mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-14 05:49:57 +00:00
Code Issues Projects Releases Wiki Activity
30,931 Commits 64 Branches 0 Tags
b79eee49dfb985bb0d58b243aabc4bc5efd56a4a
Commit Graph

93 Commits

Author SHA1 Message Date
Gyorgy Sarvari 67d0242d70 gimp: add additional patch for CVE-2026-0797 
There is an additional patch for CVE-2026-0797, which is not mentioned
in the CVE advisory, nor in the related issue nor in the related PR, however
both the change, and the commit message shows that this is a continuation
of the original fix, which was incomplete.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:52:05 +05:30
Gyorgy Sarvari 1a6816e20f gimp: patch CVE-2026-2048 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2048

Pick the patch from the relevant upstream issue[1];

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15554

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:52:00 +05:30
Gyorgy Sarvari fb8e5b9659 gimp: ignore CVE-2026-2047 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2047

The vulnerability exists in ICNS importer, which was first introduced in
version 3.0 [1], and the code is not present in the recipe version.

Due to this, ignore this CVE.

[1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/00232e17875d4676a2c797a429db23b1a9815db8

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:51:51 +05:30
Gyorgy Sarvari 210ce6945c gimp: patch CVE-2026-2045 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2045

Pick the patch associated with the relevant upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15293

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:06 +05:30
Gyorgy Sarvari 276a3b7195 gimp: patch CVE-2026-2044 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2044

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:05 +05:30
Gyorgy Sarvari 74f6a2e5ac gimp: patch CVE-2026-0797 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0797

The patch referenced in the NVD report looks incorrect.
This change in this patch was taken from the related upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15555

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:05 +05:30
Gyorgy Sarvari 3dd2d0dc98 gimp: patch CVE-2025-2761 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2761

Pick the patch from the relevant upstream bug[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/13073

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:04 +05:30
Gyorgy Sarvari 50d7ec475b gimp: patch CVE-2025-2760 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2760

Use the fixes from Debian.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:04 +05:30
Gyorgy Sarvari 42d1f2f681 gimp: patch CVE-2025-15059 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:03 +05:30
Gyorgy Sarvari 077dad4b6d gimp: ignore CVE-2025-14424 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14424

The vulnerbaility was introduced in version 3.0.0, with commit[1].
The recipe version isn't vulnerable - ignore this CVE.

[1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/a0fc5a025ae3579609730ebabc3c84146385da76

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-03-24 08:47:03 +05:30
Gyorgy Sarvari a33dae10b1 gimp: ignore CVE-2025-14423 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14423

The vulnerability is about parsing LBM files, however this feature
was introduced in verison 3.0[1], and the current recipe version
is not vulnerable.

[1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/222bef78c71ed8562a610f6863d56c0b3e2bef68

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-02-09 09:35:54 +05:30
Ankur Tyagi 7d35bbae28 gimp: patch CVE-2025-5473 
Detail: https://nvd.nist.gov/vuln/detail/CVE-2025-5473

Backport commit associated with the resolution of issue[1].

[1] https://gitlab.gnome.org/GNOME/gimp/-/issues/13910

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:15 +05:30
Ankur Tyagi f11e20ad6e gimp: ignore CVE-2025-48796 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-48796

The vulnerable function ani_load_image() was added[1] after the current
version of GIMP[2], we can ignore the CVE.

[1] https://gitlab.gnome.org/GNOME/gimp/-/commit/aa51b9e19ece8a8c54a513fe33b6d65abcb0fbfb
[2] https://gitlab.gnome.org/GNOME/gimp/-/commits/GIMP_2_10_38/plug-ins/file-ico/ico-load.c?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:14 +05:30
Ankur Tyagi 69cb161b5d gimp: patch CVE-2025-14425 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14425

Patch referenced by the nvd report is for the file "file-jp2.c" which was
renamed from "file-jp2-load.c" by commit[1] in the later versions.
[1] https://gitlab.gnome.org/GNOME/gimp/-/commit/19c57a9765ac3451c9cde94ccb06bec5ae06fbd8

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:14 +05:30
Ankur Tyagi a7ef3041ba gimp: patch CVE-2025-14422 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14422

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:14 +05:30
Peter Marko 7dfdfc0035 gimp: ignore CVE-2007-3741 
NVD still tracks this CVE as version-less, so explicit ignore is needed.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:13 +05:30
Ankur Tyagi 97c3c5ee0b gimp: upgrade 2.10.36 -> 2.10.38 
Feature backport for Windows otherwise it is mostly a bug-fix release
https://gitlab.gnome.org/GNOME/gimp/-/blob/GIMP_2_10_38/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:10 +05:30
Wang Mingyu 9f5a74cbe4 gegl: upgrade 0.4.46 -> 0.4.48 
Changelog:
-GeglColor extended with GBytes API, and space aware accesors for RGB
 and CMYK. Better runtime handling of mismatched GEGL ops in graphs.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2024-02-19 23:22:19 -08:00
Wang Mingyu 403b0f9a30 babl: upgrade 0.1.106 -> 0.1.108 
Changelog:
 "double" and "half" support in cli-tool, build fixes.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2024-02-19 23:22:19 -08:00
Khem Raj 347053753a gimp: Update to 2.10.36 
Explicitly ask for autotools build system since gnomebase is now
defaulting to meson.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-11-13 22:49:13 -08:00
Markus Volk 84f8813858 drop GNOMEBASEBUILDCLASS = "meson" 
It is set to meson by default

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-11-11 09:26:41 -08:00
Markus Volk 1ad7a9e2ce Adjust vala build according to changes in vala.bbclass 
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-11-11 09:26:41 -08:00
Wang Mingyu 9c57cb9ff5 gegl: upgrade 0.4.44 -> 0.4.46 
Changelog:
=============
New simpler API for connecting pads, gegl_node_connect which can be used instead
of either gegl_node_connect_from or gegl_node_connect_to by autosensing the
neccesary direction of the connection.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-07-07 08:59:27 -07:00
Khem Raj d3bfe80601 gimp: Fix buildpaths in binaries and scripts 
Fixes

WARNING: gimp-2.10.34-r0 do_package_qa: QA Issue: File /usr/libexec/gimp-debug-tool-2.0 in package gimp contains reference to TMPDIR
File /usr/bin/gimp-console-2.10 in package gimp contains reference to TMPDIR
File /usr/bin/gimptool-2.0 in package gimp contains reference to TMPDIR
File /usr/bin/gimp-2.10 in package gimp contains reference to TMPDIR [buildpaths]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-05-25 08:56:32 -07:00
Wang Mingyu 817421dc50 babl: upgrade 0.1.104 -> 0.1.106 
Changelog:
=========
Disable LUTs on big-endian, fix to 1bpp->4bpp LUTs, faster startup by caching
balanced RGB to XYZ matrices.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-05-08 21:37:55 -07:00
Wang Mingyu 86f9021787 babl: upgrade 0.1.102 -> 0.1.104 
Changelog:
 LUT code-paths re-enabled, some array overflow proofing.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-04-23 21:55:51 -07:00
Khem Raj 3e4121b6e7 babl: Package /usr/lib/babl-0.1/ directory 
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-04-05 23:54:56 -07:00
Khem Raj a80e993aec babl: Drop clang10 workaround for mips/rv64 
The issue reported in [1] works fine with clang 15+

This effectively reverts b12e87f84c
and ff19c7c569

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-04-05 23:54:56 -07:00
Wang Mingyu 6dd05f5463 gegl: upgrade 0.4.42 -> 0.4.44 
Changelog:
==========
This release fixes a crashing bug what is umasked by GLib 2.75.3 and
newer. Never-allocated data were being passed to g_slice_free, in
GeglBuffer's handling of copy-on-write tiles.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-04-04 13:39:46 -07:00
Wang Mingyu 27995af89d gegl: upgrade 0.4.40 -> 0.4.42 
Changelog:
==========
 - raw-load: add conditional support for 0.21.0 API
 - rgb-clib: improved ui-ranges
 - perlin, mosiac, c2g, long-shadow: small cleanups
 - gif-load: update vendored dependency, including code updates.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-03-28 10:44:00 -07:00
Khem Raj eccfc8bd2f gimp: Update to 2.10.34 
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-03-28 10:44:00 -07:00
Wang Mingyu b1d0c7e03e babl: upgrade 0.1.98 -> 0.1.102 
Changelog:
==========
Brown paper bag release - LUT code-paths now disabled by default.
Stop double processing with LUT+normal fishes.
Support for non-ASCII characters in file paths on windows. Improved wrap build
support.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-03-28 10:44:00 -07:00
Khem Raj 722f52981a gegl: Remove openmp dep for rv32 and ppc32 
openmp is not yet ported for these architectures

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-03-04 10:41:27 -08:00
Khem Raj 195caefc65 gegl: Depend on openmp when using clang 
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2023-02-01 09:28:47 -08:00
Wang Mingyu 295895bad7 gegl: upgrade 0.4.38 -> 0.4.40 
Changelog:
==========
Operations:
-----------
*newsprint: do not drop alpha channel in RGB modes.

Core
----------
*fixes for legacy build, still supporting building latest GEGL for
 stable GIMP with old babl (not recommended if distros can have
 recent enough meson.).
*avoiding possible multi thread race in babl garbage collection

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-11-19 08:11:45 -08:00
Wang Mingyu 48d7000fd9 babl: upgrade 0.1.96 -> 0.1.98 
Changelog:
More robust bounds protection in ICC handling, avoid garbage collecting lookup
tables in-line with processing.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-11-19 08:11:45 -08:00
Wang Mingyu eb60f28410 babl: upgrade 0.1.94 -> 0.1.96 
0001-meson-Do-not-run-git-rev-parse-during-configure.patch
removed since it's not available in 0.1.96

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-08-29 08:44:19 -07:00
Wang Mingyu 607c9e8f3b babl: upgrade 0.1.92 -> 0.1.94 
0001-meson-fix-misspelled-kwarg-name.patch
0002-meson-Various-fixes.patch
removed since they're included in 0.1.94

Changelog:
==========
Fix of crash on non-aligned data for SIMD, add commandline tool, improve vala
compatibility of introspection info.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-08-23 10:04:07 -07:00
wangmy b175959e94 gegl: upgrade 0.4.36 -> 0.4.38 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-07-19 06:44:18 -07:00
Andrew Davis 40a55b3215 libsdl: The libsdl and libsdl2 are not virtual 
There is only one provider, these should not be virtual.

Signed-off-by: Andrew Davis <afd@ti.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-07-08 22:43:03 -04:00
Markus Volk abdb05b6b4 unblock some recipes for wayland 
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-06-01 08:43:01 -07:00
Khem Raj c7cd5c2943 babl: Fix build with meson 0.62+ 
backport needed patches to get it going with newer meson

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-04-28 07:42:27 -07:00
Khem Raj f4e628c81e gimp: Disable vector icons on 32bit systems 
This uses qemu during build and qemu-user segfaults on all 32bit
architectures, until that is fixed disable building vector icons on
32bit architectures

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-04-19 08:58:54 -07:00
Wang Mingyu f6d537bd9c babl: upgrade 0.1.90 -> 0.1.92 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-03-29 08:28:38 -07:00
Khem Raj 69c8c91ecc gimp: Disable vector icons on ppc 
qemuppc segfaults building them

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-03-14 09:16:05 -07:00
Khem Raj 06851c6fdc recipes: Update LICENSE variable to use SPDX license identifiers 
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-03-04 17:41:45 -08:00
Wang Mingyu 8abc3bd017 gegl: upgrade 0.4.34 -> 0.4.36 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-03-01 09:13:42 -08:00
Wang Mingyu ec796f9da0 babl: upgrade 0.1.88 -> 0.1.90 
Automatic LUT creation for conversions from &lt;24bpp of colorant componants,
SIMD builds for x86_64 micro-architecture levels and ARM neon, pre-defined
CIE Lab u8 and CIE Lab u16 formats. Fix bug of an unlocked non-locked mutex,
which started failing on some platforms.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-03-01 09:13:42 -08:00
Khem Raj 712e17f840 gimp: Disable vector icons with clang on arm 
Avoid qemu coredumps

make[3]: *** [Makefile:2397: 24/gimp-center.svg] Segmentation fault (core dumped)
make[3]: *** [Makefile:2397: 24/gimp-channel.svg] Segmentation fault (core dumped)
make[3]: *** [Makefile:2397: 24/gimp-channel-blue.svg] Segmentation fault (core dumped)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-02-11 10:39:14 -08:00
Khem Raj ce1c406d63 gimp: Disable vector icons on x86 with clang 
It workarounds qemu crashes seen when building with clang

e.g.
| make[3]: *** [Makefile:2397: 24/gimp-controller.svg] Segmentation fault
| make[3]: *** Waiting for unfinished jobs....
| make[3]: *** [Makefile:2397: 24/gimp-color-space-perceptual.svg] Segmentation fault
| make[3]: *** [Makefile:2397: 24/gimp-controller-keyboard.svg] Segmentation fault
| make[3]: *** [Makefile:2397: 24/gimp-colormap.svg] Segmentation fault

Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2022-02-08 08:59:08 -08:00