On 8/27/26 09:27, Daniel Turull wrote:
On Wed, 2026-08-26 at 01:14 -0700, Jakub Szczudlo (Nokia) wrote:
Hi,
I understand this CVE is bigger than I thought CVE patch can be.
Maybe we can think about updating expat beyond the fixed version?
I now it's not the best because it is stable branch but I can't think about
correct solution.
Hi,
Upgrading expat on wrynose & scarthgap may be possible. We are carrying
a *lot* of patches for expat, especially on scarthgap, so it's worth
considering.
It would need a few things:
- Review of the delta between the current version on these branches,
including the patches we're carrying, and the latest version. Check
that there are no features removed or other backwards-incompatible
changes.
- Confirmation that the SONAME changes won't break anything.
- Testing.
- RFC patch on the mailing list with a clear subject so people can see
it's an exception to the usual stable upgrade policy, explain the
review and testing done. This gives chance for people to object if it
will cause issues for them.
- Agreement from the Yocto TSC, based on the above info.
That all needs some time investment beyond what we currently have
available, so if you have the bandwidth to look in to it then that would
be welcome.
Best regards,
Hi all,
I agree that expat should be uplifted to 2.8.3.
I have some comments/suggestions regarding this.
To verify ABI compatibility, I ran abidiff
(https://sourceware.org/libabigail/manual/abidiff.html) for expat 2.7.5
and 2.8.3, and can conclude that there is no ABI break, and can also
confirm that there has not been a major bump in the SONAME.
I want to point to our fork of
meta-binaryaudit(https://github.com/nordix/meta-binaryaudit), which
wraps abidw and abidiff into a Yocto layer, which then can be used to
compare ABI breaks in the packages.
I have also analysed the Changelog as suggested, there has not been any
feature removal, but there are some opt-in feature additions (disabled
by default), and new Autotools flags. I don't see any
backward-incompatible changes.
I will prepare a patch to uplift to expat 2.8.3, test it, and include
these results, and mark it RFC as mentioned.
Thanks!
Adarsh Jagadish Kamini
Ericsson Software Technology AB
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#244474):
https://lists.openembedded.org/g/openembedded-core/message/244474
Mute This Topic: https://lists.openembedded.org/mt/120905189/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
