From 743d30e8548b45658589ce5e2a25edaba2ce402d Mon Sep 17 00:00:00 2001 From: Yogita Urade Date: Tue, 25 Mar 2025 09:07:33 +0000 Subject: libarchive: upgrade 3.7.7 -> 3.7.8 This upgrade includes fix for CVE-2024-57970, CVE-2025-25724 and CVE-2025-1632 Changelog: ========== Libarchive 3.7.8 is a bugfix and security release Security fixes: tar reader: Handle truncation in the middle of a GNU long linkname (#2422, CVE-2024-57970) unzip: fix null pointer dereference (#2532, CVE-2025-1632) tar reader: fix unchecked return value in list_item_verbose() (#2532, CVE-2025-25724) Important bugfixes: 7zip reader: add SPARC (#2399) and POWERPC (#2459) filter support for non-LZMA compressors tar reader: Ignore ustar size when pax size is present (#2405) tar writer: Fix bug when -s/a/b/ used more than once with b flag (#2435) cpio: Fix a Y2038 bug on Windows (#2471) libarchive: Handle ARCHIVE_FILTER_LZOP in archive_read_append_filter (#2519) libarchive: Adding missing seeker function to archive_read_open_FILE() (#2539) (From OE-Core rev: 861d6a37e9457510e526c7cd5a63c82d9c48b591) Signed-off-by: Yogita Urade Signed-off-by: Richard Purdie --- .../libarchive/libarchive_3.7.7.bb | 67 ---------------------- .../libarchive/libarchive_3.7.8.bb | 67 ++++++++++++++++++++++ 2 files changed, 67 insertions(+), 67 deletions(-) delete mode 100644 meta/recipes-extended/libarchive/libarchive_3.7.7.bb create mode 100644 meta/recipes-extended/libarchive/libarchive_3.7.8.bb diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.7.bb b/meta/recipes-extended/libarchive/libarchive_3.7.7.bb deleted file mode 100644 index 0a0a6b374b..0000000000 --- a/meta/recipes-extended/libarchive/libarchive_3.7.7.bb +++ /dev/null @@ -1,67 +0,0 @@ -SUMMARY = "Support for reading various archive formats" -DESCRIPTION = "C library and command-line tools for reading and writing tar, cpio, zip, ISO, and other archive formats" -HOMEPAGE = "http://www.libarchive.org/" -SECTION = "devel" -LICENSE = "BSD-2-Clause" -LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665" - -DEPENDS = "e2fsprogs-native" - -PACKAGECONFIG ?= "zlib bz2 xz zstd ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}" - -DEPENDS_BZIP2 = "bzip2-replacement-native" -DEPENDS_BZIP2:class-target = "bzip2" - -PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl," -PACKAGECONFIG[xattr] = "--enable-xattr,--disable-xattr,attr," -PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib," -PACKAGECONFIG[bz2] = "--with-bz2lib,--without-bz2lib,${DEPENDS_BZIP2}," -PACKAGECONFIG[xz] = "--with-lzma,--without-lzma,xz," -PACKAGECONFIG[openssl] = "--with-openssl,--without-openssl,openssl," -PACKAGECONFIG[libb2] = "--with-libb2,--without-libb2,libb2," -PACKAGECONFIG[libxml2] = "--with-xml2,--without-xml2,libxml2," -PACKAGECONFIG[expat] = "--with-expat,--without-expat,expat," -PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo," -PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," -PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," -PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls," -PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd," - -EXTRA_OECONF += "--enable-largefile --without-iconv" - -SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz" - -UPSTREAM_CHECK_URI = "http://libarchive.org/" - -SRC_URI[sha256sum] = "4cc540a3e9a1eebdefa1045d2e4184831100667e6d7d5b315bb1cbc951f8ddff" - -CVE_STATUS[CVE-2023-30571] = "upstream-wontfix: upstream has documented that reported function is not thread-safe" - -inherit autotools update-alternatives pkgconfig - -CPPFLAGS += "-I${WORKDIR}/extra-includes" - -do_configure[cleandirs] += "${WORKDIR}/extra-includes" -do_configure:prepend() { - # We just need the headers for some type constants, so no need to - # build all of e2fsprogs for the target - cp -R ${STAGING_INCDIR_NATIVE}/ext2fs ${WORKDIR}/extra-includes/ -} - -ALTERNATIVE_PRIORITY = "80" - -PACKAGES =+ "bsdtar" -FILES:bsdtar = "${bindir}/bsdtar" - -ALTERNATIVE:bsdtar = "tar" -ALTERNATIVE_LINK_NAME[tar] = "${base_bindir}/tar" -ALTERNATIVE_TARGET[tar] = "${bindir}/bsdtar" - -PACKAGES =+ "bsdcpio" -FILES:bsdcpio = "${bindir}/bsdcpio" - -ALTERNATIVE:bsdcpio = "cpio" -ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio" -ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.8.bb b/meta/recipes-extended/libarchive/libarchive_3.7.8.bb new file mode 100644 index 0000000000..d78b38d3e9 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive_3.7.8.bb @@ -0,0 +1,67 @@ +SUMMARY = "Support for reading various archive formats" +DESCRIPTION = "C library and command-line tools for reading and writing tar, cpio, zip, ISO, and other archive formats" +HOMEPAGE = "http://www.libarchive.org/" +SECTION = "devel" +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665" + +DEPENDS = "e2fsprogs-native" + +PACKAGECONFIG ?= "zlib bz2 xz zstd ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}" + +DEPENDS_BZIP2 = "bzip2-replacement-native" +DEPENDS_BZIP2:class-target = "bzip2" + +PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl," +PACKAGECONFIG[xattr] = "--enable-xattr,--disable-xattr,attr," +PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib," +PACKAGECONFIG[bz2] = "--with-bz2lib,--without-bz2lib,${DEPENDS_BZIP2}," +PACKAGECONFIG[xz] = "--with-lzma,--without-lzma,xz," +PACKAGECONFIG[openssl] = "--with-openssl,--without-openssl,openssl," +PACKAGECONFIG[libb2] = "--with-libb2,--without-libb2,libb2," +PACKAGECONFIG[libxml2] = "--with-xml2,--without-xml2,libxml2," +PACKAGECONFIG[expat] = "--with-expat,--without-expat,expat," +PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo," +PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," +PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," +PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls," +PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd," + +EXTRA_OECONF += "--enable-largefile --without-iconv" + +SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz" + +UPSTREAM_CHECK_URI = "http://libarchive.org/" + +SRC_URI[sha256sum] = "a123d87b1bd8adb19e8c187da17ae2d957c7f9596e741b929e6b9ceefea5ad0f" + +CVE_STATUS[CVE-2023-30571] = "upstream-wontfix: upstream has documented that reported function is not thread-safe" + +inherit autotools update-alternatives pkgconfig + +CPPFLAGS += "-I${WORKDIR}/extra-includes" + +do_configure[cleandirs] += "${WORKDIR}/extra-includes" +do_configure:prepend() { + # We just need the headers for some type constants, so no need to + # build all of e2fsprogs for the target + cp -R ${STAGING_INCDIR_NATIVE}/ext2fs ${WORKDIR}/extra-includes/ +} + +ALTERNATIVE_PRIORITY = "80" + +PACKAGES =+ "bsdtar" +FILES:bsdtar = "${bindir}/bsdtar" + +ALTERNATIVE:bsdtar = "tar" +ALTERNATIVE_LINK_NAME[tar] = "${base_bindir}/tar" +ALTERNATIVE_TARGET[tar] = "${bindir}/bsdtar" + +PACKAGES =+ "bsdcpio" +FILES:bsdcpio = "${bindir}/bsdcpio" + +ALTERNATIVE:bsdcpio = "cpio" +ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio" +ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio" + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf