Fix incorrect function call when processing SPDX_CUSTOM_ANNOTATION_VARS.
The code was calling new_annotation() as a standalone function, but it
should be called as a method on the build_objset object.
Error:
new_annotation(d, build_objset, build, ...)
Corrected to:
build_objset.new_annotation(d, build_objset, build, ...)
This bug would cause a NameError at runtime if SPDX_CUSTOM_ANNOTATION_VARS
was set to a non-empty value, preventing SPDX document generation.
The fix aligns with how new_annotation() is called elsewhere in the
codebase and matches the SBOMObjset class method signature.
(From OE-Core rev: de5c85b2c4c5a62d12aa5b9ab328d9a51d831c41)
Signed-off-by: Stefano Tondo <stefano.tondo.ext@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 52ab3b640c6bb7ece34cb4ea6026fd6375f17af4)
Cc: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC:
Link: https://lore.kernel.org/all/CAJdd5GaqcWujQae-GXQpcgAGtosHe7_X0T%2B8LyOfrr8-mOgzLA@mail.gmail.com/
]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Update to the 5.0.20 release of the 5.0 series for buildtools
(From OE-Core rev: 955e0ed1c6651f0a1d18d0c9bee5f6ef494cd189)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Leading space leads to SPDX document validation errors in some tools.
Example:
SchemaError: \" http://certifi.io/\" is not valid under any of the
schemas listed in the 'anyOf' keyword
(components -> ... -> externalReferences -> 0 -> url)
(From OE-Core rev: 758899639692fb76e28f3914f75249957c0b3600)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: ee556d1e1cc16327e0a11207e90ac61d9f1577f3)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Leading space leads to SPDX document validation errors in some tools.
Example:
SchemaError: \" http://golang.org/\" is not valid under any of the
schemas listed in the 'anyOf' keyword
(components -> ... -> externalReferences -> 0 -> url)
(From OE-Core rev: e859061f8f00937e5bb737c029ca2da3837d551c)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: cbf36f436b477d81b58ff605846a2482308aefa)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The guard added in 80ff4903ea tests "detail" in cve_data, but cve_data is
keyed by CVE id, so it asks whether a CVE literally named "detail" was
scanned. That is never true, the condition short-circuits, and the guard
never runs: a CVE_STATUS[CVE-...] = "backported-patch" set for a vendor
cherry-picked patch is silently overwritten to Unpatched by the CNA.
Use .get() on the entry instead. Guard the fallthrough warning the same
way, it makes the same assumption.
Tested against a qemuarm64 linux-yocto report (6.6.142+git, 16221 entries,
4313 of them with no detail). Current master and this version produce
identical output, 18773 entries with no difference. Adding
CVE_STATUS[CVE-2024-42067] = "backported-patch" to that report then makes
the only difference between them: master overwrites it to Unpatched, this
version keeps it Patched. The pre-80ff4903ea code aborts on the same
report with "KeyError: 'detail'".
AI-Generated: Uses Claude (claude-opus-5)
Fixes: 80ff4903ea1b ("improve_kernel_cve_report: validate that cve details field exists")
(From OE-Core rev: ff8709c6ea17ef64e660c12f225c839865b3facb)
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f5da16b0d3c8f889dab061ba1d8808aba95d4c67)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
CVE-2026-8458 allows a Negotiate-authenticated connection to be
incorrectly reused for a request using a different SASL service name.
Scarthgap uses curl 8.7.1, which is within the affected version range.
The vulnerable code path on Linux requires both Negotiate authentication
and GSSAPI support, represented by the negotiate-auth and krb5
PACKAGECONFIG options.
The upstream fix [1] stores the SASL service name in struct Curl_creds
and includes it in connection-reuse comparisons. However, struct
Curl_creds was introduced by the credential-management rework in [2],
after curl 8.7.1. Therefore, the security fix cannot be cleanly
backported without introducing a substantial credential-management
refactor.
Use a conditional CVE_STATUS as the least invasive solution. Report the
CVE as unpatched when both krb5 and negotiate-auth are enabled. Otherwise,
mark it not-applicable-config because the vulnerable GSSAPI-backed
Negotiate implementation is not built. The default Scarthgap
configuration enables negotiate-auth but does not enable krb5.
References:
[1] https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d
[2] https://github.com/curl/curl/commit/8f71d0fde515aa4c68002477356c35bd79927729
[3] https://curl.se/docs/CVE-2026-8458.html
(From OE-Core rev: e986fa2c8d74c1b943bb9069e47d1a9ae7dee9e0)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The inherited "python:Mako" mapping is not used for the packaged Mako
source and causes its vulnerability records to be missed.
Use "makotemplates:mako" for its historical NVD configuration identity
and "sqlalchemy:mako" for the current NVD dictionary CPE, NVD
configuration, and CNA affected-data identity.
Backport note: this applies the metadata to Scarthgap Mako 1.3.2 rather
than master 1.4.1; the older release exposes applicable unpatched records.
(From OE-Core rev: d419d38614ad7dae149e005ac6183c0290f54b2d)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 76fc2046d3f251af34dd04f8fdcfc0c1d6016380)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
PLY 3.11 contains the picklefile parameter described by
CVE-2025-56005, but exploitation requires an application to
explicitly pass an attacker-controlled pickle file to yacc().
No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
the same reason [1], and NVD records the CVE as disputed [2].
[1] https://ubuntu.com/security/CVE-2025-56005
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
(From OE-Core rev: 9bce52b90a6783e0ba23ff048209ea88922fd1da)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- NVD marks CVE-2018-20225 as disputed. [1]
- pip searches all configured package indexes without priority and selects
the highest matching version. --extra-index-url adds an equal-priority
package source. [2]
- Exploitation requires use of --extra-index-url and an attacker-published,
higher-version package with the name of a private package. [1]
- Upstream closed the related report as not planned, and Red Hat classified
the issue as WONTFIX because this behavior is intentional. [3][4]
- Record the disputed status; no source patch is available.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225
[2] https://pip.pypa.io/en/stable/cli/pip_install/
[3] https://github.com/pypa/pip/issues/12874
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736
(From OE-Core rev: 34c0972ffea7dcf4888e3bcfe0ce17206b32e408)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When qemu test runs only produce suffixed bootlog variants, the base
bootlog path may not exist. os.symlink() creates a dangling symlink
in the oeqa result log directory.
Avoid advertising a boot log in the collected test results when that
path does not exist. Guard the symlink creation and log a note instead.
This is a partial backport of master commit
7a6596925cb0eb8dd48a0362a51875cdd60152bc. Only the symlink guard is
picked here; the bootlog variant globbing from master is not applicable
to scarthgap.
(From OE-Core rev: 6672769e251ab0dd42fc5f5cde99800ed5ba8289)
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This was introduced as a test for the fix in 6ec70d5d2e330b41b932b0a655b838a5f37df01e
however the way github works has changed in the decade since and this
test is no longer testing what was intended.
The test is failing intermittently on our infrastructure thanks to spam
and IP block throttling restrictions which lead to occasional failures.
At this point it is probably simplest just to drop the url from testing.
(Bitbake rev: 1b619d136c01c97ab1b76a75e8845cddc5e49735)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b59bdcf8134e6f5935e8f7b0ed8033cbb745e0ff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
We're having issues with github urls, switch many of the test repos to our own
mirror copies. Some mirror copies are modified to reduce their size and improve test
times. More needs to be done in that area!
(Bitbake rev: 931a230a28a0582552f098e97d94299f310fd2eb)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9dbf27b9fd04c40c87f25eb6cbd884db5c7f2160)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This single url takes 100s in each of the two tests it is used in,
compared to the fraction of a second for the other urls. Nobody
should really be using ftp any more anyway, drop this test url.
(Bitbake rev: 4b8695f0708f4da5ed16e97ae7bcfb69fdd1e3ed)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a181827fa0fe6738441b40b5206cc2cadb5f7dce)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The tools-profile feature was introduced in 2007 with eabfa35d7c
("Rewrite IMAGE_FEATURES tools options (people may be to update their
local.conf), split into debug and profiling and add more profiling
tools.") but was not documented. Add the feature to the list.
(From yocto-docs rev: 40952d60ef81203994bf385f4f75b5419e2356cb)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3c55d1af536c202d585e335bdcc417479d6e1ddc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The BBFILES is most likely never set by the local.conf file, but the
layer.conf file.
(From yocto-docs rev: ab632c9b814704af730b7f67153ef4124ade0118)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2f2cb936a285ef48b4f10698d19a3e934d1417f7)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
It's "FILESOVERRIDES" that defines how OE uses FILESPATH, not
"OVERRIDES".
(From yocto-docs rev: 7143ee49cab226d355d5fb8685bfe0456fcdfdd7)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 77ae9193d5793a92d6fc77db88dddbce54079fd3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
u-boot-tools builds host utilities from the same source as u-boot, but it
does not inherit the existing CVE_PRODUCT assignment and falls back to its
unrecognized recipe-name identity. Move the mapping to u-boot-common.inc
so both recipes inherit it.
Use "u-boot:u-boot" for the CNA/CVE List V5 affected-data identity and
"denx:u-boot" for the NVD dictionary CPE and configuration identity. The
CNA records are also covered by NVD today, but retaining both authoritative
identities permits direct matching independently of NVD enrichment.
(cherry picked from commit bc30a343627e2d207c38d2262a7b07f506259051)
(From OE-Core rev: 9170fe393c379b9161a8843506420269f5b53e40)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The related CVEs are tracked using pytest:py CPE, so set the CVE_PRODUCT
accordingly instead of the default python:py.
See CVE db query:
sqlite> select * from products where product like 'py';
CVE-2020-29651|pytest|py|||1.9.0|<=
CVE-2022-42969|pytest|py|||1.11.0|<=
(From OE-Core rev: 6a1595b2a8e41186c4120c90ef16a3309e1e2144)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1fac509459c4e2d970121b66ae33cd53ef1eb8a6)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: This is a cherry-pick from meta-openembedded]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Yoann Congal
Stefano Tondo
Darsh Kelaiya
Hemanth Kumar M D
Peter Marko
Vijay Anusuri
Hiago De Franco
Daniel Turull
Devansh Patel
Jakub Szczudlo (Nokia)
Hetvi Thakar
Hitendra Prajapati
Jaipaul Cheernam
Adarsh Jagadish Kamini
Peter Tatrai
Richard Purdie
Lee Chee Yang
Antonin Godard
Robert P. J. Day
Gyorgy Sarvari
Deepak Rathore