summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* python3-jinja2: upgrade 3.1.4 -> 3.1.6Soumya Sambu2025-04-281-1/+4
| | | | | | | | | | | | | Includes fix for - CVE-2024-56326, CVE-2025-27516, CVE-2024-56201 Changelog: https://github.com/pallets/jinja/blob/3.1.6/CHANGES.rst https://github.com/pallets/jinja/blob/3.1.5/CHANGES.rst (From OE-Core rev: a935ef8f205c9510ebc5539c133960bc72504902) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1182Ashish Sharma2025-04-282-0/+34
| | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b425859021d17adf62f06fb904797cf8642986ad] (From OE-Core rev: d27416eb05643afcd80435dd7ed27d6cd3d85650) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1181Ashish Sharma2025-04-193-0/+498
| | | | | | | | | | | | | | Import patches from ubuntu: Upstream-Status: Backport [ https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 && https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 Upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 ] (From OE-Core rev: abb575f6ac1f5badae2825f1cb6152379a6658ee) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1178 & CVE-2024-57360Ashish Sharma2025-04-193-0/+115
| | | | | | | | | | | | | Backport Fixes for: *CVE-2025-1178 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] *CVE-2024-57360 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=5f8987d3999edb26e757115fe87be55787d510b9] (From OE-Core rev: 15a7f68ce14f635acf9b988fc1958ee625de4e11) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-1176Ashish Sharma2025-04-192-0/+157
| | | | | | | | | | Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1176.patch?h=applied/ubuntu/jammy-security Upstream commit https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814] (From OE-Core rev: 8d02a680b415f3145f4a4ef71842f336d8e3513b) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-22871Hitendra Prajapati2025-04-162-0/+173
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/15e01a2e43ecb8c7e15ff7e9d62fe3f10dcac931 (From OE-Core rev: b343da566856ad17b5dc03d42d9241bcb44cad1b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-22870Archana Polampalli2025-04-162-0/+81
| | | | | | | | | | | | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. (From OE-Core rev: 88e79f915137edc5a37a110abdc79f5800404e45) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-cross-canadian: Set CVE_STATUS ignore for CVE-2024-43402Virendra Thakur2025-04-071-0/+4
| | | | | | | | | | | | | | | | This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 As per NVD, this CVE only affects to Windows platform Reference: https://git.yoctoproject.org/meta-lts-mixins/commit/?h=scarthgap/rust&id=13f045acf6388d1e320fd4c0f3ca19ca7a75ef44 (From OE-Core rev: ef2ba1f04f6f21530dc4efe5c4f61cbb0c76c032) Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2025-27220Divya Chellam2025-04-012-0/+79
| | | | | | | | | | | | | | | | In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27220 Upstream-patch: https://github.com/ruby/cgi/commit/cd1eb08076c8b8e310d4d553d427763f2577a1b6 (From OE-Core rev: 8c31f8e142894f103409ee10deccc22fdeea897c) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu 8.2.7: ignore CVE-2023-1386Madhu Marri2025-04-011-0/+2
| | | | | | | | | | | | | | | | | | | | Upstream Repository: https://gitlab.com/qemu-project/qemu.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1386 Type: Security Advisory CVE: CVE-2023-1386 Score: 3.3 Analysis: - According to redhat[1] this CVE has closed as not a bug. Reference: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2223985 (From OE-Core rev: 6a5d9e3821246c39ec57fa483802e1bb74fca724) Signed-off-by: Madhu Marri <madmarri@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nativesdk-libtool: sanitize the script, remove buildpathsDenys Dmytriyenko2025-03-263-14/+15
| | | | | | | | | | | | | | | | | | | Use the same sed command to sanitize libtool script for target recipe and nativesdk one. Otherwise fails with buildpaths QA error: ERROR: nativesdk-libtool-2.5.0-r0 do_package_qa: QA Issue: File /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/bin/libtool in package nativesdk-libtool contains reference to TMPDIR [buildpaths] (From OE-Core rev: f08df9adf290fb6cbebff24df6bbbbe8e5ce95e0) Upstream-Status: Backport[https://git.yoctoproject.org/poky/commit/?id=89e184da6c9d95a99fd34334df5ac6c5ae87f13a] (From OE-Core rev: a720df7ad77af1f8b1c00a211c88537e5f23edbc) Signed-off-by: Denys Dmytriyenko <denys@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 89e184da6c9d95a99fd34334df5ac6c5ae87f13a) Signed-off-by: Nikhil R <nikhilr5@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: unify cleanup of include-fixed, apply to cross-canadianDenys Dmytriyenko2025-03-264-31/+8
| | | | | | | | | | | | | | | | | | | | Since target and cross variants were already doing similar cleanup of include-fixed headers, as those aren't used, unify the code and also apply the same to cross-canadian variant. Some of those header files get processed with a tool that leaves absolute buildpaths inside the file's commented section, causing QA errors. Since those aren't used, let's remove them. This may be a temporary solution until the tool itself gets fixed to not embed absolute buildpaths in the header files: https://lists.openembedded.org/g/openembedded-core/topic/107268307 (From OE-Core rev: 621e0ac9308cc163fb767a27d63fff6570896b92) Signed-off-by: Denys Dmytriyenko <denys@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "gcc-cross-canadian.inc: Fix buildpaths error for pthread.h"Steve Sakoman2025-03-201-5/+0
| | | | | | | | | | | This patch is causing build failures where pthread.h does not exist: sed: can't read No such file or directory This reverts commit d3c294ee0afe4d2eb46320945d41064ebfb5cbff. Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-cross-canadian.inc: Fix buildpaths error for pthread.hSana Kazi2025-03-191-0/+5
| | | | | | | | | | | | | | | | | Replace the hardcoded path with /not/exist as used for other options[--with-sysroot] to ensure pthread.h does not contain hardocded references to TMPDIR: ERROR: gcc-cross-canadian-x86-64-13.3.0-r0 do_package_qa: QA Issue: File /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/ usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/13.3.0/include-fixed/ pthread.h in package gcc-cross-canadian-x86-64 contains reference to TMPDIR [buildpaths] (From OE-Core rev: d3c294ee0afe4d2eb46320945d41064ebfb5cbff) Signed-off-by: Sana Kazi <sanakazi720@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: remove paths to sysroot from configargs.h and checksum-options for ↵Oleksandr Hnatiuk2025-03-195-28/+29
| | | | | | | | | | | | | | | | | | | | | | | gcc-cross-canadian Apply fixes from gcc-cross (84a78f46d594 and 0ead8cbdfb96) to gcc-cross-canadian. This will improve (but not fix) reproducibility of gcc-cross-canadian. Also move this code to functions to avoid code duplication. [RP: Tweak patch to make the function parameters clear and fix quoting issues ensuring the code exactly matches the original replacements with an additional parameter.] (From OE-Core rev: 350ff7d53f7506de2bc01f0efc569b8294b9afea) (From OE-Core rev: b1aa13b9f656666458189d4dae0c25564abe2f25) Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com> Signed-off-by: Denys Dmytriyenko <denys@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f1ad5be4337c5d45c0f1bed48184336e9ab1fad8) Signed-off-by: Sana Kazi <sanakazi720@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: Fix CVE-2025-27219Ashish Sharma2025-03-152-0/+32
| | | | | | | | | Upstream-Status: Backport from [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab] (From OE-Core rev: 7e0a96b5c0b7a5ca593df83861086d0980ea72e9) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-0840Deepesh Varatharajan2025-03-082-0/+54
| | | | | | | | | | | | PR32560 stack-buffer-overflow at objdump disassemble_bytes Backport a patch from upstream to fix CVE-2025-0840 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893] (From OE-Core rev: 338a2a95eb9a99c8e56dfb1f6336497ddd654372) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix multiple CVEsHitendra Prajapati2025-03-054-0/+357
| | | | | | | | | | | | | Backport fixes for: * CVE-2025-1352 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 * CVE-2025-1365 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81 * CVE-2025-1372 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db (From OE-Core rev: 938676089fb5da383b7daf6c5e6348079ecf5674) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools-scm: respect GIT_CEILING_DIRECTORIESEtienne Cordonnier2025-02-282-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes https://bugzilla.yoctoproject.org/show_bug.cgi?id=15740 python3-setuptools-scm was ignoring GIT_CEILING_DIRECTORIES which is set by poky, and it was thus finding a wrong value of "toplevel" in ./src/setuptools_scm/_file_finders/git.py The code is supposed to generate the list of files contained in python3-setuptools-scm, but it was instead running "git archive" on whatever git repository was above the build directory, because the tarball containing the sources of python3-setuptools-scm does not contain a .git directory. This is barely noticeable when building as a subdirectory of poky which is only 48MB, but this was causing serious slowdowns of python3-setuptools-scm:do_compile when building inside a big git repository with files tracked using git-lfs (50 minutes in my use-case). Reported upstream as https://github.com/pypa/setuptools-scm/issues/1103 (From OE-Core rev: 4ebe72477484cf68165b6f736ce10373e97d0e6d) (From OE-Core rev: 369eebad4f38c3641be73dbc0490c87636e0912d) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* subversion: ignore CVE-2024-45720Peter Marko2025-02-211-0/+2
| | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45720 This CVE is relevant only for subversion running on Windows. (From OE-Core rev: 6a22c704c5236c7b893135dca53cc5d2b6f78e03) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Sofiane Hamam <sofiane.hamam@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Do not define sched_attr with glibc >= 2.41Khem Raj2025-02-142-0/+48
| | | | | | | | | | | | * backporting, because it's also needed also for qemu-native builds on hosts with glibc >= 2.41 (From OE-Core rev: d34b38ecc2571fae0d58a34db1358dff2505148d) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.11 -> 1.22.12Peter Marko2025-02-147-4/+4
| | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.11..go1.22.12 5817e65094 (tag: go1.22.12) [release-branch.go1.22] go1.22.12 0cc45e7ca6 [release-branch.go1.22] crypto/internal/fips140/nistec: make p256NegCond constant time on ppc64le c3c6a50095 [release-branch.go1.22] cmd/go/internal/modfetch: do not trust server to send all tags in shallow fetch e0a01acd04 [release-branch.go1.22] cmd/compile: fix write barrier coalescing Fixes CVE-2025-22866 [1] https://github.com/golang/go/compare/go1.22.11...go1.22.12 (From OE-Core rev: 423ad5a67768738dac454b1e2aa27746f74511c5) (From OE-Core rev: 9862cb44ad0f85eebbd9c7f6bcbf22df9cc10d0f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.8 -> 3.12.9Peter Marko2025-02-148-13/+67
| | | | | | | | | | | | | | | Release notes: https://docs.python.org/release/3.12.9/whatsnew/changelog.html#python-3-12-9 Solves CVE-2025-0938, CVE-2024-12254 and 3 other vulnerabilities without CVE number assigment. Add a patch to fix failure of a new test. (From OE-Core rev: 685b2719ae9b44c238e63942efabe52e5df7d640) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: remove redundant cargo config fileHarish Sadineni2025-02-121-14/+0
| | | | | | | | | | | | | YOCTO [#15061] The rust target and linker are getting setting from the sdk environment and so the config file is not needed. The redundant config file geneartion is removed. Backport from oe-core master: https://git.openembedded.org/openembedded-core/commit/?id=d5f78816d2ad0f3e43ce883eef199d1683cfcbb4 (From OE-Core rev: 12fd08cf4009d0284ab951cc48a479dcbc74db42) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: fix for rust multilib sdk configurationHarish Sadineni2025-02-123-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | YOCTO [#15061] The rust sdk installs both 'rust.sh' and 'cargo.sh' for lib32 and lib64 in the same location. This causes below error while installing the lib32 & lib64 binaries: Error: Transaction test error: file /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/environment-setup.d/cargo.sh conflicts between attempted installs of rust-cross-canadian-arm-1.67.1-r0.x86_64_nativesdk and rust-cross-canadian-aarch64-1.67.1-r0.x86_64_nativesdk file /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/environment-setup.d/rust.sh conflicts between attempted installs of rust-cross-canadian-arm-1.67.1-r0.x86_64_nativesdk and rust-cross-canadian-aarch64-1.67.1-r0.x86_64_nativesdk ERROR: Task (virtual:multilib:lib32:/media/build/poky/meta/recipes-sato/images/core-image-sato.bb:do_populate_sdk) failed with exit code '1' The change includes: - Prepending '${RUST_TARGET_SYS}' to 'rust.sh' to differentiate between target systems. - Moving the non-target-specific environment variables to 'nativesdk-cargo' and 'nativesdk-rust', instead of being managed by the cross-canadian recipe. Backport from oe-core master: https://git.openembedded.org/openembedded-core/commit/?id=40eb4bfe2f100ba5301046ca25110fcc55a640bb (From OE-Core rev: 889cda30baccd43e5c82b38752b462aef4ce626c) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pkg-config-native: pick additional search paths from ↵Alexander Kanavin2025-02-122-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | $EXTRA_NATIVE_PKGCONFIG_PATH This was prompted by working on librsvg update: the new meson-driven version wants to query values from .pc files residing in its own build directory, and modifies PKG_CONFIG_PATH accordingly. When using the pkg-config-native wrapper such modifications have no effect, and we have to pass them in manually from the recipe via EXTRA_NATIVE_PKGCONFIG_PATH variable. This variable is already defined (with an empty value) and appended to PKG_CONFIG_PATH export in the native class, so this simply extends its use to the wrapper. (Appending to PKG_CONFIG_PATH in the wrapper, instead of resetting it, is not an option as that can lead to contamination with the cross values). (From OE-Core rev: 2bc050146d47b14d890a1b0db2b55f9057a08b65) (From OE-Core rev: 104737073bd553b9cf93db7ed9575fd50ba6c973) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: File name too long causing failure to open temporary head file in ↵Jiaying Song2025-02-122-0/+209
| | | | | | | | | | | | | | | | | | | | | | | | | dlltool During the execution of the command: i686-w64-mingw32-dlltool --input-def $def_filepath --output-delaylib $filepath --dllname qemu.exe An error occurred: i686-w64-mingw32-dlltool: failed to open temporary head file: ..._w64_mingw32_nativesdk_qemu_8_2_2_build_plugins_libqemu_plugin_api_a_h.s Due to the path length exceeding the Linux system's file name length limit (NAME_MAX=255), the temporary file name generated by the i686-w64-mingw32-dlltool command becomes too long to open. To address this, a new temporary file name prefix is generated using tmp_prefix = prefix_encode ("d", getpid()), ensuring that the file name does not exceed the system's length limit. Allow for "snnnnn.o" suffix when testing against NAME_MAX, and tidy TMP_STUB handling by overwriting a prior nnnnn.o string rather than copying the entire name. (From OE-Core rev: 617df4ee1d6523ded43f156af8206dfca2c0c8ee) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: stable 2.42 branch updateDeepesh Varatharajan2025-02-121-1/+1
| | | | | | | | | | | | | | | Below commits on binutils-2.42 stable branch are updated. 758a2290dbd PR32387 ppc64 TLS optimization bug with -fno-plt code ed489bf1574 s390: Add arch15 Concurrent-Functions Facility insns 64e8e16a906 s390: Add arch15 instruction names Tested on qemux86_64. There were no additional PASS or FAIL after the update (From OE-Core rev: 6ce232df15834cae44f3eda0f786132086afb76e) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.10 -> 1.22.11Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.10..go1.22.11 f072884354 (tag: go1.22.11) [release-branch.go1.22] go1.22.11 b72d56f98d [release-branch.go1.22] net/http: persist header stripping across repeated redirects 19d2103415 [release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in URIs ae9996f965 [release-branch.go1.22] runtime: hold traceAcquire across casgstatus in injectglist 223260bc63 [release-branch.go1.22] crypto/tls: fix Config.Time in tests using expired certificates Fixes CVE-2024-45336 and CVE-2024-45341 [1] https://github.com/golang/go/compare/go1.22.10...go1.22.11 (From OE-Core rev: 4589986602319f9ed61e381b333bb53b731eb8d8) (From OE-Core rev: 35bf053cd41d53a764ef3a2de3e7cb1e6c81109f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.9 -> 1.22.10Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.9..go1.22.10 8f3f22eef8 (tag: go1.22.10) [release-branch.go1.22] go1.22.10 6d7a95abca [release-branch.go1.22] runtime: reserve 4kB for system stack on windows-386 6f05fa7a4f [release-branch.go1.22] syscall: mark SyscallN as noescape 3355db9690 [release-branch.go1.22] time: accept "+01" in TestLoadFixed on OpenBSD [1] https://github.com/golang/go/compare/go1.22.9...go1.22.10 (From OE-Core rev: e357c93b39df938dc36195dbd779a58b2951b8e6) (From OE-Core rev: 4d35279eed634f5e2b25c23dddbfb213c4943c30) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.8 -> 1.22.9Peter Marko2025-02-037-4/+4
| | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.8..go1.22.9 8af39d30a4 (tag: go1.22.9) [release-branch.go1.22] go1.22.9 c19e5887f4 [release-branch.go1.22] cmd/cgo/internal/testcarchive: remove 1-minute timeout e3fd4ba7f9 [release-branch.go1.22] cmd/link: generate Mach-O UUID when -B flag is specified 29252e4c5a [release-branch.go1.22] runtime: fix TestGdbAutotmpTypes on gdb version 15 [1] https://github.com/golang/go/compare/go1.22.8...go1.22.9 (From OE-Core rev: 4f2f202506bcefb4d6c46a11738e159e261a4a4b) (From OE-Core rev: a424422df978e267f21938bb290f35035e658d0a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: correctly link rust-snapshot into build/stage0Alexander Kanavin2025-01-263-42/+2
| | | | | | | | | | | | | | | | | | | | This does not seem to be used in regular builds, but is beneficial in rust selftest, where it allows dropping a custom patch that is unsuitable for upstream (and was rejected by them). Also remove an obsolete comment that seems related to the code but describes something that was resolved long time ago. I have confirmed that the rust selftest continues to pass with just this one commit on top of master (as the following changes do break the selftest). (From OE-Core rev: 9b23f995fbc1886c36f02b0c6e1ccaf2ee0f6daa) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bf5732e2b235ce06fa1f24fe8f0dbcbc068500e3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: use rust-snapshot binaries only in rust-nativeAlexander Kanavin2025-01-261-2/+12
| | | | | | | | | | | | | | | | | | | | | | Otherwise, use rust-native and cargo-native binaries as that allows our native tweaks in them to be used for target/nativesdk rust - same as for everything else written in rust. In particular, this allows building target rust with cargo-native that includes important reproducibility tweaks. Unfortunately, this also breaks rust selftest, and that is partially addressed by the following commit. [YOCTO #15185] (From OE-Core rev: d592bc02b0846411796c1d481c09833559d1d29f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8f2230cb51fe22ef4711a56fecfab4858c04e35b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: build the default set of toolsAlexander Kanavin2025-01-261-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | Setting it explicitly replaces rust's default choice which is rustdoc (needed for example in selftests and otherwise expected to be present in typical rust installations): https://github.com/rust-lang/rust/blob/master/config.example.toml#L320 This addresses some of the rust selftest failures but not all. Help is appreciate to restore the selftest. Unfortunately, this also breaks rust reproducibility (or rather exposes that it was never properly fixed, as explained here: https://lists.openembedded.org/g/openembedded-core/message/199288 ) (From OE-Core rev: 4d739fe248d1023eb2c3c040fc4d33273dd16bc1) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 58eaf2ee6c0809bf0a0d3c1d177e62bda7241651) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS"Steve Sakoman2025-01-261-5/+1
| | | | | | This reverts commit 136a25567499191b23a4d000a06bf83a473224ca. Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12747Archana Polampalli2025-01-252-0/+193
| | | | | | | | | | | | | | A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. (From OE-Core rev: e85beb88add5e94567d7221e00cabfb3d5010be7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12088Archana Polampalli2025-01-252-0/+142
| | | | | | | | | | | | A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. (From OE-Core rev: dad4a83c011310872cce07fc4141e66a98439cb1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12087Archana Polampalli2025-01-254-0/+123
| | | | | | | | | | | | | | | | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. (From OE-Core rev: c34cbef572e18c60bb7600fda370d6c46688c7b3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12086Archana Polampalli2025-01-255-0/+303
| | | | | | | | | | | | | | | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. (From OE-Core rev: 19f4e7bd965c63f19cc756e6e2bf8f58d9e1dc8d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12085Archana Polampalli2025-01-252-0/+33
| | | | | | | | | | | | A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. (From OE-Core rev: fb8439e856d5ea10d12180020a14442c3b101e56) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12084Archana Polampalli2025-01-253-0/+201
| | | | | | | | | | | | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. (From OE-Core rev: ad0e13912b17ca19ffbd7ea6a366f7c968517fb2) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libgfortran: fix buildpath QA issueChen Qi2025-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The '-fdebug-prefix-map' options are used to map source files locations, otherwise, DW_AT_comp_dir will contain buildpath. The '-gno-record-gcc-switches' option is used to fix the buildpath introduced by '-fintrinsic-modules-path' option, which is automatically added by fortran. Here's some output from 'readelf --debug-dump libgfortran.so.5.0.0' when this option is not added: """ <0><1a37d3>: Abbrev Number: 4 (DW_TAG_compile_unit) <1a37d4> DW_AT_producer : (indirect string, offset: 0xd653): GNU Fortran2008 14.2.0 -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse -mshstk -g -O2 -O2 -fstack-protector-strong -fimplicit-none -fno-repack-arrays -fno-underscoring -fcf-protection=full -fallow-leading-underscore -fbuilding-libgfortran -fPIC -fintrinsic-modules-path /ala-lpggp72/qichen/Yocto/builds/build-poky/tmp/work/ core2-64-poky-linux/libgfortran/14.2.0/recipe-sysroot-native/usr/bin/x86_64-poky-linux /../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/14.2.0/finclude -fpre-include=../../../../recipe-sysroot/usr/include/finclude/math-vector-fortran.h """ See https://gcc.gnu.org/pipermail/fortran/2024-October/061204.html for more detailed information. (From OE-Core rev: 660e00469f9c99fe733cc8b37f67438a96ff2e97) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architectureRoss Burton2025-01-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Using the package architecture to select the right qemu options to pass to qemu-user is incorrect, and fails for recipes that set PACKAGE_ARCH to MACHINE_ARCH (as the qemuppc workarounds suggest) because there are not typically any options set for the machine name. Solve this by using TUNE_PKGARCH instead: for the majority of recipes this is the same value, but for machine-specific recipes it remains the same instead of changing to the machine name. This means we can remove the qemuppc workarounds, as they're obsolete. Also update the gcc-testsuite recipe which uses the same pattern to use TUNE_PKGARCH, and generalise the else codepath to avoid needing to update the list of architectures. [ YOCTO #15647 ] (From OE-Core rev: 972ca555ff3aa41d32980477850c92915b6395ed) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 414b754a6cbb9cc354b1180efd5c3329568a2537) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-requests: upgrade 2.32.0 -> 2.32.3Soumya Sambu2025-01-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://requests.readthedocs.io/en/latest/community/updates/#release-history 2.32.3 (2024-05-29) * Bugfixes - Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716) * Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724) 2.32.2 (2024-05-21) * Deprecations - To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we’ve renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0. * A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710) 2.32.1 (2024-05-20) * Bugfixes - Add missing test certs to the sdist distributed on PyPI. https://github.com/psf/requests/compare/v2.32.0...v2.32.3 Also transition to using python_setuptools_build_meta. (From OE-Core rev: e1787271b07c605df2843d82d65e1c3d2e2114e6) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.7 -> 3.12.8Guðni Már Gilbert2025-01-0923-53/+53
| | | | | | | | | | Changelog: https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8 (From OE-Core rev: db5081254adacf6c87269fd43af7199267ad535c) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.6 -> 3.12.7Guðni Már Gilbert2025-01-0923-87/+65
| | | | | | | | | | Changelog: https://docs.python.org/release/3.12.7/whatsnew/changelog.html#python-3-12-7 (From OE-Core rev: 197048667f69ed559baf54831eb7b1606320f3e8) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: add reproducibility patch to eliminate host leakageAlexander Kanavin2024-12-232-0/+52
| | | | | | | | | | | | [YOCTO #15185] (From OE-Core rev: 01423828248b75e1f5afe2e5959ccd971df875cd) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 924df18b47e9a69fa295bafe37bdb39d8eaea2bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: add dependency on -compression to -coreRoss Burton2024-12-231-1/+1
| | | | | | | | | | | | | | | | importlib.metadata is part of -core, but that will import zipfile which is part of -compression. Obviously this shows that our packaging of the Python modules is not optimal. I plan to follow up with a redesign of the splitting which focuses on simply pulling out the larger or esoteric modules and having a more featureful core. (From OE-Core rev: 05166eafb99cf8c7adb6879277069ab384a2f8df) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Drop empty patchKhem Raj2024-12-232-27/+0
| | | | | | | | | | | The fix brought by this patch is already part of python 3.12.3 therefore drop it. (From OE-Core rev: 555623d2378138fdcfae95c04e06ba384cebab5b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix c++: tweak for Wrange-loop-constructSunil Dora2024-12-232-0/+114
| | | | | | | | | | | | | | | | | | | | This commit updates the warning to use a check for "trivially constructible" instead of "trivially copyable." The original check was incorrect, as "trivially copyable" only applies to types that can be copied trivially, whereas "trivially constructible" is the correct check for types that can be trivially default-constructed. This change ensures the warning is more accurate and aligns with the proper type traits. LLVM accepted a similar fix: https://github.com/llvm/llvm-project/issues/47355 PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731] (From OE-Core rev: 614a8e3a06003dfcbf1f32dc2d6f4d18f74b71a4) Signed-off-by: Marek Polacek <polacek@redhat.com> Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-28 00:24:45 +0000