5278 Commits

Author SHA1 Message Date
Richard Purdie
c3d4bc65d0 python3-testtools: Avoid traceback2 module requirement
traceback2 adds traceback for python2. Rather than depend on traceback2, we're
python3 only so just use traceback.

This caused breakage in oe-selftest -j which uses testtools on the autobuilder
using buildtools-tarball.

[YOCTO #13652]

(From OE-Core rev: ee80a06c107375e3cf0d246ea17c09dda4536dab)

(From OE-Core rev: ee82e3c24fe5727ce81e972cadedca431d6086c5)

(From OE-Core rev: be4470c9590183b388d9ff176331d0c50984dec8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-16 13:34:54 +01:00
Richard Purdie
ddfd5cf2ae binutils: Install non-alternatives links for nativesdk
In the SDK we need the plain symlinks and don't use alternative providers.
When these are missing the toolchain can work incorrectly so fix this.

(From OE-Core rev: 0c06cfaa016d06cc56d80dc1c244a938f3d38a3c)

(From OE-Core rev: 0d299c5dc04407d2d54574157f4014f50f2d0468)

(From OE-Core rev: aa37b5fe0620122e47f36165f5c7a07d3328dba3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-16 13:34:53 +01:00
Richard Purdie
b59770a314 binutils: Fix relocation of ld.so.conf in nativesdk builds
We need binutils to look at our ld.so.conf file within the SDK to ensure
we search the SDK's libdirs as well as those from the host system.

There add a patch which passes in the directory to the code using a define,
then add it to a section we relocate in a similar way to the way we relocate
the gcc internal paths. This ensures that ld works correctly in our buildtools
tarball.

Standard sysroot relocation doesn't work since we're not in a sysroot,
we want to use both the host system and SDK libs.

(From OE-Core rev: f6c1089642934ad93056ef19a0888965486ee030)

(From OE-Core rev: 09a2b16ac2bd1e3e415131e46315c851373aa7e0)

(From OE-Core rev: d0b7811b0e8654cf83d1b0f8256c7941fc3d9c41)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-16 13:34:53 +01:00
Adrian Bunk
8b3e2a5427 python: Upgrade 2.7.17 -> 2.17.18
LICENSE checksum changed due to 2019 -> 2020 update.

(From OE-Core rev: 65ab890bbdd5b104867d80b721be117a9d269aff)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-22 16:23:29 +01:00
Adrian Bunk
8fef2e0d66 git: Upgrade 2.20.1 -> 2.20.4
This includes the fixes for CVE-2020-5260 and CVE-2020-11008.

(From OE-Core rev: fe5aee43db25f622f4cbacc69765f94eca51395c)

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-22 16:23:29 +01:00
Adrian Bunk
9ccd3a2b1f python3: Upgrade 3.7.6 -> 3.7.7
THE LICENSE checksum changed in this update due to copyright notice
added for 2020.

(From OE-Core rev: 2af49cebd669bd2992d57a586e2a06bbad09e945)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-04-09 00:07:12 +01:00
Anuj Mittal
aaf587913d e2fsprogs: backport upstream patch
Fixes a bug wherein a use after free could potentially be used to run
malicious code if a user can be tricked into running e2fsck on a
maliciously crafted file system.

Also see:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948517

(From OE-Core rev: 23c1b157362609bd8d85c7d35e6c7f0f60c32c88)

(From OE-Core rev: bdd978f8f68e24dd35e2c19b46cbe71b06e4fe42)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-04-09 00:07:12 +01:00
Anuj Mittal
548ff21524 e2fsprogs: fix CVE-2019-5188
Also see:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948508

(From OE-Core rev: 09bdcef183d885025da6aa87a7c2bf7e8268774e)

(From OE-Core rev: f454e207eac6fb85eb217554e13c2d3e69f41522)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-04-09 00:07:12 +01:00
Armin Kuster
31fdfbe48e python2: add ntpath
python3 has this but python is missing this.
[Yocto #13740]

(From OE-Core rev: 3e69681857b88be44797d1d302b9e44a46a7634d)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit af41a2238beec0c34c1c1e5f25eed55f2a214643)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-21 09:44:05 +00:00
Lee Chee Yang
80df8a60bb rsync: whitelist CVE-2017-16548
patch for this CVE applies to v3.1.3pre1 not for v3.1.3.
patch already in v3.1.3.
see
https://git.samba.org/rsync.git/?p=rsync.git;a=commitdiff;h=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hp=bc112b0e7feece62ce98708092306639a8a53cce

(From OE-Core rev: 1e2739c821312527010fb0afbde5a20cd3f03d24)

(From OE-Core rev: 0a88a86d92b294175c14c7c5a2533d4e418fec6a)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 842bd7ca21efc6378ba24a8d0bf065c4d0f54f1d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-21 09:44:05 +00:00
Hongxu Jia
47de27d734 go: fix CVE-2019-17596
2017d88dbc

(From OE-Core rev: a8adb7d23172acb587c259a28aa0c9e2df83f228)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Anuj Mittal
d8da51bd3b nasm: fix CVE-2019-14248
See:
https://bugzilla.nasm.us/show_bug.cgi?id=3392576

(From OE-Core rev: 49dca79c6e5f631d1f55422864ee57c86cafe1a4)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Anuj Mittal
dbd22b6cd7 nasm: fix CVE-2018-19755
(From OE-Core rev: 021c8ae8e115ff6bab167146d97a340d4945118d)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Vinay Kumar
c2644c6afc gdb: Fix CVE-2019-1010180
Source: git://sourceware.org/git/binutils-gdb.git
Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=23657

Backported upstream commit 950b74950f6020eda38647f22e9077ac7f68ca49 to gdb-8.3.1 sources.

Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=950b74950f6020eda38647f22e9077ac7f68ca49]

(From OE-Core rev: 536a2656b44fbb98a3cdc60eed32f378184cce7c)

Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Trevor Gamblin
271da31a92 binutils: fix CVE-2019-17451
Backport upstream fix.

(From OE-Core rev: 02c54859c009be191958a19a5c3549a6635cc647)

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Trevor Gamblin
f4c9970227 binutils: fix CVE-2019-17450
Backport upstream fix.

(From OE-Core rev: dcd3406c79bdee46fabc2310c9e278918e26ce80)

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Joshua Watt
441f31d02f python3: RDEPEND on libgcc
Python uses features of glibc that require it to dynamically load (i.e.
dlopen()) libgcc_s at runtime. However, since this isn't a link time
dependency, it doesn't get picked up automatically by bitbake so
manually add it to RDEPENDS.

There is an outstanding bug in Python to make it explicitly link against
libgcc at link time which would remove the need for this. See:
https://bugs.python.org/issue37395

(From OE-Core rev: 04297ee03f5f4e4edafaf332a6648465f52ba1eb)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
[ merged the fix to make it glibc only ]
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Adrian Bunk
37e53c426b python3: Upgrade 3.7.5 -> 3.7.6
(From OE-Core rev: 262ac0c4d534b1858b81c7d69b6ff57c5d3a4559)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Adrian Bunk
78c2ea1877 python/python3: Whitelist CVE-2019-18348
This is not exploitable when glibc has CVE-2016-10739 fixed,
which is fixed in the upstream version since warrior.

(From OE-Core rev: a2507600fecdf815ad80da569c5e8ad65286b812)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Adrian Bunk
57da5247c0 python: Whitelist CVE-2017-17522 CVE-2017-18207 CVE-2015-5652
One Windows-only CVE that cannot be fixed, and two CVEs
where upstream agreement is that they are not vulnerabilities.

(From OE-Core rev: 1b69d141b73e46cc377f8566868da44dd5b1ea42)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-28 11:15:01 +00:00
Ross Burton
7ee04f2c4b subversion: set CVE vendor to Apache
There's a Jenkins plugin for Subversion.

(From OE-Core rev: 9b5437f9afb4dd1366d5e21ea861f683d8cd2a09)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Ross Burton
804ed96384 git: set CVE vendor to git-scm
There's a Jenkins plugin for Git.

(From OE-Core rev: 44d4dda6db56107d7ce900730b370a2ec81d9c30)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Ross Burton
775170b45c flex: set CVE_PRODUCT to include vendor
There are many projects called Flex and they have CVEs, so also set the vendor
to remove these false positives.

(From OE-Core rev: e128bd76ae9f4b30948e6b8fc68f4374e03c7bec)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Alexander Kanavin
cc7bd25951 python: update to 2.7.17
Drop backports, rebase a couple of patches.

This is the second last release of py 2.x; upstream support ends on
1 January 2020, there will be one final 2.x afterwards.

Note that the only thing that still needs python 2.x in oe-core is
u-boot; when the next u-boot update arrives, we should find out
where the py3 migration is for that component before merging the
update.

(From OE-Core rev: 184b60eb905bb75ecc7a0c29a175e624d8555fac)

(From OE-Core rev: 7009d823a0799ce7132bd77329b273a476718c8c)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
[Minor fixup for warrior context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Anuj Mittal
c8342197f8 python: fix CVE-2018-20852
(From OE-Core rev: 98cc3bfc6656b8648da591dcb64de8472e6c97e0)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Chen Qi
b9f8dfd5ac python: fix CVE-2019-16935
(From OE-Core rev: 1a7593bcdaf8a8cf15259aee8a0e2686247f2987)

(From OE-Core rev: 27fea8ea1da28bb3163b5d503e6d16948c50f2ae)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16 22:38:52 +00:00
Ross Burton
c9a1a608f5 file: fix CVE-2019-18218
(From OE-Core rev: 0a1b1e88b936177344392e185fbd077622d88b3e)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Ross Burton
e612e9c933 patch: the CVE-2019-13638 fix also handles CVE-2018-20969
(From OE-Core rev: fec797a6ae981efa81896fd915933621699bca4e)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Richard Purdie
bf363493fe pseudo: Add statx support to fix fedora30 issues
Modern distros (e.g. fedora30) are starting to use the new statx() syscall through
the newly exposed glibc wrapper function in software like coreutils (e.g. the ls
command). Add support to intercept this to pseudo.

(From OE-Core rev: 1c09e45f966d553f1fea3795ef9122dd9957be67)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Fixup for warrior context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Richard Purdie
9ee9089816 pseudo: Drop static linking to sqlite3
Back in 2010[1] we made pseudo statically link against sqlite3. Since then
the world has changed, pseudo now has separate processes for the database
in the server and the client and they have separate linking commands.

Also, whilst there were concerns about needing specific versions of sqlite3,
in the OE environment, this is always the case.

[1] http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=ad0ac0ecd38fc77daf42485489fccc10a5e1e3e7

The static sqlite3-native is causing us problems, in particular:

tmp/work/x86_64-linux/pseudo-native/1.9.0+gitAUTOINC+060058bb29-r0/recipe-sysroot-native/usr/lib/libsqlite3.a(sqlite3.o):(.data.rel+0xb0): undefined reference to `fcntl64'

which occurs if sqlite3-native was built on a machine with glibc 2.28 or later
and pseudo-native is being built on glibc before that. With dyanmical linking,
libc is backwards compatible and works but with static linking it does not.

There appears to be no easy way to avoid this other than adding a copy of
sqlite3 into the pseudo recipe. Given the static linking doesn't seem to
be required any longer due to the separate processes, drop that to fix
those issues.

(From OE-Core rev: c8c13ceafa3b12d2676b86182cb422681d465004)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Jason Wessel
d487ce8829 pseudo: Fix openat() with a symlink pointing to a directory
While working with ostree disk generation in conjunction with wic, I
found a problem with pseudo where it tried to resolve a symlink when
it shouldn't, based on openat() flags. A C program has been
constructed to test pseudo to show that it is working properly with
the correct behavior around openat().

 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <dirent.h>
 #include <unistd.h>
 #include <fcntl.h>

int main()
{
    /*
     * Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ;
     * ./app ; echo "pseudo"; pseudo ./app
     */
    system("rm -rf tdir tlink");
    system("mkdir tdir");
    system("ln -s tdir tlink");
    DIR *dir = opendir(".");
    int dfd = dirfd(dir);

    int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK |
                             O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
    if (target_dfd == -1) {
        printf("Test 1 good\n");
    } else {
        printf("Test 1 failed\n");
        close(target_dfd);
    }
    target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK |
                         O_DIRECTORY | O_CLOEXEC);
    if (target_dfd == -1) {
        printf("Test 2 failed\n");
    } else {
        printf("Test 2 good\n");
        close(target_dfd);
    }
    /* Test 3 make sure the owner of the link is root  */
    struct stat sbuf;
    if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0) {
        printf("Test 3 good\n");
    } else {
        printf("Test 3 failed\n");
    }
    /* Test 4 tests open with the "rb" flag, owner should not change */
    int ofd = openat(dfd,"./tlink", O_RDONLY|O_CLOEXEC);
    if (ofd >= 0) {
        if (fstat(ofd, &sbuf) != 0)
            printf("ERROR in fstat test 4\n");
        else if (sbuf.st_uid == 0)
            printf("Test 4 good\n");
        close(ofd);
    } else {
        printf("Test 4 failed with openat()\n");
    }
    /* Test pseudo db to see the fstat() above did not delete the DB entry */
    if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0)
        printf("Test 5 good\n");
    else
        printf("Test 5 failed... tlink is owned by %i and not 0\n", sbuf.st_uid);
    return 0;
}

int main()
{
    /* Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ; ./app ; echo "pseudo"; pseudo ./app */
    system("rm -rf tdir tlink");
    system("mkdir tdir");
    system("ln -s tdir tlink");
    DIR *dir = opendir(".");
    int dfd = dirfd(dir);

    int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
    if (target_dfd == -1) {
        printf("This is right\n");
    } else {
        printf("This is broken\n");
    }
    return 0;
}

Many thanks to Peter Seebach for fixing the problem in the pseudo code
to use the same logic which was already there for the
AT_SYMLINK_NOFOLLOW.

Also updated is the license MD5 checksum since the master branch of
pseudo has had the SPDX data updated.

(From OE-Core rev: d1788e865d9bcd70b36d0f239647aeffb0ea8b85)

Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Adrian Bunk
d865ce7154 python3: Upgrade 3.7.4 -> 3.7.5
Backported patch removed.

3.7.5 also includes the fix for CVE-2019-16935.

(From OE-Core rev: deabbb60b98418bd4fcf97adc3293b65d3ff306e)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Chen Qi
66f4295cbf python3: CVE-2019-16056
(From OE-Core rev: 8818a7e878644d1c695385eb256f53a34179fbbb)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Mingli Yu
3370830012 python3: fix the test_locale output format
Before this patch:
 # python3 -m test -v test_locale
 [snip]
 test_getsetlocale_issue1813 (test.test_locale.TestMiscellaneous) ... testing with ('tr_TR', 'ISO8859-9') ok
 [snip]

 After this patch:
 # python3 -m test -v test_locale
 [snip]
 test_getsetlocale_issue1813 (test.test_locale.TestMiscellaneous) ... testing with ('tr_TR', 'ISO8859-9')... ok
 [snip]

Make the test ended with "... ok" is common in python
unittest world, we should make it keep consistent
with other test cases in case it may be ignored to
record in the report if we use the common filter
"... ok".

[YOCTO #13298]

(From OE-Core rev: 5b8022db53d9ef50ea35b034a6e27477038a508b)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Joshua Watt
a2d2dba0bd python3: Fix .pyc file reproduciblility
Applies a patch to python that makes the pre-compiled .pyc files
generated during the build reproducible.

(From OE-Core rev: c2c6f30554f96e551b71b3d66fb599a5d28a10bb)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Joshua Watt
0cec926058 python3: Reformat sysconfig
Reformats the sysconfig file when packaging. This file is output by
using the python pprint function. This function will wrap long lines at
80 characters by default, and will even split strings at whitespace
boundaries to do so, e.g.:

 'A': 'B is really'
    ' long'

This causes a problem for reproducibility however because there might be
lines of differing lengths depending on the build path. These
non-reproducible paths are removed, but their effect on string wrapping
from pprint remains.

To correct this, reformat the entire sysconfig file by re-printing using
pprint with an (effectively) unlimited line length.

(From OE-Core rev: 01e4409e81c3d037fcba82fbcb3273dd1118490b)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Ricardo Ribalda Delgado
099d62754c python3: python3: Fix build error x86->x86
When building x86->x86 the system will try to execute .so and related items
from the default PYTHONPATH.  This will fail if the target CPU contains
instructions that the host CPU does not have, add CROSSPYTHONPATH
into PYTHONPATH so we can prepend the list to find correct libs.

Fixes:

Illegal instruction (core dumped)
Makefile:625: recipe for target 'sharedmods' failed
make: *** [sharedmods] Error 132
make: *** Waiting for unfinished jobs....

(From OE-Core rev: 2f8086ce87bbb62ef971be4da80c2c2b9d8c9c66)

Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Matthias Schoepfer via Openembedded-core
7a5f14778e python3: fix build on softfloat mips
This patch originally only meant to correct the python3 build for mips
with softfloat, as the original test only checked for mips hardfloat.

Replaced custom C Program for triplet detection with autotools triplet
detection.

(From OE-Core rev: f3326309c7c22a6034917f6eee21908c61f44a2f)

Signed-off-by: Matthias Schoepfer <matthias.schoepfer@ithinx.io>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Changqing Li
143c790fca python3: fix do_install fail for parallel buiild
When using make -j with the 'install' target, it's possible for altbininstall
(which normally creates BINDIR) and libainstall (which doesn't, though it
installs python-config there) to race, resulting in a failure due to
attempting to install python-config into a nonexistent BINDIR. Ensure it also
exists in the libainstall target.

(From OE-Core rev: dc84f40fd485863fb6c77e641d76135b21867d39)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:13 +00:00
Peter Kjellerstedt
d16e35442f nativesdk-meson: Remove some unused variables
(From OE-Core rev: ec563bf0009e1124adb966130f610b9df291fa19)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:12 +00:00
Peter Kjellerstedt
8855a1ec4d meson: Backport patch to handle strings in cross file args
This allows <language>_args and <language>_link_args properties, e.g.,
c_link_args, in meson.cross to be specified as either a string or a
list.

(From OE-Core rev: 1913e688ad95d465e9b9d16ad57f2bdef2b50d93)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:12 +00:00
Khem Raj
40ca39df1b go-1.12: update to 1.12.9 minor release
(From OE-Core rev: 03b303dbc92521606ff4051bd253f8acc01fd9e5)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:12 +00:00
Adrian Bunk
644beadc0b go: Upgrade 1.12.5 -> 1.12.6
(From OE-Core rev: 8dfe441fd3ad46732c2775b817de1a0d816a87e4)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:12 +00:00
Alexander Kanavin
d579ff2fa6 go: update 1.12.1->1.12.5
(From OE-Core rev: 4e642e6f7b6e51c64e990b74aff3d84b78cd894e)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-18 14:42:12 +00:00
Armin Kuster
4e1e733e06 qemu: update to 3.1.1.1
bug fix only update.

Drop patches included in update.

For full set of changes, see: https://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/tags/v3.1.1.1

(From OE-Core rev: 14f04e6b6c1fa40a1c39cd186627b4b8442f2d5e)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:55 +00:00
Chen Qi
9111972adb go: fix CVE-2019-16276
(From OE-Core rev: 5fc9b154754e67553296a00a39ed16ab6a1d59de)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e31f87e289dfd3bbca961e927447a9c7ba816d3f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit e02e8fa2e82cceaaa6a433466f52f97b0984762a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:55 +00:00
Changqing Li
f29207ae99 python: Fix CVE-2019-10160
(From OE-Core rev: 23d48f2bea2d358bd8d7d4efd07792bc1f3666bd)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit b4240b585d7fcac2fdbf33a8e72d48cb732eb696)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 10d87a3085665a959a5fda64ae3895cb27ddf343)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:54 +00:00
Chen Qi
0e55cd3815 python: CVE-2019-16056
(From OE-Core rev: 49ff6c7ef1d366007c49083f4e5faaf5a9eb086f)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 27be9cf71a6fe906a23e81b56f1cc18a6fc9ef97)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:54 +00:00
Yi Zhao
cd8a048b62 python: add tk-lib as runtime dependency for python-tkinter
Fixes:
ERROR: python-2.7.16-r0 do_package_qa: QA Issue:
/usr/lib/python2.7/lib-dynload/_tkinter.so contained in package
python-tkinter requires libtk8.6.so, but no providers found in
RDEPENDS_python-tkinter? [file-rdeps]

(From OE-Core rev: f83ecbabb911c46de77708ede759a0b768928ea2)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit f78248a2380bbbbf271b5bb02c762f5bc7a3a92e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:54 +00:00
Anuj Mittal
9cb405a3eb python: include CVE patches for python-native as well
Also avoids maintaining a different set of patches for both.

(From OE-Core rev: e73d5bb4a21497ed645e2a0a4b88c2eeaf65080a)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b3b1c00cc46b33ddbf7e008267032220e1e298af)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-30 13:47:54 +00:00