mirror of
https://git.yoctoproject.org/poky
synced 2026-09-13 09:49:32 +02:00
ba4885546e
This issue was reported and discusses under [1] which is linked in NVD CVE report. It was already documented that some parts or libarchive are thread safe and some not. [2] was now merged to document that also reported function is not thread safe. So this CVE *now* reports thread race condition for non-thread-safe function. And as such the CVE report is now invalid. The issue is still not closed for 2 reasons: * better document what is and what is not thread safe * request to public if someone could make these functions thread safe This should however not invalidate above statment about ignoring this CVE. [1] https://github.com/libarchive/libarchive/issues/1876 [2] https://github.com/libarchive/libarchive/pull/1875 (From OE-Core rev: ffa8f92aa6f8405d8fea117af2f212ba190de393) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
67 lines
2.4 KiB
BlitzBasic
67 lines
2.4 KiB
BlitzBasic
SUMMARY = "Support for reading various archive formats"
|
|
DESCRIPTION = "C library and command-line tools for reading and writing tar, cpio, zip, ISO, and other archive formats"
|
|
HOMEPAGE = "http://www.libarchive.org/"
|
|
SECTION = "devel"
|
|
LICENSE = "BSD-2-Clause"
|
|
LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665"
|
|
|
|
DEPENDS = "e2fsprogs-native"
|
|
|
|
PACKAGECONFIG ?= "zlib bz2 xz zstd ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}"
|
|
|
|
DEPENDS_BZIP2 = "bzip2-replacement-native"
|
|
DEPENDS_BZIP2:class-target = "bzip2"
|
|
|
|
PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl,"
|
|
PACKAGECONFIG[xattr] = "--enable-xattr,--disable-xattr,attr,"
|
|
PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib,"
|
|
PACKAGECONFIG[bz2] = "--with-bz2lib,--without-bz2lib,${DEPENDS_BZIP2},"
|
|
PACKAGECONFIG[xz] = "--with-lzma,--without-lzma,xz,"
|
|
PACKAGECONFIG[openssl] = "--with-openssl,--without-openssl,openssl,"
|
|
PACKAGECONFIG[libxml2] = "--with-xml2,--without-xml2,libxml2,"
|
|
PACKAGECONFIG[expat] = "--with-expat,--without-expat,expat,"
|
|
PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo,"
|
|
PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle,"
|
|
PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4,"
|
|
PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls,"
|
|
PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd,"
|
|
|
|
EXTRA_OECONF += "--enable-largefile --without-iconv"
|
|
|
|
SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz"
|
|
UPSTREAM_CHECK_URI = "http://libarchive.org/"
|
|
|
|
SRC_URI[sha256sum] = "ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f19b9b3"
|
|
|
|
# upstream-wontfix: upstream has documented that reported function is not thread-safe
|
|
CVE_CHECK_IGNORE += "CVE-2023-30571"
|
|
|
|
inherit autotools update-alternatives pkgconfig
|
|
|
|
CPPFLAGS += "-I${WORKDIR}/extra-includes"
|
|
|
|
do_configure[cleandirs] += "${WORKDIR}/extra-includes"
|
|
do_configure:prepend() {
|
|
# We just need the headers for some type constants, so no need to
|
|
# build all of e2fsprogs for the target
|
|
cp -R ${STAGING_INCDIR_NATIVE}/ext2fs ${WORKDIR}/extra-includes/
|
|
}
|
|
|
|
ALTERNATIVE_PRIORITY = "80"
|
|
|
|
PACKAGES =+ "bsdtar"
|
|
FILES:bsdtar = "${bindir}/bsdtar"
|
|
|
|
ALTERNATIVE:bsdtar = "tar"
|
|
ALTERNATIVE_LINK_NAME[tar] = "${base_bindir}/tar"
|
|
ALTERNATIVE_TARGET[tar] = "${bindir}/bsdtar"
|
|
|
|
PACKAGES =+ "bsdcpio"
|
|
FILES:bsdcpio = "${bindir}/bsdcpio"
|
|
|
|
ALTERNATIVE:bsdcpio = "cpio"
|
|
ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio"
|
|
ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|