Commit Graph

75972 Commits

Author SHA1 Message Date
Ross Burton
4e2dac74d5 perl: link to the system zlib instead of a vendored copy
The perl module Compress-Raw-Zlib defaults to using a vendored copy of
the zlib sources which has a number of CVEs.  A newer version of perl
updates this to zlib 1.3.2 to resolve them, but we should be linking to
our zlib recipe instead of the vendored code.

This mitigates CVE-2026-4176 so mark it as not appropriate.

(From OE-Core rev: 6e83e5520f415fc6ca9029a8aaa0af31cd832a90)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bf515229043685d4f00c965eb3e0236c37b6b403)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Hitendra Prajapati
b233e7b40f libexif: fix for CVE-2026-40385, CVE-2026-40386
Pick patch from [1] & [2] also mentioned at Debian report in [3] & [4]

[1] 93003b93e5
[2] dc6eac6e96
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40385
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-40386

(From OE-Core rev: 9175f776404a1f4536e0320495c446e80a281172)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Hitendra Prajapati
175a1d0fe3 libexif: fix for CVE-2026-32775
Pick patch from [1] also mentioned at NVD report in [2]

[1] 7df372e9d3
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32775
[3] https://security-tracker.debian.org/tracker/CVE-2026-32775

(From OE-Core rev: b825582edd8b05be2d3c5ca48d6d7c620628d69b)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Benjamin Robin (Schneider Electric)
6acd7c46b5 lz4: Remove a reference to the rejected CVE-2025-62813
The CVE-2025-62813 is rejected so do not reference it anymore.
So keep the patch but without referencing the CVE identifier.

The CVE database indicates the following reason:
  This candidate was withdrawn by its CNA. Further investigation
  showed that it was not a security issue.

(From OE-Core rev: 99706716626324605c049a9130f705f2090a9f91)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9c840a69b62a5fdffb3679a44d68dd5630b2916c)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Mathieu Dubois-Briand
f4122d12cf oeqa: runtime: go: Increase test_go_compile/test_go_module timeout
These tests tend do take a bit of time, and this is probably why they
have been seen failing a few times in the past months. Rising the
timeout from 5 to 10 minutes appears to help.

Fixes [YOCTO #15999]

(From OE-Core rev: c8a94dfc3a21403e8202a4adddbae9f3bd4a4549)

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 998ebfc77db4c8d7567d82560595e0994a310ae0)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Peter Bergin
5c73c64d00 go.bbclass: disable workspaces
go has a feature of workspaces [1]. If there is a file called go.work
in your working directory on any of its parent directories that will
be read and used during build. For OE where the builds shall
be sandboxed this is bad as a workspace file outside of the build
environment can be picked up. This commit wil disable that feature
according to the instruction in [1].

This was found and introduced build failures when a file go.work was
in the parent directory outside of OE build directory.

[1] https://go.dev/ref/mod#workspaces

(From OE-Core rev: 9538bcefab6881805d60d9f362e0b70996b5e2f9)

Signed-off-by: Peter Bergin <peter@berginkonsult.se>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c52c5e88626968b08510818f09829f2e1c9f94ae)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Changqing Li
0bdd741e4d go.bbclass: change GOTMPDIR to improve reproducibility
When cgo is enabled, the Go toolchain writes temporary source files
(*.c) under GOTMPDIR and compiles them there. when -trimpath is passed
to go, Go passes options such as
-ffile-prefix-map=$WORK/b387=/tmp/go-build internally to the GCC
instance it invokes. The variable WORK is a temporary directory created
under GOTMPDIR, refer the following log:

[snip of compile log]
WORK=/build/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/build-tmp/go-build377321751
cd $WORK/b387
TERM='dumb' x86_64-wrs-linux-gcc -m64 -march=x86-64-v3 -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/recipe-sysroot -I /tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/sources/buildah-1.41.5/src/github.com/containers/buildah/vendor/github.com/proglottis/gpgme -fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=$WORK/b387=/tmp/go-build -gno-record-gcc-switches -v -D_FILE_OFFSET_BITS=64 -I $WORK/b387/ -O2 -g -ffile-prefix-map=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/sources/buildah-1.41.5=/usr/src/debug/buildah/1.41.5 -ffile-prefix-map=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/build=/usr/src/debug/buildah/1.41.5 -ffile-prefix-map=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/recipe-sysroot= -ffile-prefix-map=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/recipe-sysroot-native= -pipe -v -ffile-prefix-map=/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/sources/buildah-1.41.5/src/github.com/containers/buildah/vendor=/_/vendor -frandom-seed=TZkSPVSBUvDMjg4wKjWS -o $WORK/b387/_x004.o -c unset_agent_info.cgo2.c
[snip of compile log]

OE also passes its own DEBUG_PREFIX_MAP to GCC(finally by CGO_CFLAGS),
including -ffile-prefix-map=${B}=${TARGET_DBGSRC_DIR}, where B is
${WORKDIR}/build. Because GOTMPDIR defaults to ${WORKDIR}/build-tmp, the
Go temporary directory looks like ${WORKDIR}/build-tmp/go-buildXYZ. Its
prefix therefore begins with ${WORKDIR}/build, so GCC matches the
DEBUG_PREFIX_MAP entry for ${B} first.

As a result, a path such as ${WORKDIR}/build-tmp/go-buildXYZ is
rewritten to ${TARGET_DBGSRC_DIR}-tmp/go-buildXYZ. This breaks the
-ffile-prefix-map option that Go itself adds, because the original WORK
path no longer matches the value Go expects. Since Go creates
go-buildXYZ directories randomly and internally, this causes the build
non-reproducible.

This patch changes GOTMPDIR from ${WORKDIR}/build-tmp to
${WORKDIR}/tmp-go-build so that the path no longer matches ${B}. This
prevents unintended replacements by OE's DEBUG_PREFIX_MAP and
restores reproducibility.

Note that pure go program like go-helloworld under OE will not have this
issue since it doen't use cgo, it is reproducible without this fix

(From OE-Core rev: 1b08bf9296fb6583234933b22b67b851591610a8)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 0642d2323072f561a4d0eeb9266213387b2997fc)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Martin Jansa
37bc77d15d systemd: update musl specific patch to apply
It doesn't apply after udev-builtin-path_id.c was also updated by
CVE-2026-40225-01.patch in
https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=fc2d33dbb2d5180b77c10865156db342f9d582da

causing do_patch failure for scarthgap builds with musl:

Hunk #1 FAILED at 39.
1 out of 1 hunk FAILED -- rejects in file src/udev/udev-builtin-net_id.c
patching file src/udev/udev-builtin-path_id.c
patching file src/udev/udev-event.c
patching file src/udev/udev-rules.c
Patch 0003-src-basic-missing.h-check-for-missing-strndupa.patch does not apply (enforce with -f)

stderr: ')
ERROR: Logfile of failure stored in: /OE/build/oe-core/tmp-musl/work/core2-64-oe-linux-musl/systemd/255.21/temp/log.do_patch.215528
ERROR: Task (/OE/build/oe-core/openembedded-core/meta/recipes-core/systemd/systemd_255.21.bb:do_patch) failed with exit code '1'

(From OE-Core rev: 0e66eb22a34e17939cfdaf5cdad84361b7f18e6e)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Hitendra Prajapati
f6b67fe3e8 libssh2: fix for CVE-2026-7598
Pick patch from [1] also mentioned at NVD report in [2]

[1] 256d04b60d
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-7598
[3] https://security-tracker.debian.org/tracker/CVE-2026-7598

(From OE-Core rev: 84d6cca01c9d36ec112e5eb4104437f63ad2aee5)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Ross Burton
1a099cb1fa python3-requests: backport fix for CVE-2026-25645
When unpacking zip files requests uses predictable paths. Backport a fix
to use randomly generated pathnames to mitigate injection attacks.

(From OE-Core rev: b23ec9773d67f8767904731afa86fe5ede08f97f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fe846d71b647fb06e6a87cb45a2dd9b0889e2891)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Peter Marko
3758595c3e cargo: set CVE_PRODUCT
This removes mediawiki:cargo CVEs from CVE metrics.
* CVE-2026-39837, CVE-2026-39839, CVE-2026-39840, CVE-2026-39841

(From OE-Core rev: 98088c90b6e37ab27e7b4b2546abe9ecd863c02e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a5cb71e7df95925a5c342c341e699e244b1b84f6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-10 14:35:20 +01:00
Lee Chee Yang
d03f09df0a migration-guide: add release notes for 5.0.18
(From yocto-docs rev: 76f4b5ded4aa04ca1404510f0232593a968e0f66)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
[AG: add note on large CVE updates for linux-yocto]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit be424bf52cd3ac9c83a4617d0b06afe8cde055be)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Robert P. J. Day
9c1cc745bc contributor-guide: couple minor typo/grammar fixes
- font fix
  - missing word fix

(From yocto-docs rev: c7e020d278ded715fc24034b000fb93f554b606c)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit a9bf37a1166120f8870422aceaf2f3d8cb53788a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Peter Marko
de21795014 dev-manual: remove semicolons for rootfs commands
Usage of semicolon as separator in ROOTFS/IMAGE_*COMMAND was deprecated
long time ago.
Code was changed to not include it anymore.
Update the example.

(From yocto-docs rev: 0ec798cecaae31e5bba13261d72dc8c5492b6b1f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit fa0b3fc4218e75b88b7811a3f2bfefdb0ca6496e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Robert P. J. Day
b490165ba1 overview-manual: update deploy.bbclass snippet
The current contents of deploy.bbclass is slightly different so update
the code snippet and the subsequent explanation of that snippet.

(From yocto-docs rev: b5cfd275cdd620b5260c5e66e254363be795e798)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit aec2a39ea648694bb5a30da216b721018e8bb670)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Robert P. J. Day
a5d09faf04 overview-manual: use correct spelling "counterpart"
"counterpart" is one word, not two -- this is the only example in all
the docs that needed fixing.

(From yocto-docs rev: 3511578f29e93702931883cd6537c57a5994d5cd)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 555061075725440d3aa6373624082bef6ee6e31f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Robert P. J. Day
62c57ccac1 overview-manual: mention that patch files can be compressed
Ensure the reader understands that patch files can be compressed.

(From yocto-docs rev: 39c5dff022620818bbbfeb4ad10f0f9e5b1e8d35)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit a1070100ecdf600ca9468a4115f9f9a1bf94f448)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Paul Barker
f9b6465aa0 security-team: Add section on multi-project embargoes
This text is migrated from the Security private reporting wiki page [1],
originally written by Marta.

[1]: https://wiki.yoctoproject.org/wiki/index.php?title=Security_private_reporting&type=revision&diff=86034&oldid=86033

Cc: Marta Rybczynska <marta.rybczynska@ygreky.com>
(From yocto-docs rev: 365b24e25f47ab91ccdabd309aeb34e5ef5a9eb7)

Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit c5438ff6f02856afaff9575ac21e9959158efc4b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Paul Barker
89274ac93d security-team: Tidy and update section on security team operations
The section "What Yocto Security Team does when it receives a security
vulnerability" duplicated information already found in the previous
section "Security Team Operations", so merge the sections and tidy up
the flow of the text.

While we're editing this, Mitre is now just one of the places you can go
to get a CVE assigned, many other CVE Numbering Authorities (CNAs) are
available. They also now have a web form for contact and requesting CVE
assignment so let's link directly to that.

Also drop "If an upstream project does not respond quickly" down a
heading level.

(From yocto-docs rev: ca6a21c7cf652fabd0d48fda735a9074f9fe8af7)

Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 8efdc7df5c75e92449e74e4d40b763ee1df07adc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:06 +01:00
Paul Barker
921c3654d8 security-team: Update membership list
Steve Sakoman has retired from the project. The TSC announced the need
for a new security team member and nominated me to join the team [1],
which was then confirmed after the nomination/comments period closed
[2].

[1]: https://lists.openembedded.org/g/openembedded-architecture/message/2352
[2]: https://lists.openembedded.org/g/openembedded-architecture/message/2375

(From yocto-docs rev: 22d0993a7e4c4438e80b29bd01407a5df5386768)

Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 9aca7328ae7bfd80fa9ed4a3c7efc9422b83b534)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Marta Rybczynska
2fd091dc4d security-team.rst: update my email address and key
Update my email address and expired key

(From yocto-docs rev: 527852c0398e85e437effebad9c46e78f90d306f)

Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 7d4ebbf510f47edfef87ab3727f372c24fa5fc13)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
da03ea708b overview-manual: provide a more expansive definition of "layer"
A layer is not simply a collection of recipes; it can include any
combination of recipe files, machine and distro configuration files,
class file and more, so make that clear. In fact, a layer is not
required to contain any recipe files at all.

(From yocto-docs rev: 4050b1002e1d1273fb3e0908bd42308e4f95e355)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 9d2fe509ff2ab43ea73d6cb7feaa44669ad83f0d)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
bee8b23299 overview-manual: add ":term:" for OE Build System
Add a ":term:" reference for the phrase "Openembedded Build System",
to be consistent with the earlier reference for "Poky".

(From yocto-docs rev: 938bcb41cdc5337c9f662b113381ac1ba59fb87c)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2a8bc4f1b25c818ddc517a6eee6a0c3ba653db6d)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Antonin Godard
b8e34bb802 ref-manual/variables.rst: link *MIRRORS definitions to the BitBake manual
Those are defined in BitBake documented, and would be better documented
there. Add a link to the BitBake manual for these variables.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 3210b5375356ad7097ecbf27ffdb50189a0ea6fe)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit cec08390bad4f26b841ff6fc8752f6200acf31d3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
d440c88af7 overview-manual: inform the reader early of "bitbake-getvar"
Given how Chapter 4 of the Overview Manual introduces so many of the
variables that define a build, briefly introduce the reader to the
"bitbake-getvar" command so they can examine those variables.

(From yocto-docs rev: ccd3b07fb7a24877aeea80d24456e41c93266015)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 33f57d154ad1ec950c59c5aab20e0a0323ef19cc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
b9e00fdea3 bsp-guide: update guide to reflect newer beaglebone
Update the section on describing the Beaglebone contents to reflect
the current content in the meta-yocto-bsp layer.

(From yocto-docs rev: 8ebcf1ea8e4add4045f643bde3bb48d5ff560497)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit bd5be9cc9d5aa7cca63877f3a22089c9dc02f135)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
9ff4f7dd3a bsp-guide: mention bootloader and device tree in BSP intro
In the intro to the BSP guide, mention that a BSP layer might also
contain content related to the bootloader and device tree files.

(From yocto-docs rev: ba48bdeee06522d7334ccb624053f4f363556a15)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit a6eca1e7c67225de8b32638b4ba10aa73efe5030)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
e480ed7e2c recipe-style-guide.rst: two minor grammatical tweaks
Minor rewording in two places.

(From yocto-docs rev: d08a1381231b068461f39de47154e971c71acd52)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 382f2cbea16efc13a1bcf14a3276add8aabeec4e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
7ddcb1e8c7 overview-manual: hyphens not allowed in file version
The Recipe Style Guide makes it clear that you can't have hyphens in
the version part of a recipe file name.

(From yocto-docs rev: 935bdb0d03bdb3f186ffd36faf37d5255a5b9522)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b9c7aa835576f154dff1c565e835bffd298af7c3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
cc4645864e overview-manual: fix typo, "semi-colon" -> "colon"
Obviously, this sentence should say "colon", not "semi-colon".

(From yocto-docs rev: f87c6ee9a2965b2978b93ccfd76dce0cb853bd9f)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 837e4de00f67b87c60faf21aab2dee913ba813b0)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Robert P. J. Day
aa4087cb46 overview-manual: remind reader that meta-poky is a distro layer
Even though it's mentioned a little earlier on that same page, when
defining the properties of a "Distro Layer," remind the reader that
"meta-poky" is an example of such a layer.

(From yocto-docs rev: 27a3d7d4c30f2957661d00455c15f830e1281bb9)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 4c57f21b681ca92e89903a79b2404132d5b00f10)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Antonin Godard
5e5b675713 conf.py: add a :yocto_bug: role
Similar to :yocto_bugs: but directly create a hyperlink to the bug
displayed with its identifier. Use as :yocto_bug:`12345`.

(From yocto-docs rev: a84f0e63550c2c72497c5b563f72fcfa16c3ee8f)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 24e227262df909353ef8874335cdeb114b9d4203)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Antonin Godard
9cc678e08e conf.py: define new *_path roles
Defines three new bitbake_path, meta_yocto_path, and oecore_path roles
that can be used to quickly reference a file or directory in one of
those repositories and link to our web interface for the path, e.g.
:oecore_path:`meta/conf/bitbake.conf`.

(From yocto-docs rev: cc2bb929002ed29fdb2601cf02f47de315656d27)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 89cf4b98686f6f353811d444f36848410ffd2929)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Antonin Godard
6218924ef8 conf.py: define new {oecore,bitbake,meta_yocto}_rev roles
Use the extlinks extension to create new roles to quickly reference a
commit from openembedded-core, bitbake, or meta-yocto.

For example, use as: :oecore_rev:`437e0419608e`.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 54cd2278e9f72837013831b6ce6d4aff61982899)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 79552b4a764d16282a86c8e017270a258a26240e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Anders Heimer
d80ddd7b90 bitbake: hashserv: validate unihash values
(Bitbake rev: a4daa14312d659333984aa1ae58ddfe0c96392f1)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f9b817d8017e5d5a1d22b9aa10a3c974bc7fa33d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:05 +01:00
Anders Heimer
d47ac87fb6 bitbake: hashserv/tests: use valid 64-character unihashes
(Bitbake rev: d0bc6eafbefcbc20657028640cd1e17584434ad3)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 16ef07c851f3438c0e6034b9a2fe2c708b766aa2)
[YC: migrated some more hash values with new_value = sha256(old_value)
matching what was done in the original patch]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:04 +01:00
Anders Heimer
bd4f11b2c0 bitbake: fetch2: Unpack RPMs with --no-absolute-filenames
Use cpio --no-absolute-filenames when unpacking RPM and SRPM archives so
absolute paths and parent-directory components in cpio member names are
extracted relative to the intended unpack directory.

(Bitbake rev: 37beb06ba9329cd16976273efbb341f781d4e749)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1b1a71586aa93678c1d9ca40ef2c6fa518f89356)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:04 +01:00
Anders Heimer
33d210eb57 bitbake: fetch2/git: quote shallow extra ref arguments
BB_GIT_SHALLOW_EXTRA_REFS can include wildcard entries. Matching refs
advertised by the remote are later passed to git fetch and update-ref
while creating shallow tarballs.

Quote the generated command arguments and pass the fetched ref after --
so shell metacharacters and option-like ref names are not interpreted as
command syntax or git fetch options.

(Bitbake rev: 6d3f8bd4ddc955b49eaa124e0724ea589da30646)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e9a06f79d9ec767c9d95470be78b006d6fd0d59c)
[YC: Only the quote part of the master patch applies.
The "--" part does not. This part is handled by bin/git-make-shallow
which only pass arguments to git rev-list and rev-parse through arrays]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:04 +01:00
Anders Heimer
73f77a019a bitbake: fetch2: validate striplevel parameter
The striplevel URL parameter is appended to tar_cmd, which is later run
through the shell. Validate it as a decimal count before using it in the
tar arguments.

(Bitbake rev: 3a8937cc4b6513f9ed54fee0b0347589a892c8d7)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 934fe718bfe29c7ec921e6b598d81ec2ebe8f7c7)
[YC: Removed the striplevel="1\n" subtest case. The URL-decoding regex
in decodeurl uses `.*` without `re.DOTALL`, causing literal newlines in
parameters to be silently truncated during parsing.]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:04 +01:00
Anders Heimer
a42a436300 bitbake: fetch2: validate deb/ipk data member names
The deb/ipk unpack path selects a data archive member from 'ar -t'
output and then passes that member name to a shell command. Previously,
any member beginning with data.tar. was selected.

Only select known deb/ipk data archive member names when datafile is
created. Quote the package path used in the shell command as it can come
from the local fetch path.

Add local fetcher regression coverage for quoted package filenames,
valid compressed data members, and unsupported or unsafe data member
names.

(Bitbake rev: a32064d0f10b9f5a163a25f410a4e39dccf9cb93)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 73ae3a2447ec93df39bc66cf3d8f9b2ea1bfe3bf)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-06-08 21:44:04 +01:00
Robert P. J. Day
d4576e3c08 contributor-guide: fix type "maintainance" to "maintenance"
Correct "maintainance" typo in recipe-style-guide.rst.

(From yocto-docs rev: f39ba5141cd518f08d491b2255a4acd74442e87b)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d7376cca64a0784e59d4fd60b9baefb4da2ce289)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
10837d3a3b overview-manual: fix "checkout" versus "check out"
As with "setup" versus "set up", the pedants at grammarist.com explain
that "checkout" is used as a noun or adjective, while the
corresponding verb is two words, "check out."

  https://grammarist.com/spelling/checkout-check-out/

(From yocto-docs rev: 85852e0a1e5ddf034cff979329591af786967beb)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 1d5f0fea4e150be0ef9b10d5733eeaba06c78e6f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
1c4a535dd8 What I Wish I'd KNown: Various pedantic cleanups
Tweaks:

  - Update "Software Overview" link to go to "Technical Overview"
  - use proper capitalization for "Git" when referring to the product
  - numerous grammar adjustments to basic skills list

(From yocto-docs rev: 9b440c5116828f131a304b77f5da8c98c0d27c62)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit ffd69f11172c2b0d8f52bd967c7983220d133e0d)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
3de4303196 "Transitioning ..." doc: Various pedantic cleanups
Tweaks:

  - grammer adjustments
  - hyphenation
  - monospace font for layer and file names

(From yocto-docs rev: 8e98a7264bf9d0d975b5c8fb2062ed907273ff5c)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 801f719458d0d9670debad4ddc379e3ade4d85f9)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
cee4c1df5a YP Quick Build: delete extraneous periods in list
Delete inconsistent periods in software versions list so it doesn't
look weird.

(From yocto-docs rev: a106dea889259a872fdbe69215fe4de740bc49f4)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 94ebe744d0e95672456b8157daf0ffba333397bd)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
ec370051a9 yp-intro.rst: add link to "buildbot"
When referring to buildbot, add a link to its home page.

(From yocto-docs rev: 40b6f86daea61e545d94e92b8eed11c8038573ad)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 7a9247175e1afc74371708d4bad629941477eb57)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
6ffe5c1335 yp-intro.rst: delete really old references
There seems to be be little value in continuing to point readers to
two references, one almost a decade old, the other almost 15 years
old, especially in the middle of a guide that ostensibly is part of
the introductory material.

(From yocto-docs rev: eb92a7cc3fe7772f202e9955974d79b359a257d7)

Signed-off-by: Robert P. J. Day <robday@acresecurity.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 5b4ffc020a9b0c7a877c119058cd43a51f91687f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Robert P. J. Day
3861cee8fd index.rst: update "Software Overview" to "Technical Overview"
Fix the title and link so it goes directly to the
Technical Overview.

(From yocto-docs rev: 1ba3a389b47188b6c664ae3a0bee7ca70e462650)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 0143b586572e15cac438f0fa6f3c1e7446597020)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Lee Chee Yang
6d30861b9b migration-guide: add release notes for 4.0.35
(From yocto-docs rev: 07f7f75129d7462c4d9d8256f140658cce8caa33)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 39ef57628b4fb262857d8bf55abe3e6fe7ff01f1)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-05-20 09:17:14 +01:00
Paul Barker
44dcf08572 build-appliance-image: Update to scarthgap head revisions
(From OE-Core rev: ece80784b493c8b7493478fa2ba0dc1d6d80aa79)

Signed-off-by: Paul Barker <paul@pbarker.dev>
yocto-5.0.18
2026-05-15 13:26:28 +01:00