The default product-only mapping generates vendor-wildcard CPEs for the
recipe's Simon Kelley source. dnsmasq:dnsmasq is an NVD configuration
identity and CNA affected-data identity; the_kelleys:dnsmasq is an NVD
configuration identity; and thekelleys:dnsmasq is an active NVD
dictionary CPE and configuration identity with CNA affected-data records.
This changes the generated product identities. With the frozen
sbom-cve-check database, the 48-entry CVE report is unchanged, so this is
an identity correction with no CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "python-ldap" mapping generates a vendor-wildcard product
identity for the packaged Python binding.
Use "python-ldap:python-ldap" so it matches the NVD dictionary CPE and
configuration identity. The generated product identity changes, but
sbom-cve-check 1.3.3 reports no CVE delta with the pinned databases.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
mariadb:mariadb is the active NVD dictionary CPE and configuration identity,
and is also used by CNA affected data for the packaged MariaDB source.
Deprecated mariadb_project records describe a separate Node.js connector.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 420-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "twisted" value emits a wildcard-vendor identity
instead of the active identity assigned to the packaged Twisted source.
Use "twisted:twisted" for its NVD dictionary CPE, NVD configuration,
and CNA affected-data identities. With sbom-cve-check 1.3.3 and the
pinned database snapshots, the generated product identity changes; the
current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
libssh:libssh is the active NVD dictionary CPE and configuration identity
for the packaged libssh source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 48-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Apply a patch fixing the following error:
thd_gddv.cpp: In member function 'int thd_gddv::evaluate_condition(condition&)':
thd_gddv.cpp:1721:39: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'time_t' {aka 'long long int'} [-Werror=format=]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
I am hoping to start contributing more to OpenEmbedded and this seems
like a very obvious place to start. I am on the NNG advisory board [1]
and actively working on NNG, while using Yocto for both my day job and
several hobby projects.
[1]: https://github.com/nanomsg/nng/discussions/1782
Signed-off-by: Nate Kent <nate@nkent.net>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
redis 8.10.0 added "deploy: PREFIX ?= /usr/local" to the top level
Makefile. Assigning PREFIX there, even for an unrelated target, clears
the export flag it inherited from the environment, so recipe shells no
longer see it. As the install target recurses with "$(MAKE) -C src
install" from a recipe shell, the sub-make falls back to src/Makefile's
"PREFIX?=/usr/local" and installs outside ${D}:
install: cannot create regular file '/usr/local/bin/redis-server': Permission denied
make[1]: *** [Makefile:576: install] Error 1
Releases up to 8.8.1 had no PREFIX assignment there, so the exported
value propagated. Pass PREFIX on the make command line instead, which
is propagated to sub-makes.
AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add the pw-voiceui tool, a CLI for controlling and monitoring the SVA
(Sound Trigger / Voice Activation) voice-UI PipeWire node exposed by
the pw-pal-plugin (media.role=VoiceUI). Supports list/info/listen,
setting SVA parameters, and sending commands.
Add 0003-tools-add-pw-voiceui-SVA-voice-UI-control-listen-cl.patch,
reference it from SRC_URI, and list pw-voiceui in FILES:${PN}-tools.
Signed-off-by: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pcm_ioctl() previously had a FIXME and always issued the ioctl
directly on pcm->fd, bypassing any loaded plugin (e.g. AGM's tinyalsa
plugin). Dispatch through pcm->ops->ioctl when a plugin is loaded,
falling back to the direct ioctl() otherwise.
Add 0002-pcm-fix-pcm_ioctl-to-dispatch-through-plugin-ops.patch and
reference it from SRC_URI.
Signed-off-by: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:ujson" mapping does not match the UltraJSON identities used by NVD and CVE List V5, so source-aligned CVEs are missed.
Use "ultrajson:ultrajson" for the CNA affected-data identity and "ultrajson_project:ultrajson" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "tweepy" value emits a wildcard-vendor identity and
hides the distinct NVD identities assigned to the packaged Tweepy source.
Use "josh_roesslein:tweepy" for its NVD dictionary CPE and
"tweepy:tweepy" for the NVD configuration-only identity. With
sbom-cve-check 1.3.3 and the pinned database snapshots, the generated
product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask-user" mapping emits the wildcard-vendor
*:flask-user CPE instead of the exact NVD identity for the packaged
lingthio/Flask-User source.
Use "flask-user_project:flask-user", which is both an NVD dictionary
CPE and an NVD configuration identity. CNA affected data uses
"n/a:Flask-User" and remains covered by scanner aliases. With
sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the generated
identity changes but CVE-2021-23401 remains reported as affected.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask" mapping emits the wildcard-vendor *:flask CPE
instead of the exact NVD identity for the packaged pallets/flask
source.
Use "palletsprojects:flask", which is both an NVD dictionary CPE and
an NVD configuration identity. CNA affected data uses "pallets:flask"
and "The Pallets Project:Flask", which remain covered by scanner
aliases. With sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the
generated identity changes but the current CVE report does not.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "aiohttp" mapping emits the wildcard-vendor *:aiohttp CPE
instead of the exact NVD identity for the packaged aio-libs/aiohttp
source.
Use "aiohttp:aiohttp", which is both an NVD dictionary CPE and an NVD
configuration identity. CNA affected data uses "aio-libs:aiohttp" and
remains covered by scanner aliases. With sbom-cve-check 1.3.3 and the
pinned 2026-08-12 data, the generated identity changes but the current
CVE report does not.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "waitress" mapping emits a wildcard-vendor identity instead of the exact identities assigned to the packaged Pylons source.
Use "pylons:waitress" for the CNA affected-data identity and "agendaless:waitress" for the NVD dictionary CPE and configuration identity. This changes the generated product identity, but sbom-cve-check 1.3.3 with the pinned databases leaves the current CVE report unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "werkzeug" mapping emits a wildcard-vendor identity instead of the exact identities assigned to the packaged Pallets source.
Use "pallets:werkzeug" for the CNA affected-data identity and "palletsprojects:werkzeug" for the NVD dictionary CPE and configuration identity. This changes the generated product identity, but sbom-cve-check 1.3.3 with the pinned databases leaves the current CVE report unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
run-ptest ran each case as "./test.sh $test > /dev/null 2>&1", throwing
away the only thing that explains a failure: test.sh prints which check
failed and which words were misrecognised, e.g.
Fail in base.good. Good words recognised as wrong:
<words>
Without it a failing hunspell ptest reports a bare "FAIL: <name>" and
gives no way to tell a packaging problem from a real defect when the
suite runs on target.
Capture the output and print it, indented, under the FAIL line, and
take test.sh's exit status directly rather than reading $? inside the
else branch of the if that consumed it.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
All 25 ptest failures are missing glibc character-set converters. With
run-ptest no longer discarding test.sh output, the cause is explicit:
error - iconv_open: ISO8859-1 -> UTF-8
error - iconv_open: UTF-8 -> ISO8859-1
=============================================
Fail in allcaps3.good. Good words recognised as wrong:
Aggregated over the run: 382 ISO8859-1 and 10 ISO8859-15 iconv_open
failures, and every one of the 25 failing tests reports them.
Only glibc-gconv-iso8859-2 was pulled in, but the test corpus needs more
than that. Dictionaries with no SET line in their .aff fall back to
ISO8859-1 in both consumers of the default:
csutil.hxx:99 #define SPELL_ENCODING "ISO8859-1"
affixmgr.cxx:3502 if (encoding.empty()) encoding = SPELL_ENCODING;
hashmgr.cxx:97 if (!csconv) csconv = get_current_cs(SPELL_ENCODING);
and 92 of the 144 installed .aff files have no SET, which is why tests
with pure-ASCII data and no SET line still needed a converter. The
encodings actually referenced across the corpus are ISO8859-1,
ISO8859-15, ISO-8859-15, ISO8859-2 and UTF-8; UTF-8 is built into glibc,
so add the two missing ISO8859 modules.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
tests/test-proxy.c setup() spawns the reference bus implementation
directly:
g_subprocess_launcher_spawn (launcher, &error, "dbus-daemon",
"--session", "--print-address=1",
"--nofork", NULL);
so the test aborts on distros that select a different
VIRTUAL-RUNTIME_dbus:
ERROR:../tests/test-proxy.c:75:setup: assertion failed (error == NULL):
Failed to execute child process "dbus-daemon" (No such file or directory)
FAIL: xdg-dbus-proxy/test-proxy.test (Child process killed by signal 6)
dbus-daemon is packaged only in dbus, and dbus-broker carries
"RCONFLICTS:dbus-broker: dbus", so the two cannot be co-installed;
dbus-broker-launch is not CLI-compatible and cannot stand in. The
existing RDEPENDS on ${VIRTUAL-RUNTIME_dbus} already pulls in dbus (and
hence dbus-daemon) on distros that use it, so report the test as skipped
rather than failed when the daemon genuinely is not installable.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
TestCommandLineToCommaSeparatedValues fails because its JSON test cases
are never installed.
With no arguments the test runs runJsonTests(), which globs
TEST_SOURCE_DIR/cmdline-tests/*.json via FindFirstFileA and returns -1
when the directory cannot be opened. do_configure:prepend already
rewrites TEST_SOURCE_DIR for this CMakeLists to ${PTEST_PATH}/test, and
the built driver confirms it:
$ strings Testing/TestWinPRUtils | grep -e cmdline-tests -e ptest/test
cmdline-tests
cmdline-tests%c*.json
/usr/lib/freerdp3/ptest/test
but do_install_ptest only copies *bmp out of
winpr/libwinpr/utils/test, so /usr/lib/freerdp3/ptest/test/cmdline-tests
does not exist on target and the glob always fails. Copy the directory
alongside the other test data.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
All 6 ptest failures (t/31methcache, t/35thrclone, t/40profile,
t/41prof_dump, t/42prof_data, t/43prof_env) are missing runtime perl
modules, in two groups:
Module::Load, required by DBI/Profile.pm line 682:
Can't locate Module/Load.pm in @INC ... at
/usr/lib/perl5/vendor_perl/5.44.0/aarch64-linux/DBI/Profile.pm line 682.
This breaks t/40profile and t/43prof_env directly, and cascades into
t/41prof_dump and t/42prof_data: once DBI/Profile.pm fails to compile,
%INC is poisoned, so those two report "Attempt to reload DBI/Profile.pm
aborted" and a missing DBI::Profile->flush_to_disk method rather than
the underlying cause. Provided by perl-module-load.
Test2::Util::Sig, required by Test2/IPC/Driver/Files.pm line 18, which
Test::Builder pulls in when a test enables Test2 IPC (threads/forking):
Can't locate Test2/Util/Sig.pm in @INC ... at
/usr/lib/perl5/5.44.0/Test2/IPC/Driver/Files.pm line 18.
This makes Test::More unusable in t/31methcache and t/35thrclone, which
is why only those two of the many Test::More-based tests fail. Provided
by perl-module-test2-util-sig.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
14 of the 257 pegtl tests failed - every test that reads a data file
(input_file_input, input_mmap_input, internal_file_mapper,
internal_read_file_stdio, stream_*_input, example_json, ...) while the
243 tests that parse in-memory strings passed.
Upstream runs its tests from the source root:
src/test/CMakeLists.txt:299
add_test(NAME ${exename} WORKING_DIRECTORY ${CMAKE_SOURCE_DIR} ...)
so the tests open their data with CWD-relative literals - grepping the
test sources shows src/test/data/duseltronik.txt (7 references),
src/test/data/test_data.txt (4) and src/test/data/{blns,pass1-3,
fail1-39}.json. run-ptest executes the binaries from ${PTEST_PATH}, so
the data has to be at ${PTEST_PATH}/src/test/data/.
The recipe instead installed it to src/test/pegtl/data - one directory
too deep - and copied only *.json, so test_data.txt and
duseltronik.txt were missing entirely. Install all of src/test/data
to the path the tests actually use. The binaries stay in
src/test/pegtl, which is where run-ptest globs for them.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
run-ptest has a #!/bin/sh shebang but used two constructs that are not
available in the target /bin/sh (dash), so the suite died immediately
after starting the server and reported no test results at all:
run-ptest: line 54: stdbuf: not found
run-ptest: line 58: syntax error: bad substitution
ERROR: Exit status is 2
${PIPESTATUS[0]} is a bash array reference; dash has no PIPESTATUS and
fails with "bad substitution". stdbuf is coreutils-only and is not
guaranteed to be installed on the target.
Capture pg_regress output to a temporary file and use $? directly
instead of piping live into sed, which removes the need for both
PIPESTATUS and stdbuf while keeping the same PASS:/FAIL: translation.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Same problem as xdg-dbus-proxy: the hardcoded "dbus" RDEPENDS makes
meta-oe-image-ptest-fwupd fail do_rootfs on a distro whose
VIRTUAL-RUNTIME_dbus is dbus-broker, since dbus-broker RCONFLICTS with
the dbus provided by dbus-1 while systemd requires dbus-broker.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Hardcoding "dbus" makes the ptest image unbuildable on any distro that
selects a different system bus implementation. On a systemd distro
setting VIRTUAL-RUNTIME_dbus = "dbus-broker", do_rootfs fails to
solve:
package dbus-broker-37 conflicts with dbus provided by dbus-1-1.16.2
package systemd requires dbus-broker, but none of the providers can
be installed
package xdg-dbus-proxy-ptest requires dbus, but none of the providers
can be installed
Depend on ${VIRTUAL-RUNTIME_dbus} instead so the ptest package pulls
in whichever bus the distro actually uses.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Wang Mingyu
Devansh Patel
Dmitry Baryshkov
Nate Kent
Ricardo Salveti
Jaipaul Cheernam
Kiruthika Vijayasekar
Gianfranco Costamagna
Ankur Tyagi
krant
Khem Raj