CVE-2024-37535:
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service
(memory consumption) via a window resize escape sequence, a related
issue to CVE-2000-0476.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-37535]
Upstream patches:
[036bc3ddcb]
[c313849c2e]
(From OE-Core rev: 132a5168b125d6f4fb9391d982bc64d73429ab8f)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Use git for SRC_URI as thi release has not appeared on gnome downloads yet
Drop LGPL-2.0 as it has fully moved to LGPL-3.1+ see [1] that also
covers for change in License checksums for GPL-3
Add license information to cover for Xterm files in libvte
Add new glade files into -dev package
[1] 5e14529d42
(From OE-Core rev: 4a1a20325e2d40256e03ab1a5be348a4c213d181)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Have vte-prompt in my images. Since upgrade 0.60.2 all terminals complain with:
| bash: /usr/libexec/vte-urlencode-cwd: No such file or directory
Grepping sources shows that vte.csh and vte.sh are the only callers of
vte-urlencode-cwd. Both are installed by vte-prompt so move vte-urlencode-cwd
where it's used.
(From OE-Core rev: 1ea62721b1c06a77b18cf210ee437c292f58104b)
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is new in 0.60, and needs to be added explicitly
to cause vte to rebuild properly against icu changes
(there will be a QA check to catch such situations).
(From OE-Core rev: cfa58fc143e19f465f4cb39d5e4f2c18b5f3ae85)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Besides checking DISTRO_FEATURES for required or conflicting features,
being able to check MACHINE_FEATURES and/or COMBINED_FEATURES may also
be useful at times.
Temporarily support the old class name with a warning about future
deprecation.
(From OE-Core rev: 5f4875b950ce199e91f99c8e945a0c709166dc14)
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* they moved to meson build
* all autotools specific patches must go
* although not inheriting gettext dependency on intltool-native can go
* tested with all variants of PACKAGECONFIG
* need it for gnome-terminal 3.34
(From OE-Core rev: 6e7cfd2edd7b35201478e66d47b21547a1032e30)
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Several files that are part of libvte (e.g. src/widget.cc)
are licensed LGPLv3+.
(From OE-Core rev: 4e3b013daaa07934f1fa81f1b26fe40fea1e3435)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It bugged me for a while that xfce4-terminal sets (tab-)title to 'Untitled'.
This is caused by bash variable PROMPT_COMMAND not set. vte ships /etc/profile.d/vte.sh
adding PROMPT_COMMAND and a function to handle.
Since
* not all consumers of 'libvte' are interested in this feature
* executable shipped by package 'vte' is not necessary for PROMPT_COMMAND support
create a seperate package.
Once applied patches for xfce4-terminal and gnome-terminal will be send.
(From OE-Core rev: c0bed1aa9549568a966d34d5a9e5902190f980cb)
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* license: COPYING was replaced by COPYING.LGPL2/COPYING.LGPL3/COPYING.GPL3
* prettify recipe a bit
(From OE-Core rev: 2cce886e322ac2220af369b75c075cfdb1ac36d3)
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Depend on gperf-native: The tarball used to include files generated
with gperf and this is no longer the case.
Use GIR_EXTRA_LIBS_PATH to fix introspection generation.
(From OE-Core rev: 028c398d0977b8f65a78f6a9ba2df8cc07dcc3cd)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
New release requires libpcre 2.
Enable gnutls by default to remove an annoying warning on every
vte widget. core-image-sato already has gnutls so this shouldn't
be a big deal.
(From OE-Core rev: c9b65168a6e5ca329c013d5932567eb6cca770f3)
(From OE-Core rev: 03f707ba1134b9706aed85665dc5f61aebbd5fb7)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Configure searches for xmllint which comes from libxml2-native.
(From OE-Core rev: 122f18ddf65ee025cfd164738eb76359cad2656b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
vala.bbclass DEPENDS on vala and vala-native: Drop the inherit so
that these dependencies can be added on-demand based on vte
PACKAGECONFIG. Add relevant items from vala class into the recipe.
Add copy of vapigen.m4 so building without vala actually succeeds.
Make building without vala the default PACKAGECONFIG.
Fixes [YOCTO #10386].
(From OE-Core rev: 516b5c407e19029c09b870d460f64b7133f742b4)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* License change LGPL 2.0 -> LGPL 2.1+
* vte-termcap is no more
* API break: current version seems to be parallel installable
with old one, but I did not opt for that.
* Add patch to avoid stack protection by default
* Use libtool-cross: libtool adds "-nostdlib" when g++ is used,
and this leads to a link failure on PIE builds: "undefined
reference to __init_array_start". libtool-cross has a hack to
avoid "-nostdlib"
(From OE-Core rev: dc21182ada418cf3917ae8319494d219462c5bfd)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The currnet patches in OE-core doesn't have the "CVE:"
tag, now part of the policy of the patches.
This is patch add this tag to several patches. There might
be patches that I miss; the tag can be added in the future.
(From OE-Core rev: 065ebeb3e15311d0d45385e15bf557b1c95b1669)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With the autodebug package generation logic, specifically setting FILES_${PN}-dbg
isn't needed in most cases, we can remove them.
(From OE-Core rev: 3ab59d49dd7c18e194b58d1248b4b87709b5a738)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport a fix from upstream to fix a denial of service via a malicious escape
sequence.
[YOCTO #8617]
(From OE-Core rev: d5065e2b1c49fa65627f0adec8e42190ebccb572)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If you currently do a DISTRO_FEATURES_remove = "x11" with OE-Core, you
see failures due to dependency problems. The work in resolving this was
partially completed a while back. This adds in the markup mainly for
gtk/gtk3+ recipes and means "bitbake world" will work successfully.
Rather than code the gtk/gtk+ specific distro features into each recipe,
a shared variable is used.
(From OE-Core rev: ef967c70182eeccb59c7511d838a7ecb0b2315c1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream, xz has been the only format for some time now, so let's
make it the default and adjust recipes that package old stuff.
(From OE-Core rev: 0f9ea90dde8f63aace19531e066580e41bf3d7cc)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Current releases of vte are LGPL 2.1+ but the one we have is still
LGPL 2.0.
(From OE-Core rev: 3583814792967bfa5f0a3d7d18146e447eabe348)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It uses function extentions like ptsname_r()
so we need to let build know about it
Change-Id: I5a06d08c56529a6b2cf3adf264656ae03b95c1d4
(From OE-Core rev: 1aa0346cf2a2104cfc969bfeb4ac58fa923d5fcb)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A lot of our recipes had short one-line DESCRIPTION values and no
SUMMARY value set. In this case it's much better to just set SUMMARY
since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY
is at least useful. I also took the opportunity to fix up a lot of the
new SUMMARY values, making them concisely explain the function of the
recipe / package where possible.
(From OE-Core rev: b8feee3cf21f70ba4ec3b822d2f596d4fc02a292)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
