Re: [OE-core] [RFC] Mark of upstream CVE patches

On 12/15/2015 11:13 AM, Richard Purdie wrote: On Tue, 2015-12-15 at 11:49 -0500, Philip Balister wrote: On 12/15/2015 11:37 AM, Richard Purdie wrote: On Tue, 2015-12-15 at 11:30 -0500, Philip Balister wrote: I also suggest copying the https://lists.yoctoproject.org/listinfo/yocto-security

Re: [OE-core] [RFC] Mark of upstream CVE patches

On Tue, 2015-12-15 at 11:49 -0500, Philip Balister wrote: > On 12/15/2015 11:37 AM, Richard Purdie wrote: > > On Tue, 2015-12-15 at 11:30 -0500, Philip Balister wrote: > > > I also suggest copying the > > > > > > https://lists.yoctoproject.org/listinfo/yocto-security > > > > > > list. > > > >

[OE-core] [PATCH] license: Fix BB_TASKDEPDATA references

We shouldn't try and expand what is a python dict object and we don't want it to influence the task hashes, task dependencies are already accounted for. Signed-off-by: Richard Purdie diff --git a/meta/classes/license.bbclass b/meta/classes/license.bbclass

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, 15 Dec 2015 17:28:59 Alexander Kanavin wrote: > On 12/15/2015 05:25 PM, Martin Jansa wrote: > >> +COMPATIBLE_HOST = '(i.86|x86_64|mips|powerpc|powerpc64).*-linux' > >> +COMPATIBLE_HOST_armv7a = 'arm.*-linux' > > > > Can you add armv7ve as well? > > Armv7ve support is not yet in master,

[OE-core] [RFC] Mark of upstream CVE patches

There is an initiative to track vulnerable software being built (see bugs 8119 and 7515). The idea is to have a testing tool that would check the recipe versions against CVEs. In order to accomplish such task there is need to reliable mark the patches from upstream that solve CVEs. There have

Re: [OE-core] [RFC] Mark of upstream CVE patches

On Tue, Dec 15, 2015 at 2:03 PM, Mariano Lopez wrote: > There is an initiative to track vulnerable software being built (see bugs > 8119 and 7515). The idea is to have a testing tool that would check the > recipe versions against CVEs. In order to accomplish such

[OE-core] [PATCH] meta: remove removals of FILES_-dbg

In some recipes overly-split -dbg packages were merged into PN-dbg. Unless there's a very good reason, recipes should have a single -dev and -dbg package. Signed-off-by: Ross Burton --- meta/recipes-bsp/pcmciautils/pcmciautils_018.bb| 1 -

Re: [OE-core] [RFC] Mark of upstream CVE patches

On 12/15/2015 11:37 AM, Richard Purdie wrote: > On Tue, 2015-12-15 at 11:30 -0500, Philip Balister wrote: >> I also suggest copying the >> >> https://lists.yoctoproject.org/listinfo/yocto-security >> >> list. > > and the architecture list, this is something that should apply to more > than

Re: [OE-core] [PATCH] kernel: Add support for multiple kernel packages

On Mon, Dec 14, 2015 at 03:02:44PM -0500, Bruce Ashfield wrote: > On Mon, Dec 14, 2015 at 2:17 PM, Bruce Ashfield > wrote: > > > > > > > On Mon, Dec 14, 2015 at 2:06 PM, Haris Okanovic > > wrote: > > > >> From: Gratian Crisan

Re: [OE-core] [RFC] Mark of upstream CVE patches

On Tue, 2015-12-15 at 11:30 -0500, Philip Balister wrote: > I also suggest copying the > > https://lists.yoctoproject.org/listinfo/yocto-security > > list. and the architecture list, this is something that should apply to more than OE-Core ideally. Cheers, Richard > Philip > > On 12/15/2015

[OE-core] [PATCH] coreutils/procps: Revert priority change since coreutils > busybox

In 2ce514a394e1e062172bb097aa92a1792a0f8eaf, "coreutils: fix ALTERNATIVE_PRIORITY conflict with procps and mktemp" the priority was lowered from 100 to 30. Unfortunately this lowered coreutils past busybox which means busybox was ending up in our SDK images. This isn't what users expect.

Re: [OE-core] [PATCH] meta: remove removals of FILES_-dbg

Well that subject made no sense, fixed it locally. Ross On 15 December 2015 at 16:33, Ross Burton wrote: > In some recipes overly-split -dbg packages were merged into PN-dbg. Unless > there's a very good reason, recipes should have a single -dev and -dbg > package. > >

Re: [OE-core] [RFC] Mark of upstream CVE patches

I also suggest copying the https://lists.yoctoproject.org/listinfo/yocto-security list. Philip On 12/15/2015 11:03 AM, Mariano Lopez wrote: > There is an initiative to track vulnerable software being built (see > bugs 8119 and 7515). The idea is to have a testing tool that would check > the

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, Dec 15, 2015 at 9:26 AM, Paul Eggleton wrote: > On Tue, 15 Dec 2015 17:28:59 Alexander Kanavin wrote: >> On 12/15/2015 05:25 PM, Martin Jansa wrote: >> >> +COMPATIBLE_HOST = '(i.86|x86_64|mips|powerpc|powerpc64).*-linux' >> >> +COMPATIBLE_HOST_armv7a =

Re: [OE-core] [PATCH 0/2] Debian multilib packaging fixes

Hi Matt, I'm starting to look at your patches, in what arches/combinations you test the patches? Kind regards, alimon On 12/06/2015 11:25 AM, Matt Madison wrote: > I ran into sevearl issues while trying to build an ARM multilib rootfs > using Debian packaging. After several go-rounds,

Re: [OE-core] [PATCH v2] kernel: Add support for multiple kernel packages

Hi Khem, On 12/14/2015 06:33 PM, Khem Raj wrote: On Dec 14, 2015, at 2:35 PM, Haris Okanovic wrote: From: Gratian Crisan This change allows distributions to provide multiple builds of kernel and module packages. For example, a distro may want

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, 15 Dec 2015 12:07:48 Andre McCurdy wrote: > On Tue, Dec 15, 2015 at 9:26 AM, Paul Eggleton > > wrote: > > On Tue, 15 Dec 2015 17:28:59 Alexander Kanavin wrote: > >> On 12/15/2015 05:25 PM, Martin Jansa wrote: > >> >> +COMPATIBLE_HOST =

Re: [OE-core] [PATCH] kernel: Add support for multiple kernel packages

On Tue, Dec 15, 2015 at 11:58:26AM -0500, Denys Dmytriyenko wrote: > On Mon, Dec 14, 2015 at 03:02:44PM -0500, Bruce Ashfield wrote: > > On Mon, Dec 14, 2015 at 2:17 PM, Bruce Ashfield > > wrote: > > > > > > > > > > > On Mon, Dec 14, 2015 at 2:06 PM, Haris Okanovic

Re: [OE-core] [Openembedded-architecture] Automatic -dbg FILES generation

On Tue, Dec 15, 2015 at 8:43 AM, Richard Purdie < richard.pur...@linuxfoundation.org> wrote: > I don't think I'm alone in being a bit frustrated with the effort > needed to get FILES_${PN}-dbg correct. I've just posted a patch to oe > -core which automates this and means we can drop 99% of the

Re: [OE-core] [PATCH 0/2] Debian multilib packaging fixes

[Resending as I forgot to cc the list] On Tue, Dec 15, 2015 at 9:29 AM, Aníbal Limón wrote: > Hi Matt, > > I'm starting to look at your patches, in what arches/combinations you > test the patches? I've been working on a BSP layer for the jetson-tx1, which is

[OE-core] [PATCH] msmtp: add gplv2 version

From: Wenzong Fan * add gplv2 version 1.4.12 * add patch msmtp-fixup-api-and-compiler-issues.patch to deal with issues: sysroots/qemux86-64/usr/include/ inttypes.h:290:8: error: unknown type name 'intmax_t' inttypes.h:310:8: error: unknown type name

[OE-core] [PATCH][dizzy] openssl: CVE-2015-3194, CVE-2015-3195

Fixes following vulnerabilities: Certificate verify crash with missing PSS parameter (CVE-2015-3194) X509_ATTRIBUTE memory leak (CVE-2015-3195) References: https://openssl.org/news/secadv/20151203.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3194

Re: [OE-core] [PATCH][dizzy] openssl: CVE-2015-3194, CVE-2015-3195

Hi Armin I noticed that my patch does not have reference to the original commit hash, I will create a new patch and send it to you, sorry about this. commit b29ffa392e839d05171206523e84909146f7a77c Author: Dr. Stephen Henson //Sona > -Original Message- > From:

[OE-core] [PATCH] useradd: Allow overriding USERADDDEPENDS for native

If I want to be able to override USERADDDEPENDS from another bbclass, I need to give USERADDDEPENDS a default value and use DEPENDS_append for the different types of class. This is one example of what I need to be able to do in another .bbclass: USERADDDEPENDS_class-native = " base-files-native

[OE-core] [RESEND PATCH v3] util-linux: create util-linux-runuser package

Split runuser into its own package (previously provided by util-linux). Since runuser is compiled only when DISTRO_FEATURES includes pam, the creation of util-linux-runuser is also constrained by this. Signed-off-by: Ioan-Adrian Ratiu ---

[OE-core] [PATCH] flex: update to 2.6.0

Drop backported 0001-bison-test-fixes-Do-not-use-obsolete-bison-construct.patch Test cases have been completely rearranged upstream, so ptest support is fully rewritten. Flex is now using its own binary both during compilation and test running, so the target recipe depends on the native version

Re: [OE-core] [PATCH 0/2] Debian multilib packaging fixes

Hi Matt, Trying to build core-image-sato with qemux86-64 and multilib enabled an errors appear (see attached log), next the config. MACHINE ??= "qemux86-64" IMAGE_INSTALL_append = " lib32-connman" require conf/multilib.conf MULTILIBS = "multilib:lib32" DEFAULTTUNE_virtclass-multilib-lib32 =

[OE-core] [PATCH] m4: Drop unused/unreferenced patch

Signed-off-by: Richard Purdie diff --git a/meta/recipes-devtools/m4/m4/make.patch b/meta/recipes-devtools/m4/m4/make.patch deleted file mode 100644 index 79fb415..000 --- a/meta/recipes-devtools/m4/m4/make.patch +++ /dev/null @@ -1,42 +0,0 @@

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, Dec 15, 2015 at 12:43 PM, Khem Raj wrote: > >> On Dec 15, 2015, at 12:16 PM, Paul Eggleton >> wrote: >> >> On Tue, 15 Dec 2015 12:07:48 Andre McCurdy wrote: >>> On Tue, Dec 15, 2015 at 9:26 AM, Paul Eggleton >>> >>>

Re: [OE-core] [PATCH 0/4] Replace busybox for variable.

Ping AJ On mar, 2015-12-01 at 20:27 +, Joya Cruz, Alejandro wrote: > ping > On jue, 2015-11-26 at 18:34 +, Joya Cruz, Alejandro wrote: > > Any feedback about this? > > > > On mar, 2015-11-17 at 16:13 -0600, Alejandro Joya wrote: > > > These recipes have a hardcoded dependency to busybox,

Re: [OE-core] [PATCH] m4: Drop unused/unreferenced patch

On Tue, Dec 15, 2015 at 8:27 PM, Richard Purdie wrote: > Signed-off-by: Richard Purdie Is there a way to have a task, like fetchall, which checks for non-referenced metadata files? This would help to avoid this to happen in

[OE-core] [PATCH] buildhistory-collect-srcrevs: hide empty sections

From: Christopher Larson Cc: Paul Eggleton Signed-off-by: Christopher Larson --- scripts/buildhistory-collect-srcrevs | 22 +++--- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git

[OE-core] Automatic -dbg FILES generation

I don't think I'm alone in being a bit frustrated with the effort needed to get FILES_${PN}-dbg correct. I've just posted a patch to oe -core which automates this and means we can drop 99% of the cases where we set this variable. I'm giving a heads up here since this is an architectural change to

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, Dec 15, 2015 at 5:50 PM, Khem Raj wrote: > >> On Dec 15, 2015, at 2:27 PM, Andre McCurdy wrote: >> >> On Tue, Dec 15, 2015 at 12:43 PM, Khem Raj wrote: >>> On Dec 15, 2015, at 12:16 PM, Paul Eggleton

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

> On Dec 15, 2015, at 7:11 PM, Andre McCurdy wrote: > > On Tue, Dec 15, 2015 at 5:50 PM, Khem Raj wrote: >> >>> On Dec 15, 2015, at 2:27 PM, Andre McCurdy wrote: >>> >>> On Tue, Dec 15, 2015 at 12:43 PM, Khem Raj

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

> On Dec 15, 2015, at 12:16 PM, Paul Eggleton > wrote: > > On Tue, 15 Dec 2015 12:07:48 Andre McCurdy wrote: >> On Tue, Dec 15, 2015 at 9:26 AM, Paul Eggleton >> >> wrote: >>> On Tue, 15 Dec 2015 17:28:59 Alexander Kanavin wrote:

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

> On Dec 15, 2015, at 2:27 PM, Andre McCurdy wrote: > > On Tue, Dec 15, 2015 at 12:43 PM, Khem Raj wrote: >> >>> On Dec 15, 2015, at 12:16 PM, Paul Eggleton >>> wrote: >>> >>> On Tue, 15 Dec 2015 12:07:48 Andre McCurdy

[OE-core] [PATCH] ncurses: changes ncurses-config to ncurses5-config

From: Ming Liu ncurses-config is a wrong name, there is not such file at all, changes it to ncurses5-config. Signed-off-by: Ming Liu --- meta/recipes-core/ncurses/ncurses.inc | 2 +- 1 file changed, 1 insertion(+), 1

Re: [OE-core] [PATCH] m4: Drop unused/unreferenced patch

Hi Otavio, On Tue, 15 Dec 2015 22:13:53 Otavio Salvador wrote: > Is there a way to have a task, like fetchall, which checks for > non-referenced metadata files? This would help to avoid this to happen > in future. We could do this, but one place I hope we can catch this in future is in a script

Re: [OE-core] [PATCH RFC] module.bbclass: Fix potential do_compile/do_make_scripts race condition

On Sun, 6 Dec 2015 11:26:33 + Paul Barker wrote: > I ran into a race condition building multiple external modules against a > 3.10.y > series kernel using the dylan branch of OpenEmbedded. This is difficult to > reproduce as it requires very specific timing: the

[OE-core] [PATCH] selftest/buildhistory.py: Test buildhistory does not change sigs

[YOCTO #5953] Add a test to ensure buildhistory does not change signatures. Also removed unused imports. Signed-off-by: Daniel Istrate --- meta/lib/oeqa/selftest/buildhistory.py | 69 -- 1 file changed, 65 insertions(+), 4

[OE-core] [PATCH] valgrind: update to 3.11.0

LICENSE checksums are changed due to a change in FSF address, or copyright years update. Rebased patches: sepbuildfix.patch rebased to 0004-Fix-out-of-tree-builds.patch add-ptest.patch rebased to 0005-Modify-vg_test-wrapper-to-support-PTEST-formats.patch Removed patches: force-nostabs.patch

Re: [OE-core] [PATCH RFC] module.bbclass: Fix potential do_compile/do_make_scripts race condition

On Tue, Dec 15, 2015 at 9:04 AM, Paul Barker wrote: > On Sun, 6 Dec 2015 11:26:33 + > Paul Barker wrote: > > > I ran into a race condition building multiple external modules against a > 3.10.y > > series kernel using the dylan branch

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On 12/15/2015 05:25 PM, Martin Jansa wrote: +COMPATIBLE_HOST = '(i.86|x86_64|mips|powerpc|powerpc64).*-linux' +COMPATIBLE_HOST_armv7a = 'arm.*-linux' Can you add armv7ve as well? Armv7ve support is not yet in master, so you'll have to add it later I'm afraid. Alex --

[OE-core] [PATCH] package: Add auto package splitting of .debug files

Creating FILES_${PN}-dbg is tedious and also pretty pointless. We might as well assume ".debug" is a special directory name and split into -dbg automatically. This change does so without changing the rest of the splitting logic too much. It can be disabled for the cases where we really do want

Re: [OE-core] [PATCH] valgrind: update to 3.11.0

On Tue, Dec 15, 2015 at 05:02:33PM +0200, Alexander Kanavin wrote: > LICENSE checksums are changed due to a change in FSF address, or copyright > years update. > > Rebased patches: > sepbuildfix.patch rebased to 0004-Fix-out-of-tree-builds.patch > add-ptest.patch rebased to >

[OE-core] [PATCH v2] valgrind: update to 3.11.0

LICENSE checksums are changed due to a change in FSF address, or copyright years update. Rebased patches: sepbuildfix.patch rebased to 0004-Fix-out-of-tree-builds.patch add-ptest.patch rebased to 0005-Modify-vg_test-wrapper-to-support-PTEST-formats.patch Removed patches: force-nostabs.patch

[OE-core] [PATCH] various: Drop now pointless manual -dbg packaging

With the autodebug package generation logic, specifically setting FILES_${PN}-dbg isn't needed in most cases, we can remove them. Signed-off-by: Richard Purdie diff --git a/meta/classes/cpan-base.bbclass b/meta/classes/cpan-base.bbclass index

Re: [OE-core] [PATCH] various: Drop now pointless manual -dbg packaging

Ross spotted the systemd_git.bb recipe issue, I've fixed that in the version in master-next. Cheers, Richard -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org

Re: [OE-core] [PATCH][dizzy] openssl: CVE-2015-3194, CVE-2015-3195

Hi Armin Please merge this patch to daisy branch. Thanks. Fan -Original Message- From: openembedded-core-boun...@lists.openembedded.org [mailto:openembedded-core-boun...@lists.openembedded.org] On Behalf Of Sona Sarmadi Sent: Tuesday, December 15, 2015 6:08 PM To: