aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-05-08python3-gcovr: Add missing runtime dependencylangdale-nextlangdaleJasper Orschulko
python3-gcovr requires standard python module multiprocessing as runtime dependency. Upstream-Status: Inappropriate [configuration] Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5564dbb8ff22d9ca4296a68f92f3c9d05fbdf99f) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 2c543c3698ef54eece61d6fb6e5f3e5483ab7a97) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-08meta-networking/licenses/netperf: remove unused licenseArsalan H. Awan
This removes the old unused license for netperf as upstream moved to using the MIT license for netperf. See: meta-openembedded commit 587fe5877790b6c2e1d337c351b8f50603ad4db9 Signed-off-by: Arsalan H. Awan <arsalan.awan@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 27bdecd1bcf1fa86bf4ebbc527fceb455efe2970) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06apache2: upgrade 2.4.56 -> 2.4.57Valeria Petrov
Changelog: Changes with Apache 2.4.57 *) mod_proxy: Check before forwarding that a nocanon path has not been rewritten with spaces during processing. [Yann Ylavic] *) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not double encode encoded slashes in the URL sent by the reverse proxy to the backend. [Ruediger Pluem] *) mod_http2: fixed a crash during connection termination. See PR 66539. [Stefan Eissing] *) mod_rewrite: Fix a 2.4.56 regression for substitutions ending in a question mark. PR66547. [Eric Covener] *) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded characters on redirections without the "NE" flag. [Yann Ylavic, Eric Covener] *) mod_proxy: Fix double encoding of the uri-path of the request forwarded to the origin server, when using mapping=encoded|servlet. [Yann Ylavic] *) mod_mime: Do not match the extention against possible query string parameters in case ProxyPass was used with the nocanon option. [Ruediger Pluem] New patch: 0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch Accepted in upstream, expected to be removed at next apache2 2.4.58 update. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0b9305faa29f6e26871e7662391efbaae4ae92d9) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-22redis: upgrade 7.0.9 -> 7.0.10Changqing Li
Upgrade urgency: SECURITY, contains fixes to security issues. Security Fixes: * (CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and denial-of-service Bug Fixes ========= * Large blocks of replica client output buffer may lead to psync loops and unnecessary memory usage (#11666) * Fix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875) * Trim excessive memory usage in stream nodes when exceeding `stream-node-max-bytes` (#11885) * Fix module RM_Call commands failing with OOM when maxmemory is changed to zero (#11319) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b589edf930977dbd75418e05d618a8047982dd59) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18dleyna-{server,renderer}: fix dev-so QA issue with multilibMartin Jansa
* the libdir is arch specific, but the subdirectory is always BPN * fixes: lib32-dleyna-server-0.6.0+gitAUTOINC+eb895ae827: non -dev/-dbg/nativesdk- package lib32-dleyna-server contains symlink .so '/usr/lib/dleyna-server/libdleyna-server-1.0.so' [dev-so] lib32-dleyna-renderer-0.6.0: non -dev/-dbg/nativesdk- package lib32-dleyna-renderer contains symlink .so '/usr/lib/dleyna-renderer/libdleyna-renderer-1.0.so' [dev-so] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18lirc: fix do_install with multilibMartin Jansa
* use ${S} instead of ${WORKDIR}/${PN}-${PV} and ${BP} instead of ${PN}-${PV} to fix build with multilib, where PN is lib32-lirc, but S is correctly set as ${WORKDIR}/${BP} and do_install fails with: mkdir: cannot create directory ‘lib32-lirc/0.10.1-r0/lib32-lirc-0.10.1/python-pkg/dist/’: No such file or directory Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18lvgl,lv-lib-png,lv-drivers: fix installed-vs-shipped QA issue with multilibMartin Jansa
* with multilib BASELIB is just "lib" while baselib is "lib64" and libdir is "/usr/lib64". * fixes: ERROR: QA Issue: lvgl: Files/directories were installed but not shipped in any package: /usr/lib /usr/lib/liblvgl.a Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. lvgl: 2 installed and not shipped files. [installed-vs-shipped] * lowercase baselib should work for ppc64 as well (I hope) # $baselib [3 operations] # set oe-core/meta/conf/bitbake.conf:10 # "${BASELIB}" # set oe-core/meta/conf/bitbake.conf:11 # [vardepvalue] "${baselib}" # set oe-core/meta/conf/multilib.conf:2 # "${@d.getVar('BASE_LIB:tune-' + (d.getVar('DEFAULTTUNE') or 'INVALID')) or d.getVar('BASELIB')}" # pre-expansion value: # "${@d.getVar('BASE_LIB:tune-' + (d.getVar('DEFAULTTUNE') or 'INVALID')) or d.getVar('BASELIB')}" baselib="lib64" * simplify destsuffix/S setting * I was surprised that ${WORKDIR}/${PN}-${PV} works in multilib build but then I've noticed that it's because destsuffix is set to S which is a bit uncommon, so drop that and use default "git" * use ${STAGING_INCDIR} instead of ${RECIPE_SYSROOT}/${includedir} Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18pahole: respect libdirMartin Jansa
* use the same expression as cmake.bbclass is using: CMAKE_INSTALL_LIBDIR:PATH=${@os.path.relpath(d.getVar('libdir'), d.getVar('prefix') + '/')} but ${baselib} should work here as well Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18mongodb: fix chown user for multilib buildsMartin Jansa
* the user is named mongodb (BPN) and in multilib builds this fails with: chown: invalid user: 'lib32-mongodb:lib32-mongodb' Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18restinio: fix S variable in multilib buildsMartin Jansa
* do_populate_lic as well as do_configure fails in multilib builds, because S points to empty: lib32-restinio/0.6.13-r0/lib32-restinio-0.6.13/dev Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-18openwsman: Change download branch from master to main.Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-13zsh: fix installed-vs-shipped with multilibMartin Jansa
* fixes: lib32-zsh-5.8: lib32-zsh: Files/directories were installed but not shipped in any package: /usr/share/lib32-zsh /usr/share/lib32-zsh/5.8 /usr/share/lib32-zsh/site-functions /usr/share/lib32-zsh/5.8/functions /usr/share/lib32-zsh/5.8/functions/_selinux_users ... 1000+ lines ... /usr/share/lib32-zsh/5.8/functions/VCS_INFO_bydir_detect Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. lib32-zsh: 1116 installed and not shipped files. [installed-vs-shipped] * they will clash if someone is trying to install both zsh and lib32-zsh, but it's not very likely as nobody sane was building lib32-zsh with 1000+ line warning regularly Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-25dnsmasq: fix CVE-2023-28450Peter Marko
The patch is modified by removing irrelevant and conflicting CHANGELOG entry. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-25c-ares: fix CVE-2022-4904Peter Marko
Backport based on https://github.com/c-ares/c-ares/issues/496 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-21mbedtls: upgrade to 2.28.2 to fix CVE-2022-46392, CVE-2022-46393Stefan Ghinea
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller. An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. References: https://nvd.nist.gov/vuln/detail/CVE-2022-46392 https://nvd.nist.gov/vuln/detail/CVE-2022-46393 Upstream patches: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2ab113e8be42ae2dd61babb8e9a1742684df1f59) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-16ntp: whitelist CVE-2019-11331Peter Marko
Links from https://nvd.nist.gov/vuln/detail/CVE-2019-11331 lead to conclusion that this is how icurrent ntp protocol is designed. New RFC is propsed for future but it will not be compatible with current one. See https://support.f5.com/csp/article/K09940637 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-16apache2: upgrade 2.4.55 -> 2.4.56Wang Mingyu
Changelog: ========== - rotatelogs: Add -T flag to allow subsequent rotated logfiles to be truncated without the initial logfile being truncated. - mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to allow connections of any age to be reused. Up to now, a negative value was handled as an error when parsing the configuration file. PR 66421. - mod_proxy_ajp: Report an error if the AJP backend sends an invalid number of headers. - mod_md: - Enabling ED25519 support and certificate transparency information when building with libressl v3.5.0 and newer. - MDChallengeDns01 can now be configured for individual domains. - Fixed a bug that caused the challenge teardown not being invoked as it should. - mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors reported in access logs and error documents. The processing of the reset was correct, only unneccesary reporting was caused. - mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f8b54b5243c9effb66d5685463b87767e753b843) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-16apache2: use /run instead of /var/run for systemd volatile configYi Zhao
Fixes: systemd-tmpfiles[181]: /etc/tmpfiles.d/apache2-volatile.conf:1: Line references path below legacy directory /var/run/, updating /var/run/apache2 -> /run/apache2; please update the tmpfiles.d/ drop-in file accordingly. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f018a6bb3b8400a19cd35b76809edcd545975465) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-12nodejs: Upgrade 16.19.0 -> 16.19.1Polampalli, Archana
The following CVEs fixed in this version: CVE-2023-23918 CVE-2023-23919 CVE-2023-23920 CVE-2023-23936 CVE-2023-24807 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-07redis: Upgrade 7.x to 7.0.9Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6f351de04e2eb900dcddb866013dd27923dc150a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-07redis: Upgrade 6.x recipe to 6.2.11Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-07php: Upgrade to 8.1.16Mingli Yu
Upgrade php to 8.1.16 [1]. [1] https://www.php.net/ChangeLog-8.php#8.1.16 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c20ae41fb9bdc8b6f0e3293ee9a2ce63a52e883d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-07nlohmann-json: Allow empty main package for SDKTom Hochstein
The header-only package cannot be included in the SDK without marking the main package with ALLOW_EMPTY. Fixes rootfs problem: ``` The following packages have unmet dependencies: imx-gpu-sdk : Depends: nlohmann-json but it is not installable E: Unable to correct problems, you have held broken packages. ``` Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f9c9e7a448b9d9f7d54bbf09970223db467eedb2) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-04mpd: Upgrade to 0.23.12 releaseKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ba5a86a51a459581d8f39afd95ddd27cca5def83) Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-04ncmpc: Upgrade to 0.47Khem Raj
Backport a patch to fix c++17 build with clang Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9b6baed24d5efe0820266ccf3567bcff42701a01) Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22python3-pillow: add tk to RDEPENDS ptest pkg only if x11 in DISTRO_FEATURESGeoff Parker
commit 7b0e71e00 ("python3-pillow: add ptest support", 2023-01-31) added tk to RDEPENDS:${PN}-ptest. Which cause this error on non x11 builds: ERROR: Nothing RPROVIDES 'tk' (but meta-openembedded/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb RDEPENDS on or otherwise requires it) tk was skipped: missing required distro feature 'x11' (not in DISTRO_FEATURES) NOTE: Runtime target 'tk' is unbuildable, removing... Missing or unbuildable dependency chain was: ['tk'] NOTE: Runtime target 'iotmanager' is unbuildable, removing... Missing or unbuildable dependency chain was: ['iotmanager', 'python3-pillow', 'tk'] ERROR: Required build target 'update-runtime' has no buildable providers. Missing or unbuildable dependency chain was: ['update-runtime', 'runtime-image', 'iotmanager', 'python3-pillow', 'tk'] Add tk dependency only if DISTRO_FEATURES includes x11 (cherry picked from commit 6e8c90560e0aa8fe2ebfb791985cb75fd7490527) Signed-off-by: Geoff Parker <geoffrey.parker@arthrex.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22multipath-tools: fix CVE-2022-41974Yogita Urade
Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-41974 NOTE: The actual fixes for this CVE are upstream commits [1] and [2]. However, they are part of a larger patchset which has a lot of dependencies and cannot be backported easily to older multipath-tools versions. Upstream discussion [3] indicates that there is a custom patch available for old versions ([4]). Ubuntu, Debian and Suse applied this patch to their 0.7.xx and 0.8.xx releases ([4], [5]), so we add it as well. [1] https://github.com/opensvc/multipath-tools/commit/f812466f68b8e020818c6454d7b7a7e278bc99f6 [2] https://github.com/opensvc/multipath-tools/commit/d139bcf0842bc0a16beab86e1349ed65b150bf0c [3] https://github.com/opensvc/multipath-tools/issues/59 [4] https://github.com/openSUSE/multipath-tools/commit/fbbf280a0e26026c19879d938ebb2a8200b6357c [5] http://launchpadlibrarian.net/634132876/multipath-tools_0.7.4-2ubuntu3.1_0.7.4-2ubuntu3.2.diff.gzwq Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-15mdns: use git fetcherMartin Jansa
* https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-${PV}.tar.gz is just redirect to unsafe github archives which are regenerated from time to time. * We do have src-uri-bad QA check which prevents to use github archives in SRC_URI since 2019: https://github.com/openembedded/openembedded-core/commit/21f84fcdd659544437fe393285c407e1e9432043 but this cannot catch such redirects, see: $ wget https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-878.30.4.tar.gz --2023-01-31 10:06:02-- https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-878.30.4.tar.gz Resolving opensource.apple.com (opensource.apple.com)... 17.253.73.203, 17.253.73.206, 2a01:b740:a26:f000::5, ... Connecting to opensource.apple.com (opensource.apple.com)|17.253.73.203|:443... connected. HTTP request sent, awaiting response... 302 Redirect Location: https://github.com/apple-oss-distributions/mDNSResponder/archive/refs/tags/mDNSResponder-878.30.4.tar.gz [following] --2023-01-31 10:06:02-- https://github.com/apple-oss-distributions/mDNSResponder/archive/refs/tags/mDNSResponder-878.30.4.tar.gz Resolving github.com (github.com)... 140.82.121.3 Connecting to github.com (github.com)|140.82.121.3|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://codeload.github.com/apple-oss-distributions/mDNSResponder/tar.gz/refs/tags/mDNSResponder-878.30.4 [following] --2023-01-31 10:06:02-- https://codeload.github.com/apple-oss-distributions/mDNSResponder/tar.gz/refs/tags/mDNSResponder-878.30.4 Resolving codeload.github.com (codeload.github.com)... 140.82.121.10 Connecting to codeload.github.com (codeload.github.com)|140.82.121.10|:443... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [application/x-gzip] Saving to: ?mDNSResponder-878.30.4.tar.gz? * The tarball was regenerated recently as discussed in: https://github.com/orgs/community/discussions/45830 * Use top-level directory in S to fix DEBUG_PREFIX_MAP usage like the version in master does, the only exception here is that there still was top-level Makefile (which fails to set VER with: Makefile:26: *** missing separator. Stop. so use the simple one like newer version in master) * it's already included in master as part of version upgrade in: https://github.com/openembedded/meta-openembedded/commit/ec96eb577bd518b89e2e7834bd569ba269df458f Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-15exiv2: fix SRC_URIMartin Jansa
* https://exiv2.org/releases returns 404 now, use github releases * it's already fixed in master with upgrade to 0.27.6 in: https://git.openembedded.org/meta-openembedded/commit/?id=00a7d4b284c1afccfa26021111384d2184b82e5b Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11tinyproxy: fix CVE-2022-40468Chee Yang Lee
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 795ccdd86cad05c425adae15af27797f42f33c56) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11phoronix-test-suite: fix CVE-2022-40704Joe Slater
CVE fix added after latest release (10.8.4). Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 32a0ff55166ae67931d48825e669893718663040) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11net-snmp: CVE-2022-44792 & CVE-2022-44793 Fix NULL Pointer ExceptionNarpat Mali
References: https://nvd.nist.gov/vuln/detail/CVE-2022-44792 https://nvd.nist.gov/vuln/detail/CVE-2022-44793 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5ae6f9434f44a57389a3f52dce17da6fe5928e1f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11net-snmp: Fix build with clang16Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ee0de616df82937191613c85f9df7e872b99ed6f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-django: upgrade 4.1.3 -> 4.1.6Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c3b0591ddd0c65bc9a75a06dc599a7e90c760dbb) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-django: upgrade 4.1 -> 4.1.3Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1e4fd5514d2daf4b9b233bed42683aebc78d9fcf) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11apache2: upgrade 2.4.54 -> 2.4.55Wang Mingyu
Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.55 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cba6df61c7cbc4446aab09eb11673bcb6c581307) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11freeradius: Security fixes for CVE-2022-41860 CVE-2022-41861Yi Zhao
CVE-2022-41860: In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash. CVE-2022-41861: A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. References: https://nvd.nist.gov/vuln/detail/CVE-2022-41860 https://nvd.nist.gov/vuln/detail/CVE-2022-41861 Patches from: CVE-2022-41860: https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a32e107d4d02f936051c708 CVE-2022-41861: https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e08e4c3464f6b95005821dc559c62 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-pillow: Add distutils, unixadmin for ptestRandy MacLeod
ptest results: ====== 3600 passed, 324 skipped, 2 xfailed, 1 xpassed in 74.41s (0:01:14) ====== for qemux86-64 with 2 GB RAM which is the same as seen on master. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-pillow: add ptest supportRandy MacLeod
Add initial pillow ptest support. The ptest result is: ====== 3600 passed 324 skipped, 2 xfailed, 1 xpassed in 62.41s (0:01:02) ====== for qemux86-64 with 2 GB RAM. The skipped tests as summarized with: # ptest-runner python3-pillow | tee log # grep SKIPP log | cut -d"(" -f2- | cut -d")" -f1 | cut -d" " -f1 | sort | uniq -c| sort -n | tail -4 12 webp 13 Tk 14 Qt 84 raqm Webp was explicityly disabled in 2018 in: 6cb4e90fc python3-pillow: add 5.4.1 I didn't test Tk or Qt and there isn't yet a recipe for libraqm: https://github.com/HOST-Oman/libraqm a library that encapsulates the logic for complex text layout. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7b0e71e00ce1b003c96ef38ead72a9e02555afbe) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-pillow: upgrade 9.3.0 -> 9.4.0Wang Mingyu
License-Updated: copyright year updated to 2023 Changelog: ========== Fixed null pointer dereference crash with malformed font #6846 Return from ImagingFill early if image has a zero dimension #6842 Reversed deprecations for Image constants, except for duplicate Resampling attributes #6830 Improve exception traceback readability #6836 Do not attempt to read IFD1 if absent #6840 Fixed writing int as ASCII tag #6800 If available, use wl-paste or xclip for grabclipboard() on Linux #6783 Added signed option when saving JPEG2000 images #6709 Patch OpenJPEG to include ARM64 fix #6718 Added support for I;16 modes in putdata() #6825 Added conversion from RGBa to RGB #6708 Added DDS support for uncompressed L and LA images #6820 Added LightSource tag values to ExifTags #6749 Fixed PyAccess after changing ICO size #6821 Do not use EXIF from info when saving PNG images #6819 Fixed saving EXIF data to MPO #6817 Added Exif hide_offsets() #6762 Only compare to previous frame when checking for duplicate GIF frames while saving #6787 Always initialize all plugins in registered_extensions() #6811 Ignore non-opaque WebP background when saving as GIF #6792 Only set tile in ImageFile __setstate__ #6793 When reading BLP, do not trust JPEG decoder to determine image is CMYK #6767 Added IFD enum to ExifTags #6748 Fixed bug combining GIF frame durations #6779 Support saving JPEG comments #6774 Added getxmp() to WebPImagePlugin #6758 Added "exact" option when saving WebP #6747 Use fractional coordinates when drawing text #6722 Fixed writing int as BYTE tag #6740 Added MP Format Version when saving MPO #6735 Added Interop to ExifTags #6724 CVE-2007-4559 patch when building on Windows #6704 Fix compiler warning: accessing 64 bytes in a region of size 48 #6714 Use verbose flag for pip install #6713 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b73867b9d77e8050c20dc28ec449572f2185cb2a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11python3-pillow: upgrade 9.2.0 -> 9.3.0Wang Mingyu
Changelog: ========= Limit SAMPLESPERPIXEL to avoid runtime DOS #6700 [wiredfool] Initialize libtiff buffer when saving #6699 [radarhere] Inline fname2char to fix memory leak #6329 [nulano] Fix memory leaks related to text features #6330 [nulano] Use double quotes for version check on old CPython on Windows #6695 [hugovk] Remove backup implementation of Round for Windows platforms #6693 [cgohlke] Fixed set_variation_by_name offset #6445 [radarhere] Fix malloc in _imagingft.c:font_setvaraxes #6690 [cgohlke] Release Python GIL when converting images using matrix operations #6418 [hmaarrfk] Added ExifTags enums #6630 [radarhere] Do not modify previous frame when calculating delta in PNG #6683 [radarhere] Added support for reading BMP images with RLE4 compression #6674 [npjg, radarhere] Decode JPEG compressed BLP1 data in original mode #6678 [radarhere] Added GPS TIFF tag info #6661 [radarhere] Added conversion between RGB/RGBA/RGBX and LAB #6647 [radarhere] Do not attempt normalization if mode is already normal #6644 [radarhere] Fixed seeking to an L frame in a GIF #6576 [radarhere] Consider all frames when selecting mode for PNG save_all #6610 [radarhere] Don't reassign crc on ChunkStream close #6627 [wiredfool, radarhere] Raise a warning if NumPy failed to raise an error during conversion #6594 [radarhere] Show all frames in ImageShow #6611 [radarhere] Allow FLI palette chunk to not be first #6626 [radarhere] If first GIF frame has transparency for RGB_ALWAYS loading strategy, use RGBA mode #6592 [radarhere] Round box position to integer when pasting embedded color #6517 [radarhere, nulano] Removed EXIF prefix when saving WebP #6582 [radarhere] Pad IM palette to 768 bytes when saving #6579 [radarhere] Added DDS BC6H reading #6449 [ShadelessFox, REDxEYE, radarhere] Added support for opening WhiteIsZero 16-bit integer TIFF images #6642 [JayWiz, radarhere] Raise an error when allocating translucent color to RGB palette #6654 [jsbueno, radarhere] Added reading of TIFF child images #6569 [radarhere] Improved ImageOps palette handling #6596 [PososikTeam, radarhere] Defer parsing of palette into colors #6567 [radarhere] Apply transparency to P images in ImageTk.PhotoImage #6559 [radarhere] Use rounding in ImageOps contain() and pad() #6522 [bibinhashley, radarhere] Fixed GIF remapping to palette with duplicate entries #6548 [radarhere] Allow remap_palette() to return an image with less than 256 palette entries #6543 [radarhere] Corrected BMP and TGA palette size when saving #6500 [radarhere] Do not call load() before draft() in Image.thumbnail #6539 [radarhere] Copy palette when converting from P to PA #6497 [radarhere] Allow RGB and RGBA values for PA image putpixel #6504 [radarhere] Removed support for tkinter in PyPy before Python 3.6 #6551 [nulano] Do not use CCITTFaxDecode filter if libtiff is not available #6518 [radarhere] Fallback to not using mmap if buffer is not large enough #6510 [radarhere] Fixed writing bytes as ASCII tag #6493 [radarhere] Open 1 bit EPS in mode 1 #6499 [radarhere] Removed support for tkinter before Python 1.5.2 #6549 [radarhere] Allow default ImageDraw font to be set #6484 [radarhere, hugovk] Save 1 mode PDF using CCITTFaxDecode filter #6470 [radarhere] Added support for RGBA PSD images #6481 [radarhere] Parse orientation from XMP tag contents #6463 [bigcat88, radarhere] Added support for reading ATI1/ATI2 (BC4/BC5) DDS images #6457 [REDxEYE, radarhere] Do not clear GIF tile when checking number of frames #6455 [radarhere] Support saving multiple MPO frames #6444 [radarhere] Do not double quote Pillow version for setuptools >= 60 #6450 [radarhere] Added ABGR BMP mask mode #6436 [radarhere] Fixed PSDraw rectangle #6429 [radarhere] Raise ValueError if PNG sRGB chunk is truncated #6431 [radarhere] Handle missing Python executable in ImageShow on macOS #6416 [bryant1410, radarhere] Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4e075c7dc81c4d2824094f9d3523cf16719be9a7) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11nss: fix cross-compilation errorDmitry Baryshkov
Change OS_TEST to be soft assignment so that the cross-compilation doens't fail with the errors like (note the difference in CPU tags): | make[4]: *** No rule to make target '../certhigh/Linux3.4_x86_64_glibc_PTH_64_OPT.OBJ/certhtml.o', needed by 'Linux3.4_aarch64_glibc_PTH_64_OPT.OBJ/libnss3.so'. Stop. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-04nodejs: upgrade 16.18.1 -> 16.19.0Tim Orling
* 16.18.0 (npm 8.19.2) introduced a regression in git+ssh urls - https://github.com/nodejs/node/issues/44992 - https://github.com/npm/cli/pull/5761 https://nodejs.org/ko/blog/release/v16.19.0/ License-Update: Clarify vendored OpenSSL Toolkit is OpenSSL and SSLeay License-Update: JS Foundation -> OpenJS Foundation https://github.com/nodejs/node/commit/e7ed56f501389978e4619ab697a812631c4061ff Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-23perfetto: Do not pass TUNE_CCARGS to native/host compilerKhem Raj
TUNE_CCARGS are meant to be passed to target compilers only. This fixes build failures seen on qemux6 Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Markus Volk <f_l_k@t-online.de> (cherry picked from commit 90ea68fc11181a62741e4ca79dfef0fefe48cb41) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-23perfetto: pass TUNE_CCARGS to use machine tuneMarkus Volk
We already tried to pass -mfloat-abi=hard if the machine can use it, but since no floating-point-unit was defined it got stubbed out and the result was, that only arm targets configured for softfp were able to build perfetto. Simplify by passing ${TUNE_CCARGS} to ensure, we always use the features, the machine was configured for. Also, do not use sed to remove the hardcoded -mfpu=neon entry. If this really turns out to be problematic, we need to patch it out to avoid not having a floating-point-unit again. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c23bde86d0bcba3acc677bc4cd3240a8b3116921) [Fixes build failure] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-21strongswan: upgrade 5.9.8 -> 5.9.9Yi Zhao
Changelog: https://github.com/strongswan/strongswan/releases/tag/5.9.9 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6cca42d726c333b5955c6f4e46395b9578efce2e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-21sshpass: Use SPDX identified string for GPLv2Khem Raj
Fixes QA Issue: Recipe LICENSE includes obsolete licenses GPLv2 [obsolete-license] Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bb9672b8c5a8df645f420bd0ce8092800fa61e73) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-21openwsman: upgrade 2.7.1 -> 2.7.2Wang Mingyu
Changelog: ========== - Security - call setgroups before setuid or setgid - harden systemd service (https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort) - Bugfixes - wsman-win-client-transport: initialize certificate pointer - iniparser: fix buffer size - wsman-win-client-transport: plug leak in error path - memory.c: fix memory cleanup - Improve handling of HTTP 401 Unauthorized - Fix serialization tests - Fix Ruby bindings warnings - Fix Ruby plugin loading test - Fix rpm packaging - Allow to run tests from 'build' directory - Add Python XML test - Enable CUNIT tests Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bdbb3eeb2bfaf2a03dd6ab2a2024775ab28306a7) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-21fluidsynth: update SRC_URI to remove non-existing 2.2.x branchPreeti Sachan
Remove branch 2.2.x from SRC_URI as fluidsynth github removed the branch. The SRCREV is on master branch. Signed-off-by: Preeti Sachan <preeti.sachan@intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 534d04af483d5f3d4fc73162c110449f169677a5) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-21networkmanager: fix /etc/resolv.conf handlingChen Qi
The current handling of /etc/resolv.conf by NM has some problems. When networkd is not configuring network, and there's 'ip=dhcp' in kernel command line, the /run/NetworkManager/resolv.conf file is not created, resulting in /etc/resolv.conf being a dead symlink. This is because NM is treating the network interface as externally configured and will not try to reconfigure it again. This means if we want NM to work properly with /etc/resolv.conf, we've got to either ensure there's no 'ip=dhcp' in kernel command line, or we've got to ensure networkd is configuring network. This is weird because normally we should not enable two network managers at the same time. Note that NM syncs part of its codes with networkd, which is the reason I think it happens to work when these two network configuration tools are configuring the same interface at the same time. In fact, NM now works well with resolved. It sends the DNS info it gets to resolved unconditionally by default (the behavior could be disabled in configuration file). Looking at the original commit that sets up the update-alternatives mechanism, it says: """ This brings the networkmanager in sync with how systemd-resolved and connman work. Additionally this allows it to function with a read-only rootFS. """ I guess the author was using systemd but disabling resolved, and the author wanted to use read-only rootFS. In order to keep such combination still works, change to use PACKAGECONFIG to handle things, and when 'man-resolv-conf' is enabled, the above combination could still work. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a8ebf23dde9c82dd9d1dcd0fa6de0b4467a0112b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-30 20:15:46 +0000