[OE-core][PATCH] oeqa/selftest/recipetool: add back checksum checks on pypi tests

2023-12-11 Thread Julien Stephan
recipetool pypi plugin was originally clobbering SRC_URI checksums. Now it doesn't do this anymore: 78ef0313ee6 - recipetool: pypi: do not clobber SRC_URI checksums so add back the checksum checks on pypi tests. Also this commit restrict the checksums: 45d2f8d4bc2 - recipetool: create: Only

Re: [OE-Core][PATCH 3/7] rust: Upgrade 1.71.0 -> 1.71.1

2023-12-11 Thread Frederic Martinsons
On Mon, 11 Dec 2023 at 12:44, Alex Kiernan wrote: > On Mon, Dec 11, 2023 at 10:01 AM Frédéric Martinsons > wrote: > > > > > > > > On Mon, 11 Dec 2023 at 10:17, Alex Kiernan > wrote: > >> > >> On Mon, Dec 11, 2023 at 7:15 AM Frédéric Martinsons > >> wrote: > >> > > >> > > >> > > >> > On Sun,

Re: [qa-build-notification] [yocto] QA notification for completed autobuilder build (yocto-3.1.30.rc1)

2023-12-11 Thread Steve Sakoman
On Sun, Dec 10, 2023 at 11:43 PM Jing Hui Tham wrote: > > Hi all, > > Intel and WR YP QA is planning for QA execution for YP build > yocto-3.1.30.rc1. We are planning to execute following tests for this cycle: > > OEQA-manual tests for following module: > 1. OE-Core > 2. BSP-hw > > Runtime auto

[OE-core][dunfell 1/1] linux-yocto-rt/5.4: fix buld failure

2023-12-11 Thread Bruce Ashfield
From: Bruce Ashfield Integrating the following commit(s) to linux-yocto/5.4: 1/1 [ Author: Bruce Ashfield Email: bruce.ashfi...@gmail.com Subject: rt: drop -stable migrate_disable Date: Mon, 11 Dec 2023 08:50:52 -0500 The -rt branches already have a migrate disable

Re: [OE-core] [PATCH v2 0/1] nfs-utils: Upgrade 2.6.3 -> 2.6.4

2023-12-11 Thread Robert Yang via lists.openembedded.org
On 12/11/23 18:41, Robert Yang via lists.openembedded.org wrote: From: Robert Yang * V2: Fix build error with musl Sorry, please ignore V2, a patch was lost. // Robert * V1: Initial version The following changes since commit 564339afb73fc52a66c1a08437587cad1c4d46e7: useradd:

[OE-core][kirkstone][PATCH] gnutls: Backport fix for CVE-2023-5981

2023-12-11 Thread Vijay Anusuri via lists.openembedded.org
From: Vijay Anusuri Upstream-Status: Backport [import from debian https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.7.3-4ubuntu1.3/gnutls28_3.7.3-4ubuntu1.3.debian.tar.xz Upstream-Commit: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d]

Re: [OE-Core][PATCH 1/2] cargo-update-recipe-crates: Use CARGO_LOCK_PATH

2023-12-11 Thread Alex Kiernan
On Sun, Dec 10, 2023 at 8:35 PM Alexander Kanavin wrote: > > I have to say, I struggle to see this as an improvement, and I want > to object to it. > I have to admit I kinda thought this might be controversial. > Why set the path manually, if the code to find where Cargo.lock is > just works,

Re: [OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

2023-12-11 Thread Soumya via lists.openembedded.org
Hi Alexandre, I see that current go version is 1.20.12 which is not vulnerable to these CVEs. Kindly ignore this patch. Regards, Soumya From: Alexandre Belloni Sent: Saturday, December 9, 2023 5:55 PM To: Sambu, Soumya Cc:

Re: [PATCH] [OE-Core] tzdata: only the timezone subpackage tzdata-core is retained

2023-12-11 Thread Alexandre Belloni via lists.openembedded.org
Please follow https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#fixing-your-from-identity On 11/12/2023 11:39:27+0800, Xu, Lizhi via lists.openembedded.org wrote: > To reduce the size of rootfs, the subpackages contained in tzdata.bb will now > default to only retaining

[OE-core] [kirkstone][PATCH] nativesdk-sdk-provides-dummy.bb: Update host tools for rust-cross-canadian

2023-12-11 Thread Hemraj, Deepthi via lists.openembedded.org
From: Deepthi Hemraj [YOCTO #15082] Packagegroup-rust-cross-canadian package requires rust-cross-canadian, but the necessary libstdc++.so.6(GLIBCXX_3.4.30)(64bit) library is missing. The fix adds the libstdc++.so.6(GLIBCXX_3.4.30)(64bit) library requirement to the SDK dummy package, resolving

[OE-core] [PATCH] go: set vendor in CVE_PRODUCT

2023-12-11 Thread Ross Burton
From: Ross Burton It's not uncommon for specific third party modules to use "go" as the product[1]. However, the canonical CPE for the official Go language/runtime is always golang:go[2], so use that explicitly. [1] e.g. https://nvd.nist.gov/vuln/detail/CVE-2023-49292 [2] e.g.

[OE-core] [PATCH v3 1/1] nfs-utils: Upgrade 2.6.3 -> 2.6.4

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang * Remove backported patch 0001-configure.ac-libevent-and-libsqlite3-checked-when-nf.patch. * Add 0001-reexport.h-Include-unistd.h-to-compile-with-musl.patch to fix build with musl Signed-off-by: Robert Yang --- ...event-and-libsqlite3-checked-when-nf.patch | 80

[OE-core] [PATCH v3 0/1] nfs-utils: Upgrade 2.6.3 -> 2.6.4

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang * V3: Add the lost patch 0001-reexport.h-Include-unistd.h-to-compile-with-musl.patch * V2: Fix build error with musl * V1: Initial version The following changes since commit 564339afb73fc52a66c1a08437587cad1c4d46e7: useradd: Fix useradd do_populate_sysroot

Re: [OE-core] [master] [PATCH] cve-update-nvd2-native: increase the delay between subsequent request failures

2023-12-11 Thread Yoann Congal
Hello, Le 11/12/2023 à 08:51, Yuta Hayama a écrit : > Hi, > > On 2023/12/08 14:04, Dhairya Nagodra via lists.openembedded.org wrote: >> Sometimes NVD servers are unstable and return too many errors. >> There is an option to have higher fetch attempts to increase the chances >> of successfully

Re: [OE-Core][PATCH 3/7] rust: Upgrade 1.71.0 -> 1.71.1

2023-12-11 Thread Frederic Martinsons
On Mon, 11 Dec 2023 at 10:17, Alex Kiernan wrote: > On Mon, Dec 11, 2023 at 7:15 AM Frédéric Martinsons > wrote: > > > > > > > > On Sun, 10 Dec 2023 at 21:28, Alex Kiernan > wrote: > >> > >> On Sun, Dec 10, 2023 at 7:39 PM Richard Purdie > >> wrote: > >> > > >> > On Fri, 2023-12-08 at 14:03

[OE-core] [PATCH v2 1/1] nfs-utils: Upgrade 2.6.3 -> 2.6.4

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang Remove backported patch 0001-configure.ac-libevent-and-libsqlite3-checked-when-nf.patch. Signed-off-by: Robert Yang --- ...event-and-libsqlite3-checked-when-nf.patch | 80 --- ...{nfs-utils_2.6.3.bb => nfs-utils_2.6.4.bb} | 3 +- 2 files changed, 1

[OE-core] [PATCH v2 0/1] nfs-utils: Upgrade 2.6.3 -> 2.6.4

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang * V2: Fix build error with musl * V1: Initial version The following changes since commit 564339afb73fc52a66c1a08437587cad1c4d46e7: useradd: Fix useradd do_populate_sysroot dependency bug (2023-12-10 09:23:58 +) are available in the Git repository at:

Re: [OE-Core][PATCH 3/7] rust: Upgrade 1.71.0 -> 1.71.1

2023-12-11 Thread Alex Kiernan
On Mon, Dec 11, 2023 at 7:15 AM Frédéric Martinsons wrote: > > > > On Sun, 10 Dec 2023 at 21:28, Alex Kiernan wrote: >> >> On Sun, Dec 10, 2023 at 7:39 PM Richard Purdie >> wrote: >> > >> > On Fri, 2023-12-08 at 14:03 +, Alex Kiernan wrote: >> > >

Re: [OE-Core][PATCH 1/2] cargo-update-recipe-crates: Use CARGO_LOCK_PATH

2023-12-11 Thread Alex Kiernan
On Mon, Dec 11, 2023 at 9:28 AM Alexander Kanavin wrote: > > On Mon, 11 Dec 2023 at 10:09, Alex Kiernan wrote: > > In a single project there are (potentially) multiple Cargo.toml, but > > just one Cargo.lock. If there's multiple Cargo.lock files in a repo, > > that implies multiple projects

Re: [OE-core] [master] [PATCH] cve-update-nvd2-native: increase the delay between subsequent request failures

2023-12-11 Thread Dhairya Nagodra via lists.openembedded.org
Hi, On 2023/12/11 10:02, Yoann Congal wrote: >Hello, > >Le 11/12/2023 à 08:51, Yuta Hayama a écrit : >> Hi, >> >> On 2023/12/08 14:04, Dhairya Nagodra via lists.openembedded.org wrote: >>> Sometimes NVD servers are unstable and return too many errors. >>> There is an option to have higher fetch

Re: [OE-Core][PATCH 3/7] rust: Upgrade 1.71.0 -> 1.71.1

2023-12-11 Thread Alex Kiernan
On Mon, Dec 11, 2023 at 10:01 AM Frédéric Martinsons wrote: > > > > On Mon, 11 Dec 2023 at 10:17, Alex Kiernan wrote: >> >> On Mon, Dec 11, 2023 at 7:15 AM Frédéric Martinsons >> wrote: >> > >> > >> > >> > On Sun, 10 Dec 2023 at 21:28, Alex Kiernan wrote: >> >> >> >> On Sun, Dec 10, 2023 at

Re: [OE-core] [yocto] QA notification for completed autobuilder build (yocto-3.1.30.rc1)

2023-12-11 Thread Jing Hui Tham
Hi all, Intel and WR YP QA is planning for QA execution for YP build yocto-3.1.30.rc1. We are planning to execute following tests for this cycle: OEQA-manual tests for following module: 1. OE-Core 2. BSP-hw Runtime auto test for following platforms: 1. MinnowBoard Turbot - 32bit

[OE-core] [PATCH v2 1/2] cve-update-nvd2-native: faster requests with API keys

2023-12-11 Thread Dhairya Nagodra via lists.openembedded.org
From: Dhairya Nagodra As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or

[OE-core] [PATCH v2 2/2] cve-update-nvd2-native: increase the delay between subsequent request failures

2023-12-11 Thread Dhairya Nagodra via lists.openembedded.org
From: Dhairya Nagodra Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an

Re: [OE-Core][PATCH 1/2] cargo-update-recipe-crates: Use CARGO_LOCK_PATH

2023-12-11 Thread Alexander Kanavin
On Mon, 11 Dec 2023 at 10:09, Alex Kiernan wrote: > In a single project there are (potentially) multiple Cargo.toml, but > just one Cargo.lock. If there's multiple Cargo.lock files in a repo, > that implies multiple projects which I don't think we've any way of > building from a single recipe.

Re: [OE-core] [kirkstone][PATCH] nativesdk-sdk-provides-dummy.bb: Update host tools for rust-cross-canadian

2023-12-11 Thread Randy MacLeod via lists.openembedded.org
On 2023-12-11 7:26 a.m., deepthi.hem...@windriver.com wrote: From: Deepthi Hemraj [YOCTO #15082] Packagegroup-rust-cross-canadian package requires rust-cross-canadian, but the necessary libstdc++.so.6(GLIBCXX_3.4.30)(64bit) library is missing. The fix adds the

Re: [OE-core][kirkstone][PATCH] nghttp2: fix CVE-2023-44487

2023-12-11 Thread Steve Sakoman
On Sat, Dec 9, 2023 at 1:57 AM aszh07 wrote: > > From: Zahir Hussain > > The HTTP/2 protocol allows a denial of service (server resource consumption) > because request cancellation can reset many streams quickly, as exploited in > the wild in August through October 2023. > > References: >

[OE-core] [RFC PATCH v2] qemurunner.py: continue to drain stdout after login:

2023-12-11 Thread Alex Bennée
If qemurunner doesn't continuously drain stdout we will eventually cause QEMU to block while trying to write to the pipe. This can manifest itself if the guest has for example configured its serial ports to output via stdio even if the test itself is using a TCP console or SSH to run things. To

Re: [OE-Core][PATCH 3/7] rust: Upgrade 1.71.0 -> 1.71.1

2023-12-11 Thread Alex Kiernan
On Sun, Dec 10, 2023 at 7:39 PM Richard Purdie wrote: > > On Fri, 2023-12-08 at 14:03 +, Alex Kiernan wrote: > > https://blog.rust-lang.org/2023/08/03/Rust-1.71.1.html > > > > Signed-off-by: Alex Kiernan > > --- > > > > meta/recipes-devtools/rust/{cargo_1.71.0.bb => cargo_1.71.1.bb} | 0 > >

[OE-core][PATCH] oeqa/selftest/recipetool: fix metadata corruption on meta layer

2023-12-11 Thread Julien Stephan
[YOCTO #15314] test_recipetool_appendsrcfile_update_recipe_basic is using base-files as test recipe but modifies it directly which can corrupt metadata for other tests relying on this recipe. So use mtd-utils-selftest as test recipe from meta-selftest to avoid this kind of issues Signed-off-by:

[OE-core] [PATCH RFC] bitbake.conf/pseudo: Switch from exclusion list to inclusion list

2023-12-11 Thread Richard Purdie
Currently, pseudo tracks all files referenced within it's presence unless they're listed in an exclusion list. The exclusion list has grown to be fairly unwieldy. This patch swaps PSEUDO_IGNORE_PATHS for PSEUDO_INCLUDE_PATHS which in theory should be easier and more explicit to maintain.

[OE-core] [PATCH] pseudo_client: Add support for PSEUDO_INCLUDE_PATHS

2023-12-11 Thread Richard Purdie
We've often wondered if things would be better with a path include list instead of an exclusion list. Add support for this so we can test that theory If set the include path takes precedence over the ignore path list. Signed-off-by: Richard Purdie --- pseudo_client.c | 22

[OE-core][PATCH] oeqa/selftest/recipetool: remove left over from development

2023-12-11 Thread Julien Stephan
Remove leftover code needed for development that was unintentionally committed Signed-off-by: Julien Stephan --- meta/lib/oeqa/selftest/cases/recipetool.py | 10 -- 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/meta/lib/oeqa/selftest/cases/recipetool.py

[OE-core] [PATCH 0/1] archiver.bbclass: Improve work-shared checking

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang The following changes since commit 564339afb73fc52a66c1a08437587cad1c4d46e7: useradd: Fix useradd do_populate_sysroot dependency bug (2023-12-10 09:23:58 +) are available in the Git repository at: https://github.com/robertlinux/yocto rbt/archiver

[OE-core] [PATCH 1/1] archiver.bbclass: Improve work-shared checking

2023-12-11 Thread Robert Yang via lists.openembedded.org
From: Robert Yang There are other recipes except the listed ones which use work-shared, improve the checking to make other recipes such as llvm-project-source work with do_ar_patched. Signed-off-by: Robert Yang --- meta/classes/archiver.bbclass | 6 ++ 1 file changed, 2 insertions(+), 4

Re: [OE-Core][PATCH 1/2] cargo-update-recipe-crates: Use CARGO_LOCK_PATH

2023-12-11 Thread Alex Kiernan
On Mon, Dec 11, 2023 at 10:52 AM Alex Kiernan via lists.openembedded.org wrote: > > On Mon, Dec 11, 2023 at 9:43 AM Alex Kiernan wrote: > > > > On Mon, Dec 11, 2023 at 9:28 AM Alexander Kanavin > > wrote: > > > > > > On Mon, 11 Dec 2023 at 10:09, Alex Kiernan wrote: > > > > In a single project

[OE-core] [PATCH] patchtest: Add test for deprecated CVE_CHECK_IGNORE

2023-12-11 Thread simone . p . weiss
From: Simone Weiß If a recipes was modified recommand the use of `CVE_STATUS` instead if `CVE_CHECK_IGNORE` is used. This is a depreacted variable and will result in a warning from the cve-check.class and should hence not be used anymore. [YOCTO #15311] Signed-off-by: Simone Weiß ---

Re: [OE-Core][PATCH 1/2] cargo-update-recipe-crates: Use CARGO_LOCK_PATH

2023-12-11 Thread Alex Kiernan
On Mon, Dec 11, 2023 at 9:43 AM Alex Kiernan wrote: > > On Mon, Dec 11, 2023 at 9:28 AM Alexander Kanavin > wrote: > > > > On Mon, 11 Dec 2023 at 10:09, Alex Kiernan wrote: > > > In a single project there are (potentially) multiple Cargo.toml, but > > > just one Cargo.lock. If there's multiple

Re: [OE-core] [PATCH RFC] bitbake.conf/pseudo: Switch from exclusion list to inclusion list

2023-12-11 Thread Richard Purdie
On Mon, 2023-12-11 at 20:35 +, Ross Burton wrote: > On 11 Dec 2023, at 17:35, Richard Purdie via lists.openembedded.org > wrote: > > > > Currently, pseudo tracks all files referenced within it's presence unless > > they're listed in an exclusion list. The exclusion list has grown to be > >

[OE-core] [PATCH v3] elfutils: upgrade 0.189 -> 0.190

2023-12-11 Thread Zang Ruochen
From: Zang Ruochen The following patches have been fixed: 0001-libasm-may-link-with-libbz2-if-found.patch Refresh the following patch: 0001-dso-link-change.patch Add srcfiles to TESTFILES because ptest needs it. NEWS: libelf: Add RELR support. libdw: Recognize .debug_[ct]u_index sections

Re: [OE-core] [PATCH RFC] bitbake.conf/pseudo: Switch from exclusion list to inclusion list

2023-12-11 Thread Ross Burton
On 11 Dec 2023, at 17:35, Richard Purdie via lists.openembedded.org wrote: > > Currently, pseudo tracks all files referenced within it's presence unless > they're listed in an exclusion list. The exclusion list has grown to be > fairly unwieldy. > > This patch swaps PSEUDO_IGNORE_PATHS for

Re: [OE-core] [master] [PATCH] cve-update-nvd2-native: increase the delay between subsequent request failures

2023-12-11 Thread Yuta Hayama
Hi, On 2023/12/11 19:28, Dhairya Nagodra via lists.openembedded.org wrote: >>> I have observed the do_fetch logs and found that HTTP 403 errors are >>> returned if the request is blocked, probably due to rate limitation. > > As per my knowledge, HTTP 403 is related to a permission issue rather