selftest: uboot: remove duplicated KVM presence test
test_boot_uboot_kvm_to_full_target test, needs a working KVM.
It checked it with the kvm-ok tool but that tool is not documented as a
requirement. Also, the check is also done by runqemu called later in the
test.
Remove it from the test and let runqemu have the responsibility of
checking for KVM.
Note that the KVM check now happens *after* the image build instead of
before it.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 30 Jul 2026 07:12:46 +0000 (08:12 +0100)]
spirv-tools: Upgrade 1.4.350.1 -> 1.4.357.0
v2026.3 2026-07-08
- General
- Support SPV_QCOM_multiple_wait_queues, SPV_KHR_opacity_micromap, and SPV_EXT_ocp_microscaling_types (#6671, #6670, #6772)
- Add ArmExperimentalMLOperations and NonSemantic.Graph.DebugInfo instruction sets (#6692, #6666)
- Fix unbounded memory usage in FriendlyNameMapper (#6763)
- Improved hex-float compilation and float equality testing (#6778, #6783)
- Various build system and dependency updates (Bazel, GN, Protobuf, Abseil)
- Optimizer
- Stability fixes for DeadBranchElimPass, CodeSinkingPass, and OrderBlocks (#6764, #6703, #6676)
- Improved handling of tensor constants, non-semantic instructions, and loop decorations (#6684, #6721, #6719, #6690)
- Add folding rule for extract from copy logical and prevent word limit overflows (#6725, #6722)
- Validator
- Support SPV_EXT_ocp_microscaling_types, SPV_EXT_split_barrier, and SPV_ARM_graph (#6779, #6732, #6694)
- Support for SPV_NV_cooperative_matrix_decode_vector and Intel extensions (#6693, #6717, #6665)
- Enhanced error reporting with source line printing and Shader Debug Info (#6648, #6698, #6691, #6686, #6685, #6681)
- Correctness fixes for ray queries, descriptors, OpSpecConstantOp, and array validation (#6710, #6729, #6731, #6777, #6709)
- Disallow duplicate targets for OpGroupDecorate and multiple graph entry points (#6720, #6754)
- Assembler/Disassembler
- Support for SPV_QCOM_image_processing3 (#6776)
- Performance and correctness improvements in the disassembler and tools (#6757, #6650)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:21:51 +0000 (06:21 +0000)]
vulkan-headers: upgrade 1.4.350.1 -> 1.4.357.0
e3b1eec Update for Vulkan-Docs 1.4.357 8d6039a Update for Vulkan-Docs 1.4.356 8c26833 Change to dual license on static Vulkan headers d2d8ded Add new C header 6433e5c Update for Vulkan-Docs 1.4.355 0307c70 build(deps): bump actions/checkout from 6 to 7 01393c3 Update for Vulkan-Docs 1.4.354 45834b7 Update for Vulkan-Docs 1.4.353 015e25c Update for Vulkan-Docs 1.4.352 8cfaaa1 chore: Upgrade reuse to 3.3 0e9de56 Update for Vulkan-Docs 1.4.351 7f233bc Fix incorrect header on AI-Assisted Contributions bc927f3 Add AI-Assisted Contributions and CLA section
License-Update: Some headers are now dual license, one is still MIT
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:43:28 +0000 (06:43 +0000)]
vulkan-volk: upgrade 1.4.350.1 -> 1.4.357.0
7768933 Merge pull request #303 from zeux/update/357 11f5a1b Update generated source with the new exclusion rules 1bb1f65 Update extension version filtering mechanism to be more generic 94d905c Update to 1.4.357 3b00554 Merge pull request #302 from zeux/update/356 f5e6b44 Update to 1.4.356 91e0d29 Merge pull request #301 from zeux/update/355 2ad9fb2 Update to 1.4.355 477a354 Merge pull request #300 from zeux/update/354 e2e6d51 Update to 1.4.354 9aa85bf Merge pull request #299 from zeux/update/353 6a8a2d5 Update to 1.4.353 47cddf7 Merge pull request #298 from zeux/update/352 40a3321 Update to 1.4.352 916c68b Merge pull request #297 from zeux/update/351 44a84ca Update to 1.4.351
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:14:19 +0000 (06:14 +0000)]
glslang: upgrade 1.4.350.1 -> 1.4.357.0
* Add support for GL_EXT_opacity_micromap_ray_query_mode
* Implement `GLSL_EXT_structured_descriptor_heap` with SPIR-V layout generation, heap offset access, buffer references, matrix layout decorations, and correct `readonly`/`writeonly` qualifier propagation for buffer and image descriptors
* Fix descriptor heap-bound buffer access to use typed pointers
* Omit `NonUniform` decoration when using descriptor heaps, as the SPIR-V spec does not require it
* Add `--relax-set-binding-limits` option to allow large `layout(set)` and `layout(binding)` values for descriptor heap-style workflows with sparse set spaces
* Reject combined image samplers with `descriptor_heap`
* Fix `GL_KHR_compute_shader_derivatives` regressions on shaders using the `GL_NV` variant
* Update compute shader derivative rules to allow texture operations with implicit derivatives without extensions, falling back to LoD 0
* Implement `GL_EXT_ocp_microscaling_types`
* Implement `GL_NV_cooperative_matrix_decode_vector`
* Add basic support for `GL_NV_desktop_lowp_mediump`
* Implement `GL_EXT_opacity_micromap_ray_query_mode`
* Fix generated decoration string from `UTF8EncodingKHR` to `UTFEncodingKHR`
* Fix missing SPIR-V extension emission for `float16` derivative functions with `SPV_AMD_gpu_shader_half_float`
* Apply `NoContraction` decoration to `dot()` when `noContraction` is set
* Fix `OpStore` of buffer device address pointer to use 8-byte alignment, consistent with loads
* Fix `RayTracingOpacityMicromapKHR` capability emission to only occur when `gl_RayFlagsForceOpacityMicromap2StateEXT` is actually used, fixing SPIR-V validation failures in ray query shaders outside ray-tracing pipeline stages
* Fix `setInvertY()` to apply Y-inversion to GLSL vertex, geometry, and tessellation-evaluation shaders (previously only affected HLSL)
* Fix `.length()` on arrays of long/cooperative vectors to use `OpArrayLength` instead of a constant component count
* Fix unnecessary cooperative matrix conversions when creating arrays of KHR cooperative matrices
* Add error for cooperative matrix `*=` with bf16/fp8 scalar operands
* Fix out-of-bounds access in `elseSeen` at maximum `#if`/`#ifdef` nesting depth
* Fix out-of-bounds read on empty struct texture template types
* Fix crash in `layoutObjectCheck` when accessing members of an empty block
* Emit an error when HLSL [numthreads] is given more than three arguments instead of crashing the compiler.
* Emit error when attempting to convert a literal string to an incompatible type
* Fix `abortKHR` to preserve the original user-defined string without modification
* Fix out-of-bounds indexing in `TDefaultIoResolverBase::addStage` when a negative `EShLanguage` value is passed
* Add `--discard-is-terminate` option to emit `OpTerminateInvocation` instead of `OpDemoteToHelperInvocation` for GLSL `discard` when tar
[Changelog truncated]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/devtool: cover srcrev update mode guessing for gitsm://
Add test_devtool_update_recipe_gitsm: devtool modify the
git-submodule-test recipe, move the source tree to the parent of the
pinned revision (an upstream commit, no local changes) while staying on
the devtool branch, sync the submodules to it with 'git submodule
update', run 'devtool update-recipe' in the default auto mode, and
assert the recipe's SRCREV is updated to the checked-out revision.
Without the preceding fix the mode guesser cannot see gitsm:// URIs,
falls into patch mode, reports "No patches or files need updating" and
leaves the recipe untouched, and this test fails with:
The 'git submodule update' step matters: the pinned revision of
git-submodule-test happens to bump a gitlink, so after checking out its
parent the submodule no longer matches the revision the parent records,
and the guesser deliberately stays in patch mode for such trees.
The other direction of the guess — local commits inside a submodule
must keep patch mode, because they leave the parent HEAD on the
upstream branch while a srcrev update would silently drop them — is
already covered by the vulkan-samples based test_devtool_git_submodules,
which is what caught exactly that regression in v1 of this series on
the autobuilder, so no test is added for it.
No existing test exercises the auto->srcrev guess for any URI scheme:
the auto-mode arm of test_devtool_update_recipe_git covers the
local-commits->patch direction only.
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: standard: guess srcrev update mode for gitsm:// recipes too
'devtool update-recipe' and 'devtool finish' default to guessing the
recipe update mode: 'srcrev' when the source tree HEAD sits on the
upstream branch (the "checked out another upstream revision" workflow),
'patch' otherwise. The guesser matches SRC_URI entries against a
literal 'git://' prefix, so a gitsm:// recipe never has any git URIs
from its point of view and always falls into patch mode.
In that case there are no local commits to export either, so checking
out a different upstream revision and running update-recipe reports
"No patches or files need updating" and silently leaves the recipe's
SRCREV untouched, while the same operation on a git:// recipe updates
SRCREV. Forcing -m srcrev works, since _update_recipe_srcrev() is
scheme-agnostic; only the guess is broken.
Accept gitsm:// URIs the same way e7076f1742 ("devtool: gitsm://
should be handled same as git:// in upgrades") did for the upgrade
path, where the same omission was fixed; the guesser itself dates from 9b9733b7d7 (2015), before gitsm handling was a consideration.
Unlike git://, a gitsm:// tree can carry exportable changes that do
not move the parent HEAD off the upstream branch: local commits in a
submodule only show up as an out-of-sync gitlink in the parent.
Guessing srcrev there would silently drop them, because
_update_recipe_srcrev() only rewrites the parent SRCREV — this is
exactly the scenario test_devtool_git_submodules exercises (commit
inside a submodule, then devtool finish), which caught v1 of this
patch on the autobuilder. So only guess srcrev when every submodule
checkout matches the revision its parent records: any '+' (checkout
differs) or 'U' (merge conflicts) entry in 'git submodule status
--recursive' output keeps the current patch mode. This also covers a
tree where another parent revision was checked out without a
following 'git submodule update': srcrev must never be guessed when
it could lose submodule content, and a fully synced tree is the only
state where it provably cannot.
Note this changes the guessed mode for existing gitsm:// recipes from
'patch' to 'srcrev' when HEAD is on the upstream branch and the
submodules are in sync — the behavior git:// recipes have had since
2015. Trees carrying local commits still guess 'patch', because their
HEAD is not reachable from the upstream branch.
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Igor Opaniuk [Fri, 24 Jul 2026 13:15:37 +0000 (15:15 +0200)]
libzip: import recipe from meta-oe
Recent versions of the qdl tool [1], used for flashing and provisioning
Qualcomm-based boards, depend on libzip in order to flash images
directly from zip-compressed flat builds without unpacking them: the
device requests individual images on demand (in Sahara/Firehose
device-driven order), which requires random access to archive members
by name. Neither zlib (byte-stream compression only, no container
format support) nor libarchive (streaming, sequential access only)
covers this use case.
qdl recipes are provided by the Qualcomm BSP layer (e.g. meta-qcom [2])
and board flashing is core BSP functionality. Recipes from other layers
also depend on libzip (libsigrok, idevicerestore and php in meta-oe,
localsearch in meta-gnome), so it makes sense to move libzip to
OE-Core in order to reduce inter-layer dependencies, following the
example of commit 1a0196a794 ("libconfig: import recipe from meta-oe").
Changes between meta-oe and this recipe:
- Added SUMMARY, BUGTRACKER and SECTION
- Fixed the tools and examples PACKAGECONFIGs to use the actual
BUILD_TOOLS and BUILD_EXAMPLES CMake options (ENABLE_TOOLS and
ENABLE_EXAMPLES do not exist and were silently ignored)
- Fixed the tests PACKAGECONFIG to use BUILD_REGRESS consistently
- Dropped the mbedtls PACKAGECONFIG, as mbedtls is not in OE-Core
- Extended BBCLASSEXTEND with nativesdk
Richard Purdie [Wed, 29 Jul 2026 05:59:09 +0000 (05:59 +0000)]
python3-vcs-versioning: upgrade 2.2.2 -> 2.2.3
- Fix `ValueError` when parsing `.git_archival.txt` of a tagged commit whose tag
contains more than one dash (e.g. `llvmorg-23.1.0-rc2`) - the `git describe`
suffix is now matched precisely instead of splitting on the last two dashes.
([#1481](https://github.com/pypa/setuptools-scm/issues/1481))
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 07:24:20 +0000 (07:24 +0000)]
libmicrohttpd: upgrade 1.0.6 -> 1.0.8
Source: ChangeLog
Tue Jul 28 06:12:03 PM CEST 2026
Fixing additional vulnerabilities inspired by reviewing the
code for similar issues like the ones reported by A. Ramos;
expand the test suite to cover these and other issues.
Releasing GNU libmicrohttpd 1.0.8. -CG
Mon Jul 27 06:12:03 PM CEST 2026
Fixing various vulnerabilities reported by A. Ramos resulting
in possible crashes or out-of-bounds stack writes for certain
requests in specific configurations.
Releasing GNU libmicrohttpd 1.0.7. -CG
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Markus Volk [Sat, 25 Jul 2026 08:46:07 +0000 (10:46 +0200)]
appstream: update 1.1.3 -> 1.1.5
- add wayland dependency to fix:
| Run-time dependency wayland-client found: NO (tried pkg-config and cmake)
|
| ../sources/AppStream-1.1.5/meson.build:210:25: ERROR: Dependency "wayland-client" not found (tried pkg-config and cmake)
- add it conditionally to allow builds without wayland
Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libarchive: fix ptest failure when built without crypto library
test_read_format_zip_ppmd8_aes256_streaming (added in 3.8.9) fails
with 6 assertion failures because it attempts to decrypt an AES256
encrypted zipx file without first checking if a crypto library is
available. The default PACKAGECONFIG does not include openssl/nettle/mbedtls.
Add a patch to skip the test when no crypto library is present, using
the same guard as other encrypted zip tests in the same file.
Currently, Makefile.PL-built Perl recipes (cpan.bbclass) exclude
.packlist files with NO_PACKLIST=1, but Build.PL recipes
(cpan_build.bbclass) do not. This now results in a QA error due to the
TMPDIR paths included in the .packlist file.
ERROR: x do_package_qa: QA Issue: File [...]/.packlist in package x
contains reference to TMPDIR [buildpaths]
A similar error is produced by generated html doc.
Here we add the corresponding Build.PL arg to disable packlists and html
doc.
Signed-off-by: Wes Malone <wes@mitsi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 28 Jul 2026 15:22:04 +0000 (16:22 +0100)]
pseudo: Update to 1.9.10
Pulls in various important fixes:
Makefile.in: Bump to 1.9.10
test: various: Move to makefile compilation
test-bash-exec-env: Add bash env test case
test/test-openat2-func.c: Remove unusuaed saved_errno
pseudo_util.c: strchr now returns const char
pseudo_client: remove the unused pseudo_prefix_dir_fd
pseudo_client: step around all of pseudo's own fds in closefrom
pseudo_client: step fully past pseudo's own fds when computing startfd
makewrappers: Avoid efault workaround if using AT_EMPTY_PATH
ports/linux/guts: Add __open64_2 wrapper
Makefile.in: Bump to 1.9.9
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
New Features:
- New assembler option: --reloc-section-sym=[all|internal|none] to control
whether relocations referencing local binding symbols use section symbols.
- RISC-V: support for zalasr, svrsw60t59b, zvabd, smpmpmt, zvqwdota8i,
zvqwdota16i, zvfwdota16bf, zvfqwdota8f, zvqwbdota8i, zvqwbdota16i,
zvfwbdota16bf, zvfqwbdota8f, zvfbdota32f, xsmtvdot, xsmtvdotii extensions.
- AArch64 disassembler: "-M annotate" option for undefined instruction symbols.
- x86/x86_64 disassembler: "-M annotate-immediates" option.
- Objdump/readelf: --debug-dir=<DIR> for separate debug info files.
- Objdump: --map-global-vars to display global variable locations and types.
- Linker: -O 0 optimization level to skip merging mergeable sections.
- Linker: --start-lib/--end-lib and LIB linker script statement support.
- Linker: archives with no symbol index support in all formats.
- Note: 32-bit s390 target support deprecated (s390x still works).
* System-wide tunables can be applied using /etc/tunables.conf and
running ldconfig.
* New glibc.elf.thp tunable to map read-only segments with Transparent
Huge Pages; THP page size in malloc is now capped to MAX_THP_PAGESIZE.
* Additional correctly rounded math functions (cosh, sinh, tanh) imported
from the CORE-MATH project.
* Static PIE is now supported for arm-*-linux-gnueabi.
* On AArch64, all GCS operations are locked after enabling GCS with an
ENFORCED or OVERRIDE policy, and more SVE/AdvSIMD special cases are
vectorized.
* On RISC-V, vector extension optimized variants of memcmp, memcpy,
memmove, strcmp, strcpy, strlen and others have been added.
* On PowerPC, memchr optimized for Power10 has been re-added.
* Support for LoongArch32 has been added.
* Pre-built ld.so.cache files can be installed with ldconfig.
* New locale hrx_BR (Hunsrik as spoken in Brazil).
Upstream changes affecting compatibility:
* The --enable-memory-tagging configure option, and the AArch64 specific
functionality it gated, have been removed. Drop the corresponding
memory-tagging PACKAGECONFIG, it would now be an unrecognized option.
* The --enable-static-nss configure option has been removed, it was not
used here.
* The s390-linux-gnu (31bit) configuration is no longer supported.
Recipe metadata changes:
* Change 0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-SDK.patch,
it is adjusted for open_path() now sizing its candidate
path buffer via dl_scratch_buffer instead of alloca. The pre-pass that
computes the real max_dirnamelen is kept ahead of that allocation, so
print_search_path()'s new buffer precondition stays satisfied too.
* Drop 0023-CVE-2026-5450.patch and CVE_STATUS_STABLE_BACKPORTS, already
in 2.44
* Drop the PR/HASHEQUIV_HASH_VERSION bump as its comment instructs.
glibc 2.44 declares the POSIX 2024 name posix_spawn_file_actions_addchdir in
<spawn.h> as an asm level alias of the long standing
posix_spawn_file_actions_addchdir_np [1]:
extern int __REDIRECT_NTH (posix_spawn_file_actions_addchdir,
(posix_spawn_file_actions_t *, const char *),
posix_spawn_file_actions_addchdir_np);
There is no symbol exported under the standard name though. gnulib probes for the
function with AC_CHECK_FUNCS, which does not include <spawn.h>, so it does not
see the alias and concludes the function is missing. gnulib then compiles its
own lib/spawn_faction_addchdir.c, but the header attaches the asm name
posix_spawn_file_actions_addchdir_np to that identifier, as a result the
*definition* is emitted under the _np name while its body does
i.e. it calls itself (INFINITE LOOP). It overrides the real
glibc symbol for the whole program:
0000000000000000 <posix_spawn_file_actions_addchdir_np>:
0: eb fe jmp 0 <posix_spawn_file_actions_addchdir_np>
tests/test-execute.sh case 21 therefore spins there forever. Because gnulib's
execute() blocks the fatal signals before spawning, the hung process also
ignores SIGTERM and ptest-runner has to SIGKILL it.
m4 cannot be autoreconf'd (m4-native sets INHIBIT_AUTOTOOLS_DEPS and overrides
do_configure, as autoreconf needs m4), so fix the probe result directly:
reached through <spawn.h> the function really is available. gnulib then takes
its REPLACE_ code path, which names the definition rpl_* so that it no longer
collides with the glibc symbol it forwards to:
rust: refactor source handling into a shared work-shared recipe
[YOCTO #15808]
Consolidate Rust source management across all Rust recipes (rust, cargo,
libstd-rs and their native/nativesdk variants) into a single shared
source tree using the work-shared pattern.
Disk savings: a world build with multilibs enabled, together with
nativesdk-rust and nativesdk-cargo, now shares a single ~4.2 GB rustc-src
tree instead of maintaining up to 11 independent copies (~46.2 GB total).
- rust-source_1.96.1.bb: A shared recipe that fetches, unpacks, and patches
the rustc source tree into ${TMPDIR}/work-shared/rust-source-${PV}-${PR}.
All build/install/packaging tasks are disabled; this recipe exists solely
to provide a single copy of the source. Inherits allarch/nopackages,
excludes itself from rm_work, and is hidden from world builds.
Also defines RUST_BUILD_ARCH locally since this recipe does not inherit
rust-common.bbclass but still needs the mapping for snapshot fetching
via rust-snapshot.inc.
- common-source.inc: Included by consumer recipes (rust, cargo, libstd-rs)
to disable their local do_fetch/do_unpack/do_patch tasks, clear SRC_URI,
and add task dependencies on rust-source-${PV} for configure, licensing,
and SPDX generation. Also provides is_work_shared_spdx() override for
correct SPDX shared-workdir detection.
Modified files:
- rust-source.inc:
- Set UNPACKDIR to the work-shared location so all consumers share one
source tree via RUSTSRC and S.
- rust_1.96.1.bb:
- Add 'require common-source.inc' to use the shared source tree.
- Set B = ${WORKDIR}/build to separate build artifacts from shared source.
- Set CARGO_HOME = ${WORKDIR}/cargo_home to isolate cargo caching.
- Set build-dir = "rust-build" in config.toml to distinguish Yocto's build
directory (B), which holds config.toml, from the bootstrap's own build
output directory. Without this, bootstrap defaults to "build/" inside B,
creating an ambiguous build/build/ nesting.
- Use absolute ${S}/src/bootstrap/bootstrap.py path since cwd is now B.
- Update install functions to reference rust-build/ instead of build/.
- Update do_test_compile to use absolute ${S}/src/tools/ path.
- Change do_rust_setup_snapshot from 'after do_unpack' to depend on
rust-source-${PV}:do_unpack (since local do_unpack is removed).
- cargo_1.96.1.bb:
- Add 'require common-source.inc' to use the shared source tree.
- Change do_cargo_setup_snapshot from 'after do_unpack' to depend on
rust-source-${PV}:do_unpack.
- libstd-rs_1.96.1.bb:
- Add 'require common-source.inc' to use the shared source tree.
- rust-common.bbclass:
- Add a second --remap-path-prefix for ${TMPDIR}/work-shared so debug
info from the shared source tree is correctly remapped.
- Retain RUST_BUILD_ARCH definition so that consumer recipes (rust, cargo,
libstd-rs) which inherit this class can resolve snapshot directory names
used by do_rust_setup_snapshot and do_cargo_setup_snapshot.
- lib/oeqa/selftest/cases/rust.py:
- Adapt the selftest to the build-dir/source-dir split: use B for build
artifacts and RUSTSRC for source paths.
- Update remote-test-server copy path from build/ to rust-build/.
- Pass --build-dir and --config explicitly to bootstrap.py.
- conf/distro/include/maintainers.inc:
- Add maintainer entry for the new rust-source recipe.
License-Update: recipe file renames only, no license change
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libarchive: ptest: run tests from tmpfs to avoid inode overflow failures
The bsdcpio_test odc/newc format tests verify archive headers byte-by-byte
including inode and device numbers. On ext4 root filesystems (particularly
qemuarm64 and qemuriscv64) inode numbers can exceed the odc 6-octal-digit
or newc 8-hex-digit field widths, causing intermittent assertion failures
in test_format_newc and test_option_c.
Set TMPDIR to a tmpfs mount so the test framework creates its working
directories there, where inode numbers always start small.
randtest performs autocorrelation analysis on random number sequences
and fails intermittently on overloaded CI/autobuilder systems where
CPU scheduling and floating point conditions vary between runs.
An upstream fix was previously merged (ccabae3036a7) to improve sigma
threshold handling, but the test failed again on qemux86-64-musl-ptest
on 2026-07-21 with 'Tau= 162, Autocorr= 5.15181 sigma'.
The test is inherently unsuitable for shared overloaded build
infrastructure. Skip it, consistent with how 'time' and 'timeout'
are already handled.
[YOCTO #16254]
Signed-off-by: Himani Barde <HimaniRamesh.Barde@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adapted from an existing patch:
https://patchwork.yoctoproject.org/project/oe-core/patch/20220606132653.60232-5-brgl@bgdev.pl
Update the recipe to track the latest upstream release of the official
GStreamer Rust plugins.
Remove the `flavors` and `ffv1` plugins from local manifest file because
they depend on packages that are not published on crates.io and also they
are not actively maintained in the gst-plugins-rs upstream anyway.
Skip the recipe if building for x86 without SSE support.
Unlike the other GStreamer submodules, the Rust plugins follow a
separate release cycle and versioning scheme. These plugins are fully
stable and required for a fully-featured GStreamer installation, as most
new features and plugins are being written in Rust. They are also shipped
by multiple Linux distributions such as Fedora.
Based on patch by: Bartosz Golaszewski <brgl@bgdev.pl>
ncurses: put symlinks to basic terminfo files in ncurses-terminfo-base package
With only the ncurses-terminfo-base package installed (i.e. not the
full ncurses-terminfo), systemd prints
Terminfo xterm-256color not found for /dev/console
That is despite 'xterm-256color' being one of those basic terminfo
files that are manually split off and into the terminfo-base package,
and placed under /etc/terminfo/. The reason is that systemd only looks
in /usr/share/terminfo (see their have_terminfo_file() in
src/basic/terminal-util.c).
Make sure that applications that only look in /usr/share/terminfo do
find the basic terminfo files by packaging the symlinks along with the
pointed-to files.
Richard Purdie [Mon, 27 Jul 2026 10:55:47 +0000 (11:55 +0100)]
sstate: Update unpack touch code to be consistent
When we unpack sstate files, we want to update the mtime+atime of the sstate
object and any sig/siginfo files, both for the files themselves and symlinks.
The logic was getting a bit hard to follow and wasn't entirely consistent with
only a time in some cases.
Clean it up and be consistent for all the files.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Mon, 27 Jul 2026 10:49:29 +0000 (11:49 +0100)]
sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes()
If we touch sstatefile, we should also touch any .sig/.siginfo file if we can.
We try and keep them both updated with accesses so one isn't removed without
the other and they stay consistent.
[YOCTO #15289]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Esa Jaaskela [Sun, 26 Jul 2026 19:24:41 +0000 (22:24 +0300)]
volatile-binds: order systemd-timesyncd after /var/lib
systemd-timesyncd stores its clock file under /var/lib/systemd/timesync,
so it can fail to save state if it starts before the volatile /var/lib
is mounted. Add it to the Before= and WantedBy= entries already used for
systemd-random-seed.service.
Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 13:55:14 +0000 (14:55 +0100)]
wget: enable libpsl in target builds
The Public Suffix List[1] is a list of domains that people can register
domains under, for example ".com" or ".co.uk". This is useful because
it means browsers and other HTTP using tools can prevent malicious
web sites from setting privacy-damaging "supercookies".
In the interest of being more secure out of the box, enable libpsl in
builds of wget (note that we never build wget-native, as it is provided
by the host).
[1] https://publicsuffix.org
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 13:55:13 +0000 (14:55 +0100)]
curl: enable libpsl in target builds
The Public Suffix List[1] is a list of domains that people can register
domains under, for example ".com" or ".co.uk". This is useful because
it means browsers and other HTTP using tools can prevent malicious
web sites from setting privacy-damaging "supercookies".
In the interest of being more secure out of the box, enable libpsl in
target builds of curl.
[1] https://publicsuffix.org
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libpsl: Fix meson configure failure when docs are enabled
libpsl 0.23.0 ships docs/libpsl/meson.build referencing an undefined
"cdata" configuration object; the top-level meson.build only defines
"_cdata". meson shares scope across subdir(), so with docs enabled (which
OE does via gtk-doc) do_configure fails:
libpsl: Do not embed the build path in suffixes_dafsa.h
The generated src/suffixes_dafsa.h records the public suffix list it was
built from in _psl_filename[]. meson feeds psl-make-dafsa an absolute
input path, so the full build directory gets baked into the header and,
through it, into the library and its -src/-dbg packages. On an
autobuilder whose build tree lives under $HOME/TMPDIR this trips the
buildpaths QA check with references to both TMPDIR and the build host
HOME directory, and it makes the build non-reproducible.
The absolute path is useless on the target: it is only consumed by
psl_builtin_outdated() to stat() the source list, which never exists on
the running system. psl_builtin_filename() is documented to return "the
file name", so embed only the basename.
Fixes
ERROR: libpsl-0.23.0-r0 do_package_qa: QA Issue: File /usr/src/debug/libpsl/0.23.0/src/suffixes_dafsa.h in package libpsl-src contains reference to TMPDIR [buildpaths]
ERROR: libpsl-0.23.0-r0 do_package_qa: QA Issue: File /usr/src/debug/libpsl/0.23.0/src/suffixes_dafsa.h in package libpsl-src contains a reference to the build host HOME directory. If upstream hardcodes a directory path that matches your home, you can set OEQA_BUILDPATHS_SKIP = "/srv/pokybuild" in the recipe. [buildpaths]
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- inherit meson instead of autotools; drop gettext (the meson build has
no i18n)
- Map the PACKAGECONFIG knobs to meson options: --enable-runtime=X
becomes -Druntime=X, and builtin PSL data stays enabled via meson's
default (-Dbuiltin=true), matching the previous --enable-builtin.
- Disable the bundled tests and fuzzers with -Dtests=false.
- The gtk-doc class drives -Ddocs on its own via GTKDOC_MESON_OPTION.
Unlike the autotools tarball, meson regenerates psl.1 at build time and
stamps it with `date +%B %Y`, which is not reproducible. Backport the
proposed upstream fix to honour SOURCE_DATE_EPOCH.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CERT-PL record for CVE-2026-42250 carries bzip2:bzip2 in its
affected entry [1], which the bzip:bzip2 pin does not cover, so tools
consuming CNA identities cannot connect the in-tree
CVE-2026-42250.patch to the CVE. NVD has not analysed the entry yet
and currently mirrors the same bzip2:bzip2 identity.
Peter Marko [Tue, 21 Jul 2026 19:00:04 +0000 (21:00 +0200)]
libinput: set status for CVE-2026-35094
This CVE is fixed in 1.31.1 per [1]
It is present in CVE reports as open because it's RedHat version-less.
This was originally patched and CVE patch was removed during upgrade
1.30.2 -> 1.31.3 because the patch was integrated in that release.
Peter Marko [Tue, 21 Jul 2026 19:00:03 +0000 (21:00 +0200)]
connman: remove connection_manager from CVE_PRODUCTS
The only CVE with this product/cpr is CVE-2013-10036 which is for
different connection manager and is showing up as false positive in CVE
reports with current sbom-cve-check tooling.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ivan Nestlerode [Tue, 21 Jul 2026 20:37:06 +0000 (16:37 -0400)]
mpg123: fix lack of NEON usage on aarch64
Fixes [YOCTO #16359]
mpg123 supports specific --with-cpu= configure options to use NEON
instructions, but this recipe was not using any of these on aarch64.
The problem is that it was only keying off of whether TUNE_FEATURES
contains "neon". aarch64 never puts "neon" into TUNE_FEATURES so it
has to be checked separately.
Use --with-cpu=neon64 on aarch64.
Signed-off-by: Ivan Nestlerode <ivan.nestlerode@sonos.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 19:37:44 +0000 (20:37 +0100)]
libgit2: remove library paths from installed .cmake
The libgit2 cmake rules generate a .cmake file that tells people linking
to libgit2 how to link. This includes the complete path to each of the
libraries that libgit2 links, such as /path/to/sysroot/usr/lib/libssl.so.
The build paths were previously removed with a quick sed, but this breaks
builds where those target paths exist on the build host as they get used
verbatim.
However, all of this linkage is redundant as the library directly links
to these libraries. Mark the linkage as private, so the references do
not appear in the .cmake files.
[ YOCTO #16373 ]
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Jansa [Thu, 23 Jul 2026 09:25:43 +0000 (11:25 +0200)]
glib-networking: clarify the LICENSE
As suggested by Joshua:
https://lists.openembedded.org/g/openembedded-core/message/241541
https://github.com/GNOME/glib-networking/blob/2.80.1/LICENSE_EXCEPTION
The text of the exception is very close to the
https://spdx.org/licenses/openvpn-openssl-exception.html (with replacements)
Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Thu, 23 Jul 2026 15:53:16 +0000 (08:53 -0700)]
python3-certifi: upgrade 2026.6.17 -> 2026.7.22
f4bc676 2026.07.22 (#428) 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427) 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426) eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425) 474e6fc Include tests in the source distribution (#424) a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420) 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
For full comparison of changes, see:
https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 22 Jul 2026 10:12:06 +0000 (11:12 +0100)]
pkgconf: upgrade 3.0.3 -> 3.0.4
Changes from 3.0.3 to 3.0.4:
----------------------------
* Fix a crash (stack overflow) triggered by a crafted .pc file containing a
self-referential fragment variable, such as `x=$${x}` referenced from Cflags.
Fragment variables are now evaluated only once while re-splitting. Found
through fuzzing.
* Fix over-escaping of variable values containing backslash-escaped whitespace,
such as paths quoted with `printf %q`. Such a value was stored with its
escapes intact and then escaped a second time when rendered into a fragment,
producing output like `-L/a\\\ dir`. This broke meson's test suite, which
uses paths with spaces to stay Windows-safe.
* Fix mangled and duplicated -L/-I paths on Windows when PKG_CONFIG_SYSROOT_DIR
and PKG_CONFIG_LIBDIR are set. Path separators are now normalized to forward
slashes for all runtime-injected paths (sysroot, build root, search paths and
pcfiledir), so that sysroot matching and injection operate on a consistent
basis.
* Fix `--define-prefix` dropping a path separator when the redefined prefix ends
with a trailing slash, and only rewrite a package's directories when they match
the original prefix on a path component boundary.
* Fix single-package queries returning results drawn from more than the requested
module, by restoring the package limit that was lost during a refactor of the
query builder.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The BIND 9.20.25 release was withdrawn after the discovery of a
regression in a security fix in it during pre-release testing.
BIND 9.20.26
------------
Security Fixes
~~~~~~~~~~~~~~
- [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name
too long. ``b950da5f625``
Previously, if the expansion of a wildcard CNAME RPZ policy resulted
in a name that exceeded the length limit, a self referential CNAME and
the original address record were returned, allowing the policy to be
bypassed. In branches up to 9.20, this also left query processing in
an inconsistent state which could trigger an assertion failure. We
now return a YXDOMAIN response, without the address.
ISC would like to thank Laith Mash'al (0xmshal) for bringing this
issue to our attention. :gl:`#5856`
- [CVE-2026-11721] Invalid signed wildcard records were being accepted.
``249752cd72d``
Signed wildcard responses in which the Labels field in the `RRSIG`
record was less than the number of labels in the Signer Name field
were being incorrectly accepted. This in turn broke
`synth-from-dnssec`, which depends on such records being correctly
validated. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue
to our attention. :gl:`#5871`
- [CVE-2026-13321] Fix DNSSEC validation bypass via out-of-zone NSEC
Next Field. ``6fbc963d4af``
A malicious zone with out-of-zone NSEC next owner names can cause a
DNSSEC validating resolver to cache such record and, if
`synth-from-dnssec` is enabled, to generate negative answers for any
zone that is covered by the range.
ISC would like to thank Qifan Zhang of Palo Alto Networks for
reporting the issue. :gl:`#5873`
- [CVE-2026-10723] Correct verification of NSEC3 signer name.
``df3abfc3184``
BIND 9 accepted child-zone NSEC3 records where the first label equals
the hash of the parent zone as valid parent-zone closest encloser
proofs. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
:gl:`#5874`
- [CVE-2026-12617] Do no assert for some specifics CNAME and DNAME
queries. ``d75d1e93958``
A bug in the resolver's handling of certain cached DNAME and CNAME
responses could cause named to trigger an assertion failure and exit.
An attacker controlling a domain name and the authoritative DNS server
it is hosted on could exploit this behavior to cause a
denial-of-service. This vulnerability has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue
to our attention. :gl:`#5946`
- [CVE-2026-10822] Malformed DNSKEY records could trigger an assertion.
``a1777ce7ee0``
Previously, `dns_name_fromwire()` did not honor the record boundary
when reading names from the wire, allowing malformed records to be
accepted when they should not have been
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
git log --oneline v2.6.0..v2.6.1: 2f0f3b0e9121 tests: remove the fuzzer from test 62-sim-arch_transactions 7c3f80d95bcc doc: mention EINVAL in seccomp_transaction_start(3) 84005ecc603f hash: fix strict aliasing UB in MurMur hash implementation dd759e8c4f56 api: fix seccomp_export_bpf_mem out-of-bounds read 8e31cd254be3 github: bump codeql version to v3 38c524f982d4 gh: bump ubuntu 24.04 311cb32bcc4a tests: Skip tests 60 and 61 on x32 2d0ed0cbcc3b db: propagate notify_used when merging filter collections 7bf87a67bc87 db: Fix tab/space issue with previous commit 1e6797415029 doc: Add seccomp_transaction_start.3 to Makefile.am c144002c9361 python: fix in-source python builds 4c21f22c31d1 doc: fix a missing CHANGELOG entry from v2.6.0 24033394ad69 tests: Fix shebang for python3 6abe14d1645e python: Fix shebang in setup.py bcb9d0b35fa1 syscalls: fix s390 at Linux v6.18 792976a12e38 arch: Ignore comment lines in arch-syscall-validate fea23415b090 syscalls: update syscall table to Linux v7.1.0-rc4 700b140cdd63 db: fix a copy-n-paste typo in _db_tree_add() 2d9db17cc0da bpf: properly reset/clear the bpf_program on error in _bpf_append_blk() 8d1f8a977177 helper: only clear memory on zrealloc() if the buffer grows dc9fcd66d0c2 bpf: protect against addition overflows when building the filter 4121c0e04116 docs: update the CREDITS file a81cc2de8ee7 doc: CHANGELOG entry for libseccomp v2.6.1
Note: GitHub-style username tag removed from upstream log entry to
avoid unintended notifications on mirrored repos.
Richard Purdie [Wed, 22 Jul 2026 05:42:11 +0000 (05:42 +0000)]
python3-setuptools-scm: upgrade 10.2.0 -> 10.2.1
- Omit ``scm_version.json`` and ``scm_file_list.json`` from wheel ``.dist-info``
while still including them in sdists for fallback discovery. ([#1473](https://github.com/pypa/setuptools-scm/issues/1473))
- Pass `project_root` from egg_info to the workdir so file discovery is correctly scoped in monorepo setups. ([#1440](https://github.com/pypa/setuptools-scm/issues/1440))
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
speedo: Create a pkgversioninfo.txt file.
+ commit 8716b4dac4a79b600d18847b8bc0193bd06e1fc1
* build-aux/mk-sbom.sh: New. Taken from gpg4win and extended.
* Makefile.am (EXTRA_DIST): Add it.
* build-aux/speedo.mk (gnupg_ver_this): Use sed to extract version.
(gnupg_commit_id): new.
(00-unpack): Call mk-sbom.sh.
(clean-pkg-versions: Clear version files.
($(bdir)/pkgversioninfo.txt): New.
(all-speedo,installer): Depend on above.
(dist-source): Exclude autom4te.cache just in case
* build-aux/speedo/w32/inst.nsi: Install pkgversioninfo.txt.
speedo: Fix passing configure args to w32 builds.
+ commit 7af73849a5dbbc5c70e43c3a3f5d70c639c80ab4
* build-aux/speedo.mk (pkgcfg): Use correct number of dollar signs.
common: Prepare to get rid of map_w32_to_errno.
+ commit bf808091534f587e8cdacf351b0e7ba060165fd8
* common/sysutils.c (gnupg_w32_set_errno): Use gpgrt function if
available.
agent: Make batch import of Kyber keys work.
+ commit 4fca79b67bba04bc5ef2a4402e948c01821ceac5
* agent/command.c (cmd_import_key): Allow --unattended also for
composite keys.
2026-06-26 NIIBE Yutaka <gniibe@fsij.org>
dirmngr: Add a validation check in get_dns_cert_standard.
+ commit c3ec7678799a161b9265969e7ad3fd59605b18ab
* dirmngr/dns-stuff.c (get_dns_cert_standard): Validate the length.
gpgsm: Require a minimum tag length for GCM decryption.
+ commit 4c7e68cf3d335328821bdbb70db309a60d0e4fd4
* sm/decrypt.c (gpgsm_decrypt): Require a minimum authtaglen.
2026-06-18 NIIBE Yutaka <gniibe@fsij.org>
w32:common: Fix usleep in w32_wait_when_sharing_violation.
+ commit ab9ce5f5e775a3a6a37923299685ac371f740103
* common/sysutils.c (w32_wait_when_sharing_violation): WTIME is
in milliseconds.
2026-06-17 Philip Le <philip.le@gnupg.com>
gpg: Fix copy_signature.
+ commit 56e11ffe971d5cc58185b4e8d02b82dc432c634b
* g10/free-packet.c (copy_signature): Set the signers_uid of the new
copy to NULL if it is not present in the source signature.
gpg: Use the INT_RCP_FPR subpacket in revocation signatures.
+ commit 9e0e5547d2a008332873a9b632f82f9414ad887f
* common/openpgpdefs.h (sigsubpkttype_t): Add Intended Recipient
Fingerprint signature subpacket.
* g10/build-packet.c (build_sig_subpkt): Build the Intended Recipient
Fingerprint signature subpacket for v4 and v5 keys.
* g10/free-packet.c (fre
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 24 Jul 2026 05:16:38 +0000 (05:16 +0000)]
dropbear: upgrade 2026.92 -> 2026.94
2026.94 - 23 July 2026
- Fix scp build failure regression from 2026.93
The new ascii_isdigit() etc wasn't linked.
- Print square brackets around ipv6 addresses with ports, eg
[2a00:f10:400:2:1c00:bcff:fe00:1c6]:22
Patch from Seo Suchan
- Support longer paths in scp.
- Avoid some build warnings, add increase github action coverage of
config options.
2026.93 - 21 July 2026
Note >> for compatibility/configuration changes
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4
- >> "permitlisten" authorized_keys lines will now be ignored if
the port is invalid (>65535). From Basavaraj S Maneppagol.
- >> In 2026.92, the configure option --enable-plugin-deprecated
wasn't correctly renamed. This is now implemented.
Patch from Alexander Dahl
- Two factor auth "-t" is no longer deprecated, it will be kept.
The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required.
- Fix out of bounds read during utmp/wtmp log file handling, reported by
Basavaraj S Maneppagol.
- More robust handling of ascii inputs for some platforms.
From Basavaraj S Maneppagol
- Convert manpages to mdoc format, from shrub
[Updated 16 July: This is no longer planned to be removed, future releases
will ignore DEPRECATED_TWO_FACTOR and always enable it, like previously]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 25 Jul 2026 05:36:53 +0000 (05:36 +0000)]
python3-cython: upgrade 3.2.8 -> 3.2.9
3.2.9 (2026-07-23)
==================
Bugs fixed
----------
* Indexing into freshly created lists with an out-of-bounds index could crash.
(Github issue :issue:`7793`)
* Function arguments with default values could end up uninitialised in closures, leading to crashes.
Patch by Anthony Donlon. (Github issue :issue:`7782`)
* ``bytearray.append(None)`` could crash. The optimised code was also lacking concurrency guards.
(Github issue :issue:`7796`)
* Some rare corner cases when concatenating text strings were resolved.
(Github issue :issue:`7799`)
* Assignments of builtin string types to typedefs of `object` could erroneously be rejected.
(Github issue :issue:`7789`)
* Subscripting ``type`` failed with a ``TypeError``.
(Github issue :issue:`5563`)
* Manually disabling ``CYTHON_VECTORCALL`` in CPython could lead to invalid C code.
Patch by Florent Gallaire. (Github issue :issue:`7807`)
* Some internal Limited API version checks for Py3.12 were corrected.
(Github issue :issue:`7845`)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Improves the debugging output when parsing an SPDX file fails by
reporting the file name (since this is not normally visible from the
backtrace). Continue to raise the exception after reporting the file
name to get the full backtrace.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The diff is quite large, but a partial comparison can be seen:
https://github.com/fkie-cad/nvd-json-data-feeds/compare/v2026.06.24-000003..v2026.07.23-000007
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The diff is quite large, but a partial comparison can be seen:
https://github.com/CVEProject/cvelistV5/compare/2026-06-24_baseline..2026-07-23_baseline
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Thu, 23 Jul 2026 20:48:31 +0000 (13:48 -0700)]
fragments/yocto/sbom-cve-check: fix conflict with tag=
Fixes: 00864cf5bc meta: Add tag in SRC_URI to multiple recipes
When this fragment is enabled, SRCREV is set to AUTOREV, but this then
causes do_unpack to fail for both sbom-cve-check-update-cvelist-native
and sbom-cve-check-update-nvd-native, since the tag SRCREV does not
match with the 'main' HEAD AUTOREV.
Rather than allow the tag to float, for those that desire reproducible
builds with just IMAGES_CLASSES:append = " sbom-cve-check" and not
this fragment, set SRC_URI **without** the tag= in this fragment.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 23 Jul 2026 12:51:13 +0000 (13:51 +0100)]
resulttool: Add support for ptests results for both musl and glibc
The code currently assumed a DISTRO has one libc and can't handle the case
where there are ptest results for both. Add in TCLIBC to the result data
to allow them to be differentiated and add support in the reporting to
see the difference between them.
We need to carefully handle the case where there is no TCLIBC data in the
results as the code currently assumes all data is present.
[YOCTO #16357]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 20 Jul 2026 19:45:10 +0000 (20:45 +0100)]
classes/cargo: remove BUILD_MODE, replace with CARGO_PROFILE
The BUILD_MODE variable appears to be a way to select the Cargo build profile
that is used, but it can't be assigned because it and other pieces of
code base their logic on the value of DEBUG_BUILD.
Instead of a BUILD_MODE variable that is "--release" or "" depending on
the value of DEBUG_BUILD, replace it with a clear CARGO_PROFILE variable
that selects the profile to use. The default has the same behaviour as before:
either "release" or "dev" based on DEBUG_BUILD.
This profile is then passed to cargo, and used to construct paths in the
build tree (with the caveat that the "dev" profile puts files in "debug").
kernel.bbclass: pass args instead of tuple of args to runstrip()
Since commit 7c99f90079e7 ("lib/package/utils: Improve
multiprocess_launch argument passing"), runstrip() now expects arguments
individually instead as a big tuple so let's fix the one user in OE-Core
of that function which we forgot to migrate.
Fixes: 7c99f90079e7 ("lib/package/utils: Improve multiprocess_launch argument passing") Reported-by: Robert P. J. Day <rpjday@crashcourse.ca> Closes: https://lore.kernel.org/openembedded-core/319bb00c-9712-4aa7-38b0-e1ad2bab840b@crashcourse.ca/ Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/liboe: cover oe.path's own path logic
Add in-process coverage for oe.path's join(), is_path_parent(),
symlink(), make_relative_symlink(), canonicalize(), which_wild() and
realpath(), alongside the existing copytree tests.
The cases pin behaviour that is easy to regress: __realpath() falls back
to "not a directory" when os.path.isdir() raises; symlink(force=True)
replaces the literal destination even when its name contains glob
metacharacters, and never removes a pattern sibling; and canonicalize()
skips empty tokens so '', None, and a stray separator do not inject the
current working directory.
realpath() also gets its harder contracts covered: a self-referential
link and an A->B->A cycle both raise ELOOP rather than spinning, a
symlink several components deep still resolves under use_physdir, and a
missing trailing component raises ENOENT by default but is tolerated
with assume_dir=True. symlink() is shown to stage a dangling link whose
target does not exist yet, make_relative_symlink() is exercised several
directories below its target so the multi-level "../" loop runs, and
canonicalize() drops a run of "$" tokens and preserves a trailing slash.
oe/path: canonicalize('') should return '' rather than the cwd
canonicalize() splits its input on the separator and runs each token
through os.path.realpath(). os.path.realpath('') returns the current
working directory, so canonicalize('') and canonicalize(None) wrongly
produced the cwd instead of an empty string, and a stray separator (for
example "a,,b") injected a spurious cwd entry into the result.
Skip empty tokens alongside the existing unexpanded-variable skip so only
real paths are canonicalized.
oe/path: don't glob-expand the destination in symlink(force=True)
symlink(source, destination, force=True) cleared an existing destination
by calling remove(destination). remove() treats its argument as a glob
pattern (it iterates glob.glob(path)), so a destination whose name
contains glob metacharacters is mishandled: a name such as "foo[bar]"
may fail to match itself and be left in place, or a pattern could match
and delete unrelated files.
Remove the literal destination instead: unlink it directly, and fall
back to rmtree() for a directory, ignoring ENOENT. This keeps the
force=True semantics without passing the path through glob.
oe/path: fix bare `false` NameError in __realpath's isdir guard
__realpath() wraps its os.path.isdir() probe in a bare except that
assigns `is_dir = false`. `false` is not a Python name, so when
os.path.isdir() does raise (for example on an ELOOP path), the handler
meant to absorb the error instead raises NameError and aborts the walk.
Use the builtin False so the guard degrades to "not a directory" as
intended.
Peter Marko [Wed, 15 Jul 2026 21:58:51 +0000 (23:58 +0200)]
libxfont: remove recipe
This recipe is obsolete and successor libxfont2 is available.
Nothing in oe-core or meta-openembedded depends on it anymore.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
license: fix list_licenses() crash on CLOSED and empty licenses
oe.license.list_licenses() passes the result of parse_legacy_license()
straight into walk_license(), which unconditionally iterates
node.children. For LICENSE = "CLOSED" (and for an empty license string)
parse_legacy_license() returns None, so walk_license(None) dereferences
None.children and aborts do_package_qa with:
AttributeError: 'NoneType' object has no attribute 'children'
This breaks packaging for every CLOSED-licensed recipe reaching the
obsolete-license QA check.
Guard the walk against a None node, mirroring the existing "if node:"
check in the neighbouring apply_pkg_license_exclusion().
kernel-fit-image: introduce FIT_OS variable to override 'os' field
U-Boot can load an EFI application from a FIT image; this requires
setting the OS to "efi" (usually in combination with type
"kernel_noload"). Doing so is a convenient approach for giving the OS
access to EFI services while preserving other benefits of FIT image boot.
projects / thirdparty / openembedded / openembedded-core-contrib.git / log
