summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
AgeCommit message (Collapse)Author
2021-06-15python3: fix CVE-2021-23336timo/dunfell/python3-CVE-2021-23336Lee Chee Yang
From: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> """ The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. """ References: https://nvd.nist.gov/vuln/detail/CVE-2021-23336 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336 Signed-off-by: Tim Orling <timothy.t.orling@intel.com>
2021-05-31pkgconfig: update SRC_URIChangqing Li
The git repo for pkg-config was changed, so update the SRC_URI accordingly with the new link. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9fd1b9b8282d68213b187ab42fae27e6a3c95b2e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-28unfs3: correct configure optionChangqing Li
On some new distro like ubuntu21.04, unfs3-native compile failed with error: undefined reference to `xdr_uint32', since new distro has new glibc. >From glibc 2.27 rpc support is dropped, so unfs3 need to link to libtirpc. Here is defination of ac_link: ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' Depended library should be added into LIBS, not LDFLAGS, otherwise, gcc may not load the lib since it is before conftest.$ac_ext during configure. Finally, it results in compile failed. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 27867862c1fee6c0e649286500fa1ab015d57faf) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14dejagnu: needs expect at runtimeRomain Naour
runtest return an error due to missing expect on the target. Add expect as runtime dependency. Signed-off-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d9a3a08edc1efcbe7b02e80be98370792d3c6cc2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14jquery: Exclude CVE-2007-2379 from cve-checkRichard Purdie
The CVE is non-specific and depends on the users of jquery, doesn't make sense to have this flagged against jquery as there is nothing we can do about it. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1f82843584f6d2843c5bbd2fe5dcbc654a0fbcfb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14qemu: Exclude CVE-2018-18438 from cve-checkRichard Purdie
The issues were investigated and found not to be an issue therefore exclude from checks. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee6ee9bd489c126b99d15c1011560df2f840a6e9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14qemu: Exclude CVE-2007-0998 from cve-checkRichard Purdie
The CVE applies to the built-in VNC server but we don't enable this by default. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d62b9974a5f3a0f462434ce2763c28a4b4bbcfc6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14qemu: Exclude CVE-2017-5957 from cve-checkRichard Purdie
The CVE applies to virglrender before 0.6.0 which we don't have. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b5355375d028577de0b98e05992de6a088cb972) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14python3-jinja2: 2.11.2 -> 2.11.3Lee Chee Yang
updates include fix for CVE-2020-28493 changelog: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14qemu: fix CVE-2021-3392Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-14subversion: fix CVE-2020-17525Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-05-07binutils: fix CVE-2021-3487Lee Chee Yang
drop changes to changelog file in the patch so it can be backport. Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-04-27Binutils: Fix CVE-2021-20197Vinay Kumar
Source: git://sourceware.org/git/binutils-gdb.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Backported upstream commit d3edaa91d4cf7202ec14342410194841e2f67f12 to binutils-2.34 source, along with commit id dependencies (8e03235147a9e774d3ba084e93c2daaa94d1cec, 365f5fb6d0f0da83817431a275e99e6f6babbe04 and 8b69e61d4be276bb862698aaafddc3e779d23c8f). Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d3edaa91d4cf7202ec14342410194841e2f67f12] Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-04-21libtool: make sure autoheader run before automakeMingli Yu
When use automake to generate Makefile.in from Makefile.am, there comes below race: | configure.ac:45: error: required file 'config-h.in' not found It is because the file config-h.in in updating process by autoheader, so make automake run after autoheader to avoid the above race. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1fc0a4a98e65db7efba8bb5cb835101ea5dd865b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-04-21pseudo: Upgrade to add trailing slashes ignore path fixRichard Purdie
Pull in: client: strip trailing slashes when opening an ignored path Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9fb92bc13b8a78ef98798f14e728058feb180ba6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-04-19go_1.14: don't set -buildmode=pie when building for windows targetsPeter Morrow
go 1.14 for windows targets does not support -buildmode=pie, disable it and use the default buildmode instead. Support for -buildmode=pie for windows targets is added with go 1.15 (https://golang.org/doc/go1.15) which is added to poky in gatesgarth. Signed-off-by: Peter Morrow <pemorrow@linux.microsoft.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-31libtool: make sure autoheader run before autoconfMingli Yu
autoheader will update ../libtool-2.4.6/libltdl/config-h.in which autoconf needs, so there comes a race sometimes as below: | configure.ac:45: error: required file 'config-h.in' not found | touch '../libtool-2.4.6/libltdl/config-h.in' So make sure autoheader run before autoconf to avoid this race. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d8451cbef5906b67756582fdfc44eb01ed3512fc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-31run-postinsts: do not remove postinsts directory.Anton D. Kachalov
When running on the systems having read-only rootfs backed by overlayfs, removing the whole directory lead to create a special char device file on the upperdir to reflect directory's removal. Once it is required to upgrade the whole read-only image that might contain new postinsts scripts, it will be impossible to run such scripts with a "deletion mark" file on the overlayfs -- the whole directory will be marked as deleted regardless new files in it. Signed-off-by: Anton D. Kachalov <gmouse@google.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1a27b62b225ffeecec47c249a0b86cc54d775add) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-29git: fix CVE-2021-21300Minjae Kim
checkout: fix bug that makes checkout follow symlinks in leading path Upstream-Status: Acepted [https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592] CVE: CVE-2021-21300 Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-11valgrind: Increase timeout duration 30 -> 90 sYi Fan Yu
Attempt to fix intermittent failure of `drd/tests/std_list` Locally tested to take around 45 s on qemuarm64 [YOCTO #14228] Signed-off-by: Yi Fan Yu <yifan.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aac00b1c8042e41cd6bb1aea8e3033a1c6dd2b05) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-11swig: Fix reproducibility issueRichard Purdie
Remove hardcoding the build configuration into the help/version output from swig to make the binaries reproducible. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ed28ae9717ea9dad4e131012186d5f08e8f0bec) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-11syslinux: Fix reproducibility issuesRichard Purdie
Add sorting to wildcard expansion in the makefile to make builds reproducible. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5541ba76ccc0c416f315bc0dc14a20a33059bd5f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-11meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda Bassey
Added missing HOMEPAGE and DESCRIPTION found using the test command `oe-selftest -r distrodata.Distrodata.test_missing_homepg` [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7290b773486da3888f848abf0dba747f2d9f42e1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-09python3-jinja2: set CVE_PRODUCTChen Qi
Set CVE_PRODUCT for more accurate CVE scanning. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aefcc7a7dd012530ed846292caaed70d20589a3a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-08qemu: fix CVE-2021-20203Minjae Kim
net: vmxnet3: validate configuration values during activate Upstream-Status: Acepted [https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg07935.html] CVE: CVE-2021-20203 Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-05meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-05librepo: fix CVE-2020-14352Minjae Kim
librepo: missing path validation in repomd.xml may lead to directory traversal Upstream-Status: Acepted [https://github.com/rpm-software-management/librepo/commit/7daea2a2429a54dad68b1de9b37a5f65c5cf2600] CVE: CVE-2020-14352 Signed-off-by: Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-05python3: fix CVE-2021-3177Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 25d1cae49e56797c4c9e91c01697c4de02dee046) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04qemu: Backport patch to avoid assertion fails on icache line sizeAndrei Gherzan
Due to a bug in glibc 2.33, the value of the icache line size is now reported as unsupported option. This breaks qemu at runtime with: cacheinfo.c:182: init_cache_info: Assertion `(isize & (isize - 1)) == 0' failed. Aborted (core dumped) We haven't caught this one yet because we were already on qemu 5.2.0 when we started to play with glibc 2.33 so it was only reproducible on dunfell. Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04mtd-utils: Remove duplicate assignments to alternative link namesThomas Viehweger
The two duplicate lines are not needed. The existence is confusing. Signed-off-by: Thomas Viehweger <patchesThomas.Vie@web.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 36bdb4faa90dc18bc020481eba82ee570b968c39) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04xmlto: Fix reproducibilityRichard Purdie
Don't hardcode the host's grep path into xmlto. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a7d78971df193c321c309481749fc30cae77788c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04quilt: Be determnistic about column presenceRichard Purdie
I've seen local differences in the quilt output depending on whether the column binary was available in the sysroot. Fix determinism issues by being specific about configuration. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0cd5fba8634bcc679518f98cc25be66a51081372) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04go: update to 1.14.15Lee Chee Yang
updates include fixes for CVE-2021-3114 CVE-2021-3115 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-22pseudo: Update to include fixes for glibc 2.33Richard Purdie
Pull in the changes: makewrappers: Fix glibc 2.33 fstatat usage issues ports/linux: Add wrapper for fstatat/fstatat64 in glibc 2.33 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dfcb1c5eb2690046f96c2bb6724e091028ddc3ec) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-22pseudo: Update for rename and faccessat fixesRichard Purdie
Pull in: ports/rename/renameat: Avoid race when renaming files ports/unix: Add faccessat and faccessat2 ports/access.c: Use EACCES, not EPERM which includes a fix for rename race issues causing pseudo aborts. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 330c232e4f756296331f9026e91ac26fd45f0315) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-22pseudo: Update to work with glibc 2.33Richard Purdie
Update to a pseudo version which contains some heqader fixes for glibc 2.33. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c897ac317926b132547578b1f6bd347fe5677dfc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-12python3-pycairo: use python3targetconfigAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dadf001c85938b831def8da5851a40dc0977e3d0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-12gcc-9.3.inc: Fix potential runtime crashJon Mason
GCCv9 tree vectorization code is faulty and can cause random crashes at runtime (when using -O3). Add the backported patch to address this issue. Signed-off-by: Jon Mason <jon.mason@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-11opkg: Fix patch glitchesRichard Purdie
The original patch contained some text which shouldn't have been there and used brackets in configure which isn't a great idea. Tweak the patch to resolve this. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63cbf187fe189c99645fe3afee8a6361a9a32cdc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-11opkg: Fix build reproducibility issueRichard Purdie
A build date was leaking into the generated docs and makefile used for ptests leading to reproducibility issues each time the month changed. Add a patch to use SOURCE_DATE_EPOCH to derive it if available. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6a9ca7aec4991eabd425e32fdf85f51bb1686b8b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-04python3: Use addtask statement instead of task dependenciesTomasz Dziendzielski
The externalsrc class deletes do_patch task which results with: | ERROR: Task do_create_manifest in <PATH>/python3_3.8.2.bb depends upon | non-existent task do_patch in <PATH>/python3_3.8.2.bb Use addtask to define correct order to prevent this error, since addtask mechanism accepts deleted tasks. [YOCTO #14151] Signed-off-by: Tomasz Dziendzielski <tomasz.dziendzielski@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a746d034fa7eaad4f4876fa61c5a8c3c15e211c8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-04pseudo: Update to include passwd and file renaming fixesRichard Purdie
Pulls in: pseudo_client: Ensure renames update open fd file paths pseudo_client.c: Rebuild passwd paths after chroot which should fix issues seen in apt package index creation, new binutils and other autobuilder race issues in pseudo amongst other issues. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 44d11b56001f40622c055069b0901cc4ae15c76c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-29python3: Avoid installing test data into recipe-sysrootRichard Purdie
There are several thousand files in the test directory which we don't need. Adding these for the native and target sysroots is a crazy amount of files to be throwing around needlessly. Delete the files from the sysroot side of things to tidy up the sysroots and improve performance. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6bced03011ad1663d68b0322a2f8aeb4d836646) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28strace: increase ptest timeout duration 120->240sYi Fan Yu
solve qual_fault-syscall.test and qual_fault.test failing due to timeout. Bug 14165 Signed-off-by: Yi Fan Yu <yifan.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5af9f32d9b12654793289f44366251f978f6378a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28flex: Fix --noline option behaviorOleksiy Obitotskyy
Option --noline or -L does not handled properly. So generated code contains #line directives with file absolute path and prevents to create reproducible builds. Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0bf2cb7dc2123f220accf1542c2ae4c4b4b8275a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28flex: Refresh patchzangrc
The patch changes the same file twice which causes issues with some patch tools (not used in YP by default). Refresh the patch to clean this up anyway. RP: Tweak commit message Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cb6e65f8196fd6587c75c3ab2cf060c00a074ec6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28flex: fix build with autoconf 2.70Ross Burton
autoconf 2.70 is coming soon which has some small behavioural fixes, so backport a patch from upstream to fix the build with that release. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 946610f2cc8cd42265ee3fab6c73ad4831aaeb4e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28pseudo: Update for arm host and memleak fixes/cleanupRichard Purdie
Pulls in: makewrappers: support architecture-overrides in wrapper modifiers makewrappers: fix Python 2 hangover Fix some memory leaks Disable deprecated function warnings Silence switch block warnings pseudo_util: don't overrun strings when looking for keys Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 11a3a9203ad595e7fa92acf442a7f3216d6e3830) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28pseudo: Add lchmod wrapperRichard Purdie
New versions of glibc have an lchmod function so we need to wrap it. Identified through a reproducibility issue in initramfs-base where /dev/console created by mknod from coreutils changed permissions depending on the host distro (mknod used the gnulib wrapper on most hosts but newer ones used the libc call). [YOCTO #14162] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 20a645664977530e602e1ac97e8dc0962e730e6c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-28pseudo: Drop patches merged into upstream branchRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7386a116222979e6de60c39d2c094d5f216fb101) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-01 21:48:29 +0000