This is Debian-specific CVE.
NVD tracks this CVE as version-less.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 87a1bcc14985dcb00081f7434697ff7576c8302f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Change the SRC_URI to the correct value due to the following error:
WARNING: vlock-2.2.3-r0.vr2401 do_fetch: Failed to fetch URL http://distfiles.gentoo.org/distfiles/vlock-2.2.3.tar.gz, attempting MIRRORS if available
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 784942b68ef0a9533defee6c6f3d695e1c02cd3f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Build checks for this during configure but the test is a runtime
test, which does not work when cross-compiling, therefore
prescribe this by caching it for architecture/compiler options
where it will work ok.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 91c7ac099beca35f7081facd82bee27d9aaf46ba)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This macro is documented, so it should be consistent across
different build systems. It's defined in autotools, but not
cmake. Add it for cmake.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a3854f6893afb53d896394ddcc26568b25d04d91)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
wtmpdb installs a PAM plugin in "${base_libdir}/security/pam_wtmpdb.so".
This path is not in default FILES.
Add this path to FILES:${PN} to fix this error:
ERROR: wtmpdb-0.11.0-r0 do_package: QA Issue: wtmpdb: Files/directories were installed but not shipped in any package:
/lib/security/pam_wtmpdb.so
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
wtmpdb: 1 installed and not shipped files. [installed-vs-shipped]
ERROR: wtmpdb-0.11.0-r0 do_package: Fatal QA errors were found, failing task.
ERROR: Logfile of failure stored in: .../poky/build-master/tmp/work/core2-64-poky-linux/wtmpdb/0.11.0/temp/log.do_package.939726
ERROR: Task (.../poky/meta-openembedded/meta-oe/recipes-extended/wtmpdb/wtmpdb_0.11.0.bb:do_package) failed with exit code '1'
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a090cd3e0ef554d7171eb84488661599d72fa3e9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
RISCV support in highway is assuming RVV and RISCV64
however, there is RISCV32 which perhaps does not
have RVV yet
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changes vs 3.3a are located at
https://raw.githubusercontent.com/tmux/tmux/3.4/CHANGES. However, the most
pressing reason to upgrade is that tmux crashes on copy, see
https://github.com/tmux/tmux/issues/3699.
tmux's config parser was rewritten to use yacc, which necessitates DEPENDS +=
bison-native.
drop md5sum
Signed-off-by: Rich Tollerton <rich.tollerton@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- flatpak-spawn now supports --sandbox-a11y-own-name (if supported by portal)
- flatpak-spawn prints a useful error when --host isn't permitted
- fixed minor leak in flatpak-spawn
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Polkit unconditionally installs a systemd service, remove it in
do_install() on SysVinit systems to avoid "installed but not packaged
file" error.
Fixes this error:
ERROR: polkit-125-r0 do_package: QA Issue: polkit: Files/directories were installed but not shipped in any package:
/usr/lib/systemd
/usr/lib/systemd/system
/usr/lib/systemd/system/polkit.service
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
polkit: 3 installed and not shipped files. [installed-vs-shipped]
ERROR: polkit-125-r0 do_package: Fatal QA errors were found, failing task.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add a new OS option to polkit meson: "openembedded" and use this to
set PAM include to common-* which matches OE-Core libpam.
This also may fix a non-reproducibility since polkit meson system tried
to detect the host (compiling) OS and changed PAM config from the
detected value.
Fixes: https://github.com/openembedded/meta-openembedded/issues/860
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
GPR_ASSERT is removed from latest gprc
Fixes
| /home/pokybuild/yocto-worker/meta-oe/build/build/tmp-glibc/work/core2-64-poky-linux/etcd-cpp-apiv3/0.15.4/git/src/v3/Action.cpp: In member function 'void etcdv3::Action::waitForResponse()':
| /home/pokybuild/yocto-worker/meta-oe/build/build/tmp-glibc/work/core2-64-poky-linux/etcd-cpp-apiv3/0.15.4/git/src/v3/Action.cpp:101:5: error: 'GPR_ASSERT' was not declared in this scope
| 101 | GPR_ASSERT(got_tag == (void*) this);
| | ^~~~~~~~~~
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- fix time calculations for dead host
- change paxos_acquire error for initial host state
- fix for lver that was abandoned in dblock
- terminate helper path and args
- fix freeing lvb after io timeout
- add sysusers file
- rem_lockspace EBUSY when orphans exist
- fix SANLK_ACQUIRE_ORPHAN_ONLY
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
============
- omkafka enhance: write Kafka log with level ERROR or higher into errorfile
- net subsusytem bugfix: some config statemens were not accepted
- new "ossl" crypto provider
- imtcp: improve connection error messages
0001-tests-disable-the-check-for-inotify.patch
use-pkgconfig-to-check-libgcrypt.patch
refreshed for 8.2408.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- pam_lastlog2: differentiate between three error cases
- Fix error handling of sqlite3_step
- Don't call exit() in a library
- Support 32bit time_t (but is not Y2038 safe!)
- lib/lastlog2: always use int64_t internal
- committed
- Fix minimum required meson version
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
In version 0.9.6 issue #362 was fixed. Thus, the tweak in the compile
flags is no longer needed.
The checksum of the LICENSE file changed because the copyright range
was updated.
Changelog: https://github.com/Neargye/magic_enum/releases/tag/v0.9.6
Signed-off-by: Ricardo Simoes <ricardo.simoes@pt.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Dependencies:
In distributions that compile Flatpak to use a separate bubblewrap (bwrap) executable, version 0.10.0 is required.
This version adds a new feature which is required by the security fix in this release.
Security fixes:
Don't follow symbolic links when mounting persistent directories (--persist option). This prevents a sandbox escape where a malicious or compromised app could edit the symlink to point to a directory that the app should not have been allowed to read or write. (CVE-2024-42472, GHSA-7hgv-f2j8-xw87)
Documentation:
Mark the 1.12.x and 1.10.x branches as end-of-life (#5352)
Other bug fixes:
Fix several memory leaks (#5883, #5884)
Internal changes:
Record a log file when running build-time tests with AddressSanitizer (#5884)
Add initial suppressions file for AddressSanitizer (#5884)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* broken since
https://github.com/openembedded/meta-openembedded/pull/859
which moved the files from ${sysconfdir} which is packaged
in ${PN} by default into ${datadir} which isn't packaged causing:
ERROR: QA Issue: polkit-group-rule-network: Files/directories were installed but not shipped in any package:
/usr
/usr/share
/usr/share/polkit-1
/usr/share/polkit-1/rules.d
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
polkit-group-rule-network: 4 installed and not shipped files. [installed-vs-shipped]
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It does not build in a reproducible way that is now enforced by
yocto project. Fails with
WARNING: fluentbit-1.9.9-r0 do_package_qa: QA Issue: File /usr/bin/.debug/td-agent-bit in package fluentbit-dbg contains reference to TMPDIR [buildpaths]
Signed-off-by: Khem Raj <raj.khem@gmail.com>
pr,openssl,chown,chgrp are guessed during configure and they are
found on host, sometimes under native sysroot and some under HOSTTOOLS
which is not right, therefore point to target locations of these tools
Fixes all errors like below
File /usr/sbin/lprng_certs in package lprng contains reference to TMPDIR
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Rules shipped by OS packages should go in /usr/share/. /etc/ is
reserved for local modifications. This allows local users and
admins to provide overrides. It also removes the need to fix
directory permissions.
Signed-off-by: Luca Boccassi <bluca@debian.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is no longer required by upstream for data in /usr/, as it ships
in packages so there's no point hiding its content. Still required for
/etc/ as that's for local modifications.
Signed-off-by: Luca Boccassi <bluca@debian.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upstream repo does not tag so, use UPSTREAM_CHECK_COMMITS to detect
upstream updates.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upstream repo does not tag so, use UPSTREAM_CHECK_COMMITS to detect
upstream updates.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When performing devtool check-upgrade-status, UNKNOWN_BROKEN status appears.
On the upstream source repository, releases are not identified by tags. So,
UPSTREAM_CHECK_COMMITS is set to 1, to find the latest upstream update.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When performing devtool check-upgrade-status, UNKNOWN_BROKEN status appears.
On the upstream source repository, releases are not identified by tags. So,
UPSTREAM_CHECK_COMMITS is set to 1, to find the latest upstream update.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When performing devtool check-upgrade-status, UNKNOWN_BROKEN status appears.
On the upstream source repository, releases are not identified by tags. So,
UPSTREAM_CHECK_COMMITS is set to 1, to find the latest upstream update.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When performing devtool check-upgrade-status, UNKNOWN_BROKEN status appears.
On the upstream source repository, releases are not identified by tags. So,
UPSTREAM_CHECK_COMMITS is set to 1, to find the latest upstream update.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- flatpak now uses wrap files instead of git submodules to fetch bwrap and xdg-dbus-proxy
For reproducibility reasons, this cannot be done. Add external binaries and configure like
recommended below:
Dependencies:
bubblewrap and xdg-dbus-proxy are now provided by Meson wrap files instead of being directly vendored via git submodule. If downloading external software during build is not allowed in your environment, please install suitable versions of bubblewrap and xdg-dbus-proxy separately, then configure Flatpak with options similar to -Dsystem_bubblewrap=bwrap -Dsystem_dbus_proxy=xdg-dbus-proxy (most major distributions package it like this already).
Enhancements:
If xdg-dbus-proxy is new enough (0.1.6 or later, not yet released), allow two broadcast signals from AT-SPI by default, allowing bus traffic to be reduced. If xdg-dbus-proxy is older, this change will have no practical effect but is harmless. (#5828)
Install csh profile snippet (#5753)
Bug fixes:
Expand the list of environment variables that Flatpak apps do not inherit from the host system (#5765, #5785)
Take time zone information from $TZDIR if set (#5850)
Fix a memory leak since 1.15.7 when reloading D-Bus configuration (#5856)
Fix a memory leak when running flatpak permissions (#5844)
Fix memory leaks in flatpak update (#5816)
Fix memory leaks when installing packages (#5811)
Use more similar translatable strings for some error messages (#5748)
Document flatpak config --set languages '*all*' correctly: it is really *all* (or equivalently *), not just all (#5836)
Fix a misleading comment in the test for CVE-2024-32462 (#5779)
Fix a copy/paste error in the 1.15.7 release notes
On systems where subdirectories of /sys have been made inaccessible, continue without them (#5138)
Make tests more compatible with non-GNU shell utilities (#5812)
Translation updates: ka (#5873), hi (#5838), pt_BR (#5877), zh_CN (#5843)
Internal changes:
libglnx and variant-schema-compiler are now managed as git subtree instead of git submodule. Maintainers and contributors, please see subprojects/README.md for details of how to interact with these. In particular this means that submodules no longer need to be set up before working on a git clone. (#5800, #5845)
Split library code into more, smaller translation units, reducing internal circular dependencies (#5409, #5801, #5803)
Add some convenience macros in the test suite (#5693)
Minor internal robustness improvement (#5833)
Add configuration for Github Codespaces (#5767)
Improve CI configuration (#5791)
Work around infrastructure issues in third-party apt repositories used by default in Github Workflows (#5786)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add elogind package config option.
Also make sure the systemd, consolekit and elogind options are
mutually exclusive (as defined in the meson_options.txt file).
Signed-off-by: Marc Ferland <marc.ferland@gmail.com>
