The default product-only mapping generates vendor-wildcard CPEs for the
recipe's Simon Kelley source. dnsmasq:dnsmasq is an NVD configuration
identity and CNA affected-data identity; the_kelleys:dnsmasq is an NVD
configuration identity; and thekelleys:dnsmasq is an active NVD
dictionary CPE and configuration identity with CNA affected-data records.
This changes the generated product identities. With the frozen
sbom-cve-check database, the 48-entry CVE report is unchanged, so this is
an identity correction with no CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "python-ldap" mapping generates a vendor-wildcard product
identity for the packaged Python binding.
Use "python-ldap:python-ldap" so it matches the NVD dictionary CPE and
configuration identity. The generated product identity changes, but
sbom-cve-check 1.3.3 reports no CVE delta with the pinned databases.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
mariadb:mariadb is the active NVD dictionary CPE and configuration identity,
and is also used by CNA affected data for the packaged MariaDB source.
Deprecated mariadb_project records describe a separate Node.js connector.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 420-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "twisted" value emits a wildcard-vendor identity
instead of the active identity assigned to the packaged Twisted source.
Use "twisted:twisted" for its NVD dictionary CPE, NVD configuration,
and CNA affected-data identities. With sbom-cve-check 1.3.3 and the
pinned database snapshots, the generated product identity changes; the
current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
libssh:libssh is the active NVD dictionary CPE and configuration identity
for the packaged libssh source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 48-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Apply a patch fixing the following error:
thd_gddv.cpp: In member function 'int thd_gddv::evaluate_condition(condition&)':
thd_gddv.cpp:1721:39: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'time_t' {aka 'long long int'} [-Werror=format=]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
I am hoping to start contributing more to OpenEmbedded and this seems
like a very obvious place to start. I am on the NNG advisory board [1]
and actively working on NNG, while using Yocto for both my day job and
several hobby projects.
[1]: https://github.com/nanomsg/nng/discussions/1782
Signed-off-by: Nate Kent <nate@nkent.net>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
redis 8.10.0 added "deploy: PREFIX ?= /usr/local" to the top level
Makefile. Assigning PREFIX there, even for an unrelated target, clears
the export flag it inherited from the environment, so recipe shells no
longer see it. As the install target recurses with "$(MAKE) -C src
install" from a recipe shell, the sub-make falls back to src/Makefile's
"PREFIX?=/usr/local" and installs outside ${D}:
install: cannot create regular file '/usr/local/bin/redis-server': Permission denied
make[1]: *** [Makefile:576: install] Error 1
Releases up to 8.8.1 had no PREFIX assignment there, so the exported
value propagated. Pass PREFIX on the make command line instead, which
is propagated to sub-makes.
AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add the pw-voiceui tool, a CLI for controlling and monitoring the SVA
(Sound Trigger / Voice Activation) voice-UI PipeWire node exposed by
the pw-pal-plugin (media.role=VoiceUI). Supports list/info/listen,
setting SVA parameters, and sending commands.
Add 0003-tools-add-pw-voiceui-SVA-voice-UI-control-listen-cl.patch,
reference it from SRC_URI, and list pw-voiceui in FILES:${PN}-tools.
Signed-off-by: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pcm_ioctl() previously had a FIXME and always issued the ioctl
directly on pcm->fd, bypassing any loaded plugin (e.g. AGM's tinyalsa
plugin). Dispatch through pcm->ops->ioctl when a plugin is loaded,
falling back to the direct ioctl() otherwise.
Add 0002-pcm-fix-pcm_ioctl-to-dispatch-through-plugin-ops.patch and
reference it from SRC_URI.
Signed-off-by: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:ujson" mapping does not match the UltraJSON identities used by NVD and CVE List V5, so source-aligned CVEs are missed.
Use "ultrajson:ultrajson" for the CNA affected-data identity and "ultrajson_project:ultrajson" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "tweepy" value emits a wildcard-vendor identity and
hides the distinct NVD identities assigned to the packaged Tweepy source.
Use "josh_roesslein:tweepy" for its NVD dictionary CPE and
"tweepy:tweepy" for the NVD configuration-only identity. With
sbom-cve-check 1.3.3 and the pinned database snapshots, the generated
product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask-user" mapping emits the wildcard-vendor
*:flask-user CPE instead of the exact NVD identity for the packaged
lingthio/Flask-User source.
Use "flask-user_project:flask-user", which is both an NVD dictionary
CPE and an NVD configuration identity. CNA affected data uses
"n/a:Flask-User" and remains covered by scanner aliases. With
sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the generated
identity changes but CVE-2021-23401 remains reported as affected.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask" mapping emits the wildcard-vendor *:flask CPE
instead of the exact NVD identity for the packaged pallets/flask
source.
Use "palletsprojects:flask", which is both an NVD dictionary CPE and
an NVD configuration identity. CNA affected data uses "pallets:flask"
and "The Pallets Project:Flask", which remain covered by scanner
aliases. With sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the
generated identity changes but the current CVE report does not.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ankur Tyagi
Wang Mingyu
Devansh Patel
Dmitry Baryshkov
Nate Kent
Ricardo Salveti
Jaipaul Cheernam
Kiruthika Vijayasekar
Gianfranco Costamagna