Commit Graph

58346 Commits

Author SHA1 Message Date
Chris Laplante
bd9cedf925 cve-update-db-native: remove unused variable
(From OE-Core rev: e9d24bae963aae93a1ace55c681b2d7de4ea935d)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 790f8a5bfbd1851226fa5fc5b09e79f6396e747d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chris Laplante
0ebe61887a cve-update-db-native: move -journal checking into do_fetch
It was always questionable to do this in an anonymous function, but now
with multiconfig it is a critical mistake and leads to more strange
"Exception: sqlite3.OperationalError: disk I/O error" errors.

(From OE-Core rev: 0e11c37e49272b967010df7dcebbe73a76f70edb)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fcbc9d0e8421a3a559db05005ba042337cd5d864)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chris Laplante
b623ea2d29 cve-update-db-native: be less magical about checking whether the cve-check class is enabled
(From OE-Core rev: ec2a17001a2a0180ecdb0b946ff8f7673e14ba24)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cbc717350b21fb417fa6f83621022ac633a26124)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chee Yang Lee
275a0baa72 libx11: fix CVE-2020-14363
(From OE-Core rev: 5919afe43083d9d0b818c26ca4d6c175efa0f7b5)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chee Yang Lee
0b214cad54 xserver-xorg: fix CVE-2020-14346/14361/14362
fix :
CVE-2020-14346
c940cc8b6c

CVE-2020-14361
144849ea27

CVE-2020-14362
2902b78535

(From OE-Core rev: d485870543fbc111832735ae713b2ec405ce78fa)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chee Yang Lee
4557652c4f bash : inlcude patch 17 & 18
(From OE-Core rev: bf8f33c62f6fe98777248fb05ce3105e9f63d03a)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Chee Yang Lee
d51df4da28 qemu : fix CVE-2020-16092
(From OE-Core rev: 6007398a0ff468c0b15c4982d7f04e6186d6d700)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Khem Raj
e3a6561373 site: Make sys_siglist default to no
glibc 2.32 has deprecated sys_siglist [1]

since no is default for musl as well, therefore elevate it to common
site file for all

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=b1ccfc061feee9ce616444ded8e1cd5acf9fa97f

(From OE-Core rev: 766e1565f3d33d9222323076cd57c22994bc25bf)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7c19f30849e9a73a7497d8e6c4719a2e57017086)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Richard Purdie
177dab780a buildtools-tarball: Add python3-jinja2
This is used by various pieces of the result handling code, particularly the
performance testing and we're seeing autobuilder failures that are
easiest resolved using this.

Acked-by: Tim Orling <ticotimo@gmail.com>
(From OE-Core rev: 5dc390658f0839911d85fe7f3f3ce8bf006e69eb)

Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dc6d4d438b71365f5c6f54b8482d4f01f1d0dc8e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Richard Purdie
993615ffec python3-jinja2: Import from meta-oe/meta-python
This is used by some of the results handling code and needed as part of
buildtools tarball on various autobuilder worker for testing.

ptest is disabled for OE-Core, at least for now since it depends on
python3-pytest which in turn has may other dependencies.

Acked-by: Tim Orling <ticotimo@gmail.com>
(From OE-Core rev: cc0f56a788c33ad3fd2bb5402dee497234fb06bb)

Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b5156e95e9e80e3e0f7eea181cd12f85e03a111d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Richard Purdie
d7dfbbfb43 python3-markupsafe: Import from meta-oe/meta-python
Needed as a dependency of python3-jinja2. ptest is disabled for OE-Core, at
least for now since it depends on python3-pytest which in turn has may other
dependencies.

Acked-by: Tim Orling <ticotimo@gmail.com>
(From OE-Core rev: ec222f6af5f8629453ac8e71a1dd6c44ec9a88c8)

Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a6f2727fd309b8b46a7ac1b8d99ae1d77a6ee74c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-06 14:15:21 +01:00
Richard Purdie
012ad10a89 build-appliance-image: Update to dunfell head revision
(From OE-Core rev: b39bda4cc62db12c0edfbe489d5a7f5988ede6a9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
dunfell-23.0.3 yocto-3.1.3
2020-09-23 14:39:42 +01:00
Richard Purdie
5ad5949578 scripts/oe-build-perf-report: Use python3 from the environment
This means ot matches the rest of the system rather than causing confusing errors
where multiple python versions are mixed.

(From OE-Core rev: 95d5005828b0d32d610874986fcc298b12347079)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-23 12:47:59 +01:00
Richard Purdie
9f4dbd6437 build-appliance-image: Update to dunfell head revision
(From OE-Core rev: d652b2aaa02a8aa9ff8f0ad84ca7762a6f950640)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:51 +01:00
Steve Sakoman
bb24db8e6b Revert "kernel.bbclass: run do_symlink_kernsrc before do_patch"
This reverts commit 914d8a00e34a8edf75a349da6f5978e4ed60e6d5.

Due to bug introduced for externalsrc

https://bugzilla.yoctoproject.org/show_bug.cgi?id=14044

(From OE-Core rev: a6a9913575aab96f4347bdf979e26115aa0fd716)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Khem Raj
2f63316394 populate_sdk_ext: Do not assume local.conf will always exist
Some distros may not have local.conf, and use auto.conf or site.conf
alone to describe distro config metadata, therefore make code robust
to not fail eSDK builds for such setups

(From OE-Core rev: 554dba802108c91b79acf81c046e6a47815404fb)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6379f951ba92b2b86a55de5fc267bacf8c6095d2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Michael Gloff
a509a6301e sysvinit: Remove ${B} assignment
The VERSION variable is not set unless the
top level Makefile is used as the version is
derived from the Changelog.
If VERSION is not set, none of the binaries built
in the sysvinit recipe will have a valid version
output.
Before:
INIT: version  booting
After:
INIT: version 2.96 booting

Using the top level Makefile does not cause any
additional builds to occur.

(From OE-Core rev: c8ad554db100b9fd16097fc8616b2af5390772e7)

Signed-off-by: Michael Gloff <mgloff@emacinc.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 10992ad4f343d0f92d9d6246cc2e58effd3f3eeb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Pierre-Jean Texier
86814b7354 libubootenv: upgrade 0.3 -> 0.3.1
This is a bugfix release which includes the following changes:

824551a Prepare 0.3.1
ca6aaa1 Fix file reading/writing when the environment is in EEPROM
a031dea Fix regression in UBI volume support
c91c150 Define SOVERSION to indicate API version

(From OE-Core rev: 2e646f0aca9a0af7e308590117c220c940996d86)

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 447eb941ef43cd5af19aed650fb7da718cedda61)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Christophe GUIBOUT
fe87efd920 initramfs-framework: support kernel cmdline with double quotes
It avoids init to crash when kernel cmdline contains a string with
spaces inside, like that:
dyndbg="file drivers/usb/core/hub.c +pltf"

(From OE-Core rev: 16bad6260a6a25b2ec25c7eb0dfe526db56f166e)

Signed-off-by: Christophe Guibout <christophe.guibout@st.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 88b8b94bd2d052bca29d27bd5cd00eddb0f5999d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Geoff Parker
99d2fe8638 systemd-serialgetty: Replace sed quoting using ' with " to allow var expansion
A recent commit added single quotes around the sed regex's. This prevented the
expansion of $default_baudrate in do_install(), and ended up with systemd's'
serial-getty@.service file having a literal $default_baudrate.

This broke the serial console getty service.

serial-getty@.service was getting a line which looked like this:

  ExecStart=-/sbin/agetty -8 -L %I $default_baudrate $TERM

Rather than:

  ExecStart=-/sbin/agetty -8 -L %I 115200 $TERM

Fixed by repacing the single quotes with double quotes in the sed expressions.

(From OE-Core rev: 1cc94a6b9b6a9d12f782471053448ad9795944bb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 80b721bfa4fe300a2f52f233f44fa2835426d304)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Rahul Kumar
2cc334afbf systemd-serialgetty: Fix sed expression quoting
Fix sed: -e expression #1, char 13: unterminated `s' command

Error Message:
| NOTE: Installed into sysroot: []
| NOTE: Skipping as already exists in sysroot: ['pseudo-native', 'glibc', 'patch-native', 'quilt-native', 'gcc-cross-arm', 'gcc-runtime', 'linux-libc-headers', 'libgcc', 'flex-native', 'xz-native', 'libtool-native', 'automake-native', 'binutils-cross-arm', 'zlib-native', 'mpfr-native', 'texinfo-dummy-native', 'autoconf-native', 'libmpc-native', 'gnu-config-native', 'gmp-native', 'attr-native', 'm4-native', 'gettext-minimal-native']
| DEBUG: Python function extend_recipe_sysroot finished
| DEBUG: Executing shell function do_install
| sed: -e expression #1, char 13: unterminated `s' command
| WARNING: exit code 1 from a shell command.
| ERROR: Execution of '/opt/Projects/poky/build/tmp/work/qemux86_64-poky-linux/systemd-serialgetty/1.0-r5/temp/run.do_install.11228' failed with exit code 1:
| sed: -e expression #1, char 13: unterminated `s' command
| WARNING: exit code 1 from a shell command.
|

To Fix this Issue using the strong (single quote) character in sed command.
It is recommend to use quotes. If we have meta-characters in the command, quotes are necessary.

(From OE-Core rev: edaecac74210ae201dc5eea5758bcf4e85cb14cb)

Signed-off-by: Rahul Kumar <rahulk@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e2fea05e150dcfec4b7dfbd8edddb53897026bf9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-22 23:34:40 +01:00
Richard Purdie
44ab5a8477 bitbake: tests/fetch: Move away from problematic freedesktop.org urls
We're either hitting rate limiting with freedesktop.org or the
servers have intermittent network connections. Use our own mirror
of these repositories instead.

(Bitbake rev: 18e1957337fd9f06bc673d28dd4f8277321d07bc)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a1b7ab5c9d5e64969f5ca0e41c0ac13c723e3761)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-18 19:14:26 +01:00
Steve Sakoman
3a31d9ff80 poky.conf: Bump version for 3.1.3 release
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-18 06:46:21 +01:00
Bruce Ashfield
826662534f yocto-bsp: update to v5.4.58
(From meta-yocto rev: d46b40c0e1387ac0d7883659a88b9842f5b7350a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cb67b9bcbd18a612a6e5e5bf6acfe1614aca990a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-18 06:46:21 +01:00
Bruce Ashfield
57933737b9 yocto-bsp: update to v5.4.56
(From meta-yocto rev: 22e4ca42b749c8947837bd7bb93cde6fd448fde3)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 34dfaf81b03789054d58716d43c9fc447d8bd69b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-18 06:46:21 +01:00
Bruce Ashfield
954ed426af yocto-bsps: update reference BSPs to 5.4.54
(From meta-yocto rev: 4780bd63af07fe694a071640cf9942ba3bfc3824)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc10c1589b4a4c9471bd5c847ef2f8ccc4e8a58f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-18 06:46:21 +01:00
Chris Laplante
cf0d81d6bf cve-check: avoid FileNotFoundError if no do_cve_check task has run
For example, if you just run 'bitbake cve-update-db-native' in a clean
build system, |cve_tmp_file| won't exist yet.

(From OE-Core rev: b98e50f08b2bcf61fbc75ea1b0ad83a17c0a736a)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dd4473f3d8e1c1a587b6de660775e4b46ddc5fad)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Chris Laplante
738fe904c7 cve-update-db-native: use context manager for cve_f
(From OE-Core rev: c8c307c4b28d93938887ecb1d87f6024e916c0f9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ff422652e1b5db62205fafc75ce56bb5951d478d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Chris Laplante
ed69955083 cve-check/cve-update-db-native: use lockfile to fix usage under multiconfig
Previously CVE_CHECK_DB_FILE / CVE_CHECK_DB_DIR was the same across
multiconfigs which led to a race condition wherein multiple
cve-update-db-native:do_populate_cve_db tasks could attempt to write to
the same sqlite database. This led to the following task failure:

    Error executing a python function in exec_python_func() autogenerated:

    The stack trace of python calls that resulted in this exception/failure was:
    File: 'exec_python_func() autogenerated', lineno: 2, function: <module>
         0001:
     *** 0002:do_populate_cve_db(d)
         0003:
    File: '/mnt/data/agent/work/74f119cccb44f133/yocto/sources/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 103, function: do_populate_cve_db
         0099:        if year == date.today().year:
         0100:            cve_f.write('CVE database update : %s\n\n' % date.today())
         0101:
         0102:    cve_f.close()
     *** 0103:    conn.commit()
         0104:    conn.close()
         0105:}
         0106:
         0107:def initialize_db(c):
    Exception: sqlite3.OperationalError: disk I/O error

Use a lockfile to ensure multiple tasks don't step over each other.

(From OE-Core rev: f08604d27ecacfd37bd37bfaf4c76f17b8f65604)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 24e9380643a2ae3fcae193519cb64aedaf682153)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Chris Laplante
5d97a53f1e cve-update-db-native: add progress handler
(From OE-Core rev: 694f5107388c5301b82581007ff5fe96dfa8769d)

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 79ae2e82b8ec11578177f428060b568d6c7d44ca)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
akuster
ed79212913 cve-check.bbclass: always save cve report
The cve-check file should be saved always, it has good info.

Put a copy in the log dir as cve-summary with symlinks to latest run.

[Yocto #13974]

(From OE-Core rev: 4dab2610a35a998ee0bf5309a0b399ee0d54b4a8)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 859849c7b594d844819ad8c3f7d8325388d94b93)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ovidiu Panait
f2422aad3b libxml2: Fix CVE-2020-24977
GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow
vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has
been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1).

Reference:
https://gitlab.gnome.org/GNOME/libxml2/-/issues/178

Upstream patch:
50f06b3efb

(From OE-Core rev: d5406b389fcae8fb0f5fc9cc7dbf7ee819c04bc8)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 92dc02b8f03f3586de0a2ec1463b189a3918e303)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ross Burton
c68c4aa22c cmake: whitelist CVE-2016-10642
This CVE is specific to the npm package that can install cmake, so isn't
relevant to our cmake recipe.

(From OE-Core rev: ad11e4a9afea5a4c9dd34a7fa37b82efd61952a4)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8e74ed809ec4c1f61264ecf5be4bc319e5e07766)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ross Burton
6110dcd60f curl: add vendors to CVE_PRODUCT to exclude false positives
To avoid false positives (such as CVE-2010-0734, rubygems:curl), expand
the CVE_PRODUCT list to include all the vendors that have been used.

(From OE-Core rev: 3c0029c9cf22b6983020edf9ce2aeb7b326d8c12)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb265122cccea9466405fdd924ad10ce8cda0dec)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Oleksandr Kravchuk
59b9e3c0ef ell: update to 0.33
Changelog
- Fix issue with uintset and number of bytes copied.
- Fix issue with overflow in DHCP lease T2 computation.
- Fix issue with side channel leak in l_ecc_scalar_new.
- Fix issue with missing MSG_MORE in l_cipher_set_iv.
- Add support for DHCP v6 client implementation.

(From OE-Core rev: deb77c59b9c11738a93fc80c1b256b3df8e14827)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ad8ca257d40f5041b3ec167e4117c687da448a9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Zhixiong Chi
7bd5cf65a6 gnutls: CVE-2020-24659
Backport the CVE patch from the usptream:
https://gitlab.com/gnutls/gnutls.git
commit 29ee67c205855e848a0a26e6d0e4f65b6b943e0a

(From OE-Core rev: fe3eebd129409fd8ed3ad1705a87eced5a61b33e)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 84b1bc500e318657cb7a8a189b59cc63bc91dca3)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Richard Purdie
dc0673760d oeqa/concurrencytest: Improve builddir path manipulations
Its possible some patterns may cause problems with the current path
manipulations, make a small tweak to try and avoid potential pathname
overlap issues.

(From OE-Core rev: b90c8e041a9a2daa9472ed37630d8e0fdec18d36)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 889005dc17d3e3b8eadee907ee2c05b8ff613285)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Richard Purdie
a4ced5e157 selftest/signing: Ensure build path relocation is safe
Similarly to 04ee0e8b95cd8ed890374e0007f976684206b630, ensure only full
build paths are replaced in the environment to avoid breaking buildtools.

(From OE-Core rev: 3be3740d0239f2eb198ccd2b75597cdccbdd1efc)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fcd0a9683af1a9155eabbd9056e3b46d4a931b2e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Adrian Freihofer
98905dd827 oe-publish-sdk: fix layers init via ssh
Escaping does not work in my use case. It must be escaped for
python, ssh and shell as well as for different versions of echo.
Let's try it a little less elegant, but hopefully more reliable.

(From OE-Core rev: cdbc9bf63b3e1354800032d0dd530949bafb7032)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5cc1ae332eb6b05d83802c8d64ab2767c7079412)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Matt Madison
15531ddeb0 image.bbclass: fix REPRODUCIBLE_TIMESTAMP_ROOTFS reference
Commit 97b439469a45a089431ca9c31893288c855045f4 added a fallback
mechanism for getting the rootfs timestamp. However, it uses curly
braces around the variable name, which causes bitbake resolve the
variable reference, rather than the shell, so the git timestamp
never gets used. Fix the reference to restore the intent of
making it a fallback for when there is no git timestamp to
retrieve.

(From OE-Core rev: 21d7ab8ce10f6d6a56875244c09dcfebae457b22)

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fbcf2c1c255b0c61a795c032cf7b67f5db41baa8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Richard Purdie
54ef7e8750 runqemu: Add a hook to allow it to renice
We have an issue where qemu is being starved of resources on our autobuilders.
We can't raise its priority without special capacilties, therefore add a hook
which if present can allow this to happen using an executable
"~/runqemu-renice".

(From OE-Core rev: 829443b3fafa000e330c06ebb144641bd2d20ad1)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 141a3c9ce93bc3d526303021ecf0460c6e9fea8a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ross Burton
52ede1bca7 autoconf: consolidate DEPENDS
Depending on nativesdk- varients in a nativesdk build isn't correct, so
just collapse the DEPENDS down and let bitbake do the right thing (which
is leaving them as -native).

(From OE-Core rev: 32902a2763a7557d52bf27f3717b8f9b27275284)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4864167ad4ed4c57e49f2aa5e7c58383bddb052b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ross Burton
7724cd224a insane: only load real files as ELF
The file path checks are passed an ELF object if the file is an ELF. It
doesn't make a lot of sense to load symlinks to ELFs as if they're in
the same package then the real file will be checked too.

This should speed up do_package_qa slightly as libraries won't be
scanned repeatedly.

(From OE-Core rev: 0b6f03752e6581a15e5fb900a8de7aef78709ef6)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c63af30d3b6350361daff94a59d4f14d7c5395e1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Ross Burton
b06a1c090a gdk-pixbuf: add tests PACKAGECONFIG
Convert the installed-tests toggle from simply respecting PTEST_ENABLED
to a PACKAGECONFIG, so that it can be turned on/off in the usual manner.

(From OE-Core rev: 02a1d8edc42961a4d97e6cd8d6e7cc573e1c1486)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 08e61ffae6056055b56f93678bcbb9fd71f3303e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Khem Raj
fef0b3bcdf rpcbind: Use update-alternatives for rpcinfo
rpcinfo is also provided vy netkit in meta-networking

(From OE-Core rev: 177a82f0e9f9c7fa12dd39cbbdd2ac64d920699d)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 28183dfd7446de9113773ab89edd0afb4ab82f7e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Lee Chee Yang
94b6af19ef libx11 : fix CVE-2020-14344
fix CVE-2020-14344 with squashed patch.
squashed patch include below patch,
1703b9f343
1a566c9e00
2fcfcc49f3
388b303c62

also include fix to issue introduced in above patch
(388b303c62aa35a245f1704211a023440ad2c488)
93fce3f4e7

(From OE-Core rev: b68ded7dee5e6e8b8f23840e3118edcdee7e5c7e)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Lee Chee Yang
a063c1c630 qemu: fix CVE-2020-14364 CVE-2020-14415
(From OE-Core rev: 1a150f0df36892283686e3e1afb30a7742c8e252)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Lee Chee Yang
cf2f611fcb xserver-xorg: fix CVE-2020-14347
(From OE-Core rev: 02484c21042fcbd31d2982fc1cf60d565ae035e4)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Khem Raj
773eae6f59 uninative: Upgrade to 2.9
This supports glibc upto 2.32 which is now rolling into distributions

(From OE-Core rev: 0f01fb2286335dd0da0c7be3f56c36a0fced3e42)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5cda8c7d642cfb72242c95f450e3391bd6537709)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:51:24 +01:00
Richard Purdie
23ec5b5087 bitbake: fetch2: Drop cups.org from wget status checks
Its becomming clear the upstream server doesn't like this, drop these
two urls from the test, not sure we need them here anyway.

(Bitbake rev: 16774d4d41f2011e8db7d2986a1a701df123dfc1)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ab2ef942dc21f9639793c972f2e546edf9444783)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 12:29:50 +01:00