Commit Graph

5510 Commits

Author SHA1 Message Date
Het Patel
791a279af0 zlib: Add CVE_PRODUCT to exclude false positives
To avoid false positives (such as CVE-2023-6992, cloudflare:zlib), add a
CVE_PRODUCT to identify the vendors that have been used.

Removing the present existing CVE_STATUS for CVE-2023-6992.

(From OE-Core rev: 119b775b36dfd51286493763cffb6e965893b8fd)

Signed-off-by: Het Patel <hetpat@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-09 22:33:38 +01:00
Richard Purdie
1f046d411c coreutils: Update merged patch to backport status
(From OE-Core rev: 80b082dbb0e04d8d7af096046b3ac1e806d0a9d8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-09 22:33:38 +01:00
Richard Purdie
dc3e34b3a6 coreutils: Fix intermittent ptest issue
The test writes to the disk and means the space used changes. If this
crosses a number boundary, the heading spacing can change causing a test
failure. This was triggered by a recent gcc upgrade.

Add a fix for this which has been shared with upstream.

(From OE-Core rev: ca6f0d81fc7d5e53d216e5131724e826369fd4ae)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-08 12:04:39 +01:00
Richard Purdie
afc895b67e glib-initial: Inherit nopackages
Since this is a bootstrap recipe with PACKAGES = "", inherit the nopackages
class to skip the various packaging functions which wouldn't do anything anyway.

This fixes errors from buildhistory changes where packages-split would be empty.

(From OE-Core rev: 731c3d6f16fdf7f9eb862a477a5363c82cac237c)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-08 08:26:14 +01:00
Richard Purdie
afec350590 glibc-y2038-tests: Don't force distro policy
How debugging is laid out is for the distro to decide, not the recipe. If the user
wants this, they can set this. This recipe isn't special.

(From OE-Core rev: 3250bdf1d9da2908b80326f4d3a61b0131fe6e2b)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-08 08:26:14 +01:00
Richard Purdie
a8b4b3ef07 glibc-y2038-tests: Fix debug split and drop INSANE_SKIPs
Create the separate dbg package and then drop and the INSANE_SKIP values
as none of them appear to be needed once debug splitting is fixed.

(From OE-Core rev: 922b5e7272c9b63c39d0c5ee0a67f08664994ab9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-08 08:26:14 +01:00
Richard Purdie
e6a49ef353 gettext: Drop ptest INSANE_SKIPs
In my local testing there are now no QA issues from this recipe so we can drop
the ptest INSANE_SKIPs.

(From OE-Core rev: 0a6821ca4a1c8aa26d3bf6ec1e8b2f86597a1699)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-08 08:26:14 +01:00
Richard Purdie
4ca98d9904 musl: Show error when used with multilibs
As discussed in the bugzilla entry, musl doesn't work with multilibs.

I originally sent this patch in 2020 but was told that support was being
added. I recently revisited the bug and retested a basic config which still
fails the way it did in 2019. Since clearly nobody is using this, make it clear
we don't support it. If anyone does add support, we can remove this error very
easily.

[YOCTO #13122]

(From OE-Core rev: 4da308d37aa51231b617fedb401076c13cafd89a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-07 15:47:15 +01:00
Richard Purdie
0731d49014 cve_check: Use a local copy of the database during builds
Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from
a local copy in STAGING DIR after fetching.

(From OE-Core rev: 03596904392d257572a905a182b92c780d636744)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-08-05 14:31:57 +01:00
Richard Purdie
7c1de3118f create-spdx-3.0/populate_sdk_base: Add SDK_CLASSES inherit mechanism to fix tarball SPDX manifests
Currently, "tarball" sdk based recipes don't generate SPDX manifests as they
don't include the rootfs generation classes. Split the SPDX 3.0 image class into
two so the SDK components can be included where needed.

To do this, introduce an SDK_CLASSES variable similar to IMAGE_CLASSES which
the SDK code can use.

Migrate testsdk usage to this.

Also move the image/sdk spdx classes to classes-recipe rather than the general classes
directory since they'd never be included on a global level.

For buildtools-tarball, it has its own testsdk functions so disable the class there as
a deferred inherit would overwrite it.

(From OE-Core rev: 662396533177b72cc1d83e95841b27f7e42dcb20)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-26 12:28:42 +01:00
Peter Marko
715899efb7 glibc: cleanup old cve status
This CVE status should have been removed on version update.
CPE says >=2.34 and <2.39 while our version is already 2.40.

(From OE-Core rev: b568a8f428e76f75bb8c374983f62822325ebe8a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-26 12:28:42 +01:00
Alejandro Hernandez Samaniego
09b49a35e1 tclibc-picolibc: Adds a new TCLIBC variant to build with picolibc as C library
Enables usage of TCLIBC=picolibc extending OE functionality to build and use
picolibc based toolchains to build baremetal applications.

Picolibc is a set of standard C libraries, both libc and libm, designed for
smaller embedded systems with limited ROM and RAM. Picolibc includes code
from Newlib and AVR Libc, but adresses some of newlibs concerns, it retains
newlibs directory structure, math, string and locale implementations, but
removed the GPL bits used to build the library, swiches old C style code for
C18 and replaces autotools with meson.

This patch adds a picolibc recipe for the C library, a picolibc-helloworld
recipe that contains an example application and a testcase that builds it.

Picolibc can be built for ARM and RISCV architectures, its been tested both
for 32 and 64 bits, the provided example recipe produces the following output:

hello, world

Runqemu does not automatically show any output since it hides QEMU stderr which
is where the QEMU monitors output is directed to when using semihosting, but,
manually running the same QEMU command does work properly.

(From OE-Core rev: c7535ecaccb72ef21a61f9aec5c68e61fb4f6fb6)

Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-26 12:28:42 +01:00
Ross Burton
4e1b106c07 glib-networking: upgrade 2.78.1 -> 2.80.0
2.80.0 - March 14, 2024
=======================

- Mark plugin functions as exports on Windows (!250, Amyspark)
- Updated translations

2.80.rc - February 29, 2024
===========================

- GnuTLS: fix improper use of IP address in SNI extension (!247, MARTINSONS Frederic)
- GnuTLS: major performance improvement: reduce unnecessary trust list creation (!249)
- OpenSSL: properly handle BIO_CTRL_EOF (!248)
- Updated translations

2.80.alpha - January 5, 2024
============================

- GnuTLS: Add warning when system has no trusted certificates (!243)
- OpenSSL: Fix bug when populating trust store (!244, Alessandro Bono)
- Fix license on dtls-connection.c test (!245, David King)
- Updated translations

As exposed by the warning when there are no trusted certificates, we should
RDEPEND on ca-certificates if either of the crypto backends are enabled
so that cryptography is usable.

(From OE-Core rev: 0e52a74bcf08cfdd879c74bff9b241a5007c7ef5)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-26 12:28:42 +01:00
Niko Mauno
a278540fc1 systemd: Mitigate /var/tmp type mismatch issue
The base-files recipe provides /var/tmp -> /var/volatile/tmp symlink
which is in conflict with systemd upstream tmpfiles.d/tmp.conf which
defines it as a directory (or subvolume on btrfs).

This generates following error in journal:

  Jul 03 15:37:21 qemux86-64 systemd-tmpfiles[158]: "/var/tmp" already exists and is not a directory.

Mitigate the issue by defining /var/tmp as symlink corresponding to
the one created by base-files.

(From OE-Core rev: 1f1f6f45e3cfe24dfee8a09d01a5d32f3080e381)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-23 11:54:37 +01:00
Khem Raj
28fd497a26 glibc: Remove redundant configure option --disable-werror
This is applied unconditionally few lines above

(From OE-Core rev: e9c6dcbe0e93f943ee622ee88d30ce0eb3dd3329)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-22 16:53:06 +01:00
Khem Raj
ece2f57685 glibc: Upgrade to 2.40
Major new features:

* The <stdbit.h> header type-generic macros have been changed when using
  GCC 14.1 or later to use __builtin_stdc_bit_ceil etc. built-in functions
  in order to support unsigned __int128 and/or unsigned _BitInt(N) operands
  with arbitrary precisions when supported by the target.

* The GNU C Library now supports a feature test macro _ISOC23_SOURCE to
  enable features from the ISO C23 standard.  Only some features from
  this standard are supported by the GNU C Library.  The older name
  _ISOC2X_SOURCE is still supported.  Features from C23 are also enabled
  by _GNU_SOURCE, or by compiling with the GCC options -std=c23,
  -std=gnu23, -std=c2x or -std=gnu2x.

* The following ISO C23 function families (introduced in TS
  18661-4:2015) are now supported in <math.h>.  Each family includes
  functions for float, double, long double, _FloatN and _FloatNx, and a
  type-generic macro in <tgmath.h>.

  - Exponential functions: exp2m1, exp10m1.

  - Logarithmic functions: log2p1, log10p1, logp1.

* A new tunable, glibc.rtld.enable_secure, can be used to run a program
  as if it were a setuid process. This is currently a testing tool to allow
  more extensive verification tests for AT_SECURE programs and not meant to
  be a security feature.

* On Linux, the epoll header was updated to include epoll ioctl definitions
  and the related structure added in Linux kernel 6.9.

* The fortify functionality has been significantly enhanced for building
  programs with clang against the GNU C Library.

* Many functions have been added to the vector library for aarch64:
    acosh, asinh, atanh, cbrt, cosh, erf, erfc, hypot, pow, sinh, tanh

* On x86, memset can now use non-temporal stores to improve the performance
  of large writes. This behaviour is controlled by a new tunable
  x86_memset_non_temporal_threshold.

Deprecated and removed features, and other changes affecting compatibility:

* Architectures which use a 32-bit seconds-since-epoch field in struct
  lastlog, struct utmp, struct utmpx (such as i386, powerpc64le, rv32,
  rv64, x86-64) switched from a signed to an unsigned type for that
  field.  This allows these fields to store timestamps beyond the year
  2038, until the year 2106.  Please note that applications are still
  expected to migrate off the interfaces declared in <utmp.h> and
  <utmpx.h> (except for login_tty) due to locking and session management
  problems.

* __rseq_size now denotes the size of the active rseq area (20 bytes
  initially), not the size of struct rseq (32 bytes initially).

(From OE-Core rev: 4dd98c39204c1bfdf54b10ec72c3003118ac1dba)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-22 16:53:06 +01:00
Yi Zhao
83e68a5f47 util-linux: install lastlog2 volatile file
Install lastlog2 volatile file to create /var/lib/lastlog directory to
fix runtime error:

$ lastlog2
lastlog2: Couldn't read entries for all users
lastlog2: Cannot open database (/var/lib/lastlog/lastlog2.db): unable to open database file

(From OE-Core rev: 0b651441363a6195a8d025f8010728bc42ae2ee5)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-21 11:08:11 +01:00
Deepthi Hemraj
c6a7695258 glibc: stable 2.39 branch updates.
Below commits on glibc-2.39 stable branch are updated.
e8f5217097 Linux: Make __rseq_size useful for feature detection (bug 31965)
143a7a0623 elf: Make dl-rseq-symbols Linux only
1062ebbd19 nptl: fix potential merge of __rseq_* relro symbols
5c46e6b666 s390x: Fix segfault in wcsncmp [BZ #31934]
a036311246 stdlib: fix arc4random fallback to /dev/urandom (BZ 31612)
d2cbfcf1d9 math: Provide missing math symbols on libc.a (BZ 31781)
d473c9bb3b math: Fix isnanf128 static build (BZ 31774)
3950cbd7a1 math: Fix i386 and m68k exp10 on static build (BZ 31775)
6cb25aff85 math: Fix i386 and m68k fmod/fmodf on static build (BZ 31488)
74630b1bb7 posix: Fix pidfd_spawn/pidfd_spawnp leak if execve fails (BZ 31695)
7f9f25f255 Linux: Include <dl-symbol-redir-ifunc.h> in dl-sysdep.c
198632a05f NEWS: update list of fixed CVEs in 2.39
77bb3c7154 NEWS: update list of fixed bugs in 2.39
f05638731e x86: Properly set x86 minimum ISA level [BZ #31883]
b7f5b0a711 x86: Properly set MINIMUM_X86_ISA_LEVEL for i386 [BZ #31867]
e1d0040a6d localedata: ssy_ER: Fix syntax error
9de9cd17e7 malloc: New test to check malloc alternate path using memory obstruction
a2da98aa2a malloc: Improve aligned_alloc and calloc test coverage.
305ee48826 malloc/Makefile: Split and sort tests
00899eba26 x86/cet: fix shadow stack test scripts
6ade91c211 elf: Avoid some free (NULL) calls in _dl_update_slotinfo
70f560fc22 misc: Add support for Linux uio.h RWF_NOAPPEND flag
c9d8534406 i386: Disable Intel Xeon Phi tests for GCC 15 and above (BZ 31782)
aee37de299 Reinstate generic features-time64.h
dd535f4f19 Always define __USE_TIME_BITS64 when 64 bit time_t is used
26e7005728 socket: Use may_alias on sockaddr structs (bug 19622)
9f2b100d67 parse_fdinfo: Don't advance pointer twice [BZ #31798]

(From OE-Core rev: 95fd926a23d20bcbf5ffe1e91df60dadc77481b4)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-21 11:08:11 +01:00
Ross Burton
1a3d89796b ell: upgrade 0.66 -> 0.67
* Add support for handling sysctl char settings.

(From OE-Core rev: a3c246763bdf5bab48d2856cad19376dc23bf6d3)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-21 11:08:11 +01:00
Ricardo Simoes
cf648b0d28 volatile-binds: Remove workdir if OverlayFS fails
To fulfill OverlayFS workdir requirements, the mount-copybind script
creates a workdir. But if the mount operation fails for any reason,
the workdir is left there.

Then, subsequent runs of mount-copybind will again try to
create the directory and pollute system logs with failed mkdir error
messages.

This commit mitigates the problem by unconditionally removing workdir
if the OverlayFS is not used or fails to run.

(From OE-Core rev: 7872edbb33024fc710ac683eaef5635b89a1b994)

Signed-off-by: Ricardo Simoes <ricardo.simoes@pt.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Ricardo Simoes
c32490b139 volatile-binds: Do not create workdir if OverlayFS is disabled
When the mountpoint parameter is a directory, the mount-copybind will
first try to use OverlayFS. Because of that, it needs to create the
OverlayFS workdir (determined by the overlay_workdir).

But if the environment variable MOUNT_COPYBIND_AVOID_OVERLAYFS is set
to "1", the script uses bind mount. In that case, the overlay_workdir
is useless, leaving the spec parent directory in a dirty state.

This commit changes mount-copybind so that the overlay_workdir is only
created when MOUNT_COPYBIND_AVOID_OVERLAYFS is not set to 1.

(From OE-Core rev: 323765607f262b5fea0f19e8a05aeffe5076235a)

Signed-off-by: Ricardo Simoes <ricardo.simoes@pt.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Peter Kjellerstedt
8dbeec7e04 systemd: Move the MIME file to a separate package
The systemd-mime package is added as a recommendation for systemd so
that it is installed by default, but can be excluded, e.g., via
BAD_RECOMMENDATIONS. Excluding it avoids pulling in the MIME database
for products that have no use for it.

(From OE-Core rev: 5560243137f772683e53b614f134dd632b62be8b)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Peter Kjellerstedt
67f3f2edd3 systemd: Correct the indentation in do_install()
There was a mix of using tabs and spaces for indentation.

(From OE-Core rev: e0442c791578c55c7f198ae389cb820a7bf437d5)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Khem Raj
e66e9d255d systemd: Replace deprecate udevadm command
In postinstall we run this script on target
these days systemd-hwdb is recommended

Fixes
...
Configuring udev-hwdb.
udevadm hwdb is deprecated. Use systemd-hwdb instead.

(From OE-Core rev: 16f3eba7f5097976a53e3ffabd3723d889df56e6)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Kai Kang
776b78ae84 systemd: fix VERSION_TAG related build error
The patch 0001-src-boot-efi-meson.build-ensure-VERSION_TAG-exists-i.patch for
systemd-boot is also required by systemd to resolve VERSION_TAG related build
error.

(From OE-Core rev: dd0100137f5f7bcaea7f665ac08754a682cb2983)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Khem Raj
7c45a025ed busybox: Add fix for CVE-2023-42366
(From OE-Core rev: 34ba71151c93d6fb19469555131519dcb820ab3c)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Khem Raj
13699cf0f2 busybox: CVE-2023-42364 and CVE-2023-42365 fixes
backport upstream fix for CVEs and fix the regression that introduced [1]

[1] http://lists.busybox.net/pipermail/busybox/2024-May/090766.html

(From OE-Core rev: 91d7580344fe5a15a9bf059dceedab42f7ba3e54)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Khem Raj
9bae37cb63 busybox: Fix tc applet build when using kernel 6.8+
We now have 6.9 kernel headers in master which means
busybox builds with CONFIG_TC will fail to build due
to CBQ being dropped in kernel 6.8+

Apply a fix which is reported upstream

(From OE-Core rev: 3afbeb1ea418a69a452e82cbce00c36452b75f1e)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18 17:21:39 +01:00
Richard Purdie
e18d60deb0 build-appliance-image: Update to master head revision
(From OE-Core rev: 758508614541c68dd6a2b7084e07287c71f40a8f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-16 15:58:14 +01:00
Ross Burton
4e96673ae2 glibc: add task to list exported symbols
When upgrading glibc it's important to know if there are any new symbols
that pseudo needs to wrap. In the future a generalised ABI comparison tool
would be good, but to solve the immediate need we can simply list the
exported symbols to files in WORKDIR.

(From OE-Core rev: 395e057743f04e5ee862d790dcfce026220a2699)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-16 11:56:53 +01:00
Niko Mauno
504cc9860e systemd: Mitigate /var/log type mismatch issue
When VOLATILE_LOG_DIR evaluates as True, the base-files recipe provides
/var/log -> /var/volatile/log symlink which is in conflict with systemd
upstream tmpfiles.d/var.conf.in which defines it as a directory.

This generates following error in journal:

  Jul 03 14:28:00 qemux86-64 systemd-tmpfiles[165]: "/var/log" already exists and is not a directory.

Mitigate the issue by defining /var/log as symlink corresponding to
the one created by base-files, when appropriate.

(From OE-Core rev: 711ee36e88c8968e3c45ea787b3adcf64352adf9)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-16 11:56:53 +01:00
Wang Mingyu
9d234fd634 base-passwd: upgrade 3.6.3 -> 3.6.4
0001-Add-a-shutdown-group.patch
0005-Add-kvm-group.patch
refreshed for 3.6.4

(From OE-Core rev: 096175565182eb92daee8fc7b92d12aa90c68d6b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-16 11:25:29 +01:00
Peter Marko
c862902172 busybox: Patch CVE-2023-42363
Backport patch for CVE-2023-42363.

(From OE-Core rev: 814f97922e1d6c24a36b03ee0e865f2210ff6d7c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:31 +01:00
Peter Marko
700febff61 busybox: Patch CVE-2021-42380
Backport patch for CVE-2021-42380.
Additionally backport clang regression fix caused by this patch.

(From OE-Core rev: 66543769ff79d81508bb703bd2fc34871a16e2c7)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:31 +01:00
Joshua Watt
f72d264226 classes-recipe: nospdx: Add class
Adds a class that allows recipes to opt out of generating SPDX

(From OE-Core rev: 170277da0dc34e3f797451473ebfbde82922f593)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:31 +01:00
Richard Purdie
0a494c8224 busybox: reconfigure wget https support by default for security
The default busybox wget https support is suboptimal, it silently ignores
checking certificate validity which isn't great for security.

Switch our defaults to disable the internal busybox tls code and the
https support using it and configure the openssl backend instead.

This this is done by spawning an openssl command, we don't need
dependencies on openssl for build. For runtime, we can assume
people would install openssl if they need/want this.

These changes put our default busybox configuration in a more secure
initial set of settings.

[YOCTO #14125]

(From OE-Core rev: 5d4ad13462f12355ff0f2bc1773ab4b1814b165a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:31 +01:00
Richard Purdie
1cf0974ad2 bitbake.conf: Further cleanup compiler optimization flags
Move the -pipe option out of the optimization flags and directly into
the flags variables since we always use it now.

Also move the debug prefix mapping there to match the nativesdk case
which already does this.

Fix the documentation and two recipe usages to match the change.

(From OE-Core rev: 9badf68d78d995f7d5d4cf27e045f029fc6d4044)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:30 +01:00
Chen Qi
67db5f4f55 util-linux/util-linux-libuuid: upgrade from 2.39.3 to 2.40.1
License-Update:
===============
GPL-2.0 is changed to GPL-2.0-only in README.licensing.

The following two patches are removed as they've been there in new release:

  0001-login-utils-include-libgen.h-for-basename-API.patch
  mit-license.patch

Other existing patches are refreshed to avoid patch-fuzz error.

A new PACKAGECONFIG, lastlog2, is added, which serves as a switch to build Y2038
safe lastlog pam module. This is a new functionality added in 2.40.

This 2.40.1 version has the problem of unnecessary remake, causing
intermmittent errors at parallel make. The do_compile:prepend is a
workaround for this. Upstream issue and PR are:
https://github.com/util-linux/util-linux/issues/3061
https://github.com/util-linux/util-linux/pull/3064

do_install is changed to do_install:append, the legacy codes are
removed. They've been there since the born of oe-core. I tested
with ccache, there's no error.

A new dependency, diffutils, is added to ptest. Because the mkswap-offset
test case needs 'cmp' from diffutils.

The tests/ts/misc/enosys test case is deleted for musl. This is because
the test case is comparing error description output and that's libc
specific. Results below can demonstrate the case.
'''
root@qemux86-64:/usr/lib/util-linux/ptest# cat /usr/lib/util-linux/ptest/tests/expected/misc/enosys-ioctl
test_enosys: ioctl r=0 errno=Success
test_enosys: ioctl r=-1 errno=Function not implemented
test_enosys: ioctl r=-1 errno=Inappropriate ioctl for device
test_enosys: ioctl r=-1 errno=Inappropriate ioctl for device
test_enosys: ioctl r=-1 errno=Function not implemented
root@qemux86-64:/usr/lib/util-linux/ptest# cat /usr/lib/util-linux/ptest/tests/output/misc/enosys-ioctl
test_enosys: ioctl r=0 errno=No error information
test_enosys: ioctl r=-1 errno=Function not implemented
test_enosys: ioctl r=-1 errno=Not a tty
test_enosys: ioctl r=-1 errno=Not a tty
test_enosys: ioctl r=-1 errno=Function not implemented
'''

(From OE-Core rev: 2c5f70e7e73362502a7d8d0773fbd04520b26eef)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:30 +01:00
Chen Qi
052ddf26b1 systemd-boot: upgrade from 255.6 to 256
Patch 0001-src-boot-efi-meson.build-ensure-VERSION_TAG-exists-i.patch
is added to resolve build time error.

(From OE-Core rev: c3f53f641d04109bf88e51e44debb6c74582b5d0)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:30 +01:00
Chen Qi
74cd617cbb systemd: upgrade from 255.6 to 256
The 'cgroupv2' PACKAGECONFIG is dropped as systemd now only supports
cgroupv2.

The 'kmod' PACKAGECONFIG is now added 'libkmod' as a runtime dependency.
This is because systemd 256 uses dlopen to make use of libkmod, and there's
no way for our library detection codes to know this and add such dependency
automatically. So we add it explicitly.

mime is now inherited because ${datadir}/mime/packages/io.systemd.xml
is a mime type file.

For musl specific patches, most are refreshed. One old patch is dropped,
and four new ones are added.
Newly added:
  build-path.c: avoid boot time segfault for musl
  adjust header inclusion order to avoid redeclaration
  undef stdin for references using stdin as a struct member
  include signal.h to avoid the 'undeclared' error
Dropped:
  src/basic/missing.h: check for missing strndupa
  (drop reason: systemd does not use strndupa any more)

(From OE-Core rev: 89b75b46371d5e9172cb496b461824d8551a2af5)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-13 23:28:30 +01:00
Richard Purdie
3c1c56ec07 native/nativesdk: Stop overriding unprefixed *FLAGS variables
We're currently encouraging an "arms race" with the FLAGS variables since
a recipe might want to set a specific flag for all variants but to do so,
+= won't work due to the assignment in the native/nativesdk class files. This
means recipes are using append.

Since the default variables are constructed out of TARGET_XXX variables and
we redefine these, there is no need to re-define the un-prefixed variables. If
we drop that, the += appends and similar work and recipes don't have to resort
to append.

Change the classes and cleanup a number of recipes to adapt to the change. This
change will result in some flags appearing to some native/nativesdk variants
but that is probably what was originally expected anyway.

(From OE-Core rev: a157b2f9d93428ca21265cc860a3b58b3698b3aa)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-01 13:58:08 +01:00
Kai Kang
d876223293 glibc: fix fortran header file conflict for arm
There is a file conflict for arm when multilib enabled:

| Error: Transaction test error:
|   file /usr/include/finclude/math-vector-fortran.h conflicts between attempted installs of
    lib32-libc6-dev-2.39+git0+312e159626-r0.armv7at2hf_neon and libc6-dev-2.39+git0+312e159626-r0.cortexa72

Install math-vector-fortran.h to the gfortran default search directory
which is arch specific to avoid the conflict.

(From OE-Core rev: d2165543e796d4558c632af24eb7b115bca45969)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-26 14:33:42 +01:00
Daniel Semkowicz
0ed32141fe os-release: Fix VERSION_CODENAME in case it is empty
If DISTRO_CODENAME was not set, VERSION_CODENAME field was populated
with unparsed string. This resulted in the following line in os-release
file:

  VERSION_CODENAME="${DISTRO_CODENAME}"

According to systemd documentation, this field is optional.
Fix the problem by setting VERSION_CODENAME conditionally, only if
DISTRO_CODENAME was set.

(From OE-Core rev: 70a0b8bc1d846c857be90ce2e97e60c5ee32558e)

Signed-off-by: Daniel Semkowicz <dse@thaumatec.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Ulrich Ölmann
8de3508743 initramfs-framework: fix typos
Fix typos in debugging and error messages.

(From OE-Core rev: 4995e222ebdc9b5508c2f03a11868f184e4629a0)

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Wang Mingyu
8e40d3933e ttyrun: upgrade 2.32.0 -> 2.33.1
Bug Fixes:
- s390-tools: Fix formatting and typos in README.md
- s390-tools: Fix release string

(From OE-Core rev: 9dd58c3b42b50604e79b59d93564260d0c6f892c)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Johannes Schneider
1080de9926 systemd: bpf-framework: pass 'recipe-sysroot' to BPF compiler
Pass the "recipe-sysroot" path via the CFLAGS=--sysroot= to the
compiler used by systemd to build the BPF, so that it can find the
needed system includes.

(From OE-Core rev: 25560c19ac7629615adb2b1a71b05d36b0d157d5)

Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Johannes Schneider
a9138c1f51 systemd: bpf-framework: 'propagate' the '--sysroot=' for crosscompilation
The eBPFs are pre-compiled during the systemd-build with a different
compiler than the cross-compiler used to build systemd itself.

This is either a 'clang-native' or a gcc (bpf-unknown-none) which do
not see the BUILD_CFLAGS, that point to the correct include search
patch. To address this have systemd's meson.build "propagate" the
--system from the C_FLAGS into the BPF compiler call.

(From OE-Core rev: 3a4d5b06f8e4ebf7b4738a99fe6b352bb03a64ae)

Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Johannes Schneider
182e599dbc systemd: add PACKAGECONFIG for bpf-framework
The bpf-framework is used to pre-compile eBPFs that required for the
systemd.resource-control features RestrictFileSystems=[1] and
RestrictNetworkInterfaces=[2] to work.

Apart from 'clang-native' to compile the eBPFs, the required kernel
switches are described in [3].

Link: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#RestrictFileSystems=
Link: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#RestrictNetworkInterfaces=
Link: https://kinvolk.io/blog/2021/04/extending-systemd-security-features-with-ebpf/
(From OE-Core rev: 6f90320bf3028a67d1fd444dfaa62f3888066ea4)

Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25 11:50:58 +01:00
Ross Burton
28def3edba libxcrypt: correct the check for a working libucontext.h
The test fails with GCC 14.1 due to an incompatible pointer assignment,
take a patch submitted upstream to fix this.

(From OE-Core rev: 054304ecb3a8a8ed523bd149f70ed468cf613178)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-24 12:43:41 +01:00
Alexander Kanavin
cb963a0414 glib-networking: submit eagain.patch upstream
(From OE-Core rev: eb3958bab8e1a7307f4de7615ddac8222aaae5b0)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-24 12:43:40 +01:00