Backport appropriate patches to fix CVE-2022-2879 and CVE-2022-41720.
Modified the original fix for CVE-2022-2879 to remove a testdata tarball
and any references to it since git binary diffs are not supported in
quilt.
(From OE-Core rev: a896cebe1ce2363b501723475154350acf0e0783)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
By default GOCACHE is set to $HOME/.cache.
Same issue for all other go recipes had been fixed by commit 9a6d208b:
[ go: avoid host contamination by GOCACHE ]
but that commit missed go-crosssdk recipe.
(From OE-Core rev: 803b754c64c8ee923cc02c17cf80798c93e3811c)
Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e5fd10c647ac4baad65f9efa964c3380aad7dd10)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update to latest v1.17.x release.
Contains fix for CVE-2022-32189.
go.git$ git log --oneline go1.17.12^..go1.17.13
15da892a49 (tag: go1.17.13, origin/release-branch.go1.17) [release-branch.go1.17] go1.17.13
703c8ab7e5 [release-branch.go1.17] math/big: check buffer lengths in GobDecode
d9242f7a8c [release-branch.go1.17] cmd/compile: do not use special literal assignment if LHS is address-taken
489c148578 [release-branch.go1.17] cmd/compile: fix prove pass when upper condition is <= maxint
66c60f076c [release-branch.go1.17] runtime: clear timerModifiedEarliest when last timer is deleted
c25b12fb81 [release-branch.go1.17] runtime: use saved LR when unwinding through morestack
1ed3c127da (tag: go1.17.12) [release-branch.go1.17] go1.17.12
(From OE-Core rev: 5acea6ee55d36987609bfa38b579ba86ca1879d1)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
go1.17.9 (released 2022-04-12) includes security fixes to the crypto/elliptic and
encoding/pem packages, as well as bug fixes to the linker and runtime.
go1.17.10 (released 2022-05-10) includes security fixes to the syscall package,
as well as bug fixes to the compiler, runtime, and the crypto/x509 and
net/http/httptest packages.
(From OE-Core rev: bcbfff47e212627b355c54ab782f38708ed12d4c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no reason to include a path in foo[dirs] if it is also in
foo[cleandirs] (except if it is the last path in foo[dirs]).
(From OE-Core rev: 9f610748f760b2d58d5250b55ae4b268909f33ef)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit 9985b17a30bb ("go: correctly set debug-prefix-map and build
directory") has changed CGO_LDFLAGS to the manually crafted version of
LDFLAGS to strip out DEBUG_PREFIX_MAP contents.
However this manually crafted version includes ${SECURITY_LDFLAGS}.
If security_flags.inc is not included, the variable is not defined, thus
CGO_LDFLAGS will include the '${SECURITY_LDFLAGS}' literally. When
building the recipe, the build would break with the follwing message:
aarch64-linaro-linux-gcc: error: ${SECURITY_LDFLAGS}: No such file or directory
So, instead of manually specifying variable contents, perform the
expected action: filter offending arguments out of LDFLAGS.
Cc: Alexander Kanavin <alex.kanavin@gmail.com>
(From OE-Core rev: e7d2d68679c1980d9e889d96c3eab49589f5b832)
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Go has its own system for creating temporary build
sub-directories with randomized names, and setting
up debug-prefix-map on the fly to prevent those
directories leaking into target binaries. OE's own
settings were clashing with it, so this change
carefully avoids the two stepping on each other.
Additionally, the top level build directory cannot
be named 'go-something'.
(From OE-Core rev: 9985b17a30bb9b9f1bc82a44662687db5cead66e)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
go writes build-specific ids into binaries it produces
and has a custom system for calculating them from
file hashes, environment variables and other inputs
(not that dissimilar to sstate cache, actually). This can
go wrong :) in various ways (for purposes of reproducibility
in particular), so this enables useful logs to see what
happens and why.
(From OE-Core rev: a587be1d18fc55fe57d1aa5aa7c9e26af887109e)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The release includes fixes for CVE-2021-41771 and CVE-2021-41772
(From OE-Core rev: 69c68f470e8e12456a4d9abf2d1c33b857e4ea37)
Signed-off-by: Pavel Zhukov <pavel.zhukov@huawei.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This reverts commit 4118415d4b.
This was found to be unnecessary, and broke upstream version checks.
(From OE-Core rev: cee436d1eb94663f3604c80b6ad87292f6901498)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
golang.org/dl is resolving to this anyway
(From OE-Core rev: 8470e38ac1d9f9bb6d8a4ee43724af452d080057)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
go-dep was an effort for dependency management before go modules, which
since 2020 has been deprecated in favor of go modules. Since its not
developed any longer and go mdules is officially supported, this should
be retired from OE-core as well.
(From OE-Core rev: 1e7ed44d87034446f1d07692c9378c3b0a8a9dd3)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Otavio Salvador <otavio.salvador@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
go1.16 has added CGO support for riscv64 arch
(From OE-Core rev: 8e078238312948e8c7b09c66ba7a186512e995d3)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Define CXX_FOR_TARGET and CC_FOR_TARGET for target go
since we are cross building it, it helps in defining the compiler
for cgo on target
backport a patch to fix CGO_LDFLAGS regression like below
Fixes
| Building std for target, linux/arm.
| go build runtime/cgo: invalid flag in go:cgo_ldflag: -Wl,-O1
(From OE-Core rev: a71d1b58e8cf0976a614c49aa2dfe1e0605dfe95)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Set PV directly to allow automated version updates between point releases.
(From OE-Core rev: 84034ea18a9fb1a012a1ecdc3a84296b08d3cc23)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is bug fix release on 1.15 stable version
(From OE-Core rev: 0783a84a6b0df84be590f59e70cb80506c774f4d)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
1.15 is latest major release changelog is [1] and detailed blog is [2]
Drop hardcoding ldso patch in favor of setting it using GO_LDSO variable
which can be defined in terms of linuxloader defined by OE
Setting GOBUILDMODE to pie is no longer needed
[1] https://golang.org/doc/go1.15
[2] https://blog.golang.org/go1.15
(From OE-Core rev: aa1bfaff4adc9246a2d65592b3a8061d55829086)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bring in only patch from meta-riscv here
(From OE-Core rev: 2e6e7b0be6e5ba5ab8fe9478c1dfdd530d22123f)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
cgo is still not available in go for riscv64, we will re-evaluate it
once we upgrade to 1.15
Fixes
| /usr/src/debug/go-runtime/1.14.4-r0/go/src/runtime/cgo/gcc_util.c:23: undefined reference to `_cgo_sys_thread_start'
[YOCTO #13966]
(From OE-Core rev: f512b3308ed6ee878c77f72b9235ada83d107dba)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Merge the .bb/.inc, and add an explanatory comment.
(From OE-Core rev: cb9eda76f53efa901d8eaadaedc456b9d29cd748)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
