OpenSSL 4.0 returns const pointers from X509 accessor functions,
makes ASN1_OCTET_STRING opaque, and deprecates HMAC one-shot API.
Four patches addressing credentials, TSI transport security, and
TSI utils.
Upstream-Status: Submitted [https://github.com/grpc/grpc/pull/41932]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
mariadb:mariadb is the active NVD dictionary CPE and configuration identity,
and is also used by CNA affected data for the packaged MariaDB source.
Deprecated mariadb_project records describe a separate Node.js connector.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 420-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
libssh:libssh is the active NVD dictionary CPE and configuration identity
for the packaged libssh source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 48-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Apply a patch fixing the following error:
thd_gddv.cpp: In member function 'int thd_gddv::evaluate_condition(condition&)':
thd_gddv.cpp:1721:39: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'time_t' {aka 'long long int'} [-Werror=format=]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
redis 8.10.0 added "deploy: PREFIX ?= /usr/local" to the top level
Makefile. Assigning PREFIX there, even for an unrelated target, clears
the export flag it inherited from the environment, so recipe shells no
longer see it. As the install target recurses with "$(MAKE) -C src
install" from a recipe shell, the sub-make falls back to src/Makefile's
"PREFIX?=/usr/local" and installs outside ${D}:
install: cannot create regular file '/usr/local/bin/redis-server': Permission denied
make[1]: *** [Makefile:576: install] Error 1
Releases up to 8.8.1 had no PREFIX assignment there, so the exported
value propagated. Pass PREFIX on the make command line instead, which
is propagated to sub-makes.
AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
run-ptest ran each case as "./test.sh $test > /dev/null 2>&1", throwing
away the only thing that explains a failure: test.sh prints which check
failed and which words were misrecognised, e.g.
Fail in base.good. Good words recognised as wrong:
<words>
Without it a failing hunspell ptest reports a bare "FAIL: <name>" and
gives no way to tell a packaging problem from a real defect when the
suite runs on target.
Capture the output and print it, indented, under the FAIL line, and
take test.sh's exit status directly rather than reading $? inside the
else branch of the if that consumed it.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
All 25 ptest failures are missing glibc character-set converters. With
run-ptest no longer discarding test.sh output, the cause is explicit:
error - iconv_open: ISO8859-1 -> UTF-8
error - iconv_open: UTF-8 -> ISO8859-1
=============================================
Fail in allcaps3.good. Good words recognised as wrong:
Aggregated over the run: 382 ISO8859-1 and 10 ISO8859-15 iconv_open
failures, and every one of the 25 failing tests reports them.
Only glibc-gconv-iso8859-2 was pulled in, but the test corpus needs more
than that. Dictionaries with no SET line in their .aff fall back to
ISO8859-1 in both consumers of the default:
csutil.hxx:99 #define SPELL_ENCODING "ISO8859-1"
affixmgr.cxx:3502 if (encoding.empty()) encoding = SPELL_ENCODING;
hashmgr.cxx:97 if (!csconv) csconv = get_current_cs(SPELL_ENCODING);
and 92 of the 144 installed .aff files have no SET, which is why tests
with pure-ASCII data and no SET line still needed a converter. The
encodings actually referenced across the corpus are ISO8859-1,
ISO8859-15, ISO-8859-15, ISO8859-2 and UTF-8; UTF-8 is built into glibc,
so add the two missing ISO8859 modules.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
tests/test-proxy.c setup() spawns the reference bus implementation
directly:
g_subprocess_launcher_spawn (launcher, &error, "dbus-daemon",
"--session", "--print-address=1",
"--nofork", NULL);
so the test aborts on distros that select a different
VIRTUAL-RUNTIME_dbus:
ERROR:../tests/test-proxy.c:75:setup: assertion failed (error == NULL):
Failed to execute child process "dbus-daemon" (No such file or directory)
FAIL: xdg-dbus-proxy/test-proxy.test (Child process killed by signal 6)
dbus-daemon is packaged only in dbus, and dbus-broker carries
"RCONFLICTS:dbus-broker: dbus", so the two cannot be co-installed;
dbus-broker-launch is not CLI-compatible and cannot stand in. The
existing RDEPENDS on ${VIRTUAL-RUNTIME_dbus} already pulls in dbus (and
hence dbus-daemon) on distros that use it, so report the test as skipped
rather than failed when the daemon genuinely is not installable.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
TestCommandLineToCommaSeparatedValues fails because its JSON test cases
are never installed.
With no arguments the test runs runJsonTests(), which globs
TEST_SOURCE_DIR/cmdline-tests/*.json via FindFirstFileA and returns -1
when the directory cannot be opened. do_configure:prepend already
rewrites TEST_SOURCE_DIR for this CMakeLists to ${PTEST_PATH}/test, and
the built driver confirms it:
$ strings Testing/TestWinPRUtils | grep -e cmdline-tests -e ptest/test
cmdline-tests
cmdline-tests%c*.json
/usr/lib/freerdp3/ptest/test
but do_install_ptest only copies *bmp out of
winpr/libwinpr/utils/test, so /usr/lib/freerdp3/ptest/test/cmdline-tests
does not exist on target and the glob always fails. Copy the directory
alongside the other test data.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
All 6 ptest failures (t/31methcache, t/35thrclone, t/40profile,
t/41prof_dump, t/42prof_data, t/43prof_env) are missing runtime perl
modules, in two groups:
Module::Load, required by DBI/Profile.pm line 682:
Can't locate Module/Load.pm in @INC ... at
/usr/lib/perl5/vendor_perl/5.44.0/aarch64-linux/DBI/Profile.pm line 682.
This breaks t/40profile and t/43prof_env directly, and cascades into
t/41prof_dump and t/42prof_data: once DBI/Profile.pm fails to compile,
%INC is poisoned, so those two report "Attempt to reload DBI/Profile.pm
aborted" and a missing DBI::Profile->flush_to_disk method rather than
the underlying cause. Provided by perl-module-load.
Test2::Util::Sig, required by Test2/IPC/Driver/Files.pm line 18, which
Test::Builder pulls in when a test enables Test2 IPC (threads/forking):
Can't locate Test2/Util/Sig.pm in @INC ... at
/usr/lib/perl5/5.44.0/Test2/IPC/Driver/Files.pm line 18.
This makes Test::More unusable in t/31methcache and t/35thrclone, which
is why only those two of the many Test::More-based tests fail. Provided
by perl-module-test2-util-sig.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
14 of the 257 pegtl tests failed - every test that reads a data file
(input_file_input, input_mmap_input, internal_file_mapper,
internal_read_file_stdio, stream_*_input, example_json, ...) while the
243 tests that parse in-memory strings passed.
Upstream runs its tests from the source root:
src/test/CMakeLists.txt:299
add_test(NAME ${exename} WORKING_DIRECTORY ${CMAKE_SOURCE_DIR} ...)
so the tests open their data with CWD-relative literals - grepping the
test sources shows src/test/data/duseltronik.txt (7 references),
src/test/data/test_data.txt (4) and src/test/data/{blns,pass1-3,
fail1-39}.json. run-ptest executes the binaries from ${PTEST_PATH}, so
the data has to be at ${PTEST_PATH}/src/test/data/.
The recipe instead installed it to src/test/pegtl/data - one directory
too deep - and copied only *.json, so test_data.txt and
duseltronik.txt were missing entirely. Install all of src/test/data
to the path the tests actually use. The binaries stay in
src/test/pegtl, which is where run-ptest globs for them.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
run-ptest has a #!/bin/sh shebang but used two constructs that are not
available in the target /bin/sh (dash), so the suite died immediately
after starting the server and reported no test results at all:
run-ptest: line 54: stdbuf: not found
run-ptest: line 58: syntax error: bad substitution
ERROR: Exit status is 2
${PIPESTATUS[0]} is a bash array reference; dash has no PIPESTATUS and
fails with "bad substitution". stdbuf is coreutils-only and is not
guaranteed to be installed on the target.
Capture pg_regress output to a temporary file and use $? directly
instead of piping live into sed, which removes the need for both
PIPESTATUS and stdbuf while keeping the same PASS:/FAIL: translation.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Same problem as xdg-dbus-proxy: the hardcoded "dbus" RDEPENDS makes
meta-oe-image-ptest-fwupd fail do_rootfs on a distro whose
VIRTUAL-RUNTIME_dbus is dbus-broker, since dbus-broker RCONFLICTS with
the dbus provided by dbus-1 while systemd requires dbus-broker.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Hardcoding "dbus" makes the ptest image unbuildable on any distro that
selects a different system bus implementation. On a systemd distro
setting VIRTUAL-RUNTIME_dbus = "dbus-broker", do_rootfs fails to
solve:
package dbus-broker-37 conflicts with dbus provided by dbus-1-1.16.2
package systemd requires dbus-broker, but none of the providers can
be installed
package xdg-dbus-proxy-ptest requires dbus, but none of the providers
can be installed
Depend on ${VIRTUAL-RUNTIME_dbus} instead so the ptest package pulls
in whichever bus the distro actually uses.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
pcsc-lite 2.5.0 defaults to installing systemd user units, which leaves the
package without a system-level pcscd.service while SYSTEMD_SERVICE still
enables pcscd.socket. On target systems this makes systemctl status pcscd
fail, and systemctl --user start pcscd can fail because the user unit
requires polkit.service from the user manager.
Select upstream Meson systemdunit=system so pcscd.service and pcscd.socket
are installed as system units. Keep upstream sysusers.d packaging so
systemd-sysusers can create the pcscd system user required by the
generated service and socket units.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Now that KERN_MAJ reflects the target kernel instead of the build host's
uname -r, vboxvideo is actually built for kernels older than 7.x -- and it
does not compile against 6.18.44:
vbox_fb.c:336:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'; did you mean 'drm_fb_helper_fill_info'? [-Wimplicit-function-declaration]
vbox_fb.c:336:14: error: assignment to 'struct fb_info *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
Linux commit 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in a
single place") moved the struct fb_info allocation out of the drivers and into
the DRM core, and made drm_fb_helper_alloc_info() static; drivers now find the
instance ready to use in fb_helper->info by the time their .fbdev_probe
callback runs. vbox_fb.c guards its call with RTLNX_VER_MIN(6,19,0), which is
where the change landed in mainline.
Bumping that version check is not a fix. The commit was pulled into stable as
a Stable-dep-of and therefore appears in the *middle* of several series --
v6.6.151, v6.12.103 and v6.18.44 have all dropped the declaration that
v6.6.150, v6.12.102 and v6.18.43 still carry. No LINUX_VERSION_CODE
comparison can express that, and guessing wrong the other way is worse than a
build failure: on a 6.18.0..6.18.43 kernel fb_helper->info is still NULL when
.fbdev_probe runs, so the driver would dereference NULL at runtime.
So add an escape hatch to vbox_fb.c and let the build system decide. do_compile
greps the kernel headers we are actually compiling against and passes
-DVBOX_NO_DRM_FB_HELPER_ALLOC_INFO through KCFLAGS when the declaration is
gone. KCFLAGS rather than EXTRA_CFLAGS/VBOXMOD_CFLAGS because a command-line
assignment of the latter two would clobber the include paths they carry, while
KCFLAGS is untouched by VirtualBox's makefiles and propagates cleanly into the
nested $(MAKE) -C $(KERN_DIR). Leaving the macro undefined keeps the previous
behaviour, so nothing changes for kernels that still export the function, and
7.x is unaffected -- VBOX_VIDEO_MODULE is empty there and the in-tree
drivers/gpu/drm/vboxvideo driver is used instead.
Verified on qemux86-64 against linux-yocto 6.18.44, from cleansstate:
vboxguest.ko, vboxsf.ko and vboxvideo.ko all build with no modpost warnings,
the -D reaches the vbox_fb.o compile line, kernel-module-vboxvideo ships the
module, and `nm -u vboxvideo.ko` no longer references
drm_fb_helper_alloc_info -- all 155 remaining undefined symbols are exported
by the kernel's Module.symvers.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Jaipaul Cheernam
Jason Schonberg
Ankur Tyagi
Wang Mingyu
Devansh Patel
Dmitry Baryshkov
Ricardo Salveti
Gianfranco Costamagna
krant
Khem Raj
Khem Raj