Peter Marko [Tue, 10 Feb 2026 08:20:12 +0000 (09:20 +0100)]
mtd-utils: fix ubifs packaging
This change moves fsck.ubifs and mount.ubifs to correct package.
Noticed when lzo was installed to ubi-less image additionally when
upgrading from scarthgap to master as being dependency of fsck.ubifs.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Paul Barker [Tue, 10 Feb 2026 08:07:57 +0000 (08:07 +0000)]
selftest: Test installation of recipes with complex packaging
When recipes have complex and dynamic packaging, it's easy to
accidentally end up with one or more packages that build but can't be
installed. We've seen this recently with linux-firmware [1].
Skimming through the recipes that set PACKAGESPLITFUNCS or
PACKAGES_DYNAMIC or are otherwise known offenders, I've also picked out
gstreamer1.0-plugins-*, kernel-modules, perl and python3 as recipes
where it would be easy to end up with similar issues in the future.
spdx30_tasks: Exclude 'doc' when exporting PACKAGECONFIG to SPDX
Currently when generating an SBOM, all packages have the 'doc' feature
indicated as disabled. This is in fact *not* a feature that was
declared in the recipe, but instead the documentation of the
PACKAGECONFIG variable.
But to be safe, if somehow a feature is named 'doc' and enabled, do
not exclude it when exporting PACKAGECONFIG features to SPDX.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fabio Berton [Mon, 9 Feb 2026 10:53:25 +0000 (10:53 +0000)]
classes/buildhistory: Do not sign buildhistory commits
This change adds the --no-gpg-sign option to prevent buildhistory
commits from failing due to GPG signing issues. Depending on the setup,
buildhistory may fail to create a commit if the user has the
commit.gpgsign option enabled.
For example, if the user creates a signing key that requires a password,
the commit won't be created and will fail with the following error:
/
|error: Enter passphrase: Load key "/home/<user>/.ssh/id_ed25519":
|incorrect passphrase supplied to decrypt private key?
|fatal: failed to write commit object
\
The bitbake command won't fail, but buildhistory won't have a commit.
Also, the commit may silently fail when building inside a container due
to missing packages or issues with accessing the GPG agent.
This is similar to [1], and signing the buildhistory commit
should be avoided to prevent such issues.
Wang Mingyu [Mon, 9 Feb 2026 09:02:44 +0000 (17:02 +0800)]
glslang: upgrade 1.4.335.0 -> 1.4.341.0
Changelog:
===========
- Allow gl_FragDepth identifier to be redeclared
- Replace 'GL_TASK(MESH)_SHADER_NV' with 'GL_TASK(MESH)_SHADER_EXT'
- Scalarize swizzled MeshEXT stores
- Support GL_EXT_long_vector
- Add missing preamble #define for GL_EXT_nontemporal_keyword
- Support GL_NV_push_constant_bank
- Support GL_EXT_descriptor_heap
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wang Mingyu [Mon, 9 Feb 2026 09:02:46 +0000 (17:02 +0800)]
liburcu: upgrade 0.15.5 -> 0.15.6
Changelog:
===========
* urcu-mb: Add missing TSAN annotation to _urcu_mb_read_lock_update
* lfstack: Coding style cleanup
* urcu-qsbr: Use CMM_SEQ_CST_FENCE for _urcu_qsbr_thread_online
* urcu-mb: Use CMM_SEQ_CST_FENCE for _urcu_mb_read_lock_update
* urcu-qsbr: Use CMM_SEQ_CST_FENCE for quiescent state update and offline
* urcu-mb: Use CMM_SEQ_CST_FENCE for _urcu_mb_read_unlock_update_and_wakeup
* Fix: Only include linux/time_types.h when __NR_futex_time64 is defined
* Use __NR_futex_time64 in futex syscall wrapper
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wang Mingyu [Mon, 9 Feb 2026 09:02:42 +0000 (17:02 +0800)]
gi-docgen: upgrade 2025.5 -> 2026.1
Changelog:
===========
- Parse method-inline for records, unions and interfaces
- Use dot's `svg_inline` output format
- Fix Red Hat Display italic font-face
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Quentin Schulz [Fri, 6 Feb 2026 17:23:57 +0000 (18:23 +0100)]
mesa: remove libxml2-native dependency
Native libxml2 is only needed for xmllint which in turn is only needed
when build-tests meson option is enabled, which defaults to disabled and
isn't enabled by the recipe.
We may need to revisit this if we add ptest support in mesa I assume.
Let's remove it from the DEPENDS for now.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Quentin Schulz [Fri, 6 Feb 2026 17:23:56 +0000 (18:23 +0100)]
mesa: make zlib dependency a PACKAGECONFIG
zlib is a mesa meson feature which can be disabled so let's make it a
PACKAGECONFIG.
The motivation actually isn't about disabling it (though we now could as
it's only required for a few things) but rather that this dependency is
a non-native one.
The issue is when a native-only (-native recipe name suffix + inherit
native) recipe includes mesa.inc, it'll include the DEPENDS as well but
will then depend on a non-native recipe because BitBake doesn't add a
suffix to dependencies listed in DEPENDS for native-only recipes like it
does for recipes with BBCLASSEXTEND = native. This is a way to
circumvent the issue by making the dependency a PACKAGECONFIG dependency
such that the listed DEPENDS (third parameter) will be properly modified
by BitBake to have the native variant of the recipe pulled in. See[1]
for more info on why this is needed.
This is in preparation for the addition of a mesa-tools-native
native-only package which will include mesa.inc.
Quentin Schulz [Fri, 6 Feb 2026 17:23:55 +0000 (18:23 +0100)]
mesa: make expat dependency a PACKAGECONFIG
expat is a mesa meson feature which can be disabled so let's make it a
PACKAGECONFIG.
The motivation actually isn't about disabling it (though we now could as
it's only required for a few things) but rather that this dependency is
a non-native one.
The issue is when a native-only (-native recipe name suffix + inherit
native) recipe includes mesa.inc, it'll include the DEPENDS as well but
will then depend on a non-native recipe because BitBake doesn't add a
suffix to dependencies listed in DEPENDS for native-only recipes like it
does for recipes with BBCLASSEXTEND = native. This is a way to
circumvent the issue by making the dependency a PACKAGECONFIG dependency
such that the listed DEPENDS (third parameter) will be properly modified
by BitBake to have the native variant of the recipe pulled in. See[1]
for more info on why this is needed.
Now that expat is a PACKAGECONFIG and that if it's not there expat isn't
autodetected anymore by meson, having xmlconfig PACKAGECONFIG add expat
as a DEPENDS (third parameter) is likely not enough anymore due to expat
feature being explicitly disabled if expat is not in PACKAGECONFIG.
Therefore, remove the third parameter for xmlconfig and add a comment
telling the user there's a PACKAGECONFIG dependency here. Note that
since this commit adds the expat PACKAGECONFIG to all recipes including
mesa.inc, no change in behavior is expected.
This is in preparation for the addition of a mesa-tools-native
native-only package which will include mesa.inc.
Ross Burton [Fri, 6 Feb 2026 14:57:15 +0000 (14:57 +0000)]
jquery: remove recipe
Now that the reproducible selftest doesn't use this recipe, it is no
longer used by any recipes that I can find.
There is an alternative jquery recipe in meta-oe that is slightly
different and has packaging consistent with with javascript recipes in
the same layer.
Signed-off-by: Ross Burton <ross.burton@arm.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 6 Feb 2026 14:57:14 +0000 (14:57 +0000)]
oeqa/selftests/reproducible: use the jQuery CDN instead of jquery-native
Instead of building jquery-native and then copying the file into the
expected place in the build tree, simply tell diffoscope to load jQuery
from their CDN.
In the slim chance that the diffoscope report is viewed offline, the
only regression is that sections cannot be collapsed.
The advantage to this approach is that we no longer need to maintain a
jquery-native recipe simply for the reproducible selftests.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
hosttools: force a --no-rosegment option if host ld supports it
Please see https://bugzilla.yoctoproject.org/show_bug.cgi?id=16087
for the tricky, unpleasant details.
The summary of the issue:
>From Fedora 42 onwards, the --rosegment argument is passed to the
linker by default when building native binaries. This triggers
re-arrangement of sections by patchelf, resulting in binaries which
are loaded incorrectly by older kernel versions. These "contaminated"
native binaries end up in sstate and cause build failures when they
are used on older distros such as AlmaLinux 8 & 9 or Rocky Linux 8 &
9.
[YOCTO #16087]
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ankur Tyagi [Fri, 6 Feb 2026 10:43:20 +0000 (23:43 +1300)]
mpg123: upgrade 1.33.3 -> 1.33.4
Changelog:
mpg123: In terminal control, ignore 7-bit escape sequences to avoid spurious actions, e.g. when hitting cursor keys.
ports/cmake: Avoid possibly conflicting use of SIZEOF_OFF_T CMake variable when embedding mpg123 with other projects using cmake and different off_t semantics.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rust-oe-selftest.patch updated for 1.93:
Renamed UI test directive from add-core-stubs to add-minicore as in
https://github.com/rust-lang/rust/commit/3796f7de57f5d4cf4325d1f13aeb07fdaa57983b
* OE-selftests:
- Exclude src/tools/remote-test-client from test suite.
This unit test modifies the TEST_DEVICE_ADDR environment variable,
which breaks the OE test harness that uses the same variable for
QEMU remote testing. Filed a bug with upstream:
https://github.com/rust-lang/rust/issues/151823
- Enable +v8a feature for cortexa57.
Rust 1.93.0 added a regression test (PR #149549) to verify that the
ARMv8-A system register ttbr0_el2 is recognized in inline assembly.
This addresses issue #97724 where LLVM wasn't recognizing ttbr0_el2
as a valid register. Upstream Rust enables +v8a by default for all
AArch64 targets (PR #105026), but Yocto's custom target specification
doesn't inherit this. Adding +v8a ensures LLVM recognizes ARMv8-A
system registers, fixing the test failure.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Mingli Yu [Thu, 5 Feb 2026 08:51:19 +0000 (16:51 +0800)]
lttng-tools: Upgrade 2.14.0 -> 2.14.1
Remove 0001-gen-ust-events-constructor-change-rpath-to-libdir-li.patch
as the logic is included in 2.14.1 [1].
Remove 0001-eventfd.cpp-Remove-the-scope-resolution-operator.patch as
the logic is included in 2.14.1 [2].
Remove 0001-liblttng-ctl-drop-index-allocator-symbols-from-versi.patch
as the logic is included in 2.14.1 [3].
util_event_generator.sh is renamed to util_event_generator.py [4] and
the .py install logic in included as below.
find "${B}/tests/$d" -maxdepth 1 -type f -name "*.py" \
-exec install -t "${D}${PTEST_PATH}/tests/$d" {} +
Ross Burton [Wed, 4 Feb 2026 15:34:22 +0000 (15:34 +0000)]
gawk: trim native build configuration
When we build gawk-native it is only for use in builds where the host
gawk output isn't reproducible across versions[1]. As such it doesn't
need support for readline or mprf, and by removing those from gawk-native
we can get building gawk-native sooner.
[1] oe-core c5bbf0a60b ("gawk: use native gawk when building glibc and grub")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Unfortunately the update is causing reproducibility issues:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/37/builds/3317
https://valkyrie.yocto.io/pub/repro-fail/oe-reproducible-20260209-a0dgcw5d/packages/diff-html/
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 10 Feb 2026 14:49:20 +0000 (14:49 +0000)]
python3-packaging: upgrade 25.0 -> 26.0
Skip the testcase test_pylock.py as this depends on tomli_w, which isn't
currently part of core.
Upstream changelog:
Features:
* PEP 751: support pylock
* PEP 794: import name metadata
* Support for writing metadata to a file
* Support __replace__ on Version
* Support positional pattern matching for Version and SpecifierSet
Behavior adaptations:
* PEP 440 handling of prereleases for Specifier.contains,
SpecifierSet.contains, and SpecifierSet.filter
* Handle PEP 440 edge case in SpecifierSet.filter
* Adjust arbitrary equality intersection preservation in SpecifierSet
* Return False instead of raising for .contains with invalid version
* Support arbitrary equality on arbitrary strings for Specifier and
SpecifierSet's filter and contains method.
* Only try to parse as Version on certain marker keys, return False on
unequal ordered comparisons
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bruce Ashfield [Fri, 6 Feb 2026 20:27:25 +0000 (15:27 -0500)]
linux-yocto/6.18: beaglebone black: boot and graphics fixes
Integrating the following commit(s) to linux-yocto/6.18:
1/2 [
Author: Kevin Hao
Email: haokexin@gmail.com
Subject: net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
Date: Wed, 4 Feb 2026 14:27:57 +0800
Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this
change triggered the following call trace on my BeagleBone Black board:
WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496
RTNL: assertion failed at net/8021q/vlan_core.c (236)
Modules linked in:
CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT
Hardware name: Generic AM33XX (Flattened Device Tree)
Call trace:
unwind_backtrace from show_stack+0x28/0x2c
show_stack from dump_stack_lvl+0x30/0x38
dump_stack_lvl from __warn+0xb8/0x11c
__warn from warn_slowpath_fmt+0x130/0x194
warn_slowpath_fmt from vlan_for_each+0x120/0x124
vlan_for_each from cpsw_add_mc_addr+0x54/0xd8
cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec
__hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88
__dev_mc_add from igmp6_group_added+0x84/0xec
igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0
__ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4
__ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168
do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8
ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c
do_sock_setsockopt from __sys_setsockopt+0x84/0xac
__sys_setsockopt from ret_fast_syscall+0x0/0x5
This trace occurs because vlan_for_each() is called within
cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.
Since modifying vlan_for_each() to operate without the RTNL lock is not
straightforward, and because ndo_set_rx_mode() is invoked both with and
without the RTNL lock across different code paths, simply adding
rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.
To resolve this issue, we opt to execute the actual processing within
a work queue, following the approach used by the icssg-prueth driver.
Fixes: 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") Signed-off-by: Kevin Hao <haokexin@gmail.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260203-bbb-v5-1-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
2/2 [
Author: Kevin Hao
Email: haokexin@gmail.com
Subject: drm/tilcdc: Set preferred depth
Date: Wed, 4 Feb 2026 14:27:58 +0800
The commit c91acda3a380 ("drm/gem: Check for valid formats") adds a
check for valid pixel formats on drm_gem_fb_create(), but this breaks
the X server on the beaglebone black board.
We have set 'DefaultDepth' to 16 in our xorg.conf. In the X modesetting
driver, the drmmode_get_default_bpp() is used to guess the default
depth/bpp. First it tries to get them via DRM_CAP_DUMB_PREFERRED_DEPTH
ioctl, and if it fail, then try to create a FB with 'depth = 24' and
'bpp = 32' to check whether this depth/dpp is a valid combo. Before the
kernel commit c91acda3a380, the FB always can be created successfully.
This will avoid the bpp to be set to 24 forcibly. But after kernel
commit c91acda3a380, the FB will not be created successfully due to the
check of the valid pixel format. Then the bpp is set to 24, but the
'depth = 16' and 'bpp = 24' combo is not a valid pixel format.
Fix this issue by explicitly setting the preferred_depth in this driver.
With this change, the modesetting driver would choose the correct
depth/bpp combo based on our setting in xorg.conf.
Bruce Ashfield [Fri, 6 Feb 2026 20:27:21 +0000 (15:27 -0500)]
linux-yocto/6.12: drop reference recipes
We are going to release the LTS with only 6.18 as the versioned
reference kernel. 6.12 will continue to be updated and used in
previous release branches.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The OpenSSL legacy provider supplies algorithms that are either used
infrequently or have been deemed insecure by modern standards. The
Python3 cryptography module can optionally support this provider via the
openssl-ossl-module-legacy package.
Currently, the cryptography module builds with legacy provider support
enabled by default, regardless of whether the legacy modules are
actually included in the system. This patch makes that dependency
explicit by introducing a legacy-openssl packageconfig option that:
* Ensures runtime dependency on openssl-ossl-module-legacy when enabled
* Allows users to disable legacy algorithm support via build configuration
* Aligns python3-cryptography's defaults with OpenSSL's current defaults
The packageconfig option defaults to enabled for consistency with
OpenSSL's current configuration and to avoid breaking existing
deployments. A future security improvement will disable legacy modules
by default in OpenSSL, at which point this packageconfig can also
default to disabled.
Signed-off-by: Colin Pinnell McAllister <colinmca242@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Max Krummenacher [Mon, 26 Jan 2026 09:36:55 +0000 (10:36 +0100)]
alsa-utils: fix packaging of alsabat
If bat is in PACKAGECONFIG two additional binaries are created which
by the dynamic package split creates two additional packages.
However due to explicitely adding the file alsabat-test.sh to the
alsabat package the alsa-utils-alsabat-test package now is empty
and not created.
Complete commit 4c6d5f96990d ("alsa-utils: fix packaging") which fixed
the same issue for all other affected packages.
Fixes: 26a28ee79350 ("alsa-utils: dynamically split the packages instead of doing it manually") Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jörg Sommer [Tue, 3 Feb 2026 18:59:54 +0000 (19:59 +0100)]
create-spdx-2.2.bbclass: Add CVE_CHECK_IGNORE to fixed CVEs
The list of CVEs fixed by patches goes to the field *sourceInfo* in the
SBOM. But this list does not contain the CVEs marked for ignoring with the
Bitbake variable *CVE_CHECK_IGNORE*. Many recipes (e.g. openssh, glibc,
python) contain such entries and these are missing in the SBOM. Therefore,
add them to the list.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Tue, 3 Feb 2026 10:07:13 +0000 (11:07 +0100)]
systemd: properly package new container files
Since last systemd upgrade these files are packaged in systemd package
and thus systemd-container is unconditionally installed in all images as
dependency of systemd package.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pratik Farkase [Mon, 2 Feb 2026 22:36:06 +0000 (23:36 +0100)]
libsolv: add ptest support
Add ptest support to enable automated testing of libsolv
using ptest-runner.
The implementation uses upstream's test infrastructure:
testsolv binary, runtestcases.sh script, and testcase data.
The test suite runs 28 test categories covering solver
functionality, package dependencies, and repository handling.
mark.yang [Fri, 30 Jan 2026 09:54:52 +0000 (18:54 +0900)]
lto.inc: introduce LTO_DEFAULT variable to support per-package overrides with Clang
Currently, LTO variable is set with a toolchain-clang override directly.
This causes priority issues where package-specific overrides (e.g., LTO:pn-perl = "")
are ignored when the Clang toolchain is active, making it difficult to disable LTO
for specific failing recipes.
This patch refactors the logic by introducing an intermediate `LTO_DEFAULT` variable.
- `LTO_DEFAULT` handles the toolchain-specific flags (GCC vs Clang).
- `LTO` is assigned `LTO_DEFAULT` as a default value.
This structure allows `LTO` to be cleanly overridden by recipe-specific overrides
(like `pn-${PN}`) regardless of the active toolchain.
Added a toolchain-gcc override for alsa-lib because -flto-partition=none is not
supported by Clang.
Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dmitry Baryshkov [Tue, 20 Jan 2026 02:43:13 +0000 (04:43 +0200)]
uki.bbclass: fix building of UKI images with multiple initramfs fstypes
If INITRAMFS_FSTYPES contains more than one entry, ukify build command
will fail as INITRD_ARCHIVE will contain extra strings. Use only the
first initramfs type, letting the user to specify other fstypes in
INITRAMFS_FSTYPES.
The INITRD_ARCHIVE variable is removed and merged into the code to
resolve the issue as we don't need a separate variable.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In a custom u-boot recipe that requires u-boot-common.inc, the config
fragments end up in SRC_URI. However, the custom recipe's FILESPATH does
not contain the path to oe-core's u-boot directory (as expected), which
leads to the error below:
ERROR: .../build/../meta-custom/recipes-bsp/u-boot/u-boot-custom_2025.10.bb:
Unable to get checksum for u-boot-custom SRC_URI entry u-boot-riscv-isa_clear.cfg: file could not be found
The following paths were searched:
(...)
Move SRC_URI_RISCV - along with the appends - out of the common
definitions.
Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The current extra_partition plugin uses predictable variable names (the
configuration must predict the image partition label or uuid). This has two
inconveniences:
- an extra partition that has a specific label (or uuid) is doomed with the
associated variable. The partition cannot be configured unless the label
(or uuid) is changed.
- two partitions with same label from distincts .wks cannot have different
content.
This allows the new suffix _name_%s to be appended to
IMAGE_EXTRA_PARTITION_FILES. This variable will be preferred whenever the
.wks specifies a name in the --sourceparams option.
For example:
an image may define:
IMAGE_EXTRA_PARTITION_FILES_name_foo = "bar.conf"
and the .wks line have line:
part --source extra_partition --sourceparams "name=foo"
Signed-off-by: Louis Rannou <louis.rannou@non.se.com> Reviewed-by: Pierre-Loup GOSSE <pierre-loup.gosse@smile.fr> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stefano Tondo [Wed, 7 Jan 2026 18:15:41 +0000 (19:15 +0100)]
spdx30_tasks: Add concluded license support with SPDX_CONCLUDED_LICENSE
Add hasConcludedLicense relationship to SBOM packages with support for
manual license conclusion override via SPDX_CONCLUDED_LICENSE variable.
The concluded license represents the license determination after manual
or external license analysis. This should be set manually in recipes or
layers when:
1. Manual license review identifies differences from the declared LICENSE
2. External license scanning tools detect additional license information
3. Legal review concludes a different license applies
The hasConcludedLicense relationship is ONLY added to the SBOM when
SPDX_CONCLUDED_LICENSE is explicitly set. When unset or empty, no
concluded license is included in the SBOM, correctly indicating that
no license analysis was performed (per SPDX semantics).
When differences from the declared LICENSE are found, users should:
1. Preferably: Correct the LICENSE field in the recipe and contribute
the fix upstream to OpenEmbedded
2. Alternatively: Set SPDX_CONCLUDED_LICENSE locally in your layer when
upstream contribution is not immediately possible or when the license
conclusion is environment-specific
The implementation checks both package-specific overrides
(SPDX_CONCLUDED_LICENSE:${PN}) and the global variable, allowing
per-package license conclusions when needed.
The concluded license expression is automatically de-duplicated by
add_license_expression() to avoid redundant license objects in the SBOM.
The variable is initialized in spdx-common.bbclass with comprehensive
documentation explaining its purpose, usage guidelines, and examples.
Example usage in recipe or layer:
SPDX_CONCLUDED_LICENSE = "MIT & Apache-2.0"
SPDX_CONCLUDED_LICENSE:${PN} = "MIT & Apache-2.0"
Signed-off-by: Stefano Tondo <stefano.tondo.ext@siemens.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Schwan [Wed, 17 Dec 2025 13:06:43 +0000 (14:06 +0100)]
cargo-update-recipe-crates: Don't fail for partially empty Cargo.lock
Do not fail if only some Cargo.lock files are empty. Only fail, if there
are absolutely no dependencies found in any Cargo.lock.
This fixes the following error message, which would occur with "bitbake
-c update_crates python3-orjson":
ERROR: python3-orjson-3.10.17-r0 do_update_crates: Execution of '.../python3-orjson/3.10.17/temp/run.do_update_crates.70693' failed with exit code 1
ERROR: Logfile of failure stored in: .../python3-orjson/3.10.17/temp/log.do_update_crates.70693
Log data follows:
| DEBUG: Executing python function extend_recipe_sysroot
| NOTE: Direct dependencies are ['.../sources/oe-core/../oe-core/meta/recipes-devtools/quilt/quilt-native_0.69.bb:do_populate_sysroot', 'virtual:native:.../sources/oe-core/../oe-core/meta/recipes-devtools/patch/patch_2.8.bb:do_populate_sysroot', 'virtual:native:.../sources/oe-core/../oe-core/meta/recipes-devtools/python/python3_3.13.9.bb:do_populate_sysroot']
| NOTE: Installed into sysroot: []
| NOTE: Skipping as already exists in sysroot: ['gettext-minimal-native', 'cmake-native', 'libtool-native', 'quilt-native', 'texinfo-dummy-native', 'openssl-native', 'expat-native', 'ncurses-native', 'util-linux-libuuid-native', 'zlib-native', 'libedit-native', 'make-native', 'patch-native', 'perl-native', 'python3-native', 'bzip2-native', 'xz-native', 'zstd-native', 'attr-native', 'gdbm-native', 'libffi-native', 'sqlite3-native']
| DEBUG: Python function extend_recipe_sysroot finished
| DEBUG: Executing shell function do_update_crates
| Traceback (most recent call last):
| File "<stdin>", line 41, in <module>
| File "<stdin>", line 12, in get_crates
| ValueError: Unable to find any candidate crates that use crates.io
|
| The above exception was the direct cause of the following exception:
|
| Traceback (most recent call last):
| File "<stdin>", line 43, in <module>
| ValueError: Cannot parse '.../python3-orjson/3.10.17/sources/orjson-3.10.17/include/cargo/simdutf8-0.1.5/Cargo.lock'
| WARNING: exit code 1 from a shell command.
ERROR: Task (.../sources/oe-core/../meta-openembedded/meta-python/recipes-devtools/python/python3-orjson_3.10.17.bb:do_update_crates) failed with exit code '1'
Signed-off-by: Martin Schwan <m.schwan@phytec.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Samuli Piippo [Wed, 4 Feb 2026 06:42:05 +0000 (06:42 +0000)]
oe/utils: filter license packages
The packages_filter_out_system() function is used in PACKAGESPLITFUNCS
to filter out "system" packages (-dbg, -dev). The filtered packages
should include license packages (-lic) as well, when they are generated
with LICENSE_CREATE_PACKAGE = "1", otherwise the license packages will
get pulled into images unintentionally.
Peter Marko [Tue, 3 Feb 2026 22:40:22 +0000 (23:40 +0100)]
ffmpeg: ignore 10 CVEs
First group of CVEs got a bogus cpe update listing all tags since v7.0.
All CVEs were fixed in v7.0 except CVE-2025-22921 fixed in v8.0.
Second group has date CPE (2025-01-13) instead of version (v8.0).
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Tue, 3 Feb 2026 21:47:17 +0000 (22:47 +0100)]
libsndfile1: patch CVE-2025-56226
Pick patches from both PRs linked in issue mentioned in NVD report.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Tue, 3 Feb 2026 21:11:42 +0000 (22:11 +0100)]
vim: upgrade 9.1.1683 -> 9.1.2128
Removes CVE-2025-66476 from CVE metrics.
It's fixed in 9.1.1947, but only affects Vim for Windows.
Rebased patches and resolved conflicts.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Chen Qi [Mon, 2 Feb 2026 06:47:34 +0000 (14:47 +0800)]
qemu: fix regression for ppc64
The qemu upstream commit, fcac98d0 (linux-user: Remove ELF_HWCAP2),
accidently introduced a regression. It used get_elf_hwcap where
get_elf_hwcap2 should be used.
With recent qemu upgrade in Yocto (10.1.3 -> 10.2.0), qemuppc64 build
is basically broken. There are a lot of do_configure failures with error
message like below:
Fatal glibc error: CPU lacks ISA 3.00 support (POWER9 or later required)
Backport a patch to fix this issue.
Note that although the problem was only revealed for qemuppc64, some arm
and arm64 machines will also likely get the same issue, as in qemu source
we have:
linux-user/aarch64/target_elf.h:#define HAVE_ELF_HWCAP2 1
linux-user/arm/target_elf.h:#define HAVE_ELF_HWCAP2 1
linux-user/ppc/target_elf.h:#define HAVE_ELF_HWCAP2 1
Replaced 0001-restripe.c-Use-_FILE_OFFSET_BITS-to-enable-largefile.patch
with 0001-raid6check.c-restripe.c-Use-64-bit-off_t-across-both.patch as
partial changes from first patch are part of the upstream version[1].
Dropped patches that are part of upstream version
- xmalloc.patch [2]
- 0001-Makefile-install-mdcheck.patch [3]
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
