Commit Graph

23791 Commits

Author SHA1 Message Date
Khem Raj 3e316f1939 debootstrap: Update SRC_URI to point to valid URL
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2db438f241)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu a6c5155df6 flashrom: upgrade 1.2 -> 1.2.1
0001-typecast-enum-conversions-explicitly.patc
removed since it's included in 1.2.1

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d8e50a9507)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu 41b10de52e iperf3: upgrade 3.14 -> 3.15
Changelog:
===========
  Several bugs that could allow the iperf3 server to hang waiting
  for input on the control connection has been fixed.

  A bug that caused garbled output with UDP tests on 32-bit hosts
  has been fixed (PR #1554, PR #1556). This bug was introduced in
  iperf-3.14.

  A bug in counting UDP messages has been fixed (PR #1367, PR
  #1380).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8765f02ffb)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu 23d9cf882f uftp: upgrade 5.0.2 -> 5.0.3
Changelog:
===========
-A memory leak fix in the prior version wasn't applied correctly, resulting
 in an invalid memory access causing a crash.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5d050f078a)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu 975368a20e uftp: upgrade 5.0.1 -> 5.0.2
Changelog:
=========
-Fixed bug that caused crash when a CLIENT_KEY arrived out of order
-Fixed option handling on Windows when an argument is missing

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93a5628ae6)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu 76de61ab0a uftp: upgrade 5.0 -> 5.0.1
Changelog:
==========
-On very low speed transfers (<10Kbps) sessions would time out due to a very
  large interpacket transmission interval.  Fixed by putting a lower limit
  on the advertised GRTT of of the interpacket transmission interval.
-Sending of ABORT messages on early shutdown would sometimes fail due to
  OpenSSL cleanup functions running before application cleanup.  Changed the
  ordering of atexit() handlers to ensure OpenSSL cleanup happens last.
-Fixed missing timestamp update when clients read CONG_CTRL messages
-Fix to GRTT handling on server to ensure it doesn't fall below minumim.
-Fixed bypassed checking of existing files on client for backup
-Various logging fixes

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0a58426ed0)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Yi Zhao 68c66db375 libtdb: upgrade 1.4.3 -> 1.4.7
* Refresh patches
* Add a patch to skip checking PYTHONHASHSEED

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cf53340f00)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
wangmy 8426871255 cifs-utils: upgrade 6.14 -> 6.15
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 88ea7fc012)

Adapted to Kirkstone.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Randy MacLeod d42bb883dd tnftp: switch the SRC_URI to https
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8f4dc754cf)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Khem Raj bb12695af8 ssmping: Use debian mirror for SRC_URI
Original URI is not accessible anymore
Drop md5sum

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ceb9160341)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Randy MacLeod 790b431538 pimd: switch SRC_URI to https
Switch SRC_URI to https (yes, the URI still has ftp in the path!).
Also drop the obsolete SRC_URI[md5sum].

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9221eaa8d6)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu a88c4f592f ndisc6: upgrade 1.0.7 -> 1.0.8
Changelog
============
Fix potential garbage whilst prining an advertised prefix.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3fe7c5fae8)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Wang Mingyu b2dbbd49ca ndisc6: upgrade 1.0.6 -> 1.0.7
Changelog:
=========
# Do not ignore multicast advertisements when discovery was sent as unicast
  (fix regression from 1.0.5).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a014528ede)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Yi Zhao 515b34d850 lksctp-tools: upgrade 1.0.20 -> 1.0.21
ChangeLog:
https://github.com/sctp/lksctp-tools/blob/v1.0.21/ChangeLog

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4c3e3638b9)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Yi Zhao bc1a12e9c5 lksctp-tools: upgrade 1.0.19 -> 1.0.20
ChangeLog:
https://github.com/sctp/lksctp-tools/blob/v1.0.20/ChangeLog

Drop redundant variables LK_REL, SOLIBVERSION and SOLIBMAJORVERSION in
recipe.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 162039c327)

Adapted to Kirkstone.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-29 20:15:31 +02:00
Randy MacLeod 3420cb0739 ncftp: Upgrade to 3.2.7
Switch the SRC_URI from "ftp:" to "https:". Drop the obsolete SRC_URI[md5sum].
Drop ncftp-3.2.5-gcc10.patch since we're using gcc13 and upstream has fixed the build
to work by adding an extern to sh_util/gpshare.c for example.

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9dbf1b42bb)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Yi Zhao efc78dfed0 devecot: set dovecot.conf file mode with chmod
The touch command doesn't support file mode setting. Set it with chmod.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4b306f382f)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Khem Raj acdeeb0a4a radiusclient-ng: Point SRC_URI to archive.ubuntu.com
This tarball is not available on debian ftp archive anymore

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fe62e64c97)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Khem Raj 23b345c5a1 openflow: Switch SRC_URI to github mirror
Original repo seems to be not accessible.
Fix build with clang-18

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 59bffb6844)

Adapted for Kirkstone.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Khem Raj 86b1d92dcc openflow: Include sys/stat.h for fchmod
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e2b1b060b0)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Bergin, Peter 80968e146f freediameter: fix typo and old overide syntax
A typo that probably caused a left over from override syntax conversion.

    INITSCRIPT_PARAMS$_${PN} --> INITSCRIPT_PARAMS:${PN}

Signed-off-by: Peter Bergin <peter.bergin@windriver.com>
Signed-off-by: Peter Bergin <peter@berginkonsult.se>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 77f031776e)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Gyorgy Sarvari 1de3289aa2 znc: fix LICENSE value, clean up SRC_URI
1. Set the correct LICENSE value

2. Csocket is a submodule of the main znc project. Instead of
cloning it separately in a subfolder, just let the gitsm fetcher
to fetch the correct revisions, at the correct place.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6a8d205e5c)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Khem Raj e93f4a53c9 nfacct: Update SRC_URI to point to valid URL
Update UPSTREAM_CHECK_URI accordingly

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 88b295625d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Wang Mingyu 71a07ae386 libnftnl: upgrade 1.2.5 -> 1.2.6
Changelog:
=========
tests: nft-rule-test: Add test cases to improve code coverage
tests: nft-table-test: fix typo	shixuantong
expr: meta: introduce broute meta expression

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d358507597)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Yi Zhao a1460941fc libnftnl: upgrade 1.2.4 -> 1.2.5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e9df01df3d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Wang Mingyu 4f2e3d6e39 libnftnl: upgrade 1.2.3 -> 1.2.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9afefefac5)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Yi Zhao 5d465fed15 libnftnl: upgrade 1.2.2 -> 1.2.3
Drop 0001-avoid-naming-local-function-as-one-of-printf-family.patch as
the issue has been fixed upstream.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 333cdd80c6)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
wangmy b9e3ddaefd libnftnl: upgrade 1.2.1 -> 1.2.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6d997c52c5)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Wang Mingyu 8b4a5ad2c6 pure-ftpd: upgrade 1.0.51 -> 1.0.52
nostrip.patch
refreshed for 1.0.52

License-Update: Copyright year updated to 2024

Changelog:
==========
 - The QUIT command is now accepted during a transfer.
 - The server can be built with --with-minimal again.
 - Fixed an out of bounds read in the MLSD command.
 - Larger mmap()ed pages are used on aarch64.
 - Improved compatibility with HPUX
 - Improved OpenSSL API compatibility
 - Improved compatibility with OpenWall Linux
 - Improved compatibility with Netfilter

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fac6357f60)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
wangmy 1784ee6c9b pure-ftpd: upgrade 1.0.50 -> 1.0.51
0001-Remove-hardcoded-usr-local-includes-from-configure.a.patch
updated for new version.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8a50039955)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
alperak 95fcec5acd adcli: use https protocol for fetching
Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c74cdd43f3)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Philippe Coval 72f4d030a8 ot-br-posix: Add dep to ipset as used by firewall
ipset is used by firewall module of ot-br-posix:

   third_party/openthread/repo/src/posix/platform/firewall.cpp:\
   return ExecuteCommand("%s add %s %s -exist", kIpsetCommand, aSetName, aAddress);

Related observed issue looked like:

```
oniro@oniro-linux-blueprint-gateway-raspberrypi4-64:~$ sudo journalctl -u otbr-agent.service
Apr 28 17:42:32 oniro-linux-blueprint-gateway-raspberrypi4-64 systemd[1]: Started OpenThread Border Router Agent.
Apr 28 17:42:38 oniro-linux-blueprint-gateway-raspberrypi4-64 otbr-agent[330]: sh: ipset: not found
```

Relate-to: https://gitlab.eclipse.org/eclipse/oniro-blueprints/transparent-gateway/meta-oniro-blueprints-gateway/-/issues/6
Cc: Stefan Schmidt <stefan.schmidt@huawei.com>
Forwarded: https://github.com/openembedded/meta-openembedded/pull/611
Signed-off-by: Philippe Coval <philippe.coval.ext@huawei.com>
(cherry picked from commit fc8209e8bc)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Jim Broadus ec0d9c4746 networkmanager: fix iptables and nft paths
The NetworkManager meson.build is searching for iptables and nft by
passing absolute paths to meson's find_program. The result is that it
locates tools on the host machine when they exist at those locations. If
they don't, it uses default locations. This often works out, but in some
cases, such as when the host uses a merged usr scheme and the build
target does not, the paths will be incorrect and the tools won't be
found at runtime.

These could be PACKAGECONFIG options, but since they have fallback
values, completely disabling the use of either iptables or nft would
require patching the meson.build or setting a bogus location.

Note that this meson.build file follows the same pattern elsewhere, but
most cases are already covered by PACKAGECONFIG options.

Signed-off-by: Jim Broadus <jim@thruwave.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7c44094532)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Gianfranco Costamagna 68823348d6 mosquitto: bump to 2.0.22
Refresh patches, drop patch 3238, now part of upstream codebase

Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0331499e1f)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Louis Rannou 608dd96761 mosquitto: bump to 2.0.21
Upgrade to mosquitto 2.0.21. Update the patch status for issue 2895 and create a
new patch for an issue introduced in 2.0.19 which causes connections to get down
when the clock is changed.

Signed-off-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2a27eacee2)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Soumya Sambu df81889606 iperf3: Fix CVE-2024-53580
iperf v3.17.1 was discovered to contain a segmentation violation via
the iperf_exchange_parameters() function.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-53580
https://security-tracker.debian.org/tracker/CVE-2024-53580

Upstream patch:
https://github.com/esnet/iperf/commit/3f66f604df7f1038a49108c48612c2f4fe71331f

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:13:03 +02:00
Soumya Sambu b8333d7c6f iperf3: Fix CVE-2024-26306
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA
authentication, allows a timing side channel in RSA decryption operations. This
side channel could be sufficient for an attacker to recover credential plaintext.
It requires the attacker to send a large number of messages for decryption, as
described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-26306
https://security-tracker.debian.org/tracker/CVE-2024-26306

Upstream patch:
https://github.com/esnet/iperf/commit/299b356df6939f71619bf45bf7a7d2222e17d840

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:12:59 +02:00
Soumya Sambu 0a0ba8f467 iperf3: Fix CVE-2023-7250
A flaw was found in iperf, a utility for testing network performance using TCP, UDP,
and SCTP. A malicious or malfunctioning client can send less than the expected amount
of data to the iperf server, which can cause the server to hang indefinitely waiting
for the remainder or until the connection gets closed. This will prevent other
connections to the server, leading to a denial of service.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-7250
https://security-tracker.debian.org/tracker/CVE-2023-7250

Upstream patch:
https://github.com/esnet/iperf/commit/5e3704dd850a5df2fb2b3eafd117963d017d07b4

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:01:57 +02:00
Nitin Wankhade 8f65fa4e2e iperf3: Fix CVE-2025-54349
This commit fix heap overflow for iperf3 package

Reference: https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf

Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:01:57 +02:00
Nitin Wankhade bfa5f662db iperf3: Fix CVE-2025-54350
remove assert to prevent crash due to assertion failure
on malformed authentication attempt

Reference: https://github.com/esnet/iperf/commit/4eab661da0bbaac04493fa40164e928c6df7934a

Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 15:01:57 +02:00
AshishKumar Mishra 4c10114c66 image_types_sparse: backport optionally remove RAW image
When creating sparse images, the RAW image is no longer needed in
some workflows such as Android and CI pipelines. These RAW images
can be multi-GB artifacts and consume significant disk space.

This change introduces a configuration option
`DELETE_RAWIMAGE_AFTER_SPARSE_CMD` which, when set to "1",
removes the RAW image after sparse image generation.

This reduces disk usage in builds where sparse images are the
final deliverables and RAW images are not required.

Default behavior is unchanged: RAW images are kept unless the
variable is explicitly enabled:

This change corresponds to upstream  f5246b7df4

    DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "1"   # Delete RAW image
    DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "0"   # Default behavior

Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:19:55 +02:00
Sean Anderson 1f2a86393f image_types_sparse: backport generate "don't care" chunks
By default, img2simg will only generate raw and fill chunks. This adds
support for "don't care" chunks, based on file holes. This is similar to
how bmaptool works. "don't care" chunks do not need to be written,
speeding up flashing time.
This change corresponds to upstream  9862a017fa

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:19:53 +02:00
Sean Anderson b414502a08 image_types_sparse: backport fix pad source image to block size
If the source image's size is not aligned to the sparse image's block
size, then conversion will fail with

img2simg: libsparse/sparse.cpp:133: int write_all_blocks(sparse_file*, output_file*): Assertion `pad >= 0' failed.

This is a bug in img2simg, but an easy way to work around it is to pad
the source image ourselves. The default block size of 4096 matches
img2simg's default block size.

This change corresponds to upstream fb331cb62e

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:19:48 +02:00
Praveen Kumar 033f224986 polkit: fix CVE-2025-7519
A flaw was found in polkit. When processing an XML policy with 32 or
more nested elements in depth, an out-of-bounds write can be triggered.
This issue can lead to a crash or other unexpected behavior, and
arbitrary code execution is not discarded. To exploit this flaw, a
high-privilege account is needed as it's required to place the
malicious policy file properly.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-7519

Upstream-patch:
https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Khem Raj 8846a5a318 dhcp-relay: Pass cross configure flags to bind build
This ensures that host tools like 'gen' are built for build host and not
target. internal bind build supplies its own options to configuring it,
where it does not pass --host option and as a result it does not deduce
it to be a cross compile and hence these variables are not set property
inside bind build

Fixes
| ./gen: /usr/lib/libc.so.6: version `GLIBC_2.38' not found (required by ./gen)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d57c465562)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Zhang Xiao b044efa0e9 dhcp-relay: dev subpackage conflicts with bind-dev
dhcp-relay contains a bundled bind thus their development packages
conflict each other.

Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93892e8413)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Yi Zhao 546fd9dd75 dhcp-relay: upgrade 4.4.3 -> 4.4.3-P1
Changes since 4.4.3 (Bug Fixes)

Corrected a reference count leak that occurs when the server builds
responses to leasequery packets. Thanks to VictorV of Cyber Kunlun
Lab for reporting the issue.
[Gitlab #253]
CVE: CVE-2022-2928

Corrected a memory leak that occurs when unpacking a packet that has an
FQDN option (81) that contains a label with length greater than 63
bytes.
Thanks to VictorV of Cyber Kunlun Lab for reporting the issue.
[Gitlab #254]
CVE: CVE-2022-2929

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 354608cb88)

Adapted to Kirkstone. Dropped two CVE patches, because they are included in
this patch release.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Peter Kjellerstedt 569d5e0755 autossh: Correct the license information
Correct "startline=" to "beginline=" in LIC_FILES_CHKSUM so that the
correct lines from autossh.c and daemon.h are used. Also remove
autossh.spec from LIC_FILES_CHKSUM as it doesn't really contain any
license information.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 506b6c9411)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Khem Raj cfde891d0d libmediaart-2.0: upgrade 1.9.5 -> 1.9.6
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 04d583327d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Khem Raj abee025ebf libdvbpsi: upgrade 1.3.0 -> 1.3.3
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d6832f8136)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00