Commit Graph

74541 Commits

Author SHA1 Message Date
Richard Purdie
0979d14d54 buildhistory: Simplify intercept call sites and drop SSTATEPOSTINSTFUNC usage
We planned to drop SSTATEPOSTINSTFUNC some time ago with the introduction of
postfuncs. Finally get around to doing that which should make the buildhistory
code a little more readable.

Unfortunately ordering the buildhistory function calls after the sstate ones is
difficult without coding that into the sstate class. This patch does that to
ensure everything functions as expected until we can find a better way. This is
still likely preferable than the generic sstate postfuncs support since the function
flow is much more readable.

(From OE-Core rev: 466c505b779dec2ba790f4e6cde7fbb35037f4ef)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c9e2a8fa2f0305ef1247ec405555612326f798f8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Pedro Ferreira
4a64de8691 buildhistory: Restoring files from preserve list
This fix will ensure that, when we activate feature
`BUILDHISTORY_RESET`, files marked to keep on feature
`BUILDHISTORY_PRESERVE` will indeed exist is buildhistory
final path since they are moved to buildhistory/old but
not restored at any point.

(From OE-Core rev: 93ee5b0ee71a51daba9a332e8dba93d78a849677)

Signed-off-by: Pedro Ferreira <Pedro.Silva.Ferreira@criticaltechworks.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9f68a45aa238ae5fcdfaca71ba0e7015e9cb720e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Pedro Ferreira
4c0730341e buildhistory: Fix intermittent package file list creation
The directory that buildhistory_list_pkg_files writes to during do_package
is created by do_packagedata so a clean buildhistory doesn't have
files-in-package written during the first build since packagedata happens
after do_package.

Ensure the output package folder is created to avoid missing
files-in-package.txt files.

Also it ensures that in case of `find` fails we leave with
a hard error instead of hiding the error on the for loop.

(From OE-Core rev: eb94b09a9183e0b0d9cfc45287e0967ae185c099)

Signed-off-by: Pedro Silva Ferreira <Pedro.Silva.Ferreira@criticaltechworks.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8de9b8c1e199896b9a7bc5ed64967c6bfbf84bea)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Peter Marko
d7249c50ec python3: Upgrade 3.12.5 -> 3.12.6
Includes security fixes for CVE-2024-7592, CVE-2024-8088, CVE-2024-6232,
CVE-2023-27043 and other bug fixes.

Removed below patches, as the fix is included in 3.12.6 upgrade:
1. CVE-2024-7592.patch
2. CVE-2024-8088.patch

Release Notes:
https://www.python.org/downloads/release/python-3126/

(From OE-Core rev: aa492b1fd5973c37b8fa2cd17d28199eba46afcc)

(From OE-Core rev: 6688a8ff2e1cbf6ad8ebd1b89ec6c929caf6a161)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Trevor Gamblin
b9a2619bc8 python3: skip readline limited history tests
Python 3.12.5 is failing a newer ptest for reading/writing limited
history when editline (default) is set in PACKAGECONFIG. Skip it for now
until a proper fix (if any) is determined.

A bug has been opened upstream: https://github.com/python/cpython/issues/123018

(From OE-Core rev: de569ddffd5ea36b70c56df21dec9c892e5dee7d)

(From OE-Core rev: 98b3a3e3f79a3edaa4cf2cfbf58eb84553d65e1e)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Trevor Gamblin
a8086d489e python3: upgrade 3.12.4 -> 3.12.5
Changelog: https://docs.python.org/release/3.12.5/whatsnew/changelog.html

(From OE-Core rev: d9e2ebd6b24b802d1d4cd38b3b910e068c308809)

(From OE-Core rev: ae0e8f6932359959535e901e64bdb47189de14cd)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Siddharth Doshi
a2803e528c openssl: Upgrade 3.2.2 -> 3.2.3
Updated SRC_URI link and format due to change in openssl website.

CVE's Fixed by upgrade:
CVE-2024-5535: Fixed possible buffer overread in SSL_select_next_proto().
CVE-2024-6119: Fixed possible denial of service in X.509 name checks

- Removed backports of CVE-2024-5535 as it is already fixed.
- Removed first hunk of 0001-Added-handshake-history-reporting-when-test-fails.patch as the copyright years are already updated in test/helpers/handshake.c file

Detailed Information:
https://github.com/openssl/openssl/blob/openssl-3.2/CHANGES.md#changes-between-322-and-323-3-sep-2024

(From OE-Core rev: 2155e3016a98ae0db28488dcc5176437e6f8b24a)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Vijay Anusuri
263e0c2f1a libpcap: Security fix for CVE-2023-7256 & CVE-2024-8006
Reference:
https://security-tracker.debian.org/tracker/CVE-2023-7256
https://security-tracker.debian.org/tracker/CVE-2024-8006

Upstream commits:
73da0d4d65
2aa69b04d8
8a633ee5b9

(From OE-Core rev: 00e809013a51c1af4979bcff0b3ae3eb7a4d4a20)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Steve Sakoman
5413343d48 Revert "wpa-supplicant: Upgrade 2.10 -> 2.11"
This version bump adds new features and should not have been taken.

This reverts commit 35c2b5f56bca789b9723a144fda0a130a67a860c.

(From OE-Core rev: 79ed0dba62404b9de3cd97bc861dea8779416afc)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-25 05:07:47 -07:00
Richard Purdie
1678bb9ee2 libedit: Make docs generation deterministic
The presence or lack of nroff on the host was changing the doc type. Stop
the code from looking at host paths outside HOSTTOOLS and hence cause the
doc type to be deterministic and reproducible.

(From OE-Core rev: 343f40b0bc8ef65cc1e2abd6c9c33bb2e08bad3d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 918e2b266eba6779f19f65349f85caa880ba45e7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Richard Purdie
3884757bc4 ruby: Make docs generation deterministic
The presence or lack of nroff on the host was changing the doc type. Set it
explicitly to be deterministic and reproducible.

(From OE-Core rev: 9ed723d1972b4e1bd1ae799661194ccbd4c6c759)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f5053abb8957acf358b518ee3c76146dc5f4eb6c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
c5126983d9 python3-maturin: Fix cross compilation issue for armv7l, mips64, ppc
When bitbaking python3-rpds-py it built extension module as:

  site-packages/rpds/rpds.cpython-312-armv7l-linux-gnueabihf.so

Which caused error on target:

  root@qemuarm:~# python3 -c "from rpds import HashTrieMap, HashTrieSet, List"
  Traceback (most recent call last):
    File "<string>", line 1, in <module>
    File "/usr/lib/python3.12/site-packages/rpds/__init__.py", line 1, in <module>
      from .rpds import *
  ModuleNotFoundError: No module named 'rpds.rpds'

Where as it should have been:

  site-packages/rpds/rpds.cpython-312-arm-linux-gnueabihf.so

Associated upstream bug report:
https://github.com/PyO3/maturin/issues/2203

Associated upstream pull request:
https://github.com/PyO3/maturin/pull/2204

Note - mitigation has not been tested with musl:
https://github.com/PyO3/maturin/pull/2204#issuecomment-2323952320

(From OE-Core rev: 32a8a7379008cc6e367b7664c5b10b29f0bb8136)

(From OE-Core rev: d2f73e3840c21997b918d1f1cfae965c618c1076)

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
585bd3edba gcr: Fix LICENSE
The contents of the COPYING file included in the current source code
package match those of LGPL-2.0 license, which seems to have been the
case since 2011 commit
c6691faa03

(From OE-Core rev: f3ae58b741e4e6e3a5196ff75fcc4da6ee89d0b9)

(From OE-Core rev: 422bee7302ea26403e0ac048d3a0e72988be83b3)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
a439b55e5c tiff: Fix LICENSE
The contents of the LICENSE.md file included in the current source
code package match those of libtiff license, which seems to have been
the case since 1999 commit
0ef31e1f62
where it was added with filename COPYRIGHT and was then changed to
LICENSE.md in 2022 commit
fa1d6d787f

(From OE-Core rev: 71d8e8b03349ab18dca558055c2b3a3687785ddf)

(From OE-Core rev: 5495cf45ce74e79be3b8d9b1195f65e253c62828)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
7472a8be65 zip: Fix LICENSE
The contents of the LICENSE file included in the current source code
package match those of Info-ZIP license, which seems to originate from
the year 2007:

  This is version 2007-Mar-4 of the Info-ZIP license.

(From OE-Core rev: 3739a1af61ff6f0faca23bb565f9e71666953715)

(From OE-Core rev: c9bc2bc9c9d0482b13b27505b57df050ebe01898)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
8da9de3186 unzip: Fix LICENSE
The contents of the LICENSE file included in the current source code
package match those of Info-ZIP license, which seems to originate from
the year 2009:

  This is version 2009-Jan-02 of the Info-ZIP license.

(From OE-Core rev: e7c9368e56a6ad90b4ffbba1b765e2b3a331c796)

(From OE-Core rev: f4b84a234662bc8f68e54d4753d9f03e4c2e7931)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
0791976de0 dejagnu: Fix LICENSE
The contents of the COPYING file included in the current source code
package match those of GPL-3.0-only license, which seems to have been
the case since 2008 commit
http://git.savannah.gnu.org/gitweb/?p=dejagnu.git;a=commitdiff;h=9bebe7b9bfb9b02e5e4d86ad74e8ce3eb32a36b9;hp=50fbdd118dba066e201c73a8b0155381cd65a32d
("* COPYING: Update to GPL version 3.")

(From OE-Core rev: 26b71cfb7815a096c5962629801cc3bc85147284)

(From OE-Core rev: 718f6cb5ecf33529efb126f9eda67041f42bd7bf)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Niko Mauno
dab891d2dc iw: Fix LICENSE
The contents of the COPYING file included in the source code match
those of ISC license:
https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/COPYING?h=v6.9
which seems to have been in effect since 2008 commit
https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/commit?id=622c36ae94a880fb53f7f051f1b26616f5b553c1
("license under ISC").

(From OE-Core rev: 87da7445a2a77fe73e3524cd50112842e91235b6)

(From OE-Core rev: cfb0352f1c89729e11259bfe3a7ebcaf7193620f)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Richard Purdie
0aa69e15f1 expat: 2.6.2 -> 2.6.3
Includes fixes for CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492.

https://blog.hartwork.org/posts/expat-2-6-3-released/

(From OE-Core rev: 5cf92f8164d6d03756997e6b9cfb6d37ef5a273a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc96903d915db0dfde382a26bb7ec57d0d37e62e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Siddharth Doshi
8a8d815bf8 vim: Upgrade 9.1.0682 -> 9.1.0698
This includes CVE-fix for CVE-2024-43790 and CVE-2024-43802

Changes between 9.1.0682 -> 9.1.0698
====================================
https://github.com/vim/vim/compare/v9.1.0682...v9.1.0698

(From OE-Core rev: 829e474534777b2154f1b1246c5792b3159dacb1)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e530265415d93e3f49ec7874cf720aad18ab2e22)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Michael Halstead
7a6923bdd9 yocto-uninative: Update to 4.6 for glibc 2.40
(From OE-Core rev: 0a8ba360f111d379af436de86e0a990be02910bb)

Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b29bfd333dffe635ab67475dcd8d22ad8b114c84)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-19 05:11:35 -07:00
Benjamin Szőke
703740d19f mc: fix source URL
new URL for sources: http://ftp.midnight-commander.org/

(From OE-Core rev: 7e11701698a9f38a5e3e0499c0c2edd98d32a85d)

Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 03c4052718a9b8392b25e1770630317b8cf29fbe)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Jon Mason
6191a86bbe openssh: add backported header file include
Backport upstream patch to add a missing header.  The patch says it is
for systemd, but I am seeing build issues when building openssh with
clang and musl.  The issue being seen is:
 #warning usage of non-standard #include <sys/cdefs.h> is deprecated
And similar deprecated warnings.  This patch resolves the issue.

Original patch can be found at
88351eca17

This issue was introduced with OE-Core 1c9d3c22718bf49ae85c2d06e0ee60ebdc2fd0c1
1c9d3c2271

Patch suggested by Khem Raj.

(From OE-Core rev: ae4064a8a60b60bee8a32a454e8784fcf1ecd318)

Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Jon Mason
40d43dd8f4 oeqa/runtime/ssh: increase the number of attempts
Under high load, the ssh test is hitting the amount of retries.
Increase it to 20 to avoid this issue.  This would increase the maximum
failure time from 50 seconds (5 * 10) to 100 seconds.

(From OE-Core rev: 4581b5793f310d2f1f0c80bfe1a5f8743416c4fc)

Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c796438eec5dd6b4671b798f85506bc89ff402ab)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Wang Mingyu
c0aed6b0f2 wireless-regdb: upgrade 2024.05.08 -> 2024.07.04
(From OE-Core rev: d2b83ae234668bccd81ae4b53ca06196d398573b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b460d2d55a35450564ea04255153b0a3bf715530)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Wang Mingyu
f5d5ad980b libdnf: upgrade 0.73.1 -> 0.73.2
Changelog:
==========
- context: use rpmtsAddReinstallElement() when doing a reinstall
- MergedTransaction: Fix invalid memory access when dropping items
- ConfigParser: fix use-out-of-scope leaks
- Since we use rpmtsAddReinstallElement rpm also uninstalls the package
- Fix countme bucket calculation

(From OE-Core rev: 20b67ad71cfa3eac35b2514067f87d79d9c3da2e)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9cf8330068503a5721640763309c4c74f293a94d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Wang Mingyu
aea897cff8 libadwaita: upgrade 1.5.1 -> 1.5.2
Changelog:
==========
- AdwAlertDialog
  - Fix unmatched va_start()
  - Fix setting default widget when removing a response
- AdwBreakpointCondition
  - Fix leaks when parsing
- AdwBreakpointBin
  - Fix a leak
- AdwDialog
  - Fix toggling presentation mode
  - Fix close button ignoring :can-close
  - Fix ::close-attempt not emitting in some cases
  - Fix swipe area for bottom sheets
  - Leak fixes
- AdwHeaderBar
  - Fix initial focus for the back button
  - Fix split view links in docs
- AdwMessageDialog
  - Fix unmatched va_start()
- AdwSpinRow
  - Fix ::input handling
- AdwTabButton
  - Fix needs-attention badge on RTL
- AdwTabView
  - Accessibility fixes
- AdwViewStack
  - Accessibility fixes
- Translation updates
  - Nepali

(From OE-Core rev: 5cc094b5ba1a6e685b01ff35130c4e69fdc7e0ec)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 25b8f5059061bf52257117ba7d54031a31388fb1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Siddharth Doshi
3c8d846bf0 wpa-supplicant: Upgrade 2.10 -> 2.11
License-Update:
===============
- README: Change in copyright years as per https://w1.fi/cgit/hostap/commit/README?id=d945ddd368085f255e68328f2d3b020ceea359af
- wpa_supplicant/wpa_supplicant.c: Change in copyright years as per https://w1.fi/cgit/hostap/commit/wpa_supplicant/wpa_supplicant.c?id=d945ddd368085f255e68328f2d3b020ceea359af

CVE's Fixed:
===========
- CVE-2024-5290 wpa_supplicant: wpa_supplicant loading arbitrary shared objects allowing privilege escalation
- CVE-2023-52160 wpa_supplicant: potential authorization bypass

Changes between 2.10 -> 2.11:
============================
https://w1.fi/cgit/hostap/commit/wpa_supplicant/ChangeLog?id=d945ddd368085f255e68328f2d3b020ceea359af

Note:
=====
Patches
0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch,
0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch,
0001-Install-wpa_passphrase-when-not-disabled.patch,
0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch (CVE-2023-52160)
are already fixed and hence removing them.

(From OE-Core rev: 35c2b5f56bca789b9723a144fda0a130a67a860c)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 824eb0641dc6001a5e9ad7a685e60c472c9fdce8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Wang Mingyu
50cd89849b cups: upgrade 2.4.9 -> 2.4.10
Changelog:
===========
- Fixed error handling when reading a mixed "1setOf" attribute.
- Fixed scheduler start if there is only domain socket to listen on

0001-use-echo-only-in-init.patch
0002-don-t-try-to-run-generated-binaries.patch
0004-cups-fix-multilib-install-file-conflicts.patch
refreshed for 2.4.10.

(From OE-Core rev: 01039c35a89de4bbd1410b3ee08a99cf325adf2b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dd7a978d2d7feb11f6c265ba812c8ca29912ebc6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Vijay Anusuri
25376fc0c7 apr: upgrade 1.7.4 -> 1.7.5
Refreshed patch 0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch

Includes security fix
CVE-2023-49582

changelog:
https://downloads.apache.org/apr/CHANGES-APR-1.7

(From OE-Core rev: e650030ec8fe37b84e6ae37a2305453cc59fda31)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c5d9498466526451910fa02862f8860b2bb81df8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Alexander Kanavin
143639cb8e apr: drop 0007-explicitly-link-libapr-against-phtread-to-make-gold-.patch
At some point this became unnecessary, as tested by building apr
with DISTRO_FEATURES:append = " ld-is-gold"

The logs do confirm that (previously) problematic binary links without errors.

(From OE-Core rev: c04d1ca0d4f1c7236a5093e7be5ef51633c503fd)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c041932f14cf552b0446732ce0cca6537f3286ab)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Dmitry Baryshkov
71a245b2d6 xserver-xorg: fix CVE-2023-5574 status
If XvFB is enabled, the CVE_STATUS for CVE-2023-5574 should be
'unpatched' rather than the empty string. Otherwise SDPX checker
complains:

xserver-xorg-2_21.1.13-r0 do_create_spdx: Unknown CVE status

(From OE-Core rev: 9965028d74b3c480f7556d299d616999822b79bf)

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0ec5dcbdd7c922df25ce90b04902d9c7c749a8c0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Soumya Sambu
31ea437bf7 python3: Fix CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module. When iterating over names of entries in a zip archive (for example,
methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()",
etc) the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-8088

Upstream-Patch:
7ae310c56a

(From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Soumya Sambu
9541ad9650 python3: Fix CVE-2024-7592
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module. When parsing cookies that contained
backslashes for quoted characters in the cookie value, the parser would use
an algorithm with quadratic complexity, resulting in excess CPU resources
being used while parsing the value.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-7592

Upstream-Patch:
dcc3eaef98

(From OE-Core rev: 3bb9684eef5227e7b1280ee9051884310b0d0b7f)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Soumya Sambu
67aa29393d python3-setuptools: Fix CVE-2024-6345
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for
remote code execution via its download functions. These functions, which are used to download
packages from URLs provided by users or retrieved from package index servers, are susceptible
to code injection. If these functions are exposed to user-controlled inputs, such as package
URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-6345

Upstream-patch:
88807c7062

(From OE-Core rev: 468c5a4e12b9d38768b00151c55fd27b2b504f3b)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-09 06:08:10 -07:00
Bartosz Golaszewski
8637aa34f0 linux-firmware: add a package for ath12k firmware
Add the firmware package for the ATH12K module.

(From OE-Core rev: 553f31396a5d966ab827f1c4b807ef46649080d0)

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
[DB: added rdepends from PN to PN-ath12k]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Changqing Li
d40d52e8de libcap-ng: update SRC_URI
Refer [1], people.redhat.com has certificate issue, so update SRC_URI
to fix do_fetch warning

[1] https://github.com/stevegrubb/libcap-ng/issues/56

(From OE-Core rev: ba5d05337c97ec14d00939f02ecdd6aeab126822)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Changqing Li
8bfdb53247 expect-native: fix do_compile failure with gcc-14
In native.bbclass, CFLAGS is overrided by 'CFLAGS = "${BUILD_CFLAGS}"',
this make "CFLAGS +=" not work for expect-native, use append to make it
also work for native.

(From OE-Core rev: 6974c6548cae62529d96d4ceb3a296707d4adae5)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Quentin Schulz
d72fe250e4 weston-init: fix weston not starting when xwayland is enabled
When xwayland PACKAGECONFIG option is set, xwayland is enabled in
weston.ini. However, if the xwayland module isn't installed, weston will
refuse to start with the following error message:
Failed to load module: /usr/lib/libweston-13/xwayland.so: cannot open shared object file: No such file or directory

Therefore, whenever the xwayland PACKAGECONFIG is set, weston-init
should depend on weston-xwayland to bring this module in.

Fixes: fdbe559c66c9 ("weston.init: enabled xwayland")
(From OE-Core rev: ba66fa75e57f94d35bfd703075ea6706879c63cb)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fa2314125318634108452af4e40c9eeee260767c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Niko Mauno
b5f4d8952a util-linux: Add PACKAGECONFIG option to mitigate rootfs remount error
The 2.39 version of util-linux took new file descriptors based mount
kernel API into use. In relation to this change, the upstream release
notes in
https://github.com/util-linux/util-linux/blob/v2.39/Documentation/releases/v2.39-ReleaseNotes#L14-L21
mention that

  This change is very aggressive to libmount code, but hopefully, it does not introduce regressions in traditional mount(8) behavior.

After observing following failure when booting a board using a bit
older 6.1 series kernel together with initramfs rootfs based boot flow

  [FAILED] Failed to start Remount Root and Kernel File Systems.
  See 'systemctl status systemd-remount-fs.service' for details.

closer inspection revealed:

  demoboard ~ # systemctl status -l systemd-remount-fs.service
  x systemd-remount-fs.service - Remount Root and Kernel File Systems
       Loaded: loaded (/usr/lib/systemd/system/systemd-remount-fs.service; enabled-runtime; preset: disabled)
       Active: failed (Result: exit-code) since Wed 2024-08-14 14:53:48 UTC; 1min 22s ago
         Docs: man:systemd-remount-fs.service(8)
               https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
      Process: 76 ExecStart=/usr/lib/systemd/systemd-remount-fs (code=exited, status=1/FAILURE)
     Main PID: 76 (code=exited, status=1/FAILURE)

  Aug 14 14:53:48 demoboard systemd-remount-fs[76]: /usr/bin/mount for / exited with exit status 32.
  Aug 14 14:53:48 demoboard systemd-remount-fs[81]: mount: /: mount point not mounted or bad option.
  Aug 14 14:53:48 demoboard systemd-remount-fs[81]:        dmesg(1) may have more information after failed mount system call.
  Aug 14 14:53:48 demoboard systemd[1]: systemd-remount-fs.service: Main process exited, code=exited, status=1/FAILURE
  Aug 14 14:53:48 demoboard systemd[1]: systemd-remount-fs.service: Failed with result 'exit-code'.
  Aug 14 14:53:48 demoboard systemd[1]: Failed to start Remount Root and Kernel File Systems.

also consequentially, 'systemctl status' reported:

  State: degraded

When issuing 'strace -ff mount -o remount /' the failure occurred at

  mount_setattr(3, "", AT_EMPTY_PATH, {attr_set=MOUNT_ATTR_RDONLY|MOUNT_ATTR_NOATIME|MOUNT_ATTR_NODIRATIME, attr_clr=MOUNT_ATTR_NOSUID|MOUNT_ATTR_NODEV|MOUNT_ATTR_NOEXEC|MOUNT_ATTR_NOATIME|MOUNT_ATTR_STRICTATIME|MOUNT_ATTR_NOSYMFOLLOW|0x40, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)

After further investigation, The issue was pinpointed to lack of Linux
kernel commit
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=95de4ad173ca0e61034f3145d66917970961c210
("fs: relax mount_setattr() permission checks") in the kernel version
that was being used. Above mitigation was discussed in email related to
then-rejected CVE-2024-26821:
https://lore.kernel.org/linux-cve-announce/2024051606-imaging-entrench-b327@gregkh/T/

After testing with qemuarm64 machine different linux-yocto versions,
it was observed that the issue impacts following versions of currently
supported LTS kernels:
 - 6.6.17 (fixed since 6.6.18 i.e. mount_setattr() returns 0)
 - 6.1.78 (fixed since 6.1.79 i.e. mount_setattr() returns 0)
 - 5.15.164 which is currently the newest of 5.15.y series (i.e. no
   known working version)

Taking the above findings into consideration, add a new PACKAGECONFIG
option removing which enables users to opt-out from using the feature
which can cause issues with a bit older kernels. The option is enabled
only for class-target here, since it otherwise causes following error
during util-linux-native's do_configure task on Debian 11 build host
(mountfd_api requirement fails):

   | configure: error: libmount_mountfd_support selected, but required mount FDs based API not available

Versions 5.10.223, 5.4.279 and 4.10.317 were also tested with qemuarm64
but the issue was not reproduced with those versions - using strace
showed that the mount_setattr call associated with the new mount API
problem was not issued with these LTS kernel versions, which seemed to
be confirmed also by following libmount debug message in these cases:

  415: libmount:     HOOK: [0x7fa115e818]: failed to init new API

Note: In addition to the aforementioned, this change was tested also
briefly using the current latest kernel versions 6.1.104, 6.6.45 and
6.10.3 that using the old mount API with newest kernels did not
introduce any observable regression to the boot flow.

(From OE-Core rev: dc086d9a8613143607af3583c72ed892e20b4d66)

(From OE-Core rev: c0487c8141ae2b9242447b53b71052769db6338f)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Siddharth Doshi
b2f504f0cc vim: Upgrade 9.1.0114 -> 9.1.0682
This includes CVE-fix for CVE-2024-41957, CVE-2024-41965 and CVE-2024-43374

Changes between 9.1.0114 -> 9.1.0682
====================================
https://github.com/vim/vim/compare/v9.1.0114...v9.1.0682

Note:
====
Removed patch "vim-add-knob-whether-elf.h-are-checked.patch" as libelf checks are removed from configure.ac as per
commit 1acc67ac44

(From OE-Core rev: ad71057a09ec6304cee3771122224af011ee9087)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6d2938e53cad5d9bf2e78a5403e9f9fab1db77b4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Archana Polampalli
0069bab748 qemu: fix CVE-2024-7409
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack
via improper synchronization during socket closure when a client keeps a socket open as the server
is taken offline.

(From OE-Core rev: 334f70c408ce5c95f145aa4657f343b023f7e1b4)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Archana Polampalli
0f869ed43b ffmpeg: fix CVE-2024-32230
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at
libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0

(From OE-Core rev: b78fd9322b80734ec54440a01a36323a9b1b83f1)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Simone Weiß
c3e123dda7 curl: Ignore CVE-2024-32928
This CVE affects google cloud services that utilize libcurl wrongly.

(From OE-Core rev: d8aeaaf2d2ac3308af1ec442795e9714f0e6fc8c)

Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 27ac7879711e7119b4ec8b190b0a9da5b3ede269)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Peter Marko
79bc6dd607 curl: Patch CVE-2024-7264
Pick commits per https://curl.se/docs/CVE-2024-7264.html

(From OE-Core rev: 0f1c4b8ae80dc90ee4ed89c4b99da2dca75dd247)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Peter Marko
0504e13c02 libyaml: Ignore CVE-2024-35325
This is similar CVE as the previous ones from the same author.
https://github.com/yaml/libyaml/issues/303 explain why this is misuse
(or wrong use) of libyaml.

(From OE-Core rev: f233c1b7d55fbc8c1968c105905462eed5c793e6)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Yogita Urade
8c533e9242 qemu: fix CVE-2024-4467
A flaw was found in the QEMU disk image utility (qemu-img) 'info'
command. A specially crafted image file containing a `json:{}`
value describing block devices in QMP could cause the qemu-img
process on the host to consume large amounts of memory or CPU time,
leading to denial of service or read/write to an existing external file

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-4467

Upstream Patches:
bd385a5298
2eb42a728d
7e1110664e
6bc30f1949
7ead946998

(From OE-Core rev: 0e309919b8807950cebc8924fc1e15763548b1f1)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-03 05:39:12 -07:00
Lee Chee Yang
c5627ab06f migration-guides: add release notes for 5.0.3
(From yocto-docs rev: fd4654df2d9eb36cae872dca4d23341ed5f9be91)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-08-26 05:18:44 -07:00
Lee Chee Yang
35af162f52 migration-guide: add release notes for 4.0.20
(From yocto-docs rev: 9b822bab8d351a120ebcdbc0d43d709921b88dca)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-08-26 05:18:44 -07:00
Matthias Pritschet
e7bfd398dd ref-manual: fix typo and move SYSROOT_DIRS example
1. Changed one letter (s/B/A), so the sentence is correct again.
2. Moved example from SYSROOT_DIRS_IGNORE into SYSROOT_DIRS section.

(From yocto-docs rev: 74cdaccd4cbe208de037b3b35c2cf0b8aa334748)

Signed-off-by: Matthias Pritschet <matthias@pritschet.eu>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-08-26 05:18:44 -07:00