summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* rust: add reproducibility patch to eliminate host leakageAlexander Kanavin2024-12-232-0/+52
| | | | | | | | | | | | [YOCTO #15185] (From OE-Core rev: 01423828248b75e1f5afe2e5959ccd971df875cd) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 924df18b47e9a69fa295bafe37bdb39d8eaea2bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: add dependency on -compression to -coreRoss Burton2024-12-231-1/+1
| | | | | | | | | | | | | | | | importlib.metadata is part of -core, but that will import zipfile which is part of -compression. Obviously this shows that our packaging of the Python modules is not optimal. I plan to follow up with a redesign of the splitting which focuses on simply pulling out the larger or esoteric modules and having a more featureful core. (From OE-Core rev: 05166eafb99cf8c7adb6879277069ab384a2f8df) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Drop empty patchKhem Raj2024-12-232-27/+0
| | | | | | | | | | | The fix brought by this patch is already part of python 3.12.3 therefore drop it. (From OE-Core rev: 555623d2378138fdcfae95c04e06ba384cebab5b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix c++: tweak for Wrange-loop-constructSunil Dora2024-12-232-0/+114
| | | | | | | | | | | | | | | | | | | | This commit updates the warning to use a check for "trivially constructible" instead of "trivially copyable." The original check was incorrect, as "trivially copyable" only applies to types that can be copied trivially, whereas "trivially constructible" is the correct check for types that can be trivially default-constructed. This change ensures the warning is more accurate and aligns with the proper type traits. LLVM accepted a similar fix: https://github.com/llvm/llvm-project/issues/47355 PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731] (From OE-Core rev: 614a8e3a06003dfcbf1f32dc2d6f4d18f74b71a4) Signed-off-by: Marek Polacek <polacek@redhat.com> Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* subversion: fix CVE-2024-46901Jiaying Song2024-12-232-1/+163
| | | | | | | | | | | | | | | | | | | | | | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected. References: https://nvd.nist.gov/vuln/detail/CVE-2024-46901 Upstream patches: https://subversion.apache.org/security/CVE-2024-46901-advisory.txt (From OE-Core rev: 16c212bd9a9e9c35256ff308da72a518c76ce11d) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2024-53589Yash Shinde2024-12-232-0/+93
| | | | | | | | | | | | | | | | A buffer overflow vulnerability exists in GNU Binutils’ objdump utility when processing tekhex format files. The vulnerability occurs in the Binary File Descriptor (BFD) library’s tekhex parser during format identification. Specifically, the issue manifests when attempting to read 8 bytes at an address that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read. Backport a patch from upstream to fix CVE-2024-53589. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] (From OE-Core rev: 15635eb807ea1cbf0fd04e0cbe9cf169df107a05) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dnf: drop python3-iniparse from DEPENDS and RDEPENDSGuðni Már Gilbert2024-12-131-2/+1
| | | | | | | | | | | | | | | python3-iniparse dependency was dropped 2019, see the following commit as reference: https://github.com/rpm-software-management/dnf/pull/1329/commits/d7d0e0e2f9d8c7d021c794821ad0b56a39ebc01f When looking at the Git history, this happened around tag 4.2.1 (From OE-Core rev: 3273ace1e5e4b0573ceaa44f2710f651db9ae525) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-poetry-core: drop python3-six from RDEPENDSGuðni Már Gilbert2024-12-131-1/+0
| | | | | | | | | | | | | | | | Looking at the history, python3-six was removed as a dependency in the poetry.lock file in v1.5.2 Even before v1.5.2 and until now (v1.9.1) there is no code in the package which imports the six module. So it can be safely dropped from the recipe. (From OE-Core rev: 09378088bba46b6e505f69381496da0ecd0ecf2c) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: set CVE-2024-6505 to fixedPeter Marko2024-12-131-0/+3
| | | | | | | | | | | | | | | | | CVE patch was removed on last upgrade as fixing commit was backported to stable 8.2.x branch. NVD DB has this CVE as version-less (with "-"). So explicit status set is needed to mark it as fixed. (From OE-Core rev: 64359ec3b60ae68d39c2e6444f903fd20e397cff) (From OE-Core rev: 33050bf82add43409675122a8f29acbcda4e8439) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ninja: fix build with python 3.13Markus Volk2024-12-062-1/+66
| | | | | | | | | | | python 3.13 removed the pipes module. Thus build fails for host machines that run python 3.13 This commit adds a backport patch to use subprocess module instead (From OE-Core rev: f357486da3374f7b49d6956260b5b3200f562e02) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: add a backport patch to fix an issue with tzdata 2024bMarkus Volk2024-12-062-0/+550
| | | | | | | | | | | | | There is an issue in the std::chrono::tzdb parser that causes problems since the tzdata-2024b release started using %z in the main format. As a real world problem I encounter an issue with the waybar clock module, which ignores the timezone setting and only shows system time. (From OE-Core rev: 05d05d9c199de6ec81d2ee9b06f0bff84a9144be) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: upgrade 8.2.3 -> 8.2.7Yogita Urade2024-12-0616-2550/+1
| | | | | | | | | | | | | | | | | This includes fix for: CVE-2024-4693, CVE-2024-6505 and CVE-2024-7730 General changelog for 8.2: https://wiki.qemu.org/ChangeLog/8.2 Droped: 0001-target-riscv-kvm-change-KVM_REG_RISCV_FP_F-to-u32.patch 0002-target-riscv-kvm-change-KVM_REG_RISCV_FP_D-to-u64.patch 0003-target-riscv-kvm-change-timer-regs-size-to-u64.patch CVE-2024-4467 and CVE-2024-7409 since already contained the fix. (From OE-Core rev: 7983ad282c37f8c1125da5bab96489e5d0039948) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-requests: upgrade 2.32.1 -> 2.32.2Soumya Sambu2024-12-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | https://requests.readthedocs.io/en/latest/community/updates/#id2 2.32.2 (2024-05-21) * Deprecations - To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we’ve renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0. * A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710) https://github.com/psf/requests/compare/v2.32.1...v2.32.2 (From OE-Core rev: 5b420f3526729809f11b187f48469a7a86d6a93a) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-urllib3: upgrade 2.2.1 -> 2.2.2Trevor Gamblin2024-12-061-1/+1
| | | | | | | | | | | | (From OE-Core rev: 32fdd5673c25084af4ba295b271455cd92ca09d5) (From OE-Core rev: ee42ec7146a7c3ceb25c1e0f5afee93849cf9143) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-zipp: fix CVE-2024-5569Jiaying Song2024-12-062-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp. References: https://nvd.nist.gov/vuln/detail/CVE-2024-5569 Upstream patches: https://github.com/jaraco/zipp/pull/120/commits/79a309fe54dc6b7934fb72e9f31bcb58f2e9f547 https://github.com/jaraco/zipp/pull/120/commits/564fcc10cdbfdaecdb33688e149827465931c9e0 https://github.com/jaraco/zipp/pull/120/commits/58115d2be968644ce71ce6bcc9b79826c82a1806 https://github.com/jaraco/zipp/pull/120/commits/c18417ed2953e181728a7dac07bff88a2190abf7 (From OE-Core rev: ec77cfe12f0790c7e3cf2d9bf00e47b4c653997c) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: reduce size of -dbg packageSteve Sakoman2024-11-261-0/+2
| | | | | | | | | | | | | | | | | Unless DEBUG_BUILD is enabled, pass -g1 to massively reduce the size of the debug symbols Level 1 produces minimal information, enough for making backtraces in parts of the program that you don't plan to debug. This includes descriptions of functions and external variables, and line number tables, but no information about local variables. This makes the sstate objects a lot more manageable, and packaging faster. (From OE-Core rev: dac630ab5ee7aa6c5c7c294093adbd11b116c765) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcl: skip io-13.6 test caseRoss Burton2024-11-261-0/+2
| | | | | | | | | | | | | | | | | | | | | ---- Result was: {abcdefghj 01234} 0 ---- Result should have been (exact matching): {abcdefghj } 1 01234 0 ==== io-13.6 FAILED This test is documented as failing on slow machines, so just skip it. [ YOCTO #15407 ] (From OE-Core rev: 2a44845ab1ca7d10e64d09fd5feb5becfc16aabe) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f69183586655294c9aed6687cebe57767c2f3eb8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* strace: download release tarballs from GitHubRoss Burton2024-11-261-2/+2
| | | | | | | | | | | | | Switch to downloading the release tarballs from GitHub. Their CDN is rock solid, and strace.io is hosted inside Russia which some networks are blocking. (From OE-Core rev: 0ed862a612af7a6389e68cdcb2e94bd005bf64c2) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bbdbd6d943a64e5b0dae4c2ee705d017fb7ef80e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: stable 2.42 branch updateDeepthi Hemraj2024-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | Below commits on binutils-2.42 stable branch are updated. 09ba78f0513 LoongArch: ld:Report an error when seeing an unrecognized relocation 00abcf39930 s390: Add arch15 instructions caf72067a77 s390: Relax risbg[n]z, risb{h|l}gz, {rns|ros|rxs}bgt operand constraints 543a22c7ee3 s390: Simplify (dis)assembly of insn operands with const bits 7c94c87d463 s390: Align opcodes to lower-case fffb4fae823 s390: Flag conditional branch relative insns as condjump 2d238ecbe50 s390: Use proper string lengths when parsing opcode table flags 10d0dd2ba2b s390: Whitespace fixes in conditional branch flavor descriptions 10a143e273c LoongArch: Add elfNN_loongarch_mkobject to initialize LoongArch tdata 9055fbe5ffb LoongArch: The symbol got type can only be obtained after initialization Tested on qemux86_64. There were no additional PASS or FAIL after the update (From OE-Core rev: 312c522787e72fffb9eb1b49e97aeaf24db27d2d) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml-parser-perl: fix do_fetch errorJiaying Song2024-11-181-1/+1
| | | | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: libxml-parser-perl-native-2.47-r0 do_fetch: Failed to fetch URL https://search.cpan.org/CPAN/modules/by-module/XML/XML-Parser-2.47.tar.gz, attempting MIRRORS if available (From OE-Core rev: c9d5a6c480c377399a7dc998f3755e42072e19a6) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Add missing perl modules to RDEPENDS for nativesdk variantHarish Sadineni2024-11-181-0/+4
| | | | | | | | | | | | | | | | | | In SDK, missing perl modules causes 'x86_64-pokysdk-linux-gp-display-html --help' to abort with below errors.. - Can't locate bignum.pm in @INC (you may need to install the feature module). - Can't locate Math/BigInt.pm in @INC (you may need to install the Math::BigInt module) By adding the following perl modules to RDEPENDS fixes the above errors: nativesdk-perl-module-bignum nativesdk-perl-module-bigint nativesdk-perl-module-math-bigint (patch taken to master branch with following commit id: 05f1099acbbb10b6ce33ea117d313749f7dc4a47) (From OE-Core rev: a1317e52260eed9961291d461e48a4915ffc36bc) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Fix envp bug and add posix_spawn wrapperRichard Purdie2024-11-181-1/+1
| | | | | | | | | | | | Fix pseudo with python 3.13 by adding a wrapper for posix_spawn and fixing a NULL pointer dereference in envp handling it uncovered. This fixes issues on Fedora 41. (From OE-Core rev: 782fc8c12deaf713a60c62c34914b585ff150ddf) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d80e20d70d170397f9827c5a5fc75ad1f2e8cd94) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Fix sporadic issues when determining compiler internalsPhilip Lorenz2024-11-182-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | When `-pipe` is enabled, GCC passes data between its different executables using pipes instead of temporary files. This leads to issues when cmake attempts to infer compiler internals via the `-v` parameter as each executable will print to `stderr` in parallel. In turn this may lead to compilation issues down the line as for example the system include directories could not be determined properly which may then propagate to issues such as: recipe-sysroot/usr/include/c++/11.3.0/cstdlib:75:15: fatal error: stdlib.h: No such file or directory | 75 | #include_next <stdlib.h> | | ^~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | WARNING: exit code 1 from a shell command. Fix this stripping `-pipe` from the command line used to determine compiler internals. (From OE-Core rev: ef5c060a939416b4034be1b8b81f9035b23534b7) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* e2fsprogs: removed 'sed -u' optionAditya Tayade2024-11-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | In embedded box, sed might be provided another providers like Busybox, hence use generic options whenever possible. /bin/sed -> /etc/alternatives/sed /etc/alternatives/sed -> /bin/busybox.nosuid Here used 'sed -u' option is not necessary, hence removed it. Fixes below error: sed: invalid option -- 'u' Also added 'set -eux' option which halts execution of the script on any failures. (From OE-Core rev: 5b3b290baa0a83f493b7ca25d5ffa5ff279bcc69) Signed-off-by: Aditya Tayade <Aditya.Tayade@kpit.com> Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-lxml=v5.0.2Martin Jansa2024-11-091-2/+1
| | | | | | | | | | | | | | | | * minor upgrade to fix building with gcc-14 on host * contains 31 commits: https://github.com/lxml/lxml/compare/lxml-5.0.0...lxml-5.0.2 the important one for gcc-14 is: https://github.com/lxml/lxml/commit/663041a56a075a8fa1e6ca13ba4c6d1de7043ac2 * https://bugs.launchpad.net/lxml/+bug/2045435 * https://bugs.gentoo.org/917562 (From OE-Core rev: baa0ba7084533907c0735dcb58b4432e0b3072df) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.7 -> 1.22.8Peter Marko2024-11-097-4/+4
| | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.7..go1.22.8 aeccd613c8 (tag: go1.22.8) [release-branch.go1.22] go1.22.8 b4086b7c16 [release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document 6fab4b9a9e [release-branch.go1.22] runtime: size maps.Clone destination bucket array safely 71655f14ce [release-branch.go1.22] cmd/cgo: correct padding required by alignment [1] https://github.com/golang/go/compare/go1.22.7...go1.22.8 (From OE-Core rev: 552b9913b25107d7a34611b499b7811896b5f098) (From OE-Core rev: f3bc0483519fcf08f5e3ccbbbb29de0ec4fc927e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.22.6 -> 1.22.7Peter Marko2024-11-097-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.6..go1.22.7 7529d09a11 (tag: go1.22.7) [release-branch.go1.22] go1.22.7 d4c53812e6 [release-branch.go1.22] go/build/constraint: add parsing limits 2092294f2b [release-branch.go1.22] encoding/gob: cover missed cases when checking ignore depth b232596139 [release-branch.go1.22] go/parser: track depth in nested element lists e87be9833e [release-branch.go1.22] runtime: on AIX, fix call to _cgo_sys_thread_create in _rt0_ppc64_aix_lib 676d6100d8 [release-branch.go1.22] cmd/fix: support go versions with patch release 0a525a3ed0 [release-branch.go1.22] os: fix Chtimes test flakes Fixes CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158 [1] https://github.com/golang/go/compare/go1.22.6...go1.22.7 (From OE-Core rev: 92d609c49c0870ca10fcc39d52a801109d65a98b) (From OE-Core rev: 4a0ccebab099b3654097ca6ba591eefce58a410e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* orc: upgrade 0.4.39 -> 0.4.40Wang Mingyu2024-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== - Security: Minor follow-up fixes for CVE-2024-40897 - powerpc: fix div255w which still used the inexact substitution - x86: work around old GCC versions (pre 9.0) having broken xgetbv implementations - x86: consider MSYS2/Cygwin as Windows for ABI purposes only - x86: handle unnatural and misaligned array pointers - orccodemem: Assorted memory mapping fixes - Fix include header use from C++ - Some compatibility fixes for Musl - ppc: Disable VSX and ISA 2.07 for Apple targets - ppc: Allow detection of ppc64 in Mac OS - x86: Fix non-C11 typedefs - meson: Fix detecting XSAVE on older AppleClang - x86: try fixing AVX detection again by adding check for XSAVE - Check return values of malloc() and realloc() (From OE-Core rev: a11152a65f27521ec9a546b4dd3c16d04bbd9db4) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ed7e4eb12491968c5f962b7e89d557c2c6d86a33) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-llvm: Fix CVE-2024-0151Deepthi Hemraj2024-11-092-1/+1088
| | | | | | | (From OE-Core rev: 175e22f2df542b0e1eb638c43c11eeefe794b0b7) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools: Add "python:setuptools" to CVE_PRODUCTShunsuke Tokumoto2024-10-301-0/+2
| | | | | | | | | | | | | | | Since there are vulnerabilities that cannot be detected by the existing CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT. https://nvd.nist.gov/vuln/detail/CVE-2013-1633 https://nvd.nist.gov/vuln/detail/CVE-2022-40897 (From OE-Core rev: 85b61bf9cefc024faefa083c37ce88ba9c7355e1) Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* makedevs: Fix matching uid/gidJaeyoon Jung2024-10-181-6/+6
| | | | | | | | | | | | | | Correct the length to compare in convert2guid() to fix an issue where it ends up with returning a wrong id that matches partially. Also fix the length of usr_buf and grp_buf in interpret_table_entry() which are used as arguments of convert2guid(). (From OE-Core rev: 865b7149da5dd6301c1d9805a1e7bac8dcac82a9) Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ca9d193a21e6b8669c4da1a68cd5e0791bb80a4b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: upgrade 3.2.2 -> 3.3.5Yogita Urade2024-10-1812-451/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes fix for CVE-2024-41123 & CVE-2024-41946 Release notes: https://github.com/ruby/ruby/releases/tag/v3_3_5 Rebase: 0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch 0006-Make-gemspecs-reproducible.patch Drop: 0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch 0002-Obey-LDFLAGS-for-the-link-of-libruby.patch CVE-2023-36617_1.patch CVE-2023-36617_2.patch CVE-2024-27281.patch CVE-2024-27282.patch (merged upstream) 0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch 0002-template-Makefile.in-filter-out-f-prefix-map.patch remove_has_include_macros.patch (code rewritten upstream) License-Update: Updated LEGAL section (From OE-Core rev: 69ffe5bc09260918fb32bfcb29586dcaa1958a5c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: ignore CVE-2024-43402Peter Marko2024-10-181-0/+1
| | | | | | | | | | | | This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 (From OE-Core rev: 6ed9968bf3e35aca316227ee23294c683f77055d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* makedevs: Fix issue when rootdir of / is givenJaeyoon Jung2024-10-021-9/+12
| | | | | | | | | | | | | | | Treating rootdir "/" as "" leads an error in parse_devtable(). Preserve it as it is given and use a separate variable for path name prepending. Another minor fix is to add a return statement at the end of convert2guid() to avoid an error with -Werror=return-type. (From OE-Core rev: 3d894863f442188bad446095bd7fdd82665bb54b) Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4d52e6276c687a8950bde21850072ddf14893fb2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rpm: fix expansion of %_libdir in macrosYi Zhao2024-10-022-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a patch in oe-core[1] to avoid hardcoded paths in macros. It tries to use libdir to expand %_libdir in macros.in. However, in upstream commit[2], libdir for macros in CMakeLists.txt is set to ${prefix}/=LIB=, which causes %_libdir to expand to ${prefix}/=LIB= instead of the correct path in the final macros. On target: $ rpm --showrc | grep _libdir [snip] -13: _libdir ${prefix}/=LIB= [snip] This also causes %__pkgconfig_path in fileattrs/pkgconfig.attr to become an invalid regular expression when building rpm packages. This results a warning in log.do_package_write_rpm in all packages: Warning: Ignoring invalid regular expression ^((${prefix}/=LIB=|usr/share)/pkgconfig/.*.pc|usr/bin/pkg-config)$ Set libdir to ${CMAKE_INSTALL_FULL_LIBDIR} instead of ${prefix}/=LIB= to make sure it is expanded to the correct path in macros. After the patch: On target: $ rpm --showrc | grep _libdir [snip] -13: _libdir /usr/lib [snip] [1] https://git.openembedded.org/openembedded-core/tree/meta/recipes-devtools/rpm/files/0001-Do-not-hardcode-lib-rpm-as-the-installation-path-for.patch [2] https://github.com/rpm-software-management/rpm/commit/d2abb7a48760418aacd7f17c8b64e39c25ca50c9 (From OE-Core rev: 7c7f95668d270a825c7d3d235ec2b8d4e7eb0b9f) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit ae0e217145f45d065124aeb0a7d72a0c25f621ef) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio, desktop-file-utils: correct freedesktop.org -> ↵Alexander Kanavin2024-10-021-1/+1
| | | | | | | | | | | | | www.freedesktop.org SRC_URI Server's https certificate isn't valid for freedesktop.org without www prefix. (From OE-Core rev: 60f411d19a9ea5297911eed64902e1cb65358e35) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d7ce9da33498869384b26a6fda05c37e7b2c3565) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: stable 2.42 branch updatesDeepesh Varatharajan2024-10-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on binutils-2.42 stable branch are updated. 8a6764d35e5 libctf: fix ref leak of names of newly-inserted non-root-visible types d9ddfab9be2 ld: Move foo before delete in dl5.cc 3e92ae5088c ld: Avoid folding new and delete pairs Results before updates as below: No. of expected passes 302 No. of unexpected failures 2 No. of untested testcases 1 No. of unsupported tests 7 Results after updates as below: No. of expected passes 302 No. of unexpected failures 2 No. of untested testcases 1 No. of unsupported tests 7 (From OE-Core rev: cfa318fd4a0a6bfa9899a366189ef6a75f000770) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix spurious '/' in GLIBC_DYNAMIC_LINKER on microblazeKhem Raj2024-09-251-3/+3
| | | | | | | | | | | | | (From OE-Core rev: d143981f78a85a4c5e057528f4bad7acefd46465) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Backport from master OE-Core rev: f0eac82b9a1e4549b7d918df768c369ed7ab5183 Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: back port patches to fix riscv64 build failureChen Qi2024-09-254-0/+258
| | | | | | | | | Backport patches to fix riscv64 build failure. (From OE-Core rev: ab7d0dcb49606651505bf167fd919bc969d97eed) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Upgrade 3.12.5 -> 3.12.6Peter Marko2024-09-254-285/+9
| | | | | | | | | | | | | | | | | | | | | Includes security fixes for CVE-2024-7592, CVE-2024-8088, CVE-2024-6232, CVE-2023-27043 and other bug fixes. Removed below patches, as the fix is included in 3.12.6 upgrade: 1. CVE-2024-7592.patch 2. CVE-2024-8088.patch Release Notes: https://www.python.org/downloads/release/python-3126/ (From OE-Core rev: aa492b1fd5973c37b8fa2cd17d28199eba46afcc) (From OE-Core rev: 6688a8ff2e1cbf6ad8ebd1b89ec6c929caf6a161) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: skip readline limited history testsTrevor Gamblin2024-09-252-0/+42
| | | | | | | | | | | | | | | | | Python 3.12.5 is failing a newer ptest for reading/writing limited history when editline (default) is set in PACKAGECONFIG. Skip it for now until a proper fix (if any) is determined. A bug has been opened upstream: https://github.com/python/cpython/issues/123018 (From OE-Core rev: de569ddffd5ea36b70c56df21dec9c892e5dee7d) (From OE-Core rev: 98b3a3e3f79a3edaa4cf2cfbf58eb84553d65e1e) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.12.4 -> 3.12.5Trevor Gamblin2024-09-251-1/+1
| | | | | | | | | | | | | | Changelog: https://docs.python.org/release/3.12.5/whatsnew/changelog.html (From OE-Core rev: d9e2ebd6b24b802d1d4cd38b3b910e068c308809) (From OE-Core rev: ae0e8f6932359959535e901e64bdb47189de14cd) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libedit: Make docs generation deterministicRichard Purdie2024-09-191-0/+7
| | | | | | | | | | | | The presence or lack of nroff on the host was changing the doc type. Stop the code from looking at host paths outside HOSTTOOLS and hence cause the doc type to be deterministic and reproducible. (From OE-Core rev: 343f40b0bc8ef65cc1e2abd6c9c33bb2e08bad3d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 918e2b266eba6779f19f65349f85caa880ba45e7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: Make docs generation deterministicRichard Purdie2024-09-191-0/+1
| | | | | | | | | | | The presence or lack of nroff on the host was changing the doc type. Set it explicitly to be deterministic and reproducible. (From OE-Core rev: 9ed723d1972b4e1bd1ae799661194ccbd4c6c759) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f5053abb8957acf358b518ee3c76146dc5f4eb6c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-maturin: Fix cross compilation issue for armv7l, mips64, ppcNiko Mauno2024-09-196-0/+438
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When bitbaking python3-rpds-py it built extension module as: site-packages/rpds/rpds.cpython-312-armv7l-linux-gnueabihf.so Which caused error on target: root@qemuarm:~# python3 -c "from rpds import HashTrieMap, HashTrieSet, List" Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python3.12/site-packages/rpds/__init__.py", line 1, in <module> from .rpds import * ModuleNotFoundError: No module named 'rpds.rpds' Where as it should have been: site-packages/rpds/rpds.cpython-312-arm-linux-gnueabihf.so Associated upstream bug report: https://github.com/PyO3/maturin/issues/2203 Associated upstream pull request: https://github.com/PyO3/maturin/pull/2204 Note - mitigation has not been tested with musl: https://github.com/PyO3/maturin/pull/2204#issuecomment-2323952320 (From OE-Core rev: 32a8a7379008cc6e367b7664c5b10b29f0bb8136) (From OE-Core rev: d2f73e3840c21997b918d1f1cfae965c618c1076) Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dejagnu: Fix LICENSENiko Mauno2024-09-191-1/+1
| | | | | | | | | | | | | | | | | The contents of the COPYING file included in the current source code package match those of GPL-3.0-only license, which seems to have been the case since 2008 commit http://git.savannah.gnu.org/gitweb/?p=dejagnu.git;a=commitdiff;h=9bebe7b9bfb9b02e5e4d86ad74e8ce3eb32a36b9;hp=50fbdd118dba066e201c73a8b0155381cd65a32d ("* COPYING: Update to GPL version 3.") (From OE-Core rev: 26b71cfb7815a096c5962629801cc3bc85147284) (From OE-Core rev: 718f6cb5ecf33529efb126f9eda67041f42bd7bf) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libdnf: upgrade 0.73.1 -> 0.73.2Wang Mingyu2024-09-091-1/+1
| | | | | | | | | | | | | | | | | | Changelog: ========== - context: use rpmtsAddReinstallElement() when doing a reinstall - MergedTransaction: Fix invalid memory access when dropping items - ConfigParser: fix use-out-of-scope leaks - Since we use rpmtsAddReinstallElement rpm also uninstalls the package - Fix countme bucket calculation (From OE-Core rev: 20b67ad71cfa3eac35b2514067f87d79d9c3da2e) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9cf8330068503a5721640763309c4c74f293a94d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Fix CVE-2024-8088Soumya Sambu2024-09-092-0/+129
| | | | | | | | | | | | | | | | | | | | | There is a HIGH severity vulnerability affecting the CPython "zipfile" module. When iterating over names of entries in a zip archive (for example, methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. References: https://nvd.nist.gov/vuln/detail/CVE-2024-8088 Upstream-Patch: https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec (From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Fix CVE-2024-7592Soumya Sambu2024-09-092-0/+144
| | | | | | | | | | | | | | | | | | | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. References: https://nvd.nist.gov/vuln/detail/CVE-2024-7592 Upstream-Patch: https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1 (From OE-Core rev: 3bb9684eef5227e7b1280ee9051884310b0d0b7f) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools: Fix CVE-2024-6345Soumya Sambu2024-09-092-1/+315
| | | | | | | | | | | | | | | | | | | A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. References: https://nvd.nist.gov/vuln/detail/CVE-2024-6345 Upstream-patch: https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 (From OE-Core rev: 468c5a4e12b9d38768b00151c55fd27b2b504f3b) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-23 10:49:14 +0000