summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.13scarthgap-5.0.13Steve Sakoman2025-10-131-1/+1
| | | | | | (From OE-Core rev: 7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main serverSteve Sakoman2025-10-131-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: b0ce480eca6397fab71082ed202c3cf9dd02456f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/cases/meta_ide.py: use use gnu mirror instead of main serverSteve Sakoman2025-10-131-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: aa7ff5a115f55c092f8ca5badad63734c8f4f5b7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* conf/bitbake.conf: use gnu mirror instead of main serverGyorgy Sarvari2025-10-131-1/+1
| | | | | | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html . (From OE-Core rev: ef14bcae0f3f27acdd4e591fac69515aa912f194) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d8c6f01d7467e018aa0ed27a87850d9e4434a47a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.2.4 -> 3.2.6Peter Marko2025-10-133-2050/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can upgrade now. We can also drop CVE-2025-27587 patch which was taken instead of 3.2.5 upgrade under: https://github.com/openssl/openssl/pull/28198 Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025 OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate. This release incorporates the following bug fixes and mitigations: * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) * Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231) * Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025 OpenSSL 3.2.5 is a bug fix release. This release incorporates the following bug fixes and mitigations: * Miscellaneous minor bug fixes. (From OE-Core rev: ef6bbf39c10ff7bd8ad36d5d2f59ddd0756e0141) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-47906Archana Polampalli2025-10-132-0/+184
| | | | | | | | | | | | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. (From OE-Core rev: ed6df1883225ec08e637a0d7a15a6a5da4665d8d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: ignore 8 CVEs fixed in 6.1.1 and 6.1.3 releasesPeter Marko2025-10-131-0/+4
| | | | | | | | | | | | | | | Following are mentioned in commit upgrading the recipe to 6.1.3: * CVE-2023-49502 CVE-2023-50007 CVE-2023-50008 CVE-2024-31578 CVE-2024-31582 Following are fixed via mentioned commits already in 6.1.1: * CVE-2023-50009: https://github.com/FFmpeg/FFmpeg/commit/162b4c60c8f72be2e93b759f3b1e14652b70b3ba * CVE-2023-50010: https://github.com/FFmpeg/FFmpeg/commit/e809c23786fe297797198a7b9f5d3392d581daf1 * CVE-2024-31585: https://github.com/FFmpeg/FFmpeg/commit/3061bf668feffc7c1f0b244205167b3b86da8015 (From OE-Core rev: 8286570b3baf275ff48c45ca0864348a8d3faa01) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: ignore 5 CVEsPeter Marko2025-10-131-0/+4
| | | | | | | | | | | | | These CVEs are for tools which were removed in v4.6.0 via [1] and re-introduced again in v4.7.0 via [2]. [1] https://gitlab.com/libtiff/libtiff/-/commit/eab89a627f0a65e9a1a47c4b30b4802c80b1ac45 [2] https://gitlab.com/libtiff/libtiff/-/commit/9ab54a858049bef020d578c71d82669531551c00 (From OE-Core rev: faf1e12ae0f9de56402830460315e5be0d13f4a5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: ignore CVE-2024-11586Ross Burton2025-10-131-0/+2
| | | | | | | | | | | | | | | | | As per the linked ticket, this issue is related to an Ubuntu-specific patch that we don't have. (From OE-Core rev: dc81fdc6bdf8ab39b7f2fd994d50256430c36558) (From OE-Core rev: 72e63e44a0c6ad5a408c4dc59a24288c36463439) (From OE-Core rev: 4cdcb27238be40e815ce5a0b67ce419331079801) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expat: follow-up for CVE-2024-8176Peter Marko2025-10-134-0/+231
| | | | | | | | | | | | | Expat release 2.7.3 implemented a follow-up for this CVE. References: * https://github.com/libexpat/libexpat/blob/R_2_7_3/expat/Changes * https://security-tracker.debian.org/tracker/CVE-2024-8176 * https://github.com/libexpat/libexpat/pull/1059 (From OE-Core rev: 5bbb9ee52674f5aa6eed5d6cf3f515704092994d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59800Peter Marko2025-10-132-0/+37
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: a63bb2ccc8294c8a97f5957f1ca9f0a4880713ac) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59799Peter Marko2025-10-132-0/+42
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: 2f1d5b9ad1af6d2b28e9e7b46aadd879a67b8fc6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59798Peter Marko2025-10-132-0/+135
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: 4a2f47d9541d7a13da7a9ce16bd5088870c45ec4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: ignore CVE-2025-2759Peter Marko2025-10-131-0/+2
| | | | | | | | | | | | | | | | Copy statement from [1] that it is problem of installers (non-Linux). Also [2] linked in NVD says "Fixed in 1.25.1 Gstreamer Installer". Since Yocto builds from sources into our own packages, ignore it. [1] https://security-tracker.debian.org/tracker/CVE-2025-2759 [2] https://www.zerodayinitiative.com/advisories/ZDI-25-268/ (From OE-Core rev: 99ee1df6bde2ffd4fa2ddea44c0a9b94d9d77bae) (From OE-Core rev: 7937625a30f6046ba483a000497b15169659f5eb) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: ignore CVEs fixed in pluginsPeter Marko2025-10-131-4/+13
| | | | | | | | | All these CVEs were fixed in recent commits. (From OE-Core rev: c5a68886247d4417de4ecaa8460e25e84ab93b0d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub2: mark CVE-2024-2312 as not applicableHitendra Prajapati2025-10-131-0/+1
| | | | | | | | | | | | This issue is specific to the peimage module that Ubuntu add, and is not an upstream issue. (From OE-Core rev: 8d2fe3f403e6435e1ffe122a6776381090752d8a) (From OE-Core rev: d005eda88dad37f31bdc59e45e20b209f3771a26) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: patch CVE-2025-46394Peter Marko2025-10-133-0/+91
| | | | | | | | | | Pick commit mentioning this CVE. Additionally fix test broken by the CVE fix. (From OE-Core rev: e348e10f35cc082ebfe22c890c5f64c4a06dcea3) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: fix native build with GCC 15Adrian Freihofer2025-10-091-1/+1
| | | | | | | | | | | | | | | | | | | | This does not work for native builds: CFLAGS += "-std=gnu17" The line from native.bbclass gets priority: CFLAGS = "${BUILD_CFLAGS}" From bitbake-getvar -r expect-native CFLAGS ... append ...poky/meta/recipes-devtools/expect/expect_5.45.4.bb:44 "-std=gnu17" set ...poky/meta/classes-recipe/native.bbclass:44 "${BUILD_CFLAGS}" ... (From OE-Core rev: 2696c50af9946f425ccaf7d0e7e0eb3fd87c36bb) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: Fix build with GCC 15Khem Raj2025-10-091-0/+2
| | | | | | | | | | Stick to C17 standard as GCC 15 switches to C23 (From OE-Core rev: a1ac756f2f55c4f27a95cb8b1e63ee2db06dd327) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: cleanup do_installRoss Burton2025-10-091-6/+3
| | | | | | | | | | | | | | Clean up the do_install append, and remove a long-standing unused variable that appears to be intending to not install the scripts but would have never actually done that as the relevant override since 2008 has been task-install. As we've been installing the scripts, keep instaling them. (From OE-Core rev: 10a501b3bfe8f73ce2eb15673900df71e547b54d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: don't run aclocal in do_configureRoss Burton2025-10-091-0/+2
| | | | | | | | | | | | | | expect has a hand-maintained aclocal.m4 so don't run aclocal, which has the side effect of not deleting the aclocal.m4 file which pulls in macros. The build works without this change more through luck and a combination of behaviours than design. (From OE-Core rev: 61dbfd66210b090ec8abfbf1f4688e5691299d68) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: update code for Tcl channel implementationRoss Burton2025-10-092-4/+28
| | | | | | | | | | | | | Tcl 8.4.0 changed the channel implementation, take a patch submitted upstream to update the code for the new interface and remove the silencing of the incompatible assignment error which was due to this issue. (From OE-Core rev: 20cadf7b66f30e8a3b409b4a96eced614ac21013) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expect: Revert "expect-native: fix do_compile failure with gcc-14"Adrian Freihofer2025-10-091-1/+1
| | | | | | | | | | | | | | In the meantime there is a cleaner fix on the master branch and we also need to back-port more patches to support gcc-15 as well. This reverts commit 8bfdb53247c917559e7813c2e1bd2f6eb13c811d which is not in the master branch as a preparation for cherry-picking the newer fixes from there. (From OE-Core rev: 4ea89ba363228aa5e16412f85644608f4c645d5f) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: Fix CVE-2025-3887Vijay Anusuri2025-10-093-0/+147
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5463f0e09768ca90aa8c58357c1f4c645db580db & https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bcaab3609805ea10fb3d9ac0c9d947b4c3563948 (From OE-Core rev: 7ef632c2a85e42c16b5509edec822705a236cafb) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-9900Yogita Urade2025-10-092-0/+55
| | | | | | | | | | | | | | | | | | | | | A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.[EOL][EOL]By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9900 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/3e0dcf0ec651638b2bd849b2e6f3124b36890d99 (From OE-Core rev: c1303b8eb4e85a031a175867361876a256bfb763) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1652 -> 9.1.1683Divya Chellam2025-09-301-2/+2
| | | | | | | | | | | | | Handles CVE-2025-9389 Changes between 9.1.1652 -> 9.1.1683 ==================================== https://github.com/vim/vim/compare/v9.1.1652...v9.1.1683 (From OE-Core rev: 55e0c38dc28b73fa689446e2d5e564d235a24084) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* util-linux: use ${B} instead of ${WORKDIR}/build, to fix building under devtoolChris Laplante2025-09-301-1/+1
| | | | | | | | | | | | This change already exists on master, but it was made as part of the larger migration to ${UNPACKDIR} and is not cherry-pickable. See: d73595df696 (recipes: Update WORKDIR references to UNPACKDIR) (From OE-Core rev: 378f87f087651bacdb6efc6b98168bc6ba865070) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* examples: genl: fix wrong attribute sizeNitin Wankhade2025-09-302-1/+48
| | | | | | | | | | | | | | | | | | | | | | | This example no longer works on more recent kernels: genl-family-get error: Invalid argument dmesg says: netlink: 'genl-family-get': attribute type 1 has an invalid length. Fix this and also zero out the reserved field in the genl header, while not validated yet for dumps this could change. Upstream-Status: Backport [https://git.netfilter.org/libmnl/patch/?id=54dea548d796653534645c6e3c8577eaf7d77411] Reported-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> (From OE-Core rev: bae5ecea1c40847ffc3760173192f85e28ed9d7b) Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit 54dea548d796653534645c6e3c8577eaf7d77411) Signed-off-by: Divyanshu Rathore <divyanshu.rathore@bmwtechworks.in> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* p11-kit: backport fix for handle USE_NLS from masterAshishKumar Mishra2025-09-301-0/+1
| | | | | | | | | | | | | | | | | | | Disable NLS in the build when USE_NLS is off. (From OE-Core rev: b94798ecd535956ef4565663710ea9a701ff21ed) This change corresponds to upstream eeb3974472429a99a724f324dc8a63e435741f68 from master . Since the p11-kit version are different between master & scarthgap applied the patch manually (From OE-Core rev: 96602ea67463170c4cadf748525f5615ce9bbd91) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* shared-mime-info: Handle USE_NLSPhilip Lorenz2025-09-301-1/+4
| | | | | | | | | | | | | | Skip building of translations when NLS is disabled. (From OE-Core rev: b58a3f4e9c78522423a94821b7ba7a35eb18f75a) (From OE-Core rev: 49a9aebc0e9f668cf2896d0b522f8194bb4049ad) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: backport fix for handle USE_NLS from masterAshishKumar Mishra2025-09-301-0/+1
| | | | | | | | | | | | | | | | | | Do not build translations when NLS is disabled. (From OE-Core rev: 83795ef6c3fa12a863cd20b7ec1a2607606987b6) This change corresponds to upstream d848b454e64ffbd642590b4bbc378619e1547ad3 from master . Since the systemd version are different between master & scarthgap applied the patch manually (From OE-Core rev: 780b902a0fd124420f00ee5e55f4fd362d2d8913) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib/oe/utils: use multiprocessing from bbMartin Jansa2025-09-301-1/+2
| | | | | | | | | | | | | | | | | | Fixes build with python-3.14 It was added to bitbake in 62be9113d98fccb347c6aa0a10d5c4ee2857f8b6 and oe-core now requires latest bitbake already, so we can use this. [YOCTO #15858] (From OE-Core rev: 92369c8acf0b4d6c2ced88abbda5f5defd276ba2) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sanity.conf: Update minimum bitbake version to 2.8.1Martin Jansa2025-09-301-1/+1
| | | | | | | | | | | | Needed for multiprocessing module in bb used in the next commit. It was added to bitbake in 62be9113d98fccb347c6aa0a10d5c4ee2857f8b6 which was backported to 2.8 branch and tagged as 2.8.1 (From OE-Core rev: 95888aa944847cf6dbfac501997a3e2980344b66) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: fix build with gcc-15Adrian Freihofer2025-09-304-0/+86
| | | | | | | | | | | | | | Pick 3 patches from meta-clang's scartsgap branch to fix build with gcc-15. These patches are already in upstream llvm but not in 18.1.8 release. Note: the patch 0039-Fix-build-with-GCC-15.patch from meta-clang is not needed as it targets lldb which we do not build. (From OE-Core rev: a2c5e1d6ec6c905bbf31f017a010b0496b39b211) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: update from 18.1.6 to 18.1.8Adrian Freihofer2025-09-301-1/+1
| | | | | | | (From OE-Core rev: 3a171fde7d5cb0c2dfb6d1b11f08b061826284c2) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2025-9086Yogita Urade2025-09-302-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1, A cookie is set using the secure keyword for https://target 2, curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3, The same cookie name is set - but with just a slash as path (path="/"). Since this site is not secure, the cookie should just be ignored. 4, A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9086 Upstream patch: https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6 (From OE-Core rev: b0cc7001a628deaa96d1aebb5ded52797898a0be) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: apply patch for CVE-2025-7424Ross Burton2025-09-302-1/+105
| | | | | | | | | | | | | This patch is taken from the upstream bug, and is used by Apple in their build of WebKit. (From OE-Core rev: f59e07fd9f6c437e30431607763672fde42511ad) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* buildtools-tarball: fix unbound variable issues under 'set -u'Haixiao Yan2025-09-224-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | | When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* license.py: avoid deprecated ast.StrMartin Jansa2025-09-221-2/+2
| | | | | | | | | | | | | | | | | | | | | * it's deprecated since python-3.12 and removed in 3.14 causing: openembedded-core/meta/lib/oe/license.py', lineno: 176, function: visit 0172: 0173: LicenseVisitor.__init__(self) 0174: 0175: def visit(self, node): *** 0176: if isinstance(node, ast.Str): 0177: lic = node.s 0178: 0179: if license_ok(self._canonical_license(self._d, lic), 0180: self._dont_want_licenses) == True: Exception: AttributeError: module 'ast' has no attribute 'Str' (From OE-Core rev: df9898f13c261eeac2cc343569c843bc7dcaf163) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemtap: Fix task_work_cancel buildJinfeng Wang2025-09-222-0/+104
| | | | | | | | | | | | | | | | | | | | Backport a patch to fix: 107 | twork = task_work_cancel(task, func); | ^~~~ | | | task_work_func_t {aka void (*)(struct callback_head *)} /work/rad/wrs/wrl-systemtap-demo/qemux86-64-std-23p17/build/tmp-glibc/work/x86_64-linux/systemtap-native/4.8-r0/recipe-sysroot-native/usr/share/systemtap/runtime/stp_task_work.c:107:40: note: expected 'struct callback_head *' but argument is of type 'task_work_func_t' {aka 'void (*)(struct callback_head *)'} /work/rad/wrs/wrl-systemtap-demo/qemux86-64-std-23p17/build/tmp-glibc/work/x86_64-linux/systemtap-native/4.8-r0/recipe-sysroot-native/usr/share/systemtap/runtime/stp_task_work.c:13:26: error: incompatible types when assigning to type 'struct callback_head *' from type 'bool' {aka '_Bool'} 13 | #define task_work_cancel (* (task_work_cancel_fn)kallsyms_task_work_cancel) | ^ /work/rad/wrs/wrl-systemtap-demo/qemux86-64-std-23p17/build/tmp-glibc/work/x86_64-linux/systemtap-native/4.8-r0/recipe-sysroot-native/usr/share/systemtap/runtime/stp_task_work.c:107:17: note: in expansion of macro 'task_work_cancel' 107 | twork = task_work_cancel(task, func); | ^~~~~~~~~~~~~~~~ (From OE-Core rev: 58509b54a464cd5b692ad4ef8dd333eb9c14abfa) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: Fix for CVE-2025-58060 and CVE-2025-58364Vijay Anusuri2025-09-223-0/+123
| | | | | | | | | | | Upstream-Status: Backport from https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 & https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d (From OE-Core rev: 6f3b7e6efdf14d080b74a48d8cdc445255e9025f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: upgrade 2.4.10 -> 2.4.11Vijay Anusuri2025-09-2211-647/+9
| | | | | | | | | | | | | | | | | | | Removed CVE-2024-47175 patches which is fixed by upgrade system-cups.slice added to FILES Changelog ========== v2.4.11 CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes. Detailed list of changes is available in CHANGES.md (From OE-Core rev: 117a401756a3cf26d1fc0a6694b0c42967e00fec) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub2: fix CVE-2024-56738Ross Burton2025-09-222-0/+76
| | | | | | | | | | | | | | | Backport an algorithmic change to grub_crypto_memcmp() so that it completes in constant time and thus isn't susceptible to side-channel attacks. (From OE-Core rev: 319210be147ec57518c237cb705857aeda9943e6) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 30a1cc225a2bd5d044bf608d863a67df3f9c03be) Signed-off-by: Shubham Pushpkar <spushpka@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: fix CVE-2022-37660Divya Chellam2025-09-226-0/+1679
| | | | | | | | | | | | | | | | | | | | | | | | | | | In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 91848ac13ec18f98469f7f8ed68c6153fea31607) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: Add audio group explicitlyKyungjik Min2025-09-091-1/+1
| | | | | | | | | | | | | | | | | | | Since pulseaudio-server requires the audio group, we explicitly add it. When use useradd-staticids or do not use the default group in base-passwd, an error will occur because the audio group is not defined. NOTE: pulseaudio: Performing useradd with [--root TOPDIR/tmp/work/cortexa72-poky-linux/pulseaudio/17.0/recipe-sysroot --home-dir /var/run/pulse --gid 998 --groups audio,pulse --no-create-home --system --shell /bin/false --uid 998 pulse] useradd: group 'audio' does not exist ERROR: pulseaudio: useradd command did not succeed. (From OE-Core rev: baa5e7ea5f37f54c2a00080798ad7fb4c0664f69) Signed-off-by: Kyungjik Min <dpmin7@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issueDeepak Rathore2025-09-092-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default CONNECTIVITY_CHECK_URIS uses "https://yoctoproject.org/connectivity.html" which redirect to "https://www.yoctoproject.org/connectivity.html". Some network configurations with proxies or restricted internet access don't handle HTTP redirects properly during the sanity check phase, causing build failures with: ERROR: OE-core's config sanity checker detected a potential misconfiguration. Either fix the cause of this error or at your own risk disable the checker (see sanity.conf). Following is the list of potential problems / advisories: Fetcher failure for URL: 'https://yoctoproject.org/connectivity.html'. URL doesn't work. Updated the default URL to use the final destination directly to avoid redirect-related connectivity check failures. Also updated SDK test cases in https.py to use the corrected URL for consistency. (From OE-Core rev: bd624ebbcf4e6d7a24c4ab232ca2e138b1ac3433) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60cdf960a3560f391babd559737f1afb31fb2c5c) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rpm: keep leading `/' from sed operationHongxu Jia2025-09-091-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For /usr/lib/rpm/macros, Yocto explicitly set OECMAKE_FIND_ROOT_PATH_MODE_PROGRAM = "ONLY" [1][2] to search tools from CMAKE_FIND_ROOT_PATH [5] which locates in native recipe sysroot or HOSTTOOLS_DIR. If found in native recipe sysroot or HOSTTOOLS_DIR, the sed operation removed leading `/' root@qemux86-64:~# vi /usr/lib/rpm/macros ... %__xz usr/bin/xz %__make usr/bin/make %__zstd usr/bin/zstd %__quilt usr/bin/quilt %__patch usr/bin/patch ... root@qemux86-64:~# rpm --eval "%{__xz} %{__make} %{__zstd} %{__quilt} %{__patch}" usr/bin/xz usr/bin/make usr/bin/zstd usr/bin/quilt usr/bin/patch This commit keeps leading `/' from sed operation, and similar reason for /usr/lib/cmake/rpm/rpm-targets.cmake After applying this commit: root@qemux86-64:~# rpm --eval "%{__xz} %{__make} %{__zstd} %{__quilt} %{__patch}" /usr/bin/xz /usr/bin/make /usr/bin/zstd /usr/bin/quilt /usr/bin/patch [1] https://git.openembedded.org/openembedded-core/commit/?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3 [2] https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_ROOT_PATH_MODE_PROGRAM.html (From OE-Core rev: cab720b5508411f9a63025e2765d4d46914a1404) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0d0773879ab9520c475c4a8c930b2e663de0e032) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: fix CVE-2024-10963Stanislav Vovk2025-09-092-0/+266
| | | | | | | | | Upstream-Status: Backport from https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628 (From OE-Core rev: 2be498fd0872d7ccbf0e9b2eb0a1d4879823c968) Signed-off-by: Stanislav Vovk <stanislav.vovk@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: update CVE_STATUS for CVE-2025-5025Vrushti Dabhi2025-09-091-1/+1
| | | | | | | | | | | | This CVE applies only when curl is built with wolfSSL support. Revised CVE_STATUS description to align with CVE details. Reference: https://github.com/openembedded/openembedded-core/commit/93ae0758ef35 (From OE-Core rev: fddc4dcc89a9491abdf8f5d0ea4df9a6526b1538) Signed-off-by: Vrushti Dabhi <vdabhi@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: remove devtool FIXME commentPeter Marko2025-09-011-52/+0
| | | | | | | | | | This comment should not have been merged. It shows that the license did not change. (From OE-Core rev: a19afb7db1b9995ce433f8bfeb5406c9fd1fdc19) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-03-19 22:19:25 +0000