summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.15scarthgap-5.0.15Steve Sakoman2026-01-021-1/+1
| | | | | | (From OE-Core rev: 6988157ad983978ffd6b12bcefedd4deaffdbbd1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.0.15Steve Sakoman2026-01-021-1/+1
| | | | | | (From meta-yocto rev: 9bb6e6e8b016a0c9dfe290369a6ed91ef4020535) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2025-61729Vijay Anusuri2026-01-022-0/+175
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/3a842bd5c6aa8eefa13c0174de3ab361e50bd672 (From OE-Core rev: 2d6d68e46a430a1dbba7bd8b7d37ff56f4f5a0e6) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2025-61727Vijay Anusuri2026-01-022-0/+227
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/04db77a423cac75bb82cc9a6859991ae9c016344 (From OE-Core rev: 647e151485bd10a8bbbdbae4825791723c9a5d8e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Update CVE-2025-58187Vijay Anusuri2026-01-023-1/+518
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/ca6a5545ba18844a97c88a90a385eb6335bb7526 (From OE-Core rev: 2d6b089de3ef5e062d852eb93e3ff16997e796ef) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-12105Changqing Li2026-01-022-0/+35
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481 (From OE-Core rev: 1ac9ad3faf022684ae709f4494a430aee5fb9906) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 ↵Jiaying Song2026-01-025-0/+221
| | | | | | | | | | | | | | | | CVE-2025-61664 References: https://nvd.nist.gov/vuln/detail/CVE-2025-54770 https://nvd.nist.gov/vuln/detail/CVE-2025-61661 https://nvd.nist.gov/vuln/detail/CVE-2025-61662 https://nvd.nist.gov/vuln/detail/CVE-2025-61663 https://nvd.nist.gov/vuln/detail/CVE-2025-61664 (From OE-Core rev: c28fa3e6421257f50d4ae283cca28fadb621f831) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cross.bbclass: Propagate dependencies to outhashMartin Jansa2025-12-311-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to what native and staging is doing since: https://git.openembedded.org/openembedded-core/commit/meta/classes/native.bbclass?id=d6c7b9f4f0e61fa6546d3644e27abe3e96f597e2 https://git.openembedded.org/openembedded-core/commit/meta/classes/staging.bbclass?id=1cf62882bbac543960e4815d117ffce0e53bda07 Cross task outputs can call native dependencies and even when cross recipe output doesn't change it might produce different results when the called native dependency is changed, e.g. clang-cross-${TARGET_ARCH} contains symlink to clang binary from clang-native, but when clang-native outhash is changed, clang-cross-${TARGET_ARCH} will still be considered equivalent and target recipes aren't rebuilt with new clang binary, see work around in https://github.com/kraj/meta-clang/pull/1140 to make target recipes to depend directly not only on clang-cross-${TARGET_ARCH} but clang-native as well. I have added a small testcase in meta-selftest which demostrates this issue. Not included in this change, but will send it if useful. openembedded-core $ ls -1 meta-selftest/recipes-devtools/hashequiv-test/ print-datetime-link-cross.bb print-datetime-link-native.bb print-datetime-native.bb print-datetime-usecross.bb print-datetime-usenative.bb print-datetime-native provides script which prints defined PRINT_DATETIME variable. print-datetime-link-native and print-datetime-link-cross both provide a symlink to the script from print-datetime-native. print-datetime-usenative and print-datetime-usecross are target recipes using the native and cross versions of print-datetime-link-* recipe. # clean build all is rebuilt: $ bitbake -k print-datetime-usenative print-datetime-usecross WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_05 WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_05 WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_05 WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_05 WARNING: print-datetime-usecross-1.0-r0 do_install: print-datetime-usecross current DATETIME from print-datetime-link is 2025-11-13_20_05 # keep sstate-cache and hashserv.db: # print-datetime-usenative is correctly rebuilt, because print-datetime-link-native has different hash (because print-datetime-native hash changed) # print-datetime-usecross wasn't rebuilt, because print-datetime-link-cross-x86_64 doesn't include the changed hash of print-datetime-native $ bitbake -k print-datetime-usenative print-datetime-usecross WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_07 WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_07 WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_07 WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_07 It's because print-datetime-link-cross-x86_64 depsig doesn't include print-datetime-native signature: $ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64 drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin drwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux lrwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime While print-datetime-link-native doesn't have this issue, because print-datetime-native signature is there: $ cat tmp/work/x86_64-linux/print-datetime-link-native/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 print-datetime-native: 60f2734a63d708489570ca719413b4662f8368abc9f4760a279a0a5481e4a17b quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8 SSTATE_PKGSPEC=sstate:print-datetime-link-native:x86_64-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 26 3d5458be834b2d0e4c65466b9b877d6028ae2210a56399284a23144818666f10 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-native drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin lrwx ./recipe-sysroot-native/usr/bin/print-datetime-link -> print-datetime With the cross.bbclass fix the link-cross recipe has a checksum from native recipe as well: $ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 print-datetime-native: 9ceb6c27342eae6b8da86c84685af38fb8927ccc19979aae75b8b1e444b11c5c quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8 SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64 drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin drwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux lrwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime And print-datetime-usecross is correctly rebuilt whenever print-datetime-native output is different. (From OE-Core rev: dccb7a185fe58a97f33e219b4db283ff4a2071d7) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Use host CA bundle by default for native(sdk) buildsMoritz Haase2025-12-311-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes YOCTO #16077 Commit 0f98fecd (a backport of 4909a46e) broke HTTPS downloads in opkg in the SDK, they now fail with: > SSL certificate problem: self-signed certificate in certificate chain The root cause is a difference in the handling of related env vars between curl-cli and libcurl. The CLI will honour CURL_CA_BUNDLE and SSL_CERT_DIR|FILE (see [0]). Those are set in the SDK via env setup scripts like [1], so curl continued to work. The library however does not handle those env vars. Thus, unless the program utilizing libcurl has implemented a similar mechanism itself and configures libcurl accordingly via the API (like for example Git in [2] and [3]), there will be no default CA bundle configured to verify certificates against. Opkg only supports setting the CA bundle path via config options 'ssl_ca_file' and 'ssl_ca_path'. Upstreaming and then backporting a patch to add env var support is not a feasible short-time fix for the issue at hand. Instead it's better to ship libcurl in the SDK with a sensible built-in default - which also helps any other libcurl users. This patch is based on a proposal by Peter.Marko@siemens.com in the related mailing list discussion at [4]. (cherry picked from commit 3f819f57aa1960af36ac0448106d1dce7f38c050) [0]: https://github.com/curl/curl/blob/400fffa90f30c7a2dc762fa33009d24851bd2016/src/tool_operate.c#L2056-L2084 [1]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl/environment.d-curl.sh?id=3a15ca2a784539098e95a3a06dec7c39f23db985 [2]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1389 [3]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1108-L1109 [4]: https://lists.openembedded.org/g/openembedded-core/topic/115993530#msg226751 (From OE-Core rev: 0e553b685c0a987a7be1eee16b7b5e3e48a036e2) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> CC: matthias.schiffer@ew.tq-group.com CC: Peter.Marko@siemens.com Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cml1.bbclass: use consistent make flags for menuconfigEnrico Jörns2025-12-312-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The class called 'make menuconfig' without any of the make variables and options set in EXTRA_OEMAKE, resulting in a quite different build environment than actually intended. For the kernel.bbclass this was fixed in commit 8c616bc0 ("kernel: Use consistent make flags for menuconfig") by appending ${EXTRA_OEMAKE} to KCONFIG_CONFIG_COMMAND. Instead of fixing this individually for additional recipes, we simply include ${EXTRA_OEMAKE} in KCONFIG_CONFIG_COMMAND by default. For most class users, this change is directly visible in the generated .config file: * For barebox and u-boot, the CONFIG_GCC_VERSION erroneously reflected the host GCC version before where it now correctly reflects the target toolchain's GCC. * For u-boot, also the "Compiler: " line at the beginning of the .config now prints the target toolchain instead of the host ones. * The kernel had this already set. * busybox did not produce any difference. Note that these projects might base some compile-time decisions on e.g. the actual compiler version used. Having the wrong one in the menuconfig-generated .config affects at least the visibility and consistency. Reported-by: Ulrich Ölmann <u.oelmann@pengutronix.de> (From OE-Core rev: a7dd1c221e42fd8df1d6f1c76c6a5ab7a3e19542) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1b6ddd452837e67b500a84455a234f5edc8250a9) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/selftest: oe-selftest: Add SPDX tests for kernel config and PACKAGECONFIGKamel Bouhara (Schneider Electric)2025-12-311-0/+57
| | | | | | | | | | | | | | | Add test_kernel_config_spdx and test_packageconfig_spdx to verify SPDX document generation includes kernel configuration and package feature metadata when enabled. (From OE-Core rev: a172a0e8d543796ee78bb66650726168352f1cdf) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2f0ab110d7521510c60e0493ef3cb021130758cd) Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDXKamel Bouhara (Schneider Electric)2025-12-312-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes PACKAGECONFIG features to be recorded in the SPDX document as build parameters. Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG:<feature> and value enabled or disabled, depending on whether the feature is active in the current build. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. In particular, it allows consumers of the SBOM to identify enabled/disabled features that may affect security posture or feature set. Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> (From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kernel.bbclass: Add task to export kernel configuration to SPDXKamel Bouhara (Schneider Electric)2025-12-312-0/+70
| | | | | | | | | | | | | | | | | | | | | | | Introduce a new bitbake task do_create_kernel_config_spdx that extracts the kernel configuration from ${B}/.config and exports it into the recipe's SPDX document as a separate build_Build object. The kernel config parameters are stored as SPDX DictionaryEntry objects and linked to the main kernel build using an ancestorOf relationship. This enables the kernel build's configuration to be explicitly captured in the SPDX document for compliance, auditing, and reproducibility. The task is gated by SPDX_INCLUDE_KERNEL_CONFIG (default = "0"). Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> (From OE-Core rev: 1fff29a0428778929ffa530482ebf7db95f1e0ae) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 228a968e7c47d811c06143279bdb0f9c5f374bef) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 5.0.14Aleksandar Nikolic2025-12-311-2/+2
| | | | | | | | | Update to the 5.0.14 release of the 5.0 series for buildtools (From OE-Core rev: 4c85440cd95d9cd007ef4346ecc9580806526c96) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: Upgrade 3.3.5 -> 3.3.10Mingli Yu2025-12-315-244/+1
| | | | | | | | | | | | | | | | Per ruby maintenance policy [1], the 3.3.x branch should be still in normal maintenance, so upgrade to the latest version 3.3.10 to fix many security issues and bugs. Remove the fix for CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 as these fixes have been included in the new version. [1] https://www.ruby-lang.org/en/downloads/branches/ (From OE-Core rev: bad372ad8ec33334c6a74c077bf975851c1e59d2) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Fix CVE-2025-11731Mingli Yu2025-12-312-1/+44
| | | | | | | | | | | Backport the patch [1] to fix CVE-2025-11731. [1] https://gitlab.gnome.org/GNOME/libxslt/-/commit/fe508f201efb9ea37bfbe95413b8b28251497de3 (From OE-Core rev: e70c70e0359418197699f18c9e2cbfd7ebac705d) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11840Yash Shinde2025-12-312-0/+38
| | | | | | | | | | | | | | | | | | | CVE-2025-11840 PR 33455 [BUG] A SEGV in vfinfo at ldmisc.c:527 A reloc howto set up with EMPTY_HOWTO has a NULL name. More than one place emitting diagnostics assumes a reloc howto won't have a NULL name. https://sourceware.org/bugzilla/show_bug.cgi?id=33455 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0] (From OE-Core rev: d477a67f623da424c3165bde25d76152636b1f50) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11839Yash Shinde2025-12-312-0/+33
| | | | | | | | | | | | | | | | | | CVE-2025-11839 PR 33448 [BUG] Aborted in tg_tag_type at prdbg.c:2452 Remove call to abort in the DGB debug format printing code, thus allowing the display of a fuzzed input file to complete without triggering an abort. https://sourceware.org/bugzilla/show_bug.cgi?id=33448 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=12ef7d5b7b02d0023db645d86eb9d0797bc747fe] (From OE-Core rev: d60c144e082d6e6db4f9971bb886751199cd433f) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-11494Deepesh Varatharajan2025-12-312-0/+44
| | | | | | | | | | | | | | Since x86 .eh_frame section may reference _GLOBAL_OFFSET_TABLE_, keep _GLOBAL_OFFSET_TABLE_ if there is dynamic section and the output .eh_frame section is non-empty. Backport a patch from upstream to fix CVE-2025-11494 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a] (From OE-Core rev: e087881bece2884f8d1a3c6d0dd7d69b40eb6732) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake-native: fix CVE-2025-9301Daniel Turull2025-12-311-0/+1
| | | | | | | | | | | | Add fix for native recipe, since previous commit for cmake missed it. 5d8a6fb52c cmake: fix CVE-2025-9301 CC: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> CC: Steve Sakoman <steve@sakoman.com> (From OE-Core rev: 24f831be7d99d5ea3fe304b9aa2d82e7e2d4a5fa) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-urllib3: fix CVE-2025-66418 CVE-2025-66471Jiaying Song2025-12-313-0/+667
| | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2025-66418 https://nvd.nist.gov/vuln/detail/CVE-2025-66471 (From OE-Core rev: d9f52c5f86bcc4716e384fe5c01c03d386d60446) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2025-12464Kai Kang2025-12-312-0/+71
| | | | | | | | | | | Backport patch to fix CVE-2025-12464 for qemu. Reference: https://gitlab.com/qemu-project/qemu/-/commit/a01344d9d7 (From OE-Core rev: c3108b279bd5c49a3c0ea35880fe7fd4f5b75b96) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2025-10158Adarsh Jagadish Kamini2025-12-312-0/+37
| | | | | | | | | | | | | Fix an out-of-bounds read triggered by a malicious rsync client acting as a receiver. The issue can be exploited with read access to an rsync module. CVE: CVE-2025-10158 (From OE-Core rev: 110933506d7a1177d1a074866d08fe0b0da612d7) Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups 2.4.11: Fix CVE-2025-61915Deepak Rathore2025-12-312-0/+492
| | | | | | | | | | | | | | | Upstream Repository: https://github.com/OpenPrinting/cups.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61915 Type: Security Fix CVE: CVE-2025-61915 Score: 6.7 Patch: https://github.com/OpenPrinting/cups/commit/db8d560262c2 (From OE-Core rev: ca252aac4e50b7ed8864bf7482a86fe7129e737e) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups 2.4.11: Fix CVE-2025-58436Deepak Rathore2025-12-312-0/+636
| | | | | | | | | | | | | | | Upstream Repository: https://github.com/OpenPrinting/cups.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-58436 Type: Security Fix CVE: CVE-2025-58436 Score: 5.5 Patch: https://github.com/OpenPrinting/cups/commit/5d414f1f91bd (From OE-Core rev: 6a721aad5f531ac74996386cbaaa0173c2c5001a) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "lib/oe/go: document map_arch, and raise an error on unknown ↵Peter Marko2025-12-171-5/+1
| | | | | | | | | | | | | | | architecture" This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1. This introduced a breaking change which is not suitable for backport to stable LTS branches. (From OE-Core rev: 2b3d2b671a149cbeea2bdc9ba42192da2015c3b7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: fix regression in KEX method validation (GH-1553)Vijay Anusuri2025-12-172-0/+74
| | | | | | | | | | | | | | | Resolves: https://github.com/libssh2/libssh2/issues/1553 Regression caused by https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89 Backport fix https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d (From OE-Core rev: c348296ff0181921e8aa5a16d8d90db75f7b3e7c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: upgrade 1.11.0 -> 1.11.1Vijay Anusuri2025-12-172-469/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1 Dropped CVE-2023-48795.patch which is already included in version 1.11.1 Resolves: https://github.com/libssh2/libssh2/issues/1326 License-Update: Copyright symbols were changed from (C) to lowercase (c) ptest results: root@qemux86-64:~# ptest-runner libssh2 START: ptest-runner 2025-12-08T12:37 BEGIN: /usr/lib/libssh2/ptest PASS: mansyntax.sh PASS: test_simple PASS: test_sshd.test DURATION: 6 END: /usr/lib/libssh2/ptest 2025-12-08T12:37 STOP: ptest-runner TOTAL: 1 FAIL: 0 (From OE-Core rev: 71316433eb018e831d72a873365aa53ed04f14f4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libmicrohttpd: disable experimental code by defaultPeter Marko2025-12-171-0/+4
| | | | | | | | | | | | | | | | | | | Introduce new packageconfig to explicitly avoid compilation of experimental code. Note that the code was not compiled by default also before this patch, this now makes it explicit and makes it possible to check for the flags in cve-check code. This is less intrusive change than a patch removing the code which was rejected in patch review. This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code is not compiled by default. Set appropriate CVE status for these CVEs based on new packageconfig. (From OE-Core rev: 9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Security fix for CVE-2025-7425Hitendra Prajapati2025-12-172-0/+803
| | | | | | | | | | | | | | | CVE-2025-7425 libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6 Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425 Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/issues/140 (From OE-Core rev: 315882f25ac3c5e5d210557fd863b3a0fff28850) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-66293Peter Marko2025-12-173-0/+187
| | | | | | | | | | | | Pick patches per nvd report [1] and github advisory [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66293 [2] https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f (From OE-Core rev: f5f0af82d8775180d76e6448a14f74cc70edf963) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/create-spdx-2.2: Define SPDX_VERSION to 2.2Daniel Turull2025-12-171-0/+2
| | | | | | | | | | | | | | | | | SPDX_VERSION is used in DEPLOY_DIR_SPDX but if is not defined, will default to SPDX-1.1 Define SPDX_VERSION to have the correct deploy path, to align with master branch behaviour. The change in path was introduced in 8996d0899d CC: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> CC: JPEWhacker@gmail.com (From OE-Core rev: 04cc49593a0ba2c51e4f4d477d4587079735b624) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respectedMoritz Haase2025-12-051-2/+2
| | | | | | | | | | | | | | | | | | Due to what looks like a copy'n'paste mistake, the environment setup script might override 'CURL_CA_BUNDLE' from the host env instead of leaving it untouched. Fix that. (cherry picked from commit 545e43a7a45be02fda8fc3af69faa20e889f58c4) CC: changqing.li@windriver.com CC: raj.khem@gmail.com CC: Peter.Marko@siemens.com (From OE-Core rev: ef198b0c6063ede32cb93fe44eb89937c076a073) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-65018Peter Marko2025-12-053-0/+225
| | | | | | | | | | Pick commit per NVD report. Add two patches to apply it cleanly. (From OE-Core rev: 4e03bed20bceb455cb46dcf9564ad5a8525b207d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64720Peter Marko2025-12-052-0/+104
| | | | | | | | | Pick commit per NVD report. (From OE-Core rev: e8fbb7521e0113c467e07ba473a46612709c5311) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64506Peter Marko2025-12-052-0/+58
| | | | | | | | | Pick commit per NVD report. (From OE-Core rev: f3bdbd782eed2b597927df489a7d38a22fbba5ed) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: patch CVE-2025-64505Peter Marko2025-12-054-0/+329
| | | | | | | | | | Pick commit per NVD report. Add two patches to apply it cleanly. (From OE-Core rev: 285a495b8b0e8fa93a0a0884f466f1adca76a28a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix CVE-2025-6075Praveen Kumar2025-12-052-0/+356
| | | | | | | | | | | | | | | | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 (From OE-Core rev: 5313fa5236cd3943f90804de2af81358971894bc) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-9820Peter Marko2025-12-052-0/+251
| | | | | | | | | | | | | This CVE is announced under [1]. Pick commit which mentions this CVE per [2]. [1] https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18 [2] https://security-tracker.debian.org/tracker/CVE-2025-9820 (From OE-Core rev: 37dcb0f617f02f95293455d58927e0da4e768cc4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-60753Peter Marko2025-12-012-0/+77
| | | | | | | | | | | | | Pick patch from [3] marked in [2] mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753 [2] https://github.com/libarchive/libarchive/issues/2725 [3] https://github.com/libarchive/libarchive/pull/2787 (From OE-Core rev: 1fbd9eddbdf0da062df0510cabff6f6ee33d5752) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch 3.8.3 security issue 2Peter Marko2025-12-012-0/+29
| | | | | | | | | | | | Pick patch [2] as listed in [1]. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2768 (From OE-Core rev: efe032eef7034009f1202985b2036fc79e06bddf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch 3.8.3 security issue 1Peter Marko2025-12-014-0/+407
| | | | | | | | | | | | | Pick patch [2] as listed in [1]. To apply it cleanly, add two additional patches from branch patch/3.8. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2753 (From OE-Core rev: 11f782c1ae9962a2faa98bff3566e49fbf6db017) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vex: fix rootfs manifestBenjamin Robin (Schneider Electric)2025-12-011-0/+5
| | | | | | | | | | | | | | | | | | | | | Rootfs VEX file is created by gathering files from CVE_CHECK_DIR (deploy directory), however recipes generate the files only in CVE_CHECK_DIR (log directory). This make the rootfs VEX be always empty without any message. The code is copied from cve_check class, which writes to both, so let keep them aligned and make also vex write both files. Also add a warning for case that a cve file would be still missing. (From OE-Core rev: 7493eeed6d53bc704f558a0ccf8a0b5195381873) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee6541d0940c65685aaafd7d41a59a9406392e7d) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx: extend CVE_STATUS variablesBenjamin Robin (Schneider Electric)2025-12-011-0/+5
| | | | | | | | | | | | | | | | If spdx is generated without inheriting cve/vex classes (which is poky default), only explicitly set CVE_STATUS fields are handled. Calculated ones (e.g. from CVE_STATUS_GROUPS) are ignored. Fix this by expanding the CVE_STATUS in spdx classes. (From OE-Core rev: 23a4e02542252657fa45fd4a605aec0af9178e0b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ead9c6a8770463c21210a57cc5320f44f7754dd3) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: extract extending CVE_STATUS to library functionBenjamin Robin (Schneider Electric)2025-12-013-30/+26
| | | | | | | | | | | | | | | | | | | The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vex.bbclass: add a new classBenjamin Robin (Schneider Electric)2025-12-011-0/+327
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "vex" class generates the minimum information that is necessary for VEX generation by an external CVE checking tool. It is a drop-in replacement of "cve-check". It uses the same variables from recipes to make the migration and backporting easier. The goal of this class is to allow generation of the CVE list of an image or distribution on-demand, including the latest information from vulnerability databases. Vulnerability data changes every day, so a status generated at build becomes out-of-date very soon. Research done for this work shows that the current VEX formats (CSAF and OpenVEX) do not provide enough information to generate such rolling information. Instead, we extract the needed data from recipe annotations (package names, CPEs, versions, CVE patches applied...) and store for later use in the format that is an extension of the CVE-check JSON output format. This output can be then used (separately or with SPDX of the same build) by an external tool to generate the vulnerability annotation and VEX statements in standard formats. When back-porting this feature, the do_generate_vex() had to be modified to use the "old" get_patched_cves() API. (From OE-Core rev: 123a60bc19987e99d511b1f515e118022949be7e) Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Signed-off-by: Samantha Jalabert <samantha.jalabert@syslinbit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6352ad93a72e67d6dfa82e870222518a97c426fa) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30: provide all CVE_STATUS, not only Patched statusBenjamin Robin (Schneider Electric)2025-12-011-14/+17
| | | | | | | | | | | | | In scarthgap, the `oe.cve_check.get_patched_cves()` method only returns CVEs with a "Patched" status. We want to retrieve all annotations, including those with an "Ignored" status. Therefore, to avoid modifying the current API, we integrate the logic for retrieving all CVE_STATUS values ​​directly into `spdx30_task`. (From OE-Core rev: 9a204670b1c0daedf1ed8ff944f8e5443b39c8f7) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "spdx: Update for bitbake changes"Kai Kang2025-12-012-63/+64
| | | | | | | | | | | | | | | | | | | | | This reverts part of commit 4859cdf97fd9a260036e148e25f0b78eb393df1e. Modification of meta/classes/create-spdx-2.2.bbclass is not backported, so no need to consider it. In the commit, it updates spdx according to bitbake change. But the bitbake commit * 2515fbd10 fetch: Drop multiple branch/revision support for single git urls doesn't backport for scarthgap. So revert the other parts of the commit 4859cdf97fd9a260036e148e25f0b. (From OE-Core rev: f3bfb98d1cf928678d9931308c116e9e6ec64ba5) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 4.0.31Lee Chee Yang2025-11-262-0/+211
| | | | | | | | | | (From yocto-docs rev: b0f5cc276639916df197435780b3e94accd4af41) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 992d0725e8b4fdcdc2e9a101ce51ebef94a00112) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation: link to the Releases page on yoctoproject.org instead of wikiRoss Burton2025-11-265-12/+12
| | | | | | | | | | | | | | | We have a machine-generated Releases page[1] which is preferable to the wiki. [1] https://www.yoctoproject.org/development/releases/ (From yocto-docs rev: 5af5e64e42732c0919cad499e79ff35ca4255a86) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 46a9172fd17aa518028e35b8c874e74889079094) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-06-03 21:00:14 +0000