summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
AgeCommit message (Collapse)Author
2023-12-15build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01glibc: ignore CVE-2023-4527Peter Marko
This vulnerability was introduced in 2.36, so 2.35 is not vulnerable. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-30libxml2: Patch CVE-2023-45322Peter Marko
Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-20zlib: patch CVE-2023-45853Peter Marko
Backport commit merged to develop branch from PR linked in NVD report: * https://nvd.nist.gov/vuln/detail/CVE-2023-45853 * https://github.com/madler/zlib/pull/843 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-06glibc: Update to latest on stable 2.35 branchPeter Marko
Adresses CVE-2023-4911. Single commit bump: * c84018a05ae tunables: Terminate if end of input is reached (CVE-2023-4911) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-05glibc: Update to latest on stable 2.35 branchSoumya Sambu
Adresses CVE-2023-4813, CVE-2023-4806, CVE-2023-5156. Added these to CVE_CHECK_IGNORE to avoid in cve-check reports since the recipe version did not change. These are the complete list of changes this brings * 73d4ce728a Document CVE-2023-4806 and CVE-2023-5156 in NEWS * 17092c0311 Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]* * 762a747fae io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64 * e3ccb230a9 getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806) * 1b9087dcec gethosts: Return EAI_MEMORY on allocation failure * f5f88f142a gaih_inet: Split result generation into its own function * a6da106892 gaih_inet: split loopback lookup into its own function * 8b70d97b08 gaih_inet: make gethosts into a function * 9098deb96a gaih_inet: separate nss lookup loop into its own function * ce64e72b7d gaih_inet: Split nscd lookup code into its own function. * 4897bf7968 gaih_inet: Split simple gethostbyname into its own function * 571c531b3b gaih_inet: make numeric lookup a separate routine * 9aad91abe6 gaih_inet: Simplify service resolution * d02808dee9 getaddrinfo: Fix leak with AI_ALL [BZ #28852] * f366eaa608 gaih_inet: Simplify canon name resolution * b126325fc7 nss: Sort tests and tests-container and put one test per line * 6e867146ee Simplify allocations and fix merge and continue actions [BZ #28931] * 59ee83b0c2 elf: Move l_init_called_next to old place of l_text_end in link map * 34b07bdbdd elf: Remove unused l_text_end field from struct link_map * 02a67e102f elf: Always call destructors in reverse constructor order (bug 30785) * aeea91fd15 elf: Do not run constructors for proxy objects * 1d828d5855 elf: Introduce to _dl_call_fini Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-24build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-23build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-19dbus: Specify runstatedir configure optionPavel Zhukov
Without specifing runstatedir tmpfiles.d is configured to use /var/run for dbus and this causes deprecation warnings in system logs. Signed-off-by: Pavel Zhukov <pavel.zhukov@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4df1a16e5c38d0fb724f63d37cc032aa37fa122f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-19build-sysroots: Add SUMMARY fieldKhem Raj
Fixes build QA warning about [missing-metadata] Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4f4c7130f11c069ab18c374dcbfb1276ef37be60) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-19glibc: stable 2.35 branch updatesSanjana
Below commits on glibc-2.35 stable branch are updated. 561e9dadc0 x86: Fix incorrect scope of setting `shared_per_thread` 1c3ecf5858 x86: Use `3/4*sizeof(per-thread-L3)` as low bound for NT threshold. 47c7d2eb03 x86: Fix slight bug in `shared_per_thread` cache size calculation. d1b1da26ea x86: Increase `non_temporal_threshold` to roughly `sizeof_L3 / 4` e19af583b4 elf: _dl_find_object may return 1 during early startup. Signed-off-by: Sanjana <sanjanasanju1608@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-12libxml2: Fix CVE-2023-39615Soumya Sambu
Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39615 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-07dropbear: fix CVE-2023-36328Yogita Urade
Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS). References: https://nvd.nist.gov/vuln/detail/CVE-2023-36328 https://github.com/libtom/libtommath/pull/546 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-01busybox: fix CVE-2022-48174Meenali Gupta
There is a stack overflow vulnerability in ash.c:6030 in busybox vbefore 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-01ncurses: fix CVE-2023-29491Soumya Sambu
Backport patch to fix CVE-2023-29491. Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22glibc-locale: use stricter matching for metapackages' runtime dependenciesAlexander Kanavin
This resolves two issues: 1. metapackages were depending on themselves (except -binaries which wouldn't match against 'glibc-binary'). 2. for the nativesdk variant, due to a non-empty dependency list at parsing time caused by issue 1, map_depends_variable() from meta/lib/oe/classextend.py was forcibly setting PACKAGES to the initial parse-time value (e.g. missing the dynamically created packages). This meant that three out of four nativesdk- metapackages were entireyly missing the dependencies on the respective dynamic package sets. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a90fd3afe9184aa1870b34a826e3ba0563477d4b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22glibc/check-test-wrapper: don't emit warnings from sshAnuj Mittal
Dont fill up the test log with ssh warning about having added the host to list of known hosts. Also helps fix a test case failure where stderr log was being compared to a known value. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63b31ff7e54a171c4c02fca2e6b07aec64a410af) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22glib-2.0: Fix CVE-2023-32643 and CVE-2023-32636Soumya Sambu
fuzz_variant_binary_byteswap: Heap-buffer-overflow in g_variant_serialised_get_child fuzz_variant_text: Timeout in fuzz_variant_text Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22glib-2.0: Fix CVE-2023-29499 and CVE-2023-32611Soumya Sambu
GVariant offset table entry size is not checked in is_normal() g_variant_byteswap() can take a long time with some non-normal inputs Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22glib-2.0: Fix CVE-2023-32665Soumya Sambu
GVariant deserialisation does not match spec for non-normal data Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-16libxcrypt: update PV to match SRCREVAlexander Kanavin
When SRCREV was updated, only libxcrypt-compat was renamed to match, but not libxcrypt proper. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 98c89359532778a894f50ddea1cc6ab922d6e562) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02cve-update-nvd2-native: always pass str for json.loads()Yuta Hayama
Currently json.loads() accepts one of the types str, bytes, or bytearray as an argument, but bytes and bytearrays have only been allowed since python 3.6. The version of Python3 provided by default on Ubuntu 16.04 and Debian 9.x is 3.5, so make raw_data type str to work correctly on these build hosts. Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-31util-linux: add alternative links for ipcs,ipcrmBenjamin Bouvier
When enabling ipcs and ipcrm configuration into busybox, both tools are built and then deployed during do_rootfs. These operation lead to below issue (similar behavior happens for ipcs): do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget:${PN} (). update-alternatives: Error: not linking .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm to /bin/busybox since .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm exists and is not a link Binaries enter in conflict with same named util-linux utilities during do_rootfs step. Adding ALTERNATIVE_LINK_NAME for both tools fix the issue. Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e4d60408b869c9cc2ccff794d4e271d993ec8a97) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-31systemd-systemctl: fix errors in instance name expansionYuta Hayama
If the instance name indicated by %i begins with a number, the meaning of the replacement string "\\1{}".format(instance) is ambiguous. To indicate group number 1 regardless of the instance name, use "\g<1>". Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d18b939fb08b37380ce95934da38e6522392621c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-31libxcrypt: fix build with perl-5.38 and use master branchMartin Jansa
* fixes do_configure failure: checking whether all ucontext.h functions are available... yes when is deprecated at libxcrypt/4.4.30-r0/git/build-aux/scripts/BuildCommon.pm line 522. Compilation failed in require at ../git/build-aux/scripts/expand-selected-hashes line 28. BEGIN failed--compilation aborted at ../git/build-aux/scripts/expand-selected-hashes line 28. configure: error: bad value 'all' for --enable-hashes NOTE: The following config.log files may provide further information. * with this patch backported it works OK: libxcrypt/4.4.30-r0/git $ perl build-aux/scripts/expand-selected-hashes usage: expand-selected-hashes hashes.conf names,of,selected,hashes * similarly do_compile failure: ../git/build-aux/scripts/move-if-change crypt-hashes.h.T crypt-hashes.h ../git/build-aux/scripts/move-if-change crypt-symbol-vers.h.T crypt-symbol-vers.h given is deprecated at ../git/build-aux/scripts/gen-crypt-h line 41. Makefile:3818: Makefile.deps: No such file or directory make: *** [Makefile:3715: crypt.h.stamp] Error 255 * also use master branch instead of develop, the SRCREV exists in both but stable metadata branches should track stable component branches libxcrypt/4.4.30-r0/git $ git branch -a --contains d7fe1ac04c326dba7e0440868889d1dccb41a175 | tee * develop remotes/origin/HEAD -> origin/develop remotes/origin/develop remotes/origin/master and oe-core master also uses master SRCBRANCH since: https://git.openembedded.org/openembedded-core/commit/?id=d18e89bd2b46c6e266cc39dbe9fdb6c032f5f1fe Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-17wic: Add dependencies for erofs-utilsHeiko Thole
In order to build erofs filesystems, wic must have the erofs-utils package installed into its sysroot. Signed-off-by: Heiko Thole <heiko.thole@entwicklung.eq-3.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-17sysfsutils: fetch a supported fork from githubAlexander Kanavin
Debian does the same: https://packages.debian.org/source/sid/sysfsutils Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 504b2f590cb94b217c5f48090cfb71a749bd5ac8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-17systemd: Backport nspawn: make sure host root can write to the uidmapped ↵Marek Vasut
mounts we prepare for the container payload Backport fix for systemd nspawn uidmap handling from systemd v253 . Without this, attempt to start mkosi generated debian stable 12 container would ultimately fail (per "$ strace -ff") with: " symlinkat("usr/lib/aarch64-linux-gnu", 8, "lib64") = -1 EOVERFLOW (Value too large for defined data type) " Command to generate test container: " mkosi --distribution debian --release stable --architecture arm64 \ --cache-dir /home/oe/cache/ --format tar --compress-output xz \ --output-dir /home/oe/output/ --checksum 1 --root-password root \ --package systemd --package udev --package dbus " Command to import test container and start it, which triggers the failure: " $ machinectl pull-tar http://192.168.1.300/image.tar.xz default $ machinectl read-only default false $ rm -f /var/lib/machines/default/etc/machine-id $ dbus-uuidgen --ensure=/var/lib/machines/default/etc/machine-id $ machinectl start default " Minimal command to trigger the failure once container is imported: " $ strace -ff systemd-nspawn --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=default " Extracted from systemd MR: https://github.com/systemd/systemd/pull/22774 Further explanation by Christian Brauner at second half of: https://github.com/systemd/systemd/issues/20989 Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: actually use API keysRoss Burton
There were vestigal remains of API key support which could be removed, but as using an API key - in theory - gives the user larger rate limits it's probably wise to expose it. If the user has an API key, then set NVDCVE_API_KEY. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a542de684282bfec79f24ae2f1a2027ffde319d8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: log a little moreRoss Burton
Add a note of what range we're fetching, and use bb.note() instead of debug() as messages about retrying shouldn't really be considered debug logging. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b64a869b9c5e1d504f1011da16b5c5ff721afbf0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: increase retry countPeter Marko
Current 503 errors seem to last several seconds. In most cases there are two errors and third request succeeds. However sometimes the outage takes more than time needed for two retries and third one also fails. Extend retry count from 3 to 5 to improve the probablity that the fetcher succeeds. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4d118af2360cff7f234102fd5e4b65a6f4146a6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: retry all errors and sleep between retriesPeter Marko
Last couple days it is not possible to update NVD DB as servers are returning lot of errors. Mostly "HTTP Error 503: Service Unavailable" is observed but sporadially also some others. Retrying helps in most cases, so extend retries to all errors. Additionally add sleep which is recommended by NVD between requests. These retries are already implemented between successful requests, but giving servers time between failed ones is important, too. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 88dad8f198baa80af5ab576498f4df6ed639d551) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: fix cvssV3 metricsPeter Marko
After upgrade to soon-to-be-released kirkstone 4.0.11 CVE annotations got broken. Anything which has only cvssV3 does not resolve properly. Fix the API fields used to extract it. i0.0 score is now at level of NVD DB 1.1. All CVEs with UNKNOWN vector are not present in NVD DB 1.1. NVD API 1.1: sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4776 LOCAL|32146 NETWORK|167746 PHYSICAL|185 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73331 1.8|7 1.9|3 ... NVD API 2.0 (broken): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4587 LOCAL|26273 NETWORK|150421 UNKNOWN|24644 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|205925 NVD API 2.0 (fixed): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|5090 LOCAL|32322 NETWORK|168004 PHYSICAL|213 UNKNOWN|511 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73841 1.8|7 1.9|3 ... Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 61a5857efdcc0f49c69c0deb24fce99007aeef19) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: use exact times, don't truncateRoss Burton
When requesting updates in a specific range, use the actual current time and database mtime instead of truncating to midnight, and explicitly set the timezone to UTC so that NIST don't treat the timestamps as _their_ local time when they're _our_ local time. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9aa0ec37f5f74252588d2494a71c71a7d8e68df9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-13cve-update-nvd2-native: handle all configuration nodes, not just firstRoss Burton
Some CVEs, such as CVE-2013-6629, list multiple configurations which are vulnerable. The current JSON parser only considers the first configuration. Instead, consider every configuration. We don't yet handle the AND/OR logical operators, but this is a step in the right direction. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e1bf4f6dd686055fe9a8bdcc3f739eac2807bae0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-04libxcrypt: fix hard-coded ".so" extensionEtienne Cordonnier
2 issues: - the .so extension is hard-coded, and therefore the libxcryt package compiled with meta-darwin is empty, because the dylib files are not contained in FILES_${PN} - nothing actually produces a file libcrypt-*.so (the symlink file is libcrypt.so, without dash), thus defining FILES:${PN} manually to contain libcrypt-*.so has no effect. Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ed6bfa2428b4f1ba7f09d6e9e67c462ff355153) Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-27dbus: upgrade 1.14.6 -> 1.14.8Xiangyu Chen
Update dbus to 1.14.8 to fix CVE-2023-34969 and serveral bugs changes: https://gitlab.freedesktop.org/dbus/dbus/-/blob/f90d4f16933ee5153fe02c405eb883c9cb8f0ad5/NEWS commits: 55d11f57 doc/dbus-api-design: fix wrong closing tag a96f417f CI: Run a detached pipeline for merge requests 9e0477fc CI: Only run for pushes to dbus 077f7e43 CI: Remove an obsolete workaround 07fe44f4 CI: Update Windows runners ec708d55 CI: Avoid using a no-op download location that gives a 403 error 45e6e93e dbus_message_iter_get_signature: Fix two memory leaks on OOM 0bb1942e dbus-internals: use `_DBUS_FUNCTION_NAME` in `_dbus_verbose()` 8df1b8be dbus-sysdeps-win: do not log function name twice 5c3a4e81 dbus-spawn-win: use `_DBUS_FUNCTION_NAME` instead of `__FUNCTION__` 8e457296 Update NEWS e1ffce17 Revert "CI: Remove an obsolete workaround" 40c0802f monitor test: Log the messages that we monitored a70c8f2f bus: Assign a serial number for messages from the driver 39b5c617 monitor test: Reproduce #457 f99e5de1 Update NEWS 21414587 AUTHORS: Update f90d4f16 Release v1.14.8 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-23build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-17systemd-systemctl: support instance expansion in WantedByIan Ray
Refactor _process_deps to expand systemd instance specifier "%i" to the template instance. This change expands on prior commit e510222b57 ("systemd-systemctl: fix instance template WantedBy symlink construction") by substituting every "%i" pattern-match with the instance name. The regexp handles the following cases: * svc-wants@%i.service * sys-subsystem-net-devices-%i.device Signed-off-by: Ian Ray <ian.ray@ge.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9356276137267a29ae2289d796a2940918375308) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-15glibc: stable 2.35 branch updatesDeepthi Hemraj
Below commits on glibc-2.35 stable branch are updated. cbceb903c4 (HEAD -> release/2.35/master, origin/release/2.35/master) io: Fix F_GETLK, F_SETLK, and F_SETLKW for powerpc64 0967fb5861 io: Fix record locking contants on 32 bit arch with 64 bit default time_t 739de21d30 Document BZ #20975 fix 2b9906f9a0 __check_pf: Add a cancellation cleanup handler 7035f2174f gmon: Revert addition of tunables to preserve GLIBC_PRIVATE ABI e698e8bd8e gmon: fix memory corruption issues 9f81b8fa65 gmon: improve mcount overflow handling f2820e478c gmon: Fix allocated buffer overflow 413af1eb02 posix: Fix system blocks SIGCHLD erroneously CVE-2023-0687.patch is dropped Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-15cve-update-nvd2-native: added the missing http importJan Vermaete
Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 39d2cde7eb922cb0a2cf9402cd8b3ae3b4cc2f62) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-15cve-update-nvd2-native: new CVE database fetcherMarta Rybczynska
Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-09systemd-networkd: backport fix for rm unmanaged wifiC. Andy Martin
Upstream v250 of systemd-newtorkd contains a race which will drop the config of unmanaged wireless interfaces during reconfigure or carrier loss. This bug is fixed in v251 by this commit: commit a0e99a377a2f22c0ba460d3e7228214008714c14 Author: Yu Watanabe <watanabe.yu+github@gmail.com> Date: Mon Jan 31 19:08:27 2022 +0900 network: remove only managed configs on reconfigure or carrier lost Otherwise, if the carrir of the non-managed interface is lost, the configs such as addresses or routes on the interface will be removed by networkd. A bug was filed upstream on v250 to have upstream backport but was rejected as "version-too-ancient", so backport this commit as a patch to systemd-networkd for kirkstone. Fixes: [YOCTO #15134] Signed-off-by: C. Andy Martin <cam@myfastmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-05-24systemd-systemctl: fix instance template WantedBy symlink constructionMartin Siegumfeldt
Fix issue of the below instance template systemd service dependency [Install] WantedBy=svc-wants@%i.service creating the symlink (instance "a" example) /etc/systemd/system/svc-wants@%i.service.wants/svc-wanted-by@a.service which should be /etc/systemd/system/svc-wants@a.service.wants/svc-wanted-by@a.service as implemented by this change. The functionality appears regressed just after "thud" baseline when the logic was refactored from shell script into python (commit 925e30cb104ece7bfa48b78144e758a46dc9ec3f) (From OE-Core rev: 308397f0bb3d6f3d4e9ec2c6a10823184049c9b5) Signed-off-by: Martin Siegumfeldt <mns@gomspace.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 372b29c8ad270d4d430c26a4e614976c7029afaf) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-05-12build-appliance-image: Update to kirkstone head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-05-08libxml2: patch CVE-2023-28484 and CVE-2023-29469Peter Marko
Backports from: * https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 * https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-04-28glibc: stable 2.35 branch updates.Deepthi Hemraj
Below commits on glibc-2.35 stable branch are updated. 1c7f51c75a x86_64: Fix asm constraints in feraiseexcept (bug 30305) 8d07e65d15 gshadow: Matching sgetsgent, sgetsgent_r ERANGE handling (bug 30151) b7cc55a24e x86: Check minimum/maximum of non_temporal_threshold [BZ #29953] 3f63f9dfe1 stdlib: Undo post review change to 16adc58e73f3 [BZ #27749] 757d9a6306 elf: Smoke-test ldconfig -p against system /etc/ld.so.cache 416bd20b3f Use 64-bit time_t interfaces in strftime and strptime (bug 30053) ae045ed16b cdefs: Limit definition of fortification macros 6bcd5d8e36 x86: Prevent SIGSEGV in memcmp-sse2 when data is concurrently modified [BZ #29863] 82663d3c03 time: Set daylight to 1 for matching DST/offset change (bug 29951) d9923235f0 elf/tst-tlsopt-powerpc fails when compiled with -mcpu=power10 (BZ# 29776) Signed-off-by: Deepthi Hemraj <deepadeepthi98@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-03-23systemd: fix wrong nobody-group assignmentPiotr Łobacz
The generated /etc/group file had a wrong group name for nobody-group which was nobody with same id as nogroup groupd. This was leading to duplcate groups, with same ids and different names. More can be read on this link: https://bugzilla.yoctoproject.org/show_bug.cgi?id=11766 Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d69fccf2e5d108dd7c6059310924588d36a45865) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-24 02:11:35 +0000