Commit Graph

5419 Commits

Author SHA1 Message Date
Ross Burton
2e060e2df7 python3: support recommends in manifest
Add support for runtime recommends along with runtime depends to the manifest.

(From OE-Core rev: 16cc9a2ca559d978c6d0e648c18c297255b69dcc)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-03 23:56:01 +01:00
Ross Burton
53f4ad18df python3: remove empty python3-distutils-staticdev
distutils doesn't ship any static libraries, and the files this should pick up
do not exist.  Copy/paste gone wrong maybe?

(From OE-Core rev: afbca8da4ddd6c3dd01bb44af43aee9e80cae512)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-03 23:56:00 +01:00
Alexander Kanavin
8118295209 meson: add a backported patch to address vala cross-compilation errors
(From OE-Core rev: c8ac42f5110c9b8e4f2c275332651df152013c0a)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-03 23:56:00 +01:00
Alexander Kanavin
0aa7a34141 meson: update 0.50.1 -> 0.51.1
Drop backports.

Rebase other patches.

(From OE-Core rev: 3251ce439ea164fcf230dcede06da1a05b5c6775)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-03 23:56:00 +01:00
Adrian Bunk
1ea5b2f074 mtd-utils: Upgrade to 2.1.1
Add zstd PACKAGECONFIG to disable the zstd support that upstream
enables by default, zstd is not in oe-core.

(From OE-Core rev: a87cf6a1693bbeac0f03290c1cb0ddf0ad1cf9bd)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Anuj Mittal
c34e37a56e python: CVE-2019-9947 is same as CVE-2019-9740
See:
https://bugs.python.org/issue30458

(From OE-Core rev: fa434cf1ae621f106d823c92f7e3a16172e7479f)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Anuj Mittal
a6854bc41b python: fix CVE-2018-20852
(From OE-Core rev: 04fc80b2c77a177601584500f0f3048d80095ad7)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Ross Burton
da6a602398 perl: add PACKAGECONFIG for db
perl-cross makes it easy to cleanly disable the use of Berkeley DB if desired,
so add a PACKAGECONFIG for this.

More of the dependencies (such as gdbm) can be controlled in the same way, but
Berkeley DB is a prime contender: it's a large library which we have to ship an
old release for due to licensing issues, so there are users who may want to
strip it out of builds entirely.

(From OE-Core rev: e3860098dadd0b1db97fb0414aae6abfc234b245)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Ross Burton
dd949e7545 perl: fix whitespace
There was some tabs embedded in spaces, fix those.

(From OE-Core rev: 96cf9a881405faec5fb6f3f305fd29c5f14fd52f)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Alexander Kanavin
65c3253b5b createrepo-c: upgrade 0.14.2 -> 0.14.3
(From OE-Core rev: f9ef3abfdfc5df19619328117813561e408d2147)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Alexander Kanavin
b7bc14c397 libmodulemd: update to 2.6.0
(From OE-Core rev: 93e52d2d8985f7bba6a03a7a56fdc22087a62469)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Alexander Kanavin
5d1ba9eee1 btrfs-tools: update 5.1.1 -> 5.2.1
(From OE-Core rev: 53dc41128d7f976a3a0f0730b5a2dff61f8c1bdf)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Anuj Mittal
df9d8dbe75 patch: fix CVE-2019-13636
(From OE-Core rev: f201b9db5d148cb9fe03b78ca085493a27f7e24c)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Bartosz Golaszewski
57d702ed5d qemu: add a patch fixing the native build on newer kernels
The build fails on qemu-native if we're using kernels after commit
0768e17073dc527ccd18ed5f96ce85f9985e9115. This adds an upstream
patch that fixes the issue.

(From OE-Core rev: ef3af3a43d137d1e09e3fe4dbe462197fe7af4bc)

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 13:50:46 +01:00
Kai Kang
111f9ab083 subversion: add packageconfig boost
subversion checks whether build with boost during do_configure. If boost
exists on build machine, it causes configure-unsafe QA issue:

| ERROR: subversion-1.12.0-r0 do_configure: QA Issue: This autoconf log
|  indicates errors, it looked at host include and/or library paths
|  while determining system capabilities.
| Rerun configure task after fixing this. [configure-unsafe]

Add a PACKAGECONFIG 'boost' to fix the issue.

(From OE-Core rev: 237478724be75a4efeebafe07b46a353894ee4ca)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 22:45:30 +01:00
Oleksandr Kravchuk
768696d9c9 python3-git: update to 2.1.12
Got rid of python-git since there is no python2 version of the package.

(From OE-Core rev: dd9d95e8394a7a318538c7cabd27c82e4bc9e029)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-26 08:41:39 +01:00
Oleksandr Kravchuk
f465205d03 python3-pip: update to 19.2.1
(From OE-Core rev: dded7fc1bc7caf22837d13dabbc66b84b15b872b)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-26 08:41:38 +01:00
Khem Raj
3ab89fa06f strace: Upgrade to 5.2
License-Updtate: Copyright years changed
4b4a0e5a6e (diff-7116ef0705885343c9e1b2171a06be0e)

Drop backport patch for mips o32 build fix
Refresh patches to apply on 5.2

(From OE-Core rev: abeb32772b8b3a144e468e5a27b1a31f646317e4)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-26 08:41:38 +01:00
Oleksandr Kravchuk
f2d6ec0af1 python3-mako: update to 1.0.14
Got rid of python-git since there is no python2 version of the package.

(From OE-Core rev: cbdb000632b6320fe9741b750a7cf3fe5b3ec640)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-23 22:26:28 +01:00
Oleksandr Kravchuk
dfbea8ebfd python3-docutils: update to 0.15
(From OE-Core rev: 74b5d8df4e26fcfa8f1bbb91c5184331185973fc)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-23 22:26:28 +01:00
Oleksandr Kravchuk
76e59cdf85 python3-scons: update to 3.1.0
(From OE-Core rev: 03a04b197dd0d7af7050a132b4f0ad376b81821d)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-23 22:26:28 +01:00
Khem Raj
d5b73bdb45 elfutils: Fix eu-* utils builds for musl
Re-organize the musl patches in three different areas namely
libs, utils and tests, this will help maintain them in future
version bumps

Add obstack dependency on musl targets which is needed for eu-*

PN and PN-binutils is not empty anymore on musl

(From OE-Core rev: a747239978e63f22d4107e6e12c75b5f78043cce)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-23 22:26:28 +01:00
Oleksandr Kravchuk
0bebaa64c6 python3-pbr: update to 5.4.1
(From OE-Core rev: e59c6720271be8e3f1e93c301078a580ffdaafe0)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-23 22:26:28 +01:00
Joe Slater
c68d44cd0c libtool: remove host information from libtool
Import patch from Debian.

(From OE-Core rev: b2e0b383a17a3cd450adb3d86f7f818729438375)

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-22 17:31:04 +01:00
Ross Burton
e23c103434 unfs3: set upstream tag regex to avoid false-positives
(From OE-Core rev: 4663d06a79c6608127413488676a6e7dfbefb3e1)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-22 17:31:04 +01:00
Anuj Mittal
2a11ee3ad2 gdb: fix CVE-2017-9778
(From OE-Core rev: 4fa03fa14f8facb134ecd772a99c25184d8a4cbd)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 16:19:14 +01:00
Anuj Mittal
0176b556fa python: include CVE patches for python-native as well
Also avoids maintaining a different set of patches for both.

(From OE-Core rev: b3b1c00cc46b33ddbf7e008267032220e1e298af)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 16:19:14 +01:00
Anuj Mittal
db32c9bda3 rsync: fix CVEs for included zlib
rsync includes its own copy of zlib and doesn't recommend linking with
the system version [1].

Import CVE fixes that impact zlib version 1.2.8 [2] that is currently used
by rsync.

[1] https://git.samba.org/rsync.git/?p=rsync.git;a=blob;f=zlib/README.rsync
[2] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3agnu%3azlib%3a1.2.8

(From OE-Core rev: a55fbb4cb489853dfb0b4553f6e187c3f3633f48)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 16:19:14 +01:00
Ulrich Ölmann
b4db437f11 squashfs-tools: upgrade to commit f95864afe883
The master branch's current tip commit as of this writing is [1], see the
squashfs-tool's repo at [0].

Because of commits [2]-[4] which are included in the master branch three
corresponding patches are dropped as they are not needed anymore. The single
remaining patch was rebased on top of [1] to apply cleanly.

Commits [5] & [6] introduced interesting features, namely zstd support and
reproducibility of created SquashFS images. They are reflected in two new
PACKAGECONFIG options now, but only the latter ("reproducible") is appended to
the default options as OE-core does not contain a recipe to build zstd at the
moment (a working zstd recipe can be found e.g. in meta-rauc, see [7]).

[0] https://github.com/plougher/squashfs-tools.git
[1] f95864afe883 ("unsquashfs-4: Add more sanity checks + fix CVE-2015-4645/6")
[2] 46bdc1726e5a ("mksquashfs: Make a load of functions static")
[3] b0ca8a5c98ff ("pseudo.c: add explicit <sys/stat.h> include")
[4] f95864afe883 ("unsquashfs-4: Add more sanity checks + fix CVE-2015-4645/6")
[5] 6113361316d5 ("squashfs-tools: Add zstd support")
[6] e0d74d07bb35 ("Add configuration and Mksquashfs build options for
                   reproducible builds")
[7] https://layers.openembedded.org/layerindex/recipe/79049/

(From OE-Core rev: 92f34fbe321040db3dc0431dd464747324058e2e)

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 08:41:40 +01:00
Anuj Mittal
58d3ca6c15 qemu: fix CVE-2019-12155
(From OE-Core rev: a0236a8f682ab0e897cd99555b9225bae4fb04ab)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 08:41:39 +01:00
Anuj Mittal
600b9df025 binutils: CVE-2019-9070 is same as CVE-2019-9071
See:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89395

(From OE-Core rev: cef180de3684491f1ac4180ddbcc102121222181)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19 08:41:39 +01:00
Ross Burton
d64c2ad24d pkgconf: upgrade 1.6.1 -> 1.6.3
(From OE-Core rev: 4a69bf5ae3328d124a7607a52333643ebf7ec0b3)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18 12:16:19 +01:00
Ross Burton
7f5f884e55 flex: set CVE_PRODUCT to include vendor
There are many projects called Flex and they have CVEs, so also set the vendor
to remove these false positives.

(From OE-Core rev: 0598ccdcb31e16f1d1227197591b10ba441fcfe2)

Signed-off-by: Ross Burton <ross.burton@intel.com>

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18 12:16:19 +01:00
Ross Burton
75b4b5d675 git: set CVE vendor to git-scm
There's a Jenkins plugin for Git.

(From OE-Core rev: f2adf5e4d3e9afc6d45665bbe728c69d195a46ef)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18 12:16:19 +01:00
Ross Burton
b674d5cc27 subversion: set CVE vendor to Apache
There's a Jenkins plugin for Subversion.

(From OE-Core rev: ac115c3b5f1dcb95fb7d39537693fe0dcd330451)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18 12:16:19 +01:00
Anuj Mittal
edab4b2cec python3: upgrade 3.7.3 -> 3.7.4
Also fixes CVE-2019-9740, CVE-2019-9948. For details, see:

https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final

(From OE-Core rev: 73579c846fe02fb14464869ed382faf8fe299636)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 19:25:02 +01:00
Anuj Mittal
494a622cb8 python: fix CVE-2019-9740
(From OE-Core rev: 8eddac3305b7b428565103cde88cba444e3f0dd0)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 19:25:02 +01:00
Anuj Mittal
28688a2770 nasm: fix CVE-2018-19755
(From OE-Core rev: 4a46516256c24cb30bc9629371816f893693b488)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 19:25:02 +01:00
Adrian Ratiu
897483147f opkg/package/rootfs_ipk: allow overwriting OPKGLIBDIR
Some distributions for various reasons (like for example mounting a
tmpfs over /var at runtime) can't use /var/lib to store the opkg
metadata, so a different path is required to have a functioning
package manager.

${localstatedir} can't be modified to something other than the
hardcoded value in bitbake.conf because other recipes depending on it
will fail to install.

So the only recourse, which is also the least invasive, is to allow
distros to overwrite the OPKGLIBDIR variable just like they are also
allowed to overwrite OPKGBUILDCMD.

(From OE-Core rev: 81eae383c287ad2e74321345c5eba862d5704cc4)

Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 19:25:02 +01:00
Ross Burton
0c0a056db8 cve-check-tool: remove
(From OE-Core rev: 5388ed6d1378d647a65912dbd537f9ef3cb5760a)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 09:36:35 +01:00
Changqing Li
d9d208c532 opkg: make ptest output format align with common style
(From OE-Core rev: 333c2bd397ff3b0ec3e7812e04cb5e077fa59683)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-17 09:36:35 +01:00
Peter Kjellerstedt
63b9248721 nativesdk-meson: Remove some unused variables
(From OE-Core rev: 02b01280c0cc1e426d0cd9210c4bcd1f95977ab2)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16 13:53:17 +01:00
Adrian Bunk
d46a59b21d e2fsprogs: Remove patch that disabled 64bit for ext4 by default
OE no longer ships a git snapshot of e2fsprogs,
so use the new upstream default now.

(From OE-Core rev: f5edce401cfb31ebd0200adaba9a201caf7ea705)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16 13:53:16 +01:00
Ross Burton
e186617d0a ninja: use Python 3
As part of the mission to remove the use of Python 2, explicitly bootstrap Ninja
with Python 3.

(From OE-Core rev: b6a84fff1fbdab49af626d221085f3c052c4021d)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-15 09:30:00 +01:00
Ross Burton
d19cbe3af5 qemu: use Python 3 to build
As part of the mission to remove the use of Python 2, explicitly use Python 3
when building qemu.

(From OE-Core rev: 9b3ed6f7ab8bf56a05a074162ed37ead12f248cf)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-15 09:30:00 +01:00
Adrian Bunk
a9bbda96eb meta: Remove remnants of bluez4 support
bluez4 was removed from meta-oe 2 years ago.

Simplfy the setup of the two level bluetooth and bluez4/bluez5
distro features by removing the bluez4/bluez5 distro features.

This also removes the no longer required bluetooth class.

(From OE-Core rev: dcf889e93401f7c4de0055d53271eacc3882eccc)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-15 09:29:59 +01:00
Chen Qi
43a08e1936 xmlcatalog: hold libxml2-native dependency
Put libxml2-native dependency in this class and remove
it from recipes inheriting this class.

In fact, if a recipe inherits this class and does not have
libxml2-native, the xmlcatalog_sstate_postinst would fail.

(From OE-Core rev: 5a72c6d5cc1c9896c7425ac20eaf82d3d489e5c7)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-11 09:32:50 +01:00
Anuj Mittal
6beec1687f binutils: fix CVE-2019-12972 CVE-2019-9071
(From OE-Core rev: 093f0914f261a27d58ecba9c1e9d3b78a35af012)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-11 09:32:50 +01:00
Zang Ruochen
ad56c84dd7 librepo:upgrade 1.10.3 -> 1.10.4
(From OE-Core rev: ec3962b87ce35c71418cdec6b5315f00788c5595)

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-10 09:56:22 +01:00
Oleksandr Kravchuk
d26bda1656 python3-pbr: update to 5.4.0
(From OE-Core rev: d40d9573d8f7414a3fd255dbfd519185369de13c)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-10 09:56:22 +01:00