summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to mickledore head revisionyocto-4.2.4mickledore-4.2.4mickledoreSteve Sakoman2023-11-131-1/+1
| | | | | | (From OE-Core rev: 23b5141400b2c676c806df3308f023f7c04e34e0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to mickledore head revisionSteve Sakoman2023-11-121-1/+1
| | | | | | (From OE-Core rev: 3c35416a8bff3a857004beadbd053d50eca30ce2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to mickledore head revisionSteve Sakoman2023-11-121-1/+1
| | | | | | (From OE-Core rev: 0f4cd6a395404352e2f66bdd11a7727c1f117046) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to mickledore head revisionSteve Sakoman2023-11-111-1/+1
| | | | | | (From OE-Core rev: ae69823d9439ba1995ef48676a2d2236a50fe665) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: backport patch to fix warning in systemd-vconsole-setupChen Qi2023-11-112-0/+140
| | | | | | | | | | The backported patch fixes the following warning: systemd-vconsole-setup[221]: Failed to import credentials, ignoring: No such file or directory (From OE-Core rev: 07c31cd6190476d9d9a4de750a30fe0fb3a93b21) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: Set PATH in syslog initscriptMartijn de Gouw2023-10-251-0/+2
| | | | | | | | | | | | | | | This script is not always called with /sbin and /usr/sbin in the PATH already, for example when called via ssh. Explicitly set PATH to make sure it includes /sbin and /usr/sbin since that's where start-stop-daemon is located. (From OE-Core rev: e9ca1405b732720ff72d379e0262a78bfd2e7d53) Signed-off-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fa53f898eaba15dff030f9eadf86e5bca7d954fa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: add CVSS vector string to CVE database and reportsAntoine Lubineau2023-10-251-3/+8
| | | | | | | | | | | | This allows building detailed vulnerability analysis tools without relying on external resources. (From OE-Core rev: 587ae7bc85fc471d927308d866821d463799023d) Signed-off-by: Antoine Lubineau <antoine.lubineau@easymile.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 048ff0ad927f4d37cc5547ebeba9e0c221687ea6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libc-test: Run as non-root userKhem Raj2023-10-183-27/+35
| | | | | | | | | | | | | | | | | Some of tests impose rlimit on it before running which wont be imposed when running as root user. Fixes src/regression/pthread_atfork-errno-clobber.c:23: (pid = fork()) == -1 failed: fork succeeded despite rlimit src/regression/pthread_atfork-errno-clobber.c:23: (pid = fork()) == -1 failed: fork succeeded despite rlimit FAIL src/regression/pthread_atfork-errno-clobber-static.exe [status 1] (From OE-Core rev: 16075f19b49cb23ead2dec6746d2be6773ae4ae7) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 585bf4b780a8ad60ba2b33cede4f0092ff61ddfc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-sysroots: target or native sysroot population need to be selected ↵Alexander Kanavin2023-10-181-2/+10
| | | | | | | | | | | | | | | | | | explicitly Running them in parallel is prone to races as postinsts from target sysroots rely on executables from native sysroots which may or may not be fully prepared yet. This was observed for example here: https://autobuilder.yoctoproject.org/typhoon/#/builders/146/builds/468/steps/12/logs/stdio https://autobuilder.yoctoproject.org/typhoon/#/builders/147/builds/467/steps/12/logs/stdio (From OE-Core rev: 93e864a23e3f82edc2b2fa2207b2bc4b56c230a9) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 38d7a2e45b883cf999a86af05bcc0eaa875bb47c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: upgrade 1.14.8 -> 1.14.10Wang Mingyu2023-10-181-1/+1
| | | | | | | | | | | | | | | | | | | Changelog: =========== • Avoid a dbus-daemon crash if re-creating a connection's policy fails. • If getting the groups from a user ID fails, report the error correctly, instead of logging "(null)" • Return the primary group ID in GetConnectionCredentials()' UnixGroupIDs field for processes with a valid-but-empty supplementary group list (From OE-Core rev: 67ddf87d3286007a68071685d28a8f9e1ce7f3fa) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aeabd6dd4e65e5cc31f4c2acc5cc46ea03737bed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: remove coreutils dependency in busybox-ptestRoss Burton2023-10-133-1/+37
| | | | | | | | | | | | | | | | | | | A dependency on coreutils was added to busybox-ptest in oe-core 658c5ed to fix a test failure. The failure is because one of the start-stop-daemon tests is known to fail if /bin/false is busybox. Instead of failing, we can check if /bin/false is a symlink to busybox and skip the test if so. [ YOCTO #15068 ] (From OE-Core rev: 12fc32351ff6e42d0b5f9ce679793a8875d3447a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 37482e404cf4dcf9360c29986ced8db78baf249b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: add additional entries to CVE_PRODUCTEmil Kronborg Andersen2023-10-131-1/+1
| | | | | | | | (From OE-Core rev: 0329ca7bb29cdd77cca93c4354e8e0e5de5e37d8) Signed-off-by: Emil Kronborg Andersen <emkan@prevas.dk> (cherry picked from commit d50b395ceff3f30c30a10dba94fb340a547e434f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: libelf has a configure option now, specify itRoss Burton2023-10-131-2/+1
| | | | | | | | | | | GLib has had an option to control libelf since 2.67.0, so use it. (From OE-Core rev: c5bece42d8e10554a6061872ca0f8f70d7102a79) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d2f028c53a2390c28685b373841c9a600e91819a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ell: upgrade 0.57 -> 0.58Wang Mingyu2023-10-111-1/+1
| | | | | | | | | | | | Changelog: Add support for handling sysctl settings. (From OE-Core rev: b9dfc608c0db72edfa62c56a064d8bc45cfc14b1) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 76d0d0d18498c95945e9a4334de7d44d1024e2d1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.37 branch updates.Yash Shinde2023-10-054-564/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | b4e23c75ae tunables: Terminate if end of input is reached (CVE-2023-4911) 2dfd8c77b5 i686: Regenerate ulps 94ef701365 Document CVE-2023-4806 and CVE-2023-5156 in NEWS 4473d1b87d Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843] 9d5c6e27ed x86: Fix for cache computation on AMD legacy cpus. 79310b45af x86/dl-cacheinfo: remove unsused parameter from handle_amd 6529a7466c getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806) b752934602 CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode 1a7cbe52c8 elf: Move l_init_called_next to old place of l_text_end in link map bdb594afa5 elf: Remove unused l_text_end field from struct link_map a7e34a6675 elf: Always call destructors in reverse constructor order (bug 30785) 3d24d1903d elf: Do not run constructors for proxy objects be26b29262 io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64 0d500bfdc0 hurd: Make exception subcode a long f94ff95e93 x86: Fix incorrect scope of setting `shared_per_thread` [BZ# 30745] cc8243fb0b x86: Use `3/4*sizeof(per-thread-L3)` as low bound for NT threshold. 80a8c858a5 x86: Fix slight bug in `shared_per_thread` cache size calculation. 1caf955269 x86: Increase `non_temporal_threshold` to roughly `sizeof_L3 / 4` Dropped 0023-CVE-2023-4527.patch and 0024-CVE-2023-4806.patch files as they are present in glibc version update. (From OE-Core rev: 9e7aaefc0d764eaecf35582bb19490cc6262f966) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* core-image-ptest: Define a fallback for SUMMARY fieldKhem Raj2023-10-041-0/+1
| | | | | | | | | | | | | | | Fixes errors like below seen with bitbake core-image-ptest-fast WARNING: core-image-ptest-apr-util-1.0-r0 do_recipe_qa: QA Issue: Recipe core-image-ptest-apr-util in /mnt/b/yoe/master/sources/poky/meta/recipes-core/images/core-image-ptest.bb does not contain a SUMMARY. Please a dd an entry. [missing-metadata] (From OE-Core rev: 66c2245280dd6e22fa2de230de458ce5ba267f91) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 307381c9267eb3a3e687c577a0afd552d44248f7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* buildtools-tarball: Add libaclJoshua Watt2023-10-041-0/+1
| | | | | | | | | | | | | Hash equivalence need to include the ACLs in the output hash, and libacl is used to do that so include the library in the buildtools-tarball. (From OE-Core rev: 1a0622be3804598895a35c31bd44866c8647967f) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d152dfe784f231fa369d59f9bce8195ad09c5482) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: fix CVE-2023-4806Yash Shinde2023-10-042-0/+343
| | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=973fe93a5675c42798b2161c6f29c01b0e243994] (From OE-Core rev: 7591adeb37f9156266ef98b639073e986e3a49f5) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: fix CVE-2023-4527Yash Shinde2023-09-292-0/+220
| | | | | | | | | Upstream-Status: Backport[https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=4ea972b7edd7e36610e8cde18bf7a8149d7bac4f] (From OE-Core rev: 04926dc555a0a75cd2c59729b351a997b018cdbc) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dropbear: fix CVE-2023-36328Yogita Urade2023-09-202-0/+145
| | | | | | | | | | | | | | | Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS). References: https://nvd.nist.gov/vuln/detail/CVE-2023-36328 https://github.com/libtom/libtommath/pull/546 (From OE-Core rev: e2fe2c2066b066b1561eaba7bd7f27d4079c3cd6) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-sysroots: Ensure dependency chains are minimalRichard Purdie2023-09-041-0/+4
| | | | | | | | | | | | | | | We need to ensure this recipe doesn't have dependencies on others. The SPDX classes/tasks introduce dependenies quilt-native and patch-native which can introduce races on files in the sysroots. Avoid the races by removing the tasks we don't need. [YOCTO #15186] (From OE-Core rev: a3e2e156c602e7fabf0024a6c9dc4603d327f08b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5dc278b077edba8f4099f0f6dfb97e97f680320) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-sysroots: Add SUMMARY fieldKhem Raj2023-09-041-1/+2
| | | | | | | | | | | | Fixes build QA warning about [missing-metadata] (From OE-Core rev: ff7bb864d89ec8c2da707cc7d3cce8336357955e) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4f4c7130f11c069ab18c374dcbfb1276ef37be60) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.37 branch updatessanjana2023-08-301-1/+1
| | | | | | | | | | | | | | | Below commits on glibc-2.37 stable branch are updated. 58f7431fd7 sparc: Fix la_symbind for bind-now 260d4b742b nptl: Fix tst-cancel30 on sparc64 3f4b4e2cdd elf: _dl_find_object may return 1 during early startup 0930ff8eb3 realloc: Limit chunk reuse to only growing requests 8dcb1a5181 hppa: xfail debug/tst-ssp-1 when have-ssp is yes (From OE-Core rev: eef4f4502390d1e18770c604477dd63a1adcee6d) Signed-off-by: sanjana <sanjanasanju1608@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to mickledore head revisionyocto-4.2.3mickledore-4.2.3Steve Sakoman2023-08-181-1/+1
| | | | | | (From OE-Core rev: 7e3489c0c5970389c8a239dc7b367bcadf554eb5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc-locale: use stricter matching for metapackages' runtime dependenciesAlexander Kanavin2023-08-181-4/+4
| | | | | | | | | | | | | | | | | | | | This resolves two issues: 1. metapackages were depending on themselves (except -binaries which wouldn't match against 'glibc-binary'). 2. for the nativesdk variant, due to a non-empty dependency list at parsing time caused by issue 1, map_depends_variable() from meta/lib/oe/classextend.py was forcibly setting PACKAGES to the initial parse-time value (e.g. missing the dynamically created packages). This meant that three out of four nativesdk- metapackages were entireyly missing the dependencies on the respective dynamic package sets. (From OE-Core rev: 580d92c2ae5aab9f4afab1e534291c26dd5bc5c6) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a90fd3afe9184aa1870b34a826e3ba0563477d4b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc/check-test-wrapper: don't emit warnings from sshAnuj Mittal2023-08-151-1/+1
| | | | | | | | | | | | | | | Dont fill up the test log with ssh warning about having added the host to list of known hosts. Also helps fix a test case failure where stderr log was being compared to a known value. (From OE-Core rev: dddbca01474f89fade197cd3284671c859d01108) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63b31ff7e54a171c4c02fca2e6b07aec64a410af) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc-testsuite: Fix network restrictions causing test failuresRichard Purdie2023-08-151-0/+1
| | | | | | | | | | | | | | The check target for the glibc testsuite uses networking to access a QEMU in system mode. This was resulting in large numbers of test failures for the x86 targets that use it. Enable network access to resolve this. (From OE-Core rev: b3b73520296380e78e084918d5c5fbd6c7c50c9b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 088e022f80e57ca345838bf57df9abad3d8b9313) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ncurses: fix CVE-2023-29491Chen Qi2023-08-152-0/+463
| | | | | | | | | | | | | | Backport patch to fix CVE-2023-29491. (From OE-Core rev: f1c95ae70f7aac574daf5b935a02bbba0d6f8a16) (From OE-Core rev: cdb5d9d498d3c1917b286fba03ce7527f23f9953) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* util-linux: add alternative links for ipcs,ipcrmBenjamin Bouvier2023-08-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | When enabling ipcs and ipcrm configuration into busybox, both tools are built and then deployed during do_rootfs. These operation lead to below issue (similar behavior happens for ipcs): do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget:${PN} (). update-alternatives: Error: not linking .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm to /bin/busybox since .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm exists and is not a link Binaries enter in conflict with same named util-linux utilities during do_rootfs step. Adding ALTERNATIVE_LINK_NAME for both tools fix the issue. (From OE-Core rev: dc4099307100de817110958c9426ced4189fd0ac) Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e4d60408b869c9cc2ccff794d4e271d993ec8a97) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-systemctl: fix errors in instance name expansionYuta Hayama2023-08-011-1/+1
| | | | | | | | | | | | | | If the instance name indicated by %i begins with a number, the meaning of the replacement string "\\1{}".format(instance) is ambiguous. To indicate group number 1 regardless of the instance name, use "\g<1>". (From OE-Core rev: 70107f1bc33b45da794b7a24b7325eb476516fdf) Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d18b939fb08b37380ce95934da38e6522392621c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mdadm: re-add mdadm-ptest to PTESTS_SLOWOvidiu Panait2023-08-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ptest problems reported in e21021dc00ec ("mdadm: drop from PTESTS_SLOW") should now be fixed, so mdadm can be added back to PTESTS_SLOW (a qemux86-64 test run takes about ~12 minutes to execute with kvm). root@qemux86-64:~# ptest-runner mdadm START: ptest-runner 2023-06-30T08:25 BEGIN: /usr/lib/mdadm/ptest PASS: /usr/lib/mdadm/ptest/tests/00linear PASS: /usr/lib/mdadm/ptest/tests/00multipath ... PASS: /usr/lib/mdadm/ptest/tests/19repair-does-not-destroy PASS: /usr/lib/mdadm/ptest/tests/20raid5journal PASS: /usr/lib/mdadm/ptest/tests/21raid5cache DURATION: 723 END: /usr/lib/mdadm/ptest 2023-06-30T09:16 STOP: ptest-runner TOTAL: 1 FAIL: 0 For the testcases to run correctly, there must be enough rootfs space to create 13 loop devices. Similar to strace and lttng-tools, add a new IMAGE_ROOTFS_EXTRA_SPACE entry for mdadm-ptest. (From OE-Core rev: 174ef92965acd605e5aa5ed26afb3f8d556e98b2) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dfefff63c547adb1add0c8e3a308b2d0bd6cfc8c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ifupdown: install missing directoriesYi Zhao2023-07-201-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are four directories in which scripts can be placed which will always be run for any interface during certain phases of ifup and ifdown commands: /etc/network/if-pre-up.d/ /etc/network/if-up.d/ /etc/network/if-down.d/ /etc/network/if-post-down.d/ Even if there are no scripts in these directories, ifup and ifdown commands will also search these directories by using run-parts command. Install these directories to fix the following runtime errors: $ cat /etc/network/interfaces auto lo iface lo inet loopback $ ifdown lo ifdown: interface lo not configured $ ifup lo run-parts: failed to open directory /etc/network/if-up.d: No such file or directory ifup: failed to bring up lo (From OE-Core rev: c248473e2d60cfa67c64aa586b404119dec728ff) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 277bc7ab1fedd81f4df578e544ec381c819a10f9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxcrypt: fix hard-coded ".so" extensionEtienne Cordonnier2023-07-201-6/+0
| | | | | | | | | | | | | | | 2 issues: - the .so extension is hard-coded, and therefore the libxcryt package compiled with meta-darwin is empty, because the dylib files are not contained in FILES_${PN} - nothing actually produces a file libcrypt-*.so (the symlink file is libcrypt.so, without dash), thus defining FILES:${PN} manually to contain libcrypt-*.so has no effect. (From OE-Core rev: 06f8aaf8ee03b07f79e1a17708b5946782e389bd) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ed6bfa2428b4f1ba7f09d6e9e67c462ff355153) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: actually use API keysRoss Burton2023-07-131-11/+12
| | | | | | | | | | | | | | | There were vestigal remains of API key support which could be removed, but as using an API key - in theory - gives the user larger rate limits it's probably wise to expose it. If the user has an API key, then set NVDCVE_API_KEY. (From OE-Core rev: 64784e90c5ff559f4da6faadb970cc7aff549592) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a542de684282bfec79f24ae2f1a2027ffde319d8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: log a little moreRoss Burton2023-07-131-5/+7
| | | | | | | | | | | | | Add a note of what range we're fetching, and use bb.note() instead of debug() as messages about retrying shouldn't really be considered debug logging. (From OE-Core rev: cc82df9c0ff8ba17196b578e0182a5c726cfbbff) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b64a869b9c5e1d504f1011da16b5c5ff721afbf0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: increase retry countPeter Marko2023-07-131-1/+1
| | | | | | | | | | | | | | | | | Current 503 errors seem to last several seconds. In most cases there are two errors and third request succeeds. However sometimes the outage takes more than time needed for two retries and third one also fails. Extend retry count from 3 to 5 to improve the probablity that the fetcher succeeds. (From OE-Core rev: 5ca193e287c54bcb17f26e82e61e9446c21cd7e4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4d118af2360cff7f234102fd5e4b65a6f4146a6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: retry all errors and sleep between retriesPeter Marko2023-07-131-7/+4
| | | | | | | | | | | | | | | | | | | | Last couple days it is not possible to update NVD DB as servers are returning lot of errors. Mostly "HTTP Error 503: Service Unavailable" is observed but sporadially also some others. Retrying helps in most cases, so extend retries to all errors. Additionally add sleep which is recommended by NVD between requests. These retries are already implemented between successful requests, but giving servers time between failed ones is important, too. (From OE-Core rev: 75d2c50a10b8b506096b43a15bca3f06c6734e2f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 88dad8f198baa80af5ab576498f4df6ed639d551) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: fix cvssV3 metricsPeter Marko2023-07-131-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After upgrade to soon-to-be-released kirkstone 4.0.11 CVE annotations got broken. Anything which has only cvssV3 does not resolve properly. Fix the API fields used to extract it. i0.0 score is now at level of NVD DB 1.1. All CVEs with UNKNOWN vector are not present in NVD DB 1.1. NVD API 1.1: sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4776 LOCAL|32146 NETWORK|167746 PHYSICAL|185 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73331 1.8|7 1.9|3 ... NVD API 2.0 (broken): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4587 LOCAL|26273 NETWORK|150421 UNKNOWN|24644 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|205925 NVD API 2.0 (fixed): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|5090 LOCAL|32322 NETWORK|168004 PHYSICAL|213 UNKNOWN|511 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73841 1.8|7 1.9|3 ... (From OE-Core rev: babf20391305e514ddcd24be261b9b8487c8c767) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 61a5857efdcc0f49c69c0deb24fce99007aeef19) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: use exact times, don't truncateRoss Burton2023-07-131-2/+2
| | | | | | | | | | | | | | | When requesting updates in a specific range, use the actual current time and database mtime instead of truncating to midnight, and explicitly set the timezone to UTC so that NIST don't treat the timestamps as _their_ local time when they're _our_ local time. (From OE-Core rev: aa03556732b295fcf4bc2de11e3bc2e2b364580e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9aa0ec37f5f74252588d2494a71c71a7d8e68df9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: handle all configuration nodes, not just firstRoss Burton2023-07-131-4/+5
| | | | | | | | | | | | | | | | | Some CVEs, such as CVE-2013-6629, list multiple configurations which are vulnerable. The current JSON parser only considers the first configuration. Instead, consider every configuration. We don't yet handle the AND/OR logical operators, but this is a step in the right direction. (From OE-Core rev: a2d50c0fd1e1be869d8786b920f8b428a3292ed1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e1bf4f6dd686055fe9a8bdcc3f739eac2807bae0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to mickledore head revisionyocto-4.2.2mickledore-4.2.2Steve Sakoman2023-07-071-1/+1
| | | | | | (From OE-Core rev: 3ef283e02b0b91daf64c3a589e1f6bb68d4f5aa1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "systemd: fix a dead link under /var/log"Steve Sakoman2023-07-072-43/+0
| | | | | | | | | | Needs to go to master branch before stable branches. This reverts commit 7702dc8fc6c9b34647067ffabbc0e24d6109abe7. (From OE-Core rev: ac4c9f5aa967507d028caa3ee70f3fce580f9a09) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sysfsutils: fetch a supported fork from githubAlexander Kanavin2023-07-071-7/+3
| | | | | | | | | | | | | Debian does the same: https://packages.debian.org/source/sid/sysfsutils (From OE-Core rev: 0bf67fadffa24c00452acb25c58c1eb5648fe4c4) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 504b2f590cb94b217c5f48090cfb71a749bd5ac8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-networking: use correct error code in ptestTrevor Gamblin2023-07-071-1/+1
| | | | | | | | | | | | | | The eagain patch is currently using G_IO_ERROR_BUSY as part of the check to retry when the simul_read_thread test fails during ptests, but the actual error code is 27, which corresponds to G_IO_ERROR_WOULD_BLOCK. Change the check so that it looks for the right code. (From OE-Core rev: 669bb92fde575d3f9674b87044575873c3506df5) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8574fb1371e2d83c1c7ee58067c50319a62a22ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Do not use lld linker when building with tests on rv64Khem Raj2023-07-071-0/+2
| | | | | | | | | | | | | | lld ends up with errors on some tests | riscv64-yoe-linux-ld.lld: error: section size decrease is too large Therefore do not use lld when building ptests (From OE-Core rev: 23bcd0dbf3aeaff6b6914d347954bec22a133e23) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 154e81bb6b05b23c0c673b431cb7cee868421335) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: Pass linker choice via compiler flagsKhem Raj2023-07-041-1/+3
| | | | | | | | | | | | | | | | | | glibc configury tries to detect ld version and assumes BFD or gold linker but when system ld is pointing to lld or mold it might fail the linker check, therefore pass LD variable to explicitly point at ld.bfd we are using BFD linker only to link glibc after all. Second problem in such a case is that some partial objects are linked with CC -r which will fail if we do not inform the compiler to use BFD linker thusly pass it via appending to CC variable (From OE-Core rev: d1a9d11130b2e0ee4fac8665f0b4c63084d85a86) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 63248d2cbd7a15aec5b864d0058fe919eb17c46c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: fix a dead link under /var/logChangqing Li2023-07-042-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | Commit 6fe23ff31c0 changed README to a symlink to README.logs, and install README.logs under systemd doc dir. But for OE, systemd doc dir is splited into package systemd-doc, when it is not installed on the target, there will be an dead link: Eg: root@intel-x86-64:/var/log# ls -l README lrwxrwxrwx 1 root root 39 Jun 20 08:57 README -> ../../usr/share/doc/systemd/README.logs root@intel-x86-64:/var/log# ls -l ../../usr/share/doc/systemd/README.logs ls: cannot access '../../usr/share/doc/systemd/README.logs': No such file or directory Meantime, relative path for a symlink also will meet issue like "No such file or directory" Since OE have set ForwardToSyslog=yes, this README is not needed. So remove this symlink from package systemd (From OE-Core rev: 7702dc8fc6c9b34647067ffabbc0e24d6109abe7) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: upgrade 2.10.3 -> 2.10.4Wang Mingyu2023-07-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========== ### Security - [CVE-2023-29469] Hashing of empty dict strings isn't deterministic - [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType - schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK ### Regressions - SAX2: Ignore namespaces in HTML documents - io: Fix "buffer full" error with certain buffer sizes (From OE-Core rev: 5514070805c7c0f63fe8199832269b7857d5b8e4) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 9ddbbf2f86f046784c3baa58de5606a73e9e24f4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.37 branch updates.Deepthi Hemraj2023-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.37 stable branch are updated. 3593050c27 (HEAD -> release/2.37/master, origin/release/2.37/master) io: Fix F_GETLK, F_SETLK, and F_SETLKW for powerpc64 e2974d26ce io: Fix record locking contants on 32 bit arch with 64 bit default time_t 0e3e9dbb0e Document BZ #20975 fix f5d377c896 __check_pf: Add a cancellation cleanup handler [BZ #20975] b4f76ecc9e Ignore MAP_VARIABLE in tst-mman-consts.py 7c32cb7dd8 gmon: Revert addition of tunables to the manual a908c18d47 gmon: Revert addition of tunables to preserve GLIBC_PRIVATE ABI ff3a71ec1f gmon: fix memory corruption issues [BZ# 30101] d230623264 gmon: improve mcount overflow handling [BZ# 27576] 5d750495db gmon: Fix allocated buffer overflow (bug 29444) 78ab913eab posix: Fix system blocks SIGCHLD erroneously [BZ #30163] 9cc2f41e52 x86_64: Fix asm constraints in feraiseexcept (bug 30305) 97ad4c64b9 gshadow: Matching sgetsgent, sgetsgent_r ERANGE handling (bug 30151) 1d63573f81 stdio-common: tests: don't double-define _FORTIFY_SOURCE 590d0e089b elf: Restore ldconfig libc6 implicit soname logic [BZ #30125] 790e504a17 stdlib: Undo post review change to 16adc58e73f3 [BZ #27749] (From OE-Core rev: 8b0928acc22596614bc8a87ce57813cfc87c57de) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: upgrade 1.14.6 -> 1.14.8Xiangyu Chen2023-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update dbus to 1.14.8 to fix CVE-2023-34969 and serveral bugs changes: https://gitlab.freedesktop.org/dbus/dbus/-/blob/f90d4f16933ee5153fe02c405eb883c9cb8f0ad5/NEWS commits: 55d11f57 doc/dbus-api-design: fix wrong closing tag a96f417f CI: Run a detached pipeline for merge requests 9e0477fc CI: Only run for pushes to dbus 077f7e43 CI: Remove an obsolete workaround 07fe44f4 CI: Update Windows runners ec708d55 CI: Avoid using a no-op download location that gives a 403 error 45e6e93e dbus_message_iter_get_signature: Fix two memory leaks on OOM 0bb1942e dbus-internals: use `_DBUS_FUNCTION_NAME` in `_dbus_verbose()` 8df1b8be dbus-sysdeps-win: do not log function name twice 5c3a4e81 dbus-spawn-win: use `_DBUS_FUNCTION_NAME` instead of `__FUNCTION__` 8e457296 Update NEWS e1ffce17 Revert "CI: Remove an obsolete workaround" 40c0802f monitor test: Log the messages that we monitored a70c8f2f bus: Assign a serial number for messages from the driver 39b5c617 monitor test: Reproduce #457 f99e5de1 Update NEWS 21414587 AUTHORS: Update f90d4f16 Release v1.14.8 (From OE-Core rev: c1f21ec27cc7ac54040457c8591fdfedf25440bf) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-14 04:21:30 +0000