mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-12 15:31:03 +00:00
Hetvi Thakar
2f89f21927
Backport the seed-wheel digest check [1], as identified by advisory [5]. Include prerequisite [2] so the expected digests are obtained over verified HTTPS, and follow-up [3] so missing digests cannot silently disable verification. Include follow-up [4] to verify wheels in private staging before caching them and to use the same verification for the pip seeder. This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6] and [7]. Apply the TLS prerequisite before the three wheel fixes. Add python3-packaging for the upstream wheel-name and version checks. Keep virtualenv at version 21.2.1 without unrelated feature changes. [1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d [2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940 [3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946 [4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 [5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45 [6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3 [7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Collection of layers for the OE-core universe
Main layer maintainer: Anuj Mittal anuj.mittal@oss.qualcomm.com
This repository is a collection of layers to supplement OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories