Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The webkit2gtk pkg-config check was unconditional, but WEBKIT is only
used by the GNOME auth dialog. Move it under the with-gnome guard
add webkitgtk3 to the gnome PACKAGECONFIG deps
ship the D-Bus system policy file.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: copyright year range updated; still BSD-3-Clause
Update LIC_FILES_CHKSUM: the LICENSE text changed only in its copyright
year range, it is still BSD-3-Clause.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
lftp 4.9.3 bundles gnulib sources that fail to build with the OpenEmbedded
clang + lld toolchain. Carry a single patch with the gnulib compatibility
fixes:
1. Single-argument static_assert (lib/dirent.in.h, lib/uchar.in.h) is a
C++17 feature; clang in its default C++14 mode rejects it with
"static_assert with no message is a C++17 extension". Add a message.
Reported upstream: https://github.com/lavv17/lftp/issues/766
2. lib/stdlib.in.h pre-includes <string> to pre-instantiate std::strtoull
before the "#define strtoull rpl_strtoull" macro fires, but guarded the
workaround with "&& !defined __clang__" so it never triggered under
clang + libstdc++, rewriting std::strtoull to the non-existent
std::rpl_strtoull. Extend the guard to cover clang.
3. After gnulib split md5.c/sha1.c into primary + -stream.c files, both
define GL_OPENSSL_INLINE to _GL_EXTERN_INLINE before including the
header, so with the OpenSSL md5/sha1 backends both translation units
emit out-of-line wrapper copies and lld fails with duplicate symbol
errors. Drop the override from the -stream.c files.
Consolidates the three previously separate patches into one; verified by
building lftp for qemux86-64 with clang + lld (the duplicate-symbol link
failure reproduces without the patch and is resolved with it).
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
After the recent recipe update I see this build error:
| Makefile.linux:67: config.mk: No such file or directory
| make: *** No rule to make target '/configure', needed by 'config.mk'. Stop.
Run the configure script so that config.mk gets created
Also fix LIC_FILE_CHECKSUM. Copyright year has been changed
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop 0001-Add-OpenEmbedded-cross-compile-case.patch as genconfig.sh
was removed upstream in 2.3.x.
Signed-off-by: Filipe Pires <filipe.pires@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add initial recipe for Cloudflare Tunnel client (cloudflared).
The upstream source vendors all Go dependencies so no go-mods.inc
is needed.
Includes systemd service with token-based authentication
via /etc/default/cloudflared.
Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The introduction of DISTRO_FEATURES_OPTED_OUT allows rewriting the
DISTRO_FEATURES by removing whatever is in DISTRO_FEATURES_OPTED_OUT
from DISTRO_FEATURES.
Thus, the logic of vala can be negated, and it can changed be to
see if gobject-introspection-data is available in DISTRO_FEATURES.
Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Variable DISTRO_FEATURES_BACKFILL_CONSIDERED has been renamed
to DISTRO_FEATURES_OPTED_OUT.
Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Set ac_cv_prog_cc_c23=no to prevent autoconf from detecting C23
compiler support, avoiding potential build failures as the package
is not yet fully ported to support C23 standard.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The upgrade to mosquitto 2.1.2 follows an upstream change where the
default configuration file is only installed as
${sysconfdir}/mosquitto/mosquitto.conf.example.
However, the shipped systemd service explicitly starts mosquitto using
${sysconfdir}/mosquitto/mosquitto.conf. If this file is not present, the
daemon exits immediately and the service fails to start.
Install the default mosquitto.conf alongside the example file, using the
upstream-provided configuration, to match the expectations of the
service unit and ensure the service starts correctly by default, as done
with the 2.0.22 version.
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
-Update tailscale recipe to version 1.94.2
-Regenerate go module dependencies and license checksums
-Export GOFLAGS with build tags so do_update_modules discovers all dependencies
-Manually verify and complete Unknown license entries
Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Samba has a new build-time dependency, libquic[1]. The repository
builds an out-of-tree kernel module and a regular userspace library
with the same build script, however the Makefile seems to be fairly
hostile to cross-compilation. The Samba tarball also vendors the
same with their own build script - for now, this venodred version is used.
There are some efforts that the kernel part is mainlined[2], once it
happens it should be possible to easily remove this from the recipe.
pyldb was removed from RDEPENDS, as it seems that samba now builds its
own version of it.
Patches updated, unneeded patches dropped. Some patches contained a
considerable amount of whitespace changes - those were trimmed for
the ease of rebasing.
Changelog:
https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/WHATSNEW.txt?ref_type=tags
(Switch to other branches to see earlier changelogs)
[1]: https://github.com/lxin/quic/
[2]: https://github.com/lxin/net-next/commits/quic/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Those systemd services were added in 1.54 upstream
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2089
According the comments we can see they are meant for the inird
other than using for rootfs. They will conflict with the main
services and can lead to potentially confusing error messages.
So remove them for now to avoid the following issue.
>$systemd-analyze --man=false verify \
> /lib/systemd/system/NetworkManager-wait-online-initrd.service
Failed to put bus name to hashmap: File exists
NetworkManager-initrd.service: Two services allocated for the \
same bus name org.freedesktop.NetworkManager, refusing operation.
Test:
PASS: bitbake core-image-minimal
PASS: runqemu qemux86-64
PASS: systemd-analyze --man=false verify \
/lib/systemd/system/NetworkManager.service
Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It has been unmaintained/EOL for over a year - there is
a recipe for a newer, still supported version.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Radiusd fails to start because the openssl legacy provider is no longer
built by default[1]:
$ radiusd -C -X
FreeRADIUS Version 3.2.8
[snip]
(TLS) Failed loading legacy provider
Add PACKAGECONFIG[legacy-openssl] to enable openssl legacy provider
support. When disabled, pass --enable-fips-workaround to configure
instead.
Backport two patches to fix the --enable-fips-workaround option.
[1] https://git.openembedded.org/openembedded-core/commit/?id=a150c3580f7f4962152444272c0fe07cfdb72df5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Since there are no sources being fetched, set S to UNPACKDIR to fix:
| WARNING: wowlan-udev-1.0-r0 do_unpack: wowlan-udev: the directory
| ${UNPACKDIR}/${BP} ... pointed to by the S variable doesn't exist
| - please set S within the recipe to point to where the source has
| been unpacked to.
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Create path to fix `meson` build errors
Add missing dependencies.
Disables man page generation. The build was using xsltproc to try
downloading http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl
from the network, which fails in embedded build environments.
Changelog:
v1.56.0
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.56.0/NEWS?ref_type=tags
Changed:
- Unify the versioning to use everywhere the scheme with the -rcX or -dev
suffixes when appropriate. This affects, for example, the URL and filename
of the release tarball and the version reported by nmcli and the daemon.
As an exception, the C API will continue to use the 90+ scheme for RC versions.
- nmcli now supports viewing and managing WireGuard peers.
- Support reapplying the "sriov.vfs" property as long as
"sriov.total-vfs" is not changed.
- Support reapplying "bond-port.vlans".
- Accept hostnames longer than 64 characters from DNS lookup.
- Make that global-dns configuration overwrites DNS searches and
options from connections, instead of merging all together.
- Add support for a new rd.net.dhcp.client-id option in
nm-initrd-generator.
- Add gsm device-uid setting to restrict the devices the connection applies to.
- Support configuring the HSR protocol version via the
"hsr.protocol-version" property.
- Fix a bug that makes broadband connections auto-connect getting
blocked if the connection tries to reconnect when modem status is
"disconnecting" / "disconnected".
- Treat modem connection not having an operator code available
as a recoverable error.
- Add support for configuring systemd-resolved's DNSSEC option
per-connection via the "connection.dnssec" connection property.
- Support configuring the HSR interlink port via the
"hsr.interlink" property.
- Fix some connection properties not being applied to vpn connections
(connection.mdns, connection.llmnr, connection.dns-over-tls,
connection.mptcp-flags, ipv6.ip6-privacy)
- Update n-acd to always compile with eBPF enabled, as support
for eBPF is now detected at run time.
- Add new MPTCP 'laminar' endpoint type, and set it by default alongside
the 'subflow' one.
- For private connections (the ones that specify a user in the
"connection.permissions" property), verify that the user can access
the 802.1X certificates and keys set in the connection.
- Introduce a libnm function that can be used by VPN plugins to check
user permissions on certificate and keys.
v1.54.0
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.54.0/NEWS?ref_type=tags
Changed:
- Add support for configuring per-device IPv4 forwarding via the
"ipv4.forwarding" connection property.
- Add a new "prefix-delegation" setting containing a "subnet-id"
property that specifies the subnet to choose on the downstream
interface when using IPv6 prefix delegation.
- Support OCI baremetal in nm-cloud-setup
- When activating a WireGuard connection to an IPv6 endpoint, now
NetworkManager creates firewall rules to ensure that the incoming
packets are not dropped by kernel reverse path filtering.
- Add support for configuring the loopback interface in nmtui.
- Most of the properties of ovs-bridge and ovs-port connections can
now be reapplied at runtime without bringing the connection down.
- Add a new "sriov.preserve-on-down" property that controls whether
NetworkManager preserves the SR-IOV parameters set on the device
when the connection is deactivated, or whether it resets them to
their default value.
- Introduce a new "ovs-dpdk.lsc-interrupt" property to configure the
Link State Change (LSC) detection mode for OVS DPDK interfaces.
- The initrd-generator now can parse the NVMe Boot Firmware Table
(NBFT) to configure networking during early boot.
- Add systemd services to provide networking in the initrd.
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
On some platforms (for example, QCx6490), XO (Crystal Oscillator) shutdown
is prevented by Wireless Processor Subsystem votes on interconnect
bandwidth and XO unless the WoWLAN magic-packet trigger is enabled. These
votes are released only after running:
iw phy0 wowlan enable magic-packet
Add an udev rule to automatically enable WoWLAN magic-packet support when
a Wi-Fi PHY is registered. This rule is provided via a dedicated
wowlan-udev package and is not enabled by default.
Integrators should include this package only if their platform requires
automatic WoWLAN magic-packet enablement.
Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887
The vulnerability is about the default (example) configurations,
which place cache files into the /tmp folder, that is world-writeable.
The recommendation would be to place them to a more secure folder.
The recipe however does not install these example configurations,
and as such it is not vulnerable either.
Just to make sure, patch these folders to a non-tmp folder
(and also install that folder, empty).
Some more discussion about the vulnerability:
https://bugzilla.suse.com/show_bug.cgi?id=48161
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
1. Add pkgconfig to solve following configure error:
../sources/adcli-0.9.3.1/configure: line 15340: syntax error near unexpected token `LIBSELINUX,'
../sources/adcli-0.9.3.1/configure: line 15340: `PKG_CHECK_MODULES(LIBSELINUX, libselinux, found_libselinux=yes, found_libselinux=no)'
2. Add PACKAGECONFIG[selinux] for new selinux support in 0.9.3.1.
3. Add 0001-configure.ac-Fix-selinux-error-for-cross_compiling.patch to fix SELINUX_MAKEFILE file check in 0.9.3.1.
4. Add --disable-offline-join-support to solve following configure error
configure: error: Couldn't build offline join support, Samba version too old or libnatapi devel package is missing
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
fix regression where the 'plugin' was not passed to pppd
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Lian Wang
Khem Raj
Deepak Rathore
Hemanth Kumar M D
Wang Mingyu
Mingli Yu
Ankur Tyagi
Markus Volk
Filipe Pires
Adam Duskett
Ayoub Zaki
Jose Quaresma
Gyorgy Sarvari
Ricardo Salveti
Zhixiong Chi
Yi Zhao
Ricardo Simoes
Andrej Kozemcak
Anuj Mittal
Miaoqing Pan
Liu Yiding