523 Commits

Author SHA1 Message Date
Scott Murray 07439815e7 ncrack: Update
Bump to HEAD of ncrack's master branch to pick up build fixes for
newer gcc's.  PV has been updated to indicate that we are now
building something newer than the 0.7 tagged commit.

License-Update: copyright years refreshed

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-27 21:47:27 +03:00
Scott Murray ffdbb6dffd libmhash: Remove
Remove libmhash, as it is no longer required to build aide.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-27 21:47:27 +03:00
Scott Murray d0386f2844 libmspack: Remove
Remove libmspack recipe, and remove it from clamav's DEPENDS.
clamav now vendors its own substantially modified copy, so there's
no reason to carry a recipe for it.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-27 21:47:27 +03:00
Scott Murray 8e4092ad8d opendnssec: Upgrade to 2.1.14
Upgrade to 2.1.14 and add some patches from the github PR queue to
fix compilation.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-27 21:47:27 +03:00
Scott Murray 1792ae2762 aircrack-ng: Upgrade to 1.7
Upgrade to the latest release, 1.7, and rework recipe so that it
actually builds again.  Note that the extra scripts are no longer
installed by default as they seem somewhat stale and likely further
work is required to have any of them work.  A PACKAGECONFIG option,
"ext-scripts" has been added to enable installing them if they are
required for some reason.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-27 21:47:27 +03:00
Wenlin Kang 731c5fc0b8 krill: fix missing dollar sign in FILES
{sysconfdir} -> ${sysconfdir}

Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-25 00:48:55 +03:00
Haiqing Bai bd6927e1df isic: fix RDEPNEDS typo
Fix typo: RDEPNEDS -> RDEPENDS

Signed-off-by: Haiqing Bai <haiqing.bai@windriver.com>
(fixed RDEPENDS:${PN})
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-15 00:18:23 +03:00
Zhang Peng c3ddb212cf meta-security: fix incorrect HOMEPAGE variable names
Several recipes used non-standard variable names for the homepage
URL (HOME_PAGE, HOME_URL, HOMEDIR) which are not recognized by
bitbake. Rename them all to the correct HOMEPAGE variable.

Affected recipes:
- glome: HOME_PAGE -> HOMEPAGE
- google-authenticator-libpam: HOME_PAGE -> HOMEPAGE
- arpwatch: HOME_PAGE -> HOMEPAGE
- openscap: HOME_URL -> HOMEPAGE
- scap-security-guide: HOME_URL -> HOMEPAGE
- lynis: HOMEDIR -> HOMEPAGE

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-04-15 00:18:23 +03:00
Peter Kjellerstedt f79853e907 fscryptctl: Correct the spelling of DESCRIPTION
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-03-04 12:13:03 +02:00
Peter Kjellerstedt e47afa9ea4 fscryptctl: Use ${prefix} rather than /usr
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-03-04 12:12:59 +02:00
Peter Kjellerstedt 5d6f6b3a04 fscrypt: Correct the spelling of DESCRIPTION
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2026-03-04 12:12:54 +02:00
Yi Zhao 2ac6e7ccac libmhash: add UPSTREAM_CHECK_URI
Add UPSTREAM_CHECK_URI to check the correct latest stable verison.

Before the patch:
$ devtool latest-version libmash
INFO: Current version: 0.9.9.9
INFO: Latest version:

After the patch:
$ devtool latest-version libmash
INFO: Current version: 0.9.9.9
INFO: Latest version: 0.9.9.9

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2025-12-22 06:35:47 +02:00
Yi Zhao a54650c743 libgssglue: add UPSTREAM_CHECK_GITTAGREGEX
Add UPSTREAM_CHECK_GITTAGREGEX to check the correct latest stable
verison.

Before the patch:
$ devtool latest-version libgssglue
INFO: Current version: 0.9
INFO: Latest version: 011
INFO: Latest version's commit: af30789052a8cc5f86b5b0c8fd4758c7ba1505ff

After the patch:
$ devtool latest-version libgssglue
INFO: Current version: 0.9
INFO: Latest version: 0.9
INFO: Latest version's commit: ada76bdaec665f70505f0b3aefe871b873e7c4b6

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-11-21 09:13:47 -05:00
Yi Zhao 3b67d414b3 libgssglue: update HOMEPAGE
The original homepage is outdated.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-11-21 09:09:53 -05:00
hongxu b639be32ad ecryptfs-utils: Add CVE tag for ecryptfs-utils-CVE-2016-6224.patch
Follow Yocto policy to add CVE tag to CVE patch

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2025-11-12 14:17:55 -05:00
Scott Murray fa4057267c paxctl: Remove recipe
Remove the paxctl recipe since it has seemingly been broken for a
while without anyone noticing, and there likely have been no actual
users since grsecurity stopped doing public releases in 2017.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-10-08 17:34:14 +02:00
Scott Murray 3c11317212 libest: Remove recipe
Remove the libest recipe since it has been disabled since November
2021, and upstream has shown no activity since 2022.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-10-08 17:34:14 +02:00
Yi Zhao a126f7dd59 libmhash: fix build with gcc 15
GCC 15 switched to C23 by default, which libmhash does not yet support.
So keep using C17.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2025-10-08 17:34:14 +02:00
Marta Rybczynska 65fd11a293 chipsec: disable until 6.16 support is fixed
The 1.13.16 version does not work on the kernel 6.16 for now [1].

Disable when waiting for the fix.

[1] https://github.com/chipsec/chipsec/issues/2563

Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
2025-10-08 17:34:14 +02:00
Marta Rybczynska ff601bbb19 chipsec: update to 1.13.16
Update from 1.9.1 (October 2022) to the latest 1.x release, 1.13.16.

Changelog: https://github.com/chipsec/chipsec/releases

Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
2025-10-08 17:34:14 +02:00
Scott Murray abddea907b sshguard: Update to 2.5.1
This picks up required gcc 15 fixes.

Changelog: https://bitbucket.org/sshguard/sshguard/src/master/CHANGELOG.rst

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:41:20 -04:00
Scott Murray 0272225ccd Adapt to S/UNPACKDIR changes
Remove or update S definitions as required to work with oe-core
S/UNPACKDIR changes.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:41:20 -04:00
J. S. 4e2b318a86 Fix warning : lack of whitespace around assignment
v2 : also fix some typos while we are here.
v3 : add fixes for isic and checksecurity

Signed-off-by: Jason Schonberg <schonm@gmail.com>
[removed already applied change]
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:40:38 -04:00
Yi Zhao b7b2d12c4f libgssglue: add ptest
Ptest result:
ptest-runner libgssglue
START: ptest-runner
2025-03-27T13:15
BEGIN: /usr/lib64/libgssglue/ptest
PASS: gss_create_empty_oid_set
PASS: gss_test_oid_set_member
PASS: gss_test_oid_set_member n==0
PASS: gss_add_oid_set_member() OK
PASS: gss_test_oid_set_member() OK
    OID present in set with the OID added to it => 1
PASS: gss_test_oid_set_member() OK
PASS: gss_test_oid_set_member() OK
    Another OID present in set without the OID => 0
PASS: gss_test_oid_set_member() OK
PASS: gss_add_oid_set_member() OK
PASS: gss_test_oid_set_member() OK
    Another OID present in set with it added => 1
PASS: gss_test_oid_set_member() OK
PASS: gss_test_oid_set_member() OK
    First OID present in set => 1
PASS: gss_test_oid_set_member() OK
PASS: gss_release_oid_set() OK
PASS: gss_indicate_mechs() OK
PASS: gss_release_oid_set() OK
PASS: gss_import_name() OK
PASS: gss_display_name() OK
    display_name() => 27: imap@server.example.org@FOO
PASS: gss_release_buffer() OK
PASS: gss_release_name() OK
Basic self tests done with 0 errors
DURATION: 0
END: /usr/lib64/libgssglue/ptest
2025-03-27T13:15
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-04-13 14:07:57 -04:00
Yi Zhao 2c9feba810 libgssglue: upgrade 0.8 -> 0.9
* Drop useless patch libgssglue-canon-name.patch

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-04-13 14:07:57 -04:00
Mikko Rapeli 69b8567e97 ecryptfs-utils: depend on ecryptfs kernel module
ecryptfs-utils userspace daemon fails to start if kernel
module is not available on target.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-12-27 11:28:23 -05:00
Chen Qi baaafdf08b libgssglue: switch to use git source
The 0.8 orig.tar.gz is not in debian mirror any more. In fact, we
really should avoid using orig.tar.gz like this because distros
like debian will just delete those that they don't maintain any more.

Switch to use git source.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-09-09 19:33:20 -04:00
Armin Kuster db91051c6a chipsec: Fix QA Warnings
ERROR: chipsec-1.9.1-r0 do_package_qa: QA Issue: File /usr/lib/python3.12/site-packages/chipsec/helper/linux/chipsec.ko in package chipsec contains reference to TMPDIR [buildpaths]
ERROR: chipsec-1.9.1-r0 do_package_qa: QA Issue: File /usr/lib/python3.12/site-packages/chipsec/helper/linux/.debug/chipsec.ko in package chipsec-dbg contains reference to TMPDIR [buildpaths]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Armin Kuster 2e21e54812 isic: Fix config error
configure: error: installation or configuration problem: C compiler cannot create executables.
| NOTE: The following config.log files may provide further information.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Armin Kuster 2aa07876ba krill: Fix QA warnings
ERROR: krill-0.12.3-r0 do_package_qa: QA Issue: File /usr/bin/.debug/krill in package krill-dbg contains reference to TMPDIR
File /usr/bin/.debug/krillc in package krill-dbg contains reference to TMPDIR
File /usr/bin/.debug/krillup in package krill-dbg contains reference to TMPDIR [buildpaths]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Armin Kuster ca10975033 recipes-*: convert WORKDIR->UNPACKDIR
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Changqing Li ceb47a8a39 recipes: WORKDIR -> UNPACKDIR transition
* WORKDIR -> UNPACKDIR transition
* Switch away from S = WORKDIR

Signed-off-by: Changqing Li <changqing.li@windriver.com>
[Fixed up the smack changes due to prior patch]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-06-17 08:25:25 -04:00
Jeremy A. Puhlman f4ef325fc3 Check for usrmerge before removing /usr/lib
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-27 12:36:58 -04:00
Armin Kuster 6cf4d653dc libgssglue: update to 0.8
LICENSE changed
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-29 09:09:30 -05:00
Lei Maohui 830817cc14 paxctl: Fix do_package QA Issue.
After usrmerge had been enabled, paxctl has the fowllowing error:
ERROR: paxctl-0.9-r0 do_package: QA Issue: paxctl: Files/directories were installed but not shipped in any package:
  /sbin/paxctl

Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-08 12:06:31 -04:00
Armin Kuster 02f285b276 sshguard: Update to 2.4.3
Changelog: https://bitbucket.org/sshguard/sshguard/src/master/CHANGELOG.rst

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-06 11:31:18 -04:00
Luke Granger-Brown 21bb5627e0 glome: update to tip
Markus Rudy (17):
      Use Github TeX Markdown instead of image includes.
      Merge pull request #134 from burgerdev/md-tex
      Merge pull request #135 from vvidic/cli-base64
      RFD 002: public key format at rest (#109)
      Merge pull request #137 from vvidic/hmac
      Merge pull request #138 from vvidic/hmac2
      Update list of supported Python versions
      Install golint instead of 'get'ting it.
      Merge pull request #139 from burgerdev/actions
      Clarify format of public key at rest
      Test all supported config file keys
      Merge pull request #144 from burgerdev/public-key-format
      Fix linter findings for #144
      Use 'release' buildtype for NixOS builds
      Merge pull request #149 from google/l9i/bye-java
      RFD 001: GLOME Login v2 (#102)
      login/v2 implementation for Go (#162)

Philipp Kern (21):
      Merge pull request #133 from google/l9i/pam-fix
      Merge pull request #132 from google/l9i/nix-shell
      Merge pull request #140 from vvidic/defaul-typo
      Merge pull request #142 from vvidic/soversion
      Merge pull request #146 from burgerdev/lint
      Merge pull request #148 from google/dependabot/go_modules/go/golang.org/x/crypto-0.1.0
      Merge pull request #152 from google/l9i/cpplint
      Merge pull request #154 from vvidic/docker-public-key
      Merge pull request #155 from vvidic/prompt-fix
      Insert a slash after url-prefix when writing it into prompt
      Merge pull request #156 from google/url-prefix-compat
      Merge pull request #157 from vvidic/config-order
      State that devices require randomness for the protocol to work
      Update docs/protocol.md
      Merge pull request #158 from google/pkern-patch-1
      Fix error to state "at most" instead of "at least"
      Merge pull request #153 from vvidic/min-tag-length
      Merge pull request #159 from vvidic/host-id-type
      README.md: Codeblock fixups
      Merge branch 'master' into l9i/README
      Merge pull request #141 from google/l9i/README

Piotr Lewandowski (12):
      Fix failing PAM test
      Treat warning as errors
      Define OPENSSL_API_COMPAT to require OpenSSL >=1.1
      Use werror only for CI
      Add nix-shell config for setting up dev environment
      Add GitHub Action workflow for shell.nix
      Add intro and installation steps to README.md
      Address reviewer's comments
      Wrap lines
      Delete Java implementation
      Rename `url-prefix` to `prompt` (#131)
      Add `cpplint` linter

Valentin Vidic (10):
      Update CLI to use base64 instead of hex tags.
      Replace deprecated OpenSSL HMAC API with EVP.
      Replace OpenSSL EVP_DigestSign API with HMAC()
      Fix typo: defaul => default
      Use project version in library version
      Update Docker scripts for new public key format
      Fix setting of prompt parameter
      Parse command line again after reading the config
      Add config option for minimum authcode length #122
      Add config option for host-id type #122

dependabot[bot] (1):
      Bump golang.org/x/crypto in /go

Signed-off-by: Luke Granger-Brown <lukegb@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-06 11:31:18 -04:00
Armin Kuster 1dd076d3a7 firejail: only allow x86-64 and arm64 to build
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-31 06:18:52 -04:00
Martin Jansa df8a1eb479 *.patch: fix malformed Upstream-Status and SOB lines
* as reported by openembedded-core/scripts/contrib/patchreview.py -v .

Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/crosscompile_perl_bindings.patch)
Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/disable_perl_h_check.patch)

Missing Upstream-Status tag (./recipes-compliance/scap-security-guide/files/0001-standard.profile-expand-checks.patch)

Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-pid-path.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/suricata/files/fixup.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-scanners/clamav/files/fix2_libcurl_check.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/isic/files/configure_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/krill/files/panic_workaround.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libdns_conf_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libxml2_conf.patch

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 2eb05e11c0 isic: fine tune Upstream-Status
These are changes I did so apply the appropriate label.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Martin Jansa ea97a23986 *.patch: add Upstream-Status to all patches
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a

This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).

This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.

This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:

0 (0%)  	meta-parsec
N/A (0%)        meta-hardening
1 (100%)        meta-integrity
15 (68%)        meta-tpm
27 (61%)        meta-security

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Adrian Zaharia 10a2c9505c libmhash: fix multilib header conflict - mutils/mhash_config.h
Header file conflict between 32-bit and 64-bit versions

Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06 07:54:09 -04:00
Armin Kuster ae23806825 fscryptctl: update to 1.0.1
Don't build man as it needs pandoc

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06 07:54:09 -04:00
Armin Kuster 415424a706 krill: forced to inclued fetch hashes.
Now manditory via Poky commit: https://git.yoctoproject.org/poky/commit/bitbake/lib/bb/fetch2?id=4d9886e1435dba3785973cc920865f8ab67e644d

used cargo-update-recipe-crates to fixup

Drop krill.inc in favor of new crate file name

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-08 10:49:38 -04:00
Armin Kuster 6f7c5fe13f cryptmout: update to 6.2.0
Change LIC_FILES_CHKSUM to use COPYING

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster 883d5e4dd9 krill: update 0.12.3
refresh patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster 90feb1888d firejail: update 0.9.72
refresh patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster d440752461 libmspack: update to 1.11
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster 206260ffd0 fscrypt: update to 1.1.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:15 -04:00
Markus Volk d623fc232b bubblewrap: remove recipe
It was moved to meta-oe.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:46:25 -05:00