9731 Commits

Author SHA1 Message Date
Peter Marko
0bab6572a6 binutils: patch CVE-2025-0840
Backport [1] as listed in [2].

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-0840

(From OE-Core rev: 059b6bb3058fadbeee2626ab241de315ed1b0baa)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-03-15 06:44:46 -07:00
Peter Marko
64e49ed5e7 subversion: ignore CVE-2024-45720
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45720

This CVE is relevant only for subversion running on Windows.

(From OE-Core rev: 1be6e32a75e40bc3e1d3c7256350579c37e3d22f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Reviewed-by: Sofiane Hamam <sofiane.hamam@smile.fr>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-03-13 07:21:43 -07:00
Peter Marko
b17d4e97e7 go: upgrade 1.22.11 -> 1.22.12
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.11..go1.22.12
5817e65094 (tag: go1.22.12) [release-branch.go1.22] go1.22.12
0cc45e7ca6 [release-branch.go1.22] crypto/internal/fips140/nistec: make p256NegCond constant time on ppc64le
c3c6a50095 [release-branch.go1.22] cmd/go/internal/modfetch: do not trust server to send all tags in shallow fetch
e0a01acd04 [release-branch.go1.22] cmd/compile: fix write barrier coalescing

Fixes CVE-2025-22866

[1] https://github.com/golang/go/compare/go1.22.11...go1.22.12

(From OE-Core rev: 423ad5a67768738dac454b1e2aa27746f74511c5)

(From OE-Core rev: ce999920af8c8ac6ce4c3f37edae348919e8a13b)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-14 07:49:10 -08:00
Peter Marko
61e2aebcb5 python3: upgrade 3.12.8 -> 3.12.9
Release notes:
https://docs.python.org/release/3.12.9/whatsnew/changelog.html#python-3-12-9

Solves CVE-2025-0938, CVE-2024-12254 and 3 other vulnerabilities without
CVE number assigment.

Add a patch to fix failure of a new test.

(From OE-Core rev: cb0187ed2962e4c140c4f59ce08f94b18b05004c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-14 07:49:09 -08:00
Alexander Kanavin
d78b78df91 libxml-parser-perl: correct SRC_URI
(From OE-Core rev: d2a7186bfc819cc52901b8cf8086d53342586a60)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b3e44bbf9972968076f06ecac027bd7a2f3fe781)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-12 06:29:34 -08:00
Peter Marko
281e96aaec go: upgrade 1.22.10 -> 1.22.11
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.10..go1.22.11
f072884354 (tag: go1.22.11) [release-branch.go1.22] go1.22.11
b72d56f98d [release-branch.go1.22] net/http: persist header stripping across repeated redirects
19d2103415 [release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in URIs
ae9996f965 [release-branch.go1.22] runtime: hold traceAcquire across casgstatus in injectglist
223260bc63 [release-branch.go1.22] crypto/tls: fix Config.Time in tests using expired certificates

Fixes CVE-2024-45336 and CVE-2024-45341

[1] https://github.com/golang/go/compare/go1.22.10...go1.22.11

(From OE-Core rev: 4589986602319f9ed61e381b333bb53b731eb8d8)

(From OE-Core rev: 622f866e00c0c3bdc80670df04378cb49381ea9c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-03 06:24:37 -08:00
Peter Marko
ec14a3ed28 go: upgrade 1.22.9 -> 1.22.10
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.9..go1.22.10
8f3f22eef8 (tag: go1.22.10) [release-branch.go1.22] go1.22.10
6d7a95abca [release-branch.go1.22] runtime: reserve 4kB for system stack on windows-386
6f05fa7a4f [release-branch.go1.22] syscall: mark SyscallN as noescape
3355db9690 [release-branch.go1.22] time: accept "+01" in TestLoadFixed on OpenBSD

[1] https://github.com/golang/go/compare/go1.22.9...go1.22.10

(From OE-Core rev: e357c93b39df938dc36195dbd779a58b2951b8e6)

(From OE-Core rev: d723fa3573d02cc815ad9706aafd7510eb54eac6)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-03 06:24:37 -08:00
Peter Marko
b0df688b3c go: upgrade 1.22.8 -> 1.22.9
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.8..go1.22.9
8af39d30a4 (tag: go1.22.9) [release-branch.go1.22] go1.22.9
c19e5887f4 [release-branch.go1.22] cmd/cgo/internal/testcarchive: remove 1-minute timeout
e3fd4ba7f9 [release-branch.go1.22] cmd/link: generate Mach-O UUID when -B flag is specified
29252e4c5a [release-branch.go1.22] runtime: fix TestGdbAutotmpTypes on gdb version 15

[1] https://github.com/golang/go/compare/go1.22.8...go1.22.9

(From OE-Core rev: 4f2f202506bcefb4d6c46a11738e159e261a4a4b)

(From OE-Core rev: 3425dd4ba1723fb9c660b3941fd92209c3141dd3)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-03 06:24:37 -08:00
Ross Burton
dbb36a45f0 classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architecture
Using the package architecture to select the right qemu options to pass
to qemu-user is incorrect, and fails for recipes that set PACKAGE_ARCH
to MACHINE_ARCH (as the qemuppc workarounds suggest) because there are
not typically any options set for the machine name.

Solve this by using TUNE_PKGARCH instead: for the majority of recipes
this is the same value, but for machine-specific recipes it remains the
same instead of changing to the machine name.

This means we can remove the qemuppc workarounds, as they're obsolete.

Also update the gcc-testsuite recipe which uses the same pattern to use
TUNE_PKGARCH, and generalise the else codepath to avoid needing to
update the list of architectures.

[ YOCTO #15647 ]

(From OE-Core rev: 6db23345fd653aa0b4e483d2635376dfe7bed3cd)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 414b754a6cbb9cc354b1180efd5c3329568a2537)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-29 06:20:43 -08:00
Deepthi Hemraj
b2cd1dea04 binutils: stable 2.43.1 branch update
Below commit on binutils-2.43.1 stable branch are updated.
b82e2250574 Automatic date update in version.in
280374309b1 PR32300, --dependency-file: link dependencies are not all collected
263e116833e s390: Add arch15 instructions
645da6d426e s390: Relax risbg[n]z, risb{h|l}gz, {rns|ros|rxs}bgt operand constraints
7f7047a9c6c s390: Simplify (dis)assembly of insn operands with const bits
e7592364504 s390: Align opcodes to lower-case
d6ab1d2efdc s390: Document syntax to omit base register operand
c40337b1784 LoongArch: Add elfNN_loongarch_mkobject to initialize LoongArch tdata
95ed7cf1be2 segv in bfd_elf_get_str_section
0a71d78f6a6 ld: Don't explicitly add .note.gnu.build-id in elf.sc
ad2ce1e6457 x86: Turn PLT32 to PC32 only for PC-relative relocations
238493e7f09 x86-64: Disable PIE on PR gas/32189 test
68d5dbd315d x86-64: Never make R_X86_64_GOT64 section relative
d77d08180d1 x86/APX: Don't promote AVX/AVX2 instructions out of APX spec
f307db3d8b7 bfd: Pass true to ld_plugin_object_p
cd3e2b58f2c PR32109, aborting at bfd/bfd.c:1236 in int _bfd_doprnt
2d37b890e56 lto: Add a test for PR ld/32083
d16a1893c44 ld: Add an LTO test for common symbol override
e4cfe6dab3e Re-enable development changes on the 2_43 branch

Testing was done and there were no regressions found

(From OE-Core rev: dce36f0c4a2c1455ecce56377afc3d436096360a)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4950a2d67a85b3f4a643a46fdc54d348abce5ed6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-13 05:49:08 -08:00
Yash Shinde
44c8d98587 binutils: Fix CVE-2024-53589
A buffer overflow vulnerability exists in GNU Binutils’ objdump utility
when processing tekhex format files. The vulnerability occurs in the
Binary File Descriptor (BFD) library’s tekhex parser during format identification.
Specifically, the issue manifests when attempting to read 8 bytes at an address
that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read.

Backport a patch from upstream to fix CVE-2024-53589.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88]

(From OE-Core rev: 04c6b181bf9b1babd647c642ba8598b837f1263b)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-09 06:02:48 -08:00
Sunil Dora
d0a0b07574 gcc: Fix c++: tweak for Wrange-loop-construct
This commit updates the warning to use a check for "trivially constructible" instead of
"trivially copyable." The original check was incorrect, as "trivially copyable" only applies
to types that can be copied trivially, whereas "trivially constructible" is the correct check
for types that can be trivially default-constructed.

This change ensures the warning is more accurate and aligns with the proper type traits.

LLVM accepted a similar fix:
https://github.com/llvm/llvm-project/issues/47355

PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731]

(From OE-Core rev: b8260e5aca93a7000001013f8a950fb040141588)

Signed-off-by: Marek Polacek <polacek@redhat.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-09 06:02:48 -08:00
Guðni Már Gilbert
c2dcb76eb1 python3: upgrade 3.12.7 -> 3.12.8
Changelog:
https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8

(From OE-Core rev: 751cf7a576dbb949763703e655e951bcd583f251)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-09 06:02:48 -08:00
Guðni Már Gilbert
1b4d8585f0 python3: upgrade 3.12.6 -> 3.12.7
Changelog:
https://docs.python.org/release/3.12.7/whatsnew/changelog.html#python-3-12-7

(From OE-Core rev: 103cb3a5390214bd95a75c4db4b00f64b456b7f1)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-09 06:02:48 -08:00
Guðni Már Gilbert
ae130b042f dnf: drop python3-iniparse from DEPENDS and RDEPENDS
python3-iniparse dependency was dropped 2019, see the
following commit as reference:
d7d0e0e2f9

When looking at the Git history, this happened around tag 4.2.1

(From OE-Core rev: 82b1c8fb497f74bbc67cc6763116fa96267acc4a)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-17 12:58:11 -08:00
Guðni Már Gilbert
25b62b9d75 python3-poetry-core: drop python3-six from RDEPENDS
Looking at the history, python3-six was removed as a dependency
in the poetry.lock file in v1.5.2

Even before v1.5.2 and until now (v1.9.1) there is no code in
the package which imports the six module. So it can be safely
dropped from the recipe.

(From OE-Core rev: 01a938f176c1eb2f753c2df50ef966cc175a2d18)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-17 12:58:11 -08:00
Peter Marko
5aec1091bf rust: ignore CVE-2024-43402
This CVE was created because fix for CVE-2024-24576 was incomplete.
Ignore the new CVE in the same way as the old one.

See https://nvd.nist.gov/vuln/detail/CVE-2024-43402

(From OE-Core rev: 6ed9968bf3e35aca316227ee23294c683f77055d)

(From OE-Core rev: 10abc451f37be9d7d6b9482dbd5666a2bf8e9736)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-17 12:58:11 -08:00
Peter Marko
027121de7e qemu: patch CVE-2024-6505
Backport patch [3] as linked from [1] via [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505
[2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760
[3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb

(From OE-Core rev: ded62bdb5ce9da62aaaa53ac20203bd87a7b1197)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-17 12:58:10 -08:00
Markus Volk
d7cd2e6f52 gcc: add a backport patch to fix an issue with tzdata 2024b
There is an issue in the std::chrono::tzdb parser that causes problems
since the tzdata-2024b release started using %z in the main format.

As a real world problem I encounter an issue with the waybar clock module,
which ignores the timezone setting and only shows system time.

(From OE-Core rev: 08dfd3849bd804f4760ebeca226645e65709a65a)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 39018429f05511053ab12e23e7f4487ea25ee529)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-30 05:41:59 -08:00
Aditya Tayade
ce94244963 e2fsprogs: removed 'sed -u' option
In embedded box, sed might be provided another providers like Busybox,
hence use generic options whenever possible.
/bin/sed -> /etc/alternatives/sed
/etc/alternatives/sed -> /bin/busybox.nosuid

Here used 'sed -u' option is not necessary, hence removed it.

Fixes below error:
sed: invalid option -- 'u'

Also added 'set -eux' option which halts execution of the script
on any failures.

(From OE-Core rev: 045d50e63bcaf13056ce749c616eecc4d4516958)

Signed-off-by: Aditya Tayade <Aditya.Tayade@kpit.com>
Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:10 -08:00
Yoann Congal
cc6492d418 python3-maturin: sort external libs in wheel files
Import a merged patch that sort external libs in the wheel file
generated by maturin. That improve reproducibility.

(From OE-Core rev: 055519ae0da73afd1bfb89d74193b41751dc9a80)

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
CC: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 66da28f85727206c0e647efba93c1be028519fe5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Chen Qi
7b3d419028 libgfortran: fix buildpath QA issue
The '-fdebug-prefix-map' options are used to map source files locations,
otherwise, DW_AT_comp_dir will contain buildpath.

The '-gno-record-gcc-switches' option is used to fix the buildpath introduced
by '-fintrinsic-modules-path' option, which is automatically added by fortran.
Here's some output from 'readelf --debug-dump libgfortran.so.5.0.0' when this
option is not added:
"""
<0><1a37d3>: Abbrev Number: 4 (DW_TAG_compile_unit)
   <1a37d4>   DW_AT_producer    : (indirect string, offset: 0xd653): GNU Fortran2008 14.2.0 -m64
                -march=core2 -mtune=core2 -msse3
                -mfpmath=sse -mshstk -g -O2 -O2 -fstack-protector-strong -fimplicit-none
                -fno-repack-arrays -fno-underscoring -fcf-protection=full
                -fallow-leading-underscore -fbuilding-libgfortran -fPIC
                -fintrinsic-modules-path /ala-lpggp72/qichen/Yocto/builds/build-poky/tmp/work/
                core2-64-poky-linux/libgfortran/14.2.0/recipe-sysroot-native/usr/bin/x86_64-poky-linux
                /../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/14.2.0/finclude
                -fpre-include=../../../../recipe-sysroot/usr/include/finclude/math-vector-fortran.h
"""

See https://gcc.gnu.org/pipermail/fortran/2024-October/061204.html for more
detailed information.

(From OE-Core rev: ba53108d33267b58306c6406ec90455bc221edaf)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1eb084956bcba83782bc2b24cf8cc89459a57e34)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Ross Burton
4280b129e7 tcl: skip io-13.6 test case
---- Result was:
{abcdefghj
01234} 0
---- Result should have been (exact matching):
{abcdefghj
} 1 01234 0
==== io-13.6 FAILED

This test is documented as failing on slow machines, so just skip it.

[ YOCTO #15407 ]

(From OE-Core rev: 8b608a5f40c6c40d0fd1091c8943eae61adc1df0)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f69183586655294c9aed6687cebe57767c2f3eb8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Hongxu Jia
f808d877a9 gcc-source: Fix racing on building gcc-source-14.2.0 and lib32-gcc-source-14.2.0
While enabling multilib, build gcc-source-14.2.0 and lib32-gcc-source-14.2.0
at the same time:

    $ MACHINE = "qemux86-64"
    $ require conf/multilib.conf
    $ MULTILIBS = "multilib:lib32"
    $ DEFAULTTUNE:virtclass-multilib-lib32 = "x86"
    $ bitbake gcc-source-14.2.0 lib32-gcc-source-14.2.0
    ...
    $ cat tmp-glibc/work-shared/gcc-14.2.0-r0.vr2401/temp/log.task_order
    20241012-064533.415426 do_recipe_qa (2688052): log.do_recipe_qa.2688052
    20241012-064533.463783 do_recipe_qa (2688051): log.do_recipe_qa.2688051
    20241012-064533.805164 do_fetch (2688257): log.do_fetch.2688257
    20241012-064533.852955 do_fetch (2688256): log.do_fetch.2688256
    20241012-064617.823714 do_unpack (2698542): log.do_unpack.2698542
    20241012-064617.871730 do_unpack (2698541): log.do_unpack.2698541
    ...

There are two tasks for do_fetch, do_unpack and others, so there are race issues.

Both of them have the same hardcode 'gcc' prefix in ${WORKDIR} and
${S}, explicitly disable lib32-gcc-source-14.2.0 for multilib

Set gcc-source as BPN of gcc-source-14.2.0

(From OE-Core rev: 9609a7c9c6d809cc02480c3f12f8dd7c6f3fe9fc)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 901c47877e0710af50639f688e0bfdb851b762b5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Ross Burton
007a24be9c strace: download release tarballs from GitHub
Switch to downloading the release tarballs from GitHub.  Their CDN is
rock solid, and strace.io is hosted inside Russia which some networks
are blocking.

(From OE-Core rev: f0ae7467e194c79778a0561b4cd1eda99f9cc5a8)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bbdbd6d943a64e5b0dae4c2ee705d017fb7ef80e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Richard Purdie
cf7ae7abb7 pseudo: Fix envp bug and add posix_spawn wrapper
Fix pseudo with python 3.13 by adding a wrapper for posix_spawn and
fixing a NULL pointer dereference in envp handling it uncovered. This
fixes issues on Fedora 41.

(From OE-Core rev: 111024b00dab52e6c1e382d931f97af4b90d7683)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d80e20d70d170397f9827c5a5fc75ad1f2e8cd94)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Peter Marko
6a653ee684 go: upgrade 1.22.7 -> 1.22.8
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.7..go1.22.8
aeccd613c8 (tag: go1.22.8) [release-branch.go1.22] go1.22.8
b4086b7c16 [release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document
6fab4b9a9e [release-branch.go1.22] runtime: size maps.Clone destination bucket array safely
71655f14ce [release-branch.go1.22] cmd/cgo: correct padding required by alignment

[1] https://github.com/golang/go/compare/go1.22.7...go1.22.8

(From OE-Core rev: c6808b3b618b377fb5e723c8921c12de7cddb7ff)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 552b9913b25107d7a34611b499b7811896b5f098)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Peter Marko
9c722def51 go: upgrade 1.22.6 -> 1.22.7
Upgrade to latest 1.22.x release [1]:

$ git --no-pager log --oneline go1.22.6..go1.22.7
7529d09a11 (tag: go1.22.7) [release-branch.go1.22] go1.22.7
d4c53812e6 [release-branch.go1.22] go/build/constraint: add parsing limits
2092294f2b [release-branch.go1.22] encoding/gob: cover missed cases when checking ignore depth
b232596139 [release-branch.go1.22] go/parser: track depth in nested element lists
e87be9833e [release-branch.go1.22] runtime: on AIX, fix call to _cgo_sys_thread_create in _rt0_ppc64_aix_lib
676d6100d8 [release-branch.go1.22] cmd/fix: support go versions with patch release
0a525a3ed0 [release-branch.go1.22] os: fix Chtimes test flakes

Fixes CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158

[1] https://github.com/golang/go/compare/go1.22.6...go1.22.7

(From OE-Core rev: aac1f6716deb89edeba223b530c7620e85837cb6)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 92d609c49c0870ca10fcc39d52a801109d65a98b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-26 05:37:09 -08:00
Wang Mingyu
3148ccf972 orc: upgrade 0.4.39 -> 0.4.40
Changelog:
===========
- Security: Minor follow-up fixes for CVE-2024-40897
- powerpc: fix div255w which still used the inexact substitution
- x86: work around old GCC versions (pre 9.0) having broken xgetbv
  implementations
- x86: consider MSYS2/Cygwin as Windows for ABI purposes only
- x86: handle unnatural and misaligned array pointers
- orccodemem: Assorted memory mapping fixes
- Fix include header use from C++
- Some compatibility fixes for Musl
- ppc: Disable VSX and ISA 2.07 for Apple targets
- ppc: Allow detection of ppc64 in Mac OS
- x86: Fix non-C11 typedefs
- meson: Fix detecting XSAVE on older AppleClang
- x86: try fixing AVX detection again by adding check for XSAVE
- Check return values of malloc() and realloc()

(From OE-Core rev: ad56908d308d6d51e2d0b3f258ea52cfe6bf0375)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ed7e4eb12491968c5f962b7e89d557c2c6d86a33)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-11 09:16:26 -08:00
Chen Qi
a78f903a5f json-c: avoid ptest failure caused by valgrind
json-c's ptest will automatically detect valgrind and use it to run
tests. This will fail in case valgrind does not work, e.g., intel-x86-64
(corei7-64) + lib32 image. The error is about illegal instruction.
Error message is like below:

  Illegal instruction     (core dumped) valgrind --tool=memcheck ...
  ERROR: "test1Formatted spaced pretty" exited with non-zero exit status: 132

So we explicitly disable valgrind by exporting USE_VALGRIND=0.

(From OE-Core rev: 78160463259ac3be6de380d12b8cd6159162792b)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b0429a278e39b7a2846144bcc3fcc24ca298cab7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Richard Purdie
8113fd2dc1 binutils: Fix binutils mingw packaging
Use SOLIBSDEV in FILES to fix nativesdk-binutils packaging on mingw
builds.

(From OE-Core rev: 3e953bbf59ed4bd08e40403fb4506dfc35a58f92)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cba58ab2f380252f231fc78944499ade65e32223)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Harish Sadineni
80e1dff59f binutils: Add missing perl modules to RDEPENDS for nativsdk variant
In SDK, missing perl modules causes 'x86_64-pokysdk-linux-gp-display-html --help' to abort with below errors..
  - Can't locate bignum.pm in @INC (you may need to install the feature module).
  - Can't locate Math/BigInt.pm in @INC (you may need to install the Math::BigInt module)

By adding the following perl modules to RDEPENDS fixes the above errors:
  nativesdk-perl-module-bignum
  nativesdk-perl-module-bigint
  nativesdk-perl-module-math-bigint

(From OE-Core rev: 75773577d8dd9c9d61aa039e1da2482c064c666a)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 05f1099acbbb10b6ce33ea117d313749f7dc4a47)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Khem Raj
2b82219880 qemu: Fix build on musl/riscv64
musl does not provide strerrorname_np() so do not use it.

(From OE-Core rev: 36b05346e63f9885da45a3c3a06ad5f6a5cd905c)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d7678118af5aa4bfbf6fb72b34f90a1e37b917c3)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Wang Mingyu
a6e5a0bf50 git: upgrade 2.46.0 -> 2.46.1
Changelog:
==============
 * "git checkout --ours" (no other arguments) complained that the
   option is incompatible with branch switching, which is technically
   correct, but found confusing by some users.  It now says that the
   user needs to give pathspec to specify what paths to checkout.
 * It has been documented that we avoid "VAR=VAL shell_func" and why.
 * "git add -p" by users with diff.suppressBlankEmpty set to true
   failed to parse the patch that represents an unmodified empty line
   with an empty line (not a line with a single space on it), which
   has been corrected.
 * "git rebase --help" referred to "offset" (the difference between
   the location a change was taken from and the change gets replaced)
   incorrectly and called it "fuzz", which has been corrected.
 * "git notes add -m '' --allow-empty" and friends that take prepared
   data to create notes should not invoke an editor, but it started
   doing so since Git 2.42, which has been corrected.
 * An expensive operation to prepare tracing was done in re-encoding
   code path even when the tracing was not requested, which has been
   corrected.
 * Perforce tests have been updated.
 * The credential helper to talk to OSX keychain sometimes sent
   garbage bytes after the username, which has been corrected.
 * A recent update broke "git ls-remote" used outside a repository,
   which has been corrected.
 * "git config --value=foo --fixed-value section.key newvalue" barfed
   when the existing value in the configuration file used the
   valueless true syntax, which has been corrected.
 * "git reflog expire" failed to honor annotated tags when computing
   reachable commits.
 * A flakey test and incorrect calls to strtoX() functions have been
   fixed.

 * Follow-up on 2.45.1 regression fix.
 * "git rev-list ... | git diff-tree -p --remerge-diff --stdin" should
   behave more or less like "git log -p --remerge-diff" but instead it
   crashed, forgetting to prepare a temporary object store needed.
 * The patch parser in "git patch-id" has been tightened to avoid
   getting confused by lines that look like a patch header in the log
   message.
 * "git bundle unbundle" outside a repository triggered a BUG()
   unnecessarily, which has been corrected.
 * The code forgot to discard unnecessary in-core commit buffer data
   for commits that "git log --skip=<number>" traversed but omitted
   from the output, which has been corrected.
 * "git verify-pack" and "git index-pack" started dying outside a
   repository, which has been corrected.
 * A corner case bug in "git stash" was fixed.

(From OE-Core rev: 46298bda0ac17750d5a120be21feaef2407da7ee)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ee7e9866ad942a9682e54878f1e7fb06c68c8cf4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Shunsuke Tokumoto
fa99b92b24 python3-setuptools: Add "python:setuptools" to CVE_PRODUCT
Since there are vulnerabilities that cannot be detected by the existing
CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT.

https://nvd.nist.gov/vuln/detail/CVE-2013-1633
https://nvd.nist.gov/vuln/detail/CVE-2022-40897

(From OE-Core rev: d06ce1ca98e5a192dd47af0fa243328aa6d87bff)

Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-29 05:51:03 -07:00
Divya Chellam
0249d9c893 python3: Upgrade 3.12.5 -> 3.12.6
Includes security fixes for CVE-2024-7592, CVE-2024-8088, CVE-2024-6232
and other bug fixes.

Removed below patches, as the fix is included in 3.12.6 upgrade:
1. CVE-2024-7592.patch

Release Notes:
https://www.python.org/downloads/release/python-3126/

(From OE-Core rev: aa492b1fd5973c37b8fa2cd17d28199eba46afcc)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-13 07:15:49 +01:00
Richard Purdie
a14e58799e libedit: Make docs generation deterministic
The presence or lack of nroff on the host was changing the doc type. Stop
the code from looking at host paths outside HOSTTOOLS and hence cause the
doc type to be deterministic and reproducible.

(From OE-Core rev: 918e2b266eba6779f19f65349f85caa880ba45e7)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-11 11:56:37 +01:00
Richard Purdie
ec9fb6eaa5 ruby: Make docs generation deterministic
The presence or lack of nroff on the host was changing the doc type. Set it
explicitly to be deterministic and reproducible.

(From OE-Core rev: f5053abb8957acf358b518ee3c76146dc5f4eb6c)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-11 11:56:37 +01:00
Richard Purdie
23763df006 Revert "python3-setuptools: upgrade 72.1.0 -> 72.2.0"
This reverts commit 8fccef7a731f44e5d27653e06becb54cf770e5e5.

The patch causes problems for systems using ccache. Revert until this is fixed.

"Inherit ccache, build anything which uses python3-setuptools (e.g. python3-icu)."

(From OE-Core rev: a7dafda0303e52965010fc428d950e10ff1bb940)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-10 13:05:00 +01:00
Niko Mauno
63055fc4d0 python3-maturin: Fix cross compilation issue for armv7l, mips64, ppc
When bitbaking python3-rpds-py it built extension module as:

  site-packages/rpds/rpds.cpython-312-armv7l-linux-gnueabihf.so

Which caused error on target:

  root@qemuarm:~# python3 -c "from rpds import HashTrieMap, HashTrieSet, List"
  Traceback (most recent call last):
    File "<string>", line 1, in <module>
    File "/usr/lib/python3.12/site-packages/rpds/__init__.py", line 1, in <module>
      from .rpds import *
  ModuleNotFoundError: No module named 'rpds.rpds'

Where as it should have been:

  site-packages/rpds/rpds.cpython-312-arm-linux-gnueabihf.so

Associated upstream bug report:
https://github.com/PyO3/maturin/issues/2203

Associated upstream pull request:
https://github.com/PyO3/maturin/pull/2204

Note - mitigation has not been tested with musl:
https://github.com/PyO3/maturin/pull/2204#issuecomment-2323952320

(From OE-Core rev: 32a8a7379008cc6e367b7664c5b10b29f0bb8136)

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-05 21:48:47 +01:00
Khem Raj
4a3990485f gcc: Fix spurious '/' in GLIBC_DYNAMIC_LINKER on microblaze
(From OE-Core rev: f0eac82b9a1e4549b7d918df768c369ed7ab5183)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Mark Hatle <mark.hatle@amd.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-05 21:48:47 +01:00
Richard Purdie
d75b116aab elfutils: Drop obsolete ptest conditional in do_install
The PTEST_ENABLED conditional is no longer needed since the task is deleted
if ptest isn't enabled.

(From OE-Core rev: 48af648d9855fec70a1b4baba0970876a0b3163d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
d307c65b86 python3-zipp: upgrade 3.20.0 -> 3.20.1
Bugfix:
- Replaced SanitizedNames with a more surgical fix for infinite loops, restoring
  support for names with special characters in the archive.

(From OE-Core rev: 1c71b6b401bad423448d9edb4db4371e7bf605b6)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
1f4def61db python3-websockets: upgrade 12.0 -> 13.0.1
Changelog:
 https://github.com/python-websockets/websockets/blob/main/docs/project/changelog.rst

(From OE-Core rev: a5a9eb1f27790d6f9997378955ef6f09eedab406)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
0c9b4819b6 python3-pbr: upgrade 6.0.0 -> 6.1.0
0001-change-shebang-to-python3.patch
refreshed for 6.1.0

(From OE-Core rev: 14e7455069137ec8ef2866fa3160e92f86fc71d8)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
79b4e699c3 python3-maturin: upgrade 1.7.0 -> 1.7.1
Changelog
=========
- Update clap_complete_command to v0.6.1
- Fix platform tags when cross-compiling universal2
- Fix Typo in Migration Guide
- Fix rust 1.80 clippy errors
- Don't check .gitignore files in parent directories
- Replace --skip-auditwheel with --auditwheel option
- Remove install_requires and setup_requires from setup.py
- Use modern stripping option
- Move project metadata from setup.py to pyproject.toml
- Update manylinux/musllinux policies to the latest main
- use just licenses as the license directory in a wheel
- Forward cargo package --list warnings
- Add current package context to source dist error
- Place source dist readmes next to Cargo.toml

(From OE-Core rev: 48e00b925648dc394bf3ba08324b333b44a5ec0b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
5a7fb59b09 python3-idna: upgrade 3.7 -> 3.8
Changelog:
==========
- Fix regression where IDNAError exception was not being produced for certain inputs.
- Add support for Python 3.13, drop support for Python 3.5 as it is no longer testable.
- Documentation improvements
- Updates to package testing using Github actions

(From OE-Core rev: 23075f8fd3144338cac1e3ad0b6b81d2376d2d4b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Wang Mingyu
1a39a1cd3d python3-certifi: upgrade 2024.7.4 -> 2024.8.30
(From OE-Core rev: 864b7b4affae0bf6a57cbdd2f2e4a07c1468705b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Richard Purdie
1be4af3df2 libtool: 2.5.1 -> 2.5.2
(From OE-Core rev: 279e6f4eaa6e47cbd2640c7afe699cda2a796514)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Niko Mauno
4d53374ad2 dejagnu: Fix LICENSE
The contents of the COPYING file included in the current source code
package match those of GPL-3.0-only license, which seems to have been
the case since 2008 commit
http://git.savannah.gnu.org/gitweb/?p=dejagnu.git;a=commitdiff;h=9bebe7b9bfb9b02e5e4d86ad74e8ce3eb32a36b9;hp=50fbdd118dba066e201c73a8b0155381cd65a32d
("* COPYING: Update to GPL version 3.")

(From OE-Core rev: 26b71cfb7815a096c5962629801cc3bc85147284)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-03 10:21:38 +01:00