Commit Graph

19712 Commits

Author SHA1 Message Date
wangmy 15938ed77b trace-cmd: Conflict resolution
perf(oe-core) also uses the doc included in plugins/, so package it in own subdirs of trace-cmd.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d8402fdd6f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-23 08:27:16 -07:00
Saul Wold bf945de831 sysdig: disable building for ppc
Sysdig depends on tbb which no longer builds for powerpc

Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 433603cb7d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-23 08:27:16 -07:00
Saul Wold c7c0a292cf opencv: remove tbb packageconfig for powerpc
Since tbb does not build for powerpc remove it from the enabled list

Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e0581ad12f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-23 08:19:18 -07:00
Alexander Vickberg 26c88bf3eb hostapd: fix building with CONFIG_TLS=internal
The patch recently added for CVE-2021-30004 broke compilation with
CONFIG_TLS=internal. This adds the necessary function to let it
compile again.

Signed-off-by: Alexander Vickberg <wickbergster@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d6ef417074)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 16:17:39 -07:00
wangmy 4210e9cb2a libsdl: Fix CVE-2019-13616
References
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13616

  SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read
  in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

  Upstream-Status: Backport [https://github.com/libsdl-org/SDL/commit/97fefd050976bbbfca9608499f6a7d9fb86e70db]
  CVE: CVE-2019-13616

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 57ae91d291)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:35:45 -07:00
wangmy 93a33c9611 exiv2: Fix CVE-2021-29473
References
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29473

      The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
      An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
      if they can trick the victim into running Exiv2 on a crafted image file.

      Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/pull/1587/commits/e6a0982f7cd9282052b6e3485a458d60629ffa0b]
      CVE: CVE-2021-29473

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a9aecd2c32)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy ce025415dd exiv2: Fix CVE-2021-29470
References
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29470

      The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
      An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
      if they can trick the victim into running Exiv2 on a crafted image file.

      Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/pull/1581/commits/6628a69c036df2aa036290e6cd71767c159c79ed]
      CVE: CVE-2021-29470

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit bb1400efda)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy 11ef1c6cb5 exiv2: Fix CVE-2021-29464
References
          https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29464

          The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file.
          An attacker could potentially exploit the vulnerability to gain code execution, if they can
          trick the victim into running Exiv2 on a crafted image file.

          Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/commit/f9308839198aca5e68a65194f151a1de92398f54]
          CVE: CVE-2021-29464

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8c9470bdfa)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy d3f0f8957f exiv2: Fix CVE-2021-3482
References
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3482

      Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp
      can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.

      Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/pull/1523/commits/22ea582c6b74ada30bec3a6b15de3c3e52f2b4da]
      CVE: CVE-2021-3482

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9e7c2c9713)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy 0e8fcf0e77 exiv2: Fix CVE-2021-29463
References
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29463

      The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
      An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
      if they can trick the victim into running Exiv2 on a crafted image file.

      Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/commit/783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b]
      CVE: CVE-2021-29463

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8e63ac6c86)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy 8355be5c64 exiv2: Fix CVE-2021-29458
References
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29458

      The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
      An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
      if they can trick the victim into running Exiv2 on a crafted image file.

      Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/pull/1536/commits/06d2db6e5fd2fcca9c060e95fc97f8a5b5d4c22d]
      CVE: CVE-2021-29458

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f0d83c14d9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:46 -07:00
wangmy 52455c3047 exiv2: Fix CVE-2021-29457
References
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29457

  The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file.
  An attacker could potentially exploit the vulnerability to gain code execution, if they can
  trick the victim into running Exiv2 on a crafted image file.

  Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/commit/0230620e6ea5e2da0911318e07ce6e66d1ebdf22]
  CVE: CVE-2021-29457

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5be7269309)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:34:27 -07:00
wangmy a1ae03d096 uftrace: Fix a plthook crash on aarch64 with binutils2.35.1 and later versions on aarch64
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 54feab11a1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:27:59 -07:00
Leon Anavi 9e5c4181ec python3-pymongo: Upgrade 3.11.3 -> 3.11.4
Upgrade to release 3.11.4:

- Bug fix where a MongoClient would mistakenly attempt to create
  minPoolSize connections to arbiter nodes
- Bug fix that prevented PyMongo from retrying writes after a
  writeConcernError on MongoDB 4.4+

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit dcb9ecc1e5)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:22:21 -07:00
Leon Anavi cc118b56ad python3-rfc3339-validator: Upgrade 0.1.3 -> 0.1.4
Upgrade to release 0.1.4:

- Fix test failure on darwin

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit b5fb8390df)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:21:34 -07:00
Trevor Gamblin b318670297 python3-django: upgrade 3.2 -> 3.2.2
Version 3.2.2 includes a fix for CVE-2021-32052.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit d97e1b7cfd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:03:13 -07:00
Trevor Gamblin f3758cb444 python3-django: upgrade 2.2.20 -> 2.2.22
Version 2.2.22 includes a fix for CVE-2021-32052.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit b26099fc15)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 15:01:52 -07:00
Leon Anavi d555451d10 python3-robotframework: Upgrade 4.0.1 -> 4.0.2
Upgrade to release 4.0.2:

- Using Union containing generics as type hint causes an error
- Libdoc does not anymore work with resource files in PYTHONPATH
- Rebot removes sourcename attribute from <kw> in output.xml
- Run Keyword If Test Failed does not work correctly if it is not
  first keyword in teardown and test is skipped
- Argument conversion problems when type hint is ABC

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 73d63dd3fe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 14:54:36 -07:00
Leon Anavi 3863aba2ac python3-cerberus: Upgrade 1.3.3 -> 1.3.4
Upgrade to release 1.3.4:

- Reverts the unsatisfying fix for KeyError during import when
  running with python optimisation level of 2
- instead a RuntimeError is thrown when Python is running with
  optimization level 2

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 87e6a45374)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-22 14:49:30 -07:00
Andreas Müller cf5bd6a830 xfce4-settings: upgrade 4.16.0 -> 4.16.1
Release notes for 4.16.1
========================
- display: Fix scale by rounding (Fixes #258)
- Drop preferences-desktop-default-applications icon name
- Also allocate terminating element
- Translation Updates

Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit eb5d3362d9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
Saul Wold 360eec5a84 packagegroup-meta-oe: conditional remove tbb for powerpc
Since tbb has a COMPATIBLE_MACHINE entry to prevent it from building
for powerpcc, let's also remove it from the meta-oe-support package
group.

Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 564f721954)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
Andreas Müller 30bb060b4c zsh: reduce priority slightly to avoid conflict with bash
| [log_check] Warn: update-alternatives: sh has multiple providers with the same priority, please check /workdir/raspberrypi4_64-mortsgna-linux/allgui-dev-image/1.0-r0/rootfs/usr/lib/opkg/alternatives/sh for details

Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit df10c7bcc0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
zangrc 480e25bb08 wireshark: upgrade 3.4.4 -> 3.4.5
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 37d8352d0d)
[Bug fix update only &  CVE-2021-22207]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
zangrc 8fecae53fe openvpn: upgrade 2.5.1 -> 2.5.2
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b12a2818b9)
[Bug fix update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
zangrc a570657c08 fetchmail: upgrade 6.4.18 -> 6.4.19
-License-Update: Change distribition to distribution.
Specific permission is granted for the GPLed code in this distribution to be linked to OpenSSL without invoking GPL clause 2(b).

Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 902eea11f1)
[Bug fix update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
Khem Raj e1cd1eb153 python3-jinja2_2.%.bbappend: Delete
These changes are moved to OE-Core

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit d131aed9e1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
Khem Raj 307a613c73 libdevmapper,lvm2: Do not inherit license
inheriting license class which brings in
AVAILABLE_LICENSES into do_configure task checksums class since it wants to
enable thin-provisioning-tools if distro allows GPL-3 automatically, but this
brings issues when other layers which have additional licenses are
provided which ends up in signature mismatches so leave that setting to end-user and keep it disabled by
default with a comment in recipes stating that if needed then the user should enable it via
config metadata or bbappends.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f592e81f11)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:41 -07:00
Khem Raj d914d2b2fe aom: Match the name for AOM-Patent-License-1.0
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 30ca058a1e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:40 -07:00
Silcet c7150fc61d ufw: fix python shebang
[meta-openembedded ticket #327] --
https://github.com/openembedded/meta-openembedded/issues/327

The python version in the shebang at the begining of the ufw script
should be the same one as the version the setup.py script was called
with.

The fix in patch "setup-only-make-one-reference-to-env.patch"
depends on sys.executable returning "/usr/bin/env pythonX". However,
it returns "/usr/bin/pythonX". Using sys.version_info we can get the
major version of the python used to called the script and append
that to the shebang line so it works as intended.

Signed-off-by: Silcet <camorga1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5194af1afd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:40 -07:00
Saul Wold 0cbced2d51 tbb: Disable PPC as COMPATIBLE_MACHINE
The latest version does not support PPC architecture, so disable
the it. Otherwise the following error occurs:

/srv/nvme/yocto/hardknott/builds/tbb/tmp/work/ppc7400-poky-linux/tbb/2021.2.0-r0/git/src/tbb/tools_api/ittnotify_config.h:338:12: error: '__TBB_machine_fetchadd4' was not declared in this scope
  338 |     return __TBB_machine_fetchadd4(ptr, 1) + 1L;
      |            ^~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8170a965d0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-17 07:18:40 -07:00
Martin Jansa bbe3855ec7 ostree: switch from default master branch to main to fix do_fetch failure
* branch was renamed in upstream repo

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-13 21:37:32 -07:00
Armin Kuster c3a36263f9 packagegroup-meta-webserver: remove nostromo from pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-29 18:57:25 -07:00
Armin Kuster c4a4070a46 nostromo: Blacklist and exclude from world builds
Host site is dead.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-29 18:39:03 -07:00
Sinan Kaya ef6adcba6f zram: add support for mem_limit
Some targets might be interested in limiting how big
zram can grow. If the variable is set in /etc/default/zram file,
configure it in mem_limit sysfs attribute.

Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cb1cf05378)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 15:12:19 -07:00
zangrc 981a6b3cb1 nss: upgrade 3.63 -> 3.64
-License-Update: Add the license of MIT.

Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a7d0d87854)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 15:11:33 -07:00
Yi Zhao 88db66c3e1 gvfs: rdepend on gsettings-desktop-schemas
The gvfs-udisks2-volume-monitor requires gsettings-desktop-schemas.

Fixes:
gvfs-udisks2-vo[1780]: Settings schema 'org.gnome.desktop.lockdown' is not installed
kernel: show_signal: 26 callbacks suppressed
kernel: traps: gvfs-udisks2-vo[1780] trap int3 ip:7f856be349c7 sp:7ffe34561e60 error:0 in libglib-2.0.so.0.6600.7[7f856bdf8000+88000]
systemd[1637]: gvfs-udisks2-volume-monitor.service: Main process exited, code=killed, status=5/TRAP
systemd[1637]: gvfs-udisks2-volume-monitor.service: Failed with result 'signal'.
systemd[1637]: Failed to start Virtual filesystem service - disk device monitor.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6710d0bba5)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 15:10:08 -07:00
Khem Raj 8dcdded940 gimp: Disable vector icons on musl/x86
it uses qemu underneath which segfaults on musl/x86
until its fixed, we disable vector icons

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 44ca91f0fe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 15:09:33 -07:00
zangrc 085332dcd2 redis: upgrade 6.2.1 -> 6.2.2
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4b04112fdd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 15:09:18 -07:00
zangrc 25532d82a7 libdvdread: upgrade 6.1.1 -> 6.1.2
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1dc5835403)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:59:03 -07:00
zangrc 67eaaf8548 networkmanager: upgrade 1.30.2 -> 1.30.4
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 56782012e3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:58:21 -07:00
Leon Anavi 3fe42a6805 python3-hyperframe: Upgrade 6.0.0 -> 6.0.1
Upgrade to release 6.0.1 with the following API changes:

- Added support for Python 3.9
- Added type hints

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 239a3a3a3a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:56:47 -07:00
Leon Anavi ba22785a42 python3-asttokens: Upgrade 2.0.4 -> 2.0.5
Upgrade to release 2.0.5:

- setup.cfg: remove wheel dependency
- Handle starred expressions in tests
- Make 3.9 support official
- pypy2 instead of pypy2.7
- pypy3 instead of pypy3.5

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 3bef475e76)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:56:47 -07:00
Leon Anavi 2eb29a3805 python3-pysonos: Upgrade 0.0.42 -> 0.0.43
Upgrade to release 0.0.43:

- Downgrade asyncio log severity

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 2d9aca131f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:56:47 -07:00
Khem Raj ab71ab067d tbb: Re-introduce PE
It was accidentally dropped in last upgrade for this recipe

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Martin Jansa <martin.jansa@gmail.com>
Cc: Naveen Saini <naveen.kumar.saini@intel.com>
(cherry picked from commit b5ad9c011d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:55:28 -07:00
Kai Kang 601c080499 freeradius: check existence of openssl's commands in bootstrap
It calls openssl's commands 'dhparam' and 'pkcs12' in script bootstrap.
These commands are configurable based on configure options 'no-dh' and
'no-des', and may not be provided by openssl. So check existence of
these commands. If not, abort running of script bootstrap.

1. https://github.com/openssl/openssl/blob/master/apps/build.info#L37
2. https://github.com/openssl/openssl/blob/master/apps/build.info#L22

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c8ceefc5c3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:55:17 -07:00
Mingli Yu 71b546ed85 python3-cryptography: Upgrade to 3.3.2
Fix a security issue CVE-2020-36242 where certain sequences of
``update()`` calls when symmetrically encrypting very large
payloads (>2GB) could result in an integer overflow, leading to
buffer overflows.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-23 19:09:56 -07:00
Mingli Yu 6289ad43f8 php: Upgrade to 7.4.16
License-Update: License updated (year updated)

Fix some security issues such as CVE-2021-21702 and remove two
cve patches which already included in the new version.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-23 19:09:51 -07:00
Chen Qi e705d4932a python3-django: upgrade to 2.2.20
2.2.x is LTS, so upgrade to latest release 2.2.20.
This upgrade fixes several CVEs such as CVE-2021-3281.

Also, CVE-2021-28658.patch is dropped as it's already in 2.2.20.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-23 19:09:46 -07:00
Chen Qi 63bcddbd85 tigervnc: upgrade to 1.11.0
Upgrade to latest stable version.

The 1.10 branch is not maitained any more, it stops update in 2019.
The 1.11 branch has fix for CVE-2020-26117, which is a high risk CVE.
https://nvd.nist.gov/vuln/detail/CVE-2020-26117

Some changes in this new version are as below.
1) 'bash' is added to RDEPENDS as /usr/libexec/vncsession-start requires it.
2) DEPENDS on libpam and requires 'pam' distro feature.
   This is because upstream has made 'pam' mandatory in the following commit.
   """
   commit d80817f101d1b3f1a9b1c5ec268f28fffa2d75f9
   Author: Pierre Ossman <ossman@cendio.se>
   Date:   Wed Jul 11 15:49:46 2018 +0200

       Make PAM mandatory

       It is present on all UNIX systems anyway, so let's simplify things.
       We will need it for more proper session startup anyway.
   """

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-23 19:09:42 -07:00
Stefan Ghinea aef354a0c2 python3-django: fix CVE-2021-28658
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,
MultiPartParser allowed directory traversal via uploaded files with
suitably crafted file names. Built-in upload handlers were not affected
by this vulnerability.

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-28658

Upstream patches:
https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2

Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-23 19:09:37 -07:00