summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* contributor-guide/recipe-style-guide.rst: explain difference between layer ↵yocto-4.0.33kirkstone-4.0.33Antonin Godard2026-01-261-0/+14
| | | | | | | | | | | | | | | | | | and recipe license(s) Explain that the LICENSE set in a recipe does not apply to the recipe file itself, but to the underlying software. The license of the recipe file is the license provided in the layer itself. Give OpenEmbedded-Core as an example for this. Fixes [YOCTO #14410] (From yocto-docs rev: 6799b1be5d48f4bf5dcd0b16c2dbc2e297d4ecd9) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b8a56b8b2e8c0417b2f7204f80c79b05d95e9ce4) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/variables.rst: document the CCACHE_TOP_DIR variableAntonin Godard2026-01-261-0/+6
| | | | | | | | | | | | | | | Added by commit 35d7fe73bba1 ("ccache.bbclass: Make it can be shared between different builds") in OE-Core. Fixes [YOCTO #16052] (From yocto-docs rev: e4f5ba7bb34586cd7bee7f0fe69c39b36dabb357) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 550ef8340b550f8d4e9c3d0672190dc09592c621) Fix conflicts: CCLD variable in master not on kirkstone. Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* overview-manual: convert YP-flow-diagram.png to SVGAntonin Godard2026-01-264-2/+952
| | | | | | | | | | | | | Based on diagrams/poky-buildprocess/Pokyarch_diag.svg, replace the PNG graphic for the YP flow to an SVG graphic. (From yocto-docs rev: 2983418bec7a2faeaae4e831b8f642ff0cd95980) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit d2aaf54bee49295bdf81021648cb27499930edc6) Fix conflicts (different alignment on master, keep one from kirkstone) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* overview-manual/yp-intro.rst: fix SDK type in bullet listAntonin Godard2026-01-261-1/+2
| | | | | | | | | | | | | | The YP generates an SDK by default, which can be meta-toolchain, an image-specific one, or an extensible SDK (eSDK). Don't be specific in this bullet list. (From yocto-docs rev: 3c455c5a2892611d2323610170f9600ceb953f6c) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit f02c64286504353e97c7e5fe5c0d193776469ad1) Fix conflict (#. on master, 7. on kirkstone) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/release-process.rst: add a "Development Cycle" sectionAntonin Godard2026-01-261-0/+39
| | | | | | | | | | | | | | | Add a new section to release-process.rst to document the development cycle of each release and namely the milestones and feature freeze occuring after M3. Fixes [YOCTO #15979] (From yocto-docs rev: f7888e3c3267ec7c39374f694f86088598bea649) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 77c04cc5944acda7575546a7434e014e4a75ba58) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* test-manual/ptest.rst: detail the exit code and output requirementsAntonin Godard2026-01-261-0/+19
| | | | | | | | | | | | | | | | | | | A ptest must emit at least one test result on the console, as this is required by the testimage class (which ignores the exit code). ptest-runner on the other hand, ignore the output and only cares about the exit code. Add these two items as requirements for a ptest to be valid. Fixes [YOCTO #15832] Reviewed-by: Yoann Congal <yoann.congal@smile.fr> (From yocto-docs rev: 916be11467d87d39e4ad5ea218237258523f3953) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 9292f61d7ba89598c89033ea7ee3b11a20d873f3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/classes.rst: document the image-container classAntonin Godard2026-01-262-0/+65
| | | | | | | | | | | | | | | | | | | Add documentation for the image-container class, which is a simple class to generate an image suitable for creating a container. This answers in part to questions asked in [YOCTO #14368]. It also adds documentation for IMAGE_CONTAINER_NO_DUMMY, which was added in OE-Core with commit f0645e172bb8 ("image-container.bbclass: Error if not using linux-dummy"). Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: cebe8ff0508e0fc2de8378a1cf93eb8054e12699) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 6ce00e5875eb3469fefd55cc22acaaeaf620053a) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Add a new "Security" sectionAntonin Godard2026-01-266-196/+215
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current security-related documentation is a bit hard to find and hidden within the development manual. However these are processes that are not part of a development task but is rather a vulnerability reporting process. Create a new "Security" section in the documentation to gather this information. This will be directly visible in the sidebar when opening the documentation. Split the previous security-subjects.rst document into 2 documents: - security-team.rst: defines the roles of the security teams and its members. - reporting-vulnerabilities.rst: guide to report vulnerabilities to the security team. The plan is to backport these documents to active releases. As a consequence, this section should be free of instructions and information that only make sense for a specific release. It should _not_ contain documents on how to enable security features with Yocto on target devices, this is unrelated and can be left in the development manual (for example: dev-manual/vulnerabilities.rst to deal with CVEs). (From yocto-docs rev: 3fd0f37d708d88534dd6dbb51dc264911c349352) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 81e14ca2d5cff9e2104c556655144b069633790c) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/svg/releases.svg: mark whinlatter as current releaseAntonin Godard2026-01-261-5/+5
| | | | | | | | | | | | Whinlatter is the new current Yocto Project release, mark it as an active one. Move it as released in December 2025. (From yocto-docs rev: 7f6dff5c3d549cbd5040c15261bdb38a54dbd69e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 6f8e97c6e529f3c47f45f34d9e04e3ad7bddd587) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual/svg/releases.svg: mark styhead and walnascar EOLAntonin Godard2026-01-261-3/+3
| | | | | | | | | | | | | Walnascar has stopped being updated a while ago, and Styhead is EOL since May 2025. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 2425f0cf64c35b9f7d0676dd31c2ea94fcdb3a31) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 834de77b543de43ee3c1c12ca1d6277e67e126de) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* overview-manual/yp-intro.rst: link to YP members and participantsAntonin Godard2026-01-261-4/+3
| | | | | | | | | | | | | Instead of a fixed list of commercial vendors, link to existing lists on the YP website. Reported-by: Robert P. J. Day <rpjday@crashcourse.ca> (From yocto-docs rev: 69ad32040baf8ca7c79265fd83041b3241353e2d) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 9d394db4f88b66500e4d5a2a518d25f08a0c9472) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* overview-manual/yp-intro.rst: change removed ECOSYSTEM to ABOUTAntonin Godard2026-01-261-1/+1
| | | | | | | | | | | | The ABOUT tab is where the members/participants are listed now. Reported-by: Robert P. J. Day <rpjday@crashcourse.ca> (From yocto-docs rev: 8e216cd6e17fe4bc367c11d2ad3e3d7a29701af8) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit a8a8d810f0505529aaaa90678e03152c8ac0c00b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionRichard Purdie2026-01-261-1/+1
| | | | | | (From OE-Core rev: 036f76ea35c49a78d612093dcd8eb1fac7ded8d7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: Bump version for 4.0.33 releasePaul Barker2026-01-261-1/+1
| | | | | | | (From meta-yocto rev: 677379f21941363d50f9d946963542b4ccb7e27c) Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa: Use 2.14 release of cpio instead of 2.13Khem Raj2026-01-263-4/+4
| | | | | | | | | | | | | | | | | | | | 2.13 may not be buildable with latest compilers without patching (From OE-Core rev: 64d56cf416b31ae92438deefe4028402120ed998) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 406a33f896accc35a9cb6ab156f1e0f42dda67d8) Backport: Fix [YOCTO #16137] by using the same archive as the cpio recipe, ensuring the archive is in DL_DIR and so, avoiding reaching unreliable upstream server. This upgrade is safe to do because this archive is only use to test that it compiles. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Update to pull in 'makewrappers: Fix EFAULT implementation'Richard Purdie2026-01-261-1/+1
| | | | | | | | | | | | The pseudo update was causing hangs in builds, pull in the fix. (From OE-Core rev: e514b1ac74ae8a69b15e3459cb3b327a35cabff8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8acdbefd0a148c8b7713f46066ae8489984c5d2d) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Update to pull in openat2 and efault return code changesRichard Purdie2026-01-261-1/+1
| | | | | | | | | | | | | | | | | | | | | Pulls in the following fixes: * makewrappers: Enable a new efault option * ports/linux/openat2: Add dummy wrapper * test-syscall: Add a syscall test * ports/linux/pseudo_wrappers: Avoid openat2 usage via syscall which should fix issues with the tar CVE fix on Centos/Alma/Rocky 9 distros that uses openat2 as well as the efault issue breaking rust based uutils. (From OE-Core rev: edc8c8e0ae511b03cb9d0501d472bb42fbea2c8b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 51f1388dd1679a28ec3ca468cf16aa0ea32bccf9) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Add hard sstate dependencies for pseudo-nativePaul Barker2026-01-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Where a task (such as do_package) runs under fakeroot, the corresponding setscene task (do_package_setscene) will also run under fakeroot when restoring from sstate. Assuming pseudo is used as the fakeroot implementation, we need pseudo-native and all its runtime dependencies to be available in the sysroot before running any setscene tasks under fakeroot. We already add a hard dependency from all do_package_setscene tasks to virtual/fakeroot-native:do_populate_sysroot in base.bbclass, but this does not cover transitive dependencies. So, extend the dependencies of pseudo-native:do_populate_sysroot_setscene to ensure that the sqlite3 library is also available in the sysroot before running fakeroot setscene tasks. [YOCTO #15963] (From OE-Core rev: e3c07672d22343cd7ac68cb84716b05ec7cd438b) Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2c146ca657440550e00bc5e53d13502ef7aa945b) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Update to pull in memleak fixRichard Purdie2026-01-261-2/+2
| | | | | | | | | | (From OE-Core rev: d789b03d33d9a0fce335080f667c29ed45515726) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 42137b6f97da0672af365cd841678f39ce5907d2) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: 1.9.0 -> 1.9.2Robert Yang2026-01-261-2/+2
| | | | | | | | | | | (From OE-Core rev: 2093a9c80e391795abbac8766569583a3547e43b) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 48a42747fd280ce68283e1491971d22273e3bdf2) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Upgrade to version 1.9.1Richard Purdie2026-01-264-114/+3
| | | | | | | | | | | | | | | | | | | | | | | | This brings in: * nftw, nftw64: add wrapper * ftw, nftw, ftw64, nftw64: add tests * Move ftw and ftw64 to calling ntfw and nftw64 * makewrappers: Introduce 'array' support * pseudo_util.c: Avoid warning when we intentionally discard const * pseudo_client.c: Fix warning * yocto-older-glibc-symbols.path: Add as a reference patch * pseudo/pseudo_client: Add wrapper functions to operate correctly with glibc 2.38 onwards * configure: Prune PIE flags * test/test-parallel-rename.sh: Add parallel rename test * test/test-parallel-symlinks.sh: Add parallel symlink test * ports/linux/guts: Add .gitignore to ignore generated files (From OE-Core rev: b3140c624504b19a2b2faec8df89f57a99cefce1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 994e508b2a0ede8b5cc4fe39444cf25dc9a53faf) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: Fix CVE-2025-1181Vijay Anusuri2026-01-263-0/+493
| | | | | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2025-1181 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 & https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=18cc11a2771d9e40180485da9a4fb660c03efac3] (From OE-Core rev: 55d4b81b15b6eb2e221ff69dc791d2e319fad234) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> [Yoann Congal: Corrected the second patch SHA1 in URLs "18cc11a..."] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: patch CVE-2025-68973Peter Marko2026-01-262-0/+109
| | | | | | | | | | | | | Pick patch from 2.4 branch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-68973 (From OE-Core rev: 403a9bc3da3574d828cfbce805df48d0181eafed) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-15224Peter Marko2026-01-262-0/+32
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15224.html (From OE-Core rev: db87200a8ae19d40e7a8f038d9fe4e426f159ad3) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-15079Peter Marko2026-01-262-0/+33
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15079.html (From OE-Core rev: 8ce2a761c2f00e9c7782654cf6d6384ccd3f6e16) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-14017Peter Marko2026-01-262-0/+116
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-14017.html (From OE-Core rev: ae23e163f7399e957a100dc13d9cd0b829eef2f4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: fix CVE-2025-60753 regressionPeter Marko2026-01-263-1/+48
| | | | | | | | | | | Pick patch from PR mentioned in v3.8.5 release notes. (From OE-Core rev: dc3d99c419a913e66cb73bf098291c21985b0432) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2025-13836Hitendra Prajapati2026-01-262-0/+164
| | | | | | | | | | | Upstream-Status: Backport from https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15 (From OE-Core rev: d3bcb5ded27003612ad591764f648e83e91c27ca) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcap: patch CVE-2025-11964Peter Marko2026-01-262-0/+34
| | | | | | | | | | | | | Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-11964 (From OE-Core rev: 026c6e7ee386ae09b9a2ef22d69730fc838ddf4f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcap: patch CVE-2025-11961Peter Marko2026-01-263-0/+473
| | | | | | | | | | | | | | Pick patch per [1]. Also pick additional preparation patch to apply it cleanly. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-11961 (From OE-Core rev: 714fb7c711b414407598e3a94b0600fe7f857e38) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-urllib3: patch CVE-2025-66418Peter Marko2026-01-262-0/+75
| | | | | | | | | | | | | Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66418 (From OE-Core rev: 469fcdd5f07635fa9e308c968126807c1ca09647) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dropbear: patch CVE-2019-6111Peter Marko2026-01-262-0/+158
| | | | | | | | | | | Pick patch mentioning this CVE number. (From OE-Core rev: 3a8effd37b83cab3421ee1fe59da232cdf338743) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cups: allow unknown directives in conf filesPeter Marko2026-01-262-0/+44
| | | | | | | | | | | | | | | | | Patch for CVE-2025-61915 by mistake causes fatal error on unknown directives in configuration files. The default configuration already contains unknown directive in non-systemd setups: Unknown directive IdleExitTimeout on line 32 of /etc/cups/cupsd.conf Backport fix for this from 2.4.x branch which reverts this behavior. (From OE-Core rev: 6faf1266813efa21503511834cbb12f0d63c82fe) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cups: patch CVE-2025-61915Peter Marko2026-01-262-0/+488
| | | | | | | | | | | | | Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-61915 (From OE-Core rev: 522d8a64335bb3faa7a2ed492fca1bdd665fb236) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cups: patch CVE-2025-58436Peter Marko2026-01-262-0/+631
| | | | | | | | | | | | | Pick patch from branch 2.4.x corresponding to patch mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-58436 (From OE-Core rev: f1014ff6d886312afd55473497934590bc9c78ac) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: ignore CVE-2025-54566 and CVE-2025-54567Peter Marko2026-01-261-0/+3
| | | | | | | | | | | | | | | | These CVEs are not applicable to version 6.2.x as the vulnerable code was introduced inly in 10.0.0. Debian made the analysis, reuse their work. * https://security-tracker.debian.org/tracker/CVE-2025-54566 * https://security-tracker.debian.org/tracker/CVE-2025-54567 (From OE-Core rev: 616e6c793bd025337aa8b66450408829fdfe59d5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2025-14512Peter Marko2026-01-262-0/+71
| | | | | | | | | | | | | | Pick patch from [1] linked from [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935 [2] https://gitlab.gnome.org/GNOME/glib/-/issues/3845 (From OE-Core rev: 2fb84f36c77e0d049a71dcfa597a67d297cbfd0a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2025-14087Peter Marko2026-01-264-0/+462
| | | | | | | | | | | | | | Pick commits from [1] linked from [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4933 [2] https://gitlab.gnome.org/GNOME/glib/-/issues/3834 (From OE-Core rev: 6e1ce2de818d647d69f652ab67c0c2d13860e77b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: patch CVE-2025-13601Peter Marko2026-01-263-0/+255
| | | | | | | | | | | | | | Pick commits from [1] per [2]. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-13601 (From OE-Core rev: eb0e4e0fce9378100e4482fc91d6886d84ef7ec2) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* util-linux: patch CVE-2025-14104Peter Marko2026-01-263-0/+63
| | | | | | | | | | | | | Pick patches per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-14104 (From OE-Core rev: 8f7f1562f6cba3b67cc4301702c03ab31551a155) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Fix CVE-2025-61729Vijay Anusuri2026-01-022-0/+173
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/3a842bd5c6aa8eefa13c0174de3ab361e50bd672 (From OE-Core rev: 0057fc49725db8637656fac10631d8f89799bad3) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2025-61727Vijay Anusuri2026-01-022-0/+230
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/04db77a423cac75bb82cc9a6859991ae9c016344 (From OE-Core rev: dc1d95e3edfeaa5458fc564910ae5c9445a6f942) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Update CVE-2025-58187Vijay Anusuri2026-01-023-1/+518
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/ca6a5545ba18844a97c88a90a385eb6335bb7526 (From OE-Core rev: 43b3d2b2ef77c97b323b86bd6ee54996c38e46ed) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664Jiaying Song2026-01-024-0/+179
| | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2025-61661 https://nvd.nist.gov/vuln/detail/CVE-2025-61662 https://nvd.nist.gov/vuln/detail/CVE-2025-61663 https://nvd.nist.gov/vuln/detail/CVE-2025-61664 (From OE-Core rev: f2031f39e423b764ccf4003bdee05f30d66fb7ce) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cross.bbclass: Propagate dependencies to outhashMartin Jansa2025-12-311-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to what native and staging is doing since: https://git.openembedded.org/openembedded-core/commit/meta/classes/native.bbclass?id=d6c7b9f4f0e61fa6546d3644e27abe3e96f597e2 https://git.openembedded.org/openembedded-core/commit/meta/classes/staging.bbclass?id=1cf62882bbac543960e4815d117ffce0e53bda07 Cross task outputs can call native dependencies and even when cross recipe output doesn't change it might produce different results when the called native dependency is changed, e.g. clang-cross-${TARGET_ARCH} contains symlink to clang binary from clang-native, but when clang-native outhash is changed, clang-cross-${TARGET_ARCH} will still be considered equivalent and target recipes aren't rebuilt with new clang binary, see work around in https://github.com/kraj/meta-clang/pull/1140 to make target recipes to depend directly not only on clang-cross-${TARGET_ARCH} but clang-native as well. I have added a small testcase in meta-selftest which demostrates this issue. Not included in this change, but will send it if useful. openembedded-core $ ls -1 meta-selftest/recipes-devtools/hashequiv-test/ print-datetime-link-cross.bb print-datetime-link-native.bb print-datetime-native.bb print-datetime-usecross.bb print-datetime-usenative.bb print-datetime-native provides script which prints defined PRINT_DATETIME variable. print-datetime-link-native and print-datetime-link-cross both provide a symlink to the script from print-datetime-native. print-datetime-usenative and print-datetime-usecross are target recipes using the native and cross versions of print-datetime-link-* recipe. # clean build all is rebuilt: $ bitbake -k print-datetime-usenative print-datetime-usecross WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_05 WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_05 WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_05 WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_05 WARNING: print-datetime-usecross-1.0-r0 do_install: print-datetime-usecross current DATETIME from print-datetime-link is 2025-11-13_20_05 # keep sstate-cache and hashserv.db: # print-datetime-usenative is correctly rebuilt, because print-datetime-link-native has different hash (because print-datetime-native hash changed) # print-datetime-usecross wasn't rebuilt, because print-datetime-link-cross-x86_64 doesn't include the changed hash of print-datetime-native $ bitbake -k print-datetime-usenative print-datetime-usecross WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_07 WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_07 WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_07 WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_07 It's because print-datetime-link-cross-x86_64 depsig doesn't include print-datetime-native signature: $ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64 drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin drwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux lrwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime While print-datetime-link-native doesn't have this issue, because print-datetime-native signature is there: $ cat tmp/work/x86_64-linux/print-datetime-link-native/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 print-datetime-native: 60f2734a63d708489570ca719413b4662f8368abc9f4760a279a0a5481e4a17b quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8 SSTATE_PKGSPEC=sstate:print-datetime-link-native:x86_64-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 26 3d5458be834b2d0e4c65466b9b877d6028ae2210a56399284a23144818666f10 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-native drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin lrwx ./recipe-sysroot-native/usr/bin/print-datetime-link -> print-datetime With the cross.bbclass fix the link-cross recipe has a checksum from native recipe as well: $ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot OEOuthashBasic 18 print-datetime-native: 9ceb6c27342eae6b8da86c84685af38fb8927ccc19979aae75b8b1e444b11c5c quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8 SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14: task=populate_sysroot drwx . drwx ./recipe-sysroot-native drwx ./recipe-sysroot-native/sysroot-providers -rw- 32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64 drwx ./recipe-sysroot-native/usr drwx ./recipe-sysroot-native/usr/bin drwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux lrwx ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime And print-datetime-usecross is correctly rebuilt whenever print-datetime-native output is different. (From OE-Core rev: c15faee8854e85e02693a041d88326f30b24ee92) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 4.0.31Aleksandar Nikolic2025-12-311-2/+2
| | | | | | | | | Update to the 4.0.31 release of the 4.0 series for buildtools (From OE-Core rev: c0dacba480b02ea591915f8afbe0b48c10b8be43) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-12105Changqing Li2025-12-312-0/+35
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481 (From OE-Core rev: caa6f192df558d5f46c8a0968f72f08c6e59df1d) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Fix CVE-2025-11731Mingli Yu2025-12-312-0/+43
| | | | | | | | | | | Backport patch [1] to fix CVE-2025-11731. [1] https://gitlab.gnome.org/GNOME/libxslt/-/commit/fe508f201efb9ea37bfbe95413b8b28251497de3 (From OE-Core rev: 7196077d84cc8d49652b0d6b54963df579ab1a0b) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11840Yash Shinde2025-12-312-0/+38
| | | | | | | | | | | | | | | | | | | CVE-2025-11840 PR 33455 [BUG] A SEGV in vfinfo at ldmisc.c:527 A reloc howto set up with EMPTY_HOWTO has a NULL name. More than one place emitting diagnostics assumes a reloc howto won't have a NULL name. https://sourceware.org/bugzilla/show_bug.cgi?id=33455 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0] (From OE-Core rev: 85e62aad46eb096cf92907288a3eb1b6f76072c4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11839Yash Shinde2025-12-312-0/+33
| | | | | | | | | | | | | | | | | | CVE-2025-11839 PR 33448 [BUG] Aborted in tg_tag_type at prdbg.c:2452 Remove call to abort in the DGB debug format printing code, thus allowing the display of a fuzzed input file to complete without triggering an abort. https://sourceware.org/bugzilla/show_bug.cgi?id=33448 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=12ef7d5b7b02d0023db645d86eb9d0797bc747fe] (From OE-Core rev: d99979ea5fa475a59d3c21859d3bbbd81e0cdba4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-26 20:35:04 +0000