summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Revert "lib/oe/go: document map_arch, and raise an error on unknown ↵scarthgapPeter Marko14 days1-5/+1
| | | | | | | | | | | | | | | architecture" This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1. This introduced a breaking change which is not suitable for backport to stable LTS branches. (From OE-Core rev: 2b3d2b671a149cbeea2bdc9ba42192da2015c3b7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: fix regression in KEX method validation (GH-1553)Vijay Anusuri14 days2-0/+74
| | | | | | | | | | | | | | | Resolves: https://github.com/libssh2/libssh2/issues/1553 Regression caused by https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89 Backport fix https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d (From OE-Core rev: c348296ff0181921e8aa5a16d8d90db75f7b3e7c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: upgrade 1.11.0 -> 1.11.1Vijay Anusuri14 days2-469/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1 Dropped CVE-2023-48795.patch which is already included in version 1.11.1 Resolves: https://github.com/libssh2/libssh2/issues/1326 License-Update: Copyright symbols were changed from (C) to lowercase (c) ptest results: root@qemux86-64:~# ptest-runner libssh2 START: ptest-runner 2025-12-08T12:37 BEGIN: /usr/lib/libssh2/ptest PASS: mansyntax.sh PASS: test_simple PASS: test_sshd.test DURATION: 6 END: /usr/lib/libssh2/ptest 2025-12-08T12:37 STOP: ptest-runner TOTAL: 1 FAIL: 0 (From OE-Core rev: 71316433eb018e831d72a873365aa53ed04f14f4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libmicrohttpd: disable experimental code by defaultPeter Marko14 days1-0/+4
| | | | | | | | | | | | | | | | | | | Introduce new packageconfig to explicitly avoid compilation of experimental code. Note that the code was not compiled by default also before this patch, this now makes it explicit and makes it possible to check for the flags in cve-check code. This is less intrusive change than a patch removing the code which was rejected in patch review. This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code is not compiled by default. Set appropriate CVE status for these CVEs based on new packageconfig. (From OE-Core rev: 9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Security fix for CVE-2025-7425Hitendra Prajapati14 days2-0/+803
| | | | | | | | | | | | | | | CVE-2025-7425 libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6 Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425 Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/issues/140 (From OE-Core rev: 315882f25ac3c5e5d210557fd863b3a0fff28850) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-66293Peter Marko14 days3-0/+187
| | | | | | | | | | | | Pick patches per nvd report [1] and github advisory [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66293 [2] https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f (From OE-Core rev: f5f0af82d8775180d76e6448a14f74cc70edf963) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/create-spdx-2.2: Define SPDX_VERSION to 2.2Daniel Turull14 days1-0/+2
| | | | | | | | | | | | | | | | | SPDX_VERSION is used in DEPLOY_DIR_SPDX but if is not defined, will default to SPDX-1.1 Define SPDX_VERSION to have the correct deploy path, to align with master branch behaviour. The change in path was introduced in 8996d0899d CC: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> CC: JPEWhacker@gmail.com (From OE-Core rev: 04cc49593a0ba2c51e4f4d477d4587079735b624) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respectedMoritz Haase2025-12-051-2/+2
| | | | | | | | | | | | | | | | | | Due to what looks like a copy'n'paste mistake, the environment setup script might override 'CURL_CA_BUNDLE' from the host env instead of leaving it untouched. Fix that. (cherry picked from commit 545e43a7a45be02fda8fc3af69faa20e889f58c4) CC: changqing.li@windriver.com CC: raj.khem@gmail.com CC: Peter.Marko@siemens.com (From OE-Core rev: ef198b0c6063ede32cb93fe44eb89937c076a073) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-65018Peter Marko2025-12-053-0/+225
| | | | | | | | | | Pick commit per NVD report. Add two patches to apply it cleanly. (From OE-Core rev: 4e03bed20bceb455cb46dcf9564ad5a8525b207d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64720Peter Marko2025-12-052-0/+104
| | | | | | | | | Pick commit per NVD report. (From OE-Core rev: e8fbb7521e0113c467e07ba473a46612709c5311) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64506Peter Marko2025-12-052-0/+58
| | | | | | | | | Pick commit per NVD report. (From OE-Core rev: f3bdbd782eed2b597927df489a7d38a22fbba5ed) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64505Peter Marko2025-12-054-0/+329
| | | | | | | | | | Pick commit per NVD report. Add two patches to apply it cleanly. (From OE-Core rev: 285a495b8b0e8fa93a0a0884f466f1adca76a28a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix CVE-2025-6075Praveen Kumar2025-12-052-0/+356
| | | | | | | | | | | | | | | | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 (From OE-Core rev: 5313fa5236cd3943f90804de2af81358971894bc) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-9820Peter Marko2025-12-052-0/+251
| | | | | | | | | | | | | This CVE is announced under [1]. Pick commit which mentions this CVE per [2]. [1] https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18 [2] https://security-tracker.debian.org/tracker/CVE-2025-9820 (From OE-Core rev: 37dcb0f617f02f95293455d58927e0da4e768cc4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-60753Peter Marko2025-12-012-0/+77
| | | | | | | | | | | | | Pick patch from [3] marked in [2] mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753 [2] https://github.com/libarchive/libarchive/issues/2725 [3] https://github.com/libarchive/libarchive/pull/2787 (From OE-Core rev: 1fbd9eddbdf0da062df0510cabff6f6ee33d5752) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch 3.8.3 security issue 2Peter Marko2025-12-012-0/+29
| | | | | | | | | | | | Pick patch [2] as listed in [1]. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2768 (From OE-Core rev: efe032eef7034009f1202985b2036fc79e06bddf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch 3.8.3 security issue 1Peter Marko2025-12-014-0/+407
| | | | | | | | | | | | | Pick patch [2] as listed in [1]. To apply it cleanly, add two additional patches from branch patch/3.8. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2753 (From OE-Core rev: 11f782c1ae9962a2faa98bff3566e49fbf6db017) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vex: fix rootfs manifestBenjamin Robin (Schneider Electric)2025-12-011-0/+5
| | | | | | | | | | | | | | | | | | | | | Rootfs VEX file is created by gathering files from CVE_CHECK_DIR (deploy directory), however recipes generate the files only in CVE_CHECK_DIR (log directory). This make the rootfs VEX be always empty without any message. The code is copied from cve_check class, which writes to both, so let keep them aligned and make also vex write both files. Also add a warning for case that a cve file would be still missing. (From OE-Core rev: 7493eeed6d53bc704f558a0ccf8a0b5195381873) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee6541d0940c65685aaafd7d41a59a9406392e7d) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx: extend CVE_STATUS variablesBenjamin Robin (Schneider Electric)2025-12-011-0/+5
| | | | | | | | | | | | | | | | If spdx is generated without inheriting cve/vex classes (which is poky default), only explicitly set CVE_STATUS fields are handled. Calculated ones (e.g. from CVE_STATUS_GROUPS) are ignored. Fix this by expanding the CVE_STATUS in spdx classes. (From OE-Core rev: 23a4e02542252657fa45fd4a605aec0af9178e0b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ead9c6a8770463c21210a57cc5320f44f7754dd3) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: extract extending CVE_STATUS to library functionBenjamin Robin (Schneider Electric)2025-12-013-30/+26
| | | | | | | | | | | | | | | | | | | The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vex.bbclass: add a new classBenjamin Robin (Schneider Electric)2025-12-011-0/+327
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "vex" class generates the minimum information that is necessary for VEX generation by an external CVE checking tool. It is a drop-in replacement of "cve-check". It uses the same variables from recipes to make the migration and backporting easier. The goal of this class is to allow generation of the CVE list of an image or distribution on-demand, including the latest information from vulnerability databases. Vulnerability data changes every day, so a status generated at build becomes out-of-date very soon. Research done for this work shows that the current VEX formats (CSAF and OpenVEX) do not provide enough information to generate such rolling information. Instead, we extract the needed data from recipe annotations (package names, CPEs, versions, CVE patches applied...) and store for later use in the format that is an extension of the CVE-check JSON output format. This output can be then used (separately or with SPDX of the same build) by an external tool to generate the vulnerability annotation and VEX statements in standard formats. When back-porting this feature, the do_generate_vex() had to be modified to use the "old" get_patched_cves() API. (From OE-Core rev: 123a60bc19987e99d511b1f515e118022949be7e) Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Signed-off-by: Samantha Jalabert <samantha.jalabert@syslinbit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6352ad93a72e67d6dfa82e870222518a97c426fa) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30: provide all CVE_STATUS, not only Patched statusBenjamin Robin (Schneider Electric)2025-12-011-14/+17
| | | | | | | | | | | | | In scarthgap, the `oe.cve_check.get_patched_cves()` method only returns CVEs with a "Patched" status. We want to retrieve all annotations, including those with an "Ignored" status. Therefore, to avoid modifying the current API, we integrate the logic for retrieving all CVE_STATUS values ​​directly into `spdx30_task`. (From OE-Core rev: 9a204670b1c0daedf1ed8ff944f8e5443b39c8f7) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "spdx: Update for bitbake changes"Kai Kang2025-12-012-63/+64
| | | | | | | | | | | | | | | | | | | | | This reverts part of commit 4859cdf97fd9a260036e148e25f0b78eb393df1e. Modification of meta/classes/create-spdx-2.2.bbclass is not backported, so no need to consider it. In the commit, it updates spdx according to bitbake change. But the bitbake commit * 2515fbd10 fetch: Drop multiple branch/revision support for single git urls doesn't backport for scarthgap. So revert the other parts of the commit 4859cdf97fd9a260036e148e25f0b. (From OE-Core rev: f3bfb98d1cf928678d9931308c116e9e6ec64ba5) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 4.0.31Lee Chee Yang2025-11-262-0/+211
| | | | | | | | | | (From yocto-docs rev: b0f5cc276639916df197435780b3e94accd4af41) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 992d0725e8b4fdcdc2e9a101ce51ebef94a00112) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation: link to the Releases page on yoctoproject.org instead of wikiRoss Burton2025-11-265-12/+12
| | | | | | | | | | | | | | | We have a machine-generated Releases page[1] which is preferable to the wiki. [1] https://www.yoctoproject.org/development/releases/ (From yocto-docs rev: 5af5e64e42732c0919cad499e79ff35ca4255a86) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 46a9172fd17aa518028e35b8c874e74889079094) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* overview-manual: migrate to SVG + fix typoQuentin Schulz2025-11-263-1/+173
| | | | | | | | | | | | | | | | The original PNG had a typo (YP-Comptible instead of YP-Compatible). Instead of patching a PNG, let's migrate to an SVG with the typo already fixed. Reported-by: Robert P. J. Day <rpjday@crashcourse.ca> (From yocto-docs rev: fd023b25026b562ff2de972a44bd2c773470208f) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 9f3c2a9113b329f7efdd22d3b3fbe272a44bc654) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: debugging: use bitbake-getvar in Viewing Variable Values sectionQuentin Schulz2025-11-261-14/+20
| | | | | | | | | | | | | | | | | | We should recommend using bitbake-getvar command wherever possible as its output is much less confusing and overwhelming than bitbake -e. Unfortunately, bitbake-getvar currently doesn't list Python tasks or functions, unlike bitbake -e, so keep the latter for some corner cases. [AG: Moroever -> Moreover typo fix] (From yocto-docs rev: 3f1ca1c3ef60dfabe5b2a2c6e53d14edad64fb06) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 41e4e05369c4e028c679749b7b62434327927a09) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: variables: migrate the OVERRIDES note to bitbake-getvarQuentin Schulz2025-11-261-2/+2
| | | | | | | | | | | | | Wherever possible, we should use bitbake-getvar as it's the recommended tool so let's do that. (From yocto-docs rev: b9453c7ce44a6bcae7cdc05f2b2cd47b525726e9) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 2293a3f2767895e9fb5c3e8f3ec11bb4951a7127) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kernel-dev: common: migrate bitbake -e to bitbake-getvarQuentin Schulz2025-11-261-7/+5
| | | | | | | | | | | | | | | It's recommended to use bitbake-getvar for a few releases now so let's use that instead of bitbake -e. While at it, use a cross-reference for "OpenEmbedded Build System". (From yocto-docs rev: 29836a95c01cdb99c38802f55a92f32377b8c524) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 54585646d8220f8de1ba2c7246cb3f2fcbc59583) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 5.0.13Lee Chee Yang2025-11-262-0/+242
| | | | | | | | | | (From yocto-docs rev: fefa33295b2b96d5bf91dfdec3c6e6913dbf1df2) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 5a6f63e955807d6aab4a9dbcb4560078c2cec77f) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kernel-dev: add disable config exampleWalter Werner SCHNEIDER2025-11-261-3/+5
| | | | | | | | | | | | | Makes it more clear that the configuration fragment can also be used to disable a configuration. (From yocto-docs rev: a586a0ecacb4e40f4f3aeeb01dbefbdfcee8ae35) Signed-off-by: Walter Werner SCHNEIDER <contact@schnwalter.eu> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit d38ef467081ee73bf23f240ace54b849a3a87612) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/new-recipe.rst: typo, "whith" -> "which"Robert P. J. Day2025-11-261-1/+1
| | | | | | | | | | | | Fix typo "whith", should be "which". (From yocto-docs rev: bec165a3505f298b668bcf2a0f03fb8dcfccc510) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit f98b25f7f7522cf223beb001cabef870d6dd8c10) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/new-recipe.rst: replace 'bitbake -e' with 'bitbake-getvar'Robert P. J. Day2025-11-261-2/+2
| | | | | | | | | | | | | | Replace the legacy call to 'bitbake -e' to get the value of a recipe's variable with the newer call to 'bitbake-getvar'. (From yocto-docs rev: 042c4cb8c6291be857a672144b573a5eb10f1ead) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit ed7c0766ef5f13b90943a69e64f8e8713d05e864) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/new-recipe.rst: update "recipetool -h" outputRobert P. J. Day2025-11-261-11/+12
| | | | | | | | | | | | | Update the output of "recipetool -h" to include the missing "edit" subcommand. (From yocto-docs rev: 09039d05e485a842690f9f54930400e02eef1c2c) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 092d688349b0b6bb10ae6fbbab7d82801964daf5) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/layers.rst: document "bitbake-layers show-machines"Robert P. J. Day2025-11-261-0/+2
| | | | | | | | | | | | The "show-machines" subcommand is not mentioned in the docs; add it. (From yocto-docs rev: 98190334b2ad75421e8bf2cc84bd920311398670) Signed-off-by: Robert P. J. Day <Crpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b4320cdc4df08c59a24d5247b3895dd602554fa0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/sbom.rst: reflect that create-spdx is enabled by defaultEnrico Jörns2025-11-261-4/+5
| | | | | | | | | | | | | | | | | | | | | Since nanbield (b34032ec "defaultsetup: Inherit create-spdx by default"), the create-spdx class is pulled in by default, not only by poky. Adapt the text to reflect this and also change INHERIT to INHERIT_DISTRO since this is the more concrete variable to modify for disabling create-spdx. [AG: fix conflicts] (From yocto-docs rev: 4c47eb98e096121d71663342dde86b8c9256c9b5) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 2b6228943443faf76c9869a0daeccfe7f93688ca) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/buildepoxy: skip test in eSDKPeter Marko2025-11-261-0/+4
| | | | | | | | | | | | | | Currently meson inside eSDKs only works with fully populated eSDKs, but our testing uses minimal eSDKS, so skip the test if the eSDK is a minimal build. A bug has been filed to resolve this. This is minimal change extracted from OE-Core commit which has this only as a minor comment: 575e0bf52db0467d88af4b5fe467b682f10ca62a (From OE-Core rev: 7cfacaee1b3319e561036512a849e762d0f68a5e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa: drop unnecessary dependency from go runtime testsPeter Marko2025-11-261-2/+0
| | | | | | | | | The tests do not use scp command, so openssh-scp is not needed. (From OE-Core rev: 4e10e7848cb10307f133f181b41563c995df032a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa: fix package detection in go sdk testsPeter Marko2025-11-261-4/+4
| | | | | | | | | | | | | | | | | | | | | | | The test are skipped if architecture contains dash because TARGET_ARCH contains underscore while package name contains dash. Here the translation needs to be done. Note that poky distro default arch has dash: MACHINE="qemux86-64" TARGET_ARCH="x86_64" ERROR: Nothing PROVIDES 'go-cross-canadian-x86_64'. Close matches: gcc-cross-canadian-x86-64 gdb-cross-canadian-x86-64 go-cross-canadian-x86-64 TRANSLATED_TARGET_ARCH="x86-64" Quoting meta/classes-recipe/cross-canadian.bbclass: TRANSLATED_TARGET_ARCH is added into PN (From OE-Core rev: 82a46b70bfba7c4ce4fd20e2658b182b03e55037) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: remove duplicate arch map in sdk testOsama Abdelkader2025-11-261-26/+5
| | | | | | | | | | | | | | | ARCH_MAP is duplicating an existing map in meta/lib/oe/go.py use oe.go map_arch instead. (From OE-Core rev: c2ba36f41777d347fd5ffcd9b6862638e5f35a1b) (From OE-Core rev: 21f3a6c661307eab5530b51704c3a338013c9c5c) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: extend runtime testOsama Abdelkader2025-11-262-0/+75
| | | | | | | | | | | | | | | | extend go runtime test with a simple test file, and simple go module test to validate go compilation and execution on target. (From OE-Core rev: e3b2b9170f76f4bbdc41ea6ba7bccffc17d01968) (From OE-Core rev: bda3e3711f84394423c15f48fb4e75258fec199a) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: add sdk testOsama Abdelkader2025-11-261-0/+128
| | | | | | | | | | | | | | | | | - Add meta/lib/oeqa/sdk/cases/go.py with GoCompileTest and GoHostCompileTest classes - Test validates Go cross-compilation toolchain functionality - Includes native compilation, cross-compilation, and Go module support - Uses dynamic architecture detection for portability (From OE-Core rev: 17015f692a6bf3697a89db51bbc4673a5efa1497) (From OE-Core rev: 506f4e8c99b164673ba7d1c19e10d240f4df0376) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signaturesAlexander Kanavin2025-11-261-0/+3
| | | | | | | | | | | | | | | | | | | The default assignments look like this: TARGET_GO386 = "${@go_map_386(d.getVar('TARGET_ARCH'), d.getVar('TUNE_FEATURES'), d)}" TUNE_FEATURES is a target-specific variable, and so should be used only for target builds. The change is similar to what is already done for native packages. (From OE-Core rev: cfff8e968257c44880caa3605e158764ed5c6a2a) (From OE-Core rev: e8d475b9b6d7b1ac3b0cfe367faabc07deb663b0) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib/oe/go: document map_arch, and raise an error on unknown architectureRoss Burton2025-11-261-1/+5
| | | | | | | | | | | | | | | | | Add a comment explaining what this function does and where the values come from. If the architecture isn't know, instead of returning an empty string which could fail mysteriously, raise a KeyError so it fails quickly. (From OE-Core rev: 025414c16319b068df1cd757ad9a3c987a6b871d) (From OE-Core rev: e6de433ccb2784581d6c775cce97f414ef9334b1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oe/sdk: fix empty SDK manifestsRoss Burton2025-11-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SDK manifests are generated by listing the sstate was that used, but it hardcodes that the sstate data filenames end in .tgz. This has not been the case since sstate switched to Zstd[1] in 2021, which meant that all of the tests which checked for packages existing were being skipped as the manifests were empty. For example, see a representative core-image-sato eSDK test run[2]: RESULTS - cmake.CMakeTest.test_assimp: SKIPPED (0.00s) RESULTS - gtk3.GTK3Test.test_galculator: SKIPPED (0.00s) RESULTS - kmod.KernelModuleTest.test_cryptodev: SKIPPED (0.00s) RESULTS - maturin.MaturinDevelopTest.test_maturin_develop: SKIPPED (0.00s) RESULTS - maturin.MaturinTest.test_maturin_list_python: SKIPPED (0.00s) RESULTS - meson.MesonTest.test_epoxy: SKIPPED (0.00s) RESULTS - perl.PerlTest.test_perl: SKIPPED (0.00s) RESULTS - python.Python3Test.test_python3: SKIPPED (0.00s) All of those tests should have been ran. Solve this by generalising the filename check so that it doesn't care what specfic compression algorithm is used. [1] oe-core 0710e98f40e ("sstate: Switch to ZStandard compressor support") [2] https://autobuilder.yoctoproject.org/valkyrie/#/builders/16/builds/1517/steps/15/logs/stdio (From OE-Core rev: 062a525bd36c672f372dabe8d9f0fbe355c7e58b) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* testsdk: allow user to specify which tests to runRoss Burton2025-11-263-2/+7
| | | | | | | | | | | | | | | | | | Following the usage of TEST_SUITES in testimage, add TESTSDK_SUITES to specify the list of tests to execute. By default the variable is empty, which means to run all discovered tests. This makes it easier to work on a single test without having to run all of the tests. (From OE-Core rev: 28d437c52c77889b2ede0fc2f2d6777c5b0a553d) (From OE-Core rev: a93e21419476658f24220193fb0183efeb7a184f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glslang: fix compiling with gcc15Gyorgy Sarvari2025-11-262-0/+31
| | | | | | | | | | | | | | Backport a patch that fixes a compilation failure with gcc15: | .../git/SPIRV/SpvBuilder.h:238:30: error: ‘uint32_t’ has not been declared | 238 | Id makeDebugLexicalBlock(uint32_t line); | | ^~~~~~~~ | .../git/SPIRV/SpvBuilder.h:64:1: note: ‘uint32_t’ is defined in header ‘<cstdint>’; this is probably fixable by adding ‘#include <cstdint>’ (From OE-Core rev: cd0039c22d7aa3d6983ac6fe917b648930355849) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-target-config: fix nativesdk-libstd-rs build with baremetalOvidiu Panait2025-11-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If TCLIBC='baremetal' is set in local.conf, nativesdk-libstd-rs build fails with: | error[E0412]: cannot find type `c_char` in the crate root | --> /usr/src/debug/libstd-rs/1.75.0/rustc-1.75.0-src/vendor/libc/src/unix/mod.rs:56:29 | | | 6 | pub type c_schar = i8; | | ---------------------- similarly named type alias `c_schar` defined here | ... | 56 | pub gr_name: *mut ::c_char, | | ^^^^^^ This happens because rust_gen_target() sets os="none" when TCLIBC is 'baremetal' - even for nativesdk targets. However, nativesdk packages are built against glibc, so the correct 'os' value should be "linux". Fix this by setting the os field based on {TARGET,HOST,BUILD}_OS variables, as it is already done in rust_base_triple(), instead of relying on TCLIBC. (From OE-Core rev: 4c3f321304f2aa8b75cb58699b59fea80a23690c) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (master rev: 3eaf2cd5647585a1e6df03fc20e2753da27bb692) -- backport Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* musl: patch CVE-2025-26519Gyorgy Sarvari2025-11-263-1/+80
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-26519 Pick the patches that are attached to the musl advisory: https://www.openwall.com/lists/musl/2025/02/13/1 (From OE-Core rev: bbdd7d54b070f62f13967df8a13f5f14f2c36120) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: fix CVE-2025-62231Yogita Urade2025-11-262-0/+51
| | | | | | | | | | | | | | | | | | | A flaw was identified in the X.Org X serverâ\x80\x99s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-62231 Upstream patch: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3baad99f9c15028ed8c3e3d8408e5ec35db155aa (From OE-Core rev: 97326be553f3fec8fbda63a8b38d18f656425b2c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-31 06:35:27 +0000