summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/dpkg
AgeCommit message (Collapse)Author
2021-01-16dpkg: add nativesdk supporthongxu
- Add nativesdk support and override EXTRA_OECONF and PROV for nativesdk - Replace ${bindir} with ${STAGING_BINDIR_NATIVE} for perl-native shebang to fix QA error of shebang too long in nativesdk build - Conditionally (except musl) add ldconfig to runtime depends to fix the following issue on target [snip] ... dpkg: warning: 'ldconfig' not found in PATH or not executable dpkg: error: 1 expected program not found in PATH or not executable Note: root's PATH should usually contain /usr/local/sbin, /usr/sbin and/sbin E: Sub-process /usr/bin/dpkg returned an error code (2) [snip] Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-18dpkg: upgrade 1.20.0 -> 1.20.5Richard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-12dpkg: change SRC_URI to take dpkg from gitChangqing Li
tar.xz on original URL have been removed, switch to use git Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-22dpkg-native: rebase and reinstate fix for "tar: file changed as we read it"Paul Eggleton
In OE-Core rev 8ee36a5f2f9367550d28bf271afc53bca6ff3d5f a patch was added for dpkg to ignore a return of 1 from dpkg's calls to tar (which indicates that files changed in some way while tar was operating) we were observing failures on the autobuilder due to changes to link counts in hard-linked file trees. The patch was subsequently rebased and then later removed during an upgrade in 3812f58b3a438ae533c282170416cdd1681868e0 on the assumption that the fix had been applied upstream, however that was not the case. I am now occasionally seeing these errors in my builds without any apparent material change to the files, so rebase and reinstate the patch. Fixes [YOCTO #13913]. Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2020-06-06dpkg: Remove workaound patch for host tar < 1.27Adrian Bunk
tar >= 1.28 is already required. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-03dpkg: upgrade 1.19.7 -> 1.20.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-03dpkg: Add riscv32 CPU supportKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-08dpkg: Provide update-alternative for start-stop-daemonJason Wessel
When using DISTRO_FEATURE usrmerge, busybox and something that requires dpkg-start-stop there is a conflict which prints the following error. === ERROR: core-image-minimal-1.0-r1 do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget_${PN} (). Deferring to first boot via 'exit 1' is no longer supported. Details of the failure are in /build/tmp-glibc/work/intel_x86_64-linux/core-image-minimal/1.0-r1/temp/log.do_rootfs. ERROR: core-image-minimal-1.0-r1 do_rootfs: Function failed: do_rootfs === Looking at the log file, it shows the problem: update-alternatives: Error: not linking /build/tmp-glibc/work/intel_x86_64-linux/core-image-minimal/1.0-r1/rootfs/usr/sbin/start-stop-daemon to /usr/bin/busybox.nosuid since /build/tmp-glibc/work/intel_x86_64-linux/core-image-minimal/1.0-r1/rootfs/usr/sbin/start-stop-daemon exists and is not a link === The solution is to add an update-alternative to start-stop-daemon for dpkg. Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-30dpkg: update to 1.19.7Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-19dpkg: Use less as pagerRicardo Ribalda Delgado
Debian traditionaly uses /usr/bin/pager as the system pager, which is a link to the user preferred pager. This is a Debianism. Without this patch: root@qt5122:~# dpkg -l sh: pager: command not found dpkg-query: error: showing package list on pager subprocess returned error exit status 127 Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-31dpkg: Remove workaround patches for no longer supported host distributionsAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25dpkg: 1.18.25 -> 1.19.4Kai Kang
Upgrade dpkg from 1.18.25 to 1.19.4: * update SRC_URI which DEBIAN_MIRROR * un-export PERL which causes script scripts/dpkg-architecture.pl fails to get cpu type and package arch * add configure option '--disable-update-alternatives' which causes installed-vs-shipped issue * add patch for dpkg-native to resolve host tar may not support options --owner=NAME:ID and --group=NAME:ID * update context of patches * drop dpkg-configure.service that apt provides a systemd timer to do it Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-03dpkg: Upgrade to 1.18.25Aníbal Limón
Removed (now in upstream), 0001-arch-Add-support-for-riscv64-CPU.patch Signed-off-by: Aníbal Limón <anibal.limon@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-20dpkg: Backport riscv supportKhem Raj
Refresh patches with devtool Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-12-10meta: fix malformed/missing Upstream-Status tagsRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-08dpkg: use snapshot.debian.orgRoss Burton
2017-09-13dpkg: Support muslx32 buildsweeaun
Modified ostable and tupletable to support muslx32 build. Signed-off-by: sweeaun <swee.aun.khor@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-23dpkg: Upgrade to 1.18.24Aníbal Limón
Patches rebased due to don't apply, no major changes, - 0002-Adapt-to-linux-wrs-kernel-version-which-has-characte.patch - arch_pm.patch - noman.patch Patches related to move ostable/triplettable insida data/ostable and data/tupletable instead also needs to comply the new format of the tables for arch detection. - 0006-add-musleabi-to-known-target-tripets.patch - add_armeb_triplet_entry.patch And finally a patch to avoid usage --clamp-mtime in tar needs to be modified because the dpkg-deb internal API changed. - 0007-dpkg-deb-build.c-Remove-usage-of-clamp-mtime-in-tar.patch Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-16dpkg-configure: do not reload daemon configurationMax Krummenacher
In case a systemd service disables itself while init is still in its boot sequence the reloading of the service files can be problematic. In that case: It seems that systemd looses the state of .device units, and some services depend on such units (namely serial consoles such as serial-getty@ttymxc0.service). As a result no getty is spawned on the affected serial tty. After a power-cycle the second boot (which does not disable services) succeeds. The following sequence shows this problem: | Jan 09 16:36:28 apalis-t30 systemctl[162]: Removed /etc/systemd/system/sysinit.target.wants/run-postinsts.service. | Jan 09 16:36:28 apalis-t30 systemd[1]: Reloading. | ... | And then the failing one: | Feb 22 15:33:15 apalis-t30 systemd[1]: dev-ttyS0.device: Job dev-ttyS0.device/start timed out. | Feb 22 15:33:15 apalis-t30 systemd[1]: Timed out waiting for device dev-ttyS0.device. | Feb 22 15:33:15 apalis-t30 systemd[1]: Dependency failed for Serial Getty on ttyS0. | Feb 22 15:33:15 apalis-t30 systemd[1]: serial-getty@ttyS0.service: Job serial-getty@ttyS0.service/start failed with result 'dependency'. | Feb 22 15:33:15 apalis-t30 systemd[1]: dev-ttyS0.device: Job dev-ttyS0.device/start failed with result 'timeout'. | Feb 22 15:33:15 apalis-t30 systemd[1]: Reached target Login Prompts. (the time has been updated between this two events, but that does not influence the issue) Using --no-reload in the service file avoids the "Reloading." message above and seems to not cause such issues anymore. Reported-by: Stefan Agner <stefan.agner@toradex.com> Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> (cherry picked from commit 94fabe4b03e899d8876027ee2ced649737a9e522) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-12dpkg: Add missing RDEPENDS for dpkg-perlTom Rini
In order to be able to use dpkg-perl on a system various stock perl modules must also be installed on the system. Create the list of required modules based on a read of the code and testing with additional utilities and list them in RDEPENDS_${PN}-perl. Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-06-12dpkg: Fix perl modules by moving them to the versioned perl directoryTom Rini
In order for the dpkg perl modules to be used the must reside in the versioned perl library directory (as to be in the default include path). Be explicit about this location in our FILES_${PN}-perl directive, so that if this breaks in the future, the recipe will fail). We can now drop the custom do_configure as it wasn't fixing this problem. Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-31dpkg: Add PACKAGECONFIG for liblzma and enable itRichard Purdie
liblzma is part of xz and we already build it but configure it out. This makes no sense. Enabling it means we gain multithreaded compression and it speeds dpkg-deb up massively. It also removes the fork overhead of separate xz processes. Turning the existing config into a PACKAGECONFIG and turning it on by default therefore makes best use of what we have available. The manual RDEPENDS are no longer needed since it uses liblzma which is picked up by the shlibs code magically. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-13run-postinsts: simplify the logic of whether to install it to imagesAlexander Kanavin
The logic is scattered all over the place, but amounts to "install, unless the rootfs is read only". Let's express that directly. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2017-03-01dpkg: Upgrade to 1.18.10Aníbal Limón
Add a patch to don't use --clamp-time when call tar because isn't supported in tar hosts versions. See 0007-dpkg-deb-build.c-Remove-usage-of-clamp-mtime-in-tar.patch patch for details. Rebased patch: - 0003-Our-pre-postinsts-expect-D-to-be-set-when-running-in.patch Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16meta: remove True option to getVar callsJoshua Lock
getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-28dpkg: Only set DEB_HOST_ARCH in target caseRichard Purdie
If we don't do this, the sstate checksums vary for dpkg-native depending on which MACHINE is set and this is clearly incorrect. It leads to dpkg-native rebuilding far too often. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-08-10dpkg: Avoid automatic target architecture detectionAlexandre Belloni
dpkg is using a script (dpkg-architecture.pl) to detect the target architecture automatically. Unfortunately, it is using the cross compiler prefix to do the detection and for ARM, oe-core is using <vendor>-linux-gnueabi for toolchains with and without call-convention hard. The script then always detects 'armel' and never gets 'armhf' for call-convention hard. This solves: dpkg: error processing archive evtest_1.32+0+b8343ec112-r0_armhf.deb (--install): package architecture (armhf) does not match system (armel) Errors were encountered while processing: evtest_1.32+0+b8343ec112-r0_armhf.deb Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-04dpkg: put start-stop-daemon into a separate packageJoe Slater
This is useful for supplying start-stop-daemon to images that do not include busybox. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-26dpkg: use snapshot.debian.org for SRC_URIRoss Burton
Using ${DEBIAN_MIRROR} for SRC_URI doesn't work very well as that will only contain releases that are currently in Debian, so currently doesn't contain 1.18.7 as unstable has moved on to 1.18.9. So, move all of SRC_URI to the .bb so it can use snapshot.debian.org instead, and set UPSTREAM_CHECK_URI to ${DEBIAN_MIRROR} so upstream release checking continues to work. Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-03dpkg: Upgrade to 1.18.7Aníbal Limón
Rebased patches: 0003-Our-pre-postinsts-expect-D-to-be-set-when-running-in.patch add_armeb_triplet_entry.patchadd_armeb_triplet_entry.patch Patches removed already in upstream: [1] 0001-When-running-do_package_write_deb-we-have-trees-of-h.patch [2] fix-abs-redefine.patch Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> [1] https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/build.c?id=7a91341446851cd3594a8b752823b8c1f26d652a [2] https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/lib/dpkg/i18n.h?id=ecd4baa091619cbbdd70043129dd992573580371 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-07dkpg: Use tar everywhere (not gtar)Richard Purdie
All our systems usually have tar, if we want the native sstate to work universally, we need to prefer this. This avoids a system with gtar causing dpkg-native to use it and it not being present on some systems. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18dpkg: Update to 1.18.4Marek Vasut
Update dpkg version to 1.18.4 . This adds nios2 architecture support among other fixes. One patch was updated so it would apply to 1.18.4. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Alexander Kanavin <alexander.kanavin@linux.intel.com> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Cc: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-29dpkg: fix CVE-2015-0860Catalin Enache
Backported and cherry picked upstream commit: https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?h=wheezy&id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-22dpkg: Add musleabi to known architecturesKhem Raj
Remove a glibc specific patch to be applied only for native version, this is a dpkg-native specific patch needed for Centos 5.8, this patch should be redone to be glibc independent for it to be applied to all types of dpkg recipes Signed-off-by: Khem Raj <raj.khem@gmail.com>
2015-09-01dpkg: update to 1.18.2Alexander Kanavin
check_snprintf.patch has been dropped, because it seems to fix a problem that doesn't anymore exist, and doesn't have any description of what the problem was and how was it fixed. tarfix.patch has been merged upstream. The rest of the patches have been rebased to the new upstream release Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-13dpkg: Fix for Fedora22 and new versions of tarRichard Purdie
They managed to 'break' tar. Again. Sorry, they fixed a regression which broke dpkg-deb. The addition of: http://git.savannah.gnu.org/cgit/tar.git/commit/?id=163e96a0e619a900eab6de827c7c5749ecc9d3f2 ("Bugfix: entries read from the -T file did not get proper matching_flag.") means that the no-recursion option gets lost. This leads to many files getting included multiple times, along with files which shouldn't be there. The commit message is horrendous. The patch actually makes the option positional (as documnted since 2003) and therefore doesn't affect the input from the -T option. Moving the --no-reursion option to earlier in the command avoids the bug. The bug was not present in tar 1.28 however it has been backported in at least Fedora 22 and heading into Fedora 21. Redhat reports of issue: https://bugzilla.redhat.com/show_bug.cgi?id=1230762 [tar] https://bugzilla.redhat.com/show_bug.cgi?id=1241508 [dpkg] Discussion of bug in upstream tar: http://www.mail-archive.com/bug-tar@gnu.org/msg04799.html [YOCTO #7988] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-07dpkg: fix typo in tar-error-code.patch, Upsteam -> UpstreamAndre McCurdy
Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-30dpkg: upgrade to 1.17.25Roy Li
upgrade to fix two CVE defects: CVE-2014-8625 and CVE-2015-0840 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8625 Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0840 The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc). Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-09dpkg: add triplet entry to fix build error for armebKrishnanjanappa, Jagadeesh
Cross-compling dpkg application for armeb fails with below error during configure task, (snip) configure:23141: checking dpkg cpu type configure:23148: result: armeb configure:23150: WARNING: armeb not found in cputable configure:23162: checking dpkg operating system type configure:23169: result: linux-gnueabi configure:23171: WARNING: linux-gnueabi not found in ostable configure:23183: checking dpkg architecture name configure:23189: error: cannot determine host dpkg architecture -- CUT -- Add the required combination of "gnueabi-linux-armeb" entry in triplet list. Signed-off-by: Krishnanjanappa, Jagadeesh <jagadeesh.krishnanjanappa@caviumnetworks.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-31dpkg-native: Avoid 'file changed' errors from tarRichard Purdie
Hardlink count duing do_package_write_deb can change causing dpkg-deb failures. We don't care about this error case so avoid it by checking the tar exit code. [YOCTO #7529] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-24dpkg: Don't move update-alternatives to sbindirAndreas Oberritter
Debian, Ubuntu and opkg all have it in bindir. Signed-off-by: Andreas Oberritter <obi@opendreambox.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-23recipes: Delete superfluous assignments, S = ${WORKDIR}/${BP}Robert P. J. Day
Given that bitbake.conf sets the default values: BP = "${BPN}-${PV}" S = "${WORKDIR}/${BP}" there are a number of recipes that set the variable S completely superfluously, so get rid of them. Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-14meta: enable parallel build for several recipesRobert Yang
I used a for loop to build these packages more than 520 times, these recipes never failed. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-02-03dpkg: add perl to RDEPENDSRobert Yang
perl scripts: packages-split/dpkg/usr/bin/dpkg-parsechangelog:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-mergechangelogs:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-architecture:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-vendor:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-shlibdeps:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-scanpackages:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-buildpackage:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-genchanges:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-gensymbols:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-distaddfile:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-buildflags:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-checkbuilddeps:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-gencontrol:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-scansources:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-source:#!/usr/bin/perl packages-split/dpkg/usr/bin/dpkg-name:#!/usr/bin/perl packages-split/dpkg/usr/lib/dpkg/parsechangelog/debian:#!/usr/bin/perl Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-01-29dpkg: fix host contaminationDan McGregor
Force dpkg to use "tar" on the target. The dpkg configure script looks for gnutar, gtar, and tar in order. If it finds gnutar or gtar on the host it expects to use that as its tar program on the target. Without this, if gtar exists (as it does on my system) then dpkg will consistently fail on the target with an error about gtar not being found. Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-12-25dpkg: Upgrade to 1.17.21Aníbal Limón
Remove dpkg-1.17.4-CVE-2014-0471, dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127 and ignore_extra_fields patches that are already in upstream. Rebase no-vla-warning patch. Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-17dpkg: Security Advisory - CVE-2014-3127Guillem Jover
v2 changes: * update format for commit log * add Upstream-Status for patch commit a12eb58959d0a10584a428f4a3103a49204c410f upstream Dpkg::Source::Patch: Outright reject C-style filenames in patches Because patch only started recognizing C-style filenames in diffs in version 2.7, it's not safe to assume one behaviour or the other, as the system might or might not have a recent enough version, or a GNU patch program at all. There's also no reason we should be supporting this kind of strange encoded filenames in patches, when we have not done so up to now. Let's just ban these types of diffs and be done with it. Fixes: CVE-2014-0471, CVE-2014-3127 Closes: #746306 [drop the text for debian/changelog,because it's not suitable for the veriosn] Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-17dpkg: Security Advisory - CVE-2014-0471Guillem Jover
v2 changes: * update format for commit log * add Upstream-Status for patch commit a82651188476841d190c58693f95827d61959b51 upstream Dkpkg::Source::Patch: Correctly parse C-style diff filenames We need to strip the surrounding quotes, and unescape any escape sequence, so that we check the same files that the patch program will be using, otherwise a malicious package could overpass those checks, and perform directory traversal attacks on source package unpacking. Fixes: CVE-2014-0471 Reported-by: Jakub Wilk <jwilk@debian.org> [drop the text for debian/changelog,because it's not suitable for the veriosn] Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-25Globally replace 'base_contains' calls with 'bb.utils.contains'Otavio Salvador
The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-25Globally replace oe.utils.contains to bb.utils.containsOtavio Salvador
BitBake has the exact same code as oe.utils.contains so there's no reason to duplicate it. We now rely on the bb.utils.contains code for metadata. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>