The pypi class default python:pyyaml vendor prefix matches nothing,
so PyYAML CVEs are not evaluated at all. The databases use two
vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a
space, not expressible as a vendor:product pair) in CVE-2020-1747's
CNA record. Use the bare product name to cover both.
All four existing CVEs (CVE-2017-18342, CVE-2019-20477,
CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as
not affected at 6.0.1.
Note: Original commit was for python3-pyyaml_6.0.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyyaml_6.0.1.bb.
(From OE-Core rev: 666e25c1fe1347da307726afd87554ffc080ed12)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89a0ba3c2da2a7755bafb28afbf75dc7112e2549)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The CVE databases track xmltodict as xmltodict:xmltodict, so the
default python:xmltodict vendor prefix never matches and its CVEs
are not evaluated at all. Use the exact vendor:product pair.
Note: Original commit was for python3-xmltodict_1.0.4.bb. This is
adjusted for scarthgap where recipe version is python3-xmltodict_0.13.0.bb.
(From OE-Core rev: 918d1fd448ff96431197031e5adb1be658156bc2)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD tracks certifi as certifi:certifi, so the default python:certifi
vendor prefix never matches and its CVEs are not evaluated at all.
Use the exact vendor:product pair.
For scarthgap, python3-certifi is 2024.2.2. CVE-2024-39689 affects
certifi versions before 2024.7.4, but this recipe already carries
CVE-2024-39689.patch. With this mapping, cve-check can evaluate that
existing backport against the correct NVD product instead of missing
the CVE mapping.
Note: Original commit was for python3-certifi_2026.2.25.bb. This is
adjusted for scarthgap where recipe version is
python3-certifi_2024.2.2.bb.
(From OE-Core rev: e6773f4c819544eae93f3efa7d2101b448db4ebb)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 26c49743ec431a3cc39803664eec8851be75756e)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The pypi class default python:idna matches nothing in the CVE
databases, which track the Python idna CVEs as:
* CVE-2024-3651 (kjd:internationalized_domain_names_in_applications) [1]
* CVE-2026-45409 (kjd:idna in the CNA record, same NVD CPE as above)
Set both vendor:product pairs.
For scarthgap, python3-idna is 3.7. CVE-2026-45409 affects idna
versions before 3.15, so this metadata change will expose that CVE as
applicable/unpatched. The fix for CVE-2026-45409 needs to be handled
separately.
The bare product name is not an option here: it would also match
"servo:idna", the Rust idna crate (e.g. CVE-2024-12224).
Note: Original commit was for python3-idna_3.11.bb. This is adjusted
for scarthgap where recipe version is python3-idna_3.7.bb.
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3651
(From OE-Core rev: 70a1b17edf909715065c1d727f989fc07f8db8bf)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48428c0fe22d8ecbfa53efffb28173d4d37539e6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The pypi class default python:pyopenssl matches nothing in the CVE
databases, which have used four vendor spellings for pyOpenSSL over
the years:
* CVE-2013-4314 (jean-paul_calderone:pyopenssl)
* CVE-2018-1000807 (pyopenssl:pyopenssl)
* CVE-2018-1000808 (pyopenssl_project:pyopenssl)
* CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records,
pyopenssl:pyopenssl in the NVD CPEs)
Set all four vendor:product pairs.
For scarthgap, python3-pyopenssl is 24.0.0. CVE-2026-27448 and
CVE-2026-27459 are fixed in 26.0.0, so this metadata change will
expose those CVEs as applicable/unpatched. The fixes for these CVEs
need to be handled separately.
Note: Original commit was for python3-pyopenssl_26.0.0.bb. This is
adjusted for scarthgap where recipe version is
python3-pyopenssl_24.0.0.bb.
(From OE-Core rev: f6cc7e0c0a4a906244fc8cd4b45706d42a931fce)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The QB_DEFAULT_BIOS allows setting the -bios parameter of QEMU, which
can be used to emulate U-Boot, for example.
(From yocto-docs rev: dc9a5aa19ca2a0b5ad866f0329b8a030542ca0c6)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f2eef5268aa94b31e986e4eef4ce1fe0094b70c4)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Document the variables in qemuboot.bbclass that allow customizing how
the QEMU guest is instantiated.
(From yocto-docs rev: 3c485a4838d7ca721d2d00867ff3d98d9e999c69)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 392ef512b05da8170d5e329c2750b2ada0a06cbd)
[AG: remove QB_TAP_NAMESERVER, doesn't exist on scarthgap]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The CROPS[1] project hasn't been updated in two years which makes it
incompatible with our current system requirements.
Remove references to CROPS from the documentation, and in most cases
replace them by mentioning that a container can be used (setup for it
left to the user).
Note that the project is working on reference containers[2] which may
replace this at some point (not confirmed).
[1]: https://github.com/crops/poky-container/
[2]: https://lore.kernel.org/yocto/8286fd3b-1b05-47bf-95e4-0b9f0f5411cb@app.fastmail.com/
(From yocto-docs rev: 9d795bc96ad209c1ab7c007c2aae92b60a5d6ee9)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 95cf1ba327a3bcdabadf0ee96d6bf38d05c4c3dc)
[AG: fix conflicts in start.rst]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Expand the existing note section under "Submitting Changes to Stable
Release Branches" to provide guidance on (not) submitting large or
complex changes.
Concerns around the increased size and complexity of patches being
submitted for the stable branches (mostly driven by complex
vulnerabilities found and/or fixed via LLM agents) were discussed with
the stable maintainer and the Yocto Project TSC. This patch reflects the
TSC decision that we should push back on these changes to preserve the
maintainability of our stable branches.
Cc: Yoann Congal <yoann.congal@smile.fr>
(From yocto-docs rev: 3adedbd203b894924fb75d187a8cea1d92aaa700)
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 33bf0ff80df6be2aad8eb081752648d3c408a54b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
SPDX3 support was backported to scarthgap with 9c9b9545049a ("backport:
SPDX 3.0 fixes and tasks from upstream version Walnascar") in OE-Core,
but the Scarthgap documentation doesn't reflect it. Update the
documentation to show how to enable and remove SPDX2 statements.
(From yocto-docs rev: 365377da1b810c456f1d966ae8ffeed1cd534c10)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- CVE-2026-59998 concerns an undocumented limitation of
GSSAPIStrictAcceptorCheck in Windows Active Directory
environments [1].
- Upstream OpenSSH 10.4 only documents the existing behavior and
provides no code remediation [2].
- The recipe disables Kerberos/GSSAPI by default. Mark the CVE
not-applicable-config when PACKAGECONFIG lacks kerberos, and
unpatched when kerberos is enabled.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
[2] 8058c5bdb5
(From OE-Core rev: 543550522f831479f07d332a40ba343c53ae1065)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: See previous version of this patch for context about ignoring vs
this CVE vs patching:
https://patchwork.yoctoproject.org/project/oe-core/patch/20260720175518.3546447-3-devanshp@cisco.com/#40497 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Do not fail if only some Cargo.lock files are empty. Only fail, if there
are absolutely no dependencies found in any Cargo.lock.
This fixes the following error message, which would occur with "bitbake
-c update_crates python3-orjson":
ERROR: python3-orjson-3.10.17-r0 do_update_crates: Execution of '.../python3-orjson/3.10.17/temp/run.do_update_crates.70693' failed with exit code 1
ERROR: Logfile of failure stored in: .../python3-orjson/3.10.17/temp/log.do_update_crates.70693
Log data follows:
| DEBUG: Executing python function extend_recipe_sysroot
| NOTE: Direct dependencies are ['.../sources/oe-core/../oe-core/meta/recipes-devtools/quilt/quilt-native_0.69.bb:do_populate_sysroot', 'virtual:native:.../sources/oe-core/../oe-core/meta/recipes-devtools/patch/patch_2.8.bb:do_populate_sysroot', 'virtual:native:.../sources/oe-core/../oe-core/meta/recipes-devtools/python/python3_3.13.9.bb:do_populate_sysroot']
| NOTE: Installed into sysroot: []
| NOTE: Skipping as already exists in sysroot: ['gettext-minimal-native', 'cmake-native', 'libtool-native', 'quilt-native', 'texinfo-dummy-native', 'openssl-native', 'expat-native', 'ncurses-native', 'util-linux-libuuid-native', 'zlib-native', 'libedit-native', 'make-native', 'patch-native', 'perl-native', 'python3-native', 'bzip2-native', 'xz-native', 'zstd-native', 'attr-native', 'gdbm-native', 'libffi-native', 'sqlite3-native']
| DEBUG: Python function extend_recipe_sysroot finished
| DEBUG: Executing shell function do_update_crates
| Traceback (most recent call last):
| File "<stdin>", line 41, in <module>
| File "<stdin>", line 12, in get_crates
| ValueError: Unable to find any candidate crates that use crates.io
|
| The above exception was the direct cause of the following exception:
|
| Traceback (most recent call last):
| File "<stdin>", line 43, in <module>
| ValueError: Cannot parse '.../python3-orjson/3.10.17/sources/orjson-3.10.17/include/cargo/simdutf8-0.1.5/Cargo.lock'
| WARNING: exit code 1 from a shell command.
ERROR: Task (.../sources/oe-core/../meta-openembedded/meta-python/recipes-devtools/python/python3-orjson_3.10.17.bb:do_update_crates) failed with exit code '1'
(From OE-Core rev: 59f1965358f59457857c920ed836998509450d9a)
Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1ef39b3fa731fb121d338aea2b1ac004620063e0)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html
and the fix essentially consolidates the fact that HTTP2 stream
dependency is deprecated.
While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not
actually used so the affected part of the code is not compiled. For
instance, in the do_configure logs:
"""
(...)
HTTP2: no (--with-nghttp2, --with-hyper)
(...)
"""
Ignore this CVE unless 'nghttp2' is enabled.
(From OE-Core rev: 637ce45a66ff7125b98fc126321b31cb0cf6bf0f)
Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.
Note: Original commit was for python3-pyasn1_0.6.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyasn1_0.5.1.bb.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: 4c2a8f74464cf3b7143bd9e978eef976aea6315e)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD registers ply as dabeaz:ply, so the default python:ply vendor
prefix never matches and no CVEs are reported. Use the exact
vendor:product pair.
CVE-2025-56005 will then show as unpatched; no fixed release exists.
Suggested-by: Paul Barker <paul@pbarker.dev>
(From OE-Core rev: 069cda2549b0dd841914c5b860f138f6db8b3977)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD lists it as cryptography.io:cryptography and CNA lists it as
pyca:cryptography, so set both vendor:product pairs to match correctly
and precisely.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: f4029c635ce3dc1470352d3d3381d9fef19426ed)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to
extend packaging behavior.
Layers can now append custom functions via PACKAGEFUNCS += "func_name"
and they will run before emit_pkgdata generates package metadata.
(From OE-Core rev: 358a847c9dfaf56291f9eb5e2f150cae56044c7c)
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa85baff9ebdd3f932811c3b43d1918c38373cb9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Add trailing space to value field in :prepend assignments, in
order to avoid providing examples which could lead the users to risk
inadvertent string concatenation.
(From yocto-docs rev: 8496602a28b19fec9ee55dc45572b31a32c70443)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b2f611f498eb22ca42dc436e3cde0c60ad2ba72f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Running 'devtool modify linux-yocto' with latest version of OE-Core and
linux-yocto did not prompt the error, so remove the note.
(From yocto-docs rev: 6a5efba38c8edf17a28cc0bd9f682df582c71705)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit e8debfba3458618a25d21286581adc22bf78a836)
[AG: conflicts: note had different path, remove anyway]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
According to [1]
As of the current version 1.0.8, bzip2 --version will print version
info but it will also continue compressing stdin:
$ ./bzip2 --version
bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019.
Copyright (C) 1996-2019 by Julian Seward.
This program is free software; [...]
bzip2: I won't write compressed data to a terminal.
bzip2: For help, type: `bzip2 --help'.
This is a long-standing bug, not new to 1.0.8 -- the same code
(license() followed by break, with no exit) exists in bzip2 1.0.6 and
earlier. The upstream bzip2 master branch on GitLab already includes
this fix.
Debian (and its downstreams like Ubuntu) will patch this out [2],
making the < /dev/null unnecessary, port a part of debian patch
to fix the issue
[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/
(From OE-Core rev: 762321beb0260b1411c7f98f13458ec99a118280)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b)
[Jaipaul: backport to scarthgap -- added commit message context that this is a
long-standing bug (not new to 1.0.8), updated Upstream-Status in patch
to actual mailing list URL in the patch file, this patch is already present on master,
wrynose and walnascar branches using the same bzip2 1.0.8]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Backport the upstream fix for CVE-2026-4367, in which the
`xpmNextWord()` function could attempt to read beyond the file's
end due to improper validation of file boundaries.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4367
(From OE-Core rev: b3f8956f38b2f2cb0f260ab8853e9d028831f420)
Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
