Commit Graph

1482 Commits

Author SHA1 Message Date
Jose Quaresma
d8306e4824 meta-hardening/layer: lower the priority from 10 to 6
The priority change on sumo version without any description.
Since then is very hard to add in other layers a new version
of any recipe on this layer with such priority so these patch
reverts the priority back to 6.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:27:24 -04:00
Petr Gotthard
c06b9a18a6 tpm2-abrmd: upgrade 2.4.1 -> 3.0.0
Changelog:
https://github.com/tpm2-software/tpm2-abrmd/blob/3.0.0/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
13653bf807 tpm2-pkcs11: upgrade 1.8.0 -> 1.9.0
Changelog:
https://github.com/tpm2-software/tpm2-pkcs11/blob/1.9.0/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
1ac7c66afc tpm2-tools: upgrade 5.3 -> 5.5
Changelog:
https://github.com/tpm2-software/tpm2-tools/blob/5.5/docs/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
e188be029c tpm2-tss: upgrade 3.2.0 -> 4.0.1
Changelog:
https://github.com/tpm2-software/tpm2-tss/blob/4.0.1/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Maciej Borzęcki
ab8651c139 dm-verity-img.bbclass: add squashfs images
Add squashfs to images supported by verity.

Signed-off-by: Maciek Borzecki <maciek@thing.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11 10:36:23 -05:00
Mikko Rapeli
3529cfb43e linux-yocto: drop version from bbappends
These bbappends apply to multiple kernel versions so no
need to make them version dependent. Fixes recipe parsing when
using meta-security master branch on kirkstone. In our custom layer we
set layer compatibility for kirkstone and I understand why meta-security
upstream would not want to do that:

LAYERSERIES_COMPAT_security-layer += 'kirkstone'
LAYERSERIES_COMPAT_parsec-layer += 'kirkstone'
LAYERSERIES_COMPAT_tpm-layer += 'kirkstone'

While I work towards supporting also yocto master branch and newer
releases than kirkstone, I would appreciate if I would not have to
branch off layers over minor details like this.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-06 07:32:41 -05:00
Max Krummenacher
7eed4a60f5 samhain: rework due to changed cache handling
OE-Core changed the cache handling which made the use of ${BPN} no fail.

| Parsing recipes...WARNING: .../samhain-standalone.bb: Exception during build_dependencies for do_configure
| WARNING: .../samhain-standalone.bb: Error during finalise of .../samhain-standalone.bb
| ERROR: ExpansionError during parsing .../samhain-standalone.bb
| Traceback (most recent call last):
|   File "Var <MODE_NAME>", line 1, in <module>
| bb.data_smart.ExpansionError: Failure expanding variable MODE_NAME, expression was ${@d.getVar('BPN').split('-')[1]} which triggered exception IndexError: list index out of range
| The variable dependency chain for the failure is: MODE_NAME -> SAMHAIN_MODE -> do_configure

Simplify the setting of MODE_NAME and SAMHAIN_MODE by setting them
in the recipe files where we know their values.

bitbake:
ee89ade5 cache/codeparser: Switch to a new BB_CACHEDIR variable for cache location
oe-core:
7c15e03dd3 bitbake.conf: Add BB_HASH_CODEPARSER_VALS

Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:22:30 -05:00
Armin Kuster
92f04c78f0 meta-tpm: bump linux-yocto to 6.x kernel
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:17:03 -05:00
Armin Kuster
769ddade73 linux-yocto.bbappend: bump to kernel version 6.x
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:15:27 -05:00
Chen Qi
3d9dab6d14 openscap: add libpcre DEPEDNS to fix do_configure failure
swig has switched to use libpcre2, we need to add libpcre to
DEPENDS to avoid do_configure failure.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-16 09:30:09 -05:00
Markus Volk
d623fc232b bubblewrap: remove recipe
It was moved to meta-oe.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:46:25 -05:00
Martin Jansa
1550c126ce layer.conf: update LAYERSERIES_COMPAT for mickledore
* oe-core switched to mickedore in:
  https://git.openembedded.org/openembedded-core/commit/?id=57239d66b933c4313cf331d35d13ec2d0661c38f

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:32:16 -05:00
Alex Kiernan
f991b20f56 bubblewrap: Update 0.6.2 -> 0.7.0
Inherit github-releases so that `devtool upgrade` can identify new
versions correctly.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
2893be10d0 chipsec: update to 1.9.1
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
715537c48b python3-privacyidea: update to 2.7.4
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Michael Haener
dbab46107d tpm2-tools: update to 5.3 2022-11-19 14:01:41 -05:00
Gowtham Suresh Kumar
2aa48e6f4e Update PARSEC recipe to latest v1.1.0 release
This commit updates the parsec-service to v1.1.0 and the parsec-tool
to v0.5.4.

The buildpaths QA check has been disabled and relevant
issue links have been added to address this.

Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
2022-10-24 10:27:58 -04:00
Michael Haener
6bc02ba989 tpm2-openssl: update to 1.1.1
Signed-off-by: Michael Haener <michael.haener@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-10-24 10:27:58 -04:00
Armin Kuster
d7d3056ed7 kas-security-base.yml: make work again
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-10-24 10:27:58 -04:00
Armin Kuster
e8e7318189 cryptmount: update to 6.0
LIC_FILES_CHKSUM changed do to yr change
Drop patch remove_linux_fs.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 15:19:51 -04:00
Armin Kuster
b29ce7d47d libgssglue: update to 0.7
LIC_FILE_CHKSUM changes to to indentations changes.
use bootstrap to setup config properly.

Drop libgssglue-fix-CVE-2011-2709.patch, libgssglue-g-initialize.patch now included in update.
  and ibgssglue-mglueP.patch now included in update.

Drop libgssglue-gss-inq-cred.patch still pending after 5 yrs.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 13:37:57 -04:00
Armin Kuster
852daaf67b apparmor: update to 3.0.7
Fix typo in HOMEPAGE

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 12:18:45 -04:00
Michael Haener
014f9dab78 tpm: update the linux-yocto rule with the one from sanity-meta-tpm class 2022-09-25 11:29:43 -04:00
Armin Kuster
824d2762f6 update chipsec to 1.8.8
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
8a4ed4034f update sssd to 2.7.4
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
ee8a51c582 cryptmount: fix systemd service install
Default is to install the service in /usr/lib

Signed-off-by: Armin Kuster <akuster808@gmail.com>

--
[V2]
Fix typo in subject
2022-09-12 11:11:50 -04:00
Armin Kuster
b59691b3d9 suricata: fix compile issue
make[2]: *** No rule to make target '../rust/target/arm-poky-linux-gnueabi/release/libsuricata.a', needed by 'suricata'

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
10fdc2b13a kas: update testimage inherit
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:24:12 -04:00
Anton Antonov
2753e73086 parsec-service: Update oeqa tests
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
2022-08-25 08:17:39 -04:00
Anton Antonov
64b64696a9 Use CARGO_TARGET_SUBDIR in do_install
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
2022-08-25 08:17:39 -04:00
Armin Kuster
aa57a13788 cyptmount: Fix mount.h conflicts seen with glibc 2.36+
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:15:58 -04:00
Mingli Yu
ea5bb2f2e7 samhain-standalone: fix buildpaths issue
Fixes:
  WARNING: samhain-standalone-4.4.9-r0 do_package_qa: QA Issue: File /usr/share/doc/samhain-standalone/scripts/samhain.ebuild-light in package samhain-standalone-doc contains reference to TMPDIR
  File /usr/share/doc/samhain-standalone/scripts/samhain.ebuild in package samhain-standalone-doc contains reference to TMPDIR [buildpaths]

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:14:21 -04:00
John Edward Broadbent
571af37e9c meta-security: Add recipe for Glome
Generic Low Overhead Message Exchange (GLOME) is a protocol providing
secure authentication and authorization for low dependency environments.

Signed-off-by: John Edward Broadbent <jebr@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
5f530ba5ab packagegroup-core-security: add pkg to grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
8e26e9dc7a cryptmount: Add new pkg
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
c352530c13 packagegroup-core-security: add space for appends
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:49 -07:00
Armin Kuster
a891026392 apparmor: update to 3.0.6
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:41 -07:00
Armin Kuster
13120455a5 lkrg-module: update to 0.9.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:34 -07:00
Armin Kuster
8173cc90c8 python3-privacyidea: update to 3.7.3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:26 -07:00
Armin Kuster
2a2d650ee0 packagegroup-core-security: remove krill for some archs
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
70859e8608 krill: only builds on x86/x86-64 and arm64
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
4e0ba84530 lkrg: update to 0.9.4
drop Makefile fixup patch. Use sed instead

LIC_FILES_CHKSUM update do to yr update

Signed-off-by: Armin Kuster <akuster808@gmail.com>

---
V2]
Add LIC_FILES_CHKSUM change reason
2022-08-02 13:45:26 -07:00
Armin Kuster
8a90b05e72 swtpm: update to 0.7.3
drop musl patch.Fix another way

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
e73c62adf7 ibmswtpm2: update to 1682
fixes openssl 3.0 support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
67c42369b3 ibmswtpm2: fix UPSTREAM_CHECK
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
55b5906ddd ibmtpm2tss: update version format
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
65d88fced2 clamav: update to 0.104.4
drop accepted patch fix_systemd_socket.patch

allow clamav-libclamav to have a symlink

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
a3500e01e2 apparmor: update to 3.0.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
d8d3824d2d packagegroup-core-security: add chipsec pkg to grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00