Fixes the build against OpenSSL 4.0, which completes the opaquing of
struct asn1_string_st:
src/lib/ssl_util.c:201:9: error: incomplete definition of type
'ASN1_OCTET_STRING' (aka 'struct asn1_string_st')
Upstream switched both call sites in ssl_util.c to the
ASN1_STRING_get0_data()/ASN1_STRING_length() accessors, so the upgrade
is all that is needed, no local patch.
Drop 0001-src-lib-tpm-return-NULL-for-twist-on-auth-failure.patch, it is
already applied upstream in this release (PR #923) and now fails to
apply.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Release notes:
https://github.com/tpm2-software/tpm2-tools/blob/5.8/docs/CHANGELOG.md
Fixes GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66 and GHSA-qp88-8f4j-wv7q,
including a heap buffer overflow in tpm2_getekcertificate.
Also brings OpenSSL 4.0 compatible macros, so the tools build and link
cleanly against openssl 4.x (verified against 4.0.2 with no deprecation
warnings; tpm2 links libcrypto.so.4).
Add autoconf-archive-native to DEPENDS: the 5.8 release tarball no longer
bundles the autoconf-archive ax_*.m4 macros under m4/ the way 5.7 did, so
the autoreconf done by autotools.bbclass leaves AX_CHECK_COMPILE_FLAG,
AX_CHECK_LINK_FLAG, AX_CHECK_PREPROC_FLAG, AX_ADD_FORTIFY_SOURCE,
AX_CODE_COVERAGE and AX_IS_RELEASE undefined. m4 then strips a quoting
level off their unexpanded arguments and the bare AC_MSG_ERROR leaks into
configure, failing autoconf's m4_pattern_forbid check with:
configure.ac:40: error: undefined or overquoted macro: AC_MSG_ERROR
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
The installation task hash for the aide is marked as nostamp. This is
done because the native task installs files outside the sysroot, to the
Aide staging directory. Those files are not captured by
do_populate_sysroot, so they are missing whenever the task is skipped or
restored from sstate.
Install the required native contents to the sysroot, and then customise
and deploy the configuration file in the aide_init_db rootfs postprocess
function that utilizes the files. The configuration file needs to be
reset every time the function is run to avoid using stale
configurations.
Staging the native files through the sysroot makes the nostamp
unnecessary, so remove it along with the unstable task hash it caused.
Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
To quiet the missing metadata warnings, switch DESCRIPTION to SUMMARY
in the following recipes:
- security-tpm-image
- security-tpm2-image
- packagegroup-security-tpm
- openssl-tpm-engine
and add HOMEPAGE to these recipes:
- libtpms
- swtpm
- tpm-tools
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Correct the misspelled PACKAGECONFIG variable so efivar is enabled by
default as intended by commit cdb4e444ac.
Signed-off-by: Krupal Ka Patel <krkapate@cisco.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
The wic files were moved from wic/ to files/wic since commit 596b966a0d
("wic: wic need to be moved to files/wic within the layer to be
found/used").
This updates the path of wic files in the documentation.
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
The dependency might not be obvious to everyone, so leave a hint as in
commit 2fbeebc18c ("dm-verity: document the meta-intel dependency in the
systemd example").
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
This removes unused variable that was dropped by commit d80cd2ba6a
("dm-verity: Set the IMAGE_FSTYPES correctly when dm-verity is
enabled").
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Several meta-tpm recipes were missing HOMEPAGE and/or SUMMARY entries,
tripping the missing-metadata recipe QA check that is enabled for
core-layer recipes. The warnings surface whenever do_recipe_qa actually
runs (a fresh build with no sstate hit), e.g.:
WARNING: tpm2-tss-4.1.3-r0 do_recipe_qa: QA Issue: Recipe tpm2-tss in
.../tpm2-tss_4.1.3.bb does not contain a HOMEPAGE. Please add an entry.
[missing-metadata]
Add the upstream project URL as HOMEPAGE, and a SUMMARY where absent:
- tpm2-tss: add HOMEPAGE
- tpm2-tools: add HOMEPAGE
- tpm2-openssl: add HOMEPAGE
- tpm2-abrmd: add HOMEPAGE
- tpm2-pkcs11: add HOMEPAGE
- tpm2-tss-engine: add HOMEPAGE
- python3-tpm2-pytss: add SUMMARY
- packagegroup-security-tpm2: add SUMMARY
Signed-off-by: Shreejit C <shreejit.c@emerson.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Fix two issues preventing samhain-server (yule) from starting:
1. The compiled-in PID file path /var/run/samhain.pid fails because
/var/run is a symlink to /run on systemd-based systems, and
samhain's security check rejects symlinks for PID directories.
Add SetLockfilePath = /run/yule.pid to yulerc.template, following
the same approach used in 0004-Set-the-PID-Lock-path-for-samhain.pid
for the standalone/client configuration.
2. The init scripts unconditionally source /etc/default/rcS which does
not exist on systemd-based systems, producing a confusing error
message. Source it conditionally instead.
Signed-off-by: Bin Cao <bin.cao.cn@windriver.com>
(adapted against prior 4.5.3 upgrade)
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
- Fix conditional checks for AIDE_SCAN_POSTINIT and AIDE_RESCAN_POSTINIT:
'[ 0 ]' always evaluates to true since it's a non-empty string.
Use string comparison '= "1"' instead.
- Fix invalid use of '&&' inside '[ ]' test brackets. Use separate
test expressions joined by shell '&&'.
Signed-off-by: Haitao Liu <haitao.liu@windriver.com>
(reworked for 0.19.3, fixed indentation)
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Previous commit made this a hard dependency because it's autodetected.
Instead of that, make it configurable so it can be disabled (roughtly
equivalent to behavior before that commit).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
meta-arm recently changed the group name that is used by TS[1], so update
the group name to match.
[1] meta-arm 595cb0f1a0 ("arm/trusted-services: fix udev management in libts")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Instead of calling groupmems after creating the user, we can tell useradd
to do the group membership when creating the user. There are several
reasons for this:
1) Consolidation of the calls into a single call means creation is atomic,
it either worked or it did not.
2) The existing logic doesn't work if both TPM and TS were enabled.
3) GROUPMEMS_PARAM is broken in oe-core master[1] and this will not be
fixed as groupmems has been removed from shadow[2].
Instead, construct a list of groups that parsec needs to be a member of,
and pass them to useradd.
[1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16277
[2] shadow 388ce70 "*/: groupmems(8): Remove program"
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
By :appending the TPM option we make it impossible for distros to simply
assign to PACKAGECONFIG.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Changes from 1.09 to 1.10:
- Shorten syslog name to work with rsyslog (#172)
- Update config file with grace period in all cases (#193)
- Remove printing QR code using Google Charts URL (service shut down)
Changes from 1.10 to 1.11:
- Change secret key bits from 128 to 160 bits (#266, #271)
- Add support for black & white terminals (#268, #270)
- Fix grace_period for IPv6 link-local addresses (#265)
Also fix the .bb recipe:
- Fix typo: RDEPNEDS -> RDEPENDS
- Use new override syntax: RDEPENDS:pam-google-authenticator
(replaces old underscore style RDEPENDS_pam-google-authenticator)
Signed-off-by: Haitao Liu <haitao.liu@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Fix the typo "tmp-layer" in "WARN_QA:append".
The right name for this layer in OVERRIDES is layer-tpm-layer
by checking "bitbake -e <recipe_name> | grep ^OVERRIDES=".
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Because "x86_64" and "arm64" aren't valid in bitbake OVERRIDES,
they should be corrected to "x86-64" and "aarch64".
On the other side, "x86_64" and "arch64" aren't valid MACHINE
name.
So correct the way to "only allow x86-64 and arm64 to build":
COMPATIBLE_MACHINE = "(-)" => disallow all machine first
COMPATIBLE_MACHINE:aarch64 = "(.*)" => when arch "aarch64" in
OVERRIDES, allow all machines.
COMPATIBLE_MACHINE:x86-64 = "(.*)" => when arch "x84-64" in
OVERRIDES, allow all machines.
Fix 1dd076d3a7 ("firejail: only allow x86-64 and arm64 to build")
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
To work around an install conflict between python3-cryptography and
python3-pyrad and unblock CI runs, remove python3-privacyidea from
the packagegroup dynamic bbappend temporarily.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Add aircrack-ng, crowdsec, ncrack, and opendnssec where appropriate
now that they have been updated to build again.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Bump to HEAD of ncrack's master branch to pick up build fixes for
newer gcc's. PV has been updated to indicate that we are now
building something newer than the 0.7 tagged commit.
License-Update: copyright years refreshed
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Remove libmspack recipe, and remove it from clamav's DEPENDS.
clamav now vendors its own substantially modified copy, so there's
no reason to carry a recipe for it.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Upgrade to the latest release, 1.7, and rework recipe so that it
actually builds again. Note that the extra scripts are no longer
installed by default as they seem somewhat stale and likely further
work is required to have any of them work. A PACKAGECONFIG option,
"ext-scripts" has been added to enable installing them if they are
required for some reason.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
The crowdsec recipes has seemingly been broken since soon after its
addition, rewrite it to build the latest version with the go-mod
bbclass.
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Scott Murray
Khem Raj
Wang Mingyu
Esa Jaaskela
Krupal Ka Patel
Peter Marko
Gaël PORTAY
Shreejit C
Sandeep J
Bin Cao
jason.lau
Li Zhou
Yi Zhao
Ross Burton
Anton Antonov
Marta Rybczynska