summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2022-10-29vulkan: update 1.3.216.0 -> 1.3.224.1Alexander Kanavin
(From OE-Core rev: c9d245a78a22542ea4fb063370974ac1c85be74d) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29stress-ng: update 0.14.03 -> 0.14.06Alexander Kanavin
(From OE-Core rev: ec701b7054a9731ddd4f44fe39457054fd790e09) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29hdparm: update 9.64 -> 9.65Alexander Kanavin
(From OE-Core rev: 438083e2ec628b563130bda5005ea10fd685d5b7) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29grep: update 3.7 -> 3.8Alexander Kanavin
(From OE-Core rev: f69355219cb0ead23113f77cb29a7caacfde9611) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29llvm: update 14.0.6 -> 15.0.1Alexander Kanavin
'Release' type follows standard practice elsewhere in core, particularly rust-llvm as well. (From OE-Core rev: 20adf74207b8c3eac7871e27da2df1aa26fca3b6) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29gnu-config: update to latest revisionAlexander Kanavin
(From OE-Core rev: b4d105d0d2bc54cf3987cbb9665588ec7aa037bd) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29unfs3: correct upstream version checkAlexander Kanavin
(From OE-Core rev: 70897a57b2f3f0eaaa937fe84383d6e26cd62c72) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29cmake-native: Fix host tool contaminationBernhard Rosenkränzer
[v2 hopefully fixes the From: mangling by the ML, no functional changes] Trying to build cmake-native on a host system where curl was built with cmake (resulting in CURLConfig.cmake and friends, which do not use the same naming schemes expected by cmake-native's build process, being installed to a system wide cmake directory like /usr/lib64/cmake/CURL) results in undefined references to all libcurl symbols. The problem is that cmake-native sees and uses the system wide /usr/lib64/cmake/CURL/CURLConfig.cmake, which defines CURL::libcurl and CURL::curl as opposed to setting ${CURL_LIBRARIES} as expected by cmake-native. find_package(CURL) (cmake-native's CMakeLists.txt, line 478) succeeds, but incorrectly uses the system wide CURLConfig.cmake, resulting CMAKE_CURL_LIBRARIES to be set to an empty string (cmake-native's CMakeLists.txt, line 484), causing the cmake-native build to miss -lcurl. The simplest fix is to let cmake know the right value for CURL_LIBRARIES. Making it -lcurl should always work with libcurl-native in recipe-sysroot-native. [YOCTO #14951] (From OE-Core rev: 2659c735a464c956b4fca0894a5aed27a0fe7e37) Signed-off-by: Bernhard Rosenkränzer <bero@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-29bitbake: fetch2/git: don't set core.fsyncobjectfiles=0Ross Burton
This git configuration variable is deprecated in 2.36.0 onwards, so git warns in the logs for every git call. Luckily the default value has always been false[1], so we can just remove this. [ YOCTO #14939 ] [1] https://github.com/git/git/commit/aafe9fbaf4f1d1f27a6f6e3eb3e246fff81240ef (Bitbake rev: 8ad310633e0c5d5593631c1196cbdde30147efce) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28manuals: use references to the "Build Directory" termMichael Opdenacker
Replace instances of "Build Directory" and "build directory" (when applicable) by :term:`Build Directory` as already done in most places. Doing this, fix the indentation of the paragraphs with this term. (From yocto-docs rev: dce50679242d39f133e0cde5c8483b5e69f3eb54) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28manuals: add missing references to SDKMACHINE and SDK_ARCHMichael Opdenacker
Doing this, fix the odd identation of the corresponding paragraphs (From yocto-docs rev: e319b3bf4eb6420949372e699d60c7383945e513) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28manuals: stop referring to the meta-openembedded repo from GitHubMichael Opdenacker
(From yocto-docs rev: de6e7c05fbcff99a6f1fe2a2bf889b559b9b576b) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28manuals: replace "_" by "__" in external linksMichael Opdenacker
(From yocto-docs rev: 25142cd8121fdd6a8e0524fc8417fc666c498981) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28Documentation/README: formalize guidelines for external link syntaxMichael Opdenacker
(From yocto-docs rev: f5d10ceed943270d7bcfa31b5936f37a60669c7f) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28dev-manual: common-tasks.rst: refactor and improve "Checking for ↵Mikko Rapeli
Vulnerabilities" section Add sub section to how Poky and OE-Core handle CVE security issues. This is a generic intro chapter. Also add note that this is a process which needs quite a bit of review and iteration to keep products and SW stack secure, a process not a product. Then change "Vulnerabilites in images" chapter to "Vulnerability check at build time" since the process applies to anything compiled with bitbake, not just images. Explain details of how to work with cve-check.bbclass, especially the states Patched, Unpatched and Ignored in the generated reports. Rename recipe chapter to "Fixing CVE product name and version mappings" since CVE check has some default which works for all recipes but generated reports may be completely broken. Fixes are then done with CVE_PRODUCT and CVE_VERSION. Give some hints how to analyze "Unpatched" CVEs by checking what happens in other Linux distros etc. (From yocto-docs rev: 77a9c1a9fe651bf11f1d5a723b0741dd1764b2c8) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28dev-manual: common-tasks.rst: add regular updates and CVE scans to security ↵Mikko Rapeli
best practices Regular security scans and updates to fix issues and updates from upstream maintainers are best practices. (From yocto-docs rev: 24d3337b6cbb38297877f6ce6ec78896ce93e8b2) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28ref-manual: classes.rst: improve documentation for cve-check.bbclassMikko Rapeli
It is a quite important tool for maintaining yocto based products so documentation should include the best practices. (From yocto-docs rev: 3f7d09fc3c96f29ab80a2cb893c9b4b19a75a769) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28ref-manual: variables.rst: add documentation for CVE_VERSIONMikko Rapeli
Related to cve-check.bbclass. (From yocto-docs rev: 1218775a9b32ac16556645c5d186007c19a5baf4) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28ref-manual: add info on buildtools-make-tarballPaul Eggleton
PENDING ON THIS OE-CORE PATCH: install-buildtools: support buildtools-make-tarball and update to 4.1 https://lists.openembedded.org/g/openembedded-core/message/171522 Cover the use case and the new provided tarball. (From yocto-docs rev: 3a06c35d059d7d43f7eb33a4f490f5d76afe6cb6) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28ref-manual: add wic command bootloader ptable optionAdrian Freihofer
Reordering the bootloader command options alphabetically (From yocto-docs rev: 9d43fcf8ba023be1350ed2b26482d2d5e44cf0cb) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28tiff: fix a typo for CVE-2022-2953.patchQiu, Zheng
The CVE number in the patch is a typo. CVE-2022-2053 is not related to libtiff. So fix it. (From OE-Core rev: c9f76ef859b0b4edb83ac098816b625f52c78173) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28mirrors.bbclass: use shallow tarball for binutils-nativeEtienne Cordonnier
This is useful e.g. when using meta-clang, which introduces a dependency to binutils-native, and then a full tarball of binutils is fetched additionally to a shallow tarball. The original BB_GIT_SHALLOW lines were added because of https://www.mail-archive.com/yocto@lists.yoctoproject.org/msg08752.html (From OE-Core rev: bd83b8b502ae935c75b59aaf71bbb531c9771dcc) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28go: add support to build on ppc64leAndrew Geissler
Verified by building on a ppc64le based system (From OE-Core rev: 6f9bb7094b34d9cbafa8618ada46a94a06332545) Signed-off-by: Andrew Geissler <geissonator@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28kernel-fitimage: skip FDT section creation for applicable symlinksAhmad Fatoum
When building a FIT image with device trees, each device tree lands in a FIT section and is referenced by a FIT configuration node. FIT images however also allow referencing the same device tree from multiple configurations. This can be useful to reduce FIT image size while staying compatible with existing bootloaders. Allow kernel-fitimage.bbclass users to take advantage of this by mapping each symlink to a regular device tree included in the FIT to a configuration that references a common device tree section. (From OE-Core rev: 21e240da63239826f3ef50ceef40c9519e9030d8) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28kernel-fitimage: mangle slashes to underscores as late as possibleAhmad Fatoum
This introduces no functional change, but will come in handy in a later commit where a file lookup will have us using the device tree name. If we keep it like it's now, we will lose the information whether an underscore is an original underscore or a mangled slash. (From OE-Core rev: 8bea426ca59d17715a3b32f7e3caf3e4b6db5ce9) Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28lighttpd: upgrade 1.4.66 -> 1.4.67wangmy
Changelog: ============= * Update comment about TCP_INFO on OpenBSD * [mod_ajp13] fix crash with bad response headers (fixes #3170) * [core] handle RDHUP when collecting chunked body * [core] tweak streaming request body to backends * [core] handle ENOSPC with pwritev() (#3171) * [core] manually calculate off_t max (fixes #3171) * [autoconf] force large file support (#3171) * [multiple] quiet coverity warnings using casts * [meson] add license keyword to project declaration (From OE-Core rev: 7a399862bb2e1503fbffa18e7ec0767643f76132) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28rust: install rustfmt for riscv32 as wellAlexander Kanavin
With the above rust arch fixes it builds just fine. (From OE-Core rev: f417ae30c79fac99e2549324ed351f6f63cc4a25) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28rust-target-config: match riscv target names with what rust expectsAlexander Kanavin
Official rust risc-v targets are prefixed with riscv32gc- and riscv64gc-: https://doc.rust-lang.org/nightly/rustc/platform-support.html Particularly crossbeam-utils make important build time decisions for atomics based on those names, and so we need to match ours with official targets. On the other hand, the actual definitions for those targets do not use the 'gc' suffix in 'arch' and 'llvm-target' fields, and so we need to follow that too, to avoid cryptic mismatch errors from rust-llvm: https://github.com/rust-lang/rust/blob/master/compiler/rustc_target/src/spec/riscv32gc_unknown_linux_gnu.rs (From OE-Core rev: 1cfb9c8a59d98ccc9b0510cd28fb933f72fb6b6c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28qemu: backport the fix for CVE-2022-3165Ross Burton
(From OE-Core rev: d820389728b0f5e085954b4f995da2b2014acedf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28tiff: fix a number of CVEsRoss Burton
Backport fixes from upstream for the following CVEs: - CVE-2022-3599 - CVE-2022-3597 - CVE-2022-3626 - CVE-2022-3627 - CVE-2022-3570 - CVE-2022-3598 (From OE-Core rev: 722bbb88777cc3c7d1c8273f1279fc18ba33e87c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28mesa: update 22.2.0 -> 22.2.2Markus Volk
- add a PACKAGECONFIG for perfetto support (From OE-Core rev: cbcaff0b4cc349706b9847f4262746b43adba209) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-27bitbake: bitbake-user-manual: details about variable flags starting with ↵Michael Opdenacker
underscore Fixes [YOCTO #14140] (Bitbake rev: 0f3e9d87168813ce49995ff04bccdce11c5f7b47) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26bitbake: tests/fetch: Allow handling of a file:// url within a submoduleRichard Purdie
CVE-2022-39253 in git meant file:// urls within submodules were disabled. Add a parameter to the commands in the tests to allow this to continue to work. (Bitbake rev: 209f7ba352b60722830157054e3fc56cb9c693eb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26openssl: Fix SSL_CERT_FILE to match ca-certs locationRichard Purdie
In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26bitbake: tests: bb.tests.fetch.URLHandle: add 2 new testsMark Asselstine
Add a test for special characters in user and password to qualify decodeurl() inspired by a bug report describing that '=' signs in a password was problematic. Add a second test to qualify decodeurl() as related to the change in commit 628c4bf6c89b [fetch2/__init__: handle @ in package names]. Relates to [YOCTO #14476] (Bitbake rev: ee04cf09c7022168c035affa654773652a49793e) Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26bitbake: doc: bitbake-user-manual: expand description of BB_PRESSURE_MAX ↵Michael Opdenacker
variables (Bitbake rev: 72e9847dd578c3cbed52a9c16fea23ebbeef5046) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26bitbake: utils/ply: Update md5 to better report errors with hashlibMark Hatle
In the case where hashlib is not available, the try would fail and fall through resulting in a backtrace on the usage of the 'sig'. The backtrace itself was confusing and made it difficult to determine what went wrong. Update the import to be in it's own try block with an appropriate message to indicate what went wrong. Note, the current version of ply all of this code has been restructured so this is not applicable upstream. Additionally, some versions of hashlib don't appear to implement the second FIPS related argument. Detect this and support both versions. (Bitbake rev: 484ab42f440070c0369b81f5c69da860fa47a798) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26bitbake: bitbake: user-manual: inform about spaces in :removeJohan Korsnes
Inform the reader that there should be no need for spaces in the value when using removal override `:remove`. Considering why spaces are used in the other override operators, it might seem obvious that they aren't needed for the removal operator. But, it seems like I'm not the first to be confused about this. Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com> Cc: Ross Burton <ross.burton@arm.com> Cc: Nicolas Dechesne <nicolas.dechesne@linaro.org> (Bitbake rev: 0a493a772f83436cbe909de93c157f4ab2d2d136) Signed-off-by: Johan Korsnes <johan.korsnes@remarkable.no> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26u-boot: Rework signing to remove interdependenciesSean Anderson
The U-Boot signing code is a bit of a mess. The problem is that mkimage determines the public keys to embed into a device tree based on an image that it is signing. This results in all sorts of contortions: U-Boot has to be available to the kernel recipe so that it can have the correct public keys embedded. Then, the signed U-Boot has to be made available to U-Boot's do_deploy. This same dance is then repeated for SPL. To complicate matters, signing for U-Boot and U-Boot SPL is optional, so the whole process must be seamlessly integrated with a non-signed build. The complexity and interdependency of this process makes it difficult to extend. For example, it is not possible to install a signed U-Boot binary into the root filesystem. This is first because u-boot:do_install must run before linux:do_assemble_fitimage, which must run before u-boot:do_deploy. But aside from infrastructure issues, installing a signed U-Boot also can't happen, because the kernel image might have an embedded initramfs (containing the signed U-Boot). However, all of this complexity is accidental. It is not necessary to embed the public keys into U-Boot and sign the kernel in one fell swoop. Instead, we can sign the kernel, stage it, and sign the staged kernel again to embed the public keys into U-Boot [1]. This twice-signed kernel serves only to provide the correct parameters to mkimage, and does not have to be installed or deployed. By cutting the dependency of linux:do_assemble_fitimage on u-boot:do_install, we can drastically simplify the build process, making it much more extensible. The process of doing this conversion is a bit involved, since the U-Boot and Linux recipes are so intertwined at the moment. The most major change is that uboot-sign is no longer inherited by kernel-fitimage. Similarly, all U-Boot-related tasks have been removed from kernel-fitimage. We add a new step to the install task to stage the kernel in /sysroot-only. The logic to disable assemble_fitimage has been removed. We always assemble it, even if the final fitImage will use a bundled initramfs, because U-Boot will need it. On the U-Boot side, much of the churn stems from multiple config support. Previously, we took a fairly ad-hoc approach to UBOOT_CONFIG and UBOOT_MACHINE, introducing for loops wherever we needed to deal with them. However, I have chosen to use a much more structured approach. Each task which needs to use the build directory uses the following pseudocode: do_mytask() { if ${UBOOT_CONFIG}; then for config, type in zip(${UBOOT_CONFIG}, ${UBOOT_MACHINE}); do cd ${config} mytask_helper ${type} done else cd ${B} mytask_helper "" fi } By explicitly placing the work in mytask_helper, we make it easier to ensure that everything is covered, and we also allow bbappends files to more easily extend the task (as otherwise they would need to reimplement the loop themselves). [1] It doesn't particularly matter what we sign. Any FIT will do, but I chose the kernel's because we already went to the trouble of setting it up with the correct hashes and signatures. In the future, we could create a "dummy" image and sign that instead, but it would probably have to happen in the kernel recipe anyway (so we have access to the appropriate variables). (From OE-Core rev: 5e12dc911d0c541f43aa6d0c046fb87e8b7c1f7e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26uboot-sign: Split off kernel-fitimage variablesSean Anderson
In preparation for the next commit, split off several (From OE-Core rev: 60c1a170f1f8c11bc8f42026debf121433b39115) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26uboot-sign: Use bitbake variables directlySean Anderson
uboot_fitimage_assemble is called from one place with the same arguments. Instead of using shell variables as intermediaries, simplify the function by using the bitbake variables directly. Removing a layer of indirection makes it easier to determine what values are being substituted in. Some variables can't be fully converted, but they will be addressed in the a few commits. (From OE-Core rev: 27f42c9b9a91742d3ee358aa8dc29627379b2539) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26kernel-fitimage: Use KERNEL_OUTPUT_DIR where appropriateSean Anderson
We have a specific variable for the path to the boot directory. Use it instead of open-coding this path. (From OE-Core rev: 725b75e83bc2b2111f2ab5103b7e7f60d6d3f34e) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26kernel: Clear SYSROOT_DIRS instead of replacing sysroot_stage_allSean Anderson
Replacing sysroot_stage_all by a no-op recipe makes it difficult for bbappends to stage files intentionally. Instead, just clear SYSROOT_DIRS, allowing other bbappends to easily add new directories. (From OE-Core rev: 849791e7086463a4c7c53c2c1ed9603a6c3a080d) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26uboot-sign: Fix using wrong KEY_REQ_ARGSSean Anderson
When generating our SPL-verifying certificate, we use FIT_KEY_REQ_ARGS, which is intended for the U-Boot-verifying certificate. Instead, use UBOOT_FIT_KEY_REQ_ARGS. Fixes: 0e6b0fefa0 ("u-boot: Use a different Key for SPL signing") (From OE-Core rev: a2d939ccb182a1ad29280d236b9f9e1d09527af1) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26git: upgrade 2.37.3 -> 2.38.1Tim Orling
Fixes CVE-2022-39260 Git v2.38.1 Release Notes ========================= This release merges the security fix that appears in v2.30.6; see the release notes for that version for details. Excerpt from 2.30.6 release notes: * CVE-2022-39260: An overly-long command string given to `git shell` can result in overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution when `git shell` is exposed and the directory `$HOME/git-shell-commands` exists. `git shell` is taught to refuse interactive commands that are longer than 4MiB in size. `split_cmdline()` is hardened to reject inputs larger than 2GiB. Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub. The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau. For 2.38.0 changes, see: https://github.com/git/git/blob/master/Documentation/RelNotes/2.38.0.txt (From OE-Core rev: b304768711374066db320fe87960be81f54a8424) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551Ross Burton
(From OE-Core rev: e32401d8bf44afcca88af7e4c5948d2c28e1813f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26xserver-xorg: ignore CVE-2022-3553 as it is XQuartz-specificRoss Burton
(From OE-Core rev: 769576f36aac9652525beec5c7e8a4d26632b844) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26libx11: apply the fix for CVE-2022-3554Ross Burton
(From OE-Core rev: 5d30f124274d2822d72b56f84eb8c8ae64e31e0d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26kernel-yocto: improve fatal error messages of symbol_why.pyJose Quaresma
Improve the fatal error message of the yocto-kernel-tools symbol_why.py and shows the command that generate the error as it can help understand the root cause of the error. (From OE-Core rev: 54ae08779071f2e97bff0ff6514ede3124312c3b) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26os-release: add HOMEPAGE and link to documentationMikko Rapeli
It's important to use standard variable names in the /etc/os-release file. Otherwise reporting version etc details requires custom modifications in various tools. (From OE-Core rev: af528f4b46e5df0a176d91d46cc6f89c7296c602) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-11 18:37:50 +0000