Re: [OE-core] [RFT][PATCH] glibc: Upgrade to 2.39

2024-01-22 Thread Andrej Valek
Hello Raj, Is this one https://lists.openembedded.org/g/openembedded-core/message/194128 ok? Regards, Andy On 19.01.2024 15:47, Khem Raj wrote: On Thu, Jan 18, 2024 at 11:22 PM Andrej Valek wrote: Hello Raj, I will try to take a look on this today. Is the patch the same as here

Re: [OE-core] [PATCH] Revert "cve-check: Modify judgment processing using "=" in version comparison"

2024-01-22 Thread Matsunaga-Shinji
Hi, Ross, What does "too common an issue" mean? Is it okay to ignore the misjudgment by the following cases? e.g. PV = "1.2.0" and Vulnerabilities Affected Versions (registered with NVD) = "1.2" Regards, Shinji -Original Message- From: Matsunaga, Shinji/松永 慎司 Sent: Tuesday, January

Re: [OE-core] [PATCH] binutils : CVE-2023-25584

2024-01-22 Thread Khem Raj
On Mon, Jan 22, 2024 at 9:15 PM Ashishx88 wrote: > > Hi Khem Raj , > > Thanks for the input . > Do i need to submit v3 with the space fixed ? > Just trying to get idea w.r.t process yes please. > > Thanks , > > Ashish > > > > -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to

[OE-core][dunfell][PATCH] gnutls: Backport fix for CVE-2024-0553

2024-01-22 Thread Vijay Anusuri via lists.openembedded.org
From: Vijay Anusuri CVE-2024-0553 A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel

[OE-core] [dunfell][PATCH] opkg: Fix bad memory acces error observe in file_read_line_alloc

2024-01-22 Thread virendra thakur
In the case of a zero length string being returned by fgets(), the condition checking for a trailing new line would perform a bad memory access outside of `buf`. This might happen when line with a leading null byte is read. Avoid this case by checking that the string has a length of at least one

Re: [OE-core] [PATCH] binutils : CVE-2023-25584

2024-01-22 Thread Ashishx88
Hi Khem Raj , Thanks for the input . Do i need to submit v3 with the space fixed ? Just trying to get idea w.r.t process Thanks , Ashish -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#194200):

Re: [OE-core][PATCH] python3-yamllint: Add recipe

2024-01-22 Thread Tim Orling
On Mon, Jan 22, 2024 at 3:36 PM Ryan Eatmon via lists.openembedded.org wrote: > > > On 1/22/2024 4:30 PM, Yoann Congal wrote: > > Hi, > > > > Le 22/01/2024 à 21:07, Ryan Eatmon via lists.openembedded.org a écrit : > >> Add recipe for yamllint. There is an upcoming change in u-boot where > >>

[OE-core] [PATCH V2] tcmode-default.inc: use ?= to set PREFERRED_VERSION_llvm/llvm-native/nativesdk-llvm

2024-01-22 Thread Changqing Li
From: Changqing Li If meta-clang is included, LLVMVERSION might set to version different from llvm version in oe-core, and PREFERRED_PROVIDER_llvm set to clang, In this condition, following warning is reported: WARNING: preferred version 16.0.1 of llvm-native not available (for item

Re: [OE-core] [PATCH] shadow: replace static linking with dynamic libraries in a custom location and bundled with shadow

2024-01-22 Thread Dmitry Baryshkov
On Fri, 19 Jan 2024 at 14:43, Alexander Kanavin wrote: > > Despite our efforts to make static linking work, there have > been new reports of bizarre build failures: > https://lists.openembedded.org/g/openembedded-core/message/194006 >

Re: [OE-core] [PATCH] perl: Fix perl-module-* being ignored via COMPLEMENTARY_GLOB

2024-01-22 Thread Lyu, William via lists.openembedded.org
> On Mon, 2024-01-22 at 07:49 -0800, Lyu, William via > lists.openembedded.org wrote: >> From: William Lyu >> >> When perl-modules is added via COMPLEMENTARY_GLOB, all perl-module-* >> packages recommended by perl-modules are ignored due to the defined >> behavior of COMPLEMENTARY_GLOB. >> >>

Re: [OE-core][PATCH] python3-yamllint: Add recipe

2024-01-22 Thread Ryan Eatmon via lists.openembedded.org
On 1/22/2024 4:30 PM, Yoann Congal wrote: Hi, Le 22/01/2024 à 21:07, Ryan Eatmon via lists.openembedded.org a écrit : Add recipe for yamllint. There is an upcoming change in u-boot where the binman tool is now configured to call yamllint to verify the configs during compile time. There was

Re: [OE-core][PATCH] python3-yamllint: Add recipe

2024-01-22 Thread Yoann Congal
Hi, Le 22/01/2024 à 21:07, Ryan Eatmon via lists.openembedded.org a écrit : > Add recipe for yamllint. There is an upcoming change in u-boot where > the binman tool is now configured to call yamllint to verify the configs > during compile time. > > There was a previous patch a year ago from

Re: [OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Alexander Kanavin
On Mon, 22 Jan 2024 at 17:49, Joakim Tjernlund wrote: > > On Mon, 2024-01-22 at 17:19 +0100, Alexander Kanavin wrote: > > On Mon, 22 Jan 2024 at 16:59, Joakim Tjernlund > > wrote: > > > Maybe but what about the missing reproducibleA/tmp and reproducibleB/tmp ? > > > Would these be missing if

[OE-core][PATCH] python3-yamllint: Add recipe

2024-01-22 Thread Ryan Eatmon via lists.openembedded.org
Add recipe for yamllint. There is an upcoming change in u-boot where the binman tool is now configured to call yamllint to verify the configs during compile time. There was a previous patch a year ago from Trevor Woerner that never made it into oe-core. This patch is a reworking of his patch

[OE-core] [PATCH] glibc: Do not enable CET on 32bit x86

2024-01-22 Thread Khem Raj
Support has been removed from 2.39+ see [1] [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=25f1e16ef03a6a8fb1701c4647d46c564480d88c Signed-off-by: Khem Raj --- meta/recipes-core/glibc/glibc_2.38.bb | 1 - 1 file changed, 1 deletion(-) diff --git

Re: [OE-core] [PATCH] perl: Fix perl-module-* being ignored via COMPLEMENTARY_GLOB

2024-01-22 Thread Richard Purdie
On Mon, 2024-01-22 at 07:49 -0800, Lyu, William via lists.openembedded.org wrote: > From: William Lyu > > When perl-modules is added via COMPLEMENTARY_GLOB, all perl-module-* > packages recommended by perl-modules are ignored due to the defined > behavior of COMPLEMENTARY_GLOB. > > This patch

Re: [OE-core] [PATCH 4/4] classes/recipes: Switch to use inherit_defer

2024-01-22 Thread Patrick Williams
On Mon, Jan 22, 2024 at 10:08:56AM -0600, Patrick Williams wrote: > On Wed, Jan 03, 2024 at 02:59:02PM +, Richard Purdie wrote: > > meta/recipes-core/libxml/libxml2_2.11.5.bb | 2 +- > > I'm seeing some issues after this commit with libxml and Python > PATH, etc. variables.

[OE-core] [PATCH] libssh2: backport fix for CVE-2023-48795

2024-01-22 Thread Ross Burton
From: Ross Burton Backport the upstream fix for CVE-2023-48795. Signed-off-by: Ross Burton --- .../libssh2/libssh2/CVE-2023-48795.patch | 466 ++ .../recipes-support/libssh2/libssh2_1.11.0.bb | 1 + 2 files changed, 467 insertions(+) create mode 100644

Re: [OE-core] [yocto-security] OE-core CVE metrics for master on Sun 21 Jan 2024 01:00:01 AM HST

2024-01-22 Thread Ross Burton
And the rest of the CVEs: On 21 Jan 2024, at 11:18, Steve Sakoman via lists.yoctoproject.org wrote: > CVE-2023-25584 (CVSS3: 7.1 HIGH): > binutils:binutils-cross-testsuite:binutils-cross-x86_64:binutils-native > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25584 * Part of 2.40,

Re: [OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Joakim Tjernlund via lists.openembedded.org
On Mon, 2024-01-22 at 17:19 +0100, Alexander Kanavin wrote: > On Mon, 22 Jan 2024 at 16:59, Joakim Tjernlund > wrote: > > Maybe but what about the missing reproducibleA/tmp and reproducibleB/tmp ? > > Would these be missing if sstate is used for both? > > In the log there is this: > > INFO -

[OE-core] [PATCH v3] gcc: Update status of CVE-2023-4039

2024-01-22 Thread Simone Weiß
From: Simone Weiß This is fixed via a patch added in gcc-13.2.inc already, but still reported e.g. for libgcc as it is not defining an own source but use the shared gcc-source. Signed-off-by: Simone Weiß --- meta/recipes-devtools/gcc/gcc-13.2.inc | 1 + 1 file changed, 1 insertion(+) diff

Re: [OE-core] [PATCH v2] gcc: Upgidate status of CVE-2023-4039

2024-01-22 Thread Simone Weiß
On Mon, 2024-01-22 at 16:18 +, Simone Weiß wrote: > From: Simone Weiß > > This is fixed via a patch added in gcc-13.2.inc already, but still > reported e.g. for libgcc as it is not defining an own source but use > the > shared gcc-source. > > Signed-off-by: Simone Weiß > --- >  

Re: [OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Alexander Kanavin
On Mon, 22 Jan 2024 at 16:59, Joakim Tjernlund wrote: > Maybe but what about the missing reproducibleA/tmp and reproducibleB/tmp ? > Would these be missing if sstate is used for both? > In the log there is this: > INFO - Building reproducibleB (sstate NOT allowed)... It's possible your

[OE-core] [PATCH v2] gcc: Upgidate status of CVE-2023-4039

2024-01-22 Thread Simone Weiß
From: Simone Weiß This is fixed via a patch added in gcc-13.2.inc already, but still reported e.g. for libgcc as it is not defining an own source but use the shared gcc-source. Signed-off-by: Simone Weiß --- meta/recipes-devtools/gcc/libgcc-initial_13.2.bb | 2 ++ 1 file changed, 2

Re: [OE-core] [PATCH 4/4] classes/recipes: Switch to use inherit_defer

2024-01-22 Thread Patrick Williams
On Wed, Jan 03, 2024 at 02:59:02PM +, Richard Purdie wrote: > meta/recipes-core/libxml/libxml2_2.11.5.bb | 2 +- I'm seeing some issues after this commit with libxml and Python PATH, etc. variables. I opened a bugzilla but maybe I should have reported it to this mailing

Re: [OE-core] [PATCH] binutils : CVE-2023-25584

2024-01-22 Thread Khem Raj
On Sun, Jan 21, 2024 at 11:56 PM Ashishx88 wrote: > > Closes: CVE-2023-25584 > > Upstream-Status: Backport > [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=77c225bdeb410cf60da804879ad41622f5f1aa44] > > Signed-off-by: Ashish Kumar Mishra > --- > .../binutils/binutils-2.39.inc

Re: [OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Joakim Tjernlund via lists.openembedded.org
On Mon, 2024-01-22 at 16:10 +0100, Alexander Kanavin wrote: > You are not showing what kind of error you expect to see. What is > being tested for non-reproducibility? Right, I hacked u-boot to set current date: --- a/meta/recipes-bsp/u-boot/u-boot.inc +++ b/meta/recipes-bsp/u-boot/u-boot.inc @@

[OE-core] [PATCH] perl: Fix perl-module-* being ignored via COMPLEMENTARY_GLOB

2024-01-22 Thread Lyu, William via lists.openembedded.org
From: William Lyu When perl-modules is added via COMPLEMENTARY_GLOB, all perl-module-* packages recommended by perl-modules are ignored due to the defined behavior of COMPLEMENTARY_GLOB. This patch changes the relationship between perl-modules and all of its perl-module-* from RRECOMMENDS to

Re: [OE-core] Patchtest results for [PATCH v2 8/9] oeqa/selftest/recipetool: Move helper function to the class scope

2024-01-22 Thread Lukas Funke
Is this the reason why I cannot find the series on patchwork? This makes it kinda tricky to review/test IMHO. Please provide a commit message, so patchtest is happy. On 16.01.2024 09:45, Patchtest via lists.openembedded.org wrote: Thank you for your submission. Patchtest identified one or

Re: [OE-core] Inputs to share CVE patch for binutils CVE-2023-25584

2024-01-22 Thread Ashishx88
Hi Members , I have submitted ver2 after locally checking with patchtest https://lists.openembedded.org/g/openembedded-core/message/194129 Any feedback will be helpful as i can learn and look at some other CVE as i have some bandwidth  this week Thanks , Ashish -=-=-=-=-=-=-=-=-=-=-=- Links:

Re: [OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Alexander Kanavin
You are not showing what kind of error you expect to see. What is being tested for non-reproducibility? Also the short completion time is suspicious: it might indicate that both runs indeed take the same package from sstate. The test expects that the second run uses a private empty sstate to

[OE-core] oe-selftest -v -K -r reproducible.ReproducibleTests.test_reproducible_builds always succeeds, even when pkg is non-reproducible

2024-01-22 Thread Joakim Tjernlund via lists.openembedded.org
Whatever I do, ReproducibleTests always succeeds and I think I got a clue. Looking at the logs below and the files after build one can see thate there are no ...reproducibleA/tmp or ...reproducibleB/tmp dirs in the FS. Furthermore, deploy_A and deploy_B are the same. This all ends up with the

Re: [OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992

2024-01-22 Thread Peter Marko via lists.openembedded.org
-Original Message- From: Ross Burton Sent: Monday, January 22, 2024 15:27 To: Marko, Peter (ADV D EU SK BFS1) Cc: openembedded-core@lists.openembedded.org Subject: Re: [OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992 > On 22 Jan 2024, at 14:16, Marko, Peter wrote: > > > > Hi Ross, >

[OE-core] [PATCH] libxcomposite: Drop obsolete patch

2024-01-22 Thread Richard Purdie
The patch looks obsolete now we have recipe specific sysroots, drop it. Signed-off-by: Richard Purdie --- .../libxcomposite/change-include-order.patch | 18 -- .../xorg-lib/libxcomposite_0.4.6.bb| 2 -- 2 files changed, 20 deletions(-) delete mode 100644

Re: [OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992

2024-01-22 Thread Ross Burton
On 22 Jan 2024, at 14:16, Marko, Peter wrote: > > Hi Ross, > > I think this one is better - > https://lists.openembedded.org/g/openembedded-core/message/193603 > I'm not sure why it was not picked up yet after 9 days, but It's CPE which is > not matching, not our configuration options… Ah I

Re: [OE-core] [PATCH] insane.bbclass: Allow the warning about virtual/ to be disabled

2024-01-22 Thread Peter Kjellerstedt
> -Original Message- > From: Richard Purdie > Sent: den 22 januari 2024 15:02 > To: Peter Kjellerstedt ; openembedded- > c...@lists.openembedded.org > Subject: Re: [OE-core] [PATCH] insane.bbclass: Allow the warning about > virtual/ to be disabled > > On Mon, 2024-01-22 at 06:52 +0100,

Re: [OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992

2024-01-22 Thread Peter Marko via lists.openembedded.org
Hi Ross, I think this one is better - https://lists.openembedded.org/g/openembedded-core/message/193603 I'm not sure why it was not picked up yet after 9 days, but It's CPE which is not matching, not our configuration options... Peter -Original Message- From:

Re: [OE-core] [PATCH] insane.bbclass: Allow the warning about virtual/ to be disabled

2024-01-22 Thread Martin Jansa
On Mon, Jan 22, 2024 at 3:02 PM Richard Purdie < richard.pur...@linuxfoundation.org> wrote: > On Mon, 2024-01-22 at 06:52 +0100, Peter Kjellerstedt wrote: > > Commit f673d3d239799fb1ab50f4aa5d44187666aa0cd7 introduced a warning for > > virtual/ being used in RPROVIDES and RDEPENDS. Make it

[OE-core] [PATCH 1/5] cve_check: handle CVE_STATUS being set to the empty string

2024-01-22 Thread Ross Burton
From: Ross Burton Handle CVE_STATUS[...] being set to an empty string just as if it was not set at all. This is needed for evaluated CVE_STATUS values to work, i.e. when setting not-applicable-config if a PACKAGECONFIG is disabled. Signed-off-by: Ross Burton --- meta/lib/oe/cve_check.py | 4

[OE-core] [PATCH 5/5] xserver-xorg: disable xvfb by default

2024-01-22 Thread Ross Burton
From: Ross Burton xvfb has limited use, so to mitigate CVE-2023-5574 out of the box we can disable the xvfb PACKAGECONFIG. Signed-off-by: Ross Burton --- meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992

2024-01-22 Thread Ross Burton
From: Ross Burton This issue is specific to the Cloudflare fork of zlib. Signed-off-by: Ross Burton --- meta/recipes-core/zlib/zlib_1.3.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/zlib/zlib_1.3.bb b/meta/recipes-core/zlib/zlib_1.3.bb index

[OE-core] [PATCH 4/5] xserver-xorg: add PACKAGECONFIG for xvfb

2024-01-22 Thread Ross Burton
From: Ross Burton Xvfb is pretty niche and has outstanding unsolved security issues, so let people disable it and add a conditional CVE_STATUS to reflect this. Signed-off-by: Ross Burton --- meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 6 -- 1 file changed, 4 insertions(+), 2

[OE-core] [PATCH 2/5] cve_check: cleanup logging

2024-01-22 Thread Ross Burton
From: Ross Burton Primarily list the number of patches found, useful when debugging. Also clean up some bad escaping that caused warnings and use re.IGNORECASE instead of manually doing case-insenstive rang matches. Signed-off-by: Ross Burton --- meta/lib/oe/cve_check.py | 13 ++---

Re: [OE-core] [PATCH] insane.bbclass: Allow the warning about virtual/ to be disabled

2024-01-22 Thread Richard Purdie
On Mon, 2024-01-22 at 06:52 +0100, Peter Kjellerstedt wrote: > Commit f673d3d239799fb1ab50f4aa5d44187666aa0cd7 introduced a warning for > virtual/ being used in RPROVIDES and RDEPENDS. Make it possible to > disable the warning by removing "virtual-slash from WARN_QA. > > Signed-off-by: Peter

[OE-core] [PATCH v10 9/9] WIP: sdk-manual: extensible.rst: cover devtool ide-sdk

2024-01-22 Thread Adrian Freihofer
Cover the new devtool ide plugin in the extensible sdk section. Many thanks to Enguerrand de Ribaucourt for his re-view and contributions. Signed-off-by: Adrian Freihofer --- documentation/sdk-manual/extensible.rst | 257 +++- 1 file changed, 256 insertions(+), 1

[OE-core] [PATCH v10 7/9] devtool: refactor deploy-target

2024-01-22 Thread Adrian Freihofer
Make the deploy function independent from d. This allows to call the function also from Python code not running in bitbake. This is needed to for the devtool ide plugin which will call the do_install task and the code from devtool deploy-target independently from a bitbake server. This allows a

[OE-core] [PATCH v10 8/9] devtool: ide-sdk make deploy-target quicker

2024-01-22 Thread Adrian Freihofer
Signed-off-by: Adrian Freihofer --- scripts/lib/devtool/ide_sdk.py | 43 ++ 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/scripts/lib/devtool/ide_sdk.py b/scripts/lib/devtool/ide_sdk.py index 27389026be3..3986dc1436a 100755 ---

[OE-core] [PATCH v10 6/9] devtool: refactor deploy to use exec_fakeroot_no_d

2024-01-22 Thread Adrian Freihofer
This is a step towards a deploy function which can be called without passing the d variable. Signed-off-by: Adrian Freihofer --- scripts/lib/devtool/deploy.py | 11 +++ 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/lib/devtool/deploy.py

[OE-core] [PATCH v10 5/9] devtool: refactor exec_fakeroot

2024-01-22 Thread Adrian Freihofer
Provide a function exec_fakeroot_no_d which does the same like exec_fakeroot does, but is usable independenlty from bitbake. This allows to use the fanction from scripts where the d variable is not available. Signed-off-by: Adrian Freihofer --- scripts/lib/devtool/__init__.py | 5 - 1 file

[OE-core] [PATCH v10 3/9] devtool: new ide-sdk plugin

2024-01-22 Thread Adrian Freihofer
The new devtool ide plugin provides the eSDK and configures an IDE to work with the eSDK. In doing so, bitbake should be used to generate the IDE configuration and update the SDK, but it should no longer play a role when working on the source code. The work on the source code should take place

[OE-core] [PATCH v10 4/9] oe-selftest devtool: ide-sdk tests

2024-01-22 Thread Adrian Freihofer
Add some oe-selftests for the new devtool ide-sdk plugin. Most of the workflows are covered. Many thanks to Enguerrand de Ribaucourt for testing and bug fixing. Signed-off-by: Adrian Freihofer --- meta/lib/oeqa/selftest/cases/devtool.py | 492 1 file changed, 492

[OE-core] [PATCH v10 2/9] devtool: support plugins with plugins

2024-01-22 Thread Adrian Freihofer
Pass the plugins search path to plugins via context. This allows plugins to search for their own plugins at the same paths. Signed-off-by: Adrian Freihofer --- scripts/devtool | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/devtool b/scripts/devtool index

[OE-core] [PATCH v10 0/9] devtool ide plugin

2024-01-22 Thread Adrian Freihofer
Changes from v9 to v10: - Fix a bashism issue which was the root cause for the failures on the AB Debian and Ubuntu hosts: https://autobuilder.yoctoproject.org/typhoon/#/builders/80/builds/6257/steps/14/logs/stdio

[OE-core] [PATCH v10 1/9] cmake.bbclass: use --install

2024-01-22 Thread Adrian Freihofer
Since version 3.15 CMake provides a command-line signature to install an already-generated project binary tree. This may be used after building a project to run installation without using the generated build system or the native build tool. This is a small improvement, for regular bitbake calls.

[OE-core] [PATCH] xev: Drop diet libx11 related patch

2024-01-22 Thread Richard Purdie
We dropped diet-libx11 back in 2019 in 1a502765db2093e573c9e3ecd6c1bc7621476963. Drop the patch we don't need from xev to match. Signed-off-by: Richard Purdie --- .../xorg-app/xev/diet-x11.patch | 114 -- meta/recipes-graphics/xorg-app/xev_1.2.5.bb | 2 - 2

Re: [OE-core] [yocto-security] OE-core CVE metrics for master on Sun 21 Jan 2024 01:00:01 AM HST

2024-01-22 Thread Ross Burton
On 21 Jan 2024, at 11:18, Steve Sakoman via lists.yoctoproject.org wrote: > New this week: 0 CVEs Hurray! > Full list: Found 39 unpatched CVEs Ouch! I did a pass of triage on the non-kernel issues. > CVE-2022-3219 (CVSS3: 3.3 LOW): gnupg:gnupg-native >

Re: [OE-core] [PATCH] libgcc-initial: Update status of CVE-2023-4039

2024-01-22 Thread Ross Burton
> On 21 Jan 2024, at 19:19, Simone Weiß via lists.openembedded.org > wrote: > +CVE_STATUS[CVE-2023-4039] = "fixed-version: Fixed via CVE-2023-4039.patch in > gcc-13-2.inc which is added via require here” I’m guessing this is because gcc and friends all use gcc-source recipe, so gcc.bb

[OE-Core][PATCH v1] wic: implement reproducible Disk GUID

2024-01-22 Thread Adithya Balakumar
From: Adithya Balakumar GPT based disks have a disk guid apart from the 32-bit disk identifier. This commit implements reproducible disk guid by using SOURCE_DATE_EPOCH (if available) value as a random seed Signed-off-by: Adithya Balakumar --- scripts/lib/wic/plugins/imager/direct.py | 16

Re: [OE-core] [PATCH 1/2] mdamd: Switch to git recipe

2024-01-22 Thread Pavel Zhukov
Upstream project has got new maintainer last month. I'm contacting him to see what's the plan is. They were doing release every 2-3 years before and 4.2 has been released in 2021 (Dec 30th :) ) so not so long time ago. -- Pavel On Mon, Jan 22, 2024, at 12:09, Richard Purdie wrote: > On

Re: [OE-core] [PATCH 1/2] mdamd: Switch to git recipe

2024-01-22 Thread Richard Purdie
On Mon, 2024-01-22 at 11:17 +0100, Alexander Kanavin wrote: > On Mon, 22 Jan 2024 at 09:55, Pavel Zhukov wrote: > > > > mdadm latest official release was long time while development is > > ongoing. This caused growing number of downstream patches in the layer. > > Switch to git recipe and

Re: [OE-core] [PATCH v2 5/5] rust: Enable rust oe-selftest.

2024-01-22 Thread Shinde, Yash via lists.openembedded.org
[Edited Message Follows] On 20-01-2024 22:31, Randy MacLeod wrote: I like that you have broken the original patch down into 5 patches that are easier to understand. On 2024-01-19 10:09 a.m., yash.shi...@windriver.com wrote: From: Yash Shinde ( yash.shi...@windriver.com ) Tests which are

Re: [OE-core] [PATCH v2 5/5] rust: Enable rust oe-selftest.

2024-01-22 Thread Shinde, Yash via lists.openembedded.org
On 20-01-2024 22:31, Randy MacLeod wrote: I like that you have broken the original patch down into 5 patches that are easier to understand. On 2024-01-19 10:09 a.m., yash.shi...@windriver.com wrote: From: Yash Shinde Tests which are failing from below modules are added to exclude list

Re: [OE-core] [PATCH v2 1/5] rust: Fetch cargo from rust-snapshot dir.

2024-01-22 Thread Shinde, Yash via lists.openembedded.org
On 20-01-2024 22:33, Randy MacLeod wrote: On 2024-01-19 10:09 a.m., yash.shi...@windriver.com wrote: From: Yash Shinde Fixes: Exception: no cargo executable found at `${B}/rustc-1.74.1-src/build/x86_64-unknown-linux-gnu/stage0/bin/cargo` Fix the cargo binary path error on oe-selftest

Re: [OE-core] Core workflow: sstate for all, bblock/bbunlock, tools for why is sstate not being reused?

2024-01-22 Thread Alexander Kanavin
On Thu, 14 Sept 2023 at 13:52, Alexander Kanavin wrote: > > On Tue, 12 Sept 2023 at 16:44, Stephen Jolley wrote: > > Alexander Kanavin will be working on the core workflow topic I thought I'd write a summary of where we are with these subjects, and make a plan for what needs to be done still:

Re: [OE-core] [PATCH] tcmode-default.inc: use ?= to set PREFERRED_VERSION_llvm/llvm-native/nativesdk-llvm

2024-01-22 Thread Martin Jansa
So please suggest a variable name which Richard will accept as I think it's easier to use separate variable than overriding all 3 PREFERRED_VERSION_llvm* to version currently in oe-core whenever someone wants to use meta-clang. On Mon, Jan 22, 2024 at 1:58 AM Changqing Li wrote: > Yes > On

Re: [OE-core] [PATCH 2/2] mdadm: Disable ptest

2024-01-22 Thread Alexander Kanavin
None of the recipes in oe-core set PTEST_ENABLED, they only read it to determine build settings. If recipes in other layers do that, it's a mistake. Alex On Mon, 22 Jan 2024 at 11:28, Pavel Zhukov wrote: > > Yes, Yoann has mentioned this already. > Seems like recipes use both PTEST_ENABLED and

Re: [OE-core] [PATCH 2/2] mdadm: Disable ptest

2024-01-22 Thread Pavel Zhukov
Yes, Yoann has mentioned this already. Seems like recipes use both PTEST_ENABLED and PTESTS_PROBLEMS for this purposes and I've not found any documentation. I'll update the patch to use PTESTS_PROBLEMS instead -- Pavel On Mon, Jan 22, 2024, at 11:21, Alexander Kanavin wrote: > On Mon, 22 Jan

Re: [OE-core] [PATCH 2/2] mdadm: Disable ptest

2024-01-22 Thread Yoann Congal
Le lun. 22 janv. 2024 à 11:21, Alexander Kanavin a écrit : > On Mon, 22 Jan 2024 at 09:55, Pavel Zhukov wrote: > > mdadm tests are flaky and cause a lot of failures on autobuilder. > > Disable them for now. Keeping ptest code in the recipe to fix/enable > > in the future > > SRC_URI = "git://

Re: [OE-core] [PATCH 2/2] mdadm: Disable ptest

2024-01-22 Thread Alexander Kanavin
On Mon, 22 Jan 2024 at 09:55, Pavel Zhukov wrote: > mdadm tests are flaky and cause a lot of failures on autobuilder. > Disable them for now. Keeping ptest code in the recipe to fix/enable > in the future > SRC_URI = >

Re: [OE-core] [PATCH 1/2] mdamd: Switch to git recipe

2024-01-22 Thread Alexander Kanavin
On Mon, 22 Jan 2024 at 09:55, Pavel Zhukov wrote: > > mdadm latest official release was long time while development is > ongoing. This caused growing number of downstream patches in the layer. > Switch to git recipe and cleanup patches. Wait. Did you engage with upstream to find out if/when

Re: [OE-core] [PATCH 1/2] perl: Add option to prevent COMPLEMENTARY_GLOB from ignoring perl-modules

2024-01-22 Thread Alexander Kanavin
Thank you for doing this deep level investigation. I think this pretty much shows that listing all modules in a way that can be maintained isn't feasible (the idea was that maybe there's only a few of them needed for ptest). Which brings us back to the question: why is perl-modules using

[OE-core] [nanbield][patch 1/2] sudo: upgrade 1.9.14p3 -> 1.9.15p2

2024-01-22 Thread Lee Chee Yang
From: Xiangyu Chen Changelog: === 1.9.15p2: - Fixed a bug on BSD systems where sudo would not restore the terminal settings on exit if the terminal had parity enabled. 1.9.15p1: - Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers from being able to read the

[OE-core] [nanbield][patch 2/2] sudo: upgrade from 1.9.15p2 to 1.9.15p5

2024-01-22 Thread Lee Chee Yang
From: Chen Qi (cherry picked from OE-Core rev 4b2eccc0ee3f2906f9b04de194b9df6e24c2cdf4) Signed-off-by: Chen Qi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Lee Chee Yang --- .../sudo/{sudo_1.9.15p2.bb => sudo_1.9.15p5.bb} | 2 +- 1 file

[OE-core] [PATCH] nativesdk-cairo: fix build error

2024-01-22 Thread Kai Kang
From: Kai Kang It fails to build nativesdk-cairo: | ../cairo-1.18.0/meson.build:381:13: ERROR: Can not run test applications in this cross environment. Set meson property ipc_rmid_deferred_release in cross-file to fix the issue which is as same as for target cairo Signed-off-by: Kai Kang

[OE-core] [PATCH v2] binutils: Add patch to fix CVE-2023-25584

2024-01-22 Thread Ashishx88
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=77c225bdeb410cf60da804879ad41622f5f1aa44] CVE: CVE-2023-25584 Signed-off-by: Ashish Kumar Mishra --- .../binutils/binutils-2.39.inc| 1 + .../binutils/0016-CVE-2023-25584.patch| 535

[OE-core][PATCH] glibc: Refresh CVE statuses

2024-01-22 Thread Andrej Valek
- drop irrelevant CVEs Signed-off-by: Valek Andrej --- meta/recipes-core/glibc/glibc-version.inc | 5 - meta/recipes-core/glibc/glibc_2.39.bb | 2 -- 2 files changed, 7 deletions(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc

[OE-core] [PATCH 2/2] mdadm: Disable ptest

2024-01-22 Thread Pavel Zhukov
mdadm tests are flaky and cause a lot of failures on autobuilder. Disable them for now. Keeping ptest code in the recipe to fix/enable in the future Signed-off-by: Pavel Zhukov --- meta/recipes-extended/mdadm/mdadm_git.bb | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git

[OE-core] [PATCH 1/2] mdamd: Switch to git recipe

2024-01-22 Thread Pavel Zhukov
mdadm latest official release was long time while development is ongoing. This caused growing number of downstream patches in the layer. Switch to git recipe and cleanup patches. Signed-off-by: Pavel Zhukov --- ...anup-validate_geometry_ddf_container.patch | 148 --

Re: [OE-core][PATCH] opensbi: bump to 1.4

2024-01-22 Thread Thomas Perrot via lists.openembedded.org
Hello Khem, On Fri, 2024-01-19 at 15:56 -0800, Khem Raj wrote: > On Fri, Jan 19, 2024 at 2:00 PM Alexandre Belloni > wrote: > > > > > > On 19/01/2024 19:24:44+, Richard Purdie wrote: > > > On Fri, 2024-01-19 at 18:48 +0100, Thomas Perrot wrote: > > > > Hello Richard, > > > > > > > > On

[OE-core][PATCH] glibc: Refresh CVE statuses

2024-01-22 Thread Andrej Valek
- drop irrelevant CVEs Signed-off-by: Valek Andrej --- meta/recipes-core/glibc/glibc-version.inc | 5 - meta/recipes-core/glibc/glibc_2.39.bb | 2 -- 2 files changed, 7 deletions(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc

[OE-core][PATCH v3] opensbi: bump to 1.4

2024-01-22 Thread Thomas Perrot via lists.openembedded.org
From: Thomas Perrot This release has: - Synopsys DesignWare APB GPIO driver - Zicntr and Zihpm support - Console print improvements - Smepmp support - Simple FDT based syscon regmap driver - Syscon based reboot and poweroff driver - Non-contiguous hpm counters - Smcntrpmf support - Full sparse

Re: [OE-core][PATCH 1/3] systemd: upgrade to 255.1

2024-01-22 Thread Alexandre Belloni via lists.openembedded.org
On 22/01/2024 16:15:41+0800, ChenQi wrote: > On 1/22/24 16:04, Alexandre Belloni wrote: > > On 22/01/2024 12:38:15+0800, ChenQi wrote: > > > On 1/20/24 02:14, Alexandre Belloni wrote: > > > > On 19/01/2024 19:13:25+0100, Alexandre Belloni wrote: > > > > > On 19/01/2024 11:09:20+0800, Chen Qi via

Re: [OE-core][PATCH 1/3] systemd: upgrade to 255.1

2024-01-22 Thread Chen Qi via lists.openembedded.org
On 1/22/24 16:04, Alexandre Belloni wrote: On 22/01/2024 12:38:15+0800, ChenQi wrote: On 1/20/24 02:14, Alexandre Belloni wrote: On 19/01/2024 19:13:25+0100, Alexandre Belloni wrote: On 19/01/2024 11:09:20+0800, Chen Qi via lists.openembedded.org wrote: What's the status of this patch

Re: [OE-core][PATCH 1/3] systemd: upgrade to 255.1

2024-01-22 Thread Alexandre Belloni via lists.openembedded.org
On 22/01/2024 12:38:15+0800, ChenQi wrote: > On 1/20/24 02:14, Alexandre Belloni wrote: > > On 19/01/2024 19:13:25+0100, Alexandre Belloni wrote: > > > On 19/01/2024 11:09:20+0800, Chen Qi via lists.openembedded.org wrote: > > > > What's the status of this patch series? > > > > Is there any issue

[OE-core] Patchtest results for [PATCH] binutils : CVE-2023-25584

2024-01-22 Thread Patchtest
Thank you for your submission. Patchtest identified one or more issues with the patch. Please see the log below for more information: --- Testing patch /home/patchtest/share/mboxes/binutils-CVE-2023-25584.patch FAIL: test CVE tag format: Missing or incorrectly formatted CVE tag in patch file.

Re: [OE-core] Inputs to share CVE patch for binutils CVE-2023-25584

2024-01-22 Thread Ashishx88
Hi Khem Raj / Members , - Have shared my first patch https://lists.openembedded.org/g/openembedded-core/message/194117 Can members please review this and help me improve any aspect of patch if required. - Also how do we know that patch has been accepted and merged ? In BUGZILLA we generally we