Commit Graph

10412 Commits

Author SHA1 Message Date
Moritz Haase
22f513741d json-c: Don't build unneeded apps to unblock builds with CMake 4+
Disable build of the apps, as we don't seem to package them (upstream says they
aren't ready, see [0]). They are the only part of the code that doesn't build
yet with CMake 4+. One alternative would be to apply [1], but the PR hasn't been
merged yet by upstream, so we keep it simple.

[0]: 7cee5237dc/apps/CMakeLists.txt (L119-L121)
[1]: https://github.com/json-c/json-c/pull/888

(From OE-Core rev: cb5234acdab200bd43b89416d8d7e9df91af58cc)

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-26 11:02:34 +01:00
Robert Yang
2156cb9598 rpm: Update 0001-CMakeLists.txt-Fix-checking-for-CFLAGS.patch
The patch merged by upstream is different, so backport the one from upstream.

(From OE-Core rev: 65fd3c93285e0a166f0d77a92cc42680d72a6bd1)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-23 21:42:54 +01:00
Alexander Kanavin
dc9faa3cdc meta: remove consecutive blank lines
Some of them were introduced by mass-removal of S = WORKDIR/git assignments;
rather than try to fix up (or redo) just these, I've run this sed command over
the whole tree:

sed -i -z -E 's/([ \t\f\v\r]*\n){3,}/\n\n/g' `find . -name *.bb -o -name *.inc`

The rationale is that more than one empty line is wasting vertical screen space, and
does nothing for readability.

(From OE-Core rev: cedc4ff7c9bcfb22a20e43e47f9759f4007a4f1a)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-20 12:07:27 +01:00
Alexander Kanavin
efb0410d38 meta: set S from UNPACKDIR in recipes that use only local files
There is no need to have two assignments; also setting S from
UNPACKDIR (and not vice versa) is more logical as unpack
task comes first, and tasks that come after unpack use S to access
unpack results.

Also adjust reference test data in selftest/recipeutils to reflect changes in test recipes.

(From OE-Core rev: f64b7e5fb3181734c8dde87b27e872a026261a74)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-20 12:07:26 +01:00
Alexander Kanavin
e1f059f34e meta: set S to be in UNPACKDIR in recipes that explicitly set S
(From OE-Core rev: 7321cc17ae5483f17fe9cdffea7b62acd9d9c3a2)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-20 12:07:26 +01:00
Alexander Kanavin
910442fedc gcc/clang: set S to be in UNPACKDIR
This and some further commits allows removing the 'backwards
compatibility magic' in do_unpack that moves unpacked sources
to where S is set to.

(From OE-Core rev: 6b2f14cd2d110113f1065bdc818ec4e9dbd4b054)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-20 12:07:26 +01:00
Alexander Kanavin
f59a7df3fe meta: remove S in recipes that fetch from git via setting BB_GIT_DEFAULT_DESTSUFFIX
Removing all the S = ${WORKDIR}/git assignments works because BB_GIT_DEFAULT_DESTSUFFIX
is set to match S from bitbake.conf (which itself is set to match typical tarball
releases).

A few recipes are setting S to a sub-directory of the git tree and need
to be adjusted accordingly.

bzip2 recipe is fetching a tarball and separately cloning tests;
adjust the recipe to put the latter into 'bzip2-tests', instead of 'git'.

devupstream.bbclass no longer needs to rewrite S, and is adjusted accordingly.

Adjust scripts/lib/recipetool/append.py to not hardcode 'git' as unpack
destination.

Adjust kernel-yocto.bbclass to use the git unpack variable instead
of hardcoding 'git' (there's also removal of repetition of
string constants and a correction of workdir/unpackdir mismatch in
one of the if-else branches).

Ensure build-appliance-image recipe does not use 'git' as checkout directory for
poky repo, but rather explicitly name it 'poky'.

Ensure reproducible.py code that looks for git repositories does not
hardcode 'git' but uses the destination set by BB_GIT_DEFAULT_DESTSUFFIX.

Ensure recipetool does not write out unneeded S settings into newly
created recipes that fetch from git.

Adjust selftest to not hardcode 'git' as unpack directory.

(From OE-Core rev: f80c07019ddadaf9c5fb890faabfda7920ecd15e)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-20 12:07:26 +01:00
Peter Marko
ea635ace50 go: set status of CVE-2024-3566
NVD ([1]) tracks this as:
cpe:2.3🅰️golang:go:*:*:*:*:*:*:*:*
Running on/with
  cpe:2.3microsoft:windows:-:*:*:*:*:*:*:*

Yocto cve-check ignores the "Running on/with", so it needs to be ignored
explicitly.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566

(From OE-Core rev: c8ce6710d864d237fdf67d2c3d3aa0f0970a2a05)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 22:00:10 +01:00
Trevor Gamblin
0a6432ac3f python3-pytest: upgrade 8.3.5 -> 8.4.1
Changelog for 8.4.0: https://docs.pytest.org/en/stable/changelog.html#pytest-8-4-0-2025-06-02

Add colorama (moved to oe-core from meta-python) and pygments to
RDEPENDS.

Note that 8.4.0 accidentally removed pytest.PytestReturnNotNoneWarning,
which seems to have broken some tests (e.g. python3-pytz). See:
https://github.com/pytest-dev/pytest/releases/tag/8.4.1

(From OE-Core rev: 908c5535506592af654e7efac5b4a28a05da23f6)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 21:54:44 +01:00
Trevor Gamblin
f477b606ff python3: upgrade 3.13.4 -> 3.13.5
Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-13-5-final

ptests look OK:

|443 tests OK.
|
|Total duration: 2 min 43 sec
|Total tests: run=44,050 skipped=2,309
|Total test files: run=471/480 skipped=28 resource_denied=9
|Result: SUCCESS
|DURATION: 164
|END: /usr/lib/python3/ptest
|2025-06-17T14:05
|STOP: ptest-runner
|TOTAL: 1 FAIL: 0

Reproducibility OK:

|2025-06-17 10:34:28,071 - oe-selftest - INFO -  ... ok
|2025-06-17 10:35:04,539 - oe-selftest - INFO - ----------------------------------------------------------------------
|2025-06-17 10:35:04,539 - oe-selftest - INFO - Ran 1 test in 1429.952s
|2025-06-17 10:35:04,539 - oe-selftest - INFO - OK
|2025-06-17 10:35:08,924 - oe-selftest - INFO - RESULTS:
|2025-06-17 10:35:08,924 - oe-selftest - INFO - RESULTS - reproducible.ReproducibleTests.test_reproducible_builds: PASSED (1393.34s)
|2025-06-17 10:35:08,925 - oe-selftest - INFO - SUMMARY:
|2025-06-17 10:35:08,925 - oe-selftest - INFO - oe-selftest () - Ran 1 test in 1429.952s
|2025-06-17 10:35:08,925 - oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=1, skipped=0, failures=0, errors=0)

(From OE-Core rev: 10a6b07637ac818a28da5117b1f46f9563453486)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 21:54:44 +01:00
Trevor Gamblin
633dffe6f8 python3-setuptools-scm: upgrade 8.2.1 -> 8.3.1
Changelog: https://github.com/pypa/setuptools-scm/compare/v8.3.0...v8.3.1

(From OE-Core rev: 7ebc8e0b7a18ec28c9c89e3986bd479085abe9dd)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 21:54:44 +01:00
Trevor Gamblin
474ffe5684 python3-colorama: add recipe
Add existing recipe from meta-python, since pytest lists it as a
dependency. This also puts it in maintainers.inc with myself as
maintainer.

[RP: Switch to use hatching directly]
(From OE-Core rev: 8c06239fdcf983dac759c7d80d6326807c993622)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 21:54:44 +01:00
Moritz Haase
f6fb4c7273 cmake: Correctly handle cost data of tests with arbitrary chars in name
ctest automatically optimizes the order of (parallel) test execution based on
historic test case runtime via the COST property (see [0]), which can have a
significant impact on overall test run times. Sadly this feature is broken in
CMake < 4.0.0 for test cases that have spaces in their name (see [1]).

This commit backports the upstream fix. As repeated test runs are expected to
mainly take place inside the SDK, the patch is only applied to 'nativesdk'
builds.

[0]: https://cmake.org/cmake/help/latest/prop_test/COST.html
[1]: https://gitlab.kitware.com/cmake/cmake/-/issues/26594

Reported-By: John Drouhard <john@drouhard.dev>
(From OE-Core rev: dcbaf42dd74cc0bda7254856589613718ed3f057)

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-19 21:54:43 +01:00
Richard Purdie
5317a214c5 toolchain: Provide abstraction for recipe specific toolchain selection
This change implements a toolchain selection mechanism. Selection is
made using a set of variables, primarily PREFERRED_TOOLCHAIN_TARGET which
defaults to gcc.

It uses the familiar name for toolchain e.g. "gcc" which selects GNU
compiler + binutils as default C/C++ toolchain or "clang" which will
use LLVM/Clang Compiler. Layers an add their own toolchain definitions
too.

There are also PREFERRED_TOOLCHAIN_NATIVE and PREFERRED_TOOLCHAIN_SDK
which will ulitmately allow selection of the toolchain used for the
native/cross and nativesdk/crosssdk compilers. This currently isn't
functional but is essential to the patch to ensure things are set
to the existing gcc support in those cases.

Users would most commonly want to set:

PREFERRED_TOOLCHAIN_TARGET ?= "clang"

in local.conf or other distro specific global configuration metadata.

It is also selectable at recipe scope, since not all packages are
buildable with either clang or gcc, a recipe can explicitly require
a given toolchain using the TOOLCAHIN variable, e.g. glibc can not
be built with clang therefore glibc recipe sets:

TOOLCHAIN = "gcc"

The TOOLCHAIN variable is distinct from the user preference so recipes
with specific requirements can be identified. This also allows different
polcies to be be specified for native/SDK cases in the future.

(From OE-Core rev: 45bdedd213aff8df3214b95ef2a8551c0abd93a0)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 22:26:38 +01:00
Wang Mingyu
aa8425e556 repo: upgrade 2.55 -> 2.55.2
(From OE-Core rev: 38cd05c628b3528db360ac2d3b8f40de124cda74)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
4c87de868f python3-typing-extensions: upgrade 4.13.2 -> 4.14.0
(From OE-Core rev: 590cac310ae962aade2bc2c8c1dcdd83d5c548b0)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
e6656c1ec4 python3-ruamel-yaml: upgrade 0.18.12 -> 0.18.14
(From OE-Core rev: bb219001f206b437fdf862b29a403db4bb65055c)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
2b1a8bd74d python3-pdm: upgrade 2.24.2 -> 2.25.1
Changelog:
=============
- Fix duplicated dependencies added to the lock file when the same dependency with extras is requested.
- Stabilize order of the extras and dependency-groups fields in pylock output.
- Fix Windows 11 install pdm error, which is because of msgpack install failure.
- Change the return type of array_of_inline_tables to list[dict] from list[str]
- Ensure uv resolver to include hash for package files.
- Avoid infinite recursion when reading pyproject.toml with circular file dependencies.
- Support pylock as alternative lock format and make it opt-in by config.
- Search for package metadata in lock file first when reuse strategy is used.

(From OE-Core rev: 121c609e91dd7eb72670513eef8c31a5f2271c89)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
01fc2d7d9f python3-numpy: upgrade 2.2.6 -> 2.3.0
License-Update: Copyright year updated to 2025

(From OE-Core rev: 2ac6a959f32214d958a7a0cf1973a9bc66839a9b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
733b8b5460 python3-hypothesis: upgrade 6.132.0 -> 6.135.9
(From OE-Core rev: 9e861a62b8bd86419b93b1dc697ea990d03b565a)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
c97ee5e3b9 python3-dtschema: upgrade 2025.2 -> 2025.6.1
Changelog:
===========
- Fix a longstanding ordering issue with extracting type information
  from properties which have a reference to another property. 'mac-mode'
  is the one in the Linux kernel.

- Fix a false positive warning about missing
  unevaluatedProperties/additionalProperties

(From OE-Core rev: e36601ca6454ec62ad2dd0db47724e2ad4c240cd)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
51897427a3 python3-cython: upgrade 3.1.1 -> 3.1.2
Bugs fixed
----------
* Attribute lookups failed on the "bool" builtin type.
* Type checks on or-ed union types could incorrectly return false.
* Negative list indexing could accidentally wrap around twice in PyPy and the Limited API.
* Iterating over literal sequences with starred (unpacked) items could infer a wrong
  type for the loop variable and fail to assign the values.
* Calls to C functions taking exception types failed to check for a 'None' argument.
* Fused functions had an incorrect "__module__" attribute.
* The type of Cython implemented functions had an incorrect "__module__" attribute.
* Errors while indexing into "bytearray" or "str" in "nogil" sections could crash.
* "bytearray.append()" could silently accept some invalid character numbers.
* The C++11 "<type_traits>" header was included regardless of the C++ version.
* "PyDict_GetItemStringRef()" was accidentally used in older Limited API versions.
* "abort()" was used but not always available in the Limited API.
* Some dependencies were missing from the "depfile".
* Embedded function signatures were not always separated from the existing docstring.
* "numpy.math" was missing from "Cython/Includes/" and could not be cimported.
* Some tests were adapted for NumPy 2.x.
* Some C compiler warnings were fixed.
* "Cython.Build" was not officially exposing the "cythonize" function.

(From OE-Core rev: ad9e2ba3d7c1af3f7084427eb9ddb0822460b108)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Wang Mingyu
2b1232c314 meson: upgrade 1.8.1 -> 1.8.2
(From OE-Core rev: b585d1cb1d655f191018a50fe3483a5228e68ad6)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:30 +01:00
Jiaying Song
82ee4aeb28 python3-requests: upgrade 2.32.3 -> 2.32.4
Changelog:
https://requests.readthedocs.io/en/latest/community/updates/#release-history

(From OE-Core rev: 5d54d99fe6613062c7597fb2bbd23a641c76d8d4)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-16 17:57:29 +01:00
Yash Shinde
72d932cc5b rust: Upgrade 1.85.1->1.86.0
Rust stable version updated to 1.86.0.
https://blog.rust-lang.org/2025/04/03/Rust-1.86.0.html

* Add pkgconfig-native and openssl to resolve openssl-sys crate
dependency on pkg-config. As per rust document this is a required dependency.

Fixes:
| error: failed to run custom build command for `openssl-sys v0.9.106`
| Could not find openssl via pkg-config:
|   The pkg-config command could not be found.
|
|   Most likely, you need to install a pkg-config package for your OS.
|   Try `apt install pkg-config`, or `yum install pkg-config`,
|   or `pkg install pkg-config`, or `apk add pkgconfig` depending on your distribution

https://crates.io/crates/openssl-sys/0.9.108/dependencies
https://github.com/rust-lang/rust/blob/master/INSTALL.md#dependencies

* Add Ninja as a dependency for building Rust to prevent bootstrap
  build regression.

Fixes:
| Building LLD for x86_64-unknown-linux-gnu
|
| Couldn't find required command: ninja (or ninja-build)
|
| You should install ninja as described at
| <https://github.com/ninja-build/ninja/wiki/Pre-built-Ninja-packages>,
| or set `ninja = false` in the `[llvm]` section of `config.toml`.
| Alternatively, set `download-ci-llvm = true` in that `[llvm]` section
| to download LLVM rather than building it.

* Add bash to DEPENDS to resolve missing dependency for subtree-sync.sh
Fixes:
ERROR: rust-1.86.0-r0 do_package_qa: QA Issue: /usr/lib/rustlib/src/rust/library/portable-simd/subtree-sync.sh
contained in package rust requires /bin/bash, but no providers found in RDEPENDS:rust? [file-rdeps]

* Add do_install:append() task to remove cargo bin from rust native builds.
This resolves the following conflict:

Fixes:
ERROR: libstd-rs-1.86.0-r0 do_prepare_recipe_sysroot: The file /usr/bin/cargo is
installed by both rust-native and cargo-native, aborting

* Update Unicode-3.0 license checksums.
License-Update: Copyright and license files to distributions are updated.

f9c16997dc
  It adds copyright and license files (including HTML versions) to distributions,
  aligns with license compliance tools like reuse, and ensures all required
  license texts are properly included and formatted.

* Disable building of extended Rust tools to reduce build time and filesystem usage.
  Update config.toml to disable building of extended Rust tools that are not required.
  This helps minimize unnecessary build time and filesystem usage.

* The "remote-test-server" bin is now generated in stage2-tools-bin dir
  rather than stage1. Update the test suite accordingly.

* Fix do_package QA issue by packing missing zsh files and directories:

Fixes:
do_package: QA Issue: rust: Files/directories were installed but not shipped in any package:
/usr/share/zsh
/usr/share/zsh/site-functions
/usr/share/zsh/site-functions/_cargo
Please set FILES such that these items are packaged. Alternatively if they are unneeded,
avoid installing them or delete them within do_install

* From v1.86.0, a "self-contained" LLD is built as part of rust
 bootstrap build. This results in additional build time and
 installations. Disable rust-lld in config.toml to prevent it.

 References: https://github.com/rust-lang/rust/pull/135001
             8744b44e6b

* Drop Zdual-proc-macros-additional-check.patch patch
 since it's merged with v1.86.0
 139d6ba054

* LTO config is applied to rustdoc from v1.86.0.
 Rebase 0001-src-core-build_steps-tool.rs-switch-off-lto-for-rust.patch
 which disables it to avoid suffixes in binaries causing non-reproducibility.
 https://github.com/rust-lang/rust/commit/1fe351b

* Restrict tests using "//@only <target_arch>" to avoid failures on riscv64,
  which is now part of default AB testing. Since riscv64 is Tier 2
  with no automated testing, some tests may fail. This approach ensures tests continue
  running on supported architectures while skipping them on riscv64.
  https://doc.rust-lang.org/rustc/platform-support.html#tier-2-with-host-tools

(From OE-Core rev: c064ef18343a956aea397d36d2e7665d6c8afd7d)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 13:12:06 +01:00
Ross Burton
aad1f72e15 python3-ndg-httpsclient: remove unused recipe
The last dependency in core on this recipe was removed in May 2024[1],
and there don't appear to be any other users that I can find.  The last
upstream release was in 2018 so this is now obsolete.

[1] oe-core dfa482f199 ("python3-requests: cleanup RDEPENDS")

(From OE-Core rev: 48b6851420ac54b181647bf23fe1ad86c75fa650)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Peter Marko
7088d89aff go: upgrade 1.24.3 -> 1.24.4
Upgrade to latest 1.24.x release [1]:

$ git --no-pager log --oneline go1.24.3..go1.24.4
6796ebb2cb [release-branch.go1.24] go1.24.4
85897ca220 [release-branch.go1.24] net/http: strip sensitive proxy headers from redirect requests
9f9cf28f8f [release-branch.go1.24] os: don't follow symlinks on Windows when O_CREATE|O_EXCL
a31c931adf [release-branch.go1.24] cmd/link: allow linkname reference to a TEXT symbol regardless of size
03811ab1b3 [release-branch.go1.24] crypto/x509: decouple key usage and policy validation
04a9473847 [release-branch.go1.24] lib/fips140: set inprocess.txt to v1.0.0
db8f1dc948 [release-branch.go1.24] hash/maphash: hash channels in purego version of maphash.Comparable
664cf832ec [release-branch.go1.24] runtime/debug: document DefaultGODEBUG as a BuildSetting
431f75a0b9 [release-branch.go1.24] os: fix Root.Mkdir permission bits on OpenBSD

Fixes CVE-2025-4673, CVE-2025-0913 and CVE-2025-22874 [2].

[1] https://github.com/golang/go/compare/go1.24.3...go1.24.4
[2] https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A

(From OE-Core rev: 25aed3ec02c22857380957783e2926bf3368398c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Harish Sadineni
436bde4c5f binutils: Fix for CVE-2025-3198
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d]
CVE: CVE-2025-3198

(From OE-Core rev: 602d1cab0f8e11925244a27310086b195de70464)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Deepesh Varatharajan
3946dc51ac binutils: Fix CVE-2025-5244
PR32858 ld segfault on fuzzed object
We missed one place where it is necessary to check for empty groups.

Backport a patch from upstream to fix CVE-2025-5244
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5]

(From OE-Core rev: 082c56061e910176dd464702a19858dc0d57431a)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Ross Burton
95ed7d9909 squashfs-tools: clean up PACKAGECONFIG
LZMA isn't supported by the mainline kernel driver, so there's no real
point in enabling it.

Disable LZO by default, as LZO is very obsolete (last released in 2017)
and there are better algorithms available.

Move xattr to the end so it's separate from the compression algorithms.

(From OE-Core rev: 6f65d9372ec639491920fd48df76dfea8afdbfd9)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Ross Burton
b1eaa39797 squashfs-tools: update to 4.7
The REPRODUCIBLE_DEFAULT option was removed in 4.7[1].

Backport a patch to fix missing pthread typedefs, and a patch to fix
missing pid_t typedefs.

Also clean up the tasks to be neater and more concise.

[1] squash-tools ae9914d15293af7c596148aedd997b3058e35d9e

(From OE-Core rev: d588d0fbd8360cc999badaf4c4888be983c14b14)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Ross Burton
fe0b0ae081 squashfs-tools: put version in recipe filename
A recipe that fetches from git but is otherwise a released version
should not be using _git.bb recipe names.

Put the version in the filename, drop the explicit PV, and set the tag
name in the SRC_URI to verify the SHA.

(From OE-Core rev: 8529dbae1b345d1517023dae09637a4baad9ffe8)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-12 11:03:43 +01:00
Soumya Sambu
82ebd782f7 elfutils: Upgrade 0.192 -> 0.193
Refreshed patches:
0001-libelf-Add-libeu-objects-to-libelf.a-static-archive.patch
ptest.patch

Changelog:
Version 0.193 "Bugs erased, stacks traced"

debuginfod: Add CORS (webapp access) support to webapi and --cors option.

            Add --listen-address option for binding the HTTP listen socket
            to a specific IPv4 or IPv6 address.

            debuginfod client now caches x-debuginfod-* HTTP headers
            alongside downloaded files.

libdw: Add dwarf_language and dwarf_language_lower_bound functions.

       Improved support for DWARF6 language metadata as well as DWARF
       language constants for Nim, Dylan, Algol68, V and Mojo.

       dwarf_srclang is now forward-compatible with DWARF6 language
       constants.

libdwfl_stacktrace: Experimental new library interface for unwinding
                    stack samples into call chains, and tracking and
                    caching Elf data for multiple processes, building
                    on libdwfl.  Initially supports perf_events stack
                    sample data.

libelf: elf_scnshndx has been rewritten to be more robust, particularily
        for ELF files with more than 64K sections.

readelf: Improved handling of corrupt ELF data.

         --section-headers output now includes a "Key to Flags" explaining
         section flag meanings.

(From OE-Core rev: ca990ae5a14fa0899dee4fccacf4cac8f212e4e8)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-11 09:34:40 +01:00
Ross Burton
667be7b685 tcf-agent: put version in recipe filename
A recipe that fetches from git but is otherwise a released version
should not be using _git.bb recipe names.

Put the version in the filename and drop the explicit PV.

(From OE-Core rev: b9eada4db556f06c5a76991db2220272cef66fa3)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
bc9d4c7d6b unfs3: upgrade to 0.11
Drop all of the patches that have been merged upstream.

The build no longer needs the flex runtime library so remove flex from
DEPENDS.

License-Update: contributor list updated.

(From OE-Core rev: 3370ef98b6fe74b56b9e6b42b915a536195094cd)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
872edf1865 unfs3: clean up DEPENDS
flex-nativesdk is both the wrong name (should be nativesdk-flex), and in
nativesdk builds it will be a dependency anyway thanks to the DEPENDS
remapping.

Merge multiple assignments into a single line.

(From OE-Core rev: 9a59d2c0be199c4f16143db6c70942fdedd0212c)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
235fe2d9e7 unfs3: put version in recipe filename
A recipe that fetches from git but is otherwise a released version
should not be using _git.bb recipe names.

Put the version in the filename, and drop the explicit PV.

(From OE-Core rev: f288f7dc47a488eb3d388a2513f0908e09c0feca)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
d79324557c libmodulemd: add manpages
Inherit manpages and optionally enable the manpages. They're in the
repository so don't need more tools to build.

(From OE-Core rev: 44ef85ac2b41e78888411cf4577b1128eced6909)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
789d8d0df1 libmodulemd: remove libmagic option
Meson shows this warning in do_configure:

  WARNING: libmagic option is obsolete. libmodulemd can detect
  compression formats without a magic library now. Please stop using
  this option. It will be removed in the future and will cause a meson
  failure.

Remove the option as it's now redundant.

(From OE-Core rev: c053dd1f2143e10d970db849d13df447e736169f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Ross Burton
f1181e56b0 libmodulemd: put version in recipe filename
A recipe that fetches from git but is otherwise a released version
should not be using _git.bb recipe names.

Put the version in the filename, and drop the explicit PV.

(From OE-Core rev: d3d2a8158b81920c51d366a5d38614bf7681e5b0)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:42 +01:00
Richard Purdie
99e842451f compiler-rt/libcxx: Use clang as compiler
(From OE-Core rev: e75b2dee39fc0a35f764caa6b72af2a0b9beb165)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Praveen Kumar
f64ec011d9 python3: upgrade 3.13.3 -> 3.13.4
Security content in this release:
- gh-135034: Fixes multiple issues that allowed tarfile extraction filters
  (filter="data" and filter="tar") to be bypassed using crafted symlinks and
  hard links. Addresses CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, and
  CVE-2025-4517.
- gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-
  “strict” error handler.
- gh-128840: Short-circuit the processing of long IPv6 addresses early in
  ipaddress to prevent excessive memory consumption and a minor denial-of-service.

Includes additional standard library improvements and bug fixes.

References:
https://docs.python.org/3/whatsnew/changelog.html#python-3-13-4-final
https://www.python.org/downloads/release/python-3134/

(From OE-Core rev: d2bcfa826aa3a7bd5d6ab250fb8ba083e2688c8b)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Robert Yang
bcf6af00f4 rpm: 4.20.0 -> 4.20.1
* Rebased:
  0001-When-cross-installing-execute-package-scriptlets-wit.patch
  0016-rpmscript.c-change-logging-level-around-scriptlets-t.patch

* Removed the one which already merged:
  0001-Set-RPM_PLUGINDIR-in-top-level-CMakeLists.txt.patch

* Added a patch to fix rpm-native build error:
  gcc: error: unrecognized command-line option -fhardened
  0001-CMakeLists.txt-Fix-checking-for-CFLAGS.patch

* License-Update: Minor formatting changes as the commit messages said in
  41143b27b6f7320f280aea6014e8f532eb0239d6

(From OE-Core rev: 5d25e1ba4d8850e2c281fc7f24493239bf2f9866)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Guðni Már Gilbert
9ec3fc636a python3: drop old nis module dependencies
libnsl2 and libtirpc were build dependencies for the nis module.

The nis module was deprecated in Python 3.11 and removed in Python 3.13

(From OE-Core rev: 742eca9cb56ab4ad10534181d28de1fdf3880b9f)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Alexander Kanavin
dfaff44d8a m4: simplify path substitutions in ptest
There's no need to setup a fake 'source directory' and
redirect the tests to it; rather it's possible to point
them directly to ptest directory (this needs to be done
twice, in Makefile substitutions, and as a C define during
ptest compilation).

This also eliminates the assumption that S and B are in the
same directory (no longer true when S is in UNPACKDIR).

(From OE-Core rev: 4df67f54cc4f98b63e465fba3dc41ac9813a033e)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Alexander Kanavin
e65d0d156d strace: better sed expression for ptest Makefile
The previous one wasn't particularly readable, and assumed
a particular relationship between S and B. The new one
also works when S is in UNPACKDIR, or anywhere else.

(From OE-Core rev: 584b039fe688ba85fb19b48f2c7209452e248c00)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Alexander Kanavin
3306e1eaf1 qemu-system-native: enable sdl by default
This is already done in target and nativesdk qemu, and in
default templates for both oe-core and poky. Let's just
make it universal.

This also simplifies configurations for bitbake-setup,
as they no longer have to enable sdl separately.

(From OE-Core rev: f52c9d5a59ac19fc6b68c175649697257a9ebdfd)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Deepesh Varatharajan
e71d2c0211 binutils: Fix CVE-2025-5245
PR32829, SEGV on objdump function debug_type_samep
u.kenum is always non-NULL, see debug_make_enum_type.

Backport a patch from upstream to fix CVE-2025-5245
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a]

(From OE-Core rev: f5fd6f691d62052ffddb13461cf221321ff127c3)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
Khem Raj
18ec179172 gcc: Turn FORTRAN into a weak assignment
This ensures that it can be turned on from a distro layer
config metadata e.g. local.conf without forcing overrides

currently we have do something like

FORTRAN:forcevariable = ",fortran"
RUNTIMETARGET:append:pn-gcc-runtime = " libquadmath "
TOOLCHAIN_TARGET_TASK:append = " gfortran"

to enabled fortran support from distro conf file.

After this change we can do it with

FORTRAN = ",fortran"
RUNTIMETARGET:append:pn-gcc-runtime = " libquadmath "
TOOLCHAIN_TARGET_TASK:append = " gfortran"

(From OE-Core rev: 50abae55eda0115d073bbc6552f2fcb4ecbb7949)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00
hongxu
57f4fad751 rpm: correct tool path in macros for no usrmerge
While no usrmerge in sysvinit, some tools defined in rpm macro have wrong path

$ echo 'INIT_MANAGER="sysvinit"'  >> conf/local.conf
$ echo 'IMAGE_INSTALL:append = " rpm busybox"' >> conf/local.conf
$ bitbake core-image-minimal
$ runqemu tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.qemuboot.conf

root@qemux86-64:~# which sed tar rm mkdir cp cat chown chmod gzip grep mv
/bin/sed
/bin/tar
/bin/rm
/bin/mkdir
/bin/cp
/bin/cat
/bin/chown
/bin/chmod
/bin/gzip
/bin/grep
/bin/mv

root@qemux86-64:~# rpm --eval "%{__sed} %{__tar} %{__rm} %{__mkdir} %{__cp} %{__cat} %{__chown} %{__chmod} %{__gzip} %{__grep} %{__mv}"
/usr/bin/sed /usr/bin/tar /usr/bin/rm /usr/bin/mkdir /usr/bin/cp /usr/bin/cat /usr/bin/chown /usr/bin/chmod /usr/bin/gzip /usr/bin/grep /usr/bin/mv

Here to explain how __rm was set in rpm during build. The build system
of rpm is cmake. Take rpm rpm-4.19.x for example:

The '__RM rm' is defected by findutil [1], and function findutil
calls find_program to search for tool, if not found on host, then
hardcode with "/usr/bin" prefix [2]

Yocto explicitly set OECMAKE_FIND_ROOT_PATH_MODE_PROGRAM = "ONLY" [3][4]
to search tools from CMAKE_FIND_ROOT_PATH [5] which locates in recipe sysroot,
if not found in recipe sysroot, hardcode with "/usr/bin" prefix

If "${base_bindir}" != "${bindir}, explicitly correct tools in rpm
macros, use ${base_bindir} to instead original ${bindir}. Only do the
operation for target, it is not necessary for native and nativesdk,
because most host distribution supports usrmerge

After applying this commit, on target:

root@qemux86-64:~# rpm --eval "%{__sed} %{__tar} %{__rm} %{__mkdir} %{__cp} %{__cat} %{__chown} %{__chmod} %{__gzip} %{__grep} %{__mv}"
/bin/sed /bin/tar /bin/rm /bin/mkdir /bin/cp /bin/cat /bin/chown /bin/chmod /bin/gzip /bin/grep /bin/mv

root@qemux86-64:~# ls /bin/sed /bin/tar /bin/rm /bin/mkdir /bin/cp /bin/cat /bin/chown /bin/chmod /bin/gzip /bin/grep /bin/mv
/bin/cat    /bin/chmod  /bin/chown  /bin/cp     /bin/grep   /bin/gzip   /bin/mkdir  /bin/mv     /bin/rm     /bin/sed    /bin/tar

In order to save size, this commit does not add these tools to
runtime depends, user should explicitly add them if necessary
(such as use rpm to build packages)

[1] https://github.com/rpm-software-management/rpm/blob/rpm-4.19.x/CMakeLists.txt#L121
[2] https://github.com/rpm-software-management/rpm/blob/rpm-4.19.x/CMakeLists.txt#L59
[3] https://git.openembedded.org/openembedded-core/commit/?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3
[4] https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_ROOT_PATH_MODE_PROGRAM.html
[5] https://git.openembedded.org/openembedded-core/tree/meta/classes-recipe/cmake.bbclass?id=f4ea12f6635125ee793f4dd801c538c0186f9dc3#n123

(From OE-Core rev: c89c7177be2df5d2be44478a6ac43b35ad46db9e)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-06-09 17:43:41 +01:00