Backport upstream patch for CVE-2019-15133.
Set CVE_PRODUCT to "giflib_project:giflib" which is used
in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2020-35864 is for the rust crate for flatbuffers, not
flatbuffers itself.
https://security-tracker.debian.org/tracker/CVE-2020-35864
"NOT-FOR-US: flatbuffers rust crate"
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The custom configure block can be shared between target
and native if you just configure the sysroot option accordingly
and use STAGING_INCDIR to locate the python headers to build
against.
Signed-off-by: S. Lockwood-Childs <sjl@vctlabs.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5fe362171c7f3426fced0c7889facec397c9cc5e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
0001-libopeniscsiusr-Compare-with-max-int-instead-of-max-.patch
Removed since this is included in 2.1.3
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 46e30569e3b3d0cc66ce05e9accd759f37705feb)
[Bug fix only update. Includes several CVE fixes.
CVE-2020-17437
CVE-2020-17438
CVE-2020-13987
CVE-2020-13988 ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The configure script contains hardcoded lookup paths to /usr and other
paths that might interfere with the host. These are overwritten with the
staging dir locations for Poky compatibility.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 74b66d1911118bac53033f77ba6d3923f4809d5a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Fixes the following CVEs:
CVE-2020-25694
CVE-2020-25695
CVE-2020-25696
Full release notes at:
https://www.postgresql.org/docs/12/release-12-5.html
Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Remove --enable-music-ogg-tremor as it broke vorbis support:
checking tremor/ivorbisfile.h usability... no
checking tremor/ivorbisfile.h presence... no
checking for tremor/ivorbisfile.h... no
checking for ov_open_callbacks in -lvorbisidec... no
configure: WARNING: *** Unable to find Ogg Vorbis Tremor library (http://www.xiph.org/)
configure: WARNING: Ogg Vorbis support disabled
With this change:
checking vorbis/vorbisfile.h usability... yes
checking vorbis/vorbisfile.h presence... yes
checking for vorbis/vorbisfile.h... yes
checking for ov_open_callbacks in -lvorbisfile... yes
-- dynamic libvorbisfile -> libvorbisfile.so.3
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 074c7d9a1ebb86674f02d8a5545e1ed54f6d87fe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
scripts/build is interpreted as an sh script which may not recognize variable
assignment operator += and thus give the following error and fail to append
LDLIBS.
../scripts/build: 21: ../scripts/build: LDLIBS+=-lm: not found
Use the basic assignment instead.
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a6a8fc75bad04be0842e22fb137d0e7a2dcb7279)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upstream has deleted the 'master' branch, so use the 1.2 branch.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 583fbb4775a960391cb62d55164b91570a70921a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This is to update the tclap v1.2.2 with several bug fixes.
See:
https://sourceforge.net/p/tclap/bugs/23/
Signed-off-by: Chencheng Zhang <chencheng@wittra.se>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f03ad4971ed0b7cf34550a90ee3c0fa18f964533)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* I enabled the shared library option to eliminate linker issues
with a package that used spdlog.
* Edited the tweak.h file so programs use the external fmt library
headers, not the oners in spdlog.
Signed-off-by: Philip Balister <philip@opensdr.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 010cd128e7ae8258f83c03195caa605bbce3e76b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This works fine until valgrind is installed on build host but its not
selected as option to build in recipe, configure wrongly pokes at
/usr/lib and sees valgrind there and enables it but only to fail in
compile time where it does not find valgrind.h in recipe sysroot, since
OE's build environment add right guardrails to pkgconfig, there is no
need to add build staging area to pkgconfig search path which turns out
to be wrong for cross builds anyway
Fixes
../../../pidgin-sipe-1.25.0/src/core/sipe-cert-crypto-nss.c:34:10: fatal error: 'valgrind.h' file not found
^~~~~~~~~~~~
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 99bc44010402c2d8211805e78f6d4df751cf00e0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
When multilib is enabled, tmpfiles.d is created in /usr/lib rather than
${libdir} which is /usr/lib64. It causes installed-vs-shipped error:
| ERROR: colord-1.4.4-r0 do_package: QA Issue: colord:
Files/directories were installed but not shipped in any package:
| /usr/lib/tmpfiles.d
| /usr/lib/tmpfiles.d/colord.conf
Fix the path in FILES to fix the issue.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f147cbab5d11e7f708448de1917d78ff99170464)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The Debian pool URLs are not permanent, and the package is no longer
included in any active Debian release. It is also not available through
any of the default Debian snapshot mirrors. Instead of adding a new
Debian snapshot mirror, use the upstream URL directly.
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5265de84b38c3ce946bdc0a489a70cedf7145e1a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The Debian pool URLs are not permanent and the package might vanish as
soon as the version is no longer part of any Debian release. Use the
upstream URL directly.
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2e1a32a474b8600b56e4d7e2434967103b267ccb)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
aiohttp implicitly RDEPENDs on html, json, and socketserver modules,
which are part of python3 recipe. They can't be properly imported if
they are missing from RDEPENDS
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8e7c57bd8f8250251e54fcbe149dc81743c0e30a)
[Fixup for Gatesgarth context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The /etc/ethertypes is provided by netbase since 6.0[1].
Do not instal the file in ebtables, otherwise there would be a conflict:
Error: Transaction test error:
file /etc/ethertypes conflicts between attempted installs of netbase-1:6.2-r0.corei7_64 and ebtables-2.0.10+4-r4.corei7_64
[1] 316680c6a2
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit af6f068632281f8abd42dd3e3301eddd2b0d3ae4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Since systemd v246.5[1], udev_monitor_set_receive_buffer_size() will
return 0 or 1 if successful. We only need to check a negative value for
the failure.
[1] 4dcae66688fe9b92e5665dd4cc4b10
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 60a95ba16ec29d9cb8be32436bb0f96b2a5106aa)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Uprev nodejs in order to fix CVE-2020-8277.
This CVE allows an attacker to trigger a DNS request for a host
of their choice, which could trigger a Denial of Service in
nodejs versions < 12.19.1.
See https://nvd.nist.gov/vuln/detail/CVE-2020-8277 for details.
CVE: CVE-2020-8277
Signed-off-by: Stacy Gaikovaia <Stacy.Gaikovaia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a44015408253d8a4f64055f41fa1f497aeacfc30)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Because CVE-2019-14274.patch is included in ice-mcpp.patch, the cve-check-tool fails to correctly judge the CVE of the OSS. CVE-2019-14274.patch is separated from ice-mcpp.patch to fix the problem.
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9301b77e3266160ffb7e9bfd69d445f0392076c8)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This change causes build failure:
Found CMake: NO
| Run-time dependency libhandy-1 found: NO (tried pkgconfig)
|
| ../gnome-calendar-3.38.1/meson.build:166:0: ERROR: Dependency "libhandy-1" not found, tried pkgconfig
Gategarth Core version of libandy is 0.0.13 so this patch is puzzling
This reverts commit 46ac17595bbd74a3dbcfbc7b5e1456ff78f5dca7.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Commits e2180b00b3b8fcf776c3 and 8edd760e66b48e411d2a added support for
native builds for the opensc and pcsc-lite recipes, but building
opensc-native fails after commit 40b3a5123120da0e4586 (2019-12-04,
"opensc: fix RDEPENDS in pcsc PACKAGECONFIG") with:
ERROR: Required build target 'opensc-native' has no buildable providers.
Missing or unbuildable dependency chain was: ['opensc-native', 'pcsc-lite-lib-native']
The commit in question is correct for target builds, but native builds
don't have packages, therefore there is no pcsc-lite-lib-native package
to depend on – the -lib part is also provided in pcsc-lite-native.
Ideally we would fix this in the opensc recipe. However, using syntax
like "PACKAGECONFIG_class-native[pcsc]" in the opensc recipe is
apparently not possible to overwrite the dependency for a native build,
and using RDEPENDS_remove has no effect either – apparently dependencies
from PACKAGECONFIG are added after RDEPENDS_remove is evaluated.
Therefore let pcsc-lite provide the missing package name for native
builds, even if fixing this unrelated package is not the most elegant
solution.
Fixes: 40b3a5123120da0e4586 (2019-12-04, "opensc: fix RDEPENDS in pcsc PACKAGECONFIG")
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
More information on: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976228
| A buffer overflow in the dlt_filter_load function in dlt_common.c in
| dlt-daemon 2.8.5 (GENIVI Diagnostic Log and Trace) allows arbitrary
| code execution because fscanf is misused (no limit on the number of
| characters to be read in a format argument).
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Appending ${TMPDIR} to ${D} doesn't make any sense, because both are
absolute paths. And additionally, the code fails:
rmdir: failed to remove '/usr/src/oe/tmp-musl/work/core2-64-oe-linux-musl/php/7.1.9-r0/image//usr': Directory not empty
Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add nettle and lz4 to DEPENDS to make the minifi extension archive
support crypto and lz4.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This reverts commit e5d9133800f5c37172a6315d42a99464f9fe1902.
It exists in oe-core/master, but not in oe-core/gatesgarth, so this shouldn't
be included in meta-oe/gatesgarth.
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 7.19.0:
- Fix to restore the ability to specify more than one extension
using command line flags when using traitlets 5.0
- Docs docs formatting that make the install commands work on zsh
- Always display the last frame in tracebacks even if hidden with
__traceback_hide__
- Avoid an issue where a callback can be registered multiple times.
- Avoid an issue in debugger mode where frames changes could be
lost.
- Never hide the frames that invoke a debugger, even if marked as
hidden by __traceback_hide__
- Fix calling the debugger in a recursive manner
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
