Peter Marko [Wed, 5 Aug 2026 17:28:38 +0000 (19:28 +0200)]
nfs-utils: set status for CVE-2025-12801
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
This is RedHat version-less CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pratik Farkase [Wed, 5 Aug 2026 13:16:57 +0000 (15:16 +0200)]
glib-2.0: skip a timing sensitive monotonic-time ptest
The /monotonic-time-ns/similar test compares g_get_monotonic_time() and
g_get_monotonic_time_ns() by spinning until the microsecond clock ticks
and asserting the two clocks haven't diverged. This is inherently racy
under QEMU emulation on loaded hosts, as the process can be preempted
between the clock reads.
Wang Mingyu [Wed, 5 Aug 2026 05:48:49 +0000 (13:48 +0800)]
weston: upgrade 15.0.1 -> 16.0.0
Backport the patch to allow weston to build with libdisplay-info 0.4.0.
Update PACKAGECONFIG entries to reflect the options actually
available in Weston 16.0.0 (many deprecated options have been
removed or renamed):
- Remove the following (no longer exist):
* screenshare
* shell-fullscreen
* vaapi (deprecated-backend-drm-screencast-vaapi)
- Rename 'remoting' to 'deprecated-remoting' (the option name
changed upstream).
- In EXTRA_OEMESON, change '-Dpipewire=false' to
'-Dbackend-pipewire=false' because the meson option was renamed.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Sun, 9 Aug 2026 23:19:04 +0000 (16:19 -0700)]
python3-gitpython: upgrade 3.1.43 -> 3.1.58
Upstream tarballs changed from mixed case GitPython-3.1.43.tar.gz to
all lowercase gitpython-3.1.44.gz and the regex in pypi.bbclass was
not catching it.
Similarly, per PEP-625, the PYPI_SRC_URI since 3.1.44 needs to be
lowercase.
It appears the proper fix for fetching is to set
PYPI_PACKAGE = "gitpython".
Multiple security releases, see the change logs:
https://gitpython.readthedocs.io/en/3.1.58/changes.html
https://gitpython.readthedocs.io/en/3.1.57/changes.html
https://gitpython.readthedocs.io/en/3.1.56/changes.html
https://gitpython.readthedocs.io/en/3.1.55/changes.html
https://gitpython.readthedocs.io/en/3.1.54/changes.html
https://gitpython.readthedocs.io/en/3.1.53/changes.html
https://gitpython.readthedocs.io/en/3.1.52/changes.html
https://gitpython.readthedocs.io/en/3.1.51/changes.html
To see the details of each release:
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44
For the full comparison changes (1292 commits, 201 files changed), see:
https://github.com/gitpython-developers/GitPython/compare/3.1.43...3.1.58
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Sun, 9 Aug 2026 23:19:02 +0000 (16:19 -0700)]
pypi.bbclass: improve UPSTREAM_CHECK_REGEX
UPSTREAM_CHECK_REGEX was case-sensitive, but PyPI's simple index now lists
lowercase sdist filenames (e.g. gitpython-*.tar.gz) for packages whose
PYPI_PACKAGE is mixed-case (e.g. GitPython).
Added an (?i) inline flag so the regex matches regardless of case — this
fixes AUH detection for python3-git and any other pypi.bbclass recipe hit
by the same upstream lowercase-normalization trend, without needing
per-recipe overrides.
This will not magically fix fetching, but WILL at least mean AUH will
detect more upstream releases and maintainers will see when the
resulting default PYPI_SRC_URI is failing.
A fix for some recipes might be to set:
PYPI_SRC_URI = ""${@pypi_src_uri(d).lower()}"
but it is premature to set that globally, as legacy recipes with
releases before the PEP-625 normalization still exist.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Sun, 9 Aug 2026 23:19:00 +0000 (16:19 -0700)]
python3-git: fix CVE_PRODUCT
Using the pypi.bbclass default CPE of python:GitPython detects no CVEs.
With CVE_PRODUCT = "gitpython_project:gitpython" we properly detect
9 CVEs, with 4 unpatched.
Daniel Turull [Fri, 7 Aug 2026 12:14:33 +0000 (14:14 +0200)]
util-linux: inherit upstream-stable-release-point
util-linux's README ("Stable Branches") documents stable/v<major>.<minor>
branches whose maintenance releases are bug fixes only, so upgrades
within a major.minor are stable point upgrades per the OE-Core stable
release policy (ref-manual, "Stable Point Release Upgrades").
2.42.2 (Jun 16 2026), against 2.42.1 (May 18 2026): 32 commits, all
fixes or hardening -- memory safety (a libblkid use-after-free, two
buffer overflows, a libfdisk GPT fix), privilege tightening
(X-mount.subdir restricted for non-root), diagnostics (fanotify queue
overflow detection) and documentation. No new options or behaviour.
These releases are not picked up on the OE stable branches: util-linux has
had zero point-release bumps on kirkstone, scarthgap or wrynose since each
branch forked from master, leaving them at 2.37.4, 2.39.3 and 2.41.3
respectively. This addresses that gap going forward.
Scarthgap already has v2.39.3, and the 2.39.x stable branch history (mount
API regression fix in 2.39.1, new CPU model support, and libblkid’s bcachefs
handling) demonstrates that util-linux exercises good judgement in managing
stable branches, so we can safely track their stable series there as well.
For the avoidance of doubt it is not a development-series effect either:
util-linux has no development/stable version split, and pre-release work
goes to -rc tags.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Paul Barker [Fri, 7 Aug 2026 11:10:50 +0000 (12:10 +0100)]
ruby: Avoid build-time race condition
The ruby Makefile rule for $(REVISION_H) is always marked as PHONY
when building from a source tarball. This has no benefit,
file2lastrev.rb will just print a warning and exit if we're not in a VCS
checkout, but it can cause problems.
When cross-compiling, the generated file $(arch)-fake.rb is used by
every invocation of MINIRUBY. $(arch)-fake.rb depends on $(REVISION_H),
so it is considered perpetually out-of-date and sub-make invocations
will repeatedly regenerate this file.
There is no enforcement of dependencies between sub-make invocations, so
one sub-make can be running MINIRUBY (and so using $(arch)-fake.rb) at
the same time as a different sub-make is regenerating $(arch)-fake.rb.
Truncating and re-writing $(arch)-fake.rb while it is mmapped by a
running ruby interpreter can cause a SIGBUS error, for example:
i686-linux-gnu-fake.rb: [BUG] Bus Error at 0x00007fee11f02765
No addition of dependencies to Makefile rules can address this. Instead,
we need to stop treating $(REVISION_H) as PHONY when not building from a
git checkout.
[YOCTO #16283]
Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 7 Aug 2026 10:58:19 +0000 (11:58 +0100)]
glibc: remove obsolete parallelism flag handling
Several problems here: the comment refers to PARALLELMFLAGS (which is a
variable in glibc's Makefile) but the actual assignment is to
EGLIBCPARALLELISM, which is an eglibc-ism and thus not respected by
glibc. Thus we were emptying PARALLEL_MAKE and so not actually doing the
build in parallel.
The Makefiles as of glibc 2.44[1] actually build in parallel well using
the standard way to pass flags, so drop all of this logic.
On my machine this has noticable improvements to walltime:
do_compile: 86s -> 44s
do_install: 55s -> 40s
Note that there is a PARALLELMFLAGS variable in the Makefiles, but using
it has marginal gains over not and upstream are looking at removing it
entirely.
Enabling parallel builds exposed some missing dependencies in the
Makefiles, backport submitted patches to resolve the issues.
[1] glibc 7cac99621e ("Makefile: Run the subdirectory recursion in parallel")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Himani Barde [Fri, 7 Aug 2026 07:47:31 +0000 (07:47 +0000)]
libarchive: backport fix for archive_read_append_filter test failure
Backport upstream commit 50b585bb ('append_filter: Use last bidder for
filter') to fix test_read_append_rpm_filter ptest failure.
The archive_read_append_filter() function used a name-based bidder
lookup loop that could fail to locate the correct bidder due to a
desync between the loop index and the bidder array. The fix replaces
this with get_last_bidder() which returns the most recently registered
bidder.
Daniel Turull [Fri, 7 Aug 2026 07:03:33 +0000 (09:03 +0200)]
devtool: upgrade: diff git-log-style changelogs by commit hash
Files like nghttp2's ChangeLog are the literal output of `git log`,
regenerated wholesale on every release. New commits are prepended, so
every existing commit shifts position even though its content is
unchanged. A textual diff sees that shift as removed/added lines
instead of showing just the commits that were actually added.
Diff these files structurally instead: compare commit hashes between
the old and new file to tell moved commits from genuinely new ones,
and report the subject lines of the new commits. Falls back to the
existing line-based diff for changelogs that aren't git-log output.
AI-Generated: Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 7 Aug 2026 07:03:32 +0000 (09:03 +0200)]
devtool: upgrade: call subprocess.run() instead of bb.process.run()
bb.process.run() is intended for bitbake's own use: it wraps subprocess
with logging behaviour and always decodes command output as UTF-8. The
latter makes _run() raise UnicodeDecodeError on files containing
non-UTF-8 bytes (e.g. Latin-1 author names in a changelog), which
_extract_changelog() hits when reading release notes with `git show`.
Call subprocess.run() directly and decode with errors='replace' to
tolerate that. Keep raising bb.process.ExecutionError so the existing
callers and their error messages are unaffected.
AI-Generated: Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Trevor Woerner [Fri, 7 Aug 2026 00:17:44 +0000 (20:17 -0400)]
sdk: fold SDK_TOOLCHAIN_LANGS into SDK_FEATURES
Selecting the toolchain languages for an SDK is the same kind of choice
as selecting any other optional SDK content, so it does not need a list
of its own.
Make "go" and "rust" values of SDK_FEATURES and mark SDK_TOOLCHAIN_LANGS
as renamed so existing settings are reported rather than silently
ignored.
Trevor Woerner [Fri, 7 Aug 2026 00:17:43 +0000 (20:17 -0400)]
bitbake.conf: add an SDK_FEATURES lever
Add SDK_FEATURES, a list for optionally adding features to a standalone
SDK in the same spirit as DISTRO_FEATURES and IMAGE_FEATURES. It only
introduces the variable and its documentation, defaulting to empty.
Markus Volk [Thu, 6 Aug 2026 07:22:22 +0000 (09:22 +0200)]
rust: patch uninative loader into snapshot's self-contained lld
Since Rust 1.90, rustc defaults to using the self-contained lld
linker (lib/rustlib/<triple>/bin/gcc-ld/ld.lld, which execs
rust-lld) on x86_64-unknown-linux-gnu.
This applies to the snapshot compiler used to bootstrap the target
rustc, before the rust.lld/use-lld settings in the config.toml we
generate for the target compiler can take effect. Without patching
these too, they fail to exec on build hosts without a /lib64
compatibility path.
collect2: fatal error: posix_spawnp: No such file or directory
| compilation terminated.
|
|
| error: linking with
`/home/flk/bitbake/bitbake-builds/master/build/tmp/work/x86_64-linux/rust-native/1.96.1/wrapper/target-rust-ccld`
failed: exit status: 1
Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Levi Shafter [Sat, 8 Aug 2026 18:11:51 +0000 (12:11 -0600)]
image_types: make oe_mkext234fs reproducible
oe_mkext234fs() creates ext2/3/4 images with mke2fs and then runs
"fsck -pvfD". Unlike the ext4 partitions produced by wic
(scripts/lib/wic/partition.py), this direct IMAGE_CMD path embeds build
time into the result and is not reproducible:
- mke2fs picks a random directory hash seed, and the fsck "-D" pass
reorders every directory using it;
- mke2fs and e2fsck stamp the superblock mkfs/write/last-check times
with the wall clock.
When SOURCE_DATE_EPOCH is set, apply the same handling wic already uses
for its ext4 partitions:
- export E2FSPROGS_FAKE_TIME and pass a deterministic "-E hash_seed"
derived from SOURCE_DATE_EPOCH (reusing wic's namespace UUID);
- after mkfs+fsck, normalize the superblock time fields with debugfs,
since e2fsck stamps wtime/lastcheck with the current time even under
E2FSPROGS_FAKE_TIME (debugfs takes epochs with a leading '@').
The filesystem UUID is still assigned by mke2fs and is left for the user
to pin (e.g. "-U ..." via EXTRA_IMAGECMD), matching wic where the UUID
comes from the .wks.
Verified with comparison via xdelta3, getfattr, find, debugfs, and
dumpe2fs between two custom builds using the patch against two custom
builds omitting the patch. Builds were successful, and no delta was
observed due to the usage of fsck.
[YOCTO #16110]
Signed-off-by: Levi Shafter <lshafter@elder-tomes.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Trevor Woerner [Thu, 6 Aug 2026 11:58:09 +0000 (07:58 -0400)]
ruby: scrub build host paths from rbconfig.rb for nativesdk too
rbconfig.rb records the flags ruby was configured with, which include the
recipe sysroot, the hosttools directory and the debug prefix map, all of
them paths on the machine that did the build. The recipe removes them,
but only for class-target, so a nativesdk build ships them.
Nothing noticed because nativesdk-ruby has not been installed into an
SDK before. Doing so fails do_package_qa outright:
QA Issue: File .../rbconfig.rb in package nativesdk-ruby contains
reference to TMPDIR [buildpaths]
Move the scrubbing into a function and call it for class-nativesdk as
well as class-target.
Deliberately not for class-native. A native rbconfig.rb names paths
inside the native sysroot, and those are correct: stripping them leaves
the file pointing at the build host's /usr, which breaks every recipe
that builds anything with ruby-native. With the scrub applied to native,
DLDFLAGS becomes
-L/usr/lib -L/lib -Wl,-rpath,/usr/lib ...
and CFLAGS becomes -isystem/usr/include. Nothing packages a native
rbconfig.rb, so there is no reason to touch it.
Richard Purdie [Sat, 8 Aug 2026 15:03:21 +0000 (16:03 +0100)]
python_pyo3: Ensure native recipe sstate signatures work
When a native recipe was added using this class, issues were exposed by the
sstate tests. We need to exclude the SITEINFO_BITS value from signatures
so native sstate has the same signature on 32 and 64 bit.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 8 Aug 2026 14:31:05 +0000 (15:31 +0100)]
mirrors: Disable YP mirrors on autobuilder
The YP mirrors (and hence some bits of kernel.org) are initially populated by the
autobuilder, so having it reference itself creates a log of stress and delay when
things go wrong (such as a missing kernel revision).
Trying to remove those but not the others is hard to maintain, so add a
variable specifically to allow it. Use that variable from the autobuilder
configuration.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The glibc iconv/tst-iconv_prog test uses timeout(1) on the host to
guard against hangs during charset conversion testing. Since timeout
is not listed in HOSTTOOLS, it is unavailable in the Yocto build
environment, causing the test to fail with exit code 127 (command not
found) instead of the expected conversion error code.
Richard Purdie [Sun, 9 Aug 2026 05:33:10 +0000 (05:33 +0000)]
python3-setuptools: upgrade 83.0.0 -> 84.0.0
https://setuptools.pypa.io/en/latest/history.html
v84.0.0
=======
Features
Newline-separated keywords and platforms, which are invalid and corrupt the generated metadata
(pypa/setuptools#4887), are now handled forgivingly: each line is treated as a separate item and
a deprecation warning is emitted. Newlines were never a valid separator for these fields – the
old specification separated items with spaces and the current one uses commas. (#4887)
Extension is now a dataclass, exposing type annotations for its constructor arguments so subclasses
(e.g. in Setuptools) can inherit them without redeclaring each parameter. Passing unknown keyword
arguments is now deprecated. (pypa/distutils#373) (#5022)
The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the
distutils root logger, part of decoupling the compilers package from distutils. The logger names are
normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a
standalone compilers.C distribution. (#5266)
The C compilers gained a Compiler.call method – a thin wrapper over subprocess.check_call (with macOS
deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no
longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or
distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are
vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly
on the standard library (os.makedirs/shutil.move). The methods are retained for backward
compatibility. (#5267)
The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or
distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw)
now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup
in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version.
distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility
rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its
own decoupling.) (#5268)
The compilers now read their build configuration from the standard library’s sysconfig instead of
distutils.sysconfig. Per-compiler customization – previously distutils.sysconfig.customize_compiler
– has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler
applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual
CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained
as a thin wrapper that calls compiler.configure_system(). (#5269)
Bugfixes
The MSVC linker now passes its arguments through a response file when the command line would exceed
the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC,
but cc1 rejected the bare form when building 32-bit extensions with -m32. – by @dchaudhari7177 (#4873)
copy_file now preserves the full precision of the source’s modification time, so a copy is no longer
considered older than its source on filesystems with sub-second timestamp resolution.
(pypa/distutils#379) (#5079)
Setuptools wheels no longer bundled the project’s own test modules. – by @itscloud0 (#5212)
build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now
provides a no-op initialize() that non-MSVC compilers inherit. (pypa/distutils#399)
Improved Documentation
Clarified what “correspond exactly to the directory structure” means in the packages section of the
Package Discovery user guide. (#4109)
Documented how bdist_wheel’s py_limited_api option controls abi3 wheel tagging for extension modules –
by @Himanshuagrawal4 (#4741)
Deprecations and Removals
Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions;
spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The
MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils
before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin
wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches
PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers
to which it applied). (#5267)
Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter’s configured value now
raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS
dep loyment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a
packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the
transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the
["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it
into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
The compilers now define their own exception vocabulary instead of borrowing distutils’ framework errors.
Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at
distutils.compilers.errors, leaving room for future compilers.<language> siblings; the
C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors.
The compilers now raise compilers.errors.PlatformError where they previously raised
distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib
FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones
(CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error,
code catching it (as distutils’ top-level handlers do) still catches the new PlatformError. (#5270)
customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve
to strings, raising AssertionError if any are unexpectedly None rather than failing later with a less
clear error. (pypa/distutils#363)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 9 Aug 2026 05:59:55 +0000 (05:59 +0000)]
libmicrohttpd: upgrade 1.0.9 -> 1.0.10
Source: ChangeLog
Fri Aug 7 10:15:01 PM CEST 2026
Fix race in thread-per-connection mode on wake-up signal
between daemon and thread that could result in lost wake-ups
and thus connections that did not finish processing.
Fix rare assertion failure in relation to suspend-and-resume
processing (harmless if assertions were turned off).
Releasing GNU libmicrohttpd 1.0.10. -CG
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 9 Aug 2026 05:49:04 +0000 (05:49 +0000)]
libffi: upgrade 3.7.1 -> 3.8.0
3.8.0 August-8-2026
Add FFI_TYPE_VECTOR (SIMD) type support with libffi-computed
layout, for aarch64 and x86-64 (#1000, closes #773).
Add ffi_call_plan_size to report the total memory a reusable call
plan owns, for embedders that account for the memory held by
long-lived plans.
Add powerpc64 ELFv2 _Complex long double support for both
IBM-128 (double-double) and IEEE-128 formats (#1003, closes #1001).
Fix powerpc64 big-endian ELFv2 closures returning 5-, 6-, or
7-byte structs: missing return jump-table entries produced a
wrong result and leaked a libffi code pointer.
Fix ia64 return-value jump-table desync after the FFI_TYPE_LAST
bump, which corrupted small-struct and HFA returns.
Fix powerpc Darwin closure returns broken by #951 (#1002).
Return small (1, 2, 4 or 8 byte) structs in registers on the i386
FreeBSD and OpenBSD targets, matching the platform ABI and
fixing a segfault on struct returns through ffi_call and closures.
Cache the static trampoline "unsupported" result on hosts whose
page size exceeds the trampoline table mapping, avoiding
redundant re-initialization on every closure allocation
(e.g. 64K-page aarch64).
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 8 Aug 2026 05:56:21 +0000 (05:56 +0000)]
python3-vcs-versioning: upgrade 2.2.3 -> 2.2.4
- Speed up jujutsu version inference in large repositories.
The jj backend filtered whole-ancestry revsets with `empty()`, which makes
jj diff every commit in the history and took minutes on large repos. The
scan for the newest real commit is now bounded to the most recent
generations, distances are counted without the filter, and the working copy
is snapshotted only once per run (later queries pass
`--ignore-working-copy`).
As a side effect distances now match `git describe --long`: merge commits
count even though jj considers them empty. ([#1477](https://github.com/pypa/setuptools-scm/issues/1477))
- Improve reproducibility of scm_file_list.json ([#1488](https://github.com/pypa/setuptools-scm/issues/1488))
- Route the hg-git tag mismatch warning through the module logger instead of the root logger. ([#1489](https://github.com/pypa/setuptools-scm/issues/1489))
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 8 Aug 2026 05:24:27 +0000 (05:24 +0000)]
python3-pycairo: upgrade 1.29.0 -> 1.29.1
1.29.1 - 2026-08-07
-------------------
* Update dependencies (libpng, zlib) for the Windows wheels :pr:`442`
* Fix documentation build with Python 3.15 :pr:`441`
* Build wheels for Python 3.15 (except for 32bit Windows) :pr:`444`
* Fix a memory leak in :meth:`ScaledFont.text_to_glyphs` :pr:`446`
* Fix some minor reference leaks :pr:`447`
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 7 Aug 2026 10:57:28 +0000 (11:57 +0100)]
fontconfig: upgrade 2.18.2 -> 2.18.3
Abridged upstream changes:
- fc-cat: exit with non-zero if not successfully done
- Workaround a longstanding use-after-free warning
- Fix a null pointer dereference
- Add Noto Sans as system-ui for fallback
- Drop Noto Sans CJK KR from 60-nonlatin.conf
- Correct sat.orth
- Add an orth file for Balinese
- Update orth files for jv, so, su, tl to use native scripts
- Add orth files for scripts used by Noto font families
- Update mni.orth to use Meetei Mayek script
- Add orth files for Cuneiform languages (akk, sux, hit)
- test: Add cache format compatibility tests for orth file additions
- Add orth files for ancient scripts (xna, hlu, ecy)
- fc-cache: Create backward-compatible cache symlinks for cross-version discovery
- Add implicit rule to update genericfamily property against syntactic-sugar
- fc-genconf: Use alias syntactic-sugar instead of the pair of test-edit config
- Allow to limit the targeted family for TTC
- test: Fix test_genconf.py to avoid unexpected family name in testing conf
- test: Fix compiler warnings
- fc-fontations: Allow unnecessary_transmutes lint in bindgen-generated Rust code
- Fix another compiler warnings
- Fix the compiler warnings on MinGW
- Fix "FileType is deprecated"
- Fix unknown type name locale_t on macOS
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
d9da609 project: preserve -c optimization when revision is a SHA-1 4bec297 command: Respect smart sync override declaratively by default 54fa31c project: derive HEAD fallback from git's own default branch 29b6630 project: make GetHead file-read fallback reftable-aware 0b82311 sync: allow syncing groups with repo sync -g group 06c4f9e git_superproject: don't filter rewritten manifest dd11303 sync: Deprecate fetch-submodules flag names eeba6f2 hooks: pass yes flag when available 1729aae project: Skip superproject upstream check for MetaProjects 978adb7 sync: Add CLI flag for globally disabling submodule fetch 0398c67 color: Replace anonymous sentinel with named class 3bb4871 rebase: Resolve revisionExpr to tracking branch for --onto-manifest
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oe-selftest: devtool ide-sdk: wait for lldb-server readiness
The generated MULTI preLaunchTask starts lldb-server on the target and waits
for its TCP port to appear before its SSH command completes. The selftest
bypassed that contract by starting SSH in the background, sleeping for one
second, and only checking that lldb-server appeared in ps. On a loaded
autobuilder this allowed lldb --batch to connect before lldb-server had bound
its listening socket.
Run the generated preLaunchTask SSH command synchronously before lldb --batch.
This follows VS Code's foreground-task behavior and leaves listener readiness
and timeout handling in _target_start_cmd(), where the server is started.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Start lldb-server in the target background, record its PID, and wait for
the listener before the generated MULTI pre-launch task returns. This
ensures a client can connect only after lldb-server is accepting
connections and preserves timeout cleanup.
Move reusable TCP listener checks and bounded wait generation into
DebuggerCrossConfig to make it reusable for GDB as well.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
python_pep517.bbclass: export _PYTHON_HOST_PLATFORM to match our cross-compile target
When the _PYTHON_HOST_PLATFORM environment variable is unset, the value falls
back to the build host architecture, therefore, python wheels get an incorrect
platform tag, setting it as an empty value is also not allowed on python > 3.14.
Set _PYTHON_HOST_PLATFORM as HOST_ARCH dependent so bitbake correctly tags wheels
depending on our cross-compile target, fixing reproducibility issues.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ptest.bbclass: strip build machine triplet from installed ptest Makefiles
do_install_ptest_base already rewrites HOSTTOOLS_DIR and WORKDIR
references out of installed ptest Makefiles, but automake-generated
Makefiles (as shipped by strace-ptest, gnutls-ptest and others) also
carry six autoconf-generated variables that encode the *build
machine*, not the target:
Those values differ across autobuilder workers (typical values are
build=x86_64-pc-linux-gnu, build_alias=x86_64-linux, build_vendor=pc),
causing corresponding -ptest packages to fail the reproducibility
selftest.
Add sed rules to blank the RHS of each of those assignments, plus the
matching automake helper lines `set build_triplet` and
`set build_alias`, and extend PTEST_BUILD_HOST_FILES to include
site.exp (also autoconf-generated with the same variables).
Verified locally: before this change strace-ptest carried
`build_triplet = x86_64-pc-linux-gnu`, `build = x86_64-pc-linux-gnu`,
`build_alias = x86_64-linux`, `build_cpu = x86_64`,
`build_vendor = pc`, `build_os = linux-gnu`; after this change all six
lines have an empty RHS.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtool: strip build system triplet from installed libtool script
The installed /usr/bin/libtool script sourced by any recipe that
inherits libtool contains build_alias=, build= and build_os= lines
populated by config.status with the *build machine's* triplet
(e.g. build=x86_64-pc-linux-gnu, build_alias=x86_64-linux). Those
values vary between autobuilder workers whose config.guess reports
different vendors or OS strings, which makes libtool.rpm non-
reproducible across the autobuilder pool and shows up as a diff in
the reproducibility selftest.
Extend the sanitising sed in remove-buildpaths.inc to blank those
three lines the same way the existing rules blank sysroot and
build-path references.
Verified locally: before this change the installed libtool contained
`build_alias=x86_64-linux`, `build=x86_64-pc-linux-gnu` and
`build_os=linux-gnu`; after this change all three lines are empty.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
lttng-tools maintains a branch per minor series (stable-2.11 through
stable-2.16) and tags point releases from it, releasing from more than one
at a time: 2.14.2 and 2.15.1 went out the same day. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades"). There is no written
policy document, so qualification rests on the branch structure and the
release contents below.
Upstream keeps a ChangeLog with a per-release entry list, and all 48
entries for 2.15.1 (Jun 05 2026, against 2.15.0 in February) are fixes,
tests, documentation or refactors. Seven address machine interface output
alone; the rest cover a consumerd lockfile fd leak across fork+exec, a
missing default kernel probe entry, an uninitialised read in uri_compare,
a musl compatibility fix, popt error handling, test fixes, and one
refactor preparing the CPU-mask escaping fix.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone took 2.13.4 -> 2.13.8 and 2.13.8 ->
2.13.9, scarthgap 2.13.11 -> 2.13.13. wrynose has taken none and sits at
2.14.1.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:34 +0000 (16:11 +0200)]
sqlite3: inherit upstream-stable-release-point
SQLite cuts a per-minor maintenance branch for each release series,
branch-3.53 matching the current PV alongside branch-3.52, -3.51 and
-3.50, and tags patch releases off it. Superseded branches keep receiving
them: 3.44.5 and 3.42.1 were released in mid-2025, long after 3.50 was
current. So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked the whole current series. 3.53.1 (May 05 2026) through 3.53.4 (Jul
24 2026) are almost entirely memory-safety and corruption-handling fixes:
five out-of-bounds reads, two buffer overreads or overwrites, two integer
overflows, hot-journal rollback with a zeroed super-journal record, safer
double-to-int64 conversion, and mutex acquisition added to a batch of
sqlite3_* entry points. 3.53.0 (Apr 09 2026) opens the series and does add
API surface, confirming X.Y.0 bumps must stay outside the regex.
Two additive exceptions in 3.53.4, neither touching the core library ABI:
the SQLITE_SHELL_EDITION compile-time option for the CLI, and
sqlite3_intck_register() in the incremental integrity-check extension.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.38.2 -> 3.38.3 -> 3.38.5 and
scarthgap 3.45.1 -> 3.45.3. wrynose is at 3.51.3 with no in-series bump
yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:33 +0000 (16:11 +0200)]
libgcrypt: inherit upstream-stable-release-point
libgcrypt keeps a long-lived maintenance branch per minor version,
LIBGCRYPT-1.12-BRANCH matching the current PV with equivalents back to
1.2, and releases from several in parallel: in one week of April 2026 it
released into four of them, 1.12.2 and 1.8.13 on the 15th, 1.11.3 and
1.10.4 on the 21st. So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
NEWS separates "Bug fixes" from "New and extended interfaces", and neither
point release in the current series has the latter section at all: 1.12.2
(Apr 15 2026) is four fixes, including an ECDH buffer overwrite and a
missing Dilithium bounds check, and 1.12.1 (Feb 20 2026) four build or
arithmetic regressions. 1.12.0 (Jan 29 2026) opens the series and does add
features, confirming X.Y.0 bumps must stay outside the regex.
The libtool version-info in each NEWS heading is upstream's own ABI
record, and across the current series only the revision moves. One
deviation is worth disclosing from the previous series: 1.11.2 adds a
single enum constant, GCRY_KEM_RAW_P256R1, with current and age
incremented together so it stays backward compatible. Point releases here
are fixes-focused rather than absolutely fixes-only, with the deviation
bounded to additive constants.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: scarthgap took 1.10.3 -> 1.10.4, which needed a
build fix backported alongside it because 1.10.4 broke building with -O2
in the sysroot path. kirkstone has taken no in-series bump and stays at
1.9.4.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:32 +0000 (16:11 +0200)]
binutils: inherit upstream-stable-release-point
binutils cuts a per-X.Y stable branch, binutils-2_46-branch for the
current series, that takes only bugfixes and backported CVE fixes, and
tags X.Y.Z (Z>0) releases from it. Superseded branches stay alive: one x86
MODRM fix landed on the 2.40, 2.42 and 2.43 branches on the same day in
May 2025. So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades"). This is not spelled out in a policy document, so qualification
rests on the branch structure and the release contents below.
Checked the last two point releases. 2.46.1 (Jun 08 2026) is 137 commits,
mostly automatic version-string date bumps, with six substantive changes,
all fixes: gprof testsuite, build warnings, an sframe encoder/decoder
call-site fix, a DOS-filesystem fix and two linker fixes. 2.45.1 (Nov 10
2025) is aarch64/gas fixes to incorrectly restricted instruction
encodings, linker metadata fixes adding GLIBC_ABI_*_TLS version
dependencies to match glibc's own ABI tags, and libctf, strip and warning
fixes. Neither adds options or instruction support.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone has five or more "binutils: stable
2.38 branch update(s)" commits staying within 2.38.x, scarthgap the same
for 2.42.x, and wrynose has already taken 2.46.1.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:31 +0000 (16:11 +0200)]
openssl: inherit upstream-stable-release-point
OpenSSL's release strategy states that patch releases contain only bug and
security fixes, with no new features and no API or ABI breaking changes.
It maintains several series at once: 3.0.21, 3.4.6, 3.5.7 and 3.6.3 were
all released on 2026-06-09, with 4.0.0 already out. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades").
Checked the last three point releases. Each is labelled "a security patch
release" in its own NEWS.md header, and every entry is a CVE fix, the item
count matching the unique CVE count exactly: 15 CVEs in 3.5.7 (Jun 09
2026), 7 in 3.5.6 (Apr 07 2026), 12 in 3.5.5 (Jan 27 2026).
When a series reaches EOL the regex must be moved to the next maintained
series by hand, as that is a feature-level change.
One limit is worth stating, from this recipe's own history: 3.2.4 -> 3.2.5
was refused on scarthgap in July 2025 for intermittent ptest failures in a
dependent recipe, bisected to an upstream commit and reported upstream,
and the branch went to 3.2.6 instead. A fixes-only release can still fail
to integrate, so proposing an upgrade is not the same as it passing.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.0.2 -> 3.0.19 on the 3.0 LTS series;
scarthgap 3.2.1 -> 3.2.6 then, at EOL, 3.5.5 -> 3.5.7; wrynose picked up
3.5.7.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:30 +0000 (16:11 +0200)]
python3: inherit upstream-stable-release-point
Python maintains each release series on a per-minor maintenance branch
that, once released, takes bug and security fixes only, and it releases
from several at once: 3.10.20, 3.11.15 and 3.12.13 all went out on
2026-03-03, after 3.14.3. So upgrades within a major.minor are stable
point upgrades per the OE-Core stable release policy (ref-manual, "Stable
Point Release Upgrades").
Checked the last three point releases by category, since these are
substantial bug-fix releases rather than security-only. 3.14.6 (Jun 10
2026) has 8 Security, 32 Library and 17 Core entries; 3.14.4 (Apr 07 2026)
has 5, 59 and 46. Every C API entry in both is a fix, so neither adds C
API. 3.14.5 (May 10 2026) is mostly fixes but does add RFC 9309 support to
urllib.robotparser -- one extra capability in one module, touching neither
the language, the C API nor the stable ABI.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.10.4 -> 3.10.20, scarthgap 3.12.3 ->
3.12.13, wrynose 3.14.4 -> 3.14.6.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:29 +0000 (16:11 +0200)]
libxml2: inherit upstream-stable-release-point
libxml2 maintains per-minor stable branches (2.9 through 2.15) that take
only bug-fix micro releases, and releases from several of them in
parallel: 2.13.9 and 2.14.6 went out the same day, after 2.14.5 was
already out. So upgrades within a major.minor are stable point upgrades
per the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked the last three point releases. 2.15.3 (Apr 15 2026) is five
security fixes plus an "Improvements" section that is also entirely fixes,
and 2.15.1 (Oct 16 2025) is security, regression and build fixes. 2.15.2
(Mar 03 2026) is five CVE fixes plus one addition, a --xpath0 option
confined to the xmllint command-line tool.
A public-header diff across the three shows zero added, removed or changed
libxml2.so declarations, so the library API and ABI are unaffected by that
addition.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone picked up 2.9.14, scarthgap 2.12.5 ->
2.12.10.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Benjamin Robin [Mon, 27 Jul 2026 08:34:30 +0000 (10:34 +0200)]
spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
If a kernel recipe is using a tar file instead of git repository, it is
necessary to override `S` to point to the unpacked tar archive.
In this case `${S}` is not going to be in work-shared. So we must handle
this case in get_patched_src() to ensure that the kernel is extracted in
the following path: `${SPDXWORK}/${BP}`.
For a full detailed analysis see [1], but in summary this change is
necessary because:
- In `save_debugsources_info()` the sources are extracted from the debug
symbol. For the kernel Linux the source file path is modified to look
like `${BP}/init/main.c` (`${KERNEL_SRC_PATH}` is replaced by `${BP}`).
- In `get_patched_src()` the sources of the recipe are extracted (again)
in a sub-directory of `${SPDXWORK}`. If `${S}` is in work-shared and if
the recipe inherits the kernel class, then the sources are extracted in
`${SPDXWORK}/${BP}`.
- In `add_package_files()`, with topdir equal to `${SPDXWORK}`, all the
files (recursively) found in topdir are listed. For each source file,
if the file path (relative to topdir) is in the list of source files
retrieved by save_debugsources_info, then the file is added to the SPDX
SBoM.
- If we are using a tar archive, `${S}` is set for example to
`${UNPACKDIR}/linux-${PV}`, so in `get_patched_src()` the sources are
extracted in `${SPDXWORK}/sources/linux-${PV}` since
`UNPACKDIR = ${WORKDIR}/sources`. `${BP}/init/main.c` is not in
`${SPDXWORK}`, but `sources/linux-${PV}/init/main.c` is.
Benjamin Robin [Mon, 27 Jul 2026 08:34:29 +0000 (10:34 +0200)]
spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
This change will affect the SPDX output: the source file path will no
longer be prefixed by `sources/`.
The rest of the changes are safe because:
- `S` should reference `UNPACKDIR` and not directly reference `WORKDIR`.
- After analyzing all public layers, no `do_unpack()` or `do_patch()` was
found to reference the `${B}` variable. The comment mentioning the
`${B}` variable traces back to [1] (though no further explanation was
provided).
Additionally, this ensures proper capture of sources if the recipe
modifies `UNPACKDIR` outside of `WORKDIR` (though such cases should be
rare).
With these changes, SPDXWORK is no longer a working directory which is
"temporary" replacing WORKDIR, it is now a "temporary" directory containing
unpacked source files.
The run.do_patch.XXXX and associated files are now stored in ${WORKDIR}/temp.
The behavior remains unchanged:
- Instead of saving and restoring the values of various variables, use a
copy of the data store via `d.createCopy()`. This prevents side effects
for other tasks.
- This allows removing the `try ... finally` block.
- The function `is_work_shared_spdx()` no longer needs to be called twice.
- In the work-shared case, there is no need to modify `WORKDIR` since no
task is executed from that branch.
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch 18 adds an option to replace the interpreter in the tzselect
script from /bin/bash to whatever KSHELL is set to. However, patch 19
directly changes the interpreter to /bin/sh so this functionality never
works.
This is further cleanup based on a previous commit removing the KSHELL
assignment[1].
Ross Burton [Thu, 6 Aug 2026 16:27:28 +0000 (17:27 +0100)]
cross-localedef-native: prune patch list
The cross-localedef-native recipe builds on top of glibc and drops in an
autoconf tree to build just localedef. For some reason we're applying a
partial subset of glibc patches that do not impact the localedef build
at all, for example adding documentation or fixing nscd.
Remove patches and other assignments that don't impact the build of
localedef.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-fh_key_file.c-Fix-build-error-for-musl.patch (fixed upstream).
Add patches to fix build failures:
- Fix link error with --disable-nfsdctl (undefined reference to
nfsd_nl_cmd_str)
- Fix musl build (missing stddef.h for offsetof in getport.c)
Both reported to linux-nfs@vger.kernel.org.
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Thu, 6 Aug 2026 09:14:41 +0000 (11:14 +0200)]
systemd: upgrade to 261.2
Drop two backports that are already in the new version
Changelog for systemd: 261.1 -> 261.2
4925d9f07f meson: bump version to 261.2 70cc4f3d72 escape: reject UTF-16 surrogates in \u escapes in cunescape_one() (#43079) a7bce5b205 homed: verify privileged worker changes f62b9ce4ed man: document that ExitType=cgroup is rejected for Type=oneshot 24ca862cf7 man: update the sample glib/sd-event integration 28c374ef1c man: document unlocked as default IMDS network mode 1192084871 sd-device: allow non-safe characters in uevent files dbfd5d2789 hwdb: classify PlayStation controller audio as controller form-factor 41932924a4 hwdb: strip the root from filenames when generating hwdb.bin 089099b924 man/network: fix default value for RequiredFamilyForOnline= ff395a8c2a hwdb: add debug logging for the output filename 26f3717e27 core/dbus: do not block the manager on GetId during bus (re-)connection dc225cc553 boot: cover BCD offsets past the buffer d8cdc4ee79 password-quality-util-passwdqc: restore password-quality-util.h include 598273bb05 systemd-imds-generator: fix import docs b9a65cb1ba creds: reject empty validity intervals 5158952f96 dissect: include image size in JSON output d4ea8a3061 repart: skip generated files during dry runs eeb244e82c firstboot: validate root shell credentials 431c436a53 sysusers: validate shell credentials d3ebe51c6a docs: clarify scope of portable services c6fc821265 repart: fix varlink description string 484aee1528 network: silence false warning about unitialized variable ef3e2271bd id128: reject app-specific IDs for new 2edfcce6b0 rm-rf: downgrade root check log when directory doesn't exist caa3df83b3 rm-rf: use faccessat instead of fstatat 180baee67d repart: log allocation failure at debug level in Varlink service mode b83eac6ac0 repart: report the actual block device size in currentSizeBytes a315a8afca portable: honor --force for directory extensions 0e4bb54915 portabled: apply pool limits to portable images bcc187363a portablectl: normalize set-limit image paths bf5bf89bd4 portablectl: normalize remove image paths 81e6878669 portable: keep unit symlinks inside the image 4f7c9b77ae portablectl: normalize read-only image paths e67b1bfaf5 portablectl: keep inspect --force unit metadata b05d2790a2 hwdb: update to main@{2026-07-17} b456963bec obs: disable Tumbleweed too 43c416bcd6 units: properly wait for swtpm to finish before the initrd transition b2f01dfed1 units: harden systemd-tpm2-swtpm.service a4badd74aa tpm2: stop the software TPM before the ESP is unmounted on shutdown 160d4f1259 tree-wide: get rid of backslashes in file names 8467a27870 nspawn: use chase() for creating dev nodes c889bcb737 nspawn: log at error level before exiting if parsing OCI fails fe3dbfdf7f boot: fix MEMMAP_DEVICE_PATH EndingAddress field calculation 870d718006 Rebased and reapplied the fix, dropped the test case. 7aa2da940f discover-image: don't ignore symlinks to raw images d392d17143 homed: fix verification of local identity file eb24d74627 machined: Allow user ids in open_shell for machine-dbus c6138ffbdc udev-util: bound leading whitespace skip in udev_replace_whitespace f4c528cb06 string-util: add strnspn() f767359875 sysext: validate work directory metadata before removal 4529bb61d9 shift-uid: close consumed directory fds on early return 9033eae9af rm-rf: fail closed when the root check fails c63b37c0f0 vconsole: reject empty layout during keymap conversion with error fd01077f17 resolved: preserve unchanged question on asymmetric redirect 350d79015d journal-remote: zero-initialize MHD daemon wrapper bd45f60193 journal-remote: remove disabled compression entry before freeing 91796f82de network: cancel netlink calls for detached requests edd08edfe2 network: compare all multipath route nexthops 742bdbb0ea tpm2-util: keep the measurement log's torn-write marker intact 170dab0fe9 journalctl: reject field listing with filters 5e150d2eb5 test: make NSS IPv4 tuple bounds explicit 17dfd608f5 oci-util: Don't fall back to default registry for explicit registries 92ea6ed698 boot: guard missing Windows auto entry 19ce494c58 journalctl: use root machine ID for namespaces 5ab9b61004 tpm2-util: initialize NvPCRs on first extension 6f10261eef sd-dhcp-relay: fix off-by-one when discarding BOOTREQUEST messages by hops count 56958bd945 boot: downgrade EFI_MEMORY_ATTRIBUTE_PROTOCOL warning fdd3966f56 sysupdate: use strverscmp_improved() like everywhere else 2c219d2f09 timedatectl: display RTCTimeUSec in UTC format aa10c21092 network: do not use assert() on a call with side effects 8e10f5f229 dissect-image: don't assert() on partition geometry from blkid 20140670a5 homework-luks: add new key slots before destroying old ones ff4298e73b pull-oci: switch assert() to assert_se() for set_remove() call b5c0959d45 copy: avoid following fifo/node chmod target cb25da37eb log: add upper bound to journal iovec accounting a09c3c523d string-util: add upper bound to ellipsize_mem UTF-8 walks c8e6b02ce6 test: Remove a redundant exit call ddc90bf66c sysupdate: Downgrade an info to a debug log message c8dabc7a90 man: update gpt-auto-generator ESP mounting behavior b8a1d98873 repart: Properly pre-calculate auto size of images 2d75ade520 id128: honor json output for single ids c3ce4a403d boot: allow BCD fields to end at buffer limit e42a4b8be7 portablectl: retry inspect with PORTABLE_PREFIXES 1b23cedff3 string-util: introduce STRING_FILENAME_PART flag for string_is_safe() 87983793db string-util: add STRING_DISALLOW_WHITESPACE for string_is_safe 14648c131e dns-answer: preserve shared aliases when removing records faa89f2c7d resolved: roll back partial DNS zone publication 856f2c88b7 man: clarify that --when= is a lower bound, not a condition 72816231de boot: skip boot counter logic for entries marked read-only 848532980f boot-secret: don't initialize secret mixin file if marked read-only 4c27b10f7f boot: skip random seed handling if seed file is marked read-only eab3959fee run: reject waiting for remain-after-exit services cdc7b3c086 run: reject JSON output with verbose logs c6750b6267 run: reject JSON output in scope mode 1e4abaa22c run: reject JSON output for trigger units 53947cf5a3 run: reject JSON output with stdio forwarding abe01e1a8c run: accept explicit trigger unit names 2e5787eb75 run: reject --ignore-failure in scope mode 3e93ac6e17 run: honor --no-block for trigger units 8f4aa23791 repart: Fix growing the partition preceding a FreeArea from leftover space 6a2db11e2e timer: avoid re-arming WakeSystem=yes timer after suspend 61ed8f7147 resolved: publish browsed service after initialization 49f3d283fd libudev: replace unique list entries in place 48161d0f85 udev/net: reset the config list head in link_configs_free() 3c0f875c76 repart: Don't copy trailing padding when using --copy-from= 377c4e1001 repart: Clarify and test that --copy-from= argument respects grain size 293e44cb09 repart: Don't get old grain size from fdisk for --copy-from= 15b672e8a5 udevadm-trigger: reject invalid wait-daemon timeout 461c203676 udev-config: merge configured children max af2e46c389 man/udevadm: update device-id-of-file arguments c9c847e23d udevadm-settle: reject positional arguments feb767cb60 udevadm-wait: let --removed override initialization 400b796c81 udevadm-info: allow valueless attr filters ac6eb48563 udev: avoid reading before empty capability masks 32fc32a92f test: TEST-89: assert ifindex=0 browse does not flap 72cb20049e ci: check 'update-man-rules' to ensure it is not forgotten e445b27491 resolved: fix spurious BrowseServices add/remove flapping with ifindex=0 8ac83d4f6c nss-myhostname: keep IPv6 probe result stable a6bd0815f5 creds: tolerate TPM2 seal failure in auto mode af1a5b4566 ndisc: reject non-zero ICMPv6 codes in parsers 9d34967b4f pull-oci: verify redirected manifest digest 69a4065ae0 efivars: fix concurrent growth read accounting ebbad7adc9 network: do not regenerate MAC address if already set by userspace 5e1295cb08 obs: explicitly disable Ubuntu/i586 builds f1c1f93118 udev: require exact builtin command matches a7ca71c5a4 include: add hwcaps missing from glibc and musl 7bb32fdcee nspawn-oci: match the spec-correct "swappiness" memory field key 7ac32985fe udevadm-info: handle missing data db cleanup 1da0209142 udevadm-control: reject oversized children-max eca88a543b udev-rules: drop truncated import output line 76f014a083 udevadm-hwdb: honor root when querying ab9695a0b1 udev-rules: accept cvm CONST matches 5df1e9d9f4 import: drop redundant oci-util.c from sources 735ac821c8 dns-configuration: make dns_scope_free() static f36fa3cd91 creds: Use ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR a5231d9ace cryptsetup: Give NV index missing its own error code 5713f1e55e cryptsetup: Skip tokens with JSON parsing errors e8660577a4 cryptsetup: Reduce log level for TPM mismatches 9ccec8367c cryptsetup: Remap bad PCR set early to EPERM 70eb48e1a4 TEST-70-TPM2.cryptsetup: Make sure we iterate over foreign tokens 2424b89f5e tpm2-util: Also report EREMOTE if key is for different parent template 6ff4b985ac tpm2-util: For NV index errors report EREMOTE to be able to continue 793efd3553 tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys 96cc8eecb7 cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match 4d229c8d85 cryptsetup: Report mismatching TPM token error separately 0bd3d0c2e2 stub: Set up all detected consoles a047e14bc8 mount-util/sysext: Clone sub mounts as private to preserve nested ones 2d4b465561 mount-util: Compact list of sub mounts after dropping 434d6e0274 core: make `/run/systemd/first-boot` available earlier df771b177b sysupdate: handle slashes after pattern fields 43a450377b tree-wide: fix some double word errors like "the the" 3b3b4692a8 core: connect to sockets in credential directories 42060d2c30 pcrlock: handle piped PE input 2073a33f0d dissect: do not follow copy-to directory symlinks 86931d2563 stub: Prefer graphical console over virtio detection heuristic 94d7796aef logind: set session->started before seat_read_active_vt() call 723b35b584 journal-remote: do not create /var/log/journal/remote c76ae7a879 mkosi: update arch commit reference to f884cb080300eeb273fb7549fd0aa19bb6142c21 a955daf063 efi-api: validate boot option device path lengths b82a9f9f53 dns-rr: invalidate wire format after changing ttl 872ad58935 tmpfiles: add hardening in glob_item_recursively c4e5f003ed resolved: honour per-link DNSOverTLS=yes for certificate verification 4cff7ce255 sd-event: use CLOCK_BOOTTIME for rate limits bcabc25eb6 creds-util: log when we remove a secret from a different machine 050ff0d62b sd-device: check fd validity before using in sendmsg in test dd01b5bd60 dns-rr: fix SOA JSON fields d51dd5a655 fsck: don't apply invalid mode or repair values c4e0899385 bootctl: Fix prepend when installing systemd-boot for the first time fc4658bc0a sd-bus: voidify bus_match_remove call 9ec5d452f2 measure-smbios: bound type 1 length before zeroing wake-up type ac406e3232 gitignore: add .envrc, .direnv b8522c506f portable: fix marker_matches_images() and propagate errors correctly 138467290f journald: replace existing syslog event source before reopening 626c57b9ba journald: pin the sending client's context across native message dispatch 60cba9ebf8 portable: detect drop-in-only attachments 706c4491ce sbsign: write unaligned signature size into WIN_CERTIFICATE header 775a9e171b pull: honor sync for OCI artifacts 8201bf6977 copy: keep replaced target after publish errors 675f4b0b06 mkosi: update fedora commit reference to 57cbcf979ce2dd872a871c59e87d2c65dfa996e6 589ba40e97 mkosi: update fedora commit reference to 45c16dd369c961b70664e473552def34d5469664 9e41763ec9 resolve: anchor the service browser from mDNS maintenance queries 4744ed0712 network: implement refcounting for SR-IOV objects 0c65971685 udev: clear event back-pointer when freeing a worker c6d35bf4cb sd-bus: drop half-registered vtable members on failure 4a895ab034 sd-bus: re-check match_callbacks_modified in the argNhas value loop c01e2dff1f sd-netlink: disconnect the slot on async/match error paths 9d9774050f network: initialize dot_servers before CLEANUP_ARRAY 16b5fcfa0d udev: track remaining buffer size across $links devlinks 10bc41033c sd-device: avoid 32-bit overflow in the monitor properties bounds check 99d7c6743a hashmap: honor the value destructor in set_ensure_consume() 5867697d6e sd-device: bound the tag filter BPF program size 0826a4a15d logind: drop the seat from the GC queue after draining its devices d65875951e logind: cancel long-press timers when the Button is freed b6a6963e78 logind: don't free live SessionDevice on duplicate TakeDevice 40467642bd boot: require a minimum PE optional header size in verify_pe() b16364d0df boot: restore parent loaded image when initrd registration fails b2644bfe8f boot: restore RW/RO memory attributes on every error 23741dcd57 boot: check PE section against SizeOfImage 0f3dd7ab02 boot: bound PE section VirtualSize before zeroing the inner kernel 1dbedeef33 boot: reject inner kernel entry point outside the image ec6c9360b7 boot: don't unquote an empty value in line_get_key_value() 3b32f046f0 boot: initialize return parameters on zero-length EFI variable read e62dc3e2bf boot: make device_path_next_node() robust against malformed zero-length nodes 0b59b1bd1f test-socket-util: convert to new ASSERT macros 313edfcb48 meson: merge two libelf-related clfags dependencies 30d63ed089 meson: merge three glib cflags dependencies 8e34addf1a meson: do not pass space-separated list of libraries ab892b3e1f meson: use tpm2_cflags dependency rather than tpm2 93f26c6c5d pull: introduce pull-forward.h 2a08e8cb08 sysinstall: Look for valid kernel image before installing e233936dbc boot: reject GPT headers with SizeOfPartitionEntry below the minimum 8eb162df81 machined: drop superfluos 'supervisor' varlink input parameter for register method 0cb4245755 calendarspec: warn on weekday/date conflict in systemd-analyze and systemd-run 387df32dc2 test: ignore fails when the formatted timezone differs from the current one 6fff312839 pcrextend,tpm2-util,tpm2-setup: gracefully skip NvPCR when TPM NV space is exhausted 4f5dcef65d bless-boot: avoid false maybe-uninitialized warning a035cb3445 resolve: fix segfault when built with OPENSSL_NO_DEPRECATED_3_0 1f720ac2dd coredumpctl: use break instead of continue for time bound checks f07d32db0f man: add thread-awareness note to sd_bus/sd_event manpages c12e4a6e28 man: note that sd-tmpfiles/sysusers --root is not a sandboxing feature 3e5fdf2835 vmspawn/nspawn: Always use a per-machine runtime subdirectory 924727469e meson: fix fs.exists() check for fuzz corpus samples 59e87bb61a compress: handle ZSTD_CONTENTSIZE_UNKNOWN when decompressing blobs 97369d584a docs: Update memory pressure docs for latest GLib support for it dc8ce44f48 test: suppress fails on the Africa/Tripoli (Libya) timezone e61272caf1 ukify: show all sections and profiles in inspect JSON output 35178b46b7 test: add test case for show_menu() f99cc27984 terminal-util: drop assert() on 'x' 8a6900b8fe terminal-util: make sure we never go below 10 characters line width 380432f43a terminal-util: use LESS_BY() where appropriate 8f62acc860 terminal-util: calculate array index only once c547cddab9 bpf-restrict-fs: use a 32-bit magic key on big-endian too ce595a30c1 core/scope: don't assert when start is retried during cgroup chown 337cc13d8b core: donate the fdset to do_reexecute() to avoid a double free a8d535fb55 run: refuse --no-block when combined with --scope cfeae2790c shared/install: give the borrowed name back before bailing on error 7d0f473cb9 quotacheck: don't apply an invalid quotacheck.mode= value c4fe868f7b core: avoid using uninitialized buffer on bad systemd.random_seed= 256465f3f7 tree-wide: fix return type of sysconf() cce527de38 memory-util: don't use 'r' for non-int returns c9248545a5 build(deps): bump the actions group with 6 updates 8d8f9c1e39 man: update description for sd_device_enumerator_add_match_subsystem 9836c4ab8c test: reduce number of disks in TEST-64-UDEV-STORAGE-simultaneous_events on Debian/Ubuntu de01a0f78f sd-journal: rate-limit tail timestamp refresh during iteration 2db85c4e1c man: fix wrong KillUserProcesses= default in systemd-run(1) 114df0eeab ptyfwd: avoid touching forwarder after exit drain 3c06c9e4ad boot/random-seed: create \loader\ dir if missing when seeding 903f1d1dc6 env-util: ensure NUL termination of the replace_env_argv() output array 9d3da650d0 fido2: reject zero-length HMAC secret 2674591913 ssl-util: set log level to debug in dlopen_many_sym_or_warn() 80f8a1124a resolvectl: fix JSON reply cleanup in varlink_dump_dns_configuration a22d428609 exec-invoke: fix wrong errno in log_error_errno for setenv failure b9ec917f14 crypto-util: set log level to debug in dlopen_many_sym_or_warn() 26916eda27 luo-util: use new LIVEUPDATE_SESSION_GET_NAME ioctl to get session name if available 8b45e907e7 Import linux/liveupdate.h UAPI header from 7.2-rc1 d76499f0b4 portable: leave room for trailing NUL in metadata receive buffer ae34b3441d man: document that $XDG_CONFIG_HOME affects environment.d lookup path 14ec524c1f shared/varlink: fix license of varlink-io.systemd.Udev.c eeb5862a0b test: drop ASAN workaround in TEST-07-PID1.issue-14566 cc0c446e10 test: use /run/ for temporary files in TEST-07-PID1.issue-14566 5827c35fd8 test: make TEST-07-PID1.issue-14566 more robust 5323aefd49 mkosi: fix license of mkosi.finalize 2bb7b1ae7c shell-completion: add missing commands and options to timedatectl zsh 1fc65de3b4 tmpfiles: fix device node major:minor logging to use i->major_minor dd6c1c63de logind: fix typo in reboot-to-boot-loader-entry path b8418ff33a journal-verify: fix offset reported for tail hash mismatch 38d246a627 tmpfiles: propagate clean_item_instance() error in clean_item() df9ffa2309 Correct allocation size computation in xescape_full 71fc09c47e vmspawn: complain loudly if we can't prepare a unix socket for virtiofsd 06f2b81cc9 mkosi: pull new split-out packages for deb/ubuntu 73b089c099 journal-importer: avoid false maybe-uninitialized warning cc674bbeca test: relax grep for DNS query refusal 6a5feb213e sd-json: Fix validation of optional fields within a mandatory struct 1e133c189e man: fix first argument in Environment= expansion example 0f1a2cde63 mkosi: update debian commit reference to 8e947316488c163321665a60766dbc972e9edf7a
Ross Burton [Wed, 5 Aug 2026 11:36:34 +0000 (12:36 +0100)]
python3-packaging: upgrade 26.2 -> 26.3
- Add a public VersionRange API and SpecifierSet.to_range(),
representing the versions a specifier set accepts as an interval set
that supports intersection, union, difference, complement, set
relations, membership tests, and filtering.
VersionRange.to_specifier_set() converts a range back to a
SpecifierSet where a PEP 440 form exists.
- PEP 808: accept Metadata-Version: 2.6.
- Add a limit argument to parse_tag() for compressed tag sets.
- Add a prefer_sdist_predicate argument to Pylock.select() to prefer
source distributions over wheels for selected packages.
- Add pure_python_tags() to generate the pure-Python tags for a Python
version without touching the running platform.
- Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and
SpecifierSet.is_disjoint(), which compare the versions two specifier
sets accept.
- Drop support for Python 3.8; packaging now requires Python 3.9 or
later.
- Prefer native linux_* platform tags over manylinux and musllinux tags
on Linux. - Add a musl/Alpine test job and make the test suite pass on
musl.
The tests now work on musl so don't skip the manylinux tests.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oe-selftest: devtool ide-sdk: add test for ide=none LLDB/clang support
Add test_devtool_ide_sdk_none_cmake_clang to DevtoolIdeSdkTests to
exercise the new LldbServerConfigNone code path in ide_none.py.
The test uses the cmake-example-clang recipe (TOOLCHAIN = "clang") and
runs devtool ide-sdk with --ide=none. It verifies:
- lldb_server_<port>_<binary>_multi script is generated
- lldbinit/lldbinit_<port>_<binary> init file is generated
- lldb_<port>_<binary> wrapper script is generated
- No gdbserver_* script is generated for a clang recipe
- The install_and_deploy script exists
- The oe-scripts symlink inside the source tree is valid
- lldb-server can be started on the target via the generated script
- The pid file written by the start script references the live process
- An lldb --batch session using the generated wrapper reaches main and
can evaluate CppExample::test_string at the breakpoint
- lldb-server stops cleanly via the generated stop script
A new helper _lldb_none_debugging_multi is added alongside the
existing _gdb_cross_debugging_multi, following the same structure.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Add test_devtool_ide_sdk_code_cmake_clang to verify the full devtool
ide-sdk workflow for a cmake recipe built with clang. Unlike the gcc
variant the clang recipe uses lldb-server for remote debugging and
CodeLLDB (vadimcn.vscode-lldb) as the VS Code debug adapter.
The test covers:
- devtool modify + devtool ide-sdk with ide=code
- cmake preset compilation and CTest execution (same as the gcc test)
- extensions.json recommends vadimcn.vscode-lldb
- launch.json uses "type": "lldb" (CodeLLDB) instead of "type": "cppdbg"
- End-to-end lldb --batch remote debugging session via lldb-server
platform mode running on qemu
Supporting changes:
- _write_bb_config: accept optional extra_packages parameter so the
clang test can add lldb-server to IMAGE_INSTALL
- _verify_launch_json_lldb: new helper that validates the CodeLLDB
launch.json structure (type, initCommands, program, cwd, preLaunchTask)
- _lldb_server_debugging_once: new helper that reads the preLaunchTask
SSH command from tasks.json, starts lldb-server on the target, and
runs lldb --batch to verify a breakpoint at main is hit
- _verify_service_running: use pgrep with exact regex (^name$) for exact
process name matching; without that, pgrep would also match
cmake-example-clang (truncated to 'cmake-example-c' in
/proc/pid/comm) when checking for cmake-example, returning two PIDs
and failing the isdigit() assertion
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
meta-selftest: refactor cpp examples into .inc files and add clang variants
Refactor cmake-example.bb and meson-example.bb to extract common
build logic into separate .inc files. Add clang variants of both
examples to enable testing with alternative toolchains.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk: add LLDB support for ide=none (clang toolchain)
Bring ide=none to feature parity with ide=code for clang recipes by
adding LldbServerConfigNone and dispatching on the toolchain in
IdeNone.setup_modified_recipe.
Three files are generated per binary when toolchain == 'clang':
lldb_server_<port>_<binary>_<mode>
Shell script with start/stop logic (same pattern as the existing
gdbserver_* scripts). Passes the lldb-server SSH command produced
by LldbServerConfig._target_start_cmd, which already includes the
/proc/net/tcp readiness poll for MULTI mode.
lldbinit/lldbinit_<port>_<binary>
Init file sourced by lldb via -s. Sets up the remote platform
connection, source maps, debug-file-search-paths and
exec-search-paths, then creates the target with
"target create --remote-file <target_path> <host_debug_binary>".
lldb_<port>_<binary>
Wrapper script: cd <srctree> && lldb -s <lldbinit> "$@"
Supporting changes:
LldbServerConfig (ide_plugins/__init__.py): add server_script_file /
server_script, which were left as NotImplementedError in the base
class. Required for LldbServerConfigNone to write its start scripts
to the correct paths.
RecipeLldbNative (ide_sdk.py): rename _lldb -> lldb (plain attribute),
matching the RecipeGdbCross.gdb convention so that ide_none.py can
access the host lldb binary path without going through a property.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk add LLDB support for clang toolchain
Add support for LLDB (CodeLLDB) remote debugging in VSCode when using
the clang toolchain. This includes:
- New LldbServerConfig class for configuring lldb-server on the target
- LldbServerConfigVSCode for VSCode-specific LLDB configuration
- RecipeLldbNative to handle lldb-native (architecture-agnostic) on the
host
- CodeLLDB VSCode extension recommendation for clang toolchain
- Launch configuration generator for LLDB debugging
- Proper handling of source maps and debug symbol paths for LLDB
Meson/ninja invoke the compiler with source paths relative to the build
directory B, rather than absolute paths. -fdebug-prefix-map and
-ffile-prefix-map only rewrite paths that literally start with the
mapped host prefix, so this relative DW_AT_name is never rewritten;
only the absolute DW_AT_comp_dir is. When resolving the compile unit
path, debuggers join comp_dir with the relative name, popping one
component per leading "..". In devtool workspaces the source directory
S is relocated far away from the build directory B (outside WORKDIR),
so DW_AT_name typically contains more ".." components than comp_dir
has path components. Once the join reaches "/", extra ".." are no-ops,
so the resolved path becomes "/" plus the leftover suffix of DW_AT_name
- a suffix of the real absolute source directory, not the
"/usr/src/debug/<pn>/<pv>" prefix that DEBUG_PREFIX_MAP and the
generated sourceMap assume.
Compute this "broken" resolved suffix for the recipe's own source
directory and use it instead of the original comp_dir-based mapping.
Keeping both mappings would point two different debug-info paths at
the same host path, which is ambiguous when CodeLLDB needs to reverse
the mapping (translating a locally opened file back into a debug-info
path to resolve a breakpoint): it picks the first-registered
("normal") mapping, which never matches any real compile unit here,
leaving breakpoints stuck pending with 0 locations.
Also set launch.json's relativePathBase to the build directory B, so
CodeLLDB resolves any source path that is still relative (i.e. not
covered by sourceMap/target.source-map) against B - the compiler's
working directory - instead of the default ${workspaceFolder}, which
does not necessarily match B in devtool workspaces.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk: wait for gdbserver port before returning
In MULTI mode, gdbserver is started as a background process and the SSH
command returned immediately, leaving a race between the caller
connecting to gdbserver and gdbserver finishing its bind()/listen()
sequence.
The race condition was observed with lldb-server not with gdbserver, but
it is likely to affect both. It might be a fix for gdbserver as well,
but at least it is a preparatory step for adding LLDB support, which is
the next planned item.
There are two possible synchronisation points:
- The pid file: written by the shell immediately after fork(), before
gdbserver has called bind() or listen() — not useful as a readiness
signal.
- /proc/net/tcp: the port entry appears after remote_prepare() completes
socket()+bind()+listen(), which is the earliest point at which
gdbserver will accept a connection.
Replace the pid-file idempotency check with a /proc/net/tcp port check
so that:
- the SSH command doubles as a readiness probe (exits only when
gdbserver is actually listening, or after a 10 s timeout with exit 1)
- re-running the start command while the server is already up is still
a no-op
The VSCode task for MULTI mode is changed accordingly: since the SSH
command now exits as soon as the server is ready, VSCode no longer
needs isBackground + a pattern matcher — a plain task with an empty
problemMatcher suffices.
The pid file is still written so that the stop script can kill the
server by PID.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Refactor the devtool ide-sdk support for remote debugging with
gdbserver. The main goal is to cleanly separate the generation of the
host-side debugger configuration (gdbinit, wrapper scripts) from the
IDE-specific launch/task config generation, and to provide a common
interface for supporting multiple debug server back-ends (gdbserver,
lldb-server) in the future.
Also: skip building gdb-cross for clang-toolchain recipes
(toolchain == 'gcc' guard). Clang recipes will use lldb-server instead
of gdbserver in the future. For gcc recipes the behaviour is unchanged.
Also fix a typo in the GDB configuration generator where the property
was named "is_c_ccp" instead of "is_c_cpp".
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
oe-selftest: devtool ide-sdk: add real debug coverage for meson+code
test_devtool_ide_sdk_code_meson never booted qemu-system (missing
@OETestTag("runqemu") and runqemu()), passed a hardcoded, non-existent
target address (root@192.168.17.17), and only checked _gdb_cross()
(gdb-cross --version). It never validated the generated launch.json
nor performed an actual remote debugging session, unlike its cmake
sibling test_devtool_ide_sdk_code_cmake.
Bring it to parity with test_devtool_ide_sdk_code_cmake: boot
qemu-system, use the real qemu.ip as target address, and call
_verify_launch_json() plus _verify_launch_json_debugging() to exercise
a genuine gdbserver-based debug session through the generated
launch.json/tasks.json. This closes the last gap in the 2x2 matrix of
build system (cmake/meson) x ide mode (code/none): all four
combinations now have real breakpoint-debugging coverage.
_verify_launch_json_debugging() matched the 'once' debug configuration
by looking for "usr-bin-{recipe_name}_once" in its name. But the
config name is derived from the binary's install path, so it is
"usr-bin-{example_exe}_once". This happened to work for cmake-example,
where the binary name equals the recipe name, but not for
meson-example, whose recipe name is 'meson-example' while the
installed binary is 'mesonex'. Match on example_exe instead, and drop
the now-unused recipe_name parameter.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
oe-selftest: devtool ide-sdk: cover breakpoints in exe, header and library
_gdb_debug_cpp_example() already set breakpoints in the executable
(cpp-example.cpp, by file:line) and the library (CppExample::print_json()
in cpp-example-lib.cpp, by symbol), plus a 'list' (not a breakpoint) of
the test_string declaration in the shared header cpp-example-lib.hpp.
There was no actual breakpoint set on code that lives in the header
itself, and no file:line breakpoint set inside the library's own .cpp
file.
Add CppExample::scale_number(), a trivial inline function defined
directly in cpp-example-lib.hpp (not in a .cpp file), and call it from
cpp-example.cpp's std::vector traversal loop. Set a breakpoint on it by
file:line (cpp-example-lib.hpp, conditioned on n == 1 since the loop
calls it once per vector element) and verify it is hit with the
expected value.
Also set a second, file:line breakpoint directly inside the library's
own print_json() body (cpp-example-lib.cpp), in addition to the
existing symbol breakpoint on print_json() itself. A symbol breakpoint
only needs the function's entry address and resolves the same whether
the debugger picks up stale or freshly rebuilt debug info for the
library, since it doesn't rely on the library's own line-to-address
mapping being fresh; a file:line breakpoint does, making it the only
breakpoint in this test that actually exercises solib-search-path debug
info resolution for the library.
The second _gdb_cross_debugging_multi() call (after the code
change/recompile/redeploy cycle) originally reused the exact same
file:line breakpoints as the first call. A stale/incorrect
line-to-address mapping left over from the previous build could in
principle still resolve to a plausible address at the same line
number, without that being noticed. To close that gap, parameterize
the exe, header and library file:line breakpoints
(exe_break_line/exe_list_line/hpp_break_line/lib_break_line) through
_gdb_debug_cpp_example(), _gdb_debug_cpp_example_check() and
_gdb_cross_debugging_multi(). Insert LINE_SHIFT (3) extra lines right
before the targeted statements in cpp-example.cpp,
cpp-example-lib.hpp and cpp-example-lib.cpp as part of the existing
code-change step, and use the shifted line numbers for the second
debug session.
Together, this exercises breakpoint resolution for header-only debug
info, the executable's own file:line breakpoint, the library's symbol
breakpoint and the library's own file:line breakpoint as distinct code
paths, and proves all of them are resolved against the freshly rebuilt
debug info after a recompile/redeploy, rather than a stale/cached
mapping from the previous build.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: deploy-target: fix run strip under pseudo
Any file modification on pseudo-tracked files must happen inside the
pseudo fakeroot environment so the pseudo database stays in sync with
the real filesystem. Stripping was done outside pseudo, which is
conceptually wrong: tools that replace files (temp+rename) change
inodes, and pseudo loses track of the new inodes, causing the
deployment tar to embed incorrect ownership and permissions.
This probably went unnoticed because GNU strip modifies files in place without
changing their inodes. llvm-strip replaces files via a temp file and
rename, making the ownership corruption visible.
The old code was manually prepending path to the parent process's PATH
so strip_cmd could be found, then restoring it. The new code passes the
strip script to exec_fakeroot_no_d, which already sets PATH = path in
the subprocess's environment — so strip_cmd is findable there without
touching the parent's PATH at all.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Harish Sadineni [Wed, 5 Aug 2026 17:46:39 +0000 (10:46 -0700)]
kernel-yocto-rust: Add clang toolchain check for riscv64
Rust support in the upstream kernel on riscv64 currently requires the
LLVM/Clang toolchain and does not work with gcc [1]. Add a sanity check to skip
the recipe if TOOLCHAIN is not set to "clang" when building a riscv64 kernel with
rust support enabled, point the user to the local.conf change needed to fix it.
Peter Marko [Wed, 5 Aug 2026 18:38:45 +0000 (20:38 +0200)]
libarchive: set status for CVE-2026-4424
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
These are RedHat CVEs listing version-less or distro versions.
Release 3.8.7 notes [1] contain reference to pull [2] from NVD report.
Peter Marko [Wed, 5 Aug 2026 18:38:44 +0000 (20:38 +0200)]
gnutls: set status for CVE-2026-42010 and CVE-2026-42010
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
These are RedHat CVEs listing version-less or distro versions.
These CVEs are listed in commit upgrading to 3.8.13.
Also Debian CVE reports link commit in this release.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 5 Aug 2026 17:28:40 +0000 (19:28 +0200)]
ppp: set status for CVE-2020-15704
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:39 +0000 (19:28 +0200)]
openssl: set status for CVE-2015-3216
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:37 +0000 (19:28 +0200)]
pulseaudio: set status for CVE-2020-15710 and CVE-2020-16123
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:36 +0000 (19:28 +0200)]
ovmf: set status of CVE-2017-5731 and CVE-2019-14584
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
OVMF has a generic problem that version is encoded in different ways.
Both CVE have their fixed version in NVD CVE reports encoded as
YYYY-MM-DD...
CVE-2017-5731 additionally predates tags in vurrent git repository.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 5 Aug 2026 17:28:35 +0000 (19:28 +0200)]
glibc: set status for CVE-2011-0536 and CVE-2025-0577
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
* CVE-2011-0536: CVE desciption says it's related to RedHat patches
* CVE-2025-0577: [1] linked CVE report says it's related to RedHat
patches and no upstream release is impacted
Peter Marko [Wed, 5 Aug 2026 17:28:34 +0000 (19:28 +0200)]
gnutls: set status for CVE-2023-0361
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
EGLIBC_KNOWN_INTERPRETER_NAMES is assigned in glibc-ld.inc, and then
in do_patch() the magic string OECORE_KNOWN_INTERPRETER_NAMES is replaced
with its value.
OECORE_KNOWN_INTERPRETER_NAMES was removed in the glibc 2.37 upgrade[1]
as the relevant code was removed from glibc[2], so this is now obsolete
and can be removed.
[1] oe-core 1bba40755c8 ("glibc: Upgrade to 2.37 release")
[2] glibc 8ee878592c ("Assume only FLAG_ELF_LIBC6 suport")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 5 Aug 2026 16:03:20 +0000 (17:03 +0100)]
glibc: remove obsolete KSHELL assignment
KSHELL was set so that tzselect uses /bin/sh instead of /bin/bash.
This variable doesn't exist in glibc and instead we patch the script in
0019-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch, so we can
remove this assignment.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
