Previously CVE_CHECK_DB_FILE / CVE_CHECK_DB_DIR was the same across
multiconfigs which led to a race condition wherein multiple
cve-update-db-native:do_populate_cve_db tasks could attempt to write to
the same sqlite database. This led to the following task failure:
Error executing a python function in exec_python_func() autogenerated:
The stack trace of python calls that resulted in this exception/failure was:
File: 'exec_python_func() autogenerated', lineno: 2, function: <module>
0001:
*** 0002:do_populate_cve_db(d)
0003:
File: '/mnt/data/agent/work/74f119cccb44f133/yocto/sources/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 103, function: do_populate_cve_db
0099: if year == date.today().year:
0100: cve_f.write('CVE database update : %s\n\n' % date.today())
0101:
0102: cve_f.close()
*** 0103: conn.commit()
0104: conn.close()
0105:}
0106:
0107:def initialize_db(c):
Exception: sqlite3.OperationalError: disk I/O error
Use a lockfile to ensure multiple tasks don't step over each other.
(From OE-Core rev: f08604d27ecacfd37bd37bfaf4c76f17b8f65604)
Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 24e9380643a2ae3fcae193519cb64aedaf682153)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog
- Fix issue with uintset and number of bytes copied.
- Fix issue with overflow in DHCP lease T2 computation.
- Fix issue with side channel leak in l_ecc_scalar_new.
- Fix issue with missing MSG_MORE in l_cipher_set_iv.
- Add support for DHCP v6 client implementation.
(From OE-Core rev: deb77c59b9c11738a93fc80c1b256b3df8e14827)
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ad8ca257d40f5041b3ec167e4117c687da448a9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
u-boot.inc and busybox.inc contain identical copies of this little
helper. They both inherit the cml1 class and use cml1_do_configure
right after having used this helper, and other recipes that want to
write similar logic for doing Kconfig via fragments will also need it
or something equivalent.
(From OE-Core rev: b0fb7f18f9091db50204ef1ebd5248739ddcd6c2)
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit af687c9137a3e8efe48afa6fd12866cf656ae913)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stable branch bug fix and security release.
One patch update, none deleted.
This is expected to be the final release in the 2.62.x stable series
Changes:
Fix SOCKS5 username/password authentication (#1986)
Exception handling fixes on Windows (!1373)
Bugs fixed:
1986 Socks5 Proxy: Authentication seems broken
1988 Socks5 Proxy: Wrong error returned when using no authentication
2049 Crash in g_array_copy
1378 Backport !1373 win32 exception fixes to glib-2-62
1380 Backport !1254 “giomodule: gio modules are no longer installed in bindir on MSVC” to glib-2-62
1393 Backport !1390 “garray: Fix copying an array with reserved elements” to glib-2-62
1394 Backport part of !1375 “tests: Skip g-file-info-filesystem-readonly test if bindfs fails” to glib-2-62
1411 Backport SOCKS5 fixes to glib-2-62
(From OE-Core rev: 2dc1266eb39faa29c79ab2697564072f11d3feb8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stable branch bug fix and security release.
One patch updated, three removed since they are no longer needed
Changes (from release notes):
Fix potential relative read when calling g_printerr(), which could lead to a
denial of service from a setuid-root process being used to block access to the
TTY for another user (#1919)
Fix SOCKS proxy resolver sometimes not being used when resolving addresses
via Happy Eyeballs (CVE-2020-6750) (#1989)
Several other Happy Eyeballs fixes for address resolution (#1871, #1872, #1902)
Fix parsing of full Julian day range from $TZ environment variable (#1999)
Several race condition/crash fixes (!1353, !1357)
Bugs fixed:
1919 read from relative path in g_printerr() in 2.58.3
1995 Tracker issue for Happy Eyeballs regressions
1999 GTimeZone fails to accept full Julian day range when parsing the direct $TZ string format
1323 Backport !1314 “gtimezone: fix parsing of Julian day in POSIX TZ format” to glib-2-62
1331 Backport !1330 “W32: Correctly set st_ino when doing private stat()” to glib-2-62
1352 Backport !1351 “glib.supp: update g-threaded-resolver-getaddrinfo-config” to glib-2-62
1361 Backport !1353 GMainContext source reference fixes to glib-2-62
1365 Refactor g_socket_client_connect_async()
1370 Backport !1369 “build: Rework path construction to reliably add prefix” to glib-2-62
1371 Backport !1357 “gunixmounts: Make GUnixMountMonitor thread-safe” to glib-2-62
(From OE-Core rev: d1c337161f70893cd4eec15364c6c41d5040ccc6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently in NVD DB an item popped up, which hasn't set baseMetricV2.
Let the parser handle it as an optional item.
In case use baseMetricV2 before baseMetricV3
(From OE-Core rev: 135a6a4f55aed6148f45d01b307fadbd45be2997)
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fdcbf3f28289188c5a97664d1421d4a5c4991eda)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The blocks which test for entry exitence (file or directory) use a
`A && B || C` syntax. This form is not behaving as a if-then-else block
even the code logic assumes that. C may run when A is true which breaks
the case where VERBOSE is 'no' but the file/directory exists.
Along with fixing these specific issues, this patch fixes the other
instances where blocks of form `A && B || C` are used as if-then-else.
(From OE-Core rev: 471094f8afa57548e9ff3fd7a99306f58b87d478)
Signed-off-by: Andrei Gherzan <andrei@gherzan.ro>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1b9ea22acb66554925720e04cf24100664234574)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
settimeofday(2) has been deprecated as of glibc 2.31
which hwclock makes use of. This patch makes hwclock
compatible with glibc v2.31
See patch for more details:
busybox/0001-hwclock-make-glibc-2.31-compatible.patch
Fixes [YOCTO #13981]
(From OE-Core rev: 92d8bba5405244ae2594abc1a012c08c74999ab4)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit 992cec44 (coreutils: Move stdbuf into an own package
coreutils-stdbuf) breaks package-qa when the single-binary
PACKAGECONFIG is used:
ERROR: coreutils-8.32-r0 do_package_qa: QA Issue: /usr/bin/stdbuf contained in package coreutils-stdbuf requires /usr/bin/coreutils, but no providers found in RDEPENDS_coreutils-stdbuf? [file-rdeps]
ERROR: coreutils-8.32-r0 do_package_qa: QA run found fatal errors. Please consider fixing them.
With that PACKAGECONFIG, /usr/bin/stdbuf is just a simple "script"
containing the single line
#!/usr/bin/coreutils --coreutils-prog-shebang=stdbuf
Since there's no point splitting stdbuf to its own package when all
the functionality is in the single big coreutils binary anyway, fix
this by not creating the separate stdbuf package for the single-binary
case. But also make sure that the coreutils-stdbuf item always exists
so recipes can always RDEPEND on coreutils-stdbuf.
(From OE-Core rev: c2ad3af9da9bb3a98c1d5d1b3d21eb8db643c189)
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 74d24b5b895198898944260136d05e991a203c11)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
as this is already packaged in kernel-install package,
it shouldn't be part of the base package
(From OE-Core rev: e62371448a7d5604fa6029c7a8be278e83dad35c)
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ed04241f30e12e7c0479026a9e354e49dfa4119c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
in container image, it don't have init system,
install package initscripts will report error:
systemctl: command not found
fix by use same way as systemd.bbclass to decide if systemctl
mask will run
(From OE-Core rev: 6622515c1fa7025543aea37c4b37831577485811)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 790276bde066ecc9876120c3097dcd57a9936f00)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This unit was changed from 'BindsTo' in the following commit.
"""
commit f0f359ec9210759f6b4dbfb35d3fba8af208c43a
Author: Jason Wessel <jason.wessel@windriver.com>
Date: Thu Aug 29 07:00:31 2019 -0700
serial-getty@.service: Allow device to fast fail if it does not exist
"""
It was changed back to 'BindTo' in the following commit.
"""
commit 63bbff61b78c651339c4b18d8376187379ec3b3c
Author: Otavio Salvador <otavio.salvador@gmail.com>
Date: Fri Jun 12 14:30:44 2020 -0300
systemd: Sync systemd-serialgetty@.service with upstream
"""
This is now causing runtime problem for qemuarm64. The default.target
is not reached until a timeout. Output is like below.
"""
root@qemuarm64:~# systemd-analyze
Bootup is not yet finished (org.freedesktop.systemd1.Manager.FinishTimestampMonotonic=0).
Please try again later.
Hint: Use 'systemctl list-jobs' to see active jobs
root@qemuarm64:~# systemctl list-jobs
JOB UNIT TYPE STATE
102 getty.target start waiting
1 multi-user.target start waiting
95 systemd-update-utmp-runlevel.service start waiting
110 serial-getty@hvc0.service start waiting
111 dev-hvc0.device start running
"""
We can see that we are waiting for /dev/hvc0, while in fact there's no /dev/hvc0.
Jason's commit actually solves such problem.
So restore to use Jason's method. Do not use 'BindsTo'.
(From OE-Core rev: b1d0eacc431517695c348ad14f4452be607c0b62)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 43b989c1231d3d867303ccebceda72364a9519ee)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a bugfix release:
ver 0.32:
Fix issue with handling D-Bus watch removal.
(From OE-Core rev: cee916d41aa067fd6f994bf5331962b73f74343c)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 98d97384167a8d297650e49f9cabf4fae823b4a0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The systemd upstream has been doing some improvements in the service
which were not in sync, with the forked file. Mainly:
- Use BindsTo to bind the service with the required serial device
- Add of getty-pre.target as dependency so we can run things before
getty@.service and serial-getty@.service
- Add conflicts to rescue to avoid issues with sulogin
We did not change the ExecStart and Environment fields so we don't have
side effects of this change.
(From OE-Core rev: e6e2cabc33ab30d38e31ef830f7bc5e3cd07b6d5)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 63bbff61b78c651339c4b18d8376187379ec3b3c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The autobuilder has been experiencing SSL: CERTIFICATE_VERIFY_FAILED
errors during error report uploads when using buildtools due to looking
for certs in /opt/poky
(From OE-Core rev: f47fe24317d2fd19112c7e38858b21b3457835d9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 197f1d5d14b8e57295f5a81c03c86abba5328614)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are few fixes specifically for compiling with gcc10 that are good
to have, before hitting them later
Backport build fix from master for aarch64 with gcc10
Drop CVE-2020-10029 patch its already applied on latest 2.31 branch
latest glibc 2.31 added fix for __getauxval/aarch64 issue
(From OE-Core rev: 04e5d5f5a4318c826768146f5cd5de03fd152550)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2c7e0e0bf32eb1ed0b7d8acddb16c0d1e93f2aa1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This was fixed in upstream version 4.4.12.
(From OE-Core rev: 06a841e22853e571e07998079529839c96a23b21)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 281d53ebab4c4c1b6c880ab14761d715196fb8d7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
staging_populate_sysroot_dir() collects postinsts from the sysroot
and executes them. These postinsts, in turn, may call binaries that
are only available from the sysroot. This works fine with recipe-specific
sysroots, as all necessary paths are already in PATH, but breaks down
in this recipe which imitates the old global sysroot way but doesn't adjust
the PATH to include the binary paths from global sysroot.
To reproduce the failure:
$ bitbake docbook-xml-dtd4-native
$ bitbake -c build_native_sysroot build-sysroots
...
Exception: subprocess.CalledProcessError: Command '/home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog' returned non-zero exit status 127.
Subprocess output:
/home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: 5: /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: xmlcatalog: not found
/home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: 8: /home/akanavin/build/tmp/sysroots/x86_64/usr/bin/postinst-docbook-xml-dtd4-native-xmlcatalog: xmlcatalog: not found
(From OE-Core rev: 17fad96d3d9a8cfbc6724466475f6f161e967b74)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6b5f7bda4204d45cd29670cefcd53dc5da031095)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
22af6a2595 removed the PACKAGES
setting, but left the FILES-assignments of libsysfs-dev and -staticdev.
As these have no use anymore they can be safely removed
(From OE-Core rev: 7c3eb092392e3ae76408c8ad4cb0f3f18dc42a96)
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 941cc0cd0a69e95ca571a9a8cb0732bb06fa2b3a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This tool can be turned on in busybox which lead into a error during
do_rootfs.
(From OE-Core rev: 29ada652108335b4074ed330586f893bba1c5dce)
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit eb22e7a1190a79fd74ae54f23a13ec4932f41b0d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since commit [882ae0dcce core-image-minimal-initramfs: use
initramfs-framework for initialization] applied, it should
keep the restriction with initramfs-module-install
(From OE-Core rev: 176da1d6fbd006c770c3c02c6355a692adac3c74)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 295dbabce213855432b6274026e3b45a18b90e80)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently only VERSION_ID field is sanitized, but os-release (5) has
more fields with the same requirement. Moreover, those fields come
unquoted in most distributions, because quotes are not needed for a
values without whitespaces.
(From OE-Core rev: ea39b2edecc00cc2340328893cdfbefed5d3b981)
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport patches from upstream to fix a build error in the kill utility.
Fixes:
| In file included from ../util-linux-2.35.1/misc-utils/kill.c:57:
| ../util-linux-2.35.1/include/pidfd-utils.h: In function ‘pidfd_open’:
| ../util-linux-2.35.1/include/pidfd-utils.h:19:17: error: ‘SYS_pidfd_open’ undeclared (first use in this function); did you mean ‘pidfd_open’?
(From OE-Core rev: 9620c4e6e0e184b2b3907c8f8da4b7b54b97354e)
Signed-off-by: Benjamin Fair <benjaminfair@google.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
On ubuntu 18.04.1, it does not provides `mdir' by default
which caused `wic ls **.wic' failed on fat partition
...
$ wic ls build/tmp-glibc/deploy/images/xilinx-zynqmp/wrlinux-image-std-xilinx-zynqmp.wic
ERROR: Can't find executable 'mdir'
...
Add nativesdk-mtools to buildtools-tarball and use buildtools
to provide mdir
(From OE-Core rev: 605c81ff90760cdf4a1247df777d5ce8e12d6f6f)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a bugfix release:
ver 0.31:
Fix issue with verification of the second certificate in chain.
Fix issue with handling trusted CA matching in verification.
(From OE-Core rev: c1892a1074560e27671975f4b9fb92468d9874da)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: Updated copyright years [1]
Latest master 0.10.x+ has added support for mips/mips64, which should
help compile ruby on musl for these architectures
Switch SRC_URI to github upstream URI
Check for common arches before checking others in map_kernel_arch
Drop already upstreamed patches
[1] d31eaabbaf
(From OE-Core rev: 5dbb7d5bb9509dd455673a326c9191dec6f3092c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Builds like native-openjdk, really wants a to link
some tools against the static version. Since when
using the extended tarball, its the only place to
get it, add the library.
(From OE-Core rev: dfeca4d1e2442192aa40c420648cae2914c30be5)
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently, this unit is packaged into udev-hwdb which then adds it as rdep
instead of rrecommends to systemd itself, this meant that even if we
added udev-hwdb to BAD_RECOMMENDATIONS, it would not be respected since
its a rdep, therefore move the service unit file into udev package
instead, this decouples the hard runtime dependency and restores the bad
recommendations expectations
(From OE-Core rev: bfaaefe8346e9f0eab153981fe6a3cc63590afb5)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Alex Kiernan <alex.kiernan@gmail.com>
Cc: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
