summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
AgeCommit message (Collapse)Author
2020-09-06buildtools-extended-tarball: add nativesdk-libxcrypt-devJeremy Puhlman
virtual/crypt-native is assume provided in bitbake.conf, so buildtools-extended-tarball shoud provide crypt since it doesn't use the host's headers/libraries. [YOCTO #13714] (From OE-Core rev: da948b25d5ef452fb35275d108e18d2a2829f4fb) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06glibc: Update nativesdk locale relocation patchRichard Purdie
The locale binary reported incorrect locale lists in relocated toolchains as some path references were not relocated by this patch. Fix this missing relocations so the locale binary correctly reports the locales. (From OE-Core rev: f7a6a72880009380ae81bc7fc863921a26811c8c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-tarball: add nativesdk-pythonJeremy Puhlman
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
2020-09-06buildtools-tarball: export OPENSSL_CONF in environment setupSteve Sakoman
The autobuilder has been experiencing SSL: CERTIFICATE_VERIFY_FAILED errors during error report uploads when using buildtools due to looking for certs in /opt/poky (From OE-Core rev: 197f1d5d14b8e57295f5a81c03c86abba5328614) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-tarball: export OPENSSL_CONF for opensslLiwei Song
export OPENSSL_CONF to aviod SDK openssl can not find openssl.cnf. (From OE-Core rev: 0aaf3dd17dcde959e9c0d62543cb91c9b33551b4) Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-extended-tarball: Add libstc++.aJeremy Puhlman
Builds like native-openjdk, really wants a to link some tools against the static version. Since when using the extended tarball, its the only place to get it, add the library. (From OE-Core rev: 59c4a3fdbbfd5a6aaba7e0a1675dcd5866a7f3a4) Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06nativesdk-buildtools-perl-dummy: add dependencies for autoconf and automakeTim Orling
* For buildtools-extended-tarball, where we are adding all of build-essentials to the nativesdk, we need additional perl modules for autoconf and automake. (From OE-Core rev: f0f766160663407ea7683d31bbf5f011accc9ba2) Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-extended-tarball: Add locale commandRichard Purdie
The eSDK installation code checks installed locales with the locale command which is from glibc-utils. Add this so that we find the correct locales from the buildtools. (From OE-Core rev: 7d35e4bc6ff94a2d03c48827d7d60a6855c9029d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-tarball: Add an ld.so.conf for nativesdk-binutilsRichard Purdie
We need to search our own libdirs, then fall back to the system ones as our customised dynamic loader will. Have ld.so.conf reflect that. This ensures that binutils finds libraries here when linking too. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-06buildtools-extended-tarball: add recipe with build-essentialsTim Orling
* For some aging distros, such as CentOS 7, the native version of gcc is simply too ancient and is a constant source of headaches for moving forward. * Add an extended version of buildtools-tarball which adds all of build-essential, so that the host is now modernized and capable of compiling the latest versions of components. Fixes [YOCTO #13714] (From OE-Core rev: f0377af2325613b63716b0bb4db1ab253d79f388) Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-08-14build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-28core: glib-2.0: fix requested libmount/mkostemp/selinux not being linked inAhmad Fatoum
Since 010202076760 ("meson.bbclass: avoid unexpected operating-system names"), meson is no longer used with a cross file that appends the used libc to the operating system name, e.g. linux-gnueabi. Prior to that commit, the host_system == 'linux' checks in glib's meson failed, which led to glib being compiled without libmount, mkostemp and selinux even if explicitly requested. As the aforementioned commit affects all recipes built by glib, it might not be a candidate for backporting to current stable branches. To fix just the glib issue, instances of host_system == 'linux' are patched locally. The patch is marked as Upstream-Status: Inappropriate as it is rendered unnecessary for OE releases newer than Dunfell. Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-28glibc: CVE-2020-6096Zhixiong Chi
Backport the CVE patch from the upstream: git://sourceware.org/git/glibc.git commit 79a4fa341b8a89cb03f84564fd72abaa1a2db394 commit beea361050728138b82c57dda0c4810402d342b9 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-28cve-update: handle baseMetricV2 as optionalKonrad Weihmann
Currently in NVD DB an item popped up, which hasn't set baseMetricV2. Let the parser handle it as an optional item. In case use baseMetricV2 before baseMetricV3 Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fdcbf3f28289188c5a97664d1421d4a5c4991eda) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-17systemd: fix CVE-2020-13776wenlin.kang@windriver.com
Backport from systemd.git. (OE-Core master rev: a1b22b2263da6d11a4e0cbfa792d2bd1e56f5346) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-17dbus: fix CVE-2020-12049Lee Chee Yang
(From OE-Core rev: 3f69946c6159fa359bc5800ee72ef6151d9ecd36) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-29glibc: CVE-2020-1752Zhixiong Chi
Backport the CVE patch from upstream: git://sourceware.org/git/glibc.git commit ddc650e9b3dc916eab417ce9f79e67337b05035c Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-14build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-05systemd: Fix CVE-2020-1712wenlin.kang@windriver.com
Fix CVE-2020-1712 Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-05cve-update-db-native: clean DB if temporary file existLee Chee Yang
when do_populate_cve_db forced stop at certain point, the DB execution are stoped however the temporary database file (DB-JOURNAL) are not removed. This db-journal file indicates that DB is incomplete and set DB in readonly mode. So when db-journal exist, remove both DB and the db-journal and build the DB again from scratch. [YOCTO #13682] (From OE-Core rev: 70713df25b8ae27a21e53b0b9234567d7053800a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-04-28glibc: CVE-2020-1751Zhixiong Chi
Backport the CVE patch from upstream: git://sourceware.org/git/glibc.git commit d93769405996dfc11d216ddbe415946617b5a494 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-04-19cve-check: CPE version '-' as all versionLee Chee Yang
CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-04-06busybox: on upgrade save busybox if it is the last shellJeremy Puhlman
During a busybox upgrade on a ipk based system, it is possible that busybox is the only shell in the system. During the uninstall the alternative for /bin/sh is removed and everything after that goes down hill. * Add a check to verify if busybox is the shell, and save it to the busyboxrm directory created in tmp. Then add an alternative for /bin/sh that points to that busybox at the lowest priority. * Add PATH to the busyboxrm directory using shell(as during an upgrade busybox and its links are missing). * When install over remove extra busybox if present. deb and rpm are uneffected by the bug because they both drag in bash, however neither upgrade seemed to have issue with the changes. [YOCTO 13850] Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a9d2af8f5b3da8239cf00a52883ca596a19ea23a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-04-06glib-2.0: fix CVE-2020-6750haiqing
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-15glibc: CVE-2020-10029Zhixiong Chi
Backport the CVE patch from upstream: [https://sourceware.org/git/gitweb.cgi?p=glibc.git; a=patch;h=9333498794cde1d5cca518badf79533a24114b6f] Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-10dummy-sdk-package: Add DUMMYPROVIDES_PACKAGESRichard Purdie
We're about to need to use this variable in the main include file so restructure the users of it to all set it appropriately. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a247e7c961286cbed73b6dc0f4074ecf856402a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-26libxml2: Fix CVE-2019-20388Lee Chee Yang
see: https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68 (From OE-Core rev: 12a5eb0ea6f530ad7be2e58d4091b4edadbf461b) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-26libxml2: fix CVE-2020-7595Anuj Mittal
(From OE-Core rev: f2f7aa9a495774fe5a2e3947584cb3503bd1eaf1) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-26ncurses: add CVE_VERSIONAnuj Mittal
Include the version number in a format that is comparable to what we get from NVD. (From OE-Core rev: fdb2a95d5e0265de1172940b6dc71fc7d602e8d1) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-20glibc-testsuite: Exclude this recipe from world buildsNathan Rossi
This recipe is intended to be run manually or via oeqa. [YOCTO #13737] Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit eadbe01bb8232de79e0827e6c6b3411f69ea7303) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-20glibc-testsuite: Remove the do_install taskNathan Rossi
This task is not intended to be run as this recipe does not produce any packages or install any sysroot content. Additionally running this task behaves differently from a normal glibc build, and can result in issues. [YOCTO #13737] Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2b51252cb8bd9badfa28794f9ef9431b48752e3d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-11ncurses: Fix reproducibility issueRichard Purdie
The build was deciding whether to rename manpages based upon the presence of /etc/debian_version. Be explicit about the configuration instead and ensure determinism. [YOCTO #13781] (From OE-Core rev: 09c8a28893e7ca94a44232d802e1cb02a8f34b87) (From OE-Core rev: 3d114c08c32578426646f5d97769d2c66fea06cb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11sysvinit: Fix Reproducibility issueRichard Purdie
With a sequence like: bitbake sysvinit bitbake sysvinit -c clean bitbake sysvinit -c package_write_ipk -f then the resulting package has two files with group "root/70" rather than "root/shutdown". The issue is that of do_package is a setscene task, base-passwd isn't present. This patch fixes that dependency but there may be other cases of this problem around. [YOCTO #13776] (From OE-Core rev: 0227e929021263c51d2e7db36224000fecb01f1c) (From OE-Core rev: cbcba43c18d67aea0ba41f019b357fbec6570ee1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11patch: Extend to native/nativesdk and depend uponRichard Purdie
There is a bug in patch 2.7.3 and earlier where index lines in patches can change file modes when they shouldn't: http://git.savannah.gnu.org/cgit/patch.git/patch/?id=82b800c9552a088a241457948219d25ce0a407a4 This leaks into debug sources in particular (e.g. tcp-wrappers where source files are read-only). Add the dependency to target recipes to avoid this problem until we can rely on 2.7.4 or later. We could try and remove all index lines from patch files but it will be a losing battle. We could try and identify all the recipes which change modes on files in patches but again, its a losing battle. Instead, compromise and have patch-native as a dependency for target recipes. We use patch-replacement-native since patch-native is in ASSUME_PROVIDED. Also add nativesdk-patch to buildtools-tarball. [YOCTO #13777] (From OE-Core rev: 5ed0840c93804488cd1c1aba6cb382b2434714a5) (From OE-Core rev: fd3bd61a6fe5190c575dc968f3a0be9c1cbf21ed) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-06build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04kbd: avoid vlock conflict with busyboxHongxu Jia
busybox as well as vlock utility from meta-oe provides vlock utility which can conflict when with kbd if pam is a enabled distro_feature Fixes image build errors update-alternatives: Error: not linking <rootfs>/usr/bin/vlock to /bin/busybox.suid since <rootfs>/usr/bin/vlock exists and is not a link ERROR: yoe-qt5-wayland-image-1.0-r0 do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget_${PN} (). Deferring to first boot via 'exit 1' is no longer supported. Signed-off-by: Khem Raj <raj.khem@gmail.com> The vlock doesn't exist if PAM isn't enabled. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: De Huo <de.huo@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04kbd: configure.ac: Fix logic of vlock configure switchDe Huo
Downstream bug report: https://bugs.gentoo.org/661650 Upstream-Status: Backport [f7f357ef079b6d185f340e716d7c72a98d82bad0] Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> Signed-off-by: De Huo <De.Huo@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04libxml2: Fix CVE-2019-19956Lee Chee Yang
see: https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-08systemd: Upgrade 243 -> 243.2Adrian Bunk
Bugfix-only changes on the 243 stable branch. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-31systemd-systemctl: Fix handling of aliased targetsSlavic Brutalik
The script scans for services, parses them and makes sure those targets are still there. The exists file check fails if the target is an alias, such as default.target so add an additional test. [YOCTO #13685] (From OE-Core rev: 10bdbf033e51c97f6408c9114d480372135a2c2e) Signed-off-by: Werner Grift <sky.captin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-12-16cve-check: Switch to NVD CVE JSON feed version 1.1Niko Mauno
Switch to recently released version 1.1 of NVD CVE JSON feed, as in https://nvd.nist.gov/General/News/JSON-1-1-Vulnerability-Feed-Release it is mentioned that Due to changes required to support CVSS v3.1 scoring, the JSON vulnerability feeds must be modified. This will require the consumers of this data to update their internal processes. We will be providing the JSON 1.1 schema on the data feeds page and the information below to prepare for this transition. ... The JSON 1.1 data feeds will be available on September 9th, 2019. At that time the current JSON 1.0 data feeds will no longer available. This change was tested briefly by issuing 'bitbake core-image-minimal' with 'cve-check.bbclass' inherited via local.conf, and then comparing the content between the resulting two 'DEPLOY_DIR_IMAGE/core-image-minimal-qemux86.cve' files, which did not seem to contain any other change, except total of 167 entries like CVSS v3 BASE SCORE: 0.0 were replaced with similar 'CVSS v3 BASE SCORE:' entries which had scores that were greater than '0.0' (up to '9.8'). (From OE-Core rev: cc20e4d8ff2f3aa52a2658404af9a0ff358cc323) Signed-off-by: Niko Mauno <niko.mauno@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-16recipes: change SRC_URI to use httpsStefan Müller-Klieser
Change all recipes to https where we get an http 301 permanent redirect. (From OE-Core rev: e514acda9e12bccde6d3974e0fd1a37b3837191a) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-16glib: Whitelist CVE-2019-12450Adrian Bunk
Fixed in 2.60.4, but CPE data is outdated. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-06glibc: fix CVE-2019-19126Anuj Mittal
Backport from 2.30 stable branch and drop NEWS section. (From OE-Core rev: b4d4f70380c100d8ab06557237d8d5649a885e30) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-27build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-26build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-26build-appliance: Use zeus as the branchRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-26build-appliance-image: Update to zeus head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-25cve-update-db-native: clean up proxy handlingRoss Burton
urllib handles adding proxy handlers if the proxies are set in the environment, so call bb.utils.export_proxies() to do that and remove the manual setup. (From OE-Core rev: 6b73004668b3b71c9c38814b79fbb58c893ed434) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-24 20:43:40 +0000