ROOTFS_BOOTSTRAP_INSTALL in image.bbclass unconditionally stages
run-postinsts into every image. When no delayed postinsts remain,
_uninstall_unneeded() is supposed to remove it again, but the removal
call used the bare "run-postinsts" package name without applying
MLPREFIX.
On a multilib image (e.g. lib32-core-image-minimal), the package that
is actually installed is lib32-run-postinsts, so the unprefixed
removal silently matches nothing and run-postinsts leaks into the
final image manifest, along with its now-pointless init script /
systemd unit.
Expand MLPREFIX before removing the package, matching the pattern
already used elsewhere in oe-core (e.g. oe/package.py) for
package-name lookups that need to work across multilib variants.
(From OE-Core rev: 2522a1ad4fb66af0a9ca146ca7a88aece8f471da)
Signed-off-by: Kyungjik Min <dp.min@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dfa5673907bdc5211671ecdfce8ab1fb332eae48)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Adds suport for a working close_range() intercept.
(From OE-Core rev: 2d50a4b12798e57a6d7900de2cb2b6b4edcb77e9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9a68d3f4bd0e80ea7e1ea745b6a10acd341dc7d8)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Pulls in various important fixes:
Makefile.in: Bump to 1.9.10
test: various: Move to makefile compilation
test-bash-exec-env: Add bash env test case
test/test-openat2-func.c: Remove unusuaed saved_errno
pseudo_util.c: strchr now returns const char
pseudo_client: remove the unused pseudo_prefix_dir_fd
pseudo_client: step around all of pseudo's own fds in closefrom
pseudo_client: step fully past pseudo's own fds when computing startfd
makewrappers: Avoid efault workaround if using AT_EMPTY_PATH
ports/linux/guts: Add __open64_2 wrapper
Makefile.in: Bump to 1.9.9
(From OE-Core rev: fc1a18d4da57dcee29861b3b5efd1924541ac71a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4232a7cc5fa28828fdf3223b3c0a6432c8c1e670)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Pull in buffering fix:
"""
When running slow ptests, we can see an issue where the tests are writing output
but it doesn't make it to the process (e.g. ssh connection) running ptest-runner.
The issue is that the standard buffering for non-interactive terminals is 8kb and
some ptests don't output enough data to trigger a write. This can lead to
the controlling connection timing out.
This change forces the output streams to be line buffered in all cases. Most
ptest output would contain newlines so this should work well. stderr can be
unbuffered by default but making it consistent here seems the best approach.
Testing with this change on slow ptest runs (e.g. qemu emulated) showed much
more consistent data with this change.
"""
(From OE-Core rev: b969018b72abd96e4b504a23cb7054db4f661761)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b57105311f1c5fd879dd58fa1de8862ebad989c1)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Changelog:
- utils.c: Fix dirname() handling in run_ptests()
- ptest-runner-collect-system-data: add info to logs
- main.c: Set PYTHONUNBUFFERED in the environment
- utils.c: print a message when a timeout occurs
- main.c: Add print_helptext() for detailed help
- main.print_usage: Remove unused argument list of -l
(From OE-Core rev: 62d96e61678773686773203216f924d34a47160b)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 869d70d46c8e31cfc380b5143059cab3713cae26)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This is 2 commits squashed:
| ptest-runner: upgrade 2.4.5 -> 2.5.1
|
| Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
| Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
| Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
| (cherry picked from commit d4497ba3fed93807f59c00925056aa21e72c2189)
|ptest-runner: correct PV from 2.5.1 to 2.4.5.1
|
|2.4.5.1 is an actual version, 2.5.1 was a typo mistake.
|That merged less than an hour ago, so no one should
|trip over version going backwards hopefully.
|
|Signed-off-by: Alexander Kanavin <alex@linutronix.de>
|Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|(cherry picked from commit d5e0f51bccae7410b10c98a93fa5853155c2f59e)
Changelog: https://git.yoctoproject.org/ptest-runner2/log/?h=v2.4.5.1
* Makefile: use pkg-config to obtain libcheck flags
* Makefile: remove redundant rule
* README.md: Add my cc to be aware of patches
* README: Update mailing list address for patches + add git command
(From OE-Core rev: 6688fc0df342dfb75061647462e36590dc5175ca)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Fix incorrect function call when processing SPDX_CUSTOM_ANNOTATION_VARS.
The code was calling new_annotation() as a standalone function, but it
should be called as a method on the build_objset object.
Error:
new_annotation(d, build_objset, build, ...)
Corrected to:
build_objset.new_annotation(d, build_objset, build, ...)
This bug would cause a NameError at runtime if SPDX_CUSTOM_ANNOTATION_VARS
was set to a non-empty value, preventing SPDX document generation.
The fix aligns with how new_annotation() is called elsewhere in the
codebase and matches the SBOMObjset class method signature.
(From OE-Core rev: de5c85b2c4c5a62d12aa5b9ab328d9a51d831c41)
Signed-off-by: Stefano Tondo <stefano.tondo.ext@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 52ab3b640c6bb7ece34cb4ea6026fd6375f17af4)
Cc: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC:
Link: https://lore.kernel.org/all/CAJdd5GaqcWujQae-GXQpcgAGtosHe7_X0T%2B8LyOfrr8-mOgzLA@mail.gmail.com/
]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Update to the 5.0.20 release of the 5.0 series for buildtools
(From OE-Core rev: 955e0ed1c6651f0a1d18d0c9bee5f6ef494cd189)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Leading space leads to SPDX document validation errors in some tools.
Example:
SchemaError: \" http://certifi.io/\" is not valid under any of the
schemas listed in the 'anyOf' keyword
(components -> ... -> externalReferences -> 0 -> url)
(From OE-Core rev: 758899639692fb76e28f3914f75249957c0b3600)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: ee556d1e1cc16327e0a11207e90ac61d9f1577f3)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Leading space leads to SPDX document validation errors in some tools.
Example:
SchemaError: \" http://golang.org/\" is not valid under any of the
schemas listed in the 'anyOf' keyword
(components -> ... -> externalReferences -> 0 -> url)
(From OE-Core rev: e859061f8f00937e5bb737c029ca2da3837d551c)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: cbf36f436b477d81b58ff605846a2482308aefa)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The guard added in 80ff4903ea tests "detail" in cve_data, but cve_data is
keyed by CVE id, so it asks whether a CVE literally named "detail" was
scanned. That is never true, the condition short-circuits, and the guard
never runs: a CVE_STATUS[CVE-...] = "backported-patch" set for a vendor
cherry-picked patch is silently overwritten to Unpatched by the CNA.
Use .get() on the entry instead. Guard the fallthrough warning the same
way, it makes the same assumption.
Tested against a qemuarm64 linux-yocto report (6.6.142+git, 16221 entries,
4313 of them with no detail). Current master and this version produce
identical output, 18773 entries with no difference. Adding
CVE_STATUS[CVE-2024-42067] = "backported-patch" to that report then makes
the only difference between them: master overwrites it to Unpatched, this
version keeps it Patched. The pre-80ff4903ea code aborts on the same
report with "KeyError: 'detail'".
AI-Generated: Uses Claude (claude-opus-5)
Fixes: 80ff4903ea1b ("improve_kernel_cve_report: validate that cve details field exists")
(From OE-Core rev: ff8709c6ea17ef64e660c12f225c839865b3facb)
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f5da16b0d3c8f889dab061ba1d8808aba95d4c67)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
CVE-2026-8458 allows a Negotiate-authenticated connection to be
incorrectly reused for a request using a different SASL service name.
Scarthgap uses curl 8.7.1, which is within the affected version range.
The vulnerable code path on Linux requires both Negotiate authentication
and GSSAPI support, represented by the negotiate-auth and krb5
PACKAGECONFIG options.
The upstream fix [1] stores the SASL service name in struct Curl_creds
and includes it in connection-reuse comparisons. However, struct
Curl_creds was introduced by the credential-management rework in [2],
after curl 8.7.1. Therefore, the security fix cannot be cleanly
backported without introducing a substantial credential-management
refactor.
Use a conditional CVE_STATUS as the least invasive solution. Report the
CVE as unpatched when both krb5 and negotiate-auth are enabled. Otherwise,
mark it not-applicable-config because the vulnerable GSSAPI-backed
Negotiate implementation is not built. The default Scarthgap
configuration enables negotiate-auth but does not enable krb5.
References:
[1] https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d
[2] https://github.com/curl/curl/commit/8f71d0fde515aa4c68002477356c35bd79927729
[3] https://curl.se/docs/CVE-2026-8458.html
(From OE-Core rev: e986fa2c8d74c1b943bb9069e47d1a9ae7dee9e0)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The inherited "python:Mako" mapping is not used for the packaged Mako
source and causes its vulnerability records to be missed.
Use "makotemplates:mako" for its historical NVD configuration identity
and "sqlalchemy:mako" for the current NVD dictionary CPE, NVD
configuration, and CNA affected-data identity.
Backport note: this applies the metadata to Scarthgap Mako 1.3.2 rather
than master 1.4.1; the older release exposes applicable unpatched records.
(From OE-Core rev: d419d38614ad7dae149e005ac6183c0290f54b2d)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 76fc2046d3f251af34dd04f8fdcfc0c1d6016380)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
PLY 3.11 contains the picklefile parameter described by
CVE-2025-56005, but exploitation requires an application to
explicitly pass an attacker-controlled pickle file to yacc().
No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
the same reason [1], and NVD records the CVE as disputed [2].
[1] https://ubuntu.com/security/CVE-2025-56005
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
(From OE-Core rev: 9bce52b90a6783e0ba23ff048209ea88922fd1da)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- NVD marks CVE-2018-20225 as disputed. [1]
- pip searches all configured package indexes without priority and selects
the highest matching version. --extra-index-url adds an equal-priority
package source. [2]
- Exploitation requires use of --extra-index-url and an attacker-published,
higher-version package with the name of a private package. [1]
- Upstream closed the related report as not planned, and Red Hat classified
the issue as WONTFIX because this behavior is intentional. [3][4]
- Record the disputed status; no source patch is available.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225
[2] https://pip.pypa.io/en/stable/cli/pip_install/
[3] https://github.com/pypa/pip/issues/12874
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736
(From OE-Core rev: 34c0972ffea7dcf4888e3bcfe0ce17206b32e408)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When qemu test runs only produce suffixed bootlog variants, the base
bootlog path may not exist. os.symlink() creates a dangling symlink
in the oeqa result log directory.
Avoid advertising a boot log in the collected test results when that
path does not exist. Guard the symlink creation and log a note instead.
This is a partial backport of master commit
7a6596925cb0eb8dd48a0362a51875cdd60152bc. Only the symlink guard is
picked here; the bootlog variant globbing from master is not applicable
to scarthgap.
(From OE-Core rev: 6672769e251ab0dd42fc5f5cde99800ed5ba8289)
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This was introduced as a test for the fix in 6ec70d5d2e330b41b932b0a655b838a5f37df01e
however the way github works has changed in the decade since and this
test is no longer testing what was intended.
The test is failing intermittently on our infrastructure thanks to spam
and IP block throttling restrictions which lead to occasional failures.
At this point it is probably simplest just to drop the url from testing.
(Bitbake rev: 1b619d136c01c97ab1b76a75e8845cddc5e49735)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b59bdcf8134e6f5935e8f7b0ed8033cbb745e0ff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
We're having issues with github urls, switch many of the test repos to our own
mirror copies. Some mirror copies are modified to reduce their size and improve test
times. More needs to be done in that area!
(Bitbake rev: 931a230a28a0582552f098e97d94299f310fd2eb)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9dbf27b9fd04c40c87f25eb6cbd884db5c7f2160)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This single url takes 100s in each of the two tests it is used in,
compared to the fraction of a second for the other urls. Nobody
should really be using ftp any more anyway, drop this test url.
(Bitbake rev: 4b8695f0708f4da5ed16e97ae7bcfb69fdd1e3ed)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a181827fa0fe6738441b40b5206cc2cadb5f7dce)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The tools-profile feature was introduced in 2007 with eabfa35d7c
("Rewrite IMAGE_FEATURES tools options (people may be to update their
local.conf), split into debug and profiling and add more profiling
tools.") but was not documented. Add the feature to the list.
(From yocto-docs rev: 40952d60ef81203994bf385f4f75b5419e2356cb)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3c55d1af536c202d585e335bdcc417479d6e1ddc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The BBFILES is most likely never set by the local.conf file, but the
layer.conf file.
(From yocto-docs rev: ab632c9b814704af730b7f67153ef4124ade0118)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2f2cb936a285ef48b4f10698d19a3e934d1417f7)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Kyungjik Min
Peter Marko
Richard Purdie
Yoann Congal
Wang Mingyu
Stefano Tondo
Darsh Kelaiya
Hemanth Kumar M D
Vijay Anusuri
Hiago De Franco
Daniel Turull
Devansh Patel
Jakub Szczudlo (Nokia)
Hetvi Thakar
Hitendra Prajapati
Jaipaul Cheernam
Adarsh Jagadish Kamini
Peter Tatrai
Lee Chee Yang
Antonin Godard