Hello, Ross
On 7/23/26 15:55, Ross Burton via lists.openembedded.org wrote:
Instead of hardcoding this to disabled, add a PACKAGECONFIG.
No behavioural changes in this patch.
Signed-off-by: Ross Burton <[email protected]>
---
meta/recipes-support/curl/curl_8.21.0.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-support/curl/curl_8.21.0.bb
b/meta/recipes-support/curl/curl_8.21.0.bb
index d245e7fe60f..399b915dee8 100644
--- a/meta/recipes-support/curl/curl_8.21.0.bb
+++ b/meta/recipes-support/curl/curl_8.21.0.bb
@@ -55,6 +55,7 @@ PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap"
PACKAGECONFIG[ldaps] = "--enable-ldaps,--disable-ldaps,openldap"
PACKAGECONFIG[libgsasl] = "--with-libgsasl,--without-libgsasl,libgsasl"
PACKAGECONFIG[libidn] = "--with-libidn2,--without-libidn2,libidn2"
+PACKAGECONFIG[libpsl] = "--with-libpsl,--without-libpsl,libpsl"
PACKAGECONFIG[libssh] = "--with-libssh,--without-libssh,libssh"
PACKAGECONFIG[libssh2] = "--with-libssh2,--without-libssh2,libssh2"
PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls"
@@ -85,7 +86,6 @@ CURL_CA_BUNDLE_BASE_DIR:class-target = "${sysconfdir}"
EXTRA_OECONF = " \
--disable-libcurl-option \
- --without-libpsl \
--enable-optimize \
--with-ca-bundle=${CURL_CA_BUNDLE_BASE_DIR}/ssl/certs/ca-certificates.crt
\
${@'--without-ssl' if (bb.utils.filter('PACKAGECONFIG', 'gnutls mbedtls
openssl schannel', d) == '') else ''} \
Coincidence or not, I just started checking this critical vulnerability:
https://nvd.nist.gov/vuln/detail/CVE-2026-8924
And it is directly related to libpsl. I presumed that having it disabled
(by default or not) would make oe-core's version of curl (e.g. in
Scarthgap and Kirkstone) not affected. In fact, I checked if the parts
of the code inside USE_LIBPSL ifdef blocks is built or not (it isn't),
and in do_configure logs:
curl version: 7.82.0
SSL: enabled (OpenSSL v3+)
SSH: no (--with-{libssh,libssh2})
zlib: enabled
brotli: no (--with-brotli)
zstd: no (--with-zstd)
GSS-API: no (--with-gssapi)
GSASL: no (--with-gsasl)
TLS-SRP: enabled
resolver: POSIX threaded
IPv6: no (--enable-ipv6)
Unix sockets: enabled
IDN: enabled (libidn2)
Build libcurl: Shared=yes, Static=yes
Built-in manual: no (--enable-manual)
--libcurl option: no
Verbose errors: enabled (--disable-verbose)
Code coverage: disabled
SSPI: no (--enable-sspi)
ca cert bundle: /etc/ssl/certs/ca-certificates.crt
ca cert path: no
ca fallback: no
LDAP: no (--enable-ldap / --with-ldap-lib /
--with-lber-lib)
LDAPS: no (--enable-ldaps)
RTSP: no (--enable-rtsp)
RTMP: no (--with-librtmp)
PSL: no (--with-libpsl)
(...)
I'm not sure yet if this is a premature conclusion of mine, but I'd
still want to give this heads-up, considered you added this option to
PACKAGECONFIG in your second patch.
--
Best regards,
João Marcos Costa
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#241847):
https://lists.openembedded.org/g/openembedded-core/message/241847
Mute This Topic: https://lists.openembedded.org/mt/120410698/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
