Khem Raj
b289c5040c
Release notes: https://github.com/tpm2-software/tpm2-tools/blob/5.8/docs/CHANGELOG.md Fixes GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66 and GHSA-qp88-8f4j-wv7q, including a heap buffer overflow in tpm2_getekcertificate. Also brings OpenSSL 4.0 compatible macros, so the tools build and link cleanly against openssl 4.x (verified against 4.0.2 with no deprecation warnings; tpm2 links libcrypto.so.4). Add autoconf-archive-native to DEPENDS: the 5.8 release tarball no longer bundles the autoconf-archive ax_*.m4 macros under m4/ the way 5.7 did, so the autoreconf done by autotools.bbclass leaves AX_CHECK_COMPILE_FLAG, AX_CHECK_LINK_FLAG, AX_CHECK_PREPROC_FLAG, AX_ADD_FORTIFY_SOURCE, AX_CODE_COVERAGE and AX_IS_RELEASE undefined. m4 then strips a quoting level off their unexpanded arguments and the bare AC_MSG_ERROR leaks into configure, failing autoconf's m4_pattern_forbid check with: configure.ac:40: error: undefined or overquoted macro: AC_MSG_ERROR Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Master-next: pipeline status Master: pipeline status
Meta-security
The bbappend files for some recipes (e.g. linux-yocto) in this layer need to have 'security' in DISTRO_FEATURES to have effect. To enable them, add in configuration file the following line.
DISTRO_FEATURES:append = " security"
If meta-security is included, but security is not enabled as a distro feature a warning is printed at parse time:
You have included the meta-security layer, but
'security' has not been enabled in your DISTRO_FEATURES. Some bbappend files
and preferred version setting may not take effect.
If you know what you are doing, this warning can be disabled by setting the following variable in your configuration:
SKIP_META_SECURITY_SANITY_CHECK = 1
This layer provides security tools, hardening tools for Linux kernels and libraries for implementing security mechanisms.
Dependencies
This layer depends on:
URI: git://git.openembedded.org/openembedded-core branch: [same one as checked out for this layer]
URI: git://git.openembedded.org/meta-openembedded/meta-oe branch: [same one as checked out for this layer]
Adding the security layer to your build
In order to use this layer, you need to make the build system aware of it.
Assuming the security layer exists at the top-level of your yocto build tree, you can add it to the build system by adding the location of the security layer to bblayers.conf, along with any other layers needed. e.g.:
BBLAYERS ?= "
/path/to/oe-core/meta
/path/to/meta-openembedded/meta-oe
/path/to/layer/meta-security "
Optional Dynamic layer dependancy
URI: git://git.openembedded.org/meta-openembedded/meta-oe
URI: git://git.openembedded.org/meta-openembedded/meta-perl
URI: git://git.openembedded.org/meta-openembedded/meta-python
BBLAYERS += "/path/to/layer/meta-openembedded/meta-oe" BBLAYERS += "/path/to/layer/meta-openembedded/meta-perl" BBLAYERS += "/path/to/layer/meta-openembedded/meta-python"
This will activate the dynamic-layer mechanism.
Maintenance
Send pull requests, patches, comments or questions to yocto-patches@lists.yoctoproject.org
When sending single patches, please using something like: 'git send-email -1 --to yocto-patches@lists.yoctoproject.org --subject-prefix=meta-security][PATCH'
These values can be set as defaults for this repository:
$ git config sendemail.to yocto-patches@lists.yoctoproject.org $ git config format.subjectPrefix meta-security][PATCH
Now you can just do 'git send-email origin/master' to send all local patches.
For pull requests, please use create-pull-request and send-pull-request.
Maintainers: Scott Murray scott.murray@konsulko.com Marta Rybczynska rybczynska@gmail.com
License
All metadata is MIT licensed unless otherwise stated. Source code included in tree for individual recipes is under the LICENSE stated in each recipe (.bb file) unless otherwise stated.