Hi Brian On Fri, Sep 7, 2018 at 1:25 PM Brian Smucker <[email protected]> wrote: > > Hello all, > > We have a device whose image is built using an older yocto image. It is > based on yocto Danny, if I recall correctly. > > How do users of yocto handle the need occasionally to update one or more > component packages to deal with security vulnerabilities? > > I am not a yocto expert and I was hoping there would be a clear way > forward here. > > Migrating all our recipes to the latest version of yocto probably should > be done, but it would involve weeks of pain. I know, I started to do it > sometime back. > > So that is one option, but a very unattractive one at the moment. > > When we jumped into using Yocto, I was hoping that there would be a > clear answer to this, but I have been frustrated. Perhaps there is a > clear answer, but it's outside of what I know. > > What are my options and the tradeoffs of each?
yocto project provided infra to build distributions. so you would have either built your own distribution or procured it from someone else e.g. OSVs, if its third party the they generally have security update schedules that you can work with. If you build your own distro then you have freedom to make changes and patch the security vulnerability and deploy it. community maintains releases for quite some time and you can just cherry-pick the point releases which primarily get security fixes. danny is an old release and is not currently supported in community https://wiki.yoctoproject.org/wiki/Releases so you can still check if needed fixes are there in danny and build it. you can also work with some OE/yocto consultants to get this done for danny There are also binary feed based distributions like angstrom which can provide prebuilt packages ( ipks) but they also have support schedule and I am sure for angstrom danny based feeds are not updated. Thanks -Khem > > Thanks > > Brian > -- > _______________________________________________ > yocto mailing list > [email protected] > https://lists.yoctoproject.org/listinfo/yocto -- _______________________________________________ yocto mailing list [email protected] https://lists.yoctoproject.org/listinfo/yocto
