oe-core 3c2bb7bce1 ("cpan_build: disable .packlist and html doc") moved
--create_packlist=0 into cpan_build.bbclass and disabled html doc
generation there as well. Neither .packlist nor the html docs are
generated anymore, so the do_install:append() hooks that sed'ed TMPDIR out
of them now run find(1) over paths that no longer exist and hand sed an
empty argument list:
find: '.../image/usr/share/doc/perl/html/site/lib/HTML/': No such file or directory
sed: no input files
WARNING: exit code 4 from a shell command.
Remove the now dead hooks.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9dc293d14d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The current product-only "httplib2" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.
Use "httplib2_project:httplib2" for its exact NVD dictionary CPE and NVD
configuration identity. This changes the generated CPE, but sbom-cve-check
1.3.3 with the pinned NVD database snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0a8f71a643)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The current inherited "python:web3" mapping does not match the web3.py identities used by NVD and CVE List V5, so its source-aligned CVE is missed.
Use "ethereum:web3.py" for the CNA affected-data identity and "apeworx:web3.py" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Stay within the 4.23.x stable series (do not touch the sibling
talloc/tdb/tevent/ldb recipes). This picks up two intervening point
releases:
- 4.23.9: bug-fix release (use-after-free in ACL claims/conditions
handling, CTDB read-only record use-after-free/resource leak, RODC
auth fixes, among others).
- 4.23.10: security release fixing CVE-2026-6949 (TSIG/DNS OOB write
crash), CVE-2026-58216 (KDC kpasswd OOB read crash),
CVE-2026-58218 (DNS TKEY cache-flood DoS), CVE-2026-58221 (LDAP
privilege escalation via internal LDB special DNs),
CVE-2026-58222 (LDAP Compare filter used as protected-attribute
disclosure oracle) and CVE-2026-58224 (CTDB protocol
bounds-checking gaps).
- 4.23.11: further bug fixes (DRS memory leak, pthreadpool fork race,
RODC/NTLMv2 trust fixes, CephFS vfs crashes).
All 13 existing patches (including the musl-only pam/getpwent_r ones)
still apply cleanly against 4.23.11 with offset only, no fuzz, so none
needed to be reworked or dropped. LIC_FILES_CHKSUM for COPYING is
unchanged.
Build-verified with cleansstate + full build for qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f971f62ef1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- a11y: add aria-labels to copy-to-clipboard buttons
- a11y: add skip-to-operations link, banner and main landmarks
- a11y: close Authorization popup with Escape key and backdrop click
- a11y: name and state for dark-mode toggle button
- a11y: restore icon visibility in Windows High Contrast Mode
- a11y: topbar logo and dark-mode toggle visible in HCM
- a11y: use for model titles to convey emphasis semantically
- ci: bump cycjimmy/semantic-release-action to v6.0.0
- ci: fix Trivy security scan and add dependency vulnerability scan
- style: reduce padding on inline code blocks in markdown
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e0346def92)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The inherited python:filelock mapping does not identify the tox-dev source packaged by this recipe, so filelock CVEs are missed.
Use tox-dev:filelock to match the source identity used by NVD and CNA.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fd2c88f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
In Redis 8.0.x, the build system adds -flto by itself when clang is
used with the default optimization setting. In OE clang builds, the
final link still goes through the cross binutils linker path. That path
does not stage LLVMgold.so, so redis-benchmark link fails with:
x86_64-oe-linux-ld: ../lib/LLVMgold.so: error loading plugin
The failure is not seen with gcc because Redis does not add clang LTO in
that path. Also, changing OPTIMIZATION from the recipe is not a good fit
because it replaces Redis defaults and drops -fno-omit-frame-pointer.
Use Redis documented OPT variable only for clang builds. This avoids
the clang LTO path and keeps the frame-pointer flag. The gcc/default
build is left unchanged.
This local workaround can be removed later if LLVMgold/binutils-plugin
support is available in the toolchain path used by clang LTO builds.
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to the 0.11.5 security release to fix CVE-2026-15370 and CVE-2026-59843 through CVE-2026-59850.
Switch to the official GitLab mirror because the git.libssh.org endpoint no longer provides a usable Git repository for the new release.
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Python support 3.8+ only
- decompression limited by size and ratio
- decoder foundation to support more compression algorithms
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 69b5baba27)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
libfastjson is missing an explicit link dependency on the math library (libm),
which triggers GNU Indirect Function (IFUNC) resolution failure at runtime.
libfastjson internally calls the modf() math function but modf is optimized via
glibc's IFUNC mechanism. Because libfastjson was compiled without -lm, the dynamic
linker (ld.so) cannot safely resolve this dynamic IFUNC redirection, causing rsyslogd
to immediately crash with a segfault error.
rsyslogd boot error:
| starting rsyslogd ... /usr/sbin/rsyslogd: Relink `/usr/lib64/libfastjson.so.4'
| with `/lib64/libm.so.6' for IFUNC symbol `modf'
| rsyslogd[1311]: segfault at 9c ip
Signed-off-by: Preeti Sachan <preeti.sachan@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The Makefile uses `KERN_MAJ = $(shell uname -r | cut -d . -f1)` to
determine if the kernel version is <7, which enables building vboxvideo.
Therefore, with a host kernel >=7 and a target kernel <7, vboxvideo is
not built and we get this error in vboxsf:
```
| In file included from ../vboxsf/include/iprt/stdarg.h:59,
| from ../vboxsf/include/iprt/types.h:44,
| from ../vboxsf/include/iprt/string.h:43,
| from mount.vboxsf.c:62:
| ../vboxsf/include/linux/stdarg.h:6:9: warning: 'va_start' redefined
| 6 | #define va_start(v, l) __builtin_va_start(v, l)
| | ^~~~~~~~
| In file included from mount.vboxsf.c:44:
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:49:9:
note: this is the location of the previous definition
| 49 | #define va_start(...) __builtin_c23_va_start(__VA_ARGS__)
| | ^~~~~~~~
| ../vboxsf/include/linux/stdarg.h:8:9: warning: 'va_arg' redefined
| 8 | #define va_arg(v, T) __builtin_va_arg(v, T)
| | ^~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:54:9:
note: this is the location of the previous definition
| 54 | #define va_arg(v,l) __builtin_va_arg(v,l)
| | ^~~~~~
| ../vboxsf/include/linux/stdarg.h:9:9: warning: 'va_copy' redefined
| 9 | #define va_copy(d, s) __builtin_va_copy(d, s)
| | ^~~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:57:9:
note: this is the location of the previous definition
| 57 | #define va_copy(d,s) __builtin_va_copy(d,s)
| | ^~~~~~~
```
If the missmatch is reversed, there is probably a different error.
To fix this we provide the actual target kernel version via the KERN_MAJ
Makefile variable
Note: The kernel version might be empty during parsing (e.g. when using
linux-dummy), therefore `or ''` is needed.
CC: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Khem Raj
Devansh Patel
Ankur Tyagi
Wang Mingyu
Deepak Rathore
Hetvi Thakar
Darsh Kelaiya
Vijay Anusuri
Omkar Patil
Abhishek Bachiphale
Preeti Sachan
Tugrul Kukul
Rouven Rastetter
Peter Marko