mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-08-16 06:19:28 +00:00
15b3c0f141
Contains fixes for CVE-2026-34078 and CVE-2026-34079 Add explicit CVE_STATUS tags for these CVEs, because they are tracked without version info by NVD at this time. Changelog: 17.6: Bug fixes: - Fix the remaining regression for Chromium based browsers by not leaking file descriptors down to wrapped command - Fix a regression when installing extra-data without a runtime, which is the case for openh264 - Fix the remaining regression for Epiphany by ignoring unusable sandbox-expose paths for sub-sandboxes in the portal - Fix the installed tests by allowing to add a new ref to an existing temporary ostree repo - Avoid closing fds 0/1/2 when they are used as a bad argument to flatpak-run, and reduce duplication in handling file descriptor arguments Enhancements: - Disable auto-pin in flatpak-repair to preserve the pin state across re-installs - Small improvements for the tests 17.5: Bug fixes: - Fix regressions caused by the sandbox escape security fix, which impact some browsers, browser-based apps and Steam (#6577, #6569, #6576, #6574) Enhancements: - Expand test coverage of flatpak-run features used by flatpak-portal (#6573) 17.4: Security fixes: - Fix a complete sandbox escape which leads to host file access and code execution in the host context (CVE-2026-34078) - Prevent arbitrary file deletion on the host filesystem (CVE-2026-34079) - Prevent arbitrary read-access to files in the system-helper context (GHSA-2fxp-43j9-pwvc) - Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg) Enhancements: - Enable ntsync unconditionally - Automatic branch following for extensions to ensure that "no-autodownload" extensions stay functional after an update that requires a new branch - Translation updates: eo, kk, sr, zh_CN Bug fixes: - Prevent CPR sequence from showing up in the terminal - Fix a crash for apps/runtimes with multiarch permission - Fixes for Coverity warnings - Add test-preinstall.sh to the test matrix source - Fix a test message to refer to "systemd-localed" instead of "located" Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
82 lines
2.5 KiB
BlitzBasic
82 lines
2.5 KiB
BlitzBasic
DESCRIPTION = "Desktop containment framework."
|
|
HOMEPAGE = "http://flatpak.org"
|
|
LICENSE = "LGPL-2.1-only"
|
|
LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
|
|
|
|
SRC_URI = " \
|
|
git://github.com/flatpak/flatpak;protocol=https;branch=main;tag=${PV} \
|
|
file://0001-flatpak-pc-add-pc_sysrootdir.patch \
|
|
"
|
|
|
|
SRCREV = "9b21874f1a175a9b7c79175a221fa043e202ca73"
|
|
|
|
|
|
inherit meson pkgconfig gettext systemd gtk-doc gobject-introspection python3native mime features_check useradd
|
|
|
|
REQUIRED_DISTRO_FEATURES = "polkit"
|
|
|
|
DEPENDS = " \
|
|
appstream \
|
|
bison-native \
|
|
bubblewrap-native \
|
|
fuse3 \
|
|
gdk-pixbuf \
|
|
glib-2.0 \
|
|
gpgme \
|
|
json-glib \
|
|
libarchive \
|
|
libcap \
|
|
libxml2 \
|
|
ostree \
|
|
polkit \
|
|
python3-pyparsing-native \
|
|
xdg-dbus-proxy-native \
|
|
zstd \
|
|
curl \
|
|
"
|
|
|
|
RDEPENDS:${PN} = " \
|
|
ca-certificates \
|
|
flatpak-xdg-utils \
|
|
fuse3-utils \
|
|
bubblewrap \
|
|
xdg-dbus-proxy \
|
|
"
|
|
|
|
GIR_MESON_OPTION = "gir"
|
|
GIR_MESON_ENABLE_FLAG = 'enabled'
|
|
GIR_MESON_DISABLE_FLAG = 'disabled'
|
|
GTKDOC_MESON_OPTION = 'gtkdoc'
|
|
GTKDOC_MESON_ENABLE_FLAG = 'enabled'
|
|
GTKDOC_MESON_DISABLE_FLAG = 'disabled'
|
|
|
|
PACKAGECONFIG[dconf] = "-Ddconf=enabled,-Ddconf=disabled,dconf"
|
|
PACKAGECONFIG[docbook_docs] = "-Ddocbook_docs=enabled,-Ddocbook_docs=disabled,xmlto-native"
|
|
PACKAGECONFIG[man] = "-Dman=enabled,-Dman=disabled,libxslt-native"
|
|
PACKAGECONFIG[tests] = "-Dtests=true,-Dtests=false,xauth socat-native"
|
|
PACKAGECONFIG[xauth] = "-Dxauth=enabled,-Dxauth=disabled,xauth"
|
|
PACKAGECONFIG[seccomp] = "-Dseccomp=enabled,-Dseccomp=disabled,libseccomp"
|
|
PACKAGECONFIG[malcontent] = "-Dmalcontent=enabled,-Dmalcontent=disabled,malcontent"
|
|
PACKAGECONFIG[selinux] = "-Dselinux_module=enabled,-Dselinux_module=disabled,libselinux"
|
|
PACKAGECONFIG[wayland-security-context] = "-Dwayland_security_context=enabled,-Dwayland_security_context=disabled,wayland wayland-native wayland-protocols"
|
|
|
|
PACKAGECONFIG ?= " \
|
|
${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'xauth', '', d)} \
|
|
${@bb.utils.contains('DISTRO_FEATURES', 'seccomp', 'seccomp', '', d)} \
|
|
${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'wayland-security-context', '', d)} \
|
|
"
|
|
|
|
EXTRA_OEMESON = " \
|
|
-Dsystem_fusermount=fusermount3 \
|
|
-Dsystem_bubblewrap=bwrap \
|
|
-Dsystem_dbus_proxy=xdg-dbus-proxy \
|
|
"
|
|
|
|
USERADD_PACKAGES = "${PN}"
|
|
USERADD_PARAM:${PN} = "--system --no-create-home --user-group --shell /sbin/nologin flatpak"
|
|
|
|
FILES:${PN} += "${libdir} ${datadir}"
|
|
|
|
CVE_STATUS[CVE-2026-34078] = "fixed-version: fixed in v1.17.4"
|
|
CVE_STATUS[CVE-2026-34079] = "fixed-version: fixed in v1.17.4"
|