summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
Commit message (Collapse)AuthorAgeFilesLines
* The poky repository master branch is no longer being updated.Richard Purdie2025-11-07162-10684/+0
| | | | | | | | | | | | | | | | | | | | | You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: extend check_cwm test timeoutGyorgy Sarvari2025-11-062-0/+33
| | | | | | | | | | | | | | | | | Fixes [YOCTO 14649] The default 3s test execution timeout isn't always enough for the check_cwm test on the autobuilder in case there is a high load on the host machine, and due to this this case fails sometimes. This patch doubles the timeout for this testcase to 6 seconds to allow enough time for execution even if there is high CPU usage by other processes. (From OE-Core rev: 561aba8d38d1e15d23bd13736013825bd04aff2c) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: fix CVE-2025-11232Ross Burton2025-11-062-0/+475
| | | | | | | | | | | | | | | | | | | | Backport a patch from upstream to resolve CVE-2025-11232: Invalid characters cause assert To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. (From OE-Core rev: f9331b42fd8b0df64517969a794a93d41624bd96) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: patch CVE-2025-24912Peter Marko2025-11-033-0/+151
| | | | | | | | | | | | | | | | | Pick patches as listed in NVD CVE report. Note that Debian lists one of the patches as introducing the vulnerability. This is against what the original report [1] says. Also the commit messages provide hints that the first patch fixes this issue and second is fixing problem with the first patch. [1] https://jvn.jp/en/jp/JVN19358384/ (From OE-Core rev: 2eed0deab456df4ef8876afe0710c9c89b41d45f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Upgrade 10.0p1 -> 10.1p1Archana Polampalli2025-10-301-1/+1
| | | | | | | | | | | | | | Changelog: https://www.openssh.org/txt/release-10.1 RP: There are some changes to confg options and new warnings but those warnings would only trigger on older openssh before 9.0 (April 2022). (From OE-Core rev: 251a2997b432bfba98a94e58a557c06d9c3d416d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.20.13 -> 9.20.15Praveen Kumar2025-10-301-1/+1
| | | | | | | | | | | | | | | This upgrade fixes CVE-2025-8677,CVE-2025-40778 and CVE-2025-40780. Changelog ========== https://downloads.isc.org/isc/bind9/9.20.15/doc/arm/html/changelog.html (From OE-Core rev: 3de3d7864e34407384d5a8b34d9e1c01839f6595) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* avahi: fix CVE-2024-52615Zhang Peng2025-10-302-0/+229
| | | | | | | | | | | | | | | | | | | | | | | CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (Cherry pick from commit: ec22ec26b3f40ed5e0d84d60c29d8c315cf72e23) (From OE-Core rev: 97d60090dbe96dca423af47c8d55cc53e172fb4c) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* avahi: fix CVE-2024-52616Zhang Peng2025-10-302-0/+105
| | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (Cherry pick from commit 28de3f131b17dc4165df927060ee51f0de3ada90) (From OE-Core rev: 3d36874e2beb64ca2a089a2be942cbbbbe1fff79) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: fix installation umask to 0022 of meson.Liu Yiding2025-10-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The default installation umask is 0027 for Kea-built artifacts. And it caused package conflicts as following: Error: Transaction test error: file /usr/lib/pkgconfig conflicts between attempted installs of kea-dev-3.0.1-r0.x86_64_v3 and btrfs-tools-dev-6.16-r0.x86_64_v3 file /usr/lib/pkgconfig conflicts between attempted installs of libgcrypt-dev-1.11.2-r0.x86_64_v3 and kea-dev-3.0.1-r0.x86_64_v3 I submitted an issue to the upstream and found upstream alreadly known this issue. https://gitlab.isc.org/isc-projects/kea/-/issues/4171 https://gitlab.isc.org/isc-projects/kea/-/issues/3993 Then I follow the method in the SPEC file of upstream to fix this problem in Yocto. https://gitlab.isc.org/isc-projects/kea-packaging/-/blob/master/rpm/kea.spec?ref_type=heads meson setup build \ --buildtype release \ --install-umask 0022 \ --bindir %{_bindir} \ (From OE-Core rev: 0294c265a1f662e2b68b3a462da113cfa835485b) Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: fix EXTRA_OE config to EXTRA_OEMESONLiu Yiding2025-10-271-1/+2
| | | | | | | | | | | After kea has been upgrade to 3.0.1,the build system changed to meson,but the config of build system is still be EXTRA_OECONF. So this commit fix it. (From OE-Core rev: df3f4196693ae82bddebe134f3af0db92e5d5712) Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: fix conflict between kea-dhcp4 and kea-dhcp6 multilibsLiu Yiding2025-10-271-9/+35
| | | | | | | | | | | | | | | | There are conflict of config files between kea and lib32-kea: | Error: Transaction test error: | file /etc/kea/kea-dhcp4.conf conflicts between attempted installs of lib32-kea-3.0.1-r0.core2_32 and kea-3.0.1-r0.x86_64_v3 | file /etc/kea/kea-dhcp6.conf conflicts between attempted installs of lib32-kea-3.0.1-r0.core2_32 and kea-3.0.1-r0.x86_64_v3 Update this patch after kea was upgraded to 3.0.1. (From OE-Core rev: 5318fba1f4bc50e658aee9461cc919ab093a8293) Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 3.5.2 -> 3.5.4Peter Marko2025-10-092-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-353-and-openssl-354-30-sep-2025 OpenSSL 3.5.4 is a security patch release. The most severe CVE fixed in this release is Moderate. This release incorporates the following bug fixes and mitigations: * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) * Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231) * Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) * Reverted the synthesised OPENSSL_VERSION_NUMBER change for the release builds, as it broke some exiting applications that relied on the previous 3.x semantics, as documented in OpenSSL_version(3). Release information: https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-352-and-openssl-353-16-sep-2025 OpenSSL 3.5.3 is a bug fix release. This release incorporates the following bug fixes and mitigations: * Added FIPS 140-3 PCT on DH key generation. * Fixed the synthesised OPENSSL_VERSION_NUMBER. * Removed PCT on key import in the FIPS provider as it is not required by the standard. (From OE-Core rev: 0e2b3c46fdf2e2b3854fa73bda434fdd41da0a3c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: fix Bluetooth LE audio regressionGuðni Már Gilbert2025-10-022-0/+30
| | | | | | | | | | Backport a fix for a regression introduced in 5.84 which breaks Bluetooth LE audio (From OE-Core rev: 2b675c5cbfcaa7a5918ddd4a13400be5be60b3e6) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: upgrade 5.83 -> 5.84Guðni Már Gilbert2025-09-224-46/+4
| | | | | | | | | | | | | | | | | | | | | | * Enable aics tests again as the issue with them has been fixed * Remove threads package config as the option is removed Changelog: * Fix issue with AVRCP and handling invalid UTF-8 item name. * Fix issue with exposing coordinate sets if LE Audio is disabled. * Fix issue with BAP and not responding to SetConfiguration. * Add support for BAP unicast endpoint reconfiguration. * Add support for BASS and encrypted broadcast source. * Add support for HFP and Call Line Identification. Full changelog: https://github.com/bluez/bluez/compare/5.83...5.84 (From OE-Core rev: 967f87d0522cb9c206d1826e669f129c87aefa96) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nfs-utils: 2.8.3 -> 2.8.4Robert Yang2025-09-182-59/+1
| | | | | | | | | | * Remove backported patch 0002-Fix-build-with-glibc-2.42.patch. (From OE-Core rev: 988dc5702eb22d81ba414133b38bd6cadc8cda6b) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.20.12 -> 9.20.13Anna-Lena Marx2025-09-187-9/+9
| | | | | | | | | | | Upgrade bind to 9.20.13. Changelog: https://downloads.isc.org/isc/bind9/cur/9.20/doc/arm/html/changelog.html (From OE-Core rev: 5ae5582471f7cff4c54398516ac748c277ab43d3) Signed-off-by: Anna-Lena Marx <anna-lena.marx@inovex.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: fix unbound variable issues under 'set -u'Haixiao Yan2025-09-151-4/+4
| | | | | | | | | | | | | | | | | | | | | | | When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: avoid hiding implementation-reserved symbols in version scriptsPeter Tatrai2025-09-112-0/+51
| | | | | | | | | | | | | | | | | | | | | This commit adds a patch to ConnMan that modifies the version scripts (src/connman.ver and vpn/vpn.ver) to avoid hiding implementation-reserved symbols (such as _IO_stdin_used). Previously, using 'local: *;' in the version script caused glibc's libio to misdetect the libc version, resulting in a crash when printing to stdout (e.g., running 'connmand --help') on PowerPC. The new patch changes 'local: *;' to 'local: [!_]*;', following the recommendation in glibc bug 17908 (https://sourceware.org/bugzilla/show_bug.cgi?id=17908). This ensures that symbols starting with an underscore are not hidden, allowing libio to correctly detect the libc version and preventing the crash. (From OE-Core rev: fb2e29fc6931dc03ec892908e8e22d869d992f76) Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: Fix build with clang/libc++ 21Khem Raj2025-09-112-0/+349
| | | | | | | | | | | | | Clang with libc++ hardening on, rejects Boost’s enum trait probe which is ill-formed for scoped/limited enums whose valid range does not include −1 (e.g. enums with values [0..3]) (From OE-Core rev: 2fa8a44981abfdf8ff5b0804612be03c4da3ca2c) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ofono: upgrade 2.17 -> 2.18Gyorgy Sarvari2025-09-111-1/+1
| | | | | | | | | | | | | Changelog: Fix issue with QMI and handling SMS message acknowledgement. Fix issue with handling SIM7100 modem ready detection. Add support for forbidden operator list. (From OE-Core rev: 1cae80e6350dba5b23ad64bd97086aaee1734a4f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iw: upgrade 6.9 -> 6.17Wang Mingyu2025-09-111-1/+1
| | | | | | | | (From OE-Core rev: 11b48ad749c6f45bf5502a4bb9f21fe72629e3d7) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: upgrade 6.15.0 -> 6.16.0Wang Mingyu2025-09-111-1/+1
| | | | | | | | (From OE-Core rev: a750578cb10479e536c38a85dab3d5749ece2049) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.20.11 -> 9.20.12Wang Mingyu2025-09-111-1/+1
| | | | | | | | (From OE-Core rev: 2a81d3568389250616001f7617f8566478f61ff0) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: Upgrade to 3.0 LTS releaseKhem Raj2025-09-088-130/+258
| | | | | | | | | | | | | | | | | | | | * Drop backported patch and refresh remaining * Add fixes to build with boost 1.89.0 * Switch to meson build system * Delete meson-info files There’s no Meson built-in switch to stop creating intro-*.json in the build dir (that’s by design), only to stop installing them is possible. for runtime, Kea doesn’t read it, this is just build metadata License-Update: Removed remaining coroutine references [1] [1] https://github.com/isc-projects/kea/commit/93bab7a99f82e2ceadca14a7a6a2440cd69fb8c8 (From OE-Core rev: 7fc9f49262379442503f010933047e421efcf5f3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: Revert removal of no-version-scripts patchPeter Tatrai2025-09-082-0/+49
| | | | | | | | | | | | | | | | | This commit restores the no-version-scripts.patch for ConnMan, which was removed in the commit (5c269ba9a396832af3f8139ecaa0cfd9f7d4d1b5) as part of cleaning up gold and MIPS binutils workarounds. The removal of this patch caused runtime crashes (segfaults) on the powerpc target due to symbol visibility issues with glib and stdio. Re-adding the patch resolves these crashes by disabling version scripts in the linker flags. (From OE-Core rev: 6ba2c24b8e063afec0041c54bb80a2f4f44b526c) Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: Upgrade to 2.6.4 releaseKhem Raj2025-09-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | The following bug fixes have been implemented since the previous stable release, version 2.6.3: 1. **Syslog logging fix**: We corrected an issue in logging configuration when parsing "syslog:<facility name>" [#3921, #3992]. 2. **Fix for misconfigured global reservations**: Earlier Kea versions could crash when handling misconfigured global reservations. The problem is now fixed [#3910, #3911, #4001]. 3. **Recent Sphinx support**: Support for recent versions of Sphinx, a tool used to generate documentation, was added. This allows Kea documentation and packages to be built on recent systems, while maintaining compatibility with older versions. This fix was tested with Sphinx 1.8.4 on Debian 10, 8.1.3 on Fedora 42, and 8.2.3 on ArchLinux [#3800]. (From OE-Core rev: 692aef87a93b8b7ca45be8fdda8726021c870c6f) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: cleanup CVE_STATUS which are resolved nowPeter Marko2025-08-281-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The don't show up in CVE metrics anymore since they were either fixed upstream or recipe version was upgraded meanwhile. * bind CVE-2019-6470: cpe got corrected in nvd db * libxml2 CVE-2023-45322: version is now higher than NVD cpe * zlib CVE-2023-45853: version is now higher than NVD cpe * gcc CVE-2021-37322: version is now higher than NVD cpe * python3 * CVE-2007-4559: version is now higher than NVD cpe * CVE-2019-18348: version is now higher than NVD cpe * CVE-2020-15523: version is now higher than NVD cpe * CVE-2022-26488: version is now higher than NVD cpe * CVE-2015-20107: version is now higher than NVD cpe * CVE-2023-36632: version is now higher than NVD cpe * rust * CVE-2024-24576: NVD has no cpe, but we have newer version as fix * CVE-2024-43402: version is now higher than NVD cpe * cups CVE-2021-25317: version is now higher than NVD cpe * ghostscript CVE-2023-38559: version is now higher than NVD cpe * libtirpc CVE-2021-46828: version is now higher than NVD cpe * unzip CVE-2008-0888: version is now higher than NVD cpe * ffmpeg CVE-2023-39018: cpe got corrected in nvd db * libxslt CVE-2022-29824: version is now higher than NVD cpe * libyaml * CVE-2024-35325: CVE is now rejected in NVD DB * CVE-2024-35326: CVE is now rejected in NVD DB * CVE-2024-35328: CVE is now rejected in NVD DB Also add comment for iputils regarding reports for FKIE/NVD2. Also remove some trailing spaces in python recipe. (From OE-Core rev: 73ee9789183aa95072af2b51ac9e08203f4e33f9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: Upgrade 1.44 -> 1.45Leon Anavi2025-08-253-92/+1
| | | | | | | | | | | | | | | | | | Upgrade to release 1.45: - Add missing newlines on error messages - timezone: Replace Localtime file copy with symbolic link - Fix CVE-2025-32366 vulnerability - Fix CVE-2025-32743 vulnerability - vpn: Fix extracting of PrefixLength D-Bus value - vpn: Fix mem leak of gid_list in task setup - dchpv6: Set err to 0 when client creation succeeds (From OE-Core rev: c5fd636aa6f310e868ea29a72913ea96edcf57c5) Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nfs-utils: Fix do_configure when switching configurationsRichard Purdie2025-08-181-2/+2
| | | | | | | | | | | | | | | | On the autobuilder we saw: ERROR: nfs-utils-2.8.3-r0 do_package_qa: QA Issue: nfs-utils package is not obeying usrmerge distro feature. /lib should be relocated to /usr. [usrmerge] This can be reproduced by running do_configure with sysvinit, switching to systemd and re-running do_configure. udev_rulesdir will then have the wrong value. Fix the sed expressions so the task can rerun correctly and update as desired. (From OE-Core rev: e2f74b9ceeb4e9bf770f65db16a19b1ae1a28f2e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.20.10 -> 9.20.11Gyorgy Sarvari2025-08-141-1/+1
| | | | | | | | | | | Changelog: https://downloads.isc.org/isc/bind9/9.20.11/doc/arm/html/changelog.html#bind-9-20-11 (From OE-Core rev: 5ca636ac567f6085f62b55bc3b7de4155af9c593) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 3.5.1 -> 3.5.2Peter Marko2025-08-111-1/+1
| | | | | | | | | | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-351-and-openssl-352-5-aug-2025 OpenSSL 3.5.2 is a bug fix release. This release incorporates the following bug fixes and mitigations: * Miscellaneous minor bug fixes. * The FIPS provider now performs a PCT on key import for RSA, EC and ECX. This is mandated by FIPS 140-3 IG 10.3.A additional comment 1. (From OE-Core rev: bbe3a09beb5e9d6008ac306c82647bb22a5c3210) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* neard: recipe tweaksRoss Burton2025-08-072-3/+3
| | | | | | | | | | | The canonical git repository is on GitHub now, 01.org doesn't exist, and one of the patches has been upstreamed. (From OE-Core rev: cf9c56d772443ee79cf9ad6e40061b6399ceccdf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nfs-utils: Fix build with glibc 2.42Khem Raj2025-07-312-0/+58
| | | | | | | | (From OE-Core rev: 1f968715a1577939bdf9fd99006ca44aaf9c7a9d) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez: Fix invalid-pp-token warning found with clangKhem Raj2025-07-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | We add FIRMWARE_DIR via CFLAGS using escapes for string and clang option parser flags it <command line>:4:23: warning: missing terminating '"' character [-Winvalid-pp-token] 4 | #define FIRMWARE_DIR \"/usr/lib/firmware\" | ^ emitting this warning during configure means some tests fail wrongly. e.g. test for enable -fPIC -DPIC, which results in textrels in libbbluetooth.so Pass the string definition using single quotes to avoid the shell "eating" the quotes and other characters This works well across gcc and clang (From OE-Core rev: 23a87f27b1837bd35bea356f0a10816fb35826f2) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: remove bluez4 from RCONFLICTSGuðni Már Gilbert2025-07-171-2/+0
| | | | | | | | | | | | | There is currently no recipe for bluez4 in openembedded-core. BlueZ 4 hasn't had any updates/support since it's last point release 4.101 back in 2012. (From OE-Core rev: d2de6ae13cbd3f4ade218037ebcfd55d86961a5a) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 3.5.0 -> 3.5.1Peter Marko2025-07-142-2/+2
| | | | | | | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-350-and-openssl-351-1-jul-2025 Handles CVE-2025-4575. Refresh patches. (From OE-Core rev: c030c9c31d27917fb45aaaa5ed174c16ca68ec9e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: set correct permissions for /var/run/keaYi Zhao2025-07-103-0/+3
| | | | | | | | | | | | | | | | | | | Set the permissions of /var/run/kea to 750 to fix kea server startup error: ERROR [kea-dhcp4.dhcp4/445.140718820303936] DHCP4_INIT_FAIL failed to initialize Kea server: configuration error using file '/etc/kea/kea-dhcp4.conf': 'socket-name' is invalid: socket path:/var/run/kea does not exist or does not have permssions = 750 This permission check was introduced by commit[1] in kea 2.6.3. [1] https://gitlab.isc.org/isc-projects/kea/-/commit/43bba7799f6892f739b4745b35bbeacef3645ad3 (From OE-Core rev: 7254a27cdf16a51b5247585d417f2e6afaf84b76) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: add workaround for broken paths in native libcrypto.pcEnrico Jörns2025-07-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since d1b29222 ("openssl-native(sdk): poision built in paths") the workaround for host path contamination in native(sdk) openssl is fixed. But an unfortunate side-effect of forcing the directory variables (OPENSSLDIR, ENGINESDIR, MODULESDIR) to be invalid is that it renders the generated native pkg-config file (libcrypto.pc) unusable: [..] includedir=${prefix}/include enginesdir=${libdir}/../../../../../../../../../../../../../../../../not/builtin modulesdir=${libdir}/../../../../../../../../../../../../../../../../not/builtin Name: OpenSSL-libcrypto [..] This will prevent other native tools (like libp11-native) from installing their (.so) files into valid OpenSSL directories. The strange paths are a result of OpenSSL's build system attempting to resolve the dummy path "/not/builtin" relative to ${libdir} for libcrypto.pc.in: | enginesdir=${libdir}/{- $OpenSSL::safe::installdata::ENGINESDIR_REL_LIBDIR[0] -} There doesn't appear to be a straightforward way to avoid embedding a built-in host path while still generating a valid libcrypto.pc file. This workaround now post-fixes the .pc files for openssl-native by using two sed calls to replace the invalid paths with the valid ones. (To prevent bitbake from early expanding the libdir variables, use a group as a simple hack.) (From OE-Core rev: 4d4af8d1cb272369eb4ddcc489e90831c9c2c8c7) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: limit read access to sshd_configLouis Rannou2025-07-071-2/+5
| | | | | | | | | | | | | | | Enhance security by limiting read access for /etc/sshd_config to user root as it may reveal unsecure configurations. Reading access is limited in the install append as the default value 0644 is hardcoded in the openssh makefile and is not configurable. Therefore the permissions are modified in the install append. (From OE-Core rev: 99c09d29d56cb98f749c2283b5b800de9af98745) Signed-off-by: Louis Rannou <louis.rannou@non.se.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20240407 -> 20250613Wang Mingyu2025-07-031-2/+2
| | | | | | | (From OE-Core rev: 7ee122c35701bdf4cda4c72757ff8c85e07de5d3) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.20.9 -> 9.20.10Wang Mingyu2025-07-031-1/+1
| | | | | | | (From OE-Core rev: 87a70365d16f740c9ad720c6e4a134c0e88ce325) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: remove consecutive blank linesAlexander Kanavin2025-06-208-8/+0
| | | | | | | | | | | | | | | | | Some of them were introduced by mass-removal of S = WORKDIR/git assignments; rather than try to fix up (or redo) just these, I've run this sed command over the whole tree: sed -i -z -E 's/([ \t\f\v\r]*\n){3,}/\n\n/g' `find . -name *.bb -o -name *.inc` The rationale is that more than one empty line is wasting vertical screen space, and does nothing for readability. (From OE-Core rev: cedc4ff7c9bcfb22a20e43e47f9759f4007a4f1a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: set S from UNPACKDIR in recipes that use only local filesAlexander Kanavin2025-06-203-6/+3
| | | | | | | | | | | | | | | There is no need to have two assignments; also setting S from UNPACKDIR (and not vice versa) is more logical as unpack task comes first, and tasks that come after unpack use S to access unpack results. Also adjust reference test data in selftest/recipeutils to reflect changes in test recipes. (From OE-Core rev: f64b7e5fb3181734c8dde87b27e872a026261a74) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: set S to be in UNPACKDIR in recipes that explicitly set SAlexander Kanavin2025-06-202-2/+2
| | | | | | | | (From OE-Core rev: 7321cc17ae5483f17fe9cdffea7b62acd9d9c3a2) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: remove S in recipes that fetch from git via setting ↵Alexander Kanavin2025-06-208-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BB_GIT_DEFAULT_DESTSUFFIX Removing all the S = ${WORKDIR}/git assignments works because BB_GIT_DEFAULT_DESTSUFFIX is set to match S from bitbake.conf (which itself is set to match typical tarball releases). A few recipes are setting S to a sub-directory of the git tree and need to be adjusted accordingly. bzip2 recipe is fetching a tarball and separately cloning tests; adjust the recipe to put the latter into 'bzip2-tests', instead of 'git'. devupstream.bbclass no longer needs to rewrite S, and is adjusted accordingly. Adjust scripts/lib/recipetool/append.py to not hardcode 'git' as unpack destination. Adjust kernel-yocto.bbclass to use the git unpack variable instead of hardcoding 'git' (there's also removal of repetition of string constants and a correction of workdir/unpackdir mismatch in one of the if-else branches). Ensure build-appliance-image recipe does not use 'git' as checkout directory for poky repo, but rather explicitly name it 'poky'. Ensure reproducible.py code that looks for git repositories does not hardcode 'git' but uses the destination set by BB_GIT_DEFAULT_DESTSUFFIX. Ensure recipetool does not write out unneeded S settings into newly created recipes that fetch from git. Adjust selftest to not hardcode 'git' as unpack directory. (From OE-Core rev: f80c07019ddadaf9c5fb890faabfda7920ecd15e) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: upgrade 2.6.1 -> 2.6.3Yi Zhao2025-06-125-470/+2
| | | | | | | | | | | | | | | | | | | | | ReleaseNotes: https://downloads.isc.org/isc/kea/2.6.2/Kea-2.6.2-ReleaseNotes.txt https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt Security fixes: CVE-2025-32801 CVE-2025-32802 CVE-2025-32803 License-Update: Update copyright years * Drop backport patches. (From OE-Core rev: d09264ce0dbce31dcc50c44f350fad28c33503af) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: upgrade 5.82 -> 5.83Guðni Már Gilbert2025-06-123-5/+5
| | | | | | | | | | | | | | | | | | | | Changelog: Fix issue with handling BAP and removal of PAC. Fix issue with handling SID for broadcast receiver. Fix issue with handling HSP/HFP reconnection policy. Fix issue with handling cable pairing and Sixaxis controllers. Fix issue with handling virtual cable unplug for HID devices. Fix issue with handling service records for HID devices. Add support for AVDTP and TX timestamps. Full changelog: https://github.com/bluez/bluez/compare/5.82...5.83 (From OE-Core rev: 83d217503d565ba60dcec9382afb828deefa962b) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: put version in recipe filenameRoss Burton2025-06-091-2/+2
| | | | | | | | | | | | A recipe that fetches from git but is otherwise a released version should not be using _git.bb recipe names. Put the version in the filename and drop the explicit PV. (From OE-Core rev: 9ffe55ae643fb606a8bec7e6ec7d15ca95cf9e2d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: correctly eliminate build host paths from installed fileAlexander Kanavin2025-06-091-1/+1
| | | | | | | | | | Only the ${B} part should be trimmed, not what follows (which is subject to change, depending on where the sources are). (From OE-Core rev: 1e3fc9b7592956af9bd93e0a077c5b9f3fd9ca2e) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ofono: upgrade 2.16 -> 2.17Wang Mingyu2025-06-051-1/+1
| | | | | | | | (From OE-Core rev: 04b5ed9746ce9af0375c6691038ef123e96bd192) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-04 02:11:49 +0000