]> code.ossystems Code Review - openembedded-core.git/log
openembedded-core.git
8 years agoglibc: fix CVE-2016-1234, CVE-2016-3075, CVE-2016-5417
Pascal Bach [Fri, 14 Oct 2016 12:26:44 +0000 (14:26 +0200)]
glibc: fix CVE-2016-1234, CVE-2016-3075, CVE-2016-5417

Only relevant for krogoth since version 2.24+ (master, morty) is not affected.

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobinutils: fix AR issue when opkg is unpacking IPKs containing empty entries
Christophe Chapuis [Sun, 31 Jul 2016 18:52:41 +0000 (18:52 +0000)]
binutils: fix AR issue when opkg is unpacking IPKs containing empty entries

* this patch is backported from 2.26.1 which is already in oe-core/master
  since this patch:
  commit 37e8b6ecf9f9163d7b5b3becdc2feba57df4838f
  Author: Khem Raj <raj.khem@gmail.com>
  Date:   Thu Jul 7 11:08:29 2016 -0700
  Subject: binutils: Upgrade to 2.26.1

  -SRCREV = "71fa566a9cf2597b60a58c1d7c148bab637454a6"
  +SRCREV = "c29838e7f484e0b5714b02e7feb9a88d3a045dd2"

* verified that the patch exists in this SRCREV range:
  ~/projects/binutils $ git log --oneline 71fa566a9cf2597b60a58c1d7c148bab637454a6..c29838e7f484e0b5714b02e7feb9a88d3a045dd2^C
  ...
  343a405 Allow zero length archive elements
  ...
  so it isn't needed in master branch

Signed-off-by: Christophe Chapuis <chris.chapuis@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
8 years agopython3: Security fix CVE-2016-1000110
Armin Kuster [Sun, 2 Oct 2016 17:49:08 +0000 (10:49 -0700)]
python3: Security fix CVE-2016-1000110

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython: Security fix CVE-2016-1000110
Armin Kuster [Sun, 2 Oct 2016 17:48:28 +0000 (10:48 -0700)]
python: Security fix CVE-2016-1000110

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-1238
Mingli Yu [Mon, 26 Sep 2016 06:00:42 +0000 (14:00 +0800)]
perl: fix CVE-2016-1238

Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agomultilib_header: avoid sstate checksum issues for -nativesdk recipes
Joshua Lock [Fri, 30 Sep 2016 09:09:27 +0000 (10:09 +0100)]
multilib_header: avoid sstate checksum issues for -nativesdk recipes

Much as with -native recipes, as addressed in commit
b15730caf0d4c40271796887505507f2501958bb, arch specific variables
like MIPSPKGSFX_ABI were affecting -nativesdk sstate checksums for
recipes like nativesdk-glibc-initial.

Disable multilib_header for nativesdk as we don't use multilibs in
this scenario.

[YOCTO #10320]

(From OE-Core rev: f1c7b4f16dc9a7e5155108641fed8b3d98c931f3)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:35 +0000 (16:42 -0700)]
tzdata: update to 2016g

LICENSE md5sum changed do to rewording some text not released to the license.
see https://github.com/eggert/tz/commit/8c143a2b65fdfd43a7911be6fdb700c9c4553f58

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: Update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:34 +0000 (16:42 -0700)]
tzcode-native: Update to 2016g

LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopulseaudio: Disable unit tests
Davis, Michael [Wed, 28 Sep 2016 18:36:41 +0000 (18:36 +0000)]
pulseaudio: Disable unit tests

Pulseaudio unit tests create a dependency on check not in the recipe.
Since unit tests are not used they are disabled to eliminate build race condition.

Backported from master commit 92cfdb2ba7e04e2b70986c6569f500dd2a48b5d1

Signed-off-by: Michael Davis <michael.davis@essvote.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopigz: Update SRC_URI
Richard Purdie [Wed, 5 Oct 2016 07:55:11 +0000 (08:55 +0100)]
pigz: Update SRC_URI

Upstream have released a new tarball and removed the old one. Revert to
the Yocto Project source mirror instead, preserving the upstream version
check.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agouseradd: Fix infinite build loop
Richard Purdie [Thu, 29 Sep 2016 01:27:35 +0000 (21:27 -0400)]
useradd: Fix infinite build loop

http://git.openembedded.org/openembedded-core-contrib/commit/?id=642c6cf0b6a0371de476513162bd0cefa9c438b3
introduces a problem if the USERADD_PARAM variable has trailing
whitespace as the code infinitely loops causing build hangs.

Add a similar sed expression to $remaining to avoid this.

(From OE-Core rev: d6241e4c94a0a72acfc57e96a59918c0b2146d65)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agolibarchive: respect disable-acl configuration option
Maxin B. John [Tue, 27 Sep 2016 19:25:35 +0000 (15:25 -0400)]
libarchive: respect disable-acl configuration option

Update configure.ac to properly handle --disable-acl option

[YOCTO #9668]

(From OE-Core rev: 84fe3f29f2bdaf98c9beefdfede143084fba093b)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agouseradd.bbclass: Strip trailing ';' in cmd params
Khem Raj [Wed, 18 May 2016 04:20:15 +0000 (21:20 -0700)]
useradd.bbclass: Strip trailing ';' in cmd params

When there are more than 1 packages in a recipe requiring useradd
services, they are concatnated and a ';' is inserted just after
each of the users being added by the packages. A situation arises
in cases where this is controlled by PACKAGECONFIG then we add a
';' separator in the USERADD_PARAM value itself for each packagecofig
since we do not know which one will be picked, we end up in situation
where the final string returned from get_all_cmd_params() appears to be

a; ; b; c;

and then the logic which uses these cmds triggers with ';' as separator
but in this case it will fail after executing useradd 'a' because the next
cmd it will call will be just a whitespace

This is highlighted by the systemd patch to add more users as needed
by systemd 229 components.

(From OE-Core rev: e8d4356c38e3c2aacd6dc49231c73bcb7d597308)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-6306
Armin Kuster [Sat, 24 Sep 2016 06:18:57 +0000 (23:18 -0700)]
openssl: Security fix CVE-2016-6306

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6304
Armin Kuster [Sat, 24 Sep 2016 06:16:30 +0000 (23:16 -0700)]
openssl: Security fix CVE-2016-6304

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6303
Armin Kuster [Sat, 24 Sep 2016 06:14:36 +0000 (23:14 -0700)]
openssl: Security fix CVE-2016-6303

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6302
Armin Kuster [Sat, 24 Sep 2016 06:13:04 +0000 (23:13 -0700)]
openssl: Security fix CVE-2016-6302

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2182
Armin Kuster [Sat, 24 Sep 2016 06:11:28 +0000 (23:11 -0700)]
openssl: Security fix CVE-2016-2182

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agouseradd: use bindir_native for pseudo PATH
Martin Jansa [Wed, 18 May 2016 09:57:33 +0000 (11:57 +0200)]
useradd: use bindir_native for pseudo PATH

* useradd/userdel functions will fail for recipes which override their target prefix
  (e.g. to /opt/foo), because it will try to use pseudo from native-sysroot/opt/foo/bin/pseudo

(From OE-Core rev: 96189e71a86c0f4833e8e51d678208fd908bfe30)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-2181
Armin Kuster [Sat, 24 Sep 2016 06:09:29 +0000 (23:09 -0700)]
openssl: Security fix CVE-2016-2181

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2180
Armin Kuster [Sat, 24 Sep 2016 06:06:10 +0000 (23:06 -0700)]
openssl: Security fix CVE-2016-2180

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2179
Armin Kuster [Sat, 24 Sep 2016 06:03:14 +0000 (23:03 -0700)]
openssl: Security fix CVE-2016-2179

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2178
Armin Kuster [Sat, 24 Sep 2016 06:00:38 +0000 (23:00 -0700)]
openssl: Security fix CVE-2016-2178

affects openssl < 1.0.2i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agocracklib: Apply patch to fix CVE-2016-6318
Dengke Du [Fri, 23 Sep 2016 07:15:20 +0000 (03:15 -0400)]
cracklib: Apply patch to fix CVE-2016-6318

Fix CVE-2016-6318

Backport from cracklib upstream:

https://github.com/cracklib/cracklib/commit/47e5dec521ab6243c9b249dd65b93d232d90d6b1

(From OE-Core rev: bc7691c47f21a7d7549788fe0370c3080fc4dff5)

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agowpa_supplicant: Security Advisory-CVE-2016-4477
Zhixiong Chi [Thu, 22 Sep 2016 07:54:27 +0000 (15:54 +0800)]
wpa_supplicant: Security Advisory-CVE-2016-4477

Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

(From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agowpa_supplicant: Security Advisory-CVE-2016-4476
Zhixiong Chi [Thu, 22 Sep 2016 07:54:20 +0000 (15:54 +0800)]
wpa_supplicant: Security Advisory-CVE-2016-4476

Add CVE-2016-4476 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

(From OE-Core rev: ed610b68f7e19644c89d7131e34c990a02403c62)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agooeqa/buildiptables: Switch from netfilter.org to yoctoproject.org mirror
Richard Purdie [Tue, 23 Aug 2016 16:58:42 +0000 (17:58 +0100)]
oeqa/buildiptables: Switch from netfilter.org to yoctoproject.org mirror

We've had some upstream mirror instability so use our own mirror for the
iptables sources to ensure this doesn't affect the test results.

(From OE-Core rev: 25f6af8895d5f5c6dcedde0a21285d63522769c8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agopython3: Fixes several python3 dependency problems
Alejandro Hernandez [Wed, 21 Sep 2016 21:03:12 +0000 (21:03 +0000)]
python3: Fixes several python3 dependency problems

This patch adds the packages python3-signal, python3-enum and python3-selectors,
while it also fixes python3-subprocess which in turn fix the installation of
python3-modules

[YOCTO #10276]

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
8 years agotiff: Update download URL
Jussi Kukkonen [Thu, 8 Sep 2016 13:35:31 +0000 (16:35 +0300)]
tiff: Update download URL

remotesensing.org domain has been taken over by someone unrelated.
There does not seem to be an up-to-date tiff homepage, but
osgeo.org is a reliable download site.

(From OE-Core rev: f544e1d10e9dc0f750efdb45a78ce9d5c9603070)

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2015-8607
Mingli Yu [Wed, 21 Sep 2016 09:47:32 +0000 (17:47 +0800)]
perl: fix CVE-2015-8607

Backport patch to fix CVE-2015-8607 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/0b6f93036de171c12ba95d415e264d9cf7f4e1fd

(From OE-Core rev: e2289647ace9ef96e6a7e4aae201fd9149e56678)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-6185
Mingli Yu [Wed, 21 Sep 2016 09:47:31 +0000 (17:47 +0800)]
perl: fix CVE-2016-6185

Backport patch to fix CVE-2016-6185 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7

(From OE-Core rev: 81e550d0c23c9842b85207cdfa73bbe9102e01fb)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: Correct perl path for ptest
He Zhe [Wed, 24 Aug 2016 07:08:16 +0000 (15:08 +0800)]
perl: Correct perl path for ptest

Substitute /usr/local with ${bindir}

(From OE-Core rev: bc372d65bc395290e1b7132908a3b943e1b73144)

Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl-native: backport libnm link fix
Ioan-Adrian Ratiu [Thu, 11 Aug 2016 13:49:15 +0000 (16:49 +0300)]
perl-native: backport libnm link fix

pre-5.25.0 perl by default tries to link to an antiquated libnm (new
math) which is not used anymore since the early 1990's. After 2014
another libnm appeared for NetworkManager causing build failures.

(From OE-Core rev: 97d2ba227044571408151f84cfe611e1a72dd816)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-2381
Kai Kang [Thu, 14 Jul 2016 08:53:08 +0000 (16:53 +0800)]
perl: fix CVE-2016-2381

Backport patch to fix CVE-2016-2381 from perl upstream:

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

(From OE-Core rev: 07ca8a0131f43e9cc2f720e1cdbcb7ba7c074886)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix several perl test failures
Bill Randle [Sat, 4 Jun 2016 22:45:03 +0000 (15:45 -0700)]
perl: fix several perl test failures

Several ExtUtils-MakeMaker tests fail when cross-compiled and run on
the target machine. Backport an upstream patch to fix the issues. Also
update the customized.dat hash file for the files modified by this patch
and other existing patches so the porting/customized.t test passes.

[YOCTO #8656]

(From OE-Core rev: bf1160a62d758b0148856482cb7b3f6fed63a0c2)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: some perl tests require libssp
Bill Randle [Sat, 4 Jun 2016 22:45:02 +0000 (15:45 -0700)]
perl: some perl tests require libssp

Add libssp to the list of dependencies when building with perl-ptest
as some tests require it.

[YOCTO #8656]

(From OE-Core rev: 9ea1d6474c5cd3546d1cad7c0f02a1ee8b3c76bb)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: set proper perl subversion number in config files
Bill Randle [Sat, 4 Jun 2016 22:45:01 +0000 (15:45 -0700)]
perl: set proper perl subversion number in config files

During the upgrade from Perl 5.22.0 to 5.22.1 in commit
f4c9908eae1ae3dcc38877abe2d5fbeb46851dd4 the config.sh file was hand edited
to change the subversion numbers. However, the edit was not entirely
correct. As a result the Perl version test failed. Set the correct
version strings.

[YOCTO #8656]

(From OE-Core rev: 6e06fec1ca71979e361d8a6e35ef4ec442e71881)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoqemu: Secuirty fix for CVE-2016-5403
Armin Kuster [Tue, 20 Sep 2016 03:01:16 +0000 (20:01 -0700)]
qemu: Secuirty fix for CVE-2016-5403

affects qemu < 2.7.0-rc0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix for CVE-2016-4002
Armin Kuster [Tue, 20 Sep 2016 02:56:19 +0000 (19:56 -0700)]
qemu: Security fix for CVE-2016-4002

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-6351
Armin Kuster [Tue, 20 Sep 2016 02:52:57 +0000 (19:52 -0700)]
qemu: Security fix CVE-2016-6351

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-4439
Armin Kuster [Tue, 20 Sep 2016 02:48:42 +0000 (19:48 -0700)]
qemu: Security fix CVE-2016-4439

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3712
Armin Kuster [Tue, 20 Sep 2016 01:12:42 +0000 (18:12 -0700)]
qemu: Security Fix CVE-2016-3712

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3710
Armin Kuster [Tue, 20 Sep 2016 01:02:55 +0000 (18:02 -0700)]
qemu: Security Fix CVE-2016-3710

affects Qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoutil-linux: Security fix for CVE-2016-5011
Armin Kuster [Tue, 20 Sep 2016 04:51:14 +0000 (21:51 -0700)]
util-linux: Security fix for CVE-2016-5011

affects util-linux < 2.28.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agodropbear: upgrade to 2016.72
Sona Sarmadi [Wed, 14 Sep 2016 12:34:38 +0000 (14:34 +0200)]
dropbear: upgrade to 2016.72

The upgrade addresses CVE-2016-3116:

- Validate X11 forwarding input. Could allow bypass of
  authorized_keys command= restrictions,
  found by github.com/tintinweb.
  Thanks for Damien Miller for a patch. CVE-2016-3116

References:
https://matt.ucc.asn.au/dropbear/CHANGES
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3116

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agowget: Security fix CVE-2016-4971
Armin Kuster [Sun, 18 Sep 2016 05:33:07 +0000 (22:33 -0700)]
wget: Security fix CVE-2016-4971

affects wget < 1.18.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2015-8325
Armin Kuster [Sun, 18 Sep 2016 04:12:07 +0000 (21:12 -0700)]
openssh: Security fix CVE-2015-8325

openssh <  7.2p2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-5615
Armin Kuster [Sun, 18 Sep 2016 04:09:43 +0000 (21:09 -0700)]
openssh: Security fix CVE-2016-5615

openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-6210
Armin Kuster [Sun, 18 Sep 2016 03:58:40 +0000 (20:58 -0700)]
openssh: Security fix CVE-2016-6210

affects openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agobusybox: Avoid race building libbb
Juro Bystricky [Wed, 14 Sep 2016 17:05:46 +0000 (10:05 -0700)]
busybox: Avoid race building libbb

When building busybox, an occasional error was observed.
The error is consistently the same:

libbb/appletlib.c:164:13: error: 'NUM_APPLETS' undeclared (first use in this function)
  while (i < NUM_APPLETS) {

The reason is the include file where NUM_APPLETS is defined is not yet generated (or is being modified)
at the time libbb/appletlib.c is compiled.
The attached patchset fixes the problem by assuring libb is compiled as the last directory.

[YOCTO#10116]

(From OE-Core rev: a866a05e2c7d090a77aa6e95339c93e3592703a6)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobusybox: fix "sed n (flushes pattern space, terminates early)" testcase failure
Dengke Du [Thu, 1 Sep 2016 09:42:10 +0000 (05:42 -0400)]
busybox: fix "sed n (flushes pattern space, terminates early)" testcase failure

It is a busybox upstream known bug. When the busybox sed sub-command 'n'
hit the files EOF, it print an extra character that have been printed, but
the GNU sed would not print it.

In busybox source code ../editors/sed.c
------------------------------------------------------------------------
    case 'n':
        if (!G.be_quiet)
                sed_puts(pattern_space, last_gets_char);
            if (next_line) {
                    free(pattern_space);
                    pattern_space = next_line;
                    last_gets_char = next_gets_char;
                    next_line = get_next_line(&next_gets_char, &last_puts_char, last_gets_char);
                    substituted = 0;
                    linenum++;
                    break;
            }
            /* fall through */

    /* Quit.  End of script, end of input. */
    case 'q':
        /* Exit the outer while loop */
            free(next_line);
            next_line = NULL;
            goto discard_commands;
------------------------------------------------------------------------
when read at the end of the file, the 'next_line' is null, it would go
"case 'q'" and goto discard_commands, the discard_commands would print
the old pattern space which have been printed.

So in order to comply with GNU sed, in case 'n', when the next_line is null
I add "else" at the end of the second "if": "goto again;" and send it to
the busybox upstream, the busybox maintainer adopt it and make a little
changes to the patch, we can see it at:

His reply:

http://lists.busybox.net/pipermail/busybox/2016-September/084613.html

The new patch on busybox master branch:

https://git.busybox.net/busybox/commit/?id=76d72376e0244a5cafd4880cdc623e37d86a75e4

(From OE-Core rev: 5a680c267454d7c135c4bfe4e551a780f38a5087)

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorpm: manually cleanup sysck
Jérémy Rosen [Wed, 7 Sep 2016 09:08:48 +0000 (11:08 +0200)]
rpm: manually cleanup sysck

version 5.4.1 of rpm was not properly distclean before release, which
causes problems when cross-compiling.

The previous version this recipe called make distclean, but that would
trigger a call to ./configure which would fail when no gcc is
available and make the whole do_configure fail further down the line

This patch manually removes the files from the recipe.

(From OE-Core rev: 6c9f61233f64356291a0c42761a833f3b151114c)

Signed-off-by: Jérémy Rosen <jeremy.rosen@smile.fr>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorpm: ensure rpm2cpio call rpm relocation code
Zhixiong Chi [Mon, 5 Sep 2016 04:08:13 +0000 (12:08 +0800)]
rpm: ensure rpm2cpio call rpm relocation code

We need to call rpmcliInit to ensure the rpm relocation code is called.
when we allow rpm2cpio to be relocatable, The adjusted path used to find
the macro files was being built into the binary and this path was valid
for the machine it was built on and some of our other build machines,
but invalid on some others, and was not being properly overridden at
runtime.

when we export the wrsdk and source the sdk, then execute rpm2cpio xxx.rpm|cpio -t.
we will get the following error :
"rpm-5.4.14/rpmdb/dbconfig.c:493:
db3New: Assertion `dbOpts != ((void *)0) && *dbOpts != '\0'' failed.

(From OE-Core rev: aea2bf5c8101ac0bb27776a5614be345835c4a03)

Signed-off-by: Zhixiong Chi <Zhixiong.Chi@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorpm: make --nosignature work
Robert Yang [Mon, 18 Jul 2016 03:32:41 +0000 (20:32 -0700)]
rpm: make --nosignature work

OE-core uses rpm's --nosignature, but it never worked:
self._invoke_smart('config --set rpm-check-signatures=false')

Now fix it with:
* Define SUPPORT_NOSIGNATURES to 1 in system.h
* !QVA_ISSET(qva->qva_flags, SIGNATURE) -> QVA_ISSET(qva->qva_flags, SIGNATURE),
  otherwise, when use --nosignature would read database and verify
  signature, this is not expected.

This can fix some race issues, for example, when more than one process
are querying rpm file with "rpm -qp --nosignature", they may hang up
because of race issues (the processes are trying to get RW/RD lock on
the database, but they shouldn't read the database at all since -qp and
--nosignature are used).

(From OE-Core rev: 038c09d6ab9581030efdc16aa1b96972970eeaab)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython-smartpm: use md5 as the digest for rpm_sys channel
Markus Lehtonen [Wed, 14 Sep 2016 08:46:06 +0000 (11:46 +0300)]
python-smartpm: use md5 as the digest for rpm_sys channel

Use md5 sum instead of mtime as the "digest" method for rpm_sys channel.
The digest is used to determine if the channel has been updated. It was
found out that mtime was not a reliable digest. On some systems mtime
of the rpm db does not get updated after every transaction if transactions
(smart install / remove commands) are fired in quick succession. As a
consequence smartpm cache and rpm db get out of sync.

[YOCTO #10244]

(From OE-Core rev: e7267b4e78461e71a1175f93e2eb5e90272c2b47)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython-smartpm_git.bb: Add patch for debugging random errors
Mariano Lopez [Wed, 3 Aug 2016 13:21:30 +0000 (13:21 +0000)]
python-smartpm_git.bb: Add patch for debugging random errors

This will add a patch to debug random errors seen in the
autobuilders, it won't solve the errors, but will give us
a better idea of what is happening.

[YOCTO #8383]

(From OE-Core rev: c52a7e910a3a52a7455a2409d9ade449bbbd66d4)

Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython-smartpm: add support to check signatures
mingli.yu@windriver.com [Wed, 20 Jul 2016 08:51:34 +0000 (16:51 +0800)]
python-smartpm: add support to check signatures

RPMv5 has removed support for _RPMVSF_NOSIGNATURES,
the flag can be replaced with a flags set:
"RPMVSF_NODSAHEADER|RPMVSF_NORSAHEADER|RPMVSF_NODSA
RPMVSF_NORSA"

(From OE-Core rev: 5c0c1b8a64643ad7130b17b5dfce9cecffa6d962)

Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython-smartpm: Avoid locale issue with bitbake python3
Richard Purdie [Thu, 19 May 2016 14:00:57 +0000 (15:00 +0100)]
python-smartpm: Avoid locale issue with bitbake python3

(From OE-Core rev: fa2ca7660e8f3279736624aa2493b4ca952ae466)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoxserver-xf86-config: pre-load int10 and exa modules
Khem Raj [Sat, 20 Aug 2016 20:36:09 +0000 (13:36 -0700)]
xserver-xf86-config: pre-load int10 and exa modules

musl doesn't like lazy loading that xorg uses, therefore
load the needed modules explicitly

[YOCTO #10169]

(From OE-Core rev: e279c9a30f0df400b06a47a487967a734854714b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoarch-mips.inc: Disable QEMU usermode usage when building with n32 ABI
Alexander Kanavin [Thu, 1 Sep 2016 17:50:54 +0000 (20:50 +0300)]
arch-mips.inc: Disable QEMU usermode usage when building with n32 ABI

QEMU usermode doesn't support n32 binaries, erroring with "Invalid
ELF image for this architecture".

(From OE-Core rev: 66aa39a959bd41f7063fe64a9225eb9fd6c3293b)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agogobject-introspection.bbclass: disable introspection for -native and -nativesdk recipes
Alexander Kanavin [Thu, 26 May 2016 14:00:47 +0000 (17:00 +0300)]
gobject-introspection.bbclass: disable introspection for -native and -nativesdk recipes

It is not necessary for those targets, adds to the build time, and pulls
in the unneeded qemu-native dependency.

(From OE-Core rev: be18364edd5cd2c664f68120063a1e147563faab)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocmake.bbclass: call cmake with a relative path
Thomas Witt [Mon, 22 Aug 2016 14:27:11 +0000 (16:27 +0200)]
cmake.bbclass: call cmake with a relative path

CMake wants a relative path for CMAKE_INSTALL_*DIR, an absolute path
breaks cross-compilation. This fact is documented in the following
ticket: https://cmake.org/Bug/view.php?id=14367

$sysconfdir and $localstatedir are not relative to $prefix, so they are
still set as absolute paths. With his change ${PROJECT}Targets.cmake
that are generated by cmakes "export" function will contain relative
paths instead of absolute ones.

(From OE-Core rev: c03b32bd71dbe04f2f239556fea0b53215e403d7)

Signed-off-by: Thomas Witt <Thomas.Witt@bmw.de>
Signed-off-by: Clemens Lang <clemens.lang@bmw-carit.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agouseradd_base: avoid unintended expansion for useradd parameters
Maxin B. John [Tue, 16 Aug 2016 11:12:03 +0000 (14:12 +0300)]
useradd_base: avoid unintended expansion for useradd parameters

Now, useradd dollar sign requires three prepending backslash characters to
avoid unintended expansion. It used to be just one prepending backslash
character before Krogoth. Restore that behaviour.

[YOCTO #10062]

(From OE-Core rev: 9e43a73c7ad576666d53c8c9e0283bc6bb9087a8)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocurl: security fix for CVE-2016-7141
Sona Sarmadi [Thu, 8 Sep 2016 13:33:50 +0000 (15:33 +0200)]
curl: security fix for CVE-2016-7141

Affected versions:
    Affected versions: libcurl 7.19.6 to and including 7.50.1
    Not affected versions: libcurl >= 7.50.2

Reference to upstream patch:
https://curl.haxx.se/CVE-2016-7141.patch

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agosudo: CVE-2015-8239
Sona Sarmadi [Tue, 9 Aug 2016 11:04:41 +0000 (13:04 +0200)]
sudo: CVE-2015-8239

Fixes race condition when checking digests in sudoers.

Reference:
http://seclists.org/oss-sec/2015/q4/327

Reference to upstream fixes:
https://www.sudo.ws/repos/sudo/raw-rev/397722cdd7ec
https://www.sudo.ws/repos/sudo/raw-rev/0cd3cc8fa195

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobinutils: advance SRCREV to obtain versioned symbols
Reinette Chatre [Mon, 5 Sep 2016 05:39:35 +0000 (22:39 -0700)]
binutils: advance SRCREV to obtain versioned symbols

Libraries needing versioned symbols, for example mysql, are not
supported by current version of binutils in krogoth.

When mysql library from MariaDB is compiled with the current
version of binutils we encounter errors at runtime as seen
below where php linked to mysql tries to run:

php: relocation error: php: symbol mysql_server_init, version
 libmysqlclient_16 not defined in file libmysqlclient.so.18
 with link time reference

Above error appears even though symbols exist in library:

   245: 000000000001ecc0     0 FUNC    GLOBAL DEFAULT   13 mysql_server_init@@libmysqlclient_16
   279: 000000000001ecc0   297 FUNC    GLOBAL DEFAULT   13 mysql_server_init@@libmysqlclient_18

The problem results from a bug in binutils that has already been
fixed upstream as well as on the 2.26 and 2.27 branches. We advance
the SRCREV on the 2.26 branch used in krogoth release to pick up the fix.

Details about bug: https://sourceware.org/bugzilla/show_bug.cgi?id=19698

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobase.bbclass wipe ${S} before unpacking source
Markus Lehtonen [Tue, 22 Mar 2016 16:47:00 +0000 (18:47 +0200)]
base.bbclass wipe ${S} before unpacking source

Make sure that we have a pristine source tree after do_unpack.

[YOCTO #9064]

(From OE-Core rev: eccae514b71394ffaed8fc45dea7942152a334a1)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobitbake.conf: set READELF for cross compilation
Jeremy Puhlman [Mon, 1 Aug 2016 16:02:55 +0000 (09:02 -0700)]
bitbake.conf: set READELF for cross compilation

In the case of using an external toolchain that supports multilib
compilation with a single binary, TARGET_PREFIX is the same for both main
and multilib abis. Without READELF exported, python3 assumes it is
either the readelf for ${BUILD_SYS}-readelf. Exporting cross readelf
fixes the build issue.

checking LDLIBRARY... libpython$(LDVERSION).so
checking for i586-montavistamllib32-linux-ranlib...
x86_64-montavista-linux-ranlib
checking for i586-montavistamllib32-linux-ar...
x86_64-montavista-linux-ar
checking for i586-montavistamllib32-linux-readelf... no
checking for readelf... readelf
configure: WARNING: using cross tools not prefixed with host triplet

(From OE-Core rev: 3442ee423813d547be7899a25ea31efe719e662f)

Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoFix random python backtrace in mutlilib handling code.
Jeremy Puhlman [Mon, 1 Aug 2016 16:02:54 +0000 (09:02 -0700)]
Fix random python backtrace in mutlilib handling code.

newval is not defined in all cases. Set to None and check if it is set.

  File
"/local/foo/builds/x86/layers/openembedded-core/meta/classes/multilib_global.bbclass",
line 90, in preferred_ml_updates(d=<bb.data_smart.DataSmart object at
0xf6fd528c>):
                 if not d.getVar(newname, False):
    >                d.setVar(newname, localdata.expand(newval))
             # Avoid future variable key expansion
UnboundLocalError: local variable 'newval' referenced before assignment

(From OE-Core rev: 25ebd3bbc1f9f4b1b6147d98dd43690c3bf03ee7)

Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocml1: fix tasks after default [dirs] changed
Ross Burton [Thu, 28 Jul 2016 19:37:04 +0000 (20:37 +0100)]
cml1: fix tasks after default [dirs] changed

These tasks relied upon [dirs] being ${B} by default.  As the functions are not
simple, add back [dirs] so they work again.

[ YOCTO #10027 ]

(From OE-Core rev: 614d976ee97d6386c37afb54add5b83741ca401e)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobitbake.conf/toolchain-scripts.bbclass: Remove debug prefix mappings in SDK
Jacob Kroon [Thu, 28 Jul 2016 10:56:06 +0000 (12:56 +0200)]
bitbake.conf/toolchain-scripts.bbclass: Remove debug prefix mappings in SDK

CFLAGS/CXXFLAGS in the SDK environment script adds debug-prefix mappings
that include staging area/work directories. Remove them since the SDK
shouldn't be aware of them.

(From OE-Core rev: 7918e73e9c5fe8c8c1c1d341eaa42f2f7d3ddb69)

Signed-off-by: Jacob Kroon <jacob.kroon@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agogdb: Cache gnu gettext config vars for musl builds
Khem Raj [Fri, 29 Jul 2016 22:28:01 +0000 (15:28 -0700)]
gdb: Cache gnu gettext config vars for musl builds

intl is used in gdb as well and we run the configure for
it when running do compile. So we need to insert these
caching of variables to extra oe_make

(From OE-Core rev: 60de4d6c717c6a5131b02de29234d53a6ca1b993)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoinitramfs-live-boot: Make sure we kill udev before switching root when live booting
Alejandro Hernandez [Tue, 26 Jul 2016 22:10:02 +0000 (22:10 +0000)]
initramfs-live-boot: Make sure we kill udev before switching root when live booting

When live booting, we need to make sure the running udev processes are killed
to avoid unexepected behavior, we do this just before switching root,
once we do, a new udev process will be spawned from init and will take care
of whatever work was still missing

[YOCTO #9520]

(From OE-Core rev: e88d9e56952414e6214804f9b450c7106d04318d)

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoe2fsprogs: Fix missing check for permission denied.
Jackie Huang [Wed, 10 Aug 2016 03:19:44 +0000 (11:19 +0800)]
e2fsprogs: Fix missing check for permission denied.

If the path to "ROOT_SYSCONFDIR /mke2fs.conf" has a permission denied problem,
then the get_dirlist() call will return EACCES. But the code in profile_init
will treat that as a fatal error and all executions will fail with:
      Couldn't init profile successfully (error: 13).

But the problem should not really be visible for the target package as the path
then will be "/etc/mke2fs.conf", and it is not likely that a user have no
permission to read /etc.

(From OE-Core rev: 9d7c32a88e0670a09e5e1097ff8bca58e9a7943f)

Fixup bb for Krogoth.

Signed-off-by: Jian Liu <jian.liu@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-5323
Yi Zhao [Wed, 10 Aug 2016 07:11:20 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5323

CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323
http://bugzilla.maptools.org/show_bug.cgi?id=2559

Patch from:
https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31

(From OE-Core rev: 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-5321
Yi Zhao [Wed, 10 Aug 2016 07:11:19 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5321

CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558

Patch from:
https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0

(From OE-Core rev: 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-3186
Yi Zhao [Wed, 10 Aug 2016 07:11:18 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-3186

CVE-2016-3186 libtiff: buffer overflow in the readextension function in
gif2tiff.c allows remote attackers to cause a denial of service via a
crafted GIF file

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

Patch from:
https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff

(From OE-Core rev: 3d818fc862b1d85252443fefa2222262542a10ae)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2015-8784
Armin Kuster [Wed, 10 Aug 2016 07:11:17 +0000 (15:11 +0800)]
tiff: Security fix CVE-2015-8784

CVE-2015-8784 libtiff: out-of-bound write in NeXTDecode()

External Reference:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8784

(From OE-Core rev: 36097da9679ab2ce3c4044cd8ed64e5577e3f63e)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2015-8781
Armin Kuster [Wed, 10 Aug 2016 07:11:16 +0000 (15:11 +0800)]
tiff: Security fix CVE-2015-8781

CVE-2015-8781 libtiff: out-of-bounds writes for invalid images

External Reference:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8781

(From OE-Core rev: 9e97ff5582fab9f157ecd970c7c3559265210131)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobusybox: Add parallel make fix
Richard Purdie [Fri, 19 Aug 2016 15:28:17 +0000 (16:28 +0100)]
busybox: Add parallel make fix

We're seeing regular parallel make failures in applet headers in busybox.
This adds a patch to try and avoid the issue, building upon a fix already
backported from upstream. The patch has been sent to upstream.

[YOCTO #10116]

(From OE-Core rev: 199cef0e8a50b20d0ee6fefd1d4cf3372eba7728)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobusybox: Backport makefile fix from upstream
Richard Purdie [Wed, 17 Aug 2016 11:54:27 +0000 (12:54 +0100)]
busybox: Backport makefile fix from upstream

This at least partially addresses one of the build races we've seen
on the autobuilder in busybox. Its a straightforward backport from
upstream.

(From OE-Core rev: 8599059164ad0eb908fd1177044af8bc9a9881e4)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobusybox: Fix busybox-init on non-tty consoles
Stefan Agner [Mon, 8 Aug 2016 05:47:28 +0000 (22:47 -0700)]
busybox: Fix busybox-init on non-tty consoles

When using non-tty consoles (e.g. VirtIO console /dev/hvc0) the
current init system fails with:
process '/sbin/getty 115200 hvc0' (pid 545) exited. Scheduling for restart.
can't open /dev/ttyhvc0: No such file or directory

The first field needs to be a valid device. The BusyBox inittab example
explains as follows:
"<id>: WARNING: This field has a non-traditional meaning for BusyBox init!

The id field is used by BusyBox init to specify the controlling tty for
the specified process to run on.  The contents of this field are
appended to "/dev/" and used as-is."

(From OE-Core rev: a53393082f331a613cb3eb973a07bab22cefcde8)

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agonpm: npm.bbclass now adds nodejs to RDEPENDS
Henry Bruce [Wed, 10 Aug 2016 23:26:37 +0000 (16:26 -0700)]
npm: npm.bbclass now adds nodejs to RDEPENDS

We expect that any package that uses the npm bbclass
will have a runtime dependency on node.js

(From OE-Core rev: 769fae0b74d7c7992aa593907f446fab98ef5128)

Signed-off-by: Henry Bruce <henry.bruce@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopulseaudio: fix crash when disconnecting bluetooth devices
Tanu Kaskinen [Wed, 3 Aug 2016 20:41:31 +0000 (23:41 +0300)]
pulseaudio: fix crash when disconnecting bluetooth devices

[YOCTO #10018]

Add a patch that makes the bluetooth code create the HSP/HFP card
profile only once. The old behaviour of creating the profile twice
was not compatible with 0001-card-add-pa_card_profile.ports.patch.

This fix is not needed for master, because master doesn't any more
have 0001-card-add-pa_card_profile.ports.patch.

Signed-off-by: Tanu Kaskinen <tanuk@iki.fi>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agosystemd: allow add users as a rootfs postprocess cmd
Stephano Cetola [Tue, 9 Aug 2016 11:48:36 +0000 (13:48 +0200)]
systemd: allow add users as a rootfs postprocess cmd

Adding all the users / groups to systemd is only available for readonly
file systems. This change allows users to add them to read / write file
systems as well by specifying:

ROOTFS_POSTPROCESS_COMMAND += "systemd_create_users"

Also, add "--shell /sbin/nologin" to each user's add params.

[ YOCTO #9497 ]

(From OE-Core rev: 98a4c642444a524f547f5d978a28814d20c12354)

Signed-off-by: Stephano Cetola <stephano.cetola@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 79be110c1fdfd0affe6a310b96e7107c4549d23c)
Signed-off-by: Kristian Amlie <kristian.amlie@mender.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agosystemd: Create missing sysusers offline
Khem Raj [Tue, 9 Aug 2016 11:48:35 +0000 (13:48 +0200)]
systemd: Create missing sysusers offline

Some system users which are needed by systemd components were missing
create these users knobbed with relevant packageconfig

(From OE-Core rev: d18957925c6c073b7194e3a233efea24e436f74e)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fd36a447d0da53e713d992b17ce86dd31ea63c67)
Signed-off-by: Kristian Amlie <kristian.amlie@mender.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agometa/classes: fix bb.build.FuncFailed typos
Jonathan Liu [Sun, 7 Aug 2016 08:38:45 +0000 (18:38 +1000)]
meta/classes: fix bb.build.FuncFailed typos

Signed-off-by: Jonathan Liu <net147@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython{3}-numpy: Predefine of sizeof off_t on mips/mipsel/ppc
Khem Raj [Fri, 8 Jul 2016 23:03:43 +0000 (16:03 -0700)]
python{3}-numpy: Predefine of sizeof off_t on mips/mipsel/ppc

Fixes below errors as seen on musl

| In file included from numpy/core/include/numpy/ndarraytypes.h:4:0,
|                  from numpy/core/include/numpy/ndarrayobject.h:18,
|                  from numpy/core/include/numpy/arrayobject.h:4,
|                  from numpy/core/src/multiarray/compiled_base.c:7:
| numpy/core/include/numpy/npy_common.h:167:10: error: #error Unsupported size for type off_t
|          #error Unsupported size for type off_t
|           ^~~~~
| In file included from numpy/core/include/numpy/ndarraytypes.h:4:0,
|                  from numpy/core/include/numpy/ndarrayobject.h:18,
|                  from numpy/core/include/numpy/arrayobject.h:4,
|                  from numpy/core/src/multiarray/compiled_base.c:7:
| numpy/core/include/numpy/npy_common.h:167:10: error: #error Unsupported size for type off_t
|          #error Unsupported size for type off_t
|           ^~~~~

(From OE-Core rev: 6d8cc72e7f83b9819ff1bbdb72ca61f98de403a4)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agogcc, qemuppc: Explicitly disable forcing SPE flags for 4.9
Pascal Bach [Fri, 15 Jul 2016 13:22:21 +0000 (15:22 +0200)]
gcc, qemuppc: Explicitly disable forcing SPE flags for 4.9

This ports the missing changes from commit: 7a51776a830167e43cbd185505f62f328704e271
from 5.3 to 4.9 so that qemuppc can be compiled.

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocurl: security fix for CVE-2016-5421
Maxin B. John [Mon, 22 Aug 2016 11:15:41 +0000 (14:15 +0300)]
curl: security fix for CVE-2016-5421

Affected versions: libcurl 7.32.0 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5420
Maxin B. John [Mon, 22 Aug 2016 11:15:40 +0000 (14:15 +0300)]
curl: security fix for CVE-2016-5420

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5419
Maxin B. John [Mon, 22 Aug 2016 11:15:39 +0000 (14:15 +0300)]
curl: security fix for CVE-2016-5419

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agopython3: update manifest RDEPENDS for importlib and compression packages
Derek Straka [Mon, 11 Jul 2016 18:05:22 +0000 (14:05 -0400)]
python3: update manifest RDEPENDS for importlib and compression packages

zipfile.py has dependencies on importlib, threading, and shell
importlib has a dependency on lang
operator and contextlib added to the lang package instead of falling into misc

Signed-off-by: Derek Straka <derek@asterius.io>
(cherry picked from commit 769ad8e114fda1fe112d3747408edbeb7b066a85)

8 years agopython-3.5-manifest: Add argparse module
Fabio Berton [Tue, 23 Aug 2016 21:23:59 +0000 (18:23 -0300)]
python-3.5-manifest: Add argparse module

Adding argparse module from Python's standard library. This allow use
argparse without installing all python-misc modules. For compatibility,
add python3-argparse as RDEPENDS to python3-misc.

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit f2b96001e074d26f5eb8711c2217a695fb02de4c)

8 years agopython-3.5-manifest: Rename Queue module to queue
Fabio Berton [Tue, 23 Aug 2016 11:48:42 +0000 (08:48 -0300)]
python-3.5-manifest: Rename Queue module to queue

The Queue module has been renamed to queue in Python 3.

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit e19a430da2ef60b2c6cf6a67210ec1a7b292c8ca)

8 years agopython3-native: Extend python3-native rproviders
Fabio Berton [Tue, 16 Aug 2016 18:47:29 +0000 (15:47 -0300)]
python3-native: Extend python3-native rproviders

Add the following modules to RPROVIDES:

  - python3-email-native
  - python3-io-native
  - python3-json-native
  - python3-lang-native
  - python3-misc-native
  - python3-netclient-native
  - python3-netserver-native
  - python3-numbers-native
  - python3-pkgutil-native
  - python3-pprint-native
  - python3-re-native
  - python3-shell-native
  - python3-subprocess-native
  - python3-threading-native
  - python3-unittest-native

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1a62ffd108e6aa7b7e5d0a81819550e8a7afeb60)

8 years agopython3-native: Change code style for rprovides
Fabio Berton [Tue, 16 Aug 2016 18:47:28 +0000 (15:47 -0300)]
python3-native: Change code style for rprovides

Use a more readable code style for RPROVIDES and sort recipes
alphabetically.

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 21130e2afc4762ad84c86e377146b99224d16032)

8 years agoyocto-uninative: Update to 1.0.1 tarball
Fabio Berton [Wed, 31 Aug 2016 12:30:29 +0000 (09:30 -0300)]
yocto-uninative: Update to 1.0.1 tarball

The 1.0.1 uninative tarball includes the change for GlibC to use the
host locale data, which is required for Python 3 to work properly.

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
8 years agomesa-demos: Fix OpenGL ES configurability
Tom Hochstein [Mon, 8 Aug 2016 15:45:16 +0000 (10:45 -0500)]
mesa-demos: Fix OpenGL ES configurability

The most recent patch 0011-drop-demos-dependant-on-obsolete-MESA_screen_surface.patch
incorrectly removed the configuration constructs that allowed the
package to be configured without OpenGL ES support.

Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agolzop: Fix build with gcc-6
Khem Raj [Thu, 25 Aug 2016 21:01:18 +0000 (14:01 -0700)]
lzop: Fix build with gcc-6

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>