This release is primarily to fix two CVEs:
- CVE-2021-28544
- CVE-2022-24070
It also rewrites the macOS autoconf macros to be cross-compile friendly,
so we don't need to delete them anymore.
(From OE-Core rev: ecfbc2ef45a76ab96d215954ca0a109545e6ff02)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtool is now longer renamed to ${host}-libtool, so remove the changes
to support this.
(From OE-Core rev: 0610df3e56e350493731d49fe67261b62d346573)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage
[YOCTO #13471]
(From OE-Core rev: bb05814335e7101bfd8df0a11dc18a044e867bed)
Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For SDK environments where people still use subversion, let it easily being
added to buildtools-tarball to invite more developers relying on Yocto
based SDKs without much requirement to setup anything on the development
workplace.
(From OE-Core rev: 586a15b76f879f49c5224116cbf506b7ccf96cd2)
Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add python3native, as configure probes into python configuration.
(From OE-Core rev: e57a7d0fb2e12bfd8179e6859a7fc28183b15d76)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
All of the .pc files contain the path to ${libdir} which fails
in a multilib rpm image.
(From OE-Core rev: c96c56476fe9025884c7ea96f15f41694a6908fe)
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
subversion checks whether build with boost during do_configure. If boost
exists on build machine, it causes configure-unsafe QA issue:
| ERROR: subversion-1.12.0-r0 do_configure: QA Issue: This autoconf log
| indicates errors, it looked at host include and/or library paths
| while determining system capabilities.
| Rerun configure task after fixing this. [configure-unsafe]
Add a PACKAGECONFIG 'boost' to fix the issue.
(From OE-Core rev: 237478724be75a4efeebafe07b46a353894ee4ca)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Backport a patch to fix build failure while APR 1.7.0
...
checking for apr_int64_t Python/C API format string...
configure: error: failed to recognize APR_INT64_T_FMT on this platform
...
- Rebase disable_macos.patch and serfmacro.patch
License-update: no change, declare two new added file
* in build/ac-macros/ax_boost_base.m4
* in build/ac-macros/ax_boost_unit_test_framework.m4
(From OE-Core rev: 68ae5e624642218e7e01805c096da09098a8706f)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit 5bb47984af79 "subversion: 1.9.7 -> 1.10.0" dropped
serf.m4-Regex-modified-to-allow-D-in-paths.patch
from recipe, but left the patch itself in source tree.
Remove this patch since nobody uses it.
Cc: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 803d834780cb9380e19209f2bb93953ac3cb6165)
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License changed since licenses for the bundled linenoise and lz4 codebases
were added. We don't build either of them. Add MIT since utf8proc is MIT
licensed.
Configure to use the internal utf8proc codebase since we have no copy of that in
OE-Core, nor any need to add one.
Add a dependency on lz4 which is now required rather than using the internal
codebase within subversion.
Drop a patch merged upstream.
(From OE-Core rev: 5bb47984af79fe2e8c3ba5bc6895741131f03bcd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Add default value for PACKAGECONFIG
- Combine "inherit autotools" with "inherit pkgconfig gettext"
- Drop historical addition of -L${STAGING_LIBDIR} to LDFLAGS
- Re-order variables according to OE styleguide
(From OE-Core rev: 10cb7bccc2452375b363ba82bf1be2ee0cb0e8e2)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This reverts commit cfe6f3e251.
This is because the apr configure wrong, when the apr configure meets the
cross compiling, it pass 8 bytes to "off_t", in apr source code configure.in,
it was hardcoded:
APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], off_t, 8)
The macro "APR_CHECK_SIZEOF_EXTENDED" was defined in build/apr_common.m4,
it use the "AC_TRY_RUN" macro, this macro let the off_t to 8, when cross
compiling enable.
But in glibc on the x86 or multilib target the "off_t" was 4 bytes, so this
cases dismatch for softwares which use the apr.h, such as subversion, run this:
svnadmin create test
It failed because the "APR_OFF_T_FMT" was "lld" in apr.h when apr configure,
but the "apr_off_t" was 4 bytes, in the apr source code: apr_snprintf.c
i_quad = va_arg(ap, apr_int64_t);
When the function apr_vformatter meets "lld", it would use the above to parse,
but the above read 8 bytes, so the follow-up data go to wrong.
So we should configure the apr correct when cross compiling. I do this on the
following patchs.
(From OE-Core rev: fbdfb39c011676fe61a4d58b62226126e0e9ec62)
Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The existing sed expression can match expressions like
--sysroot=/some/path/xxx-linux/ which clearly isn't intended and
injects incorrect paths into LDFLAGS.
Fix this in the same way we address the problem in CFLAGS. This fixes corrupt
build paths and incorrect paths in .la files amongst other issues.
(From OE-Core rev: 9a8382422ddbb0972dc25b752204f4908bb9857c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When run the following command on x86:
svnadmin create /var/test_repo
It cause segmentation fault error like the following:
[16499.751837] svnadmin[21117]: segfault at 83 ip 00000000f74bf7f6 sp 00000000ffdd9b34 error 4 in libc-2.24.so[f7441000+1af000]
Segmentation fault (core dumped)
This is because in source code ./subversion/libsvn_fs_fs/low_level.c,
function svn_fs_fs__unparse_footer, when:
target arch: x86
apr_off_t: 4 bytes
if the "APR_OFF_T_FMT" is "lld", it still use type "apr_off_t" to pass
data to apr, but in apr source code file apr_snprintf.c the function
apr_vformatter meet "lld", it would use the:
i_quad = va_arg(ap, apr_int64_t);
It uses the apr_int64_t to deal data, it read 8 bytes, so the follow-up
data may be error.
(From OE-Core rev: 7ea7e3db7801b58495b89a95ec2751d618d3a29f)
Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop backported CVE fix patches
libtool2.patch has been rebased and renamed to 0001-Fix-libtool-name-in-configure.ac.patch
LICENSE checksum has been updated because more 3rd party attributions have been added to it,
it's otherwise still Apache 2.
(From OE-Core rev: b57f57ea092f93bd7e1268b04c7d3c4af2149a77)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The svn_repos_trace_node_locations function in Apache Subversion before
1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used,
allows remote authenticated users to obtain sensitive path information
by reading the history of a node that has been moved from a hidden path.
Patch is from:
http://subversion.apache.org/security/CVE-2015-3187-advisory.txt
(From OE-Core rev: 6da25614edcad30fdb4bea8ff47b81ff81cdaed2)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Modified the regex sed in serf.m4 to allow the use of '-D' characters
in project folder names without having compilation error from
subversion-native.
[YOCTO #7874]
(From OE-Core rev: 04554b128c358e3c10f6581fd4506764a65240b8)
Signed-off-by: Jose Lamego <jose.a.lamego@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removing the 1.6.X recipes, since there is a new version 1.8.X recipes,
and hope that all projects already upgraded their premirror caches to
use new format
(From OE-Core rev: 65c4dcbefbe118eb1b04335d7d6171236a1315c2)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
upgrade to fix two CVE defects: CVE-2015-0248 and CVE-2015-0251
(From OE-Core rev: cb00b9e0330970b5c768aae9ddd4703a7172acbe)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
see https://gcc.gnu.org/gcc-5/porting_to.html
we need to stop the preprocessor from generating the #line directives
or we run into issues like
| checking for apr_int64_t Python/C API format string...
| configure: error: failed to recognize APR_INT64_T_FMT on this platform
| Configure failed. The contents of all config.log files follows to aid
debugging
| ERROR: oe_runconf failed
Rightly subversion should be fixed but lets leave that to subversion
folks
Change-Id: I02a89798ff949f79967ab0a73adcddaa4218662d
(From OE-Core rev: 7793b1c425077ed6ed11a9bc2a8b1b96612b1c96)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The Makefile generation for subversion is horrible, I can't figure out
where the dependencies are missing, it looks like they might be missing
everywhere. Give up and disable parallel make install.
(From OE-Core rev: f5569d30b98418b201766ad07b177aac5fae4a41)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dropped neon patches as neon support was dropped.
Dropped CVE patches as applied in later version
Added patch to avoid OS-X check which doesn't cross compile
Add PACKAGECONFIG for gnome-keyring
Addition to license:
For the file subversion/libsvn_subr/utf_width.c
* Markus Kuhn -- 2007-05-26 (Unicode 5.0)
*
* Permission to use, copy, modify, and distribute this software
* for any purpose and without fee is hereby granted. The author
* disclaims all warranties with regard to this software.
(From OE-Core rev: 99c3225cfe39f8de89555df5bd3f1e93cd731269)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
