
-SRC_URI[sha256sum] = "87b2c17fe0c979d3ef38eeceff6362b35b28ac8589fbf1854b5be75c9ab6557c"
+SRC_URI[sha256sum] = "2290e3aede6f4d163e1a17452165af33caad4b5f0948f99429cfa2d8385faa9d"
 
 UPSTREAM_CHECK_REGEX = "mpg123-(?P<pver>\d+(\.\d+)+)\.tar"
 
diff --git a/meta/recipes-support/debianutils/debianutils_5.22.bb b/meta/recipes-support/debianutils/debianutils_5.23.1.bb
index f5deead51a..85955883a4 100644
--- a/meta/recipes-support/debianutils/debianutils_5.22.bb
+++ b/meta/recipes-support/debianutils/debianutils_5.23.1.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://debian/copyright;md5=4b667f30411d21bc8fd7db85d502a8e9
 SRC_URI = "git://salsa.debian.org/debian/debianutils.git;protocol=https;branch=master;tag=debian/${PV} \
            "
 
-SRCREV = "528fac5c7448989f33c54599ae6e4c2b84d41e21"
+SRCREV = "ab0eaf33b783ba578773af2557753d2b973ba5bb"
 
 inherit autotools update-alternatives
 
diff --git a/meta/recipes-support/diffoscope/diffoscope_297.bb b/meta/recipes-support/diffoscope/diffoscope_298.bb
index 6f6f4ac520..4a50059c99 100644
--- a/meta/recipes-support/diffoscope/diffoscope_297.bb
+++ b/meta/recipes-support/diffoscope/diffoscope_298.bb
@@ -12,7 +12,7 @@ PYPI_PACKAGE = "diffoscope"
 
 inherit pypi setuptools3
 
-SRC_URI[sha256sum] = "25532061c640b4be7496f9a726640e20ca0fcb8e46a8a1a46e51ac940a5f4e57"
+SRC_URI[sha256sum] = "9644b7e711df71f13c5f50f3d1353c1e6d09f462d342d9771576e75f3dd8c3e1"
 
 RDEPENDS:${PN} += "\
         binutils \
diff --git a/meta/recipes-support/hwdata/hwdata_0.395.bb b/meta/recipes-support/hwdata/hwdata_0.396.bb
index 73b846b181..291a4ef85d 100644
--- a/meta/recipes-support/hwdata/hwdata_0.395.bb
+++ b/meta/recipes-support/hwdata/hwdata_0.396.bb
@@ -8,7 +8,7 @@ LICENSE = "GPL-2.0-or-later | X11"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=1556547711e8246992b999edd9445a57"
 
 SRC_URI = "git://github.com/vcrhonek/${BPN}.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "95c1de6c4a0d40415867b29c0791480fb8ad3cdb"
+SRCREV = "736513dfc1d44c5fb48bead62af7e91c4e1d1dd2"
 
 S = "${WORKDIR}/git"
 
diff --git a/meta/recipes-support/libcheck/libcheck_0.15.2.bb b/meta/recipes-support/libcheck/libcheck_0.15.2.bb
index 5ab67b8728..8455f2c748 100644
--- a/meta/recipes-support/libcheck/libcheck_0.15.2.bb
+++ b/meta/recipes-support/libcheck/libcheck_0.15.2.bb
@@ -18,15 +18,16 @@ GITHUB_BASE_URI = "https://github.com/libcheck/check/releases/"
 
 S = "${WORKDIR}/check-${PV}"
 
-inherit autotools pkgconfig texinfo github-releases
-
-CACHED_CONFIGUREVARS += "ac_cv_path_AWK_PATH=${bindir}/gawk"
+inherit cmake pkgconfig texinfo github-releases
 
 RREPLACES:${PN} = "check (<= 0.9.5)"
 
+EXTRA_OECMAKE:append:class-target = " -DAWK_PATH=${bindir}/awk"
+
 do_install:append:class-native() {
     create_cmdline_shebang_wrapper ${D}${bindir}/checkmk
 }
+
 BBCLASSEXTEND = "native nativesdk"
 
 PACKAGES =+ "checkmk"
@@ -34,3 +35,4 @@ PACKAGES =+ "checkmk"
 FILES:checkmk = "${bindir}/checkmk"
 
 RDEPENDS:checkmk = "gawk"
+
diff --git a/meta/recipes-support/libffi/libffi/not-win32.patch b/meta/recipes-support/libffi/libffi/not-win32.patch
index 8efeb9c357..26263731f3 100644
--- a/meta/recipes-support/libffi/libffi/not-win32.patch
+++ b/meta/recipes-support/libffi/libffi/not-win32.patch
@@ -1,4 +1,4 @@
-From d7263091bbea40fd97d4fccd295c0ea4f5a80ad7 Mon Sep 17 00:00:00 2001
+From 28d0fd6b73163fc2dbc10c7dc838a8222671f88c Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Thu, 4 Feb 2016 16:22:50 +0000
 Subject: [PATCH] libffi: ensure sysroot paths are not in libffi.pc
@@ -20,10 +20,10 @@ Signed-off-by: Ross Burton <ross.burton@intel.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index f047895..630bdd5 100644
+index 258107d..ef1a285 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -402,7 +402,7 @@ AC_ARG_ENABLE(multi-os-directory,
+@@ -403,7 +403,7 @@ AC_ARG_ENABLE(multi-os-directory,
  
  # These variables are only ever used when we cross-build to X86_WIN32.
  # And we only support this with GCC, so...
diff --git a/meta/recipes-support/libffi/libffi_3.4.8.bb b/meta/recipes-support/libffi/libffi_3.5.1.bb
index 7f927c650b..be16008e0f 100644
--- a/meta/recipes-support/libffi/libffi_3.4.8.bb
+++ b/meta/recipes-support/libffi/libffi_3.5.1.bb
@@ -8,12 +8,12 @@ library really only provides the lowest, machine dependent layer of a fully feat
 A layer must exist above `libffi' that handles type conversions for values passed between the two languages."
 
 LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=1db54c9fd307a12218766c3c7f650ca7"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=ce4763670c5b7756000561f9af1ab178"
 
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BPN}-${PV}.tar.gz \
            file://not-win32.patch \
            "
-SRC_URI[sha256sum] = "bc9842a18898bfacb0ed1252c4febcc7e78fa139fd27fdc7a3e30d9d9356119b"
+SRC_URI[sha256sum] = "f99eb68a67c7d54866b7706af245e87ba060d419a062474b456d3bc8d4abdbd1"
 
 EXTRA_OECONF += "--disable-builddir --disable-exec-static-tramp"
 EXTRA_OECONF:class-native += "--with-gcc-arch=generic"
diff --git a/scripts/install-buildtools b/scripts/install-buildtools
index 6750ffcbcc..aa23942858 100755
--- a/scripts/install-buildtools
+++ b/scripts/install-buildtools
@@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout)
 
 DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools')
 DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto'
-DEFAULT_RELEASE = 'yocto-5.2'
-DEFAULT_INSTALLER_VERSION = '5.2'
+DEFAULT_RELEASE = 'yocto-5.2.1'
+DEFAULT_INSTALLER_VERSION = '5.2.1'
 DEFAULT_BUILDDATE = '202110XX'
 
 # Python version sanity check
diff --git a/scripts/lib/devtool/ide_plugins/ide_code.py b/scripts/lib/devtool/ide_plugins/ide_code.py
index a62b93224e..ee5bb57265 100644
--- a/scripts/lib/devtool/ide_plugins/ide_code.py
+++ b/scripts/lib/devtool/ide_plugins/ide_code.py
@@ -161,7 +161,6 @@ class IdeVSCode(IdeBase):
         if modified_recipe.build_tool is not BuildTool.CMAKE:
             return
         recommendations += [
-            "twxs.cmake",
             "ms-vscode.cmake-tools",
             "ms-vscode.cpptools",
             "ms-vscode.cpptools-extension-pack",
diff --git a/scripts/lib/recipetool/create.py b/scripts/lib/recipetool/create.py
index 94d52d6077..3c6ef6719f 100644
--- a/scripts/lib/recipetool/create.py
+++ b/scripts/lib/recipetool/create.py
@@ -18,6 +18,7 @@ from urllib.parse import urlparse, urldefrag, urlsplit
 import hashlib
 import bb.fetch2
 logger = logging.getLogger('recipetool')
+from oe.license_finder import find_licenses
 
 tinfoil = None
 plugins = None
@@ -1040,230 +1041,6 @@ def handle_license_vars(srctree, lines_before, handled, extravalues, d):
     handled.append(('license', licvalues))
     return licvalues
 
-def get_license_md5sums(d, static_only=False, linenumbers=False):
-    import bb.utils
-    import csv
-    md5sums = {}
-    if not static_only and not linenumbers:
-        # Gather md5sums of license files in common license dir
-        commonlicdir = d.getVar('COMMON_LICENSE_DIR')
-        for fn in os.listdir(commonlicdir):
-            md5value = bb.utils.md5_file(os.path.join(commonlicdir, fn))
-            md5sums[md5value] = fn
-
-    # The following were extracted from common values in various recipes
-    # (double checking the license against the license file itself, not just
-    # the LICENSE value in the recipe)
-
-    # Read license md5sums from csv file
-    scripts_path = os.path.dirname(os.path.realpath(__file__))
-    for path in (d.getVar('BBPATH').split(':')
-                + [os.path.join(scripts_path, '..', '..')]):
-        csv_path = os.path.join(path, 'lib', 'recipetool', 'licenses.csv')
-        if os.path.isfile(csv_path):
-            with open(csv_path, newline='') as csv_file:
-                fieldnames = ['md5sum', 'license', 'beginline', 'endline', 'md5']
-                reader = csv.DictReader(csv_file, delimiter=',', fieldnames=fieldnames)
-                for row in reader:
-                    if linenumbers:
-                        md5sums[row['md5sum']] = (
-                            row['license'], row['beginline'], row['endline'], row['md5'])
-                    else:
-                        md5sums[row['md5sum']] = row['license']
-
-    return md5sums
-
-def crunch_known_licenses(d):
-    '''
-    Calculate the MD5 checksums for the crunched versions of all common
-    licenses. Also add additional known checksums.
-    '''
-    
-    crunched_md5sums = {}
-
-    # common licenses
-    crunched_md5sums['ad4e9d34a2e966dfe9837f18de03266d'] = 'GFDL-1.1-only'
-    crunched_md5sums['d014fb11a34eb67dc717fdcfc97e60ed'] = 'GFDL-1.2-only'
-    crunched_md5sums['e020ca655b06c112def28e597ab844f1'] = 'GFDL-1.3-only'
-
-    # The following two were gleaned from the "forever" npm package
-    crunched_md5sums['0a97f8e4cbaf889d6fa51f84b89a79f6'] = 'ISC'
-    # https://github.com/waffle-gl/waffle/blob/master/LICENSE.txt
-    crunched_md5sums['50fab24ce589d69af8964fdbfe414c60'] = 'BSD-2-Clause'
-    # https://github.com/spigwitmer/fakeds1963s/blob/master/LICENSE
-    crunched_md5sums['88a4355858a1433fea99fae34a44da88'] = 'GPL-2.0-only'
-    # http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
-    crunched_md5sums['063b5c3ebb5f3aa4c85a2ed18a31fbe7'] = 'GPL-2.0-only'
-    # https://github.com/FFmpeg/FFmpeg/blob/master/COPYING.LGPLv2.1
-    crunched_md5sums['7f5202f4d44ed15dcd4915f5210417d8'] = 'LGPL-2.1-only'
-    # unixODBC-2.3.4 COPYING
-    crunched_md5sums['3debde09238a8c8e1f6a847e1ec9055b'] = 'LGPL-2.1-only'
-    # https://github.com/FFmpeg/FFmpeg/blob/master/COPYING.LGPLv3
-    crunched_md5sums['f90c613c51aa35da4d79dd55fc724ceb'] = 'LGPL-3.0-only'
-    # https://raw.githubusercontent.com/eclipse/mosquitto/v1.4.14/epl-v10
-    crunched_md5sums['efe2cb9a35826992b9df68224e3c2628'] = 'EPL-1.0'
-
-    # https://raw.githubusercontent.com/jquery/esprima/3.1.3/LICENSE.BSD
-    crunched_md5sums['80fa7b56a28e8c902e6af194003220a5'] = 'BSD-2-Clause'
-    # https://raw.githubusercontent.com/npm/npm-install-checks/master/LICENSE
-    crunched_md5sums['e659f77bfd9002659e112d0d3d59b2c1'] = 'BSD-2-Clause'
-    # https://raw.githubusercontent.com/silverwind/default-gateway/4.2.0/LICENSE
-    crunched_md5sums['4c641f2d995c47f5cb08bdb4b5b6ea05'] = 'BSD-2-Clause'
-    # https://raw.githubusercontent.com/tad-lispy/node-damerau-levenshtein/v1.0.5/LICENSE
-    crunched_md5sums['2b8c039b2b9a25f0feb4410c4542d346'] = 'BSD-2-Clause'
-    # https://raw.githubusercontent.com/terser/terser/v3.17.0/LICENSE
-    crunched_md5sums['8bd23871802951c9ad63855151204c2c'] = 'BSD-2-Clause'
-    # https://raw.githubusercontent.com/alexei/sprintf.js/1.0.3/LICENSE
-    crunched_md5sums['008c22318c8ea65928bf730ddd0273e3'] = 'BSD-3-Clause'
-    # https://raw.githubusercontent.com/Caligatio/jsSHA/v3.2.0/LICENSE
-    crunched_md5sums['0e46634a01bfef056892949acaea85b1'] = 'BSD-3-Clause'
-    # https://raw.githubusercontent.com/d3/d3-path/v1.0.9/LICENSE
-    crunched_md5sums['b5f72aef53d3b2b432702c30b0215666'] = 'BSD-3-Clause'
-    # https://raw.githubusercontent.com/feross/ieee754/v1.1.13/LICENSE
-    crunched_md5sums['a39327c997c20da0937955192d86232d'] = 'BSD-3-Clause'
-    # https://raw.githubusercontent.com/joyent/node-extsprintf/v1.3.0/LICENSE
-    crunched_md5sums['721f23a96ff4161ca3a5f071bbe18108'] = 'MIT'
-    # https://raw.githubusercontent.com/pvorb/clone/v0.2.0/LICENSE
-    crunched_md5sums['b376d29a53c9573006b9970709231431'] = 'MIT'
-    # https://raw.githubusercontent.com/andris9/encoding/v0.1.12/LICENSE
-    crunched_md5sums['85d8a977ee9d7c5ab4ac03c9b95431c4'] = 'MIT-0'
-    # https://raw.githubusercontent.com/faye/websocket-driver-node/0.7.3/LICENSE.md
-    crunched_md5sums['b66384e7137e41a9b1904ef4d39703b6'] = 'Apache-2.0'
-    # https://raw.githubusercontent.com/less/less.js/v4.1.1/LICENSE
-    crunched_md5sums['b27575459e02221ccef97ec0bfd457ae'] = 'Apache-2.0'
-    # https://raw.githubusercontent.com/microsoft/TypeScript/v3.5.3/LICENSE.txt
-    crunched_md5sums['a54a1a6a39e7f9dbb4a23a42f5c7fd1c'] = 'Apache-2.0'
-    # https://raw.githubusercontent.com/request/request/v2.87.0/LICENSE
-    crunched_md5sums['1034431802e57486b393d00c5d262b8a'] = 'Apache-2.0'
-    # https://raw.githubusercontent.com/dchest/tweetnacl-js/v0.14.5/LICENSE
-    crunched_md5sums['75605e6bdd564791ab698fca65c94a4f'] = 'Unlicense'
-    # https://raw.githubusercontent.com/stackgl/gl-mat3/v2.0.0/LICENSE.md
-    crunched_md5sums['75512892d6f59dddb6d1c7e191957e9c'] = 'Zlib'
-
-    commonlicdir = d.getVar('COMMON_LICENSE_DIR')
-    for fn in sorted(os.listdir(commonlicdir)):
-        md5value, lictext = crunch_license(os.path.join(commonlicdir, fn))
-        if md5value not in crunched_md5sums:
-            crunched_md5sums[md5value] = fn
-        elif fn != crunched_md5sums[md5value]:
-            bb.debug(2, "crunched_md5sums['%s'] is already set to '%s' rather than '%s'" % (md5value, crunched_md5sums[md5value], fn))
-        else:
-            bb.debug(2, "crunched_md5sums['%s'] is already set to '%s'" % (md5value, crunched_md5sums[md5value]))
-
-    return crunched_md5sums
-
-def crunch_license(licfile):
-    '''
-    Remove non-material text from a license file and then calculate its
-    md5sum. This works well for licenses that contain a copyright statement,
-    but is also a useful way to handle people's insistence upon reformatting
-    the license text slightly (with no material difference to the text of the
-    license).
-    '''
-
-    import oe.utils
-
-    # Note: these are carefully constructed!
-    license_title_re = re.compile(r'^#*\(? *(This is )?([Tt]he )?.{0,15} ?[Ll]icen[sc]e( \(.{1,10}\))?\)?[:\.]? ?#*$')
-    license_statement_re = re.compile(r'^((This (project|software)|.{1,10}) is( free software)? (released|licen[sc]ed)|(Released|Licen[cs]ed)) under the .{1,10} [Ll]icen[sc]e:?$')
-    copyright_re = re.compile(r'^ *[#\*]* *(Modified work |MIT LICENSED )?Copyright ?(\([cC]\))? .*$')
-    disclaimer_re = re.compile(r'^ *\*? ?All [Rr]ights [Rr]eserved\.$')
-    email_re = re.compile(r'^.*<[\w\.-]*@[\w\.\-]*>$')
-    header_re = re.compile(r'^(\/\**!?)? ?[\-=\*]* ?(\*\/)?$')
-    tag_re = re.compile(r'^ *@?\(?([Ll]icense|MIT)\)?$')
-    url_re = re.compile(r'^ *[#\*]* *https?:\/\/[\w\.\/\-]+$')
-
-    lictext = []
-    with open(licfile, 'r', errors='surrogateescape') as f:
-        for line in f:
-            # Drop opening statements
-            if copyright_re.match(line):
-                continue
-            elif disclaimer_re.match(line):
-                continue
-            elif email_re.match(line):
-                continue
-            elif header_re.match(line):
-                continue
-            elif tag_re.match(line):
-                continue
-            elif url_re.match(line):
-                continue
-            elif license_title_re.match(line):
-                continue
-            elif license_statement_re.match(line):
-                continue
-            # Strip comment symbols
-            line = line.replace('*', '') \
-                       .replace('#', '')
-            # Unify spelling
-            line = line.replace('sub-license', 'sublicense')
-            # Squash spaces
-            line = oe.utils.squashspaces(line.strip())
-            # Replace smart quotes, double quotes and backticks with single quotes
-            line = line.replace(u"\u2018", "'").replace(u"\u2019", "'").replace(u"\u201c","'").replace(u"\u201d", "'").replace('"', '\'').replace('`', '\'')
-            # Unify brackets
-            line = line.replace("{", "[").replace("}", "]")
-            if line:
-                lictext.append(line)
-
-    m = hashlib.md5()
-    try:
-        m.update(' '.join(lictext).encode('utf-8'))
-        md5val = m.hexdigest()
-    except UnicodeEncodeError:
-        md5val = None
-        lictext = ''
-    return md5val, lictext
-
-def find_license_files(srctree):
-    licspecs = ['*LICEN[CS]E*', 'COPYING*', '*[Ll]icense*', 'LEGAL*', '[Ll]egal*', '*GPL*', 'README.lic*', 'COPYRIGHT*', '[Cc]opyright*', 'e[dp]l-v10']
-    skip_extensions = (".html", ".js", ".json", ".svg", ".ts", ".go")
-    licfiles = []
-    for root, dirs, files in os.walk(srctree):
-        for fn in files:
-            if fn.endswith(skip_extensions):
-                continue
-            for spec in licspecs:
-                if fnmatch.fnmatch(fn, spec):
-                    fullpath = os.path.join(root, fn)
-                    if not fullpath in licfiles:
-                        licfiles.append(fullpath)
-
-    return licfiles
-
-def match_licenses(licfiles, srctree, d):
-    import bb
-    md5sums = get_license_md5sums(d)
-
-    crunched_md5sums = crunch_known_licenses(d)
-
-    licenses = []
-    for licfile in sorted(licfiles):
-        resolved_licfile = d.expand(licfile)
-        md5value = bb.utils.md5_file(resolved_licfile)
-        license = md5sums.get(md5value, None)
-        if not license:
-            crunched_md5, lictext = crunch_license(resolved_licfile)
-            license = crunched_md5sums.get(crunched_md5, None)
-            if lictext and not license:
-                license = 'Unknown'
-                logger.info("Please add the following line for '%s' to a 'lib/recipetool/licenses.csv' " \
-                    "and replace `Unknown` with the license:\n" \
-                    "%s,Unknown" % (os.path.relpath(licfile, srctree + "/.."), md5value))
-        if license:
-            licenses.append((license, os.path.relpath(licfile, srctree), md5value))
-
-    return licenses
-
-def find_licenses(srctree, d):
-    licfiles = find_license_files(srctree)
-    licenses = match_licenses(licfiles, srctree, d)
-
-    # FIXME should we grab at least one source file with a license header and add that too?
-
-    return licenses
-
 def split_pkg_licenses(licvalues, packages, outlines, fallback_licenses=None, pn='${PN}'):
     """
     Given a list of (license, path, md5sum) as returned by match_licenses(),
diff --git a/scripts/lib/recipetool/create_npm.py b/scripts/lib/recipetool/create_npm.py
index 3363a0e7ee..8c4cdd5234 100644
--- a/scripts/lib/recipetool/create_npm.py
+++ b/scripts/lib/recipetool/create_npm.py
@@ -15,8 +15,9 @@ import bb
 from bb.fetch2.npm import NpmEnvironment
 from bb.fetch2.npm import npm_package
 from bb.fetch2.npmsw import foreach_dependencies
+from oe.license_finder import match_licenses, find_license_files
 from recipetool.create import RecipeHandler
-from recipetool.create import match_licenses, find_license_files, generate_common_licenses_chksums
+from recipetool.create import generate_common_licenses_chksums
 from recipetool.create import split_pkg_licenses
 logger = logging.getLogger('recipetool')
 
diff --git a/scripts/lib/recipetool/licenses.csv b/scripts/lib/recipetool/licenses.csv
deleted file mode 100644
index 80851111b3..0000000000
--- a/scripts/lib/recipetool/licenses.csv
+++ /dev/null
@@ -1,37 +0,0 @@
-0636e73ff0215e8d672dc4c32c317bb3,GPL-2.0-only
-12f884d2ae1ff87c09e5b7ccc2c4ca7e,GPL-2.0-only
-18810669f13b87348459e611d31ab760,GPL-2.0-only
-252890d9eee26aab7b432e8b8a616475,LGPL-2.0-only
-2d5025d4aa3495befef8f17206a5b0a1,LGPL-2.1-only
-3214f080875748938ba060314b4f727d,LGPL-2.0-only
-385c55653886acac3821999a3ccd17b3,Artistic-1.0 | GPL-2.0-only
-393a5ca445f6965873eca0259a17f833,GPL-2.0-only
-3b83ef96387f14655fc854ddc3c6bd57,Apache-2.0
-3bf50002aefd002f49e7bb854063f7e7,LGPL-2.0-only
-4325afd396febcb659c36b49533135d4,GPL-2.0-only
-4fbd65380cdd255951079008b364516c,LGPL-2.1-only
-54c7042be62e169199200bc6477f04d1,BSD-3-Clause
-55ca817ccb7d5b5b66355690e9abc605,LGPL-2.0-only
-59530bdf33659b29e73d4adb9f9f6552,GPL-2.0-only
-5f30f0716dfdd0d91eb439ebec522ec2,LGPL-2.0-only
-6a6a8e020838b23406c81b19c1d46df6,LGPL-3.0-only
-751419260aa954499f7abaabaa882bbe,GPL-2.0-only
-7fbc338309ac38fefcd64b04bb903e34,LGPL-2.1-only
-8ca43cbc842c2336e835926c2166c28b,GPL-2.0-only
-94d55d512a9ba36caa9b7df079bae19f,GPL-2.0-only
-9ac2e7cff1ddaf48b6eab6028f23ef88,GPL-2.0-only
-9f604d8a4f8e74f4f5140845a21b6674,LGPL-2.0-only
-a6f89e2100d9b6cdffcea4f398e37343,LGPL-2.1-only
-b234ee4d69f5fce4486a80fdaf4a4263,GPL-2.0-only
-bbb461211a33b134d42ed5ee802b37ff,LGPL-2.1-only
-bfe1f75d606912a4111c90743d6c7325,MPL-1.1-only
-c93c0550bd3173f4504b2cbd8991e50b,GPL-2.0-only
-d32239bcb673463ab874e80d47fae504,GPL-3.0-only
-d7810fab7487fb0aad327b76f1be7cd7,GPL-2.0-only
-d8045f3b8f929c1cb29a1e3fd737b499,LGPL-2.1-only
-db979804f025cf55aabec7129cb671ed,LGPL-2.0-only
-eb723b61539feef013de476e68b5c50a,GPL-2.0-only
-ebb5c50ab7cab4baeffba14977030c07,GPL-2.0-only
-f27defe1e96c2e1ecd4e0c9be8967949,GPL-3.0-only
-fad9b3332be894bab9bc501572864b29,LGPL-2.1-only
-fbc093901857fcd118f065f900982c24,LGPL-2.1-only
diff --git a/scripts/lib/wic/canned-wks/common.wks.inc b/scripts/lib/wic/canned-wks/common.wks.inc
index 89880b417b..4a440ddafe 100644
--- a/scripts/lib/wic/canned-wks/common.wks.inc
+++ b/scripts/lib/wic/canned-wks/common.wks.inc
@@ -1,3 +1,3 @@
 # This file is included into 3 canned wks files from this directory
-part /boot --source bootimg-pcbios --ondisk sda --label boot --active --align 1024
+part /boot --source bootimg_pcbios --ondisk sda --label boot --active --align 1024
 part / --source rootfs --use-uuid --fstype=ext4 --label platform --align 1024
diff --git a/scripts/lib/wic/canned-wks/directdisk-gpt.wks b/scripts/lib/wic/canned-wks/directdisk-gpt.wks
index 8d7d8de6ea..cb640056f1 100644
--- a/scripts/lib/wic/canned-wks/directdisk-gpt.wks
+++ b/scripts/lib/wic/canned-wks/directdisk-gpt.wks
@@ -3,7 +3,7 @@
 # can directly dd to boot media.
 
 
-part /boot --source bootimg-pcbios --ondisk sda --label boot --active --align 1024
+part /boot --source bootimg_pcbios --ondisk sda --label boot --active --align 1024
 part / --source rootfs --ondisk sda --fstype=ext4 --label platform --align 1024 --use-uuid
 
 bootloader  --ptable gpt --timeout=0  --append="rootwait rootfstype=ext4 video=vesafb vga=0x318 console=tty0 console=ttyS0,115200n8"
diff --git a/scripts/lib/wic/canned-wks/directdisk-multi-rootfs.wks b/scripts/lib/wic/canned-wks/directdisk-multi-rootfs.wks
index f61d941d6d..4fd1999ffb 100644
--- a/scripts/lib/wic/canned-wks/directdisk-multi-rootfs.wks
+++ b/scripts/lib/wic/canned-wks/directdisk-multi-rootfs.wks
@@ -15,7 +15,7 @@
 #
 #   - or any combinations of -r and --rootfs command line options
 
-part /boot --source bootimg-pcbios --ondisk sda --label boot --active --align 1024
+part /boot --source bootimg_pcbios --ondisk sda --label boot --active --align 1024
 part / --source rootfs --rootfs-dir=rootfs1 --ondisk sda --fstype=ext4 --label platform --align 1024
 part /rescue --source rootfs --rootfs-dir=rootfs2 --ondisk sda --fstype=ext4 --label secondary --align 1024
 
diff --git a/scripts/lib/wic/canned-wks/efi-uki-bootdisk.wks.in b/scripts/lib/wic/canned-wks/efi-uki-bootdisk.wks.in
index 67cc41a241..cac0fa32cd 100644
--- a/scripts/lib/wic/canned-wks/efi-uki-bootdisk.wks.in
+++ b/scripts/lib/wic/canned-wks/efi-uki-bootdisk.wks.in
@@ -1,3 +1,3 @@
 bootloader --ptable gpt --timeout=5
-part /boot --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}" --label boot --active --align 1024 --use-uuid --part-name="ESP" --part-type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B --overhead-factor=1
+part /boot --source bootimg_efi --sourceparams="loader=${EFI_PROVIDER}" --label boot --active --align 1024 --use-uuid --part-name="ESP" --part-type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B --overhead-factor=1
 part / --source rootfs --fstype=ext4 --label root --align 1024 --exclude-path boot/
diff --git a/scripts/lib/wic/canned-wks/mkefidisk.wks b/scripts/lib/wic/canned-wks/mkefidisk.wks
index 5fa6682a9e..16dfe76dfe 100644
--- a/scripts/lib/wic/canned-wks/mkefidisk.wks
+++ b/scripts/lib/wic/canned-wks/mkefidisk.wks
@@ -2,7 +2,7 @@
 # long-description: Creates a partitioned EFI disk image that the user
 # can directly dd to boot media.
 
-part /boot --source bootimg-efi --sourceparams="loader=grub-efi" --ondisk sda --label msdos --active --align 1024
+part /boot --source bootimg_efi --sourceparams="loader=grub-efi" --ondisk sda --label msdos --active --align 1024
 
 part / --source rootfs --ondisk sda --fstype=ext4 --label platform --align 1024 --use-uuid
 
diff --git a/scripts/lib/wic/canned-wks/mkhybridiso.wks b/scripts/lib/wic/canned-wks/mkhybridiso.wks
index 48c5ac4791..c3a030e5b4 100644
--- a/scripts/lib/wic/canned-wks/mkhybridiso.wks
+++ b/scripts/lib/wic/canned-wks/mkhybridiso.wks
@@ -2,6 +2,6 @@
 # long-description: Creates an EFI and legacy bootable hybrid ISO image
 # which can be used on optical media as well as USB media.
 
-part /boot --source isoimage-isohybrid --sourceparams="loader=grub-efi,image_name=HYBRID_ISO_IMG" --ondisk cd --label HYBRIDISO
+part /boot --source isoimage_isohybrid --sourceparams="loader=grub-efi,image_name=HYBRID_ISO_IMG" --ondisk cd --label HYBRIDISO
 
 bootloader  --timeout=15  --append=""
diff --git a/scripts/lib/wic/canned-wks/sdimage-bootpart.wks b/scripts/lib/wic/canned-wks/sdimage-bootpart.wks
index 63bc4dab6a..f9f8044f7d 100644
--- a/scripts/lib/wic/canned-wks/sdimage-bootpart.wks
+++ b/scripts/lib/wic/canned-wks/sdimage-bootpart.wks
@@ -2,5 +2,5 @@
 # long-description: Creates a partitioned SD card image. Boot files
 # are located in the first vfat partition.
 
-part /boot --source bootimg-partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4 --size 16
+part /boot --source bootimg_partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4 --size 16
 part / --source rootfs --ondisk mmcblk0 --fstype=ext4 --label root --align 4
diff --git a/scripts/lib/wic/canned-wks/systemd-bootdisk.wks b/scripts/lib/wic/canned-wks/systemd-bootdisk.wks
index 95d7b97a60..3fb2c0e35f 100644
--- a/scripts/lib/wic/canned-wks/systemd-bootdisk.wks
+++ b/scripts/lib/wic/canned-wks/systemd-bootdisk.wks
@@ -2,7 +2,7 @@
 # long-description: Creates a partitioned EFI disk image that the user
 # can directly dd to boot media. The selected bootloader is systemd-boot.
 
-part /boot --source bootimg-efi --sourceparams="loader=systemd-boot" --ondisk sda --label msdos --active --align 1024 --use-uuid
+part /boot --source bootimg_efi --sourceparams="loader=systemd-boot" --ondisk sda --label msdos --active --align 1024 --use-uuid
 
 part / --source rootfs --ondisk sda --fstype=ext4 --label platform --align 1024 --use-uuid
 
diff --git a/scripts/lib/wic/engine.py b/scripts/lib/wic/engine.py
index 64b1d52882..b9e60cbe4e 100644
--- a/scripts/lib/wic/engine.py
+++ b/scripts/lib/wic/engine.py
@@ -180,6 +180,8 @@ def wic_create(wks_file, rootfs_dir, bootimg_dir, kernel_dir,
         os.makedirs(options.outdir)
 
     pname = options.imager
+    # Don't support '-' in plugin names
+    pname = pname.replace("-", "_")
     plugin_class = PluginMgr.get_plugins('imager').get(pname)
     if not plugin_class:
         raise WicError('Unknown plugin: %s' % pname)
diff --git a/scripts/lib/wic/help.py b/scripts/lib/wic/help.py
index 9180d75a92..2e3061f343 100644
--- a/scripts/lib/wic/help.py
+++ b/scripts/lib/wic/help.py
@@ -544,18 +544,18 @@ DESCRIPTION
     the --source param given to that partition.  For example, if the
     partition is set up like this:
 
-      part /boot --source bootimg-pcbios   ...
+      part /boot --source bootimg_pcbios   ...
 
     then the methods defined as class members of the plugin having the
-    matching bootimg-pcbios .name class member would be used.
+    matching bootimg_pcbios .name class member would be used.
 
     To be more concrete, here's the plugin definition that would match
-    a '--source bootimg-pcbios' usage, along with an example method
+    a '--source bootimg_pcbios' usage, along with an example method
     that would be called by the wic implementation when it needed to
     invoke an implementation-specific partition-preparation function:
 
     class BootimgPcbiosPlugin(SourcePlugin):
-        name = 'bootimg-pcbios'
+        name = 'bootimg_pcbios'
 
     @classmethod
         def do_prepare_partition(self, part, ...)
@@ -794,7 +794,7 @@ DESCRIPTION
 
      Here is a content of test.wks:
 
-     part /boot --source bootimg-pcbios --ondisk sda --label boot --active --align 1024
+     part /boot --source bootimg_pcbios --ondisk sda --label boot --active --align 1024
      part / --source rootfs --ondisk sda --fstype=ext3 --label platform --align 1024
 
      bootloader  --timeout=0  --append="rootwait rootfstype=ext3 video=vesafb vga=0x318 console=tty0"
diff --git a/scripts/lib/wic/partition.py b/scripts/lib/wic/partition.py
index 5b51ab214f..b34691d313 100644
--- a/scripts/lib/wic/partition.py
+++ b/scripts/lib/wic/partition.py
@@ -164,6 +164,9 @@ class Partition():
 
         plugins = PluginMgr.get_plugins('source')
 
+        # Don't support '-' in plugin names
+        self.source = self.source.replace("-", "_")
+
         if self.source not in plugins:
             raise WicError("The '%s' --source specified for %s doesn't exist.\n\t"
                            "See 'wic list source-plugins' for a list of available"
@@ -178,7 +181,7 @@ class Partition():
             splitted = self.sourceparams.split(',')
             srcparams_dict = dict((par.split('=', 1) + [None])[:2] for par in splitted if par)
 
-        plugin = PluginMgr.get_plugins('source')[self.source]
+        plugin = plugins[self.source]
         plugin.do_configure_partition(self, srcparams_dict, creator,
                                       cr_workdir, oe_builddir, bootimg_dir,
                                       kernel_dir, native_sysroot)
diff --git a/scripts/lib/wic/pluginbase.py b/scripts/lib/wic/pluginbase.py
index b64568339b..640da292d3 100644
--- a/scripts/lib/wic/pluginbase.py
+++ b/scripts/lib/wic/pluginbase.py
@@ -44,7 +44,7 @@ class PluginMgr:
                     path = os.path.join(layer_path, script_plugin_dir)
                     path = os.path.abspath(os.path.expanduser(path))
                     if path not in cls._plugin_dirs and os.path.isdir(path):
-                        cls._plugin_dirs.insert(0, path)
+                        cls._plugin_dirs.append(path)
 
         if ptype not in PLUGINS:
             # load all ptype plugins
diff --git a/scripts/lib/wic/plugins/imager/direct.py b/scripts/lib/wic/plugins/imager/direct.py
index 2124ceac7f..6e1f1c8cba 100644
--- a/scripts/lib/wic/plugins/imager/direct.py
+++ b/scripts/lib/wic/plugins/imager/direct.py
@@ -203,6 +203,8 @@ class DirectPlugin(ImagerPlugin):
         source_plugin = self.ks.bootloader.source
         disk_name = self.parts[0].disk
         if source_plugin:
+            # Don't support '-' in plugin names
+            source_plugin = source_plugin.replace("-", "_")
             plugin = PluginMgr.get_plugins('source')[source_plugin]
             plugin.do_install_disk(self._image, disk_name, self, self.workdir,
                                    self.oe_builddir, self.bootimg_dir,
diff --git a/scripts/lib/wic/plugins/source/bootimg-biosplusefi.py b/scripts/lib/wic/plugins/source/bootimg_biosplusefi.py
index 5bd7390680..4279ddded8 100644
--- a/scripts/lib/wic/plugins/source/bootimg-biosplusefi.py
+++ b/scripts/lib/wic/plugins/source/bootimg_biosplusefi.py
@@ -13,7 +13,7 @@
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
 # DESCRIPTION
-# This implements the 'bootimg-biosplusefi' source plugin class for 'wic'
+# This implements the 'bootimg_biosplusefi' source plugin class for 'wic'
 #
 # AUTHORS
 # William Bourque <wbourque [at) gmail.com>
@@ -34,7 +34,7 @@ class BootimgBiosPlusEFIPlugin(SourcePlugin):
 
     Note it is possible to create an image that can boot from both
     legacy BIOS and EFI by defining two partitions : one with arg
-    --source bootimg-efi  and another one with --source bootimg-pcbios.
+    --source bootimg_efi  and another one with --source bootimg_pcbios.
     However, this method has the obvious downside that it requires TWO
     partitions to be created on the storage device.
     Both partitions will also be marked as "bootable" which does not work on
@@ -45,7 +45,7 @@ class BootimgBiosPlusEFIPlugin(SourcePlugin):
     the first partition will be duplicated into the second, even though it
     will not be used at all.
 
-    Also, unlike "isoimage-isohybrid" that also does BIOS and EFI, this plugin
+    Also, unlike "isoimage_isohybrid" that also does BIOS and EFI, this plugin
     allows you to have more than only a single rootfs partitions and does
     not turn the rootfs into an initramfs RAM image.
 
@@ -53,32 +53,32 @@ class BootimgBiosPlusEFIPlugin(SourcePlugin):
     does not have the limitations listed above.
 
     The plugin is made so it does tries not to reimplement what's already
-    been done in other plugins; as such it imports "bootimg-pcbios"
-    and "bootimg-efi".
-    Plugin "bootimg-pcbios" is used to generate legacy BIOS boot.
-    Plugin "bootimg-efi" is used to generate the UEFI boot. Note that it
+    been done in other plugins; as such it imports "bootimg_pcbios"
+    and "bootimg_efi".
+    Plugin "bootimg_pcbios" is used to generate legacy BIOS boot.
+    Plugin "bootimg_efi" is used to generate the UEFI boot. Note that it
     requires a --sourceparams argument to know which loader to use; refer
-    to "bootimg-efi" code/documentation for the list of loader.
+    to "bootimg_efi" code/documentation for the list of loader.
 
     Imports are handled with "SourceFileLoader" from importlib as it is
     otherwise very difficult to import module that has hyphen "-" in their
     filename.
     The SourcePlugin() methods used in the plugins (do_install_disk,
     do_configure_partition, do_prepare_partition) are then called on both,
-    beginning by "bootimg-efi".
+    beginning by "bootimg_efi".
 
     Plugin options, such as "--sourceparams" can still be passed to a
     plugin, as long they does not cause issue in the other plugin.
 
     Example wic configuration:
-    part /boot --source bootimg-biosplusefi --sourceparams="loader=grub-efi"\\
+    part /boot --source bootimg_biosplusefi --sourceparams="loader=grub-efi"\\
                --ondisk sda --label os_boot --active --align 1024 --use-uuid
     """
 
-    name = 'bootimg-biosplusefi'
+    name = 'bootimg_biosplusefi'
 
-    __PCBIOS_MODULE_NAME = "bootimg-pcbios"
-    __EFI_MODULE_NAME = "bootimg-efi"
+    __PCBIOS_MODULE_NAME = "bootimg_pcbios"
+    __EFI_MODULE_NAME = "bootimg_efi"
 
     __imgEFIObj = None
     __imgBiosObj = None
@@ -100,7 +100,7 @@ class BootimgBiosPlusEFIPlugin(SourcePlugin):
 
         """
 
-        # Import bootimg-pcbios (class name "BootimgPcbiosPlugin")
+        # Import bootimg_pcbios (class name "BootimgPcbiosPlugin")
         modulePath = os.path.join(os.path.dirname(os.path.realpath(__file__)),
                                   cls.__PCBIOS_MODULE_NAME + ".py")
         loader = SourceFileLoader(cls.__PCBIOS_MODULE_NAME, modulePath)
@@ -108,7 +108,7 @@ class BootimgBiosPlusEFIPlugin(SourcePlugin):
         loader.exec_module(mod)
         cls.__imgBiosObj = mod.BootimgPcbiosPlugin()
 
-        # Import bootimg-efi (class name "BootimgEFIPlugin")
+        # Import bootimg_efi (class name "BootimgEFIPlugin")
         modulePath = os.path.join(os.path.dirname(os.path.realpath(__file__)),
                                   cls.__EFI_MODULE_NAME + ".py")
         loader = SourceFileLoader(cls.__EFI_MODULE_NAME, modulePath)
diff --git a/scripts/lib/wic/plugins/source/bootimg-efi.py b/scripts/lib/wic/plugins/source/bootimg_efi.py
index 38da5080fb..cf16705a28 100644
--- a/scripts/lib/wic/plugins/source/bootimg-efi.py
+++ b/scripts/lib/wic/plugins/source/bootimg_efi.py
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # DESCRIPTION
-# This implements the 'bootimg-efi' source plugin class for 'wic'
+# This implements the 'bootimg_efi' source plugin class for 'wic'
 #
 # AUTHORS
 # Tom Zanussi <tom.zanussi (at] linux.intel.com>
@@ -32,7 +32,7 @@ class BootimgEFIPlugin(SourcePlugin):
     This plugin supports GRUB 2 and systemd-boot bootloaders.
     """
 
-    name = 'bootimg-efi'
+    name = 'bootimg_efi'
 
     @classmethod
     def _copy_additional_files(cls, hdddir, initrd, dtb):
@@ -230,9 +230,9 @@ class BootimgEFIPlugin(SourcePlugin):
             elif source_params['loader'] == 'uefi-kernel':
                 pass
             else:
-                raise WicError("unrecognized bootimg-efi loader: %s" % source_params['loader'])
+                raise WicError("unrecognized bootimg_efi loader: %s" % source_params['loader'])
         except KeyError:
-            raise WicError("bootimg-efi requires a loader, none specified")
+            raise WicError("bootimg_efi requires a loader, none specified")
 
         if get_bitbake_var("IMAGE_EFI_BOOT_FILES") is None:
             logger.debug('No boot files defined in IMAGE_EFI_BOOT_FILES')
@@ -365,7 +365,7 @@ class BootimgEFIPlugin(SourcePlugin):
                     out = exec_cmd(cp_cmd, True)
                     logger.debug("uefi-kernel files:\n%s" % out)
             else:
-                raise WicError("unrecognized bootimg-efi loader: %s" %
+                raise WicError("unrecognized bootimg_efi loader: %s" %
                                source_params['loader'])
 
             # must have installed at least one EFI bootloader
@@ -375,7 +375,7 @@ class BootimgEFIPlugin(SourcePlugin):
                 raise WicError("No EFI loaders installed to ESP partition. Check that grub-efi, systemd-boot or similar is installed.")
 
         except KeyError:
-            raise WicError("bootimg-efi requires a loader, none specified")
+            raise WicError("bootimg_efi requires a loader, none specified")
 
         startup = os.path.join(kernel_dir, "startup.nsh")
         if os.path.exists(startup):
diff --git a/scripts/lib/wic/plugins/source/bootimg-partition.py b/scripts/lib/wic/plugins/source/bootimg_partition.py
index 589853a439..cc121a78f0 100644
--- a/scripts/lib/wic/plugins/source/bootimg-partition.py
+++ b/scripts/lib/wic/plugins/source/bootimg_partition.py
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # DESCRIPTION
-# This implements the 'bootimg-partition' source plugin class for
+# This implements the 'bootimg_partition' source plugin class for
 # 'wic'. The plugin creates an image of boot partition, copying over
 # files listed in IMAGE_BOOT_FILES bitbake variable.
 #
@@ -31,7 +31,7 @@ class BootimgPartitionPlugin(SourcePlugin):
     listed in IMAGE_BOOT_FILES bitbake variable.
     """
 
-    name = 'bootimg-partition'
+    name = 'bootimg_partition'
     image_boot_files_var_name = 'IMAGE_BOOT_FILES'
 
     @classmethod
diff --git a/scripts/lib/wic/plugins/source/bootimg-pcbios.py b/scripts/lib/wic/plugins/source/bootimg_pcbios.py
index a207a83530..21f41e00bb 100644
--- a/scripts/lib/wic/plugins/source/bootimg-pcbios.py
+++ b/scripts/lib/wic/plugins/source/bootimg_pcbios.py
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # DESCRIPTION
-# This implements the 'bootimg-pcbios' source plugin class for 'wic'
+# This implements the 'bootimg_pcbios' source plugin class for 'wic'
 #
 # AUTHORS
 # Tom Zanussi <tom.zanussi (at] linux.intel.com>
@@ -27,7 +27,7 @@ class BootimgPcbiosPlugin(SourcePlugin):
     Create MBR boot partition and install syslinux on it.
     """
 
-    name = 'bootimg-pcbios'
+    name = 'bootimg_pcbios'
 
     @classmethod
     def _get_bootimg_dir(cls, bootimg_dir, dirname):
diff --git a/scripts/lib/wic/plugins/source/isoimage-isohybrid.py b/scripts/lib/wic/plugins/source/isoimage_isohybrid.py
index 607356ad13..5d42eb5d3e 100644
--- a/scripts/lib/wic/plugins/source/isoimage-isohybrid.py
+++ b/scripts/lib/wic/plugins/source/isoimage_isohybrid.py
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # DESCRIPTION
-# This implements the 'isoimage-isohybrid' source plugin class for 'wic'
+# This implements the 'isoimage_isohybrid' source plugin class for 'wic'
 #
 # AUTHORS
 # Mihaly Varga <mihaly.varga (at] ni.com>
@@ -35,7 +35,7 @@ class IsoImagePlugin(SourcePlugin):
     bootloader files.
 
     Example kickstart file:
-    part /boot --source isoimage-isohybrid --sourceparams="loader=grub-efi, \\
+    part /boot --source isoimage_isohybrid --sourceparams="loader=grub-efi, \\
     image_name= IsoImage" --ondisk cd --label LIVECD
     bootloader  --timeout=10  --append=" "
 
@@ -45,7 +45,7 @@ class IsoImagePlugin(SourcePlugin):
     extension added by direct imeger plugin) and a file named IsoImage-cd.iso
     """
 
-    name = 'isoimage-isohybrid'
+    name = 'isoimage_isohybrid'
 
     @classmethod
     def do_configure_syslinux(cls, creator, cr_workdir):
@@ -340,10 +340,10 @@ class IsoImagePlugin(SourcePlugin):
                     cls.do_configure_grubefi(part, creator, target_dir)
 
             else:
-                raise WicError("unrecognized bootimg-efi loader: %s" %
+                raise WicError("unrecognized bootimg_efi loader: %s" %
                                source_params['loader'])
         except KeyError:
-            raise WicError("bootimg-efi requires a loader, none specified")
+            raise WicError("bootimg_efi requires a loader, none specified")
 
         # Create efi.img that contains bootloader files for EFI booting
         # if ISODIR didn't exist or didn't contains it