64-bit time was turned off for all of libcamera because v4l2-compat.
libcamera fixed this upstream in v0.3.0 by also
undefining _TIME_BITS for v4l2-compat (commit 705601 "v4l2:
Unset _TIME_BITS in addition to _FILE_OFFSET_BITS"), so the
workaround is no longer needed.
v4l2-compat.so still uses 32-bit APIs on purpose, so keep the
32bit-time QA skip for it.
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both ptests get killed by the OOM killer with the default 1G:
Out of memory: Killed process 390 (python3) total-vm:946408kB, anon-rss:909840kB
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
arrow/parser.py imports zoneinfo, falling back to backports.zoneinfo
which is not available either, so importing arrow fails on target:
ModuleNotFoundError: No module named 'zoneinfo'
Seen in python3-construct ptests.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update tiobench from the legacy 0.3.3 SourceForge release to the
actively maintained upstream at github.com/mkuoppal/tiobench, pinned
to 11c965c8 (35 commits past v0.4.2). Picks up Clang build support,
random I/O test enhancements and cache handling updates.
Remove obsolete downstream patches, now fixed upstream:
avoid-glibc-clashes.patch - helper renamed to tt_aligned_alloc
0001-Specify-printf-formats.patch - format specifiers fixed
0001-Drop-inline-of-crc32-*.patch - crc32 inlining fixed
tiobench-makefile.patch - CC?= and LDFLAGS now upstream
Pass CFLAGS via EXTRA_OEMAKE. The upstream Makefile hardcodes
CFLAGS=-O2 -Wall and oe_runmake does not pass -e, so OE flags never
reached the compiler, losing -g (empty -dbg package), the hardening
flags, -ffile-prefix-map and the tune flags. DEFINES is separate, so
-DUSE_LARGEFILES is unaffected.
Install from do_install() rather than the upstream install target,
which has no DESTDIR support and installs tiosum.pl and README, both
long gone from the tree. COPYING is dropped from docdir as licenses
are handled by the license manifest.
Trim RDEPENDS to perl and perl-module-getopt-long; tiobench.pl only
uses warnings, strict and Getopt::Long, and strict is RPROVIDED by
perl. Data::Dumper and Term::ProgressBar are only reachable via the
opt-in --dump and --progress flags. Drop the redundant PV, already
set by the recipe filename.
Runtime validated on IQ-9075 EVK with tiotest and tiobench.pl across
multiple benchmark configurations, including tiobench.pl --help on an
image carrying only the trimmed RDEPENDS.
Build tested with gcc against glibc on aarch64 (armv8-2a).
Signed-off-by: Vaibhav Jindal <vaibjind@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.23.95:
- fix: undefined behavior (UBSan) warnings in QR decoder and
scanner
- ci: address some issues for artifact generation
From 0.23.94:
- zbar now uses meson;
- ci was improved to allow unit tests on MacOS and Windows;
- Windows artifact now generate statically linked files;
- documentation updates.
- other minor changes to cleanup it a little bit after meson
migration.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
If polkit is enabled as distro feature, it makes sense to recommend the
polkit-group-rule-network package for the networkmanager-daemon package to
allow members of the network group to modify NetworkManager settings.
Signed-off-by: Weisser, Pascal <pascal.weisser.ext@karlstorz.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
kmscon builds with -std=gnu99 -Werror, and clang rejects the
declaration directly after the default: label in font_psf.c as a C23
extension. Give that case its own block scope.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The plugin imports modules from the datetime, json, misc, netclient,
numbers, profile and statistics python3 packages, so ptests of recipes
using it fail on images that don't pull those in otherwise.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
parse 1.22.2 made {:f} also accept nan/inf, which changed the generated
regex. Update the copied parse test expectation to match.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The live resolver tests use the system resolver configuration. When the
network is configured by the kernel ip= parameter and nothing in userspace
writes /etc/resolv.conf, the nameserver is only available in /proc/net/pnp
and the tests fail with "no nameservers". Seed resolv.conf from it when
it has no nameserver entry.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The final rpcbind check chained 'which systemctl && systemctl status ||
service rpcbind status', so on sysvinit images without systemctl it fell
back to 'service', which may not exist, and the tests were skipped even
though rpcbind was running. Check the status with the same init system
that was used to start it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The GPU software ISP renders with GLES 2 through EGL and never uses
desktop GL, so depend on virtual/libgles2 instead of virtual/libgl.
Requiring virtual/libgl breaks machines whose GPU stack only provides
EGL and GLES, e.g. StarFive JH7110 with the PowerVR mesa-pvr.
Also carry a patch so libcamera doesn't redefine EGL_NO_X11 when an
older Mesa's egl.pc already passes -DEGL_NO_X11, which fails the build
with -Werror.
Signed-off-by: Joel Winarske <joel.winarske@linux.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.104.1:
- WireGuard packet buffering uses less memory while waiting for
peer handshakes.
- WireGuard packet queue depth scales with CPU core count, reducing
peak memory usage under heavy traffic.
- Client-side netmap caching improves start up speed and
connectivity when the Tailscale control plane is unreachable.
- WireGuard allocates a single packet buffer for batched I/O,
improving throughput and reducing memory usage.
- An issue that could prevent traffic over IPv6 link-local
addresses from flowing through direct and Tailscale Peer Relay
connections is resolved.
- An issue preventing Linux desktop detection from working on
Wayland environments is resolved.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
dumpcap is a lightweight capture tool which carries no dependencies on
wireshark. Break it into its own package, with an RDEPENDS back to
wireshark.
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.991:
- Upgraded included OpenSSL t- version 3.0.21 on all platforms.
- Fixed a memory-consumption hang in Ncat's HTTP proxy code that
affected both connect and listen modes, reported by kumama_nui.
- Patched our included libssh2 source with upstream fixes for
CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200,
CVE-2026-58050, and CVE-2026-58051. The version number has been
annotated as 1.11.1_NMAP1
- [Zenmap][GH#3347] Fixed several issues leading t- crashes when
parsing, editing, or saving command profiles containing '%'
characters.
- [NSE][GH#2272] smb-enum-shares failed t- produce output for valid
shares when an error was encountered on one share.
- [GH#3410] Fixed an issue where DNS resolution would incorrectly
fail t- match the same name in a different case.
- [NSE][GH#1066] Added service names for SSL-protected services
like amt-soap-https t- portrules for several scripts, ensuring
they run on these as well as the standard unencrypted services.
- Audited and converted most instances of strcat, strcpy, and
sprintf t- use bounded functions instead.
- [NSE][GH#2221] mysql-dump-hashes now uses the correct column name
for MySQL 5.7+
- [NSE][GH#2238] http-referer-checker was incorrectly fetching
off-host URLs. Now only URLs on the target are fetched.
- [GH#2122] When an interface is specified with -e, als- bind t-
the IP address for that device s- that it works for non-Linux
systems and non-root users.
- [Nsock][GH#1939] When nsock_iod_set_localaddr() is used,
nsock_connect_*() will now treat errors in bind(2) as connection
failure.
- [GH#2732] Fix a potential crash on 32-bit platforms in debug mode
due to incorrect format specifier for 64-bit integer type.
[Christopher Chavez]
- [GH#3201][GH#3367] Increase line length limit for
nmap-service-probes and correctly handle lines that are to- long.
[@liquidpele, Ashutosh Kumar Singh]
- [GH#3414] Avoid out-of-bounds read when parsing PTR domain names.
[@toor11 (Juri)]
- [GH#2245] Ensure variables updated by signal handlers are
volatile sig_atomic_t.
- [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in
ncat -lk in some cases where stdin or a listening socket produces
an error.
- [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server
returned less data than needed for header" when smb.start_smb()
failed.
- Fixed an issue with parsing nmap-service-probes that could cause
a corrupted file t- crash Nmap. Reported by Muhammed Hussein.
- [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used
shut down.
- Fixed several issues reported by Himanshu Anand: infinite loop in
TCP options parsing and out-of-bounds memory read in IPv4 OS
detection; integer underflow in IPv6 extension header processing;
and undefined behavior in DNS label parsing.
- [GH#2721] Added checks for returned pointers from OpenSSL
allocation functions.
- [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long)
o.scan_delay" in traceroute which failed for timeouts greater
than 1 second when there was n- scan delay.
- [GH#3175] The --stats-every option can now be used in conjunction
with --noninteractive. Previously, n- stats messages were printed
if a TTY was not attached.
- [GH#3375] Nmap can now be built with OpenSSL 4.0
- [Nping][GH#1751] The --rate option will not accept a rate higher
than 1000 packets per second, since Nsock timers have millisecond
resolution. Use --delay 0 for unlimited rate.
- [Nping] Fixed several issues with Nping in IPv6 mode including:
+ [GH#1261] Incorrect BPF generated leading t- "expression
rejects all packets"
+ [GH#3215] Incorrect constant used t- check for IP version in
Ech- Server
- [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when
parsing a zero-length TCP header option. [Maxim Suhanov]
- Fixed an issue where Nmap OS scan trusts a packet's ip_len t-
size a CRC32 computation over TCP RST payload data, which may
result in reading arbitrary heap data. Reported by Michael
Bommarito.
- [Ncat][GH#3005] Correctly report listening port number. `ncat -l
-p 0` will cause Ncat t- listen on an ephemeral port, but it was
reporting itself as listening on port 0.
- [Ncat][GH#1672] Fixed an issue where Ncat in server mode would
quit without printing the last received data on a connection,
particularly affecting SCTP.
- [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode
would ignore disconnects and crash when it tries t- send data t-
a disconnected client.
- [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit
after 2 minutes due t- an OS-enforced timeout on the half-open
TCP socket used to emulate STDIN.
- [Nping][GH#564] Allow Nping t- fall back t- TCP Connect mode on
Windows when Npcap is not installed.
- [Ncat] Fixed several issues reported by Muhammed Hussein
involving crashes in Ncat's server-mode HTTP proxy, as well as
one code-quality issue with its Telnet negotiation code.
- [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code
would send additional null bytes on Windows and other platforms
where the compiler does not understand __attribute__((packed)).
[Daniel Miller]
- The --release-memory option is now a no-op. Nmap will always run
finalization routines that release allocated memory before
closing.
- Fixed an integer underflow in service_scan.cc that would cause
little-endian integers extracted from the beginning of a service
banner t- be interpreted as 0. Discovered with AFL++ by Malek
Althubiany.
- [Nsock][GH#583] Use OpenSSL security levels and callbacks t-
prevent errors connecting t- certain insecure targets when using
NSOCK_SSL_MAX_SPEED. The default, as used in Ncat, now uses
stricter-than-default security level.
- [GH#410] If a target times out due t- --host-timeout, d- not
perform traceroute.
- [Nping][GH#380] Disallow combining Ethernet-related options like
--dest-mac with --send-ip
- [NSE][GH#3250][GH#3206] Fix assertion failures in cases where
connect or send returns immediately with a status other than
ERROR, e.g. TIMEOUT or CANCELED. [Daniel Miller]
- [Ncat][GH#290] Enable ncat -l --ssl t- use DHE and ECDHE cipher
suites for perfect forward secrecy.
- Fix a crash when writing long CPE strings t- output. Reported by
Harshit Gupta. [Daniel Miller]
- [Ncat] Fix several cases where Ncat's SOCKS5 client could
interpret uninitialized data as protocol data, triggered by a
malicious SOCKS5 proxy server. N- code execution or application
crash is possible. Reported by Govind Pratap Singh. [Daniel
Miller]
- [Nping] Fix a out-of-bounds access in Nping Ech- client allowing
a malicious Nping EchoServer t- zer- 32 bytes of memory outside
the packet buffer. Reported by Harshit Gupta. [Daniel Miller]
- Fix a 1-byte overrun (read) while reading certain crafted DNS
labels, reported by Peter Parker. [Daniel Miller]
- [NSE][GH#3317] Function url.build_path was mangling special
characters in URL path segments. [nnposter]
Drop 0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch
because the check for PF_PACKET that failed with clang has been
fixed with commit 33c39cd38 in the upstream of nmap.
Set OEQA_BUILDPATHS_SKIP to ignore upstream HOME path match and
avoid buildpaths QA error.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- New –format string %{progress-conemu}, and option –conemu, to show
progress in the terminal title tab on terminals with ConEmu OSC 9;4
support
- Eliminate potential for closure of standard output under a combination of
error conditions when using –monitor mode
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ankur Tyagi
prasanth
Khem Raj
Peter Marko
shenlf
Vaibhav Jindal
Leon Anavi
Adam Duskett
Weisser, Pascal
Jason Schonberg
Joel Winarske
Alex Kiernan