Commit Graph

4978 Commits

Author SHA1 Message Date
Khem Raj
d89c54ee99 go: Upgrade 1.11.1 -> 1.11.4 minor release
Source: OpenEmbedded.org
MR: 98328, 98329, 98330
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-devtools/go?h=warrior&id=b964551a0d08aa921d4e0ceea2f1e28a5e83510e

ChangeID: 0b4cc69c357ba14c4e7a6c7ff926cfc6f09489b2
Description:
include:
CVE-2018-16873
CVE-2018-16874
CVE-2018-16875

Changes: https://golang.org/doc/devel/release.html#go1.11

(From OE-Core rev: 69964488112899371b7fd88b6e86e533d968b457)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Bug fix only update]
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Richard Purdie
94bacd598d go-crosssdk: PN should use SDK_SYS, not TARGET_ARCH
The crosssdk dependencies are handled using the virtual/ namespace so
this name doesn't matter in the general sense. We want to be able to provide
recipe maintainer information through overrides though, so this standardises it
with the behaviour from gcc-crosssdk and ensures the maintainer overrides work.

(From OE-Core rev: 025cd45d4129266d34a919573c02a8504f092c1b)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Hongxu Jia
3975d95822 go-target.inc: fix go not found while multilib enabled
Go binaries were installed to ${libdir}/go/bin, and create symlink
in ${bindir}, while enabling multilib, libdir was extended (such as
/usr/lib64), but BASELIB was not (still /lib), so use
baselib (such as /lib64)) to replace

(From OE-Core rev: fca74928bf2002daf526ad8c1446c8d9ba891a78)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Armin Kuster
4faf6e9e07 file: Multiple Secruity fixes
Source: https://github.com/file
MR: 97573, 97578, 97583, 97588
Type: Security Fix
Disposition: Backport from https://github.com/file/file
ChangeID: 159e532d518623f19ba777c8edc24d2dc7e3a4e9
Description:

CVE-2019-8905 is the same fix as CVE-2019-8907

Affects < 5.36.0

Fixes:
CVE-2019-8904
CVE-2019-8906
CVE-2019-8906
CVE-2019-8907

(From OE-Core rev: 3d7375eb2e459b891b4ba16c1fc486afbfecef2c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Martin Jansa
016a0b830e python: add a fix for CVE-2019-9948 and CVE-2019-9636
Source: OpenEmbedded.org
MR: 98320, 98319
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-devtools/python/python_2.7.16.bb?id=9d23b982fa4e0290761b3d15f6959779fed72ad6
ChangeID: e79b6fe3b7b4253bf0d76b029070ae869d5234bd
Description:

Fixes:
CVE-2019-9948
CVE-2019-9636

CVE-2019-9940 is a dup of 9948 per python.org
CVE-2019-9947 appears to be a dup of 9940 per https://bugs.python.org/issue30458#msg295067

(From OE-Core rev: e7bdff05da6075efc21c5ac9492b06e481e5a239)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Minor clean up for thud]
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Armin Kuster
81439e7d18 python: Update to 2.7.16
Source: Python.org
MR: 98220
Type: Security Fix & Integration
Disposition: Backport from python.org
ChangeID: 96fdd2dee9fe9317eb72584583ae0100c0be9eaa
Description:

Bug fix update per Python.org
https://www.python.org/downloads/release/python-2716/

drop backported patch

License-update: copyright years

Helps prepare Thud for 2.7 EOL support moving forward.

Update includes:
CVE-CVE-2019-5010
06b15424b0

(From OE-Core rev: 592e7de7f5208940fbcfcad3371f93f8ce2ca738)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Armin Kuster
f2961d88af qemu: Several CVE fixes
Source: qemu.org
MR: 97258, 97342, 97438, 97443
Type: Security Fix
Disposition: Backport from git.qemu.org/qemu.git
ChangeID: a5e9fd03ca5bebc880dcc3c4567e10a9ae47dba5
Description:

These issues affect qemu < 3.1.0

Fixes:
CVE-2018-16867
CVE-2018-16872
CVE-2018-18849
CVE-2018-19364

(From OE-Core rev: e3dfe53a334cd952cc2194fd3baad6d082659b7e)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:18 +01:00
Armin Kuster
cd7f7bf385 elfutils: Security fixes CVE-2019-7146,7149,7150
Source: http://sourceware.org/git/elfutils.git
MR: 97563, 97568, 97558
Type: Security Fix
Disposition: Backport from http://sourceware.org/git/elfutils.git
ChangeID: 6183c2a25d5e32eec1846a428dd165e1de659f24
Description:

Affects <= 0.175

Fixes:
CVE-2019-7146
CVE-2019-7149
CVE-2019-7150

(From OE-Core rev: ac5dca7dc68519b36aa976dfd25d8efa76af74ec)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-27 18:05:17 +01:00
Ming Liu
cba849c25b opkg-utils: backport a patch to fix a sstate timestamp issue
When using sstate, two parallel builds can produce two packages
with the same mtime but different checksums. When later one of
those two builds fetches the others ipk, the package index does
not get udpated properly (since mtime matches). This ends up with
messages such as:
  Downloading file:/../tmp/work/../image/...ipk.
  Removing corrupt package file /../sysroot/../var/cache/opkg/volatile/...ipk

However, in that case, ctime is different. Use ctime instead of
mtime to prevent failures like this.

(From OE-Core rev: 6351f52609af51055786f7b3b24aee722b4dcea4)

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Richard Purdie
cd7114274d e2fsprogs: Skip slow ptest tests
The slow tests run unreliably with our current setup/infrsstructure/timeouts.

There are only five slow ones and having the other ~250 run reliably without timeouts
is the priority right now. We can revisit the slow tests at some later date if wanted.

(From OE-Core rev: ae87e2fab31590aaf8c2f0672d327d633f896cbd)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Changqing Li
0e354a5184 ruby: add ptest
(From OE-Core rev: ed650ca30379279f6a0f1e8f9f728cc542504732)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Changqing Li
6e17a309e2 ruby: make ext module fiddle can compile success
ext module fiddle depend on libffi, in ruby source tree,
there is in internal libffi in case target platfrom don't
install libffi, but autotools.bbclass delete configure
under libffi and not run autoreconf to regenerate one.so
we met this error:
ruby-2.5.3/ext/fiddle/libffi-3.2.1/configure: No such file or directory

the fix is add depend and extra_oeconf to use libffi in the system

(From OE-Core rev: 3a0272bab546a4b47feab117713e32873419bbe7)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Grandbois, Brett
0e159278a1 ruby: remove CVE-2018-1000073.patch as already fixed
rubygems 2.7.6 which is in ruby 2.5.3 has this fix and as currently
applied all gem extraction fails as the realpath check is done against
the full path including the file to be extracted which will always fail
as the file hasnt been extracted yet

(From OE-Core rev: a9cc1b3f9a684c14f02b06226693b023adc3e609)

Signed-off-by: Brett Grandbois <brett.grandbois@opengear.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Manjukumar Matha
589437ee23 ruby.inc: Add dependency on readline-native
Add dependency on readline-native to fix the following issue

uninitialized constant Logfile
|       Check ext/fiddle/mkmf.log for more details.
| readline:
|       Could not be configured. It will not be installed.
|
build/tmp/work/x86_64-linux/ruby-native/2.5.1-r0/ruby-2.5.1/ext/readline/extconf.rb:62:
Neither readline nor libedit was found
|       Check ext/readline/mkmf.log for more details.
| *** Fix the problems, then remove these directories and try again if
you want.

(From OE-Core rev: bddf9bec4913fb8eabe6f2995020bf06cc7f890a)

Signed-off-by: Manjukumar Matha <manjukumar.harthikote-matha@xilinx.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Richard Purdie
3c0cf0ecb2 pseudo: Update to gain key bugfixes
Newer distros are using new versions of glibc and coreutils which use the new glibc
renameat2 function. We need to intercept this for correct functioning of pseudo. This
is essential to ensure new distros continue to work with the project.

Also, this version has a fix for path/inode cross corruption problems which
may explain our mysterious locale permissions issues.

Many thanks to Otavio and Peter Seebach for the help in figuring this out and
fixing it.

(From OE-Core rev: b768cfb6c849cbbc2d6e2d03974af009ca5340de)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Ross Burton
8422861b17 python: fix CVE-2018-14647 in python-native too
(From OE-Core rev: 65042ebf07afad2922dcdfceb6e8931c05255649)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Changqing Li
51c5b21ae7 python-native: fix one do_populate_sysroot warning
Fix below warning:
WARNING: Skipping RPATH /usr/lib64 as is a standard search path for
work/x86_64-linux/python-native/2.7.15-r1.1/recipe-sysroot-native/
usr/lib/python2.7/lib-dynload/_bsddb.so

setup.py will check db.h under include_dirs, for native build,
/usr/lib64 will be insert to postion 0 of include_dirs, so
it's priority is higher then our sysroot, cause db.h sysroot
is ignored, and rpath set to /usr/lib64. and this cause warning
when do_populate_sysroot. use append to fix it.

(From OE-Core rev: 12df5392afb8446507bb73f4d33ee42e06a17b82)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Armin Kuster
c9595af8ad python: time.tzset missing
import time
time.tzset()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: module 'time' has no attribute 'tzset'

enable tzset in both python versions

(From OE-Core rev: e7721ee7e7942570ebab793f5870d7a021154a92)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Fix up for Thud context ie python3_3.5.6]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-22 00:31:48 +01:00
Adam Trhon
391d8a0fca icecc-env: don't raise error when icecc not installed
When icecc is not installed, the `which icecc` command in icecc-env.sh
returns nonzero. This happens when environment is being sourced. When
the terminal has `set -e`, the whole script fails and terminal is
closed.

Fix this by ignoring errors from the which command.

(From OE-Core rev: 84c63858be47d33e49140181d73c253886d5aec5)

Signed-off-by: Adam Trhon <adam.trhon@tbs-biometrics.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25 22:27:38 +00:00
Ross Burton
2ae09cc132 e2fsprogs: fix file system generation with large files
When copying files into the file system the file offset was being truncated to a
signed 32-bit value, so any files that are larger than 2^31 bytes were the right
size, but no content after that point.

(From OE-Core rev: a77360db529d0ac3cb91161001546754d0371aa2)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25 22:27:38 +00:00
André Draszik
afadb9aa51 meta: remove True option to getVar calls (again)
A couple have still been missed in the past despite multiple
attempts at doing so (or simply have re-appeared?).

Search & replace made using the following command:
    sed -e 's|\(d\.getVar \?\)( \?\([^,()]*\), \?True)|\1(\2)|g' \
        -i $(git grep -E 'getVar ?\( ?([^,()]*), ?True\)' \
             | cut -d':' -f1 \
             | sort -u)

(From OE-Core rev: 9f551d588693328e4d99d33be94f26684eafcaba)

(From OE-Core rev: 2da88ecbbf118bb7440f48184d4b39c273ab57e9)

Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-06 16:38:31 +00:00
Khem Raj
0dd5642977 binutils: bfd doesn't handle ELF compressed data alignment
Backport patches for ld/gold from master

[YOCTO# 13136]

(From OE-Core rev: e0ed2313f22c2ca30477942fc57877b8b194428a)

(From OE-Core rev: f8298017f78f58bbe25d832dc838f1ba6becee8d)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-06 16:38:31 +00:00
Khem Raj
798f11f079 binutils: Upgrade to latest on 2.31 release branch
* Append minor version to PV so recipe checker is happy
* Drop upstreamed patches
* Remove changelog from CVE patches, they dont apply and are in patch
  log anyway

(From OE-Core rev: 550085bc092d773c8c481e238d0d3210466166dc)

(From OE-Core rev: 27b9008618fa981d12424eecbff9bbf113b735f7)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-06 16:38:31 +00:00
Khem Raj
e82e4d2cb0 binutils: Fix build with clang
(From OE-Core rev: 208dadb8f1864aca88c69766f3bfb37a2ef4953c)

(From OE-Core rev: 86a4ecad734087cff7d5c1d6109f6256b8e2b75b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-06 16:38:30 +00:00
Anuj Mittal
da340150ed i2c-tools: upgrade 4.0 -> 4.1
* For changes, see:
https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/log/?qt=range&q=v4.0...v4.1

* Remove upstreamed patches

(From OE-Core rev: 085530e8fff016d7cadcae4a769a82cddf9e6695)

(From OE-Core rev: 93c76fe812613cfe6bc7296e770c070112e3f244)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-06 16:38:30 +00:00
Zheng Ruoqin
c9bffece78 createrepo-c: Fix setup of logging (log domains)
New debug messages were added into GLib library. These messages come
from the "GLib" log domain and were not hidden in the standard and
quiet mode of the application.
This fix hides log messages regardless on source log domain.

Backport from 80810f04f2de6bae6e394f52ad9cdd2189862f74.

(From OE-Core rev: a41927366c3c3070dfb95ec7f595e9f73105a517)

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Hongxu Jia
a8bccfa9a5 go 1.9/1.11: fix textrel qa warning for non mips arch
While building go itself, the go build system does not support
to set `-buildmode=pie' from environment.

Add GOBUILDMODE to support it which make PIE executables the default
build mode, as PIE executables are required as of Yocto

But mips doesn't support -buildmode=pie, so skip the QA checking for
mips and its variants

(From OE-Core rev: 7a8c5d29f70574043d695bc60da16c823d12a83e)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Ross Burton
3fc361f5f0 python3: drop redundant patch
This patch altered the clean target's behaviour to skip the ipkg-install
directory.  However this directory isn't created by opkg, opkg-utils, or the
package_ipk class; and we don't invoke the clean target as we perform
out-of-tree builds.

(From OE-Core rev: 9f8bd475701e5d797d3ffc1ba97647101ba0b9b0)

(From OE-Core rev: e147baad7ab722b8319225561eb23cd4442629e1)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Ross Burton
356c6a7b68 python3: don't cripple target distutils
We stop distutils for *native* Python from rewriting hashbangs when installing
(so installed scripts don't have a hashbang that refers to sysroot paths), but
this isn't needed nor desirable for the *target* Python.

(From OE-Core rev: 52e128619803907c804d42815ea979b1848529c4)

(From OE-Core rev: 17a2731bd2795974197b1dca3de53094cec58126)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Alexey Brodkin
45e3843c30 gdb: Remove long ago upstreamed patch
This fix was upstreamed a long ago, see [1].

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=37ce4055fe907b9edd25498dcda7a133dbd19784

(From OE-Core rev: 873507c0cbbf1f7ef22d1cb9dcb0e2b167460490)

(From OE-Core rev: 7a4cc4c690272579491ba8340b63da7efa3ca665)

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Khem Raj
7c7daa3ec0 valgrind: Skip vgpreload_memcheck shared object from stripping
This is a special library for memcheck tool, where it needs to have the
symbols intact for the stack traces to work on target, current option is
to install valgrind-dbg ( 151 MB uncompressed ) is quite big for some
systems which may not have space to install it all. Leaving it
unstripped adds about 200KB to image which is much better, this alone
gets memcheck working, as an aside we might need same solution for other
tools e.g. helgrind etc. when needed, they also have leading libraries
installed

(From OE-Core rev: 23da8f50b1e0a74777035c9f7b65b81456908f9f)

(From OE-Core rev: 49e38e029a21c02ca44d6db1bc91190f7c6e11ca)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:44 +00:00
Ross Burton
25f260f593 ruby: upgrade 2.5.1 -> 2.5.3
(From OE-Core rev: 17a8576375fadbfa44e9272a942bf12887b5e1a2)

(From OE-Core rev: ef91e281bb1e24a26f3179fd9f511714a0d4c746)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:43 +00:00
Alejandro Enedino Hernandez Samaniego
8bfb94cc9f python: Adds instructions to the manifest file
While there is a bit of documentation regarding building a new
manifest file for python, it seems that users usually only read
the manifest file.

The manifest file is in JSON format which doesn't allow comments,
hence why instructions were initially put elsewhere.

This patch hacks the call to open the JSON manifest file by using a
marker to trick it into reading only part of the file as the manifest
itself, and keep the other part as comments, which contain instructions
for the user to run the create_manifest task after an upgrade or
when adding a new package.

(From OE-Core rev: 5641a24a70b54544012c04c6a082514d9a5aa49a)

(From OE-Core rev: 3050a4c634da74eba53380bf23de515ed651bc03)

Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandr@xilinx.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:43 +00:00
Peter Kjellerstedt
f48d96e4df meson: Correct use of the _append operator
The value to SRC_URI_append_class-native was not prefixed with a space.
This was not noticed as the SRC_URI before applying the _append contains
trailing spaces. However, if one, e.g., has a .bbappend and adds to the
SRC_URI using SRC_URI += "file://foo.patch", then there no longer is any
trailing space and the _append concatenates the two URIs together,
leading to a build failue.

(From OE-Core rev: c07ee11e99dfe28405a7225903a541b33aeb1de6)

(From OE-Core rev: 53594c9fd01f7bd02e24aa82a5bd3a14d3dd465e)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Richard Purdie
b55b254f4e meson: Disable rpath stripping at install time
As discussed in https://github.com/mesonbuild/meson/issues/2567 there
needs to be a way to allow our rpath options passed to the linker to be
preserved, else we run into weird build failures.

(e.g. libmodulemd-native used by libdnf can't find libyaml)

Disable this for now until upstream come up with a better way of handling
this.

(From OE-Core rev: b4e36281631e0b59d1058f5cf391eb8b15e605cf)

(From OE-Core rev: 98a76c3171f9080d6246aac0188ef05c40852adc)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Alexander Kanavin
1cfa86d80f meson: do not manipulate the environment when looking for python via pkg-config
meson does it in a way that breaks oe builds (they export a bunch of PKG_CONFIG_ variables)

(From OE-Core rev: f071c5eb0a46b8ac5424c5baeb471a8080d4a078)

(From OE-Core rev: d5f1211b0820d5039ecec932fda92cbe1ba9132e)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Hongxu Jia
d50041ea78 elfutils: 0.174 -> 0.175
- Drop backport CVE patches
  0001-libdwfl-Sanity-check-partial-core-file-data-reads.patch
  0001-size-Handle-recursive-ELF-ar-files.patch
  0001-arlib-Check-that-sh_entsize-isn-t-zero.patch

- Drop patches that upstream has fixed
  0005-fix-a-stack-usage-warning.patch [9a74c19 backends: ppc use define
  instead of const for size of dwarf_regs array.]

- Update debian patches to 0.175

- Rebase local patch to 0.175
  0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch

(From OE-Core rev: 8748de4df5a4ece303f07f8bbb248920a199478a)

(From OE-Core rev: 81ae67e603087166ec5583cc9686a60f769be799)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Robert Yang
38887e6c1a recipes: Remove tab indentations in python code
Use 4 spaces to replace a tab.

(From OE-Core rev: cbb6743d46752481782789fa1a0dfade11057114)

(From OE-Core rev: 42ebdc7253c3a319d671a7f924603d85a22bbb4e)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Niko Mauno
da35b05c7f opkg-utils: Fix update-alternatives link relocation
Recently Debian-style support for link relocation was added to
'update-alternatives' script, but it fails under circumstances where
host rootfs root directory differs from target rootfs root directory
and two alternative packages provide a symbolic link with source
located in different directories.

An example of the case is busybox provided /bin/rev (symlinking to
/bin/busybox.nosuid) and util-linux provided /usr/bin/rev (symlinking
to /usr/bin/rev.util-linux) in which case following failure occurs
during image recipe's do_rootfs() task:

  ERROR: core-image-minimal-1.0-r0 do_rootfs: Postinstall scriptlets of ['util-linux'] have failed. If the intention is to defer them to first boot,
  then please place them into pkg_postinst_ontarget_${PN} ().
  Deferring to first boot via 'exit 1' is no longer supported.
  Details of the failure are in .../tmp/work/qemux86-poky-linux/core-image-minimal/1.0-r0/temp/log.do_rootfs.
  ERROR: core-image-minimal-1.0-r0 do_rootfs: Function failed: do_rootfs

Looking in log.do_rootfs file, following relevant lines can be observed:

  update-alternatives: renaming rev link from /bin/rev to /usr/bin/rev
  mv: cannot stat '/bin/rev': No such file or directory

Mitigate issue by applying patch which adds target root filesystem root
directory path prefix to failing 'mv' calls relevant variable references

(From OE-Core rev: f0912e23629758fe4303284e7db8f4089bb7b4cb)

(From OE-Core rev: 58f062843008c42d28f14c42fb5f991aef73728e)

Signed-off-by: Niko Mauno <niko.mauno@iki.fi>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-08 20:14:42 +00:00
Randy MacLeod
73f8baa8d8 valgrind: drop mips n32 support
valgrind for qemumips64 multilib builds fails to configure
for libn32 with the error:
   configure:6190: checking for 32 bit build support
   ...
   fatal error: bits/long-double-32.h: No such file or directory
It seems that the toolchain is producing:
   tmp-glibc/sysroots-components/mips64-n32/libn32-glibc/usr/include/bits/long-double-n32.h

Until the toolchain problem is resolved, skip valgrind for libn32.

(From OE-Core rev: 17d5574f05384edeb5c80ada2724fff4a1c3c94b)

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-09 15:27:34 +00:00
Zhixiong Chi
b9feb4e46b binutils: fix four CVE issues
Backport the CVE patches from the binutils upstream.

(From OE-Core rev: 84bb9c0514ecbd7c31935c22062b18b4aaefbef1)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-09 15:27:34 +00:00
Changqing Li
a369f55ad3 apt: update SRC_URI
update SRC_URI since previous link is not valid now

(From OE-Core rev: 0b5972c8189dade0e77df175651b8d8707647bb1)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:55 +00:00
Richard Purdie
e06de80a61 go: Change from TARGET_ARCH to TUNE_PKGARCH
Right now go-cross is changing signatures when you change TUNE for a given
architecture. In particular this breaks layer tests like:

yocto-check-layer ../meta-yocto-bsp/ --machines qemuarm beaglebone-yocto

This changes the PN addtion to something containing the tune rather than
the arch which avoids these kinds of errors. If go-cross can be tune
independent that would be nice but currently that isn't the case.

[YOCTO #12586]

(From OE-Core rev: e3c7e1703499e6a5332d9ab8a941671ec8235c4f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:55 +00:00
Chen Qi
09e1916ef6 go-dep: disable PTEST_ENABLED for mips and mips64
The current go-dep does not compile ptest successfully on mips
and mips64. So as a workaround, disable PTEST_ENABLED explicitly
to avoid error like below.

  | vet config not found

(From OE-Core rev: 786322ec408e2ef5cd6fb809456e0453e5f5e162)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:55 +00:00
Ross Burton
fc3af664f3 python3: add python3-venv to the python3-modules RDEPENDS
(From OE-Core rev: ed5e7541677f6a046f85389cd0c879be3db422cd)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:55 +00:00
Hugues Kamba
0140a1c2f7 python3: Fix python3-pyvenv run-time dependency
Pyvenv is just a small script that uses venv to create virtual
environments.
https://www.python.org/dev/peps/pep-0405/#creating-virtual-environments

This patch adds the python3-venv module as a self-contained package which
python3-pyvenv must depend on at run-time.

The patch also provides the package python3-pyvenv from the pyhton3-venv
package.This is good for future-proofing since python3-pyvenv has been
deprecated and only python3-venv is now available in Python 3.6.
https://docs.python.org/3/library/venv.html.

Without this patch python3-pyvenv is broken because it is missing the
venv module at run-time. This patch specifies the newly created
python3-venv as a run-time dependency of python3-pyvenv.

(From OE-Core rev: effa141bfce55aab25142ee578c95383c755ad73)

Signed-off-by: Hugues Kamba <hugues.kamba@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:55 +00:00
Hongxu Jia
918c8a13b6 elfutils: fix CVE-2018-18520 & CVE-2018-18521 & CVE-2018-18310
These CVE fixes come from upstream master branch and no
new version released, so backport rather than upgrade.

(From OE-Core rev: bd8d2c25f595e30a3fdcad8a2409913bb8af7c5c)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:54 +00:00
Hongxu Jia
4f6bb406d0 elfutils: 0.173 -> 0.174
- Drop backport fixes
  CVE-2018-16062.patch
  0001-libdw-Check-end-of-attributes-list-consistently.patch
  0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch

- Rebase 0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch

(From OE-Core rev: 777c1f8b6e20643964c304400e2d746dc2926524)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:54 +00:00
Hongxu Jia
68b68dc28a nasm: fix CVE-2018-1000667
Since the latest nasm is  2.14rc16 (not formal release),
so backport a patch to 2.13 to fix CVE-2018-1000667.

(From OE-Core rev: 024b395425c95a08c881d922c310be78ffad483a)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:54 +00:00
Changqing Li
cae6e5dc83 qemu: fix for CVE-2018-10839
(From OE-Core rev: 5c2b164e1022c46f6bf541894429773c3dde7af2)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-07 23:08:54 +00:00