1
0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 05:09:24 +00:00
Commit Graph

67079 Commits

Author SHA1 Message Date
Ranjitsinh Rathod 192cb88c17 curl: Add patch to fix CVE-2022-43552
Add patch to fix the security issue "curl can be asked to tunnel
virtually all protocols it supports through an HTTP proxy. HTTP proxies
can (and often do) deny such tunnel operations using an appropriate HTTP
error response code." as per below link
Link: https://curl.se/docs/CVE-2022-43552.html

(From OE-Core rev: a0db3ddf6f2efe733271ff7f6c68fda4d215b1bb)

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06 17:33:23 +00:00
Ranjitsinh Rathod b6879ce896 curl: Add patch to fix CVE-2022-43551
Add patch to fix the security issue "curl's HSTS check could be bypassed
to trick it to keep using HTTP. Using its HSTS support, curl can be
instructed to use HTTPS instead of using an insecure clear-text HTTP
step even when HTTP is provided in the URL." as per below link
Link: https://curl.se/docs/CVE-2022-43551.html

(From OE-Core rev: baa18f2cf107af7a5e1c7b7befad46e6c48f4222)

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06 17:33:23 +00:00
Ranjitsinh Rathod 18da62e637 curl: Correct LICENSE from MIT-open-group to curl
LICENSE for curl is set to MIT-open-group which is wrong and proper
license is 'curl'

I check below link and the line "Curl and libcurl are licensed under
the license below, which is inspired by MIT/X, but not identical." says
that the license is identical to MIT but actual license is identical
from the file "meta/files/common-licenses/curl"
Link: https://curl.se/docs/copyright.html

Also, I do not find the MIT-open-group license text in the entire
source-code

(From OE-Core rev: 34b228bd3a80a74bf4d84ef7ee362f4ab1e3a466)

(From OE-Core rev: 95b5df5c9e0bdef55d0f977fb814f9de74363e68)

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4a246e06cb)
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06 17:33:23 +00:00
Vivek Kumbhar bbe38cd637 sqlite: fix CVE-2022-46908 safe mode authorizer callback allows disallowed UDFs.
(From OE-Core rev: 18641988caa131436f75dd3c279ce5af3380481a)

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06 17:33:23 +00:00
Marta Rybczynska 2f4691f403 efibootmgr: update compilation with musl
Since the commit 005b6aba89eaf1b79fdd7565dd028fdd9bbfcc7d
(efivar: add musl libc compatibility) efibootmgr compiles with
musl too. Update the variable to take that into account.

(From OE-Core rev: ada5e64a97d5f269886772540e0bb0c324088b21)

Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Richard Purdie 5c7103d6c7 yocto-check-layer: Allow OE-Core to be tested
For unknown reasons we've never seemingly run the check layer script
against OE-Core itself. This isn't entirely straightforward as the core
layer is a bit of a special case, we can't for example compare signatures
against ourselve and we can't remove core from bblayers.conf.

Core does have distro, machine and software components too, in the case
of distro, our fallback default settings. Whilst the qemu machines could
be split into a seperate layer directory, core wouldn't then parse at all
standalone due to the lack of any machine so it seems a bit pointless to
do that.

These changes tweak the script to handle core's special cases, specifically
to allow distro and machine directories and to account for the README placed
a directory level higher than other layers.

(From OE-Core rev: 2d0641df27196ad029d95c52fb790122b2db3f9f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Ross Burton 6e1c131b2f combo-layer: add sync-revs command
When starting to use combo-layer, or if someone else is using it too,
the local last_revision may be incorrect.

This command will forcibly update the last_revision config values to the
latest SHA on the remote branch that is tracked.

(From OE-Core rev: ba24231de6a3826558c9fcd403b075fc6772fffa)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2bb5d12ecd1b0273983f7c05699f34dd64b11c25)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Ross Burton 3cdbb5cc24 combo-layer: dont use bb.utils.rename
Bitbake may not be configured, and bb isn't imported anyway.

Instead just use os.rename(), and take the filename from the file object
instead of duplicating logic.

(From OE-Core rev: 87543ed6550f7e78b3ddcfed0ef088bea932ba57)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 528f4fb3683d048537604e4562ea758968060d62)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Ross Burton f86718661a combo-layer: remove unused import
(From OE-Core rev: 240c7dcad2f2e25efa269618c3bd6c549289207e)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ebfab6c3034d41252d19c6e1a0ba79072aa51146)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Peter Marko 319ccc97b4 oeqa/selftest/externalsrc: add test for srctree_hash_files
(From OE-Core rev: c3647c6beb04426774e4d99f2442f460d6a6b42c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 7b9728e5b8bdf1193c1304ec3beeca4b5bf8d2da)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Peter Marko a11a62209e externalsrc: fix lookup for .gitmodules
Commit 0533edac27 broke
bitbake parsing when bitbake is executed from directory with existing .gitmodules
and the recipe in externalsrc does not have .gitmodules

The check needs to search for .gitmodules in sources path, not cwd.

iParsing recipes...ERROR: ExpansionError during parsing <path to recipe>
...
bb.data_smart.ExpansionError: Failure expanding variable do_compile[file-checksums], expression was ${@srctree_hash_files(d)} which triggered exception CalledProcessError: Command '['git', 'config', '--file', '.gitmodules', '--get-regexp', 'path']' returned non-zero exit status 1.

(From OE-Core rev: 1f3b39c4d6828940934a341e9f8b73214dc67fdf)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 66ff3d1f65cd2e7f5319e98fa41f47a59b714c72)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Ross Burton b627db0656 lib/buildstats: fix parsing of trees with reduced_proc_pressure directories
The /proc/pressure support in buildstats is creating directories in the
buildstats tree called reduced_proc_pressure, which confuses the parsing
logic as that cannot be parsed as a name-epoc-version-revision tuple.

Explicitly skip this directory to solve the problem.

(From OE-Core rev: 96cf8b322f4cdec31175cc2c1082e9e3bc488118)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 24f0331f0b7e51161b1fa43d4592b491d2037fe9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Chen Qi 445a2069cd rm_work: adjust dependency to make do_rm_work_all depend on do_rm_work
For now, if we use rm_work and `bitbake core-image-minimal', some
recipes' WORKDIRs are not cleaned up, e.g., makedevs-native.

Adjust the dependency to make do_rm_work_all depend on do_rm_work
to solve this problem.

Below are the detailed explanation of why this would work.

Without this patch, the dependency chain is like:
[other deps] -> [do_rm_work] -+-> [do_build]
                              |
[do_rm_work_all] -------------+

With this patch, the depedency chain is like:
[other deps] -> [do_rm_work] -> [do_rm_work_all] -> [do_build]

Such dependency chain adjustment fixes the issue because do_rm_work_all
now depends on [other deps] and thus the [depends] of these [other deps].
Take core-image-minimal as an example. Before this adjustment,
do_rm_work_all does not have any relationship with do_rootfs, and we have
do_rootfs[depends] += "makedevs-native:do_populate_sysroot ..."
This essentially prevents 'recrdeptask' setting of do_rm_work_all extend
to makedevs-native. With this patch, the do_rm_work_all now depends
on do_rm_work which in turn depends on do_rootfs, and so do_rm_work_all's
recrdeptask could have effect on makedevs-native.

With this patch, all built recipes WORKDIR will be cleaned up with
a few expected exceptions such as kernel and qemu-helper-native.

(From OE-Core rev: 2565fe40514ac17d0c97e847bb9ff0ab90410e53)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b25cc45c9b39f79ba0a03c4556cb2e2431677b4e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Alex Stewart 41dbb14cb9 lsof: add update-alternatives logic
Some distributions (NI LinuxRT) provide both busybox-lsof and
full-featured lsof implementations. When users install the full-featured
lsof package, the full-binary fails to replace the bbox-binary in PATH,
because `lsof` contains no update-alternatives logic.

Inherit the update-alternatives bbclass and assert that the
full-featured lsof package has higher priority than the busybox
implementation.

Co-Authored-By: Kyle Roeschley <kyle.roeschley@ni.com>
(From OE-Core rev: 750f4e17f63cf957076c13c53139ddaab1617597)

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e2893fa692a6e91eee09fc04c8c03fe27c718a58)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Carlos Alberto Lopez Perez 13d7119cdf xwayland: libxshmfence is needed when dri3 is enabled
* The build error happens already at configure time:

| meson.build: ERROR: Problem encountered: DRI3 requested, but xshmfence not found

(From OE-Core rev: 7a27f91670d6978433ecab5d3ef694303d5da79e)

Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 451fe4a067432b432b9cd38d2fc78072f6ce5421)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Chen Qi 2bed21abab bc: extend to nativesdk
bc is needed for compiling kernel modules, more specifially
whenr running `make scripts prepare'.

In linux-yocto.inc, we have bc-native in DEPENDS. But we will
need nativesdk-bc in case we compile a kernel module inside
SDK.

(From OE-Core rev: 713ebd37cb740ebd1f3f57d14f4448ded8a5fe3c)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 95b5c89066baccb1e64bfba7d9a66feeeb086da9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Florin Diaconescu c4bbc6d9c5 python3: upgrade 3.10.8 -> 3.10.9
Security and bug fixes.

Drop patch for CVE-2022-42919 and CVE-2022-37454 which were merged in 3.10.9

Fixes:
* CVE-2022-45061 (gh-98433)
  https://nvd.nist.gov/vuln/detail/CVE-2022-45061

List of changes:
https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-9-final

(From OE-Core rev: f98b9c71686eb5ce5115ee73155a7d0389831ef0)

Signed-off-by: Florin Diaconescu <florin.diaconescu009@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Wang Mingyu f7133e57f8 libxcrypt-compat: upgrade 4.4.30 -> 4.4.33
Changelog:
==========
* Fix -Werror=sign-conversion in lib/alg-yescrypt-platform.c.
  With commit 894aee75433b4dc8d9724b126da6e79fa5f6814b we introduced some
  changes to huge page handling, that show this error when building with
  GCC v12.2.1, and thus need a small fix.

(From OE-Core rev: fbad6f482d2c3213eff12bda4020d14bbe4df288)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 6918477ad121f9c7335c661433a909e948f66d51)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Wang Mingyu 531d6fe602 mpfr: upgrade 4.1.0 -> 4.1.1
Changelog:
=========
- Bug fixes (see <https://www.mpfr.org/mpfr-4.1.0/#fixed> and/or the
  ChangeLog file), in particular for macros implementing functions.
- Improved manual formatting.

(From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Wang Mingyu c5cdf68773 bind: upgrade 9.18.8 -> 9.18.9
Changelog:
===========
  Fix a crash that could happen when you change
  a dnssec-policy zone with NSEC3 to start using
  inline-signing. [GL #3591]

  Don't trust a placeholder KEYDATA from the managed-keys
  zone by adding it into secroots. [GL #2895]

  Fixed a race condition that could cause a crash
  in dns_zone_synckeyzone(). [GL #3617]

  Don't enforce the jemalloc use on NetBSD. [GL #3634]

  Fix an inheritance bug when setting the port on
  remote servers in configuration. [GL #3627]

  Fix a resolver prefetch bug when the record's TTL value
  is equal to the configured prefetch eligibility value,
  but the record was erroneously not treated as eligible
  for prefetching. [GL #3603]

  Always call dns_adb_endudpfetch() after calling
  dns_adb_beginudpfetch() for UDP queries in resolver.c,
  in order to adjust back the quota. [GL #3598]

  Fix a startup issue on Solaris systems with many
  (reportedly > 510) CPUs. Thanks to Stacey Marshall from
  Oracle for deep investigation of the problem. [GL #3563]

  rpz-ip rules could be ineffective in some scenarios
  with CD=1 queries. [GL #3247]

  The RecursClients statistics counter could overflow
  in certain resolution scenarios. [GL #3584]

  Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
  reporting macros. [GL !6914]

  Fix a couple of bugs in cfg_print_duration(), which
  could result in generating incomplete duration values
  when printing the configuration using named-checkconf.
  [GL !6880]

  Refactor the isc_httpd implementation used in the
  statistics channel. [GL !6879]

(From OE-Core rev: 38219ac0617eac1969e4535a7dd22bf4c1fa1463)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e57fe26b3f85ebfabdc8b574caa5c97602e4d771)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:49 +00:00
Mathieu Dubois-Briand 8c4aa01b45 dbus: Add missing CVE product name
(From OE-Core rev: 655fc82974478b5986dc58f898d818bba692c2c6)

Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 67b2db202834f1213bed3580badda2a67655ab7d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:49 +00:00
Hitendra Prajapati f930572051 libxml2: Fix CVE-2022-40303 && CVE-2022-40304
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 && https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b

(From OE-Core rev: b46d0b7a599ee5d3009cca302ad5322d64eb94b9)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:49 +00:00
Hitendra Prajapati a00404e18e golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
Upstream-Status: Backport from https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997

(From OE-Core rev: d5a533b86ce68b4c3cd2d3c3dd198c2897d37587)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:49 +00:00
Richard Purdie c4e08719a7 build-appliance-image: Update to kirkstone head revision
(From OE-Core rev: 45a8b4101b14453aa3020d3f2b8a76b4dc0ae3f2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
kirkstone-4.0.6 yocto-4.0.6
2022-12-13 15:59:45 +00:00
Steve Sakoman 937f92f351 poky.conf: bump version for 4.0.6
(From meta-yocto rev: ff1102a164e83bfa4e9529f573e2f198c3cda3b5)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Ravula Adhitya Siddartha 704a3e1b01 linux-yocto/5.15: update genericx86* machines to v5.15.72
(From meta-yocto rev: de97d5fa277093f2f50e81fe241d537d3a112f81)

Signed-off-by: Ravula Adhitya Siddartha <adhityax.siddartha.ravula@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Ravula Adhitya Siddartha b8ba5491ac linux-yocto/5.10: update genericx86* machines to v5.10.149
(From meta-yocto rev: 745f65fd733a9e7bf4f22cd2efb44d156916f32b)

Signed-off-by: Ravula Adhitya Siddartha <adhityax.siddartha.ravula@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Richard Purdie 91de6ea10f oeqa/selftest/tinfoil: Add test for separate config_data with recipe_parse_file()
We've seen two different regressions in this API since it is used by
layer-index but not be the core code. Add a test for it to try and
ensure we don't break it again.

(From OE-Core rev: 2816c63240f21b175461e535d88943fc6bcd0b52)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b07de5de43ec9c9a2c5d496a64940ccdc5b47cf8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Chen Qi a0614c91a7 psplash: consider the situation of psplash not exist for systemd
In current psplash framework, the psplash might not exist at all.
For example, in case DSITRO is set to nodistro, the psplash does
not exist.

In our psplash recipe, we have:
SPLASH_IMAGES = "file://psplash-poky-img.h;outsuffix=default"
This variable is parsed to if psplash-poky-img.h exists, a package
named psplash-default is created and is added to RDEPENDS:${PN}.

We can see that the psplash-poky-img.h resides in meta-poky,
and in psplash_git.bbappend file in meta-poky, we have:
FILESEXTRAPATHS:prepend:poky := "${THISDIR}/files:"
So this file is only available in case poky distro is used.

To fix this issue, add condition check in the corresponding systemd
services.

(From OE-Core rev: c1d57880c786b3650f29afb89530941797e85560)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 7a62ff9ed39c179d2b9b0c40f4f8423ced413063)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Alexey Smirnov 55f6aabf11 classes: make TOOLCHAIN more permissive for kernel
Currently TOOLCHAIN is strictly set to gcc in kernel-arch.bbclass.
And this prevents any TOOLCHAIN changes for any kernel recipe.
This change makes TOOLCHAIN configurable as usual.

(From OE-Core rev: 0fd2cd0b1f28e9c829efc105f70611a4eafd4f31)

Signed-off-by: Alexey Smirnov <pyih.soft@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit be1634fc35dcc81f0301d942064a6eed584e0704)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Joshua Watt 02f81ae7c5 scripts: convert-overrides: Allow command-line customizations
Adds argument parsing to the conversion script so that the fields that
the script uses to do conversions can be customized on the command line.
The intention is to allows easier customization without having to fork
the script, and allow automated checking on 3rd party layers via CI
without false positives

(From OE-Core rev: b4afe3c1aaf5e8296e410ef01960f48a09dd717c)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b9551f9180bf9f13fb1c480b5b7892fdc831ffcd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Qiu, Zheng 8351b9ed2f valgrind: remove most hidden tests for arm64
An earlier version of valgrind fixed the defunct processes bug, so those
tests that were skipped specifically for arm can pass now in master,
kirkstone, honister, hardknott, and dunfell.

Detailed test result with remove-for-aarch64 skipped on qemuarm64:

    Commit           Pass   Fail    Skip
    master           624    9       21
    kirkstone        618    10      20
    honister         616    10      19
    hardknott        609    13      18
    dunfell          598    16      17
    zeus             Out of memory: Killed (with many defunct processes)

There are now only 12 skipped by remove-for-aarch64 because 9 fail on
qemuarm64 and 3 more fail on raspberry pi. These are tracked by:
    https://bugzilla.yoctoproject.org/show_bug.cgi?id=14960

(From OE-Core rev: 1101e877d818144ac64bab3d50364a1343c09d16)

Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com>
Signed-off-by: Randy MacLeod <randy.macleod@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit cbeb9418c43ec834868aa65b774dc09e983d26d9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Harald Seiler c8835a70d1 opkg: Set correct info_dir and status_file in opkg.conf
Distros can customize the location of OPKG data using OPKGLIBDIR.  In
OE-Core commit 11f1956cf5d7 ("package_manager.py: define info_dir and
status_file when OPKGLIBDIR isn't the default"), a fix was applied to
correctly set the info_dir and status_file options relative to
OPKGLIBDIR.

However, as the commit message notes, the opkg.conf file deployed as
part of the opkg package must also be adjusted to correctly reflect the
changed location.  Otherwise, opkg running inside the image cannot find
its data.

Fix this by also setting the info_dir and status_file options in
opkg.conf to the correct location relative to OPKGLIBDIR.

Fixes: 11f1956cf5d7 ("package_manager.py: define info_dir and status_file when OPKGLIBDIR isn't the default")
(From OE-Core rev: 658c9901be38a322770f3445ba2bc2fa01dc0aab)

Signed-off-by: Harald Seiler <hws@denx.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit adb939ae3635de6e02208859fbf29cf0ed39f565)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Joe Slater eea9ca003f python3: advance to version 3.10.8
Fixes CVE-2022-37460.  Also add patch to fix CVE-2022-37454.

(From OE-Core rev: b446dd69b79783ea232514e1c5212595ec28e553)

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Qiu, Zheng d513c3043b vim: upgrade 9.0.0820 -> 9.0.0947
Includes fixes for CVE-2022-4141
https://nvd.nist.gov/vuln/detail/CVE-2022-4141

For a short list of important changes, see:
https://www.arp242.net/vimlog/

(From OE-Core rev: a7abc8754ab5fbefa23fc17571d272a77dcd2421)

Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Xiangyu Chen 0a773d5592 grub: backport patches to fix CVE-2022-28736
(From OE-Core rev: 01be69264e4bf66cd1cb5acf949263d955171fc4)

Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Xiangyu Chen 887faedb16 sysstat: fix CVE-2022-39377
(From OE-Core rev: caf40fd28424aa583c18f9235d6d28651cc419b9)

Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Hitendra Prajapati 873eb777a0 libarchive: CVE-2022-36227 NULL pointer dereference in archive_write.c
Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5

(From OE-Core rev: e723e791b4faa3d5c755b4669b0901ebd0c368c9)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Ross Burton 39c76401c0 xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551
(From OE-Core rev: e40a8d939535bbb2f89aabd48c1cf843be5bb564)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e32401d8bf44afcca88af7e4c5948d2c28e1813f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Pavel Zhukov ca83262bdd bitbake: gitsm: Fix regression in gitsm submodule path parsing
Commit 0361ecf7eb82c386a9842cf1f3cb706c0a112e77 introduced regression
in submodules path parsing. As the result gitsm fetcher fails on each
submodule which name begins from the name of the parent repo which is
totally valid usecase [Yocto #14045] [1]
Fix the code to error out only if submodule's name is equal to parent
name but not if it's part of it.

[1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=14045#c4

(Bitbake rev: 7e268c107bb0240d583d2c34e24a71e373382509)

Signed-off-by: Pavel Zhukov <pavel@zhukoff.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ad27272c18f2bb9edd441f840167a3dabd5407b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-09 13:02:50 +00:00
Michael Opdenacker c883909950 SPDX and CVE documentation updates
Backporting from master the ones that are applicable to kirkstone.

(From yocto-docs rev: c10d65ef3bbdf4fe3abc03e3aef3d4ca8c2ad87f)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:04:15 +00:00
Tim Orling be95d5f93a mirrors.bbclass: update CPAN_MIRROR
Both of these redirect to https://cpan.metacpan.org/:
http://cpan.metacpan.org/
http://search.cpan.org/CPAN/

(From OE-Core rev: c0f3da88a9646fc5e6d549b1a2327c0823c0e5a1)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f1b74fc09f70d52d9ac629b04d81aa94fd97ff40)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Chen Qi b23ea642aa dhcpcd: fix to work with systemd
Currently, dhcpcd does not work well with systemd. When using dhcpcd
to configure network, the /etc/resolv.conf contents are not correct.
This issue could easily be reproduced by using 'qemu + slirp' to
start a systemd based image and using dhcpcd to configure network.
The expected 'nameserver 10.0.2.3' is not in /etc/resolv.conf.

The root cause of this problem is that dhcpcd assumes the resolvconf
should recognize .protocol suffix[1]. But systemd's resolvconf (which
is a symlink to resolvectl) has a limited support for traditional
resolvconf interface[2], and "may not work with all clients"[3]. This
of cource includes the clients that use the .protocol suffix.

The current situation is:
1. systemd is not going to support the .protocol suffix in the foreseeable
   near future[4].
2. dhcpcd does not want to merge systemd specific patch and insists
   systemd needs to consider the .protocol suffix[5][6].

It's a normal thing that people have different opinions. As a build system
that supports such combination, however, we do need to come up with a
solution to fix this typical integration problem, making dhcpcd and systemd
work together.

This patch solves this integration problem by relying on dhcpcd's ability
to manage its own resolv.conf contents. But instead of letting it to write
to /etc/resolv.conf directly, we supply the generated contents to resolvconf.
In this way, the resolvconf still stands in the central place and dhcpcd remains
a supplier to it. And the /etc/resolv.conf can get the correct contents.
With this patch, dhcpcd could work with both sysvinit and systemd.

[1] https://man.archlinux.org/man/resolvconf.8.en
[2] https://man.archlinux.org/man/resolvectl.1#COMPATIBILITY_WITH_RESOLVCONF(8)
[3] https://wiki.archlinux.org/title/systemd-resolved
[4] https://github.com/systemd/systemd/issues/25032
[5] https://github.com/NetworkConfiguration/dhcpcd/pull/152
[6] https://github.com/NetworkConfiguration/dhcpcd/issues/146

(From OE-Core rev: 26c1338f5ad73488d80cdb97ae2efbf0652ee1ac)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 935ae419f51d911c73f5dc7b4a2e5e9a7b206985)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Chen Qi 617cbccdc2 resolvconf: make it work
The current resolvconf does not work. Make it work with the
following changes.
1. Install normalize-resolvconf, which is used by resolvconf.
2. Add dependencies: sed, util-linux-flock.
   util-linux-flock is needed by our busybox does not support '-w'
   by default. sed is needed because we want to avoid package
   QA issue complaining sed is needed by no one provides it.
3. Add a patch to replace 'readlink -m' with 'readlink -l'.
   This could avoid the runtime dependency on coreutils. The replacement
   is safe as /etc always exits in OE's system.
4. Remove allarch inheritage. This is because the above RDEPENDS
   change does not allow this any more. test_sstate_allarch_samesigs
   would fail if we don't do this.

(From OE-Core rev: 66d85b2d841e6d3281f47ef9a39aa5483aad35d0)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 1b0581fd241cc9de2feda896aefbf055dc0099dc)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Enrico Jörns f8880f548e sstatesig: emit more helpful error message when not finding sstate manifest
Since oe-core commit 64b89f3c8fc31842256c482a3039d90d3f12c1cc
("sstatesig.py: make it fatal error when sstate manifest isn't found")
errors like:

| Manifest [..]/tmp/sstate-control/manifest-x86_64_x86_64-nativesdk-dbus.populate_sysroot not found in imx8mm_dummy cortexa53-mx8mm cortexa53 armv8a-crc armv8a aarch64 allarch x86_64_x86_64-nativesdk (variant '')?

are fatal now and cannot be ignored but must be debugged.

Unfortunately, the currently emitted error message is a bit imprecise
with telling the reader what has actually gone wrong.

This commit:

* adds the word 'sstate' to the error message to clarify the scope we
  are dealing with ('sstate manifests', since there are other manifests,
  too)
* does not randomly print the last manifest file searched for as THE
  manifest file that could not be found
  Instead, we print the name of the task the sstate was searched for
* adds the word 'multilib' to variant to make clear which variant we are
  talking about
* adds a separate line noting the searched pkgarchs and adds explicitly
  mentions this word ('pkgarchs')
* prints a list of ALL manifest file locations attempted
* removes the '?' at the end of the message since such errors indeed
  leave the question of what is the cause but the error message itself
  is more like a statement.

The result for the exact same issue as noted above then looks as
follows:

| The sstate manifest for task 'dbus:populate_sysroot' (multilib variant '') could not be found.
| The pkgarchs considered were: imx8mm_dummy, cortexa53-mx8mm, cortexa53, armv8a-crc, armv8a, aarch64, allarch, x86_64_x86_64-nativesdk.
| But none of these manifests exists:
|     [..]/tmp/sstate-control/manifest-imx8mm_dummy-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-cortexa53-mx8mm-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-cortexa53-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-armv8a-crc-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-armv8a-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-aarch64-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-allarch-dbus.populate_sysroot
|     [..]/tmp/sstate-control/manifest-x86_64_x86_64-nativesdk-dbus.populate_sysroot

(From OE-Core rev: cb4ad96a5d71c0a7e7a24fe12f12c2fbe06ae119)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 735ec126ec219c7cb89cb05b0e433201bb7f59eb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Dmitry Baryshkov 413ccb91b6 linux-firmware: add new fw file to ${PN}-qcom-adreno-a530
Extend the linux-firmware-qcom-adreno-a530 package with the squashed
Adreno 530 zap shader.

(From OE-Core rev: 6c477dffa8c83418d6e5c9635370e37d512885c3)

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 920bf119f35824a3531801f5e41158a8ad1bca4c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Dmitry Baryshkov 343373b112 linux-firmware: upgrade 20221012 -> 20221109
License-Update: additional files
(From OE-Core rev: ce3381ea0db213b4bf13d2593d3d0ed7a7219f4d)

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 6940f297243a66bd58d6adee7d690bcee9b9ccb2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Chen Qi 3dd024f384 kernel.bbclass: make KERNEL_DEBUG_TIMESTAMPS work at rebuild
Currently, the KERNEL_DEBUG_TIMESTAMPS is not working as expected
at rebuild. That is, even if we set it to "1", the kernel build time
is not changed. The problem could be reproduced by the following steps.
  1. bitbake core-image-minimal; start image and check `uname -a` output.
  2. set in local.conf: KERNEL_DEBUG_TIMESTAMPS = "1"
  3. bitbake core-image-minimal; start image and check `uname -a` output.

It's expected that after enabling KERNEL_DEBUG_TIMESTAMPS, the kernel
build time will be set to current date. But it's not. This is because
the compile.h was not re-generated when do_compile task was re-executed.

In mkcompile_h, we have:
"""
 # Only replace the real compile.h if the new one is different,
 # in order to preserve the timestamp and avoid unnecessary
 # recompilations.
 # We don't consider the file changed if only the date/time changed,
 # unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for
 # reproducible builds with that value referring to a commit timestamp).
 # A kernel config change will increase the generation number, thus
 # causing compile.h to be updated (including date/time) due to the
 # changed comment in the
 # first line.
"""
It has made it very clear that it will not be re-generated unless
we have KBUILD_BUILD_TIMESTAMP set explicitly. So we set this variable
explicitly in do_compile to fix this issue.

(From OE-Core rev: 640ac18b2daed698adbf849a5aef55f5de9e5db5)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 1b68c2d2d385013a1c535ef81172494302a36d74)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Bruce Ashfield a1e6d60633 kern-tools: integrate ZFS speedup patch
Bumping the SRCREV to integrat the following kern-tools change:

   commit 2d01f24bc78256c709728eb3f204491bce13e0e5
   Author: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
   Date:   Fri Nov 4 23:32:38 2022 +0000

       kconf_check: store some files in tmpdir

       Some file systems, like ZFS, are very slow at appending to existing
       files. Due to Copy-On-Write nature, they create a new copy of a file
       each time we do ">>" in a shell script. This becomes very noticeable
       if shell script does lots and lots of appends, like sanitize_fragment()
       function in kconf_check. On my setup, do_kernel_configcheck task takes
       literally hours to complete.

       To fix this issue, we can store sanitized_list and fragment_errors.txt
       files on tmpfs, which is extremely fast at writing. As most distros
       use tmpfs for /tmp, logical step is to use `mktemp` to create
       temporary files.

       After completing writing to temporary locations, we can move those two
       files back to ${LOGDIR}.

       Also, function 'cleanup' was added to remove temporary files in case
       of abnormal exit.

       With this patch, do_kernel_configcheck task completes in ~2 minutes on
       my setup, which is a great improvement.

       Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>

(From OE-Core rev: a592314318509e6367a7625caf88837480570fcd)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 9d50e2606eb66019044ee176f355a84a65a1499c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Bruce Ashfield d127f9bb46 linux-yocto/5.15: fix CONFIG_CRYPTO_CCM mismatch warnings
Integrating the following commit(s) to linux-yocto/.:

    f475b1a9ded qat: fix CONFIG_CRYPTO_CCM mismatch warnings

(From OE-Core rev: 8d06b6b13051e85250bf480ea6e3c0201b28330e)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit a3417ce85e38d514c7dc43c2ddcdacf45996fc2a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00