If polkit is enabled as distro feature, it makes sense to recommend the
polkit-group-rule-network package for the networkmanager-daemon package to
allow members of the network group to modify NetworkManager settings.
Signed-off-by: Weisser, Pascal <pascal.weisser.ext@karlstorz.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.104.1:
- WireGuard packet buffering uses less memory while waiting for
peer handshakes.
- WireGuard packet queue depth scales with CPU core count, reducing
peak memory usage under heavy traffic.
- Client-side netmap caching improves start up speed and
connectivity when the Tailscale control plane is unreachable.
- WireGuard allocates a single packet buffer for batched I/O,
improving throughput and reducing memory usage.
- An issue that could prevent traffic over IPv6 link-local
addresses from flowing through direct and Tailscale Peer Relay
connections is resolved.
- An issue preventing Linux desktop detection from working on
Wayland environments is resolved.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
backtrace.cpp sets sCrashCallback but only reads it back inside a
glibc-only execinfo backtrace path, so on musl (no backtrace()) clang
flags it as -Wunused-but-set-variable under -Werror. Reference it in
the non-glibc branch too.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes build with clang-23, which enables -Wunused-template in a way that
trips over openthread's parse_cmdline.hpp. With -Werror -Wfatal-errors
that is fatal:
third_party/openthread/repo/src/core/utils/parse_cmdline.hpp:240:48:
fatal error: unused function template 'ParseAsHexString'
[-Wunused-template]
Already fixed upstream in openthread commit 30c3569ac5ca ("[parse-cmdline]
make ParseAsHexString() inline"), which the openthread submodule of the
new SRCREV includes, so bump instead of carrying a backport.
Adapt the recipe to upstream changes made since the previous SRCREV:
* ot-br-posix commit cf4877d68af8 ("[mdns] remove avahi publisher option
and dependencies") deleted the avahi mDNS publisher; OTBR_MDNS=avahi
is now a configure-time FATAL_ERROR. Switch to OTBR_MDNS=openthread,
the new upstream default, and drop the avahi/avahi-daemon dependencies
the same way upstream did in their own etc/yocto/otbr_git.bb.
* The advertising and discovery proxies grew OT core implementations
(OTBR_OT_SRP_ADV_PROXY, OTBR_OT_DISCOVERY_PROXY) which default to ON
whenever OTBR_MDNS is set, and enabling both variants is now a
FATAL_ERROR ("Only one Advertising Proxy can be enabled."). Drop the
explicit OTBR_SRP_ADVERTISING_PROXY/OTBR_DNSSD_DISCOVERY_PROXY=ON so
the OT core ones are used.
* Drop 0001-otbr-agent.service.in-remove-pre-exec-hook-for-mdns-.patch.
With OTBR_MDNS=openthread src/agent/CMakeLists.txt never sets
EXEC_START_PRE, so the generated otbr-agent.service already has a bare
ExecStart= and the patch has nothing left to do.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_compile fails with:
alias.go:618:21: undefined: json.SkipFunc
alias.go:957:14: undefined: json.DiscardUnknownMembers
Go 1.27 turns the jsonv2 experiment on by default, so the json module
pinned by 1.98.3 builds its alias file against encoding/json/v2 and
aliases symbols that are gone. 1.102.3 pins a newer module.
- Regenerate go module dependencies and license checksums
- Manually verify and complete Unknown license entries
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
samba package also installs LDB command line tools and python LDB
module. libldb package installs the same tools and pyldb module from
standalone LDB source.
pkgdata shows the conflict clearly:
samba: /usr/bin/ldbadd
libldb: /usr/bin/ldbadd
samba-python3: site-packages/ldb.so
pyldb: site-packages/ldb.so
So when both samba and libldb are added in same image, rootfs can fail
because package manager sees same files from two different packages.
Both package sets are not expected to be installed together.
Add RCONFLICTS for samba/libldb and samba-python3/pyldb. This makes the
conflict explicit during dependency resolution instead of failing later
as file install conflict.
Older meta-networking had similar conflict handling for samba/libldb in
commit: https://git.openembedded.org/meta-openembedded/commit/?id=8e641e28f630dac61a03373ad70c72a2370ad11e
This change adds the same handling again with current python3 package names.
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- fix READNU32 by casting to uint32_t
- filter out non printable characters in description for lease file
- check for the return value of snprintf() : overflow or error
- nftables: Avoid building too long rule with nftnl_rule_nlmsg_build_payload() by triming description to 256 chars.
- HTTPS: Do not abort on SSL errors
- Fix heap overflow in PinholeVerification()
- Free resources on start error
- print usage on stdout or stderr depending on command line
- increase maximum description length when possible (netfilter/nftables)
- fix nfqueue code
- Re-enable port forwarding properly (broken in 2.3.10)
- Fix PCP option size parsing
- Allow using ip/mask when IPv6 is compiled but disabled
- use a 8kB buffer for Netlink as recommended
- fix URL parsing in upnpevents.c
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- Update SRC_URI as upstream moved to GitHub
- Upstream now builds via Makefile and no longer ships a configure script
- Refresh LICENSE file path and checksum
- Install template systemd service and conf provided by upstream
- Drop patch which is merged in the upstream version
- Recommend kernel-module-tun since /dev/net/tun is required at runtime
Fixes:
root@qemuarm64:~# systemctl status tayga@default.service
x tayga@default.service - Simple, no-fuss NAT64
Loaded: loaded (/usr/lib/systemd/system/tayga@.service; enabled; preset: disabled)
Active: failed (Result: exit-code) since Tue 2026-08-18 03:16:11 UTC; 12s ago
Invocation: a950b39a22a141baaa88e5c919a59009
Process: 300 ExecStart=tayga --config /etc/tayga/default.conf --journal --nodetach (code=exited, status=1/FAILURE)
Main PID: 300 (code=exited, status=1/FAILURE)
Mem peak: 1.7M
CPU: 190ms
Aug 18 03:16:11 qemuarm64 systemd[1]: Starting Simple, no-fuss NAT64...
Aug 18 03:16:11 qemuarm64 tayga[300]: Starting TAYGA 0.9.6
Aug 18 03:16:11 qemuarm64 tayga[300]: Compiled from tags/0.9.6
Aug 18 03:16:11 qemuarm64 tayga[300]: Commit 7f00122b75d808f696df0efe481a8c8919ba9bd7
Aug 18 03:16:11 qemuarm64 tayga[300]: Unable to open /dev/net/tun, aborting: No such file or directory
Aug 18 03:16:11 qemuarm64 systemd[1]: tayga@default.service: Main process exited, code=exited, status=1/FAILURE
Aug 18 03:16:11 qemuarm64 systemd[1]: tayga@default.service: Failed with result 'exit-code'.
Aug 18 03:16:11 qemuarm64 systemd[1]: Failed to start Simple, no-fuss NAT64.
- Add UPSTREAM_CHECK_GITTAGREGEX for git tag version checks
Fixes:
$ devtool latest-version tayga
...
INFO: Current version: 0.9.2
INFO: Latest version:
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
restinio 0.7.x is a major architectural change from 0.6.x: the release
tarball no longer bundles any of its third-party dependencies
(http_parser, expected-lite, fmt, catch2, sobjectizer). They must now
be supplied externally and resolved through find_package()/system
linkage. This requires two new supporting recipes added in prior
commits: llhttp (replacement for the now-dropped http_parser) and
expected-lite (nonstd::expected backport, now required unconditionally
instead of restinio's old embedded fallback). asio, fmt and catch2
dependencies are already satisfied by existing recipes in the tree.
Recipe changes:
- Release tag format changed from "v.X.Y.Z" to "vX.Y.Z"; update
SRC_URI and SRC_URI[sha256sum] accordingly.
- LIC_FILES_CHKSUM md5 updated for the new tarball's root LICENSE file.
- DEPENDS: drop http-parser, add llhttp and expected-lite.
- EXTRA_OECMAKE: RESTINIO_FIND_DEPS and RESTINIO_USE_EXTERNAL_HTTP_PARSER
were removed upstream. RESTINIO_BENCH renamed to RESTINIO_BENCHMARK,
RESTINIO_ALLOW_SOBJECTIZER renamed to RESTINIO_WITH_SOBJECTIZER (kept
disabled). Added RESTINIO_DEP_STANDALONE_ASIO=find,
RESTINIO_DEP_FMT=find and RESTINIO_DEP_EXPECTED_LITE=find so restinio's
CMakeLists.txt resolves these via find_package() instead of trying to
add_subdirectory() vendored sources that no longer exist in the
tarball. RESTINIO_DEP_LLHTTP=system is used instead of "find" because
llhttp's own CMakeLists.txt only exports an "llhttp::llhttp_shared"
imported target (llhttp::llhttp is just a build-tree ALIAS, never
installed/exported), which restinio's dependency-resolution logic
does not recognize as a valid find_package() target name.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Stay within the 4.23.x stable series (do not touch the sibling
talloc/tdb/tevent/ldb recipes). This picks up two intervening point
releases:
- 4.23.9: bug-fix release (use-after-free in ACL claims/conditions
handling, CTDB read-only record use-after-free/resource leak, RODC
auth fixes, among others).
- 4.23.10: security release fixing CVE-2026-6949 (TSIG/DNS OOB write
crash), CVE-2026-58216 (KDC kpasswd OOB read crash),
CVE-2026-58218 (DNS TKEY cache-flood DoS), CVE-2026-58221 (LDAP
privilege escalation via internal LDB special DNs),
CVE-2026-58222 (LDAP Compare filter used as protected-attribute
disclosure oracle) and CVE-2026-58224 (CTDB protocol
bounds-checking gaps).
- 4.23.11: further bug fixes (DRS memory leak, pthreadpool fork race,
RODC/NTLMv2 trust fixes, CephFS vfs crashes).
All 13 existing patches (including the musl-only pam/getpwent_r ones)
still apply cleanly against 4.23.11 with offset only, no fuzz, so none
needed to be reworked or dropped. LIC_FILES_CHKSUM for COPYING is
unchanged.
Build-verified with cleansstate + full build for qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Bump to the latest snort3 release. Drop
0001-Fix-build-on-c23.patch: the once_flag/call_once C23 name-collision
fix it carried (submitted upstream as snort3 PR #431) is now merged
verbatim upstream (src/loggers/alert_fast.cc already uses
std::once_flag/std::call_once as of this tag), and the patch fails to
apply (reversed/already-applied) against 3.12.2.0.
Keep 0001-cmake-Check-for-HP-libunwind.patch (applies cleanly) and
0001-cmake-Pass-noline-flag-to-flex.patch (applies with offset only,
no fuzz) unchanged.
The ~180 commits between the old and new SRCREV include several
crash/security fixes (use-after-free, heap-buffer-overflow,
null-deref) that are picked up naturally by this version bump.
Build-verified with cleansstate + full build for qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop 0001-Shim-for-renaming-of-GNUTLS_NO_EXTENSIONS-in-GnuTLS-.patch:
it was a workaround for GnuTLS >= 3.8.1 renaming GNUTLS_NO_EXTENSIONS
before a compatibility shim landed upstream; that compatibility shim
is long merged and this openconnect release range no longer needs
the local re-definition (build succeeds without it).
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Bump to the nm-1-58 stable branch. CVE-2026-10805 and the DHCPv4
out-of-bounds read fix are both already included in the 1.58.0 tag
(verified via git merge-base --is-ancestor against upstream), so no
backport patch is required.
- 0002-meson-fix-cross-compilation-issues.patch dropped: merged
upstream verbatim as commit e5d2c7c by the same author, and is an
ancestor of the 1.58.0 tag.
- 0001-linker-scripts-Do-not-export-_IO_stdin_used.patch kept, still
needed, applies with offset only.
- dhclient support was removed upstream (all: drop dhclient code and
build configuration); drop PACKAGECONFIG[dhclient] and update the
NETWORKMANAGER_DHCP_DEFAULT comment accordingly.
- Wireless Extensions (wext) meson option is deprecated and now
errors on -Dwext=true; drop it from PACKAGECONFIG[wifi], keeping
only -Dwifi.
- New CLAT feature defaults to enabled in meson_options.txt and pulls
in libbpf >= 1.3.0; add PACKAGECONFIG[clat] but leave it out of the
default PACKAGECONFIG set so it stays disabled and avoids a new
hard dependency.
- Package the new nm-initrd-generator.sh systemd generator directory
under ${PN}-daemon and make bash an unconditional RDEPENDS since
the generator script requires it regardless of the ifupdown
PACKAGECONFIG setting.
Build-verified: networkmanager and its openvpn/openconnect/
fortisslvpn plugin recipes all build successfully.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_package failed with a fatal QA error:
QA Issue: ufw: Files/directories were installed but not shipped in
any package: /usr/usr/lib/ufw/... (and on repeated rebuilds
/usr/usr/usr/lib/ufw/...) [installed-vs-shipped]
Under the usrmerge DISTRO_FEATURE, do_configure:prepend rewrites the
single os.path.join('/lib', 'ufw') in setup.py to nonarch_base_libdir
(/usr/lib) with an in-place sed. The pattern '/lib' is not anchored, so
when do_configure re-runs against an already-patched ${S} (cached
unpack/patch, as happens on world rebuilds) it matches the '/lib' inside
the previously substituted '/usr/lib' and prepends another /usr, giving
/usr/usr/lib and then /usr/usr/usr/lib. FILES:${PN} ships
${nonarch_base_libdir}/ufw (/usr/lib/ufw), so the doubled paths are
unshipped and QA fails.
Anchor the substitution to the quoted literal '/lib'. After the first
run the text is '/usr/lib', which no longer contains '/lib', so
re-running do_configure is a no-op. Verified two forced do_configure
runs leave os.path.join('/usr/lib', 'ufw') and do_package succeeds.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The webkit2gtk pkg-config check was unconditional, but WEBKIT is only
used by the GNOME auth dialog. Move it under the with-gnome guard
add webkitgtk3 to the gnome PACKAGECONFIG deps
ship the D-Bus system policy file.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: copyright year range updated; still BSD-3-Clause
Update LIC_FILES_CHKSUM: the LICENSE text changed only in its copyright
year range, it is still BSD-3-Clause.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
lftp 4.9.3 bundles gnulib sources that fail to build with the OpenEmbedded
clang + lld toolchain. Carry a single patch with the gnulib compatibility
fixes:
1. Single-argument static_assert (lib/dirent.in.h, lib/uchar.in.h) is a
C++17 feature; clang in its default C++14 mode rejects it with
"static_assert with no message is a C++17 extension". Add a message.
Reported upstream: https://github.com/lavv17/lftp/issues/766
2. lib/stdlib.in.h pre-includes <string> to pre-instantiate std::strtoull
before the "#define strtoull rpl_strtoull" macro fires, but guarded the
workaround with "&& !defined __clang__" so it never triggered under
clang + libstdc++, rewriting std::strtoull to the non-existent
std::rpl_strtoull. Extend the guard to cover clang.
3. After gnulib split md5.c/sha1.c into primary + -stream.c files, both
define GL_OPENSSL_INLINE to _GL_EXTERN_INLINE before including the
header, so with the OpenSSL md5/sha1 backends both translation units
emit out-of-line wrapper copies and lld fails with duplicate symbol
errors. Drop the override from the -stream.c files.
Consolidates the three previously separate patches into one; verified by
building lftp for qemux86-64 with clang + lld (the duplicate-symbol link
failure reproduces without the patch and is resolved with it).
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
Weisser, Pascal
Leon Anavi
Ankur Tyagi
Ross Burton
Nate Kent
Alper Ak
Jaipaul Cheernam
Zheng Ruoqin
Himanshu Jadon
Wang Mingyu
Lian Wang
Deepak Rathore
Hemanth Kumar M D
Mingli Yu