CVE is effectively disputed - yes there is stack exhaustion but no bug and it
is building the parser, not running it, effectively similar to a compiler ICE.
Upstream no plans to address and there is no security issue.
https://github.com/westes/flex/issues/414
(From OE-Core rev: 0cae5d7a24bedf6784781b62cbb3795a44bab4d1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This function does something similar to the bitbake fetcher file search
paths and is an old remnant of how this could have once been handled. There
are no users in OE-Core and we'd always prefer the fetcher to handle this now
as it handles signatures correctly. The direct OVERRIDES reference would
likely break any user of the function. Remove it to be safe and ensure it
isn't being used anywhere.
(From OE-Core rev: d49ba0243e3d28672d16cd02753eb7e85d91bbab)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
BBHASHDEPS was removed from bitbake in April 2014, with the following
commit:
92526eadd09d "bitbake-worker: Drop BBHASH variables"
so let's remove mentions from the docs.
(Bitbake rev: 7816a8de70adc3806a3739384cf08b281b4ee401)
Signed-off-by: Quentin Schulz <foss@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are many more instances of "filename" or "filenames" than
of "file name" or "file names".
The winner takes it all!
(Bitbake rev: dcd115176f63256f10db0b24b563683c4bdf8f96)
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
vim uses libcanberra to implement sound, currently its ok for target
since we have captured dependencies in recipe sysroot but things go a
bit out of control when building vim-native, where configure starts to
poke at host system and if it find libcanberra then silently enables it
lets make it consistent
(From OE-Core rev: 7bf11ce14336eff07a4e7216fb485f98757088ed)
(From OE-Core rev: 70de1dbb660461bdf0613494f53ec4c78738ae2a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This removes BSD-0-Clause, Nauman, tcl and vim and adds mappings for
them to their SPDX counterparts (0BSD, Naumen, TCL and Vim).
It also removes FreeType, which already had a mapping to FTL.
(From OE-Core rev: 35d699c479b6ce6acafbf75fb003618aaad094d7)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If systemd is built with fdisk support[1] and the openssl and cryptsetup
PACKAGECONFIG are enabled, systemd-homed[1] is automatically enabled.
The org.freedesktop.home1.conf file was forgotten, so this commit adds
the file and make enabling homed a explicit choice.
systemd-homed.service and systemd-homed-activate.service have a Also= on
each other, so "systemctl" has been fixed to handle the circular
dependency.
userdb isn't strictly speaking needed for homed but "systemctl" can't
handle the missing unit file and upstream recommend enabling both[3].
[1] Automatically enabled if the fdisk dependency is installed which it
is as util-linux is pulled in by systemd
[2] https://www.freedesktop.org/software/systemd/man/systemd-homed.service.html
[3] 871dc8d644
(From OE-Core rev: fff339b5bd7789db5d0c024fc84490ac17fa4fe9)
Signed-off-by: Kristian Klausen <kristian@klausen.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Minor tweaks to top-level README:
- add missing line for overview manual
- correct manual names to match their *actual* names
- point reader at docs.yoctoproject.org for online docs
(From yocto-docs rev: 0ce9097728dbdca926fdf7065490207d09a34cb0)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Both SYSROOT_DIRS and SYSROOT_DIRS_BLACKLIST have more current
values.
(From yocto-docs rev: 750ae3fca42e273cd533f9c8b678c2e144164191)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <foss@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since there are actually four listed requirements, just drop the
number to avoid future issues.
(From yocto-docs rev: 612015dc227600d23956402eab7f324e0c8fd42a)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <foss@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some minor grammatical and structure tweaks.
(From yocto-docs rev: 505f9b21898475746d401c8ab79b95f3dc4d02e7)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <foss@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Just a collection of:
- grammar tweaks
- space fixes
- font changes
(From yocto-docs rev: c49984f89cd2295c54f01730649aaca83eaf515e)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without this, readers could think that "devpyshell" is a script,
at least until they read the remainder of the section.
(From yocto-docs rev: fe1e3323a633acf51d64cfb6c4bdd2ecd324a79e)
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reviewed-by: Quentin Schulz <foss@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In the example in section 3.9, the call to d.getVar() needs to have
the additional argument of "False" so that the output is not expanded.
(From yocto-docs rev: ae364e76a322278e7fe37aeecaa5e854d0a0efee)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <foss@0leil.net>
Tested-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of putting the full license text for non-SPDX licenses into the
recipe and every package, use links to the recipe from the packages if
possible.
(From OE-Core rev: 9220d35dc9071ebbe991117af8261ad99f321bb3)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For licenses which are not known to SPDX, find and embed the actual
license text in an ExtractedLicesingInfo block.
(From OE-Core rev: c638f4ae579520cab8cf30e1b4306bd0e2d2a788)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
add_extracted_document() is only called if the license isn't known to
SPDX, so there's no need to check again.
(From OE-Core rev: 03f084251510c810c8434d9ddd459187827c1ca8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
spdx-licenses.json contains an array of licenses objects. As we'll be
searching it often, convert that to a dictionary when we parse it.
(From OE-Core rev: 3405d9114ca9fe4ba820e0025c91670d1a5150b1)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that recipetool writes BSD-3-Clause, update the test appropriately.
(From OE-Core rev: e4cb21609e3e95725b235de48458ab3c111ee9c1)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport an upstream patch for the CVE.
(From OE-Core rev: 87191ed0303f6552865ad1edcacd674c57f2010c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* the output is shown 3 times with default configuration and 5 times when --verbose
is being used with knotty, there might be other use-cases where we actually need
this, but until the logging is resolved better, setting this to empty looks like
more reasonable option (considering that e.g. log.do_compile from chromium-x11
can be over 50MB long, generating 150MB+ cooker log)
* more details in:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14542
(From OE-Core rev: ede2e0df7982777212b8c25195d41ce9e57562b5)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The PyPI license classifiers include "OSI Approved: BSD", which does not
specify which of the many variations of BSD license it actually means.
The generic "BSD" license in the oe-core set is actually BSD-3-Clause.
>From a random sample of ten PyPI modules that use "BSD", they are all
BSD-3-Clause. As we expect the recipe maintainer to verify the license
anyway, and this matches the previous license text, explicitly set the
license to BSD-3-Clause.
(From OE-Core rev: a879fff9af31e45b1acc3f19a3c2a7eaf6319ad4)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bulk of hdparm is under a unique license. Set the correct BSD
version, and specify that the hdparm license is also used.
(From OE-Core rev: 9a2e2251e34d020cf24d6552c06d7508df3199fa)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"BSD" is ambiguous, ffmpeg comprises of several licenses which are
BSD-like.
(From OE-Core rev: 50ba15c0a6867fcb0498a2c2c5449aa96e5f4bde)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"BSD" is ambiguous, use the precise licenses BSD-3-Clause-Attribution
and BSD-3-Clause.
(From OE-Core rev: dceba0bcdb14a117cf8a77448a3bbc8410d96a73)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"BSD" is ambiguous, use the precise license BSD-2-Clause-Patent.
(From OE-Core rev: 3e5c91e3517f15c25ecf56877a15962427dd0f3b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This recipe is just a single data file from shadow, but as we can't
easily tell what license that specific file is under just copy the full
license statement.
(From OE-Core rev: f0e2f3b1f855ea6e184bd1d8d796279fedcbfa33)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"BSD" is ambiguous, use the precise license BSD-3-Clause.
(From OE-Core rev: b12cbda349658ddef8cb72d5738c094c2b009e7e)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The python-async-test recipe is now BSD-3-Clause.
(From OE-Core rev: d819d86b482d397425043c7f478712a7f225bdae)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The xinetd license is superficially BSD-like, but it isn't BSD. Now that
we have the full SPDX license set in oe-core, use the specific xinetd
license.
(From OE-Core rev: 9d99cb5273ee0a775307afe13c14f01cb37426e0)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has moved to GitHub. Whilst it's now too late to upgrade to
the latest release, we can add upstream check variables so that we get
notified we're out of date.
(From OE-Core rev: 9a86a68a41be5bc6f32f9c86d8de7576c5dffff4)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"BSD" is ambiguous, use the precise license BSD-3-Clause.
(From OE-Core rev: 78a8427eb11d2931afcbf2a24d2441bf08bac0cf)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The lsof LICENSE is superficially BSD-like, but it isn't BSD. Now that
we have the full SPDX license set in oe-core, use Spencer-94.
(From OE-Core rev: 5c1d61d1d4dfacb643a366285c0392e6a31087ed)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream don't believe this is an issue.
(From OE-Core rev: adf7bafee3f8884e525b5639ba092a1cd8e3beb9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Specifically, the actual recipe now has LICENSE=MIT.
(From yocto-docs rev: 9f64931308f73607c40ed1eb8cf915666b6ff90a)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This log checking fix is needed for both qemux86 and qemux86-64 so move
to the common section.
[YOCTO #14528]
(From OE-Core rev: 2475ce68f0bc1f342c75364dfcfaf7f30499badf)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With the previously added general git repo fallback rule the server
specific fallback mirrors for git.savannah.gnu.org and
git.yoctoproject.org are redundant. Remove them.
(From OE-Core rev: da864dbed0c29b3e3f0d1676ec1bb974f332ff3f)
Signed-off-by: Daniel Wagenknecht <dwagenknecht@emlix.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Git hosting servers that require a slightly different URL when accessing
repositories via https protocol instead of the git native protocol
are not uncommon (servers using cgit as web UI). Provide a general rule
to try HOST/git/PATH via https as git repo fallback.
(From OE-Core rev: 0682697987873ab395360035b70630acfe66cd3a)
Signed-off-by: Daniel Wagenknecht <dwagenknecht@emlix.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
readline uses ncurses for terminal capabilities database, but it fails to
specify it correctly in the pkg-config .pc file, resulting in:
Requires.private: termcap
As ncurses by default provides newer terminfo instead of termcap, there's
no termcap.pc in the system and pkg-config fails when linking with readline:
readline.pc X-> termcap.pc
Help configure script to set pkg-config to use ncurses for the correct
terminal capabilities database:
Requires.private: ncurses
This fixes pkg-config dependency chain:
readline.pc -> ncurses.pc -> tinfo.pc
(From OE-Core rev: b4364cc44ae47d3b41a4fd181c904ae97e213842)
Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We don't want this warning causing problems on the AB, so leave it
comment out for now
(From OE-Core rev: d41018311abf91899645b8f3160db540abdb5398)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Native recipes do not produce packages and should not process them,
otherwise it can trigger an error in read_subpackage_metadata
(From OE-Core rev: ea077b1ff6a4ccd5241a085bf9a3f67011e0f7bf)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stop filtering the runtime dependencies based on do_create_sdpx (makes
it only pick up things in DEPENDS) and instead include all task
dependencies that are not the current PN. This allows other dependency
methods to be picked up correctly, for example the dependency on the
kernel used by kernel modules.
(From OE-Core rev: c9659562cf88a820c668ff1eb20814dcb4829392)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The Public Domain license (PD) needs a special exception in the license
processing since there is no common license text to be extracted for
these licenses.
(From OE-Core rev: fe5b757712aa99ff1ff10d2304ac320100635200)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
