Integer overflow in bufferobject.c in Python before 2.7.8 allows
context-dependent attackers to obtain sensitive information from
process memory via a large size and offset in a "buffer" function.
This back-ported patch fixes CVE-2014-7185
(From OE-Core rev: 49ceed974e39ab8ac4be410e5caa5e1ef7a646d9)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This aligns the params of getty with the ones used in Debian. From the
getty(8) manpage:
,----[ getty(8) manpage ]
| -L, --local-line
|
| Force the line to be a local line with no need for carrier
| detect. This can be useful when you have a locally attached
| terminal where the serial line does not set the carrier detect
| signal.
`----
Reported-by: Craig McQueen <craig.mcqueen@beamcommunications.com>
(From OE-Core rev: d7f057341e5c007783f41247ee054f257a9f2f64)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This aligns the params of getty with the ones used in Debian. From the
getty(8) manpage:
,----[ getty(8) manpage ]
| -L, --local-line
|
| Force the line to be a local line with no need for carrier
| detect. This can be useful when you have a locally attached
| terminal where the serial line does not set the carrier detect
| signal.
`----
Reported-by: Craig McQueen <craig.mcqueen@beamcommunications.com>
(From OE-Core rev: a899c362be71cb7b94bd318c57702446b017005c)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Tested-by: Craig McQueen <craig.mcqueen@beamcommunications.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When building the U-Boot the lack of a proper sysroot can trigger
following error:
,----
| arm-poky-linux-gnueabi-ld.bfd: cannot find -lgcc
| make[2]: *** [examples/standalone/hello_world] Error 1
| make[1]: *** [examples/standalone] Error 2
| make: *** [examples] Error 2
`----
Guillaume Fournier has posted a very complete analysis of the
problem[1].
1. https://lists.yoctoproject.org/pipermail/meta-freescale/2014-November/011270.html
The use of KCFLAGS makes the build of U-Boot work out of box, now that
it uses the Linux kernel build system.
Reported-by: Guillaume Fournier <gfournier@brioconcept.com>
(From OE-Core rev: 50437f9c187f1a884825a8d1ec12da47a5e58670)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In a GPLv3-free build we have two different versions of gettext in sysroot due
to GPLv3 restrictions. In this case we need gettext-native too so we can have
the needed macros and avoid errors like:
"error: possibly undefined macro: AM_GNU_GETTEXT"
The needed dependency is added by gettext class which is prefered because it
takes care of NLS flags too.
(From OE-Core rev: 23d8a4d64e9ff126d6460a69e6d086b1c86e87a9)
Signed-off-by: Andrei Gherzan <andrei.gherzan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The systemdunitdir option was split into systemdsystemunitdir and
systemduserunitdir before bluez5 was ever released, so this produced a
QA error and was ignored. There appears to be no reason to override the
inferred default, so replace it with an explicit --enable-systemd.
(From OE-Core rev: 8c9c08112d7b3bde48fb4dd5e15429948aca0dd6)
Signed-off-by: Peter A. Bigot <pab@pabigot.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Cleanups and minor fixes;
- Phonebook Access Profile 1.2 and Message Access Profile 1.2 features and improvements;
- Various GATT related fixes;
- Fix for a race condition which could occasionally cause LE connection/pairing failures.
(From OE-Core rev: 3b387c7c76d52373acae3bad96a8d718ab1948bd)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The oe.utils.contains function has been removed from OE-Core metadata
as the references for it has been replaced to use the
bb.utils.contains.
(Bitbake rev: 5cfdebe7a67dccc7552ff80c1ccc970e36d562df)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This state was renamed in bitbake 12e9d3 but this use of it wasn't changed.
[ YOCTO #5445 ]
(Bitbake rev: 196106100e2dedfacce95be0ee6def94c5a80f27)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
loginfo "op" was being set to invalid values in saveConfigurationVar it was
working because set is a python global but append is not. This replaces both
the "op" with strings and removes the crash when calling appendConfigurationVar
(Bitbake rev: 2a8e847de85546d43600a561f9c63aa36bd69222)
Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We close XSS injection points in Projects page.
* modify the json filter to properly escape HTML tags in strings
* enable $sanitize to automatically sanitize dangerous HTML in
user-supplied input
* clean dangerous characters in targets field, as that field contents
will be directly passed to a shell command
Based on the vulnerability discovered and the patch provided by Michael Wood.
(Bitbake rev: 23c440db9c076ca37e651bdbbdbefee54998e1dc)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We import angular services ngRoute and
ngSanitize that helps performing user-input
sanitization in order to prevent XSS.
Both services are version 1.2.23.
License is MIT.
(Bitbake rev: 4165895329b3a5e439a38ee749b089637dc502d7)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Small fixes to the UI of the project.html and targets.html templates.
In project.html:
* Remove some inline styles and replace them with declarations
in default.css
* Make sure that the 'add' and 'build' buttons in the project
configuration areas have nice, rounded corners
* Add some space between the machine name and the change icon
* Remove the input-prepend class from the build form (we don't
need it)
* Apply the success class to target names in completed builds
* Bold machine and project name in the change notifications to
match all other notifications
* There is a bug in Twitter Boostrap in tooltips inside buttons, so
moving the tooltip in the 'build' button outside the button tag
In targets.html, just add a missing space between the semicolon
and the first layer name in the add layer notification.
(Bitbake rev: 19113c4fe915be7db51ab06dfab5ea0797faea84)
Signed-off-by: Belen Barros <belen.barros.pena@intel.com>
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bootstrap version we are working with is 2.3 not 3
(Bitbake rev: 76c90fe9dcd6fc1aa7e82d9dca0ea9e653d322a1)
Signed-off-by: Michael Wood <michael.g.wood@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch implements the round 3 of reviews for the Project
page, including fixing the time display, fixing the build list
display, with fade-in and fade-out animations, and various
small layout fixes.
[YOCTO #6587]
[YOCTO #6731]
(Bitbake rev: 09e3ba8f800a03de731b022543cae33a46be17ef)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We separate the load configuration command as to allow
system administrators load toasterconf.json file as part of the
setup process.
[YOCTO #6895]
(Bitbake rev: 3ed596ac4e21a4494fd7f6cd8739d460fd98512f)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When the user has added/removed a layer but no page reload/requery has
happened we need to update the filter count labels client side.
[YOCTO #6861]
(Bitbake rev: d17e8425de6c609394b9a029afa2dcb455df0b3c)
Signed-off-by: Michael Wood <michael.g.wood@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes the issue where the column is under the wrong table header.
[YOCTO #6684]
(Bitbake rev: 4ef276e379d58130bb50024d7b74b7774fce6fdd)
Signed-off-by: Michael Wood <michael.g.wood@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a combined set of fixes for the project, layers and targets
pages in the project section of toaster.
The fixes correct behaviour and look in various parts of the page,
including submitting XHR commands and updating the DOM with the correct
info.
(Bitbake rev: 96d7738f964784871c928c376cb9fbc9a275cf00)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We add a static copy of the Angular's animate plugin,
version 1.2.23
Licensed under MIT.
(Bitbake rev: 12162fda32af4bc805d6ff5b0348d93befe2f623)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We update the release model to pinpoint to specific branch,
instead of holding a branch name that needs to be matched.
This is needed because we move away from mixing branches on different
layer sources.
Various minor changes to models file.
(Bitbake rev: d58aacc69b1832f99758b941803123329e06082d)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We add a logger, enabled through the settings.py, that
logs all SQL queries, with timestamp and duration, to console.
This is helpful in profiling the SQL queries.
The facility is disabled by default.
(Bitbake rev: 54fd0a76fa3154adfab5688ecc96963f42cded11)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Improve the performance of data logging in toasterui.
We modify the data queries used to:
* cache searching in memory
* insert in bulk (i.e. multiple values per insert, where possible)
On development test rig (networked mysql), on no-op build,
time for data recording is reduced from 4:10 to 1:30 (minutes).
We also improve the logging, so it is easier to detect
toasterui errors.
(Bitbake rev: d42784432f927f58730caf80546c66772e0fec89)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We add the "webport=" command line option as to allow starting
the web server on a custom port.
The bitbake server port is now auto-allocated. This is needed
to be able to run multiple toaster environments on a single machine.
We tackle bug 6023 (toaster refusing to start when lock file is present)
by using more specific checks, and automatically recover from
bitbake server down / webserver up error mode.
Command line parameters are now read on both interactive and managed
modes.
The localhost and ssh controllers are updated to work with the modified
toaster launcher script.
[YOCTO #6023]
(Bitbake rev: cd3eb5b051743463cfe51dba97cae4da75420048)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
do_configure was incorrectly spelt do_configre, which with recent changes to
base.bbclass mean make clean was invoked, which doesn't exist.
(From OE-Core rev: e7b731a1a358e0007dba1038ad504888bec5916e)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add libunwind package dependency to solve following error:
configure: error: failed to find libunwind-ptrace.h
(From OE-Core rev: 50985a40021c20c8620e82b431ff2da8e005845d)
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[YOCTO #6951]
The TOOLCHAIN_CONFIGSITE_SYSROOTCACHE value was defaulting to the nativesdk
path and not the associated target path. Set the value in toolchain-scripts
to the target path.
Be sure to set the MLPREFIX within the meta-environment script as multilibs
are processed.
Update the config_site file name to use -BPN- not PN. Otherwise the
environment processing can't find the correct filename.
(From OE-Core rev: 1f05aaa4944ddac6c2b3ba440effdf1eaf732656)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
vapigen can't be disabled anymore, so remove --disable-vapigen.
(From OE-Core rev: 3562603044e908aacece86985bc8e4d7338622ac)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If a BSP supports two or more multilibs, for example:
MULTILIBS = "multilib:lib32 multilib:lib64"
and a variable is already extended to include multilib variants,
for example in populate_sdk_base:
commit 396371588c7fd2d691ca9c39cd02287e43cb665b
Author: Richard Purdie <richard.purdie@linuxfoundation.org>
Date: Thu Jul 24 22:09:09 2014 +0100
populate_sdk_base: Extend TOOLCHAIN_TARGET_TASK to include multilib variants
Most people expect the toolchain from a multilib build to contain multilib
components. This change makes that happen and is easy for users to override
should they want something different.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The mapping clsextend.map_depends_variable("TOOLCHAIN_TARGET_TASK")
ends up with a wrong double extended package name like:
lib32-lib64-packagegroup-core-standalone-sdk-target
This patch avoid such issues.
(From OE-Core rev: c4e9b2aa894d59fe951038b3b73795b6891df70a)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add PACKAGECONFIG for 'audit', otherwise there would be warnings like
below which would possibly lead to do_rootfs failure.
WARNING: QA Issue: systemd-analyze rdepends on audit, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: systemd rdepends on audit, but it isn't a build dependency? [build-deps]
(From OE-Core rev: b4e6e0aa0229d2ce4c8bee24581c127a31109676)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The apr-native provides usr/share/build-1/libtool which is required by
the recipe such as apache2-native. If we don't set the CONFIG_SHELL to
/bin/bash, then:
1) If we build apr-native on a host which is "/bin/sh -> bash", the
interpreter in usr/share/build-1/libtool would be "#!/bin/sh".
2) When we re-use apr-native's sstate on a host which is
"/bin/sh -> dash", there would be errors.
(From OE-Core rev: 38d83009dfe77437533969ce681605a9ab9534ac)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Besides from being useful as fdisk replacement this gives us 'sgdisk'
which can be used to set the GUID for partitions, e.g.
sgdisk -t 1:C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/mmcblk0p1
To mark it as ESP in scripts like mkefidisk.sh.
(From OE-Core rev: 8c219ef79ce9855524e483d13b3c9559f9233eb1)
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no dtc/.git and pixman/.git files any longer. So remove task
sanitize_sources which is used to remove these files.
(From OE-Core rev: 8d280849b00b1e8ec0de906f6d2ad0b4dc31864a)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
u-boot doesn't really support building its tools for the target, as they are
built with HOSTCC compiler, which is also used to compile fixdep utility
that gets executed during the build. Since it might be beneficial to have a
target version of mkimage, let's hack it to build fixdep in a separate step.
(From OE-Core rev: a8692184d25cb7d8cb3b617e1dfb901fe1b0ca3d)
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Resulted libtool contains references about paths from the build host
Below variables contains hard coded build paths from the host:
LTCC=
lt_sysroot=
sys_lib_search_path_spec=
LD=
CC=
compiler_lib_search_dirs=
predep_objects=
postdep_objects=
compiler_lib_search_path=
(From OE-Core rev: d27c4226f600584f83f66c86b0988a165e8ecb75)
Signed-off-by: Shiqun Lin <Shiqun.Lin@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add this configure option for developer to control if the
/dev/dsp should be used on target. Instead of judging it
based on the very device file of build server.
(From OE-Core rev: 5960262802c394cb6a54ede30e4994929621ca06)
Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To support yocto on systems with python3 as default version, scripts
should use /usr/bin/env python in the shebang, as this allows the use of
a fake env to mimic python2 as default version.
This patch simply replaces occurrences of #!/usr/bin/python with
#!/usr/bin/env python and was done with this oneliner:
git grep -lE '^#!/usr/bin/python' | xargs \
sed -i 's|/usr/bin/python|/usr/bin/env python|'
(From OE-Core rev: 6d3de22a19657a413e01d7bb5fd74d16c00dc696)
Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To support yocto on systems with python3 as default version, scripts
should use /usr/bin/env python in the shebang, as this allows the use of
a fake env to mimic python2 as default version.
This patch simply replaces occurrences of #!/usr/bin/python with
#!/usr/bin/env python and was done with this oneliner:
git grep -lE '^#!/usr/bin/python' | xargs \
sed -i 's|/usr/bin/python|/usr/bin/env python|'
(Bitbake rev: 90d9bf1bda282fb5d053a42438a8cfd02475b9cd)
Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Being able to query whether updated versions of a url are available
is useful, not least for the package reporting system. Since such code
is closely linked to the url type and the url itself, the fetcher
makes a locical place to contain this code.
For wget based urls this means taking upstream directory listings
and searching those for later versions, returning those that are
found.
The patch also adds unittests for this function so that if
improvements are made, the original test urls can be used
to evaulate the those changes.
This is based on code from Irina Patru <irina.patru@intel.com>.
(Bitbake rev: a8272e22b7819e0e8afd8e291d276f5f28fc0007)
Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Being able to generate a version string representing the most recent git commit
given git is useful, not least for the package reporting system.
This adds in a latest_versionstring method to the git fetcher
which allows users to query the latest version using ls-remote
and filtering the responses.
The patch also adds unittests for this function so that if
improvements are made, the original test urls can be used
to evaulate the those changes.
This is based on code from Irina Patru <irina.patru@intel.com>.
(Bitbake rev: f71c8c0354e87fed80bc845db6728e6e18ce9c4d)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
