0015-fix-openssl-4-engine-api-removal made CST build against OpenSSL 4 by
stubbing out the removed ENGINE API, but left PKCS#11-backed signing broken:
ENGINE_by_id("pkcs11") returns NULL, so engine_ctx_init() fails. Add a patch
that reimplements the pkcs11 certificate and key loading on OSSL_STORE and the
pkcs11 provider (pkcs11-provider), restoring HSM/token-backed signing on
OpenSSL 4. OpenSSL 3 builds are unaffected.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This recipe is being removed from core as it is now deprecated and no
longer needed with Python 3.9 onwards, which integrated the zoneinfo
module.
All users of pytz in meta-python should be reviewed as the dependencies
may be obsolete.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GdkCursor became a final type in GTK 4.24, so gtkmm 4.22 no longer
compiles against it:
error: conflicting declaration 'using GdkCursorClass = struct _GdkCursorClass'
Depends on the gtk4 4.24.0 upgrade in oe-core.
AI-Generated: Uses Claude Code (Claude Opus 5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add missing Signed-off-by tags to benchmark package patches and
update Upstream-Status annotations where appropriate.
Mark the coremark-pro toolchain override patch as OE-specific
cross-compilation support, update the unixbench patch to reflect
that it is needed for the OpenEmbedded runtime packaging model,
and add the missing Signed-off-by tag to the wrk2 patch.
Signed-off-by: Vaibhav Jindal <vaibjind@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
On non-Android builds should_use_fs_config() in adbd's
file_sync_service.cpp unconditionally returns true, so every
`adb push` destination, including paths under /data, is routed through
Android's fs_config tables. Those tables have a catch-all directory entry
for "data" (mode 0771, AID_SYSTEM) but no equivalent file entry, so a
freshly pushed directory and the file inside it end up with inconsistent
owners, and non-root/system processes can't list the directory.
On non-Android builds should_use_fs_config() now returns false by
default: adbd then honours the mode sent by the host and leaves
ownership untouched.
Add a "fs-config" PACKAGECONFIG (disabled by default) which defines
ADBD_USE_FS_CONFIG and re-enables fs_config, scoped to /system, /vendor
and /oem, for BSPs that rely on it.
Behaviour change: fs_config is no longer applied on non-Android builds
unless PACKAGECONFIG contains "fs-config".
AI-Generated: Uses Claude Code (Claude Sonnet 5.5)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The recipe currently only does this via systemd-sysusers. This does not
work for read-only root filesystems, though. So use useradd to create
the pcscd user and group.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The polkit agent helper socket is is used for authorization requests
from (among others) systemd applications that requires administrative
privileges. When available, the polkit-agent-helper-1 executable doesn't
need the setuid bit for authorization to work.
Enable authorization without requiring setuid by configuring the systemd
bbclass to enable the polkit agent helper socket at package install
time.
For the enablement to actually happen, the SYSTEMD_AUTO_ENABLE variable
is changed back to (its default) enable value. This is okay, since it
was originally assigned to not enable the polkit.service unit. That unit
doesn't include an install section, so it cannot be enablet.
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop the pty patch, the problem is fixed upstream since 10.0.2.
Refresh the platform GPU patch to the version merged upstream,
which also excludes USB displays from the primary GPUs. Backport the
libseat build fix, 10.0.4 does not build with libseat otherwise.
Tested on a Raspberry Pi 4 with gpus=primary.
License-Update: COPYING now states that the Unifont font is licensed
under OFL-1.1 instead of GPL, drops the third-party notices for the
dbus-loop, wcwidth and vt.c code and updates the path of the htable
code to src/shl/htable.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update the defconfig to use more linux default settings. Most
settings are imported from the get_started.defconfig from the source
repository. This includes the following changes:
- use libc based malloc, string, sprintf
- use OS based pthread implementation
- include fonts
- include performance monitor
- remove CONFIG_LV_MEM_SIZE_KILOBYTES, not necessary when using libc
memory management
- set refresh period to 16 ms (60 FPS max)
- increase LV_DRAW_LAYER_SIMPLE_BUF_SIZE and LV_DRAW_THREAD_STACK_SIZE
Signed-off-by: Thorsten Schmelzer <t.schmelzer@phytec.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop setting KCONFIG_CONFIG_ROOTDIR to the lvgl subfolder. The demo repo
has now its own Kconfig file.
Signed-off-by: Thorsten Schmelzer <t.schmelzer@phytec.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add the possibility to use wayland as lvgl backend. Add a config snippet
to enable wayland and add the necessary dependencies. The lvgl cmake
needs SYSROOT to be set to RECIPE_SYSROOT to find the wayland protocols.
Signed-off-by: Thorsten Schmelzer <t.schmelzer@phytec.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update the defconfig to use Linux default settings. Settings are taken
from the linux.defconfig from the source repository. This includes the
following changes:
- use libc based malloc, string, sprintf. Using libc based memory
allocation eliminates the risk that the lvgl application runs out of
memory because of fixed internal memory size.
- use OS based pthread implementation
- set refresh period to 16 ms (60 FPS max)
- increase LV_DRAW_LAYER_SIMPLE_BUF_SIZE and
CONFIG_LV_DRAW_THREAD_STACK_SIZE
Signed-off-by: Thorsten Schmelzer <t.schmelzer@phytec.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add pkgconfig inherit and drop manually adding include paths to CFLAGS
and CXXFLAGS. The lvgl cmake can handle this meanwhile.
Add a patch to fix missing version and links for installed .so files.
Signed-off-by: Thorsten Schmelzer <t.schmelzer@phytec.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- The format specifier %h was used for two different format fields.
Use %H as target host specifier.
- Fix minor output errors in Intel Node Manager DIMMs and Windmill
device IDs.
- Fix ipmi-oem command line parsing bugs.
- In ipmi-oem, fix error in with wistron get/set-ipv6-trap-settings.
- In ipmi-oem, fix output error in dell get-system-info cmc-info.
- In libipmidetect fix potential hostname sscanf bound overflow.
- In ipmi-oem fujitsu get-sel-entry-long-text, fix potential memory
buffer overflow.
- Fix ipmiconsole workaround flag parsing issues.
- Fix minor libfreeipmi corner cases (e.g. parameter input corner cases).
- Fix minor SEL output corner cases in several OEM vendors.
- Fix libfreeipmi macro inconsistencies / errors.
- Minor documentation fixes.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ibus bundles ax_prog_cc_for_build.m4 serial 21, which does not rename
the ac_cv_prog_cc_c23 cache variable of autoconf 2.73. CC_FOR_BUILD then
takes the option of the cross compiler: with clang it becomes
"gcc -std=gnu23", which GCC 13 and older reject when unicode-parser is
built. Update the macro to serial 26 from autoconf-archive.
Upstream-Status: Pending
Tested by building ibus for x86-64 with ac_cv_prog_cc_c23=-std=gnu23
preset for the target compiler; CC_FOR_BUILD is plain gcc.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It uses pkg-config to query systemd's sysusersdir which is defined as:
sysusers_dir=${prefix}/lib/sysusers.d
sysusersdir=${sysusers_dir}
Fixes installed-vs-shipped in cases where libdir isn't 'lib':
ERROR: QA Issue: pcsc-lite: Files/directories were installed but not shipped in any package:
/usr/lib/sysusers.d
/usr/lib/sysusers.d/pcscd-sysusers.conf
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
pcsc-lite: 2 installed and not shipped files. [installed-vs-shipped]
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
LuaJIT's build compiles minilua and buildvm and runs them, and buildvm
must have the target's pointer size. For a 32 bit target the recipe adds
-m32 to the build compiler, which only exists on x86, so on any other
build host (e.g. AArch64) the build fails.
On those hosts, build the helpers with the target compiler and run them
under qemu-user. x86 build hosts keep -m32 unchanged.
AI-Generated: Claude Code (Claude Opus 5.5)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The lukefile of the git checkout has version = '$USER', which only the
release tarballs replace, so posix/version.lua carried the name of the
user who built it. Set it to PV before building.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The DRM framebuffer was made the size of the source rect while SRC_X and
SRC_Y place that rect inside the frame. With panscan or a crop the rect
reaches past the framebuffer, the atomic commit fails with ENOSPC and the
plane stays dark. The patch, Upstream-Status: Pending, makes the
framebuffer the size of the frame.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
With the OpenGL render API (vo_libmpv) every frame left a fence behind
that nothing cleaned up. On v3d each one holds a sync file, so after about
a minute of video the process ran into the open file limit and the
picture stopped ("MESA: error: Export failed"). Backport the upstream
fix.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The tarball is in the 51/ directory, so gnome_verdir is overridden to
use the major version only.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
0004-gkd-secret-session-drop-the-duplicate-session-unref.patch is
removed, the fix is included upstream (!114).
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
CVE information now contains separate version range for mainline and
stable nginx version.
Problem is that mainline version range includes stable verion fix and
since cve-check marks CVE as applicable if one of ranges contains
current recipe version, it's reported as vulnerable.
* Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive
* Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden
Add also a note to remove these explicit entries when new minor stable
version is available which does not fall into the mainline version range
(for all 3 currently explicitly handled CVEs).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Now that oe-core moved to OpenSSL 4.0, the engine API is gone.
As a result uboot-mkimage's -N/--engine no longer work:
Failed to sign 'signature-1' signature node in 'conf-imx6dl-riotboard.dtb' conf node
uboot-mkimage Can't add hashes to FIT blob: -1
Error: Bad parameters for FIT image type
Usage: uboot-mkimage [-T type] -l image
-l ==> list image header information
-T ==> parse image file as 'type'
-q ==> quiet
A previous patch documented how provider-based PKCS#11 signing works.
Now make an engine option in FITIMAGE_MKIMAGE_EXTRA_ARGS a fatal error. It
has no effect anymore, so a recipe still setting it has not been
migrated; failing with a clear message beats mkimage's generic error
messages above.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Now that oe-core moved to OpenSSL 4.0, the engine API is gone.
As a result uboot-mkimage's -N/--engine no longer work:
Failed to sign 'signature-1' signature node in 'conf-imx6dl-riotboard.dtb' conf node
uboot-mkimage Can't add hashes to FIT blob: -1
Error: Bad parameters for FIT image type
Usage: uboot-mkimage [-T type] -l image
-l ==> list image header information
-T ==> parse image file as 'type'
-q ==> quiet
Document the provider-based setup instead: signing_create_uri_pem() wraps
the role's PKCS#11 URI in a PEM file that OpenSSL loads like a key file and
resolves through the PKCS#11 provider configured by signing_prepare().
mkimage looks for a key in
${FITIMAGE_SIGN_KEYDIR}/${FITIMAGE_SIGN_KEYNAME}.key, so store it there.
This way the existing mkimage invocations do not need to be touched.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ankur Tyagi
Johannes Schneider
Ross Burton
Markus Volk
Vaibhav Jindal
Etienne Cordonnier
Bastian Krause
Peter Marko
Martin Hundebøll
Thorsten Schmelzer
Martin Jansa
Alex Kiernan
Aleksandar Nikolic