summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* freetype: Fix CVE-2026-23865Vijay Anusuri2026-03-252-0/+55
| | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-23865 https://security-tracker.debian.org/tracker/CVE-2026-23865 Picked patch mentioned in NVD (From OE-Core rev: b371b1b670123c9f231ed8b450ad868b6c4f9549) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* improve_kernel_cve_report: add option to read debugsources.zstdDaniel Turull2026-03-251-0/+27
| | | | | | | | | | | | | | | | | | Adding option to be able to import debugsources.zstd directly. The linux-yocto-debugsources.zstd is generated in every build and does not require any additional configuration. In contrast, SPDX_INCLUDE_COMPILED_SOURCES needs to be explicitly added and increases build time. (From OE-Core rev: e8e61a97bf0e88c45a323353e865a5654a500966) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> (cherry picked from commit c84a8958f30bbb982656ddcbe7476f6f81e1a6fb) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* improve_kernel_cve_report: do not use custom versionDaniel Turull2026-03-251-2/+4
| | | | | | | | | | | | | | | | | | | | | | When using the version specified in cve-summary.json, we need to remove the suffix containing the custom version to match the versions from the CVEs. This patch truncates the version from cve-summary.json to use only the base version of the kernel. This is only applicable for kernels where the user has added their own version. (From OE-Core rev: 66968d81d55de7afdf139eac56a460d04c383a6c) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3942d40e96989268e8d1030f9d8c3859044d9635) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* improve_kernel_cve_report: do not override backported-patchDaniel Turull2026-03-251-0/+4
| | | | | | | | | | | | | | | If the user has a CVE_STATUS for their own backported patch, the backport takes priority over upstream vulnerable versions. (From OE-Core rev: d317e2a52bd29a772de9bcd751f5b0e03277bd77) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0beef05be119ea465ba06553a42edea03dfc9fd3) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* tiff: ignore CVE-2025-61143, CVE-2025-61144 and CVE-2025-61145Ankur Tyagi2026-03-251-1/+1
| | | | | | | | | | | | | | | | | | | These CVEs are for tools which were removed in v4.6.0[1] [1]https://gitlab.com/libtiff/libtiff/-/commit/eab89a627f0a65e9a1a47c4b30b4802c80b1ac45 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61143 https://nvd.nist.gov/vuln/detail/CVE-2025-61144 https://nvd.nist.gov/vuln/detail/CVE-2025-61145 (From OE-Core rev: e5ec16fbe4ce402b92107d2491c4e08fa2432f1a) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> [YC: NVD patches for these CVEs only modify the tools which are not in the tarball we use] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* lsb.py: strip ' from os-release fileMartin Jansa2026-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In gentoo the file looks like this: NAME='Gentoo' ID='gentoo' PRETTY_NAME='Gentoo Linux' VERSION='2.18' VERSION_ID='2.18' HOME_URL='https://www.gentoo.org/' SUPPORT_URL='https://www.gentoo.org/support/' BUG_REPORT_URL='https://bugs.gentoo.org/' ANSI_COLOR='1;32' ' were added with: https://github.com/gentoo/gentoo/commit/2f590e35c9d3d13d5673163527120b2de97fdc80 before that the os-release file looked like this: NAME=Gentoo ID=gentoo PRETTY_NAME="Gentoo Linux" ANSI_COLOR="1;32" HOME_URL="https://www.gentoo.org/" SUPPORT_URL="https://www.gentoo.org/support/" BUG_REPORT_URL="https://bugs.gentoo.org/" VERSION_ID="2.18" The ' is stripped from the ID later in distro_identifier with: # Filter out any non-alphanumerics and convert to lowercase distro_id = re.sub(r'\W', '', distro_id).lower() but not from version which results in a weird NATIVELSBSTRING like: NATIVELSBSTRING = "gentoo-'2.18'" And similarly the directory name in sstate-cache: oe-core $ ls -d sstate-cache/gentoo-* "sstate-cache/gentoo-'2.18'" sstate-cache/gentoo-2.18 (From OE-Core rev: 9906255a99f13bf6feefca11e8305364efce6450) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 55f82653deb1ea8f1304fcba4d588bd55695b616) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* wireless-regdb: upgrade 2025.10.07 -> 2026.02.04Ankur Tyagi2026-03-251-1/+1
| | | | | | | | | | | | | (From OE-Core rev: a26cdcc31b97b5eed545b9859bee8b5c098d394b) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f86c38b13121788fe6a654df04800d24b2b28b61) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> [YC: logs: https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git/log/?h=master-2026-02-04] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* inetutils: patch CVE-2026-28372Peter Marko2026-03-252-0/+87
| | | | | | | | | | | | | | | | | | Pick patch according to [1] (equivalent to patch from [2]). This CVE is needed if util-linux >= 2.40 is used which is not the case in Yocto scarthgap, however it's always possible that users update packages in their layers. [1] https://security-tracker.debian.org/tracker/CVE-2026-28372 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-28372 (From OE-Core rev: 2ab4f313ebd2c8f2d801dc3f53df3a0741cf848e) Signed-off-by: Peter Marko <peter.marko@siemens.com> [YC: replaced kirkstone by scarthap] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* bitbake: fetch2: Fix LFS object checkout in submodulesPhilip Lorenz2026-03-251-6/+5
| | | | | | | | | | | | | | | | | | | Skipping smudging prevents the LFS objects from replacing their placeholder files when `git submodule update` actually checks out the target revision in the submodule. Smudging cannot happen earlier as the clone stored in `.git/modules` is bare. This should be fine as long as all LFS objects are available in the download cache (which they are after the other fixes are applied). (Bitbake rev: d3b4c352dd33fca90cd31649eda054b884478739) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d270e33a07c50bb9c08861cf9a6dc51e1fd2d874) Suggested-by: Michael Siebold <michael.siebold@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* bitbake: fetch2: Fix incorrect lfs parametrization for submodulesPhilip Lorenz2026-03-251-1/+1
| | | | | | | | | | | | | | | The existing code would pass `True` or `False` to the git fetcher. As the fetcher expects `lfs` to be set to `1` this always lead to LFS fetching being disabled. (Bitbake rev: 27d4df9ce9072a066d8e32802099dd61786bf5b7) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5e487a5a096400271ed1e29b0df72903f2304e49) Suggested-by: Michael Siebold <michael.siebold@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* bitbake: gitsm: Add clean functionRobert Yang2026-03-251-0/+13
| | | | | | | | | | | | | | | | Fixed: $ bitbake utfcpp -cfetch && bitbake utfcpp -ccleanall The downloads/git2/github.com.nemtrif.ftest won't be cleaned without this fix. (Bitbake rev: 6cb07e8c702b750c5047dcd646ca72ca5f75321c) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 79f25fc5c1b8d0e08540f4aa07875309f5325f47) Suggested-by: Michael Siebold <michael.siebold@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* bitbake: fetch2: don't try to preserve all attributes when unpacking filesRoss Burton2026-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When copying files as part of the unpack we currently use cp -p, which is a shortcut for --preserve=mode,ownership,timestamps. We do want to preserve timestamps, because some fetchers set these explicitly. We don't care about ownership. If the files are owned by us then they ill remain owned by us, and if they're not then the attempt to change ownership will be silently ignored. In a shared DL_DIR where files have group ownership this group access isn't relevant in the single-user build tree. We do want to preserve executable bits in the mode, but cp always does this. The difference between --preserve=mode and no --preserve is that the mode isn't preserved exactly (no sticky bits, no suid, umask is applied) but this also isn't a relevant difference in a build tree. Also expand the arguments to be clearer about what options are being passed. The impetus for this is that coreutils 9.4 includes a change in gnulib[1] and will now try to preserve permission-based xattrs if asked to preserve the mode. This can result in cp failing when copying a file from a NFSv4 server with ACLs stored in xattrs to a non-NFS directory where those xattrs cannot be written: cp: preserving permissions for ‘./jquery-3.7.1.js’: Operation not supported The error comes from the kernel refusing to write a system.nfs4_acl xattr to a file on ext4. This situation doesn't appear on all systems with coreutils 9.4, at the time of writing it fails on Ubuntu 24.04 onwards but not Fedora 40. This is because /etc/xattr.conf is used to determine which xattrs describe permissions, and Fedora 40 has removed the NFSv4 attributes[2]. Also, use long-form options to make the cp command clearer. [1] https://github.com/coreutils/gnulib/commit/eb6a8a4dfb [2] https://src.fedoraproject.org/rpms/attr/blob/rawhide/f/0003-attr-2.4.48-xattr-conf-nfs4-acls.patch [ YOCTO #15596 ] (cherry picked from commit 2f35dac0c821ab231459922ed98e1b2cc599ca9a) (Bitbake rev: 9580f15aae08ae6e3693ebb898b6fd5238f5a7f8) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* overview-manual/concepts: list other possible class directoriesQuentin Schulz2026-03-161-1/+2
| | | | | | | | | | | | | | Classes can be located in three different directories since Langdale (4.1), so let's update which directories you can find in a distribution layer. (From yocto-docs rev: 2141bc2b04ef4210e008752a97ed82979d817dae) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit fd11d75980315d87ef375091efedad69a123f680) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* overview-manual: escape wildcard in inline markupKristiyan Chakarov2026-03-161-1/+1
| | | | | | | | | | | | | This change escapes the wildcard in 'recipes-*' to properly italicize the string (From yocto-docs rev: 53bc47aedfd924f75ee77b24d13ae69a10eef221) Signed-off-by: Kristiyan Chakarov <kichakarov0@gmail.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b5a4dca823bcc04c0254a0f53a28f61969fb6c31) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/system-requirements.rst: update end-of-life distrosAntonin Godard2026-03-161-0/+1
| | | | | | | | | | | Fedora 41 was made obsolete on 2025-12-15 [1]. [1]: https://docs.fedoraproject.org/en-US/releases/eol/ (From yocto-docs rev: ef9af4a9d2a0b7f08c97961958c7535b49bf0739) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: COW: Fix hardcoded magic numbers and work with python 3.13Richard Purdie2026-03-161-4/+6
| | | | | | | | | | | | | | | The COW tests started failing on python 3.13. Looks like it is time to fix the FIXME and drop the magic numbers! (Bitbake rev: a0a5ce49f28d886b1dac173842642e69517b44e3) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2e6608cec508b3b9bab3530f83e70665ff638182) [YC: This fixes the bb.tests.cow.COWTestCase.testOriginalTestSuite bitbake-selftest on the newly added fedora-41 workers] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Fixes CVE-2025-60876Livin Sunny2026-03-162-0/+43
| | | | | | | | | | | | | | | | | | | | | | | This addresses CVE-2025-60876[1], which allows malicious URLs to inject HTTP headers. It has been accepted by Debian[2] and is tracked here [4]. The upstream fix has been submitted [3] and is pending merge. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60876 [2] https://bugs.debian.org/1120795 [3] https://lists.busybox.net/pipermail/busybox/2025-November/091840.html [4] https://security-tracker.debian.org/tracker/CVE-2025-60876 Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2025-November/091840.html] (From OE-Core rev: 077f258eb2125359ffe3982c58433ee14cb21f09) Signed-off-by: Livin Sunny <livinsunny519@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f12af98df8f627c6d1836d27be48bac542a4f00e) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-pull-request: Keep commit hash to be pulled in cover emailPaul Barker2026-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The cover email mangling in create-pull-request was cutting off the actual commit hash to be pulled, making it difficult to verify that the changes a maintainer merges exactly match those intended by the pull request author. The extra lines we want to include are, for example from a recent whinlatter stable branch PR: for you to fetch changes up to 6c4c6d39ea3202d756acc13f8ce81b114a468541: cups: upgrade from 2.4.14 to 2.4.15 (2025-12-29 09:49:31 -0800) (From OE-Core rev: a18ebd408eba0bffe4e6ea58a91fd41e60f24216) Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c78f5ae4a5ba3675b78cc226feb7b9fbbfd8da19) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* README: Add scarthgap subject-prefix to git-send-email suggestionYoann Congal2026-03-161-1/+1
| | | | | | | | | | That might help new users send correct first stable patches. (From OE-Core rev: 625d3c1e1d6b3aa5e6783a4a350238a718d02456) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-config: Fix devtool modifyTom Hochstein2026-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a problem with `devtool modify` as suggested by Marcus Flyckt on the mailing list: ``` I encountered an issue with `do_config` when using `devtool modify` on `u-boot-imx`. ``` [...] | cp: cannot stat '[...]/u-boot-imx/2024.04/build/imx8mp_wl400s_defconfig/.config': No such file or directory | WARNING: exit code 1 from a shell command. ERROR: Task ([...]/sources/poky/../meta-freescale/recipes-bsp/u-boot/u-boot-imx_2024.04.bb:do_configure) failed with exit code '1' NOTE: Tasks Summary: Attempted 963 tasks of which 962 didn't need to be rerun and 1 failed. Summary: 1 task failed: [...]/sources/poky/../meta-freescale/recipes-bsp/u-boot/u-boot-imx_2024.04.bb:do_configure Summary: There was 1 ERROR message, returning a non-zero exit code ``` The issue seems to originate from the following lines in `workspace/appends/u-boot-imx_2024.04.bbappend`: ``` do_configure:append() { if [ ${@oe.types.boolean(d.getVar("KCONFIG_CONFIG_ENABLE_MENUCONFIG"))} = True ]; then cp ${KCONFIG_CONFIG_ROOTDIR}/.config ${S}/.config.baseline ln -sfT ${KCONFIG_CONFIG_ROOTDIR}/.config ${S}/.config.new fi } ``` For some reason `KCONFIG_CONFIG_ROOTDIR` does not point to the correct directory. It gets its value in `uboot-config.bbclass`: ``` if len(ubootconfig) == 1: d.setVar('KCONFIG_CONFIG_ROOTDIR', os.path.join(d.getVar("B"), d.getVar("UBOOT_MACHINE").strip())) ``` So the main issue is that B gets expanded in this expression, and then later B gets changed by `externalsrc.bbclass`. `d.getVar("B", False)` does not solve the issue, however the proposed change does. ``` - https://lists.yoctoproject.org/g/yocto/topic/109254298#msg64152] Fixes [YOCTO #15603] Suggested-by: Marcus Flyckt <marcus.flyckt@gmail.com> (From OE-Core rev: 6a19e284baaadfdf080ebc5decf065e468655732) Signed-off-by: Tom Hochstein <tom.hochstein@oss.nxp.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 57b21065a25100c31515b32fd7c77bde3355d684) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* scripts/install-buildtools: Update to 5.0.16Yoann Congal2026-03-161-2/+2
| | | | | | | | | | Update to the 5.0.16 release of the 5.0 series for buildtools (From OE-Core rev: 917c382c412766b40779788ee2411ac23358f0ae) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 3.2.6 -> 3.5.5Peter Marko2026-03-169-203/+119
| | | | | | | | | | | | | | | | | Openssl 3.2 has reached EOL. Some projects would like to use LTS version due to criticality and exposure of this component, so upgrade to 3.5 branch. Copy recipe from oe-core master fd3b1efb6f7ffb5505ff7eb95cae222e1db9f776 which is the last revision before disabling TLS 1/1.1 by default. Single change is replacing UNPACKDIR by WORKIDR (one occurence). (From OE-Core rev: c4fc6ee6986fbd05d72bf1e6bb1d2c4eee84e5db) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* harfbuzz: Fix CVE-2026-22693Hugo SIMELIERE2026-03-162-1/+36
| | | | | | | | | | | | | | Pick patch mentioned in NVD report [1] [1] https://nvd.nist.gov/vuln/detail/CVE-2026-22693 (From OE-Core rev: 541482f93d8447f7a027bacb99a6782ac5ed2a6e) Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* zlib: Fix CVE-2026-27171Hugo SIMELIERE2026-03-162-0/+64
| | | | | | | | | | | | | | | Pick patch from [1] also mentioned in [2] [1] https://github.com/madler/zlib/issues/904 [2] https://security-tracker.debian.org/tracker/CVE-2026-27171 (From OE-Core rev: cf95e20db688fb155ba0dc7968c816937190234f) Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: set status for CVE-2025-12343Peter Marko2026-03-161-1/+1
| | | | | | | | | | | | | | | | Per [1] is patch for this CVE [2]. This is equivalent of [3] which is included in n6.1.3. [1] https://security-tracker.debian.org/tracker/CVE-2025-12343 [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e [3] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/6250ed77a6fb5bb089e533e30985d197e8323dcf (From OE-Core rev: b839647eb0627598a9e1667d18802b6b03637abf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: set status for CVE-2025-10256Peter Marko2026-03-161-1/+1
| | | | | | | | | | | | | | | | Per [1] is patch for this CVE [2]. This is equivalent of [3] which is included in n6.1.3. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-10256 [2] https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931 [3] https://github.com/FFmpeg/FFmpeg/commit/00b5af29a4203a31574c11b3df892d78d5d862ec (From OE-Core rev: 8a24195c27d440fa851da555f1147230564674b0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gdk-pixbuf: Fix CVE-2025-6199Shaik Moin2026-03-162-0/+37
| | | | | | | | | | | | | | | | Backport the fix for CVE-2025-6199 Add below patch to fix CVE-2025-6199.patch Reference: In Ubuntu and debian, fixed patch is given -> [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] (From OE-Core rev: de8c5d9964086e960e6df1f58a6d675fdb761286) Signed-off-by: Shaik Moin <moins@kpit.com> [YC: Link to Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2025-6199 ] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: add fedora-41, rocky-8 to SANITY_TESTED_DISTROSYoann Congal2026-02-281-0/+2
| | | | | | | | | | | | Those are already documented as supported: https://git.yoctoproject.org/yocto-docs/tree/documentation/ref-manual/system-requirements.rst?h=scarthgap#n65 Actually support them in sanity check. (From meta-yocto rev: 94d19f9d8392f8a125764df0f8eda04205c7e76c) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to scarthgap head revisionRichard Purdie2026-02-271-1/+1
| | | | | | (From OE-Core rev: a9a785d7fa0cfe2a9087dbcde0ef9f0d2a441375) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: Bump version for 5.0.16 releasePaul Barker2026-02-271-1/+1
| | | | | | | (From meta-yocto rev: 03f93c769ec99e5086e492d8145eb308a718e8d3) Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: delete references to "tar" package formatRobert P. J. Day2026-02-271-3/+3
| | | | | | | | | | | | | There is no "tar" packaging format anymore, so delete these references. (From yocto-docs rev: e7cbf979deb9739ee4b968672d4b03ae65b24424) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit e2b4d75fc8d738a39c5941591523620b45bc57e3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Makefile: pass -silent to latexmkAntonin Godard2026-02-271-1/+1
| | | | | | | | | | | | | | | This should drastically decrease the number of lines in the docs build logs, which currently can go up to 1700000 lines on the Autobuilder[1]. [1]: https://autobuilder.yoctoproject.org/valkyrie/#/builders/34/builds/400/steps/6/logs/stdio (From yocto-docs rev: ac3766beaff14ea62552f811b2ffcc43f77d8dd5) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 6e9362923d4ab5599730da2074ab9f5a36e8ba14) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* what-i-wish-id-known.rst: replace figure by the new SVGAntonin Godard2026-02-272-1/+1
| | | | | | | | | | | | | | | We have a new SVG figure for the Yocto Project workflow figure, which was updated with d2aaf54bee49 ("overview-manual: convert YP-flow-diagram.png to SVG"). The one in the "What I wish I’d known about Yocto Project" is the same. Remove the PNG and make a reference to the new one. (From yocto-docs rev: ef4b9077c04ed825890abf79848f45d8e692bbf7) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 4023c47cb6628971b0a142067c4a910420408bb9) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/classes.rst: fix broken links to U-Boot documentationMichael Opdenacker2026-02-271-2/+2
| | | | | | | | | | | | | In the chapter describing the "uboot-sign" class (From yocto-docs rev: 7ad53da253f6b03b75322ecc53ad6ff8fb1a4809) Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 7d1caa1d3229fb49d6d08ca4952b046c3164e628) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/system-requirements.rst: update untested distrosYoann Congal2026-02-271-3/+2
| | | | | | | | | | | | | | Some distros were removed from the autobuilder 5 months ago: * 070e6bf (config.py: Drop ubuntu2004 workers, 2025-10-01) * 8238327 (config.py: ubuntu24010 was replaced with ubuntu2504, 2025-10-01) Update their status in the supported distros list. (From yocto-docs rev: 2c9de0d74659fef6d7b0054dfd76905fba6ef81d) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: move CVE patches out of the common .inc fileYoann Congal2026-02-272-11/+11
| | | | | | | | | | | | | | | | | An external layer might use the u-boot*.inc files but have a different base version for which the CVE patches don't apply. Move the CVE patches in the leaf recipe. See related patch in kirkstone: [kirkstone][PATCH] u-boot: move CVE patch out of u-boot-common.inc https://lists.openembedded.org/g/openembedded-core/topic/117385432 (From OE-Core rev: f4ced8ff03147dd532a88cf3ce08d61fab057522) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* alsa-lib: patch CVE-2026-25068Peter Marko2026-02-272-0/+35
| | | | | | | | | | | | | | | Pick patch mentioned in NVD report. It also includes CVE ID in commit message. Use older SNDERR funtion as new one is not yet available. This was copied from Debian patch. (From OE-Core rev: 517bda641fcccbeae1988092196dc44ab7cc1491) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: patch CVE-2025-68973Peter Marko2026-02-272-0/+109
| | | | | | | | | | | | | Pick patch from 2.4 branch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-68973 (From OE-Core rev: 66df136096c6a7e29edea0fbc0132b234032965f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: set status of CVE-2025-25468Peter Marko2026-02-271-0/+1
| | | | | | | | | | | | | | | | | This vulnerability was introduced in v8.0. This can be seen by blaming fix [1] (linked from NVD report [3]) is showing that the return without freeing memory was introduced in [2]. [1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d38fc25519cf12a9212dadcba1258fc176ffbade [3] https://nvd.nist.gov/vuln/detail/CVE-2025-25468 (From OE-Core rev: 2915986318230846e1b513b4cf3d9ba62a5b8cb9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtheora: mark CVE-2024-56431 as not vulnerable yetPeter Marko2026-02-271-0/+2
| | | | | | | | | | | | | | | | | | CVE patch [1] aplies only on main branch which is base for 1.2.x. Branch 1.1 has a different initial commit and does not contain vulnerable code where the CVE patch applies. Also Debian [2] marked 1.1 as not vulnerable. [1] https://gitlab.xiph.org/xiph/theora/-/commit/5665f86b8fd8345bb09469990e79221562ac204b [2] https://security-tracker.debian.org/tracker/CVE-2024-56431 (From OE-Core rev: 07f35d022b88ab4d297d0252f9909e252b7e4cfe) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: ignore CVE-2025-1594Peter Marko2026-02-271-1/+1
| | | | | | | | | | | | | | | | This CVE was patched via c9a15206bae7f1e85dc3b8812eabb936a7e6d383 Patch was dropped during update to 6.1.4, however NVD DB does not have this information so it re-appeared in CVE reports. Set its status accordingly. (From OE-Core rev: 26e32dccade107101992dd81f387696c993d47aa) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2026-1489Peter Marko2026-02-275-0/+434
| | | | | | | | | | | | | | Pick patch from [1] linked from [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/issues/3872 [2] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4984 (From OE-Core rev: a032cc36df3cbd084ca8ae1a8fa638274dd71318) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2026-1485Peter Marko2026-02-272-0/+45
| | | | | | | | | | | | | | Pick patch from [1] linked from [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/issues/3871 [2] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4981 (From OE-Core rev: 64c332e99d0487178aab96578008bec9b133533f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2026-1484Peter Marko2026-02-273-0/+95
| | | | | | | | | | | | | | Pick patches from [1] linked from [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/issues/3870 [2] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4979 (From OE-Core rev: 67bc85229209e0405587c6747d9a98576d59e094) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic/engine: error on old host debugfs for standalone directory copyDaniel Dragomir2026-02-271-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | When wic is used in standalone mode, it relies on host tools such as debugfs. For directory host->image copies into ext* partitions, wic uses scripted debugfs "-f" input with multiple mkdir/write commands. Older host debugfs versions (< 1.46.5) may behave unreliably in this mode and can silently miss files. This does not affect builds using debugfs from OE where the version is known to be sufficiently new. Add a debugfs version check and emit an error when an older host debugfs is detected. The error is shown once per run and halts execution. (From OE-Core rev: 977d68d2702f7092fa05d04f94da5fee8e0b2195) Signed-off-by: Daniel Dragomir <daniel.dragomir@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cb536737bee95d5a5072b501bda9554705e8cd13) [YC: removed patch changelog] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* scripts/install-buildtools: Update to 5.0.15Aleksandar Nikolic2026-02-271-2/+2
| | | | | | | | | | | Update to the 5.0.15 release of the 5.0 series for buildtools (From OE-Core rev: 52063e6a91cc1386feb0cb47ba870ad21628a894) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic22@pm.me> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2025-69419Hitendra Prajapati2026-02-272-0/+62
| | | | | | | | | | | Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-69419 (From OE-Core rev: 0ad28133e04d439fbee5710ab4b43042d1101ff6) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2025-15468Hitendra Prajapati2026-02-272-0/+40
| | | | | | | | | | | | | To fix this issue, Add a NULL guard before dereferencing SSL_CIPHER. Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-15468 (From OE-Core rev: 4eb01c3d18dc268cc5aa03386247bf670075c88b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/buildhistory: Do not sign buildhistory commitsFabio Berton2026-02-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds the --no-gpg-sign option to prevent buildhistory commits from failing due to GPG signing issues. Depending on the setup, buildhistory may fail to create a commit if the user has the commit.gpgsign option enabled. For example, if the user creates a signing key that requires a password, the commit won't be created and will fail with the following error: / |error: Enter passphrase: Load key "/home/<user>/.ssh/id_ed25519": |incorrect passphrase supplied to decrypt private key? |fatal: failed to write commit object \ The bitbake command won't fail, but buildhistory won't have a commit. Also, the commit may silently fail when building inside a container due to missing packages or issues with accessing the GPG agent. This is similar to [1], and signing the buildhistory commit should be avoided to prevent such issues. 1 - https://git.openembedded.org/openembedded-core/commit/?id=7595a0a63a933af9dd9d1e458dc34a4ba80d9eae (From OE-Core rev: 667cd853a231f1fe884ba83ada2ad6cecb1c41cd) Signed-off-by: Fabio Berton <fabio.berton@ctw.bmwgroup.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5e18714aee52db898aaf9d222fb5a4168bde96e) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpng: patch CVE-2026-25646Peter Marko2026-02-272-0/+62
| | | | | | | | | | | Backport patch mentioned in NVD CVE report. (From OE-Core rev: dd08ef6de714ea06d6b6255faca2ddbc66450977) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-22 03:16:08 +0000