Commit Graph

6 Commits

Author SHA1 Message Date
Khem Raj 8f3df8b447 recipes: Convert licenses to SPDX expressions
- Automatically convert all licenses to valid SPDX license expressions
  using convert-spdx-licenses.py

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-07-20 22:35:47 -07:00
Peter Marko a16ec4b009 libwebsockets: patch CVE-2026-10650
Pick patch mentioned in NVD report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-07-18 08:29:46 -07:00
Peter Marko b574afd23b libwebsockets: set status for CVE-2025-1866
Current cve-check code does not correctly decode the entry [1]:

"versions": [
    {
        "changes": [
            {
                "at": "patch 4.3.4",
                "status": "unaffected"
            }
        ],
        "lessThan": "<4.3.4",
        "status": "affected",
        "version": "0",
        "versionType": "git"
    }
]

[1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/1xxx/CVE-2025-1866.json

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-07-18 08:29:46 -07:00
Kamlesh Gurudasani 53cbcaba3f libwebsockets: fix build against OpenSSL 3.5
OpenSSL 3.5 (first shipped in wrynose) made HMAC_CTX a fully opaque
type by removing its struct definition from the public headers. It was
deprecated since OpenSSL 3.0 but the struct remained visible until 3.5.

libwebsockets uses HMAC_CTX_new() to detect which form to use in its
lws-genhash.h public header: if found it uses HMAC_CTX *ctx (pointer),
otherwise it falls back to HMAC_CTX ctx (embedded struct).

In cross-compilation the CMake CHECK_FUNCTION_EXISTS probe for
HMAC_CTX_new can fail due to native libraries being incorrectly pulled
into the aarch64 link test, causing the function to be reported as not
found. Before OpenSSL 3.5 this was a silent failure: the fallback
embedded struct still compiled fine. With OpenSSL 3.5 the fallback
now fails with "field has incomplete type".

Force LWS_HAVE_HMAC_CTX_new=ON so the pointer form is always used.

Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-06-07 18:21:52 -07:00
Khem Raj 90609e9751 libwebsockets: Add missing dep on libcap when ssl is enabled
Disable tests, they do not build in cross-build environment

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-11 10:52:40 -07:00
Wang Mingyu 636842dbfb libwebsockets: upgrade 4.5.7 -> 4.5.8
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 19:29:05 -07:00