Hi Yoann, Thank you for your review and feedback. These patches were originally prepared on top of the curl CVE fix series that is currently under review and already present in the wrynose/wrynose-nut review branches:
* curl: fix CVE-2026-4873 - openembedded-core-contrib - OpenEmbedded Core user contribution trees<https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/wrynose-nut&id=7e44b94a57a1b7d9ec043554fb7f1f4c3fbfbbaf> * [wrynose,v4] curl: fix CVE-2026-4873 - Patchwork<https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/> Because the remaining curl CVE patches in this series were developed on top of that patch, rebasing everything on the current wrynose review branch would require additional rebasing work once CVE-2026-4873 is merged. If you apply current curl patches on top of this CVE-2026-4873 fix, then there will be no build failure. Could you please advise on the preferred approach in this situation? I appreciate your guidance. Regards, Deepak Rathore ________________________________ From: Yoann Congal <[email protected]> Sent: Tuesday, August 25, 2026 8:34 PM To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286 On Wed Aug 5, 2026 at 10:30 AM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > This patch applies the upstream curl security fix backport for > CVE-2026-8286. The upstream fix commit is referenced in [1], > and the public curl advisory is referenced in [2]. The backported > commit link is also recorded in the embedded patch header. > > [1] > https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 > [2] https://curl.se/docs/CVE-2026-8286.html > > Signed-off-by: Deepak Rathore <[email protected]> > --- > .../curl/curl/CVE-2026-8286.patch | 81 +++++++++++++++++++ > meta/recipes-support/curl/curl_8.19.0.bb | 1 + > 2 files changed, 82 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch Hello, This series does not apply on top of the review branch anymore: https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review |ERROR: curl-8.19.0-r0 do_patch: Applying patch '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl/CVE-2026-8927.patch' on target directory '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/sources/curl-8.19.0' |CmdError('quilt --quiltrc .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-8927.patch |patching file lib/url.c |patching file lib/urldata.h |patching file tests/data/Makefile.am |Hunk #1 FAILED at 218. |1 out of 1 hunk FAILED -- rejects in file tests/data/Makefile.am |patching file tests/data/test1647 |patching file tests/libtest/Makefile.inc |Hunk #1 FAILED at 100. |1 out of 1 hunk FAILED -- rejects in file tests/libtest/Makefile.inc |patching file tests/libtest/lib1647.c |Patch CVE-2026-8927.patch does not apply (enforce with -f) | |stderr: ') |ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/temp/log.do_patch.468848 |ERROR: Task (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl_8.19.0.bb:do_patch) failed with exit code '1' Can you please rebase and send a v2? Please note that there are other pending curl CVE patches, I'd recommand reviewing/testing patches to identify conflict at the earliest. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244380): https://lists.openembedded.org/g/openembedded-core/message/244380 Mute This Topic: https://lists.openembedded.org/mt/120607423/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
