summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* manuals: replace "_" by "__" in external linksMichael Opdenacker2022-10-286-13/+12
| | | | | | | (From yocto-docs rev: 25142cd8121fdd6a8e0524fc8417fc666c498981) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Documentation/README: formalize guidelines for external link syntaxMichael Opdenacker2022-10-281-0/+13
| | | | | | | (From yocto-docs rev: f5d10ceed943270d7bcfa31b5936f37a60669c7f) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: common-tasks.rst: refactor and improve "Checking for ↵Mikko Rapeli2022-10-281-46/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Vulnerabilities" section Add sub section to how Poky and OE-Core handle CVE security issues. This is a generic intro chapter. Also add note that this is a process which needs quite a bit of review and iteration to keep products and SW stack secure, a process not a product. Then change "Vulnerabilites in images" chapter to "Vulnerability check at build time" since the process applies to anything compiled with bitbake, not just images. Explain details of how to work with cve-check.bbclass, especially the states Patched, Unpatched and Ignored in the generated reports. Rename recipe chapter to "Fixing CVE product name and version mappings" since CVE check has some default which works for all recipes but generated reports may be completely broken. Fixes are then done with CVE_PRODUCT and CVE_VERSION. Give some hints how to analyze "Unpatched" CVEs by checking what happens in other Linux distros etc. (From yocto-docs rev: 77a9c1a9fe651bf11f1d5a723b0741dd1764b2c8) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: common-tasks.rst: add regular updates and CVE scans to security ↵Mikko Rapeli2022-10-281-0/+7
| | | | | | | | | | | | | best practices Regular security scans and updates to fix issues and updates from upstream maintainers are best practices. (From yocto-docs rev: 24d3337b6cbb38297877f6ce6ec78896ce93e8b2) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: classes.rst: improve documentation for cve-check.bbclassMikko Rapeli2022-10-281-2/+50
| | | | | | | | | | | It is a quite important tool for maintaining yocto based products so documentation should include the best practices. (From yocto-docs rev: 3f7d09fc3c96f29ab80a2cb893c9b4b19a75a769) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: variables.rst: add documentation for CVE_VERSIONMikko Rapeli2022-10-281-0/+12
| | | | | | | | | | Related to cve-check.bbclass. (From yocto-docs rev: 1218775a9b32ac16556645c5d186007c19a5baf4) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: add info on buildtools-make-tarballPaul Eggleton2022-10-281-1/+25
| | | | | | | | | | | | | PENDING ON THIS OE-CORE PATCH: install-buildtools: support buildtools-make-tarball and update to 4.1 https://lists.openembedded.org/g/openembedded-core/message/171522 Cover the use case and the new provided tarball. (From yocto-docs rev: 3a06c35d059d7d43f7eb33a4f490f5d76afe6cb6) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: add wic command bootloader ptable optionAdrian Freihofer2022-10-281-6/+11
| | | | | | | | | | Reordering the bootloader command options alphabetically (From yocto-docs rev: 9d43fcf8ba023be1350ed2b26482d2d5e44cf0cb) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: fix a typo for CVE-2022-2953.patchQiu, Zheng2022-10-281-1/+1
| | | | | | | | | | The CVE number in the patch is a typo. CVE-2022-2053 is not related to libtiff. So fix it. (From OE-Core rev: c9f76ef859b0b4edb83ac098816b625f52c78173) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mirrors.bbclass: use shallow tarball for binutils-nativeEtienne Cordonnier2022-10-281-0/+1
| | | | | | | | | | | | This is useful e.g. when using meta-clang, which introduces a dependency to binutils-native, and then a full tarball of binutils is fetched additionally to a shallow tarball. The original BB_GIT_SHALLOW lines were added because of https://www.mail-archive.com/yocto@lists.yoctoproject.org/msg08752.html (From OE-Core rev: bd83b8b502ae935c75b59aaf71bbb531c9771dcc) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: add support to build on ppc64leAndrew Geissler2022-10-281-0/+1
| | | | | | | | | | Verified by building on a ppc64le based system (From OE-Core rev: 6f9bb7094b34d9cbafa8618ada46a94a06332545) Signed-off-by: Andrew Geissler <geissonator@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: skip FDT section creation for applicable symlinksAhmad Fatoum2022-10-281-1/+32
| | | | | | | | | | | | | | | | | | When building a FIT image with device trees, each device tree lands in a FIT section and is referenced by a FIT configuration node. FIT images however also allow referencing the same device tree from multiple configurations. This can be useful to reduce FIT image size while staying compatible with existing bootloaders. Allow kernel-fitimage.bbclass users to take advantage of this by mapping each symlink to a regular device tree included in the FIT to a configuration that references a common device tree section. (From OE-Core rev: 21e240da63239826f3ef50ceef40c9519e9030d8) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: mangle slashes to underscores as late as possibleAhmad Fatoum2022-10-281-4/+4
| | | | | | | | | | | | | This introduces no functional change, but will come in handy in a later commit where a file lookup will have us using the device tree name. If we keep it like it's now, we will lose the information whether an underscore is an original underscore or a mangled slash. (From OE-Core rev: 8bea426ca59d17715a3b32f7e3caf3e4b6db5ce9) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lighttpd: upgrade 1.4.66 -> 1.4.67wangmy2022-10-282-33/+1
| | | | | | | | | | | | | | | | | | | | Changelog: ============= * Update comment about TCP_INFO on OpenBSD * [mod_ajp13] fix crash with bad response headers (fixes #3170) * [core] handle RDHUP when collecting chunked body * [core] tweak streaming request body to backends * [core] handle ENOSPC with pwritev() (#3171) * [core] manually calculate off_t max (fixes #3171) * [autoconf] force large file support (#3171) * [multiple] quiet coverity warnings using casts * [meson] add license keyword to project declaration (From OE-Core rev: 7a399862bb2e1503fbffa18e7ec0767643f76132) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rust: install rustfmt for riscv32 as wellAlexander Kanavin2022-10-281-1/+0
| | | | | | | | | | With the above rust arch fixes it builds just fine. (From OE-Core rev: f417ae30c79fac99e2549324ed351f6f63cc4a25) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rust-target-config: match riscv target names with what rust expectsAlexander Kanavin2022-10-282-14/+28
| | | | | | | | | | | | | | | | | | | | Official rust risc-v targets are prefixed with riscv32gc- and riscv64gc-: https://doc.rust-lang.org/nightly/rustc/platform-support.html Particularly crossbeam-utils make important build time decisions for atomics based on those names, and so we need to match ours with official targets. On the other hand, the actual definitions for those targets do not use the 'gc' suffix in 'arch' and 'llvm-target' fields, and so we need to follow that too, to avoid cryptic mismatch errors from rust-llvm: https://github.com/rust-lang/rust/blob/master/compiler/rustc_target/src/spec/riscv32gc_unknown_linux_gnu.rs (From OE-Core rev: 1cfb9c8a59d98ccc9b0510cd28fb933f72fb6b6c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: backport the fix for CVE-2022-3165Ross Burton2022-10-282-0/+60
| | | | | | | | (From OE-Core rev: d820389728b0f5e085954b4f995da2b2014acedf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: fix a number of CVEsRoss Burton2022-10-285-1/+1018
| | | | | | | | | | | | | | | | Backport fixes from upstream for the following CVEs: - CVE-2022-3599 - CVE-2022-3597 - CVE-2022-3626 - CVE-2022-3627 - CVE-2022-3570 - CVE-2022-3598 (From OE-Core rev: 722bbb88777cc3c7d1c8273f1279fc18ba33e87c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mesa: update 22.2.0 -> 22.2.2Markus Volk2022-10-283-1/+3
| | | | | | | | | | - add a PACKAGECONFIG for perfetto support (From OE-Core rev: cbcaff0b4cc349706b9847f4262746b43adba209) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake-user-manual: details about variable flags starting with ↵Michael Opdenacker2022-10-271-0/+6
| | | | | | | | | | | underscore Fixes [YOCTO #14140] (Bitbake rev: 0f3e9d87168813ce49995ff04bccdce11c5f7b47) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: tests/fetch: Allow handling of a file:// url within a submoduleRichard Purdie2022-10-261-2/+2
| | | | | | | | | CVE-2022-39253 in git meant file:// urls within submodules were disabled. Add a parameter to the commands in the tests to allow this to continue to work. (Bitbake rev: 209f7ba352b60722830157054e3fc56cb9c693eb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Fix SSL_CERT_FILE to match ca-certs locationRichard Purdie2022-10-261-1/+1
| | | | | | | | | | | | In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: tests: bb.tests.fetch.URLHandle: add 2 new testsMark Asselstine2022-10-261-0/+2
| | | | | | | | | | | | | | | | | Add a test for special characters in user and password to qualify decodeurl() inspired by a bug report describing that '=' signs in a password was problematic. Add a second test to qualify decodeurl() as related to the change in commit 628c4bf6c89b [fetch2/__init__: handle @ in package names]. Relates to [YOCTO #14476] (Bitbake rev: ee04cf09c7022168c035affa654773652a49793e) Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: doc: bitbake-user-manual: expand description of BB_PRESSURE_MAX ↵Michael Opdenacker2022-10-261-17/+43
| | | | | | | | | | | variables (Bitbake rev: 72e9847dd578c3cbed52a9c16fea23ebbeef5046) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils/ply: Update md5 to better report errors with hashlibMark Hatle2022-10-262-1/+13
| | | | | | | | | | | | | | | | | | | | | | In the case where hashlib is not available, the try would fail and fall through resulting in a backtrace on the usage of the 'sig'. The backtrace itself was confusing and made it difficult to determine what went wrong. Update the import to be in it's own try block with an appropriate message to indicate what went wrong. Note, the current version of ply all of this code has been restructured so this is not applicable upstream. Additionally, some versions of hashlib don't appear to implement the second FIPS related argument. Detect this and support both versions. (Bitbake rev: 484ab42f440070c0369b81f5c69da860fa47a798) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake: user-manual: inform about spaces in :removeJohan Korsnes2022-10-261-1/+2
| | | | | | | | | | | | | | | | | | | | Inform the reader that there should be no need for spaces in the value when using removal override `:remove`. Considering why spaces are used in the other override operators, it might seem obvious that they aren't needed for the removal operator. But, it seems like I'm not the first to be confused about this. Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com> Cc: Ross Burton <ross.burton@arm.com> Cc: Nicolas Dechesne <nicolas.dechesne@linaro.org> (Bitbake rev: 0a493a772f83436cbe909de93c157f4ab2d2d136) Signed-off-by: Johan Korsnes <johan.korsnes@remarkable.no> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Rework signing to remove interdependenciesSean Anderson2022-10-265-296/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The U-Boot signing code is a bit of a mess. The problem is that mkimage determines the public keys to embed into a device tree based on an image that it is signing. This results in all sorts of contortions: U-Boot has to be available to the kernel recipe so that it can have the correct public keys embedded. Then, the signed U-Boot has to be made available to U-Boot's do_deploy. This same dance is then repeated for SPL. To complicate matters, signing for U-Boot and U-Boot SPL is optional, so the whole process must be seamlessly integrated with a non-signed build. The complexity and interdependency of this process makes it difficult to extend. For example, it is not possible to install a signed U-Boot binary into the root filesystem. This is first because u-boot:do_install must run before linux:do_assemble_fitimage, which must run before u-boot:do_deploy. But aside from infrastructure issues, installing a signed U-Boot also can't happen, because the kernel image might have an embedded initramfs (containing the signed U-Boot). However, all of this complexity is accidental. It is not necessary to embed the public keys into U-Boot and sign the kernel in one fell swoop. Instead, we can sign the kernel, stage it, and sign the staged kernel again to embed the public keys into U-Boot [1]. This twice-signed kernel serves only to provide the correct parameters to mkimage, and does not have to be installed or deployed. By cutting the dependency of linux:do_assemble_fitimage on u-boot:do_install, we can drastically simplify the build process, making it much more extensible. The process of doing this conversion is a bit involved, since the U-Boot and Linux recipes are so intertwined at the moment. The most major change is that uboot-sign is no longer inherited by kernel-fitimage. Similarly, all U-Boot-related tasks have been removed from kernel-fitimage. We add a new step to the install task to stage the kernel in /sysroot-only. The logic to disable assemble_fitimage has been removed. We always assemble it, even if the final fitImage will use a bundled initramfs, because U-Boot will need it. On the U-Boot side, much of the churn stems from multiple config support. Previously, we took a fairly ad-hoc approach to UBOOT_CONFIG and UBOOT_MACHINE, introducing for loops wherever we needed to deal with them. However, I have chosen to use a much more structured approach. Each task which needs to use the build directory uses the following pseudocode: do_mytask() { if ${UBOOT_CONFIG}; then for config, type in zip(${UBOOT_CONFIG}, ${UBOOT_MACHINE}); do cd ${config} mytask_helper ${type} done else cd ${B} mytask_helper "" fi } By explicitly placing the work in mytask_helper, we make it easier to ensure that everything is covered, and we also allow bbappends files to more easily extend the task (as otherwise they would need to reimplement the loop themselves). [1] It doesn't particularly matter what we sign. Any FIT will do, but I chose the kernel's because we already went to the trouble of setting it up with the correct hashes and signatures. In the future, we could create a "dummy" image and sign that instead, but it would probably have to happen in the kernel recipe anyway (so we have access to the appropriate variables). (From OE-Core rev: 5e12dc911d0c541f43aa6d0c046fb87e8b7c1f7e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Split off kernel-fitimage variablesSean Anderson2022-10-263-15/+32
| | | | | | | | | | In preparation for the next commit, split off several (From OE-Core rev: 60c1a170f1f8c11bc8f42026debf121433b39115) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Use bitbake variables directlySean Anderson2022-10-261-20/+10
| | | | | | | | | | | | | | | uboot_fitimage_assemble is called from one place with the same arguments. Instead of using shell variables as intermediaries, simplify the function by using the bitbake variables directly. Removing a layer of indirection makes it easier to determine what values are being substituted in. Some variables can't be fully converted, but they will be addressed in the a few commits. (From OE-Core rev: 27f42c9b9a91742d3ee358aa8dc29627379b2539) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: Use KERNEL_OUTPUT_DIR where appropriateSean Anderson2022-10-261-8/+8
| | | | | | | | | | | We have a specific variable for the path to the boot directory. Use it instead of open-coding this path. (From OE-Core rev: 725b75e83bc2b2111f2ab5103b7e7f60d6d3f34e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel: Clear SYSROOT_DIRS instead of replacing sysroot_stage_allSean Anderson2022-10-261-3/+1
| | | | | | | | | | | | Replacing sysroot_stage_all by a no-op recipe makes it difficult for bbappends to stage files intentionally. Instead, just clear SYSROOT_DIRS, allowing other bbappends to easily add new directories. (From OE-Core rev: 849791e7086463a4c7c53c2c1ed9603a6c3a080d) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Fix using wrong KEY_REQ_ARGSSean Anderson2022-10-261-1/+1
| | | | | | | | | | | | | When generating our SPL-verifying certificate, we use FIT_KEY_REQ_ARGS, which is intended for the U-Boot-verifying certificate. Instead, use UBOOT_FIT_KEY_REQ_ARGS. Fixes: 0e6b0fefa0 ("u-boot: Use a different Key for SPL signing") (From OE-Core rev: a2d939ccb182a1ad29280d236b9f9e1d09527af1) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* git: upgrade 2.37.3 -> 2.38.1Tim Orling2022-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2022-39260 Git v2.38.1 Release Notes ========================= This release merges the security fix that appears in v2.30.6; see the release notes for that version for details. Excerpt from 2.30.6 release notes: * CVE-2022-39260: An overly-long command string given to `git shell` can result in overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution when `git shell` is exposed and the directory `$HOME/git-shell-commands` exists. `git shell` is taught to refuse interactive commands that are longer than 4MiB in size. `split_cmdline()` is hardened to reject inputs larger than 2GiB. Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub. The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau. For 2.38.0 changes, see: https://github.com/git/git/blob/master/Documentation/RelNotes/2.38.0.txt (From OE-Core rev: b304768711374066db320fe87960be81f54a8424) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551Ross Burton2022-10-263-0/+103
| | | | | | | | (From OE-Core rev: e32401d8bf44afcca88af7e4c5948d2c28e1813f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: ignore CVE-2022-3553 as it is XQuartz-specificRoss Burton2022-10-261-0/+2
| | | | | | | | (From OE-Core rev: 769576f36aac9652525beec5c7e8a4d26632b844) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libx11: apply the fix for CVE-2022-3554Ross Burton2022-10-262-0/+58
| | | | | | | | (From OE-Core rev: 5d30f124274d2822d72b56f84eb8c8ae64e31e0d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-yocto: improve fatal error messages of symbol_why.pyJose Quaresma2022-10-261-5/+5
| | | | | | | | | | | | Improve the fatal error message of the yocto-kernel-tools symbol_why.py and shows the command that generate the error as it can help understand the root cause of the error. (From OE-Core rev: 54ae08779071f2e97bff0ff6514ede3124312c3b) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: add HOMEPAGE and link to documentationMikko Rapeli2022-10-261-0/+2
| | | | | | | | | | | | It's important to use standard variable names in the /etc/os-release file. Otherwise reporting version etc details requires custom modifications in various tools. (From OE-Core rev: af528f4b46e5df0a176d91d46cc6f89c7296c602) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: replace DISTRO_CODENAME with VERSION_CODENAMEMikko Rapeli2022-10-261-1/+2
| | | | | | | | | | | | | Latter is the /etc/os-release standard to report distro codenames like "langdale". https://www.freedesktop.org/software/systemd/man/os-release.html#VERSION_CODENAME= (From OE-Core rev: 2565b435176a16aca5b747044cc3643d845f6486) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gstreamer1.0-libav: fix errors with ffmpeg 5.xClaus Stovgaard2022-10-262-1/+89
| | | | | | | | | | | | | Backport of patch already present upstream to fix issues with invalid characters for GLIB when combining gstreamer1.0-libav with ffmpeg 5.x. Remove when gstreamer1.0-libav is upgraded to 1.21.1 or above (From OE-Core rev: 703ff945557ad307bbe4ba0b0b7f1a2e5b4b847e) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: Remove a trailing slash from ${B}Peter Kjellerstedt2022-10-261-1/+1
| | | | | | | | | | | | | The trailing slash in ${B} caused -fdebug-prefix-map=${B}=... to not match as intended, resulting in ${TMPDIR} ending up in files in ${PN}-dbg when externalsrc was in use, which in turn triggered buildpath QA warnings. (From OE-Core rev: 9b5031ed5a0d102905fa75acc418246c23df6eef) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: Do not perturb script environmentJoshua Watt2022-10-261-12/+14
| | | | | | | | | | | | | | | | | | | | | Instead of changing the script environment to affect the child processes, make a copy of the environment with modifications and pass that to subprocess. Specifically, when dri rendering is enabled, LD_PRELOAD was being passed to all processes created by the script which resulted in other commands (e.g. stty) exiting with a failure like: /bin/sh: symbol lookup error: sysroots-uninative/x86_64-linux/lib/librt.so.1: undefined symbol: __libc_unwind_link_get, version GLIBC_PRIVATE Making a copy of the environment fixes this because the LD_PRELOAD is now only passed to qemu itself. (From OE-Core rev: 2232599d330bd5f2a9e206b490196569ad855de8) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu-helper-native: Re-write bridge helper as C programJoshua Watt2022-10-263-28/+44
| | | | | | | | | | | | | | | | | | | | | The bridge helper program is invoked directly from QEMU when it needs to attach to a network bridge. As such, it is subject to the environment of QEMU itself. Specifically, if bridging is enabled with direct rendering acceleration, QEMU is run with an LD_PRELOAD that attempts to preload several uninative libraries; however /bin/sh doesn't use the uninative loader which means it can fail to start with an error like: /bin/sh: symbol lookup error: sysroots-uninative/x86_64-linux/lib/librt.so.1: undefined symbol: __libc_unwind_link_get, version GLIBC_PRIVATE Converting the helper program to a C program resolves this problem because it will now use the uninative loader so the preload doesn't cause errors. (From OE-Core rev: f698e98f2f09952b34488b8cf9e73e82bd7aea07) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic: honor the SOURCE_DATE_EPOCH in case of updated fstabSergei Zhmylev2022-10-263-2/+10
| | | | | | | | | | | | | In case user requested to build a binary repeatable package, it's required to honor the SOURCE_DATE_EPOCH environment variable. So forcefully set mtime inside all the routines which modify fstab in case it is updated. (From OE-Core rev: 99719a3712a88dce8450994d995803e126e49115) Signed-off-by: Sergei Zhmylev <s.zhmylev@yadro.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: Fix gl-es argument from causing other arguments to be ignoredJoshua Watt2022-10-261-1/+1
| | | | | | | | | | | The code to parse arguments was inadvertently skipping all arguments in the elif block after gl-es if it was specified on the command line. (From OE-Core rev: 718bb8d56f6a24c86e67830a7d13af54df2ebb4e) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: fix git repo detectionMartin Jansa2022-10-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix issue introduced in: https://git.openembedded.org/openembedded-core/commit/?id=95fbac8dcad6c93f4c9737e9fe13e92ab6befa09 * it added check for s_dir + git-dir (typically '.git') isn't the same as ${TOPDIR} + git-dir, but due to copy-paste issue it was just comparing it with s_dir + git-dir again, resulting in most external repos (where git-dir is '.git') to be processed as regular directory (not taking advantage of git write-tree). * normally this wouldn't be an issue, but for big repo with a lot of files this added a lot of checksums in: d.setVarFlag('do_compile', 'file-checksums', '${@srctree_hash_files(d)}') and I mean *a lot, e.g. in chromium build it was 380227 paths which still wouldn't that bad, but the checksum processing in siggen.py isn't trivial and just looping through all these checksums takes very long time (over 1000sec on fast NVME drive with warm cache) and then https://git.openembedded.org/bitbake/commit/?id=b4975d2ecf615ac4c240808fbc5a3f879a93846b made the processing a bit more complicated and the loop in get_taskhash() function took 6448sec and to make things worse there was no output from bitbake during that time, so even with -DDD it looks like this: DEBUG: virtual/libgles2 resolved to: mesa (langdale/oe-core/meta/recipes-graphics/mesa/mesa_22.2.0.bb) Bitbake still alive (no events for 600s). Active tasks: Bitbake still alive (no events for 1200s). Active tasks: Bitbake still alive (no events for 1800s). Active tasks: Bitbake still alive (no events for 2400s). Active tasks: Bitbake still alive (no events for 3000s). Active tasks: Bitbake still alive (no events for 3600s). Active tasks: Bitbake still alive (no events for 4200s). Active tasks: Bitbake still alive (no events for 4800s). Active tasks: Bitbake still alive (no events for 5400s). Active tasks: Bitbake still alive (no events for 6000s). Active tasks: DEBUG: Starting bitbake-worker without -DDD it will get stuck for almost 2 hours in: "Initialising tasks..." before it finally writes sstate summary like: "Sstate summary: Wanted 3102 Local 0 Mirrors 0 Missed 3102 Current 1483 (0% match, 32% complete)" * fix the copy&paste typo to use git work-tree in most cases, but be aware that this issue still exists for huge local source trees not in git [YOCTO #14942] (From OE-Core rev: 9102e5a94b8146cb1da27afbe41d3db999a914ff) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wayland-protocols: upgrade 1.26 -> 1.27Markus Volk2022-10-261-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | wayland-protocols 1.27 is now available. This release includes two new staging protocols: * Content type hint This protocol enables clients to provide hints to the compositor about what kind of content it provides, allowing compositors to optionally adapt its behavior accordingly. * Idle notify This extension allows compositors to notify clients about when the user is idle. Apart from these two new extensions, this release also brings the usual clarifications, cleanups and fixes. Enjoy! Daniel Stone (1): xdg-shell: ack_configure must be strictly monotonic Emmanuel Gil Peyrot (1): staging/content-type: Content type hint support Isaac Freund (1): ext-session-lock: add note on client termination Jonas Ådahl (1): build: Bump version to 1.27 Simon Ser (3): xdg-shell: forbid loops in set_parent ext-idle-notify: new protocol build: alphabetically sort list of staging protocols (From OE-Core rev: bed837c23eada26478d50b3363e2da43f57f3b7e) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL ↵Hitendra Prajapati2022-10-262-0/+56
| | | | | | | | | | | | | | | encryption Upstream-Status: Backport from https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b] Description: CVE-2022-3358 openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption. Affects "openssl < 3.0.6" (From OE-Core rev: f98b2273c6f03f8f6029a7a409600ce290817e27) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: add systemd-creds and systemd-cryptenroll to systemd-extra-utilsLuca Boccassi2022-10-261-0/+2
| | | | | | | | | | | | ERROR: systemd-1_251.4-r0 do_package: QA Issue: systemd: Files/directories were installed but not shipped in any package: /usr/bin/systemd-creds /usr/bin/systemd-cryptenroll (From OE-Core rev: b3763dd26d324a7ce575586f306b8aec4b1103b3) Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Remove ";name=..." for downloadLocationKeiya Nobuta2022-10-261-0/+1
| | | | | | | | (From OE-Core rev: bbecab53d1b27f3bb8c5882cb0ec39b04ef300a3) Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-13 12:56:38 +0000